npm - run402 - Versions diffs - 2.40.0 → 2.41.1 - Mend

run402 2.40.0 → 2.41.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (18) hide show

package/lib/operator.mjs +48 -7
package/package.json +1 -1
package/sdk/dist/control-plane-credentials.d.ts +45 -0
package/sdk/dist/control-plane-credentials.d.ts.map +1 -0
package/sdk/dist/control-plane-credentials.js +57 -0
package/sdk/dist/control-plane-credentials.js.map +1 -0
package/sdk/dist/index.d.ts +4 -0
package/sdk/dist/index.d.ts.map +1 -1
package/sdk/dist/index.js +2 -0
package/sdk/dist/index.js.map +1 -1
package/sdk/dist/namespaces/operator-session.d.ts +223 -0
package/sdk/dist/namespaces/operator-session.d.ts.map +1 -0
package/sdk/dist/namespaces/operator-session.js +230 -0
package/sdk/dist/namespaces/operator-session.js.map +1 -0
package/sdk/dist/namespaces/operator.d.ts +10 -0
package/sdk/dist/namespaces/operator.d.ts.map +1 -1
package/sdk/dist/namespaces/operator.js +11 -0
package/sdk/dist/namespaces/operator.js.map +1 -1

package/lib/operator.mjs CHANGED Viewed

@@ -147,6 +147,10 @@ function startLoopbackServer({ expectedState, timeoutMs }) {
     rejectCode = rej;
   });
   let timer;
+  // Track live sockets: server.close() alone stops NEW connections but leaves
+  // the browser's keep-alive socket open, which keeps Node's event loop alive
+  // and hangs the CLI after a successful login. close() must destroy them.
+  const sockets = new Set();
   const server = createServer((req, res) => {
     let u;
     try {
@@ -162,19 +166,32 @@ function startLoopbackServer({ expectedState, timeoutMs }) {
     const code = u.searchParams.get("code");
     const gotState = u.searchParams.get("state");
     const errParam = u.searchParams.get("error");
-    res.writeHead(200, { "content-type": "text/html" });
+    // `connection: close` so the browser does not keep the socket alive.
+    res.writeHead(200, { "content-type": "text/html", connection: "close" });
     res.end(
       "<!doctype html><html><body style=\"font-family:system-ui;padding:3rem\">" +
         "<h2>run402 - you're signed in.</h2><p>You can close this window and return to your terminal.</p></body></html>",
     );
-    cleanup();
+    // Do NOT tear down here — let the response flush. The caller calls close()
+    // once it has the code (or on any failure path).
     if (errParam) rejectCode(new Error(`authorization error: ${errParam}`));
     else if (!code) rejectCode(new Error("no authorization code on the loopback redirect"));
     else if (gotState !== expectedState) rejectCode(new Error("state mismatch on the loopback redirect (possible CSRF) - aborted"));
     else resolveCode(code);
   });
-  function cleanup() {
+  server.on("connection", (s) => {
+    sockets.add(s);
+    s.once("close", () => sockets.delete(s));
+  });
+  function close() {
     clearTimeout(timer);
+    for (const s of sockets) {
+      try {
+        s.destroy();
+      } catch {
+        // already gone
+      }
+    }
     try {
       server.close();
     } catch {
@@ -182,18 +199,18 @@ function startLoopbackServer({ expectedState, timeoutMs }) {
     }
   }
   timer = setTimeout(() => {
-    cleanup();
+    close();
     rejectCode(new Error("timed out waiting for browser approval"));
   }, timeoutMs);
   server.on("error", (e) => {
-    cleanup();
+    close();
     rejectCode(e);
   });
   const ready = new Promise((res, rej) => {
     server.once("error", rej);
     server.listen(0, "127.0.0.1", () => res(server.address().port));
   });
-  return { ready, codePromise, close: cleanup };
+  return { ready, codePromise, close };
 }
 /**
@@ -242,13 +259,37 @@ async function loopbackLogin(args, { stepUp }) {
   try {
     session = await sdk.operator.exchangeCliToken({ code, codeVerifier, redirectUri, state });
   } catch (err) {
+    close();
     return reportSdkError(err);
   }
+  // The loopback server has done its job. Tear it down (destroying any
+  // keep-alive socket) so Node's event loop drains and the CLI exits instead
+  // of hanging until Ctrl+C.
+  close();
   const cached = controlPlaneSessionFromTokenResponse(session);
   saveControlPlaneSession(cached);
   process.stderr.write(`\nSigned in (write-capable, provenance=${cached.provenance}).\n`);
-  console.log(JSON.stringify(controlPlaneView(cached)));
+  // Surface org memberships — newly-active rows are invites auto-claimed at this
+  // login (owner/admin invites only claim once a passkey is enrolled). Best-effort:
+  // login already succeeded, so a whoami hiccup must not fail the command.
+  const view = controlPlaneView(cached);
+  try {
+    const who = await sdk.operator.session.whoami({ token: session.control_plane_session_token });
+    const memberships = Array.isArray(who?.memberships) ? who.memberships : [];
+    view.memberships = memberships;
+    if (memberships.length) {
+      process.stderr.write(
+        `Member of ${memberships.length} org(s):\n` +
+          memberships.map((m) => `  - ${m.billing_account_id} (${m.role}, ${m.status})`).join("\n") +
+          "\n",
+      );
+    }
+  } catch {
+    /* best-effort — the session is valid regardless of the whoami result */
+  }
+  console.log(JSON.stringify(view));
 }
 async function login(args) {

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "2.40.0",
+  "version": "2.41.1",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/dist/control-plane-credentials.d.ts ADDED Viewed

@@ -0,0 +1,45 @@
+/**
+ * Control-plane **session** credential provider (gateway v1.78). Carries a
+ * write-capable `control_plane_session` bearer so the whole SDK authenticates as
+ * the human principal — the token is "accepted everywhere a SIWX wallet is", so
+ * `r.org.*`, `r.admin.transfers.*`, and `r.operator.session.*` all act as that
+ * principal.
+ *
+ * Isomorphic — no Node APIs. Mint a session with `r.operator.session.verifyEmail`
+ * / `passkeyVerify` / the loopback-PKCE `exchangeCliToken`, then:
+ *
+ *   const r = run402({ credentials: controlPlaneSessionCredentials({ token }) });
+ *   await r.org.whoami();            // resolves the principal + memberships
+ *
+ * High-stakes writes still require a fresh passkey — an `email`/`oauth` session
+ * gets {@link StepUpRequiredError}; run the step-up ceremony
+ * (`r.operator.session.stepUpOptions`/`stepUpVerify`) and retry.
+ *
+ * This credential authenticates control-plane operations only; it carries no
+ * project anon/service keys, so {@link CredentialsProvider.getProject} returns
+ * null (project-key operations need the keystore/wallet).
+ */
+import type { CredentialsProvider } from "./credentials.js";
+/** Brand marking a provider as control-plane-session-backed. */
+export declare const CONTROL_PLANE_SESSION_CREDENTIALS: unique symbol;
+export interface ControlPlaneSessionMarkedCredentialsProvider extends CredentialsProvider {
+    readonly [CONTROL_PLANE_SESSION_CREDENTIALS]: true;
+}
+export interface ControlPlaneSessionCredentialsOptions {
+    /** A `control_plane_session` bearer token. Provide this OR `getToken`. */
+    token?: string;
+    /**
+     * Lazily resolve the current token (e.g. read a cache, or rotate via
+     * `r.operator.session.refresh`). Called before every authenticated request.
+     */
+    getToken?: () => string | Promise<string>;
+}
+/** True if `credentials` was created by {@link controlPlaneSessionCredentials}. */
+export declare function isControlPlaneSessionCredentials(credentials: CredentialsProvider): credentials is ControlPlaneSessionMarkedCredentialsProvider;
+/**
+ * Build a {@link CredentialsProvider} that authenticates every request with a
+ * `control_plane_session` bearer. Pass a static `token`, or a `getToken`
+ * resolver for rotation.
+ */
+export declare function controlPlaneSessionCredentials(opts: ControlPlaneSessionCredentialsOptions): ControlPlaneSessionMarkedCredentialsProvider;
+//# sourceMappingURL=control-plane-credentials.d.ts.map

package/sdk/dist/control-plane-credentials.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"control-plane-credentials.d.ts","sourceRoot":"","sources":["../src/control-plane-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAGzE,gEAAgE;AAChE,eAAO,MAAM,iCAAiC,eAE7C,CAAC;AAEF,MAAM,WAAW,4CAA6C,SAAQ,mBAAmB;IACvF,QAAQ,CAAC,CAAC,iCAAiC,CAAC,EAAE,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,qCAAqC;IACpD,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,mFAAmF;AACnF,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,mBAAmB,GAC/B,WAAW,IAAI,4CAA4C,CAM7D;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,qCAAqC,GAC1C,4CAA4C,CA8B9C"}

package/sdk/dist/control-plane-credentials.js ADDED Viewed

@@ -0,0 +1,57 @@
+/**
+ * Control-plane **session** credential provider (gateway v1.78). Carries a
+ * write-capable `control_plane_session` bearer so the whole SDK authenticates as
+ * the human principal — the token is "accepted everywhere a SIWX wallet is", so
+ * `r.org.*`, `r.admin.transfers.*`, and `r.operator.session.*` all act as that
+ * principal.
+ *
+ * Isomorphic — no Node APIs. Mint a session with `r.operator.session.verifyEmail`
+ * / `passkeyVerify` / the loopback-PKCE `exchangeCliToken`, then:
+ *
+ *   const r = run402({ credentials: controlPlaneSessionCredentials({ token }) });
+ *   await r.org.whoami();            // resolves the principal + memberships
+ *
+ * High-stakes writes still require a fresh passkey — an `email`/`oauth` session
+ * gets {@link StepUpRequiredError}; run the step-up ceremony
+ * (`r.operator.session.stepUpOptions`/`stepUpVerify`) and retry.
+ *
+ * This credential authenticates control-plane operations only; it carries no
+ * project anon/service keys, so {@link CredentialsProvider.getProject} returns
+ * null (project-key operations need the keystore/wallet).
+ */
+import { LocalError } from "./errors.js";
+/** Brand marking a provider as control-plane-session-backed. */
+export const CONTROL_PLANE_SESSION_CREDENTIALS = Symbol.for("@run402/sdk/control-plane-session-credentials");
+/** True if `credentials` was created by {@link controlPlaneSessionCredentials}. */
+export function isControlPlaneSessionCredentials(credentials) {
+    return Boolean(credentials[CONTROL_PLANE_SESSION_CREDENTIALS]);
+}
+/**
+ * Build a {@link CredentialsProvider} that authenticates every request with a
+ * `control_plane_session` bearer. Pass a static `token`, or a `getToken`
+ * resolver for rotation.
+ */
+export function controlPlaneSessionCredentials(opts) {
+    if (!opts?.token && !opts?.getToken) {
+        throw new LocalError("controlPlaneSessionCredentials requires token or getToken", "creating control-plane session credentials");
+    }
+    const provider = {
+        async getAuth() {
+            const token = opts.getToken ? await opts.getToken() : opts.token;
+            if (!token) {
+                throw new LocalError("control-plane session credentials did not return a token", "authenticating with control-plane session");
+            }
+            return { Authorization: `Bearer ${token}` };
+        },
+        async getProject() {
+            // A control-plane session carries no project anon/service keys.
+            return null;
+        },
+    };
+    Object.defineProperty(provider, CONTROL_PLANE_SESSION_CREDENTIALS, {
+        value: true,
+        enumerable: false,
+    });
+    return provider;
+}
+//# sourceMappingURL=control-plane-credentials.js.map

package/sdk/dist/control-plane-credentials.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"control-plane-credentials.js","sourceRoot":"","sources":["../src/control-plane-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,gEAAgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CACzD,+CAA+C,CAChD,CAAC;AAgBF,mFAAmF;AACnF,MAAM,UAAU,gCAAgC,CAC9C,WAAgC;IAEhC,OAAO,OAAO,CACX,WAAqE,CACpE,iCAAiC,CAClC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,IAA2C;IAE3C,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,UAAU,CAClB,2DAA2D,EAC3D,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAwB;QACpC,KAAK,CAAC,OAAO;YACX,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACjE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,UAAU,CAClB,0DAA0D,EAC1D,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,UAAU;YACd,gEAAgE;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,iCAAiC,EAAE;QACjE,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,OAAO,QAAwD,CAAC;AAClE,CAAC"}

package/sdk/dist/index.d.ts CHANGED Viewed

@@ -181,6 +181,8 @@ export type * from "./credentials.js";
 export type * from "./kernel.js";
 export { CI_SESSION_CREDENTIALS, createCiSessionCredentials, githubActionsCredentials, isCiSessionCredentials, } from "./ci-credentials.js";
 export type * from "./ci-credentials.js";
+export { CONTROL_PLANE_SESSION_CREDENTIALS, controlPlaneSessionCredentials, isControlPlaneSessionCredentials, } from "./control-plane-credentials.js";
+export type * from "./control-plane-credentials.js";
 export { Deploy } from "./namespaces/deploy.js";
 export { EMPTY_STATIC_MANIFEST_METADATA, ROUTE_HTTP_METHODS, buildDeployResolveSummary, isDeployResolveRouteHit, isDeployResolveStaticHit, normalizeDeployResolveRequest, normalizeStaticManifestMetadata, summarizeDeployResult, } from "./namespaces/deploy.types.js";
 export { Ci, CI_AUDIENCE, CI_GITHUB_ACTIONS_ISSUER, CI_GITHUB_ACTIONS_PROVIDER, DEFAULT_CI_DELEGATION_CHAIN_ID, V1_CI_ALLOWED_ACTIONS, V1_CI_ALLOWED_EVENTS_DEFAULT, assertCiDeployableSpec, buildCiDelegationResourceUri, buildCiDelegationStatement, normalizeCiRouteScopes, normalizeCiDelegationValues, validateCiNonce, validateCiRouteScope, validateCiSubjectMatch, } from "./namespaces/ci.js";
@@ -204,6 +206,8 @@ export type * from "./namespaces/email.js";
 export type * from "./namespaces/functions.types.js";
 export type * from "./namespaces/jobs.js";
 export type * from "./namespaces/operator.js";
+export { OperatorSession } from "./namespaces/operator-session.js";
+export type * from "./namespaces/operator-session.js";
 export { Org, OrgMembers, OrgInvites } from "./namespaces/org.js";
 export type * from "./namespaces/org.types.js";
 export { Grants } from "./namespaces/grants.js";

package/sdk/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,qBAAa,MAAM;;IACjB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAG,EAAE,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAIZ,IAAI,EAAE,aAAa;IAmE/B;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBjD;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKnD;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAiBhC;AAED,uCAAuC;AACvC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAEpE;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAElD;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,mBAAmB,YAAY,CAAC;AAChC,mBAAmB,kBAAkB,CAAC;AACtC,mBAAmB,aAAa,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,mBAAmB,qBAAqB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,oBAAoB,CAAC;AACxC,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,8BAA8B,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,iCAAiC,CAAC;AACrD,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,0BAA0B,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAClE,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,gCAAgC,CAAC;AACpD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,+BAA+B,CAAC;AACnD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,4BAA4B,CAAC;AAChD,mBAAmB,sBAAsB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,qBAAa,MAAM;;IACjB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAG,EAAE,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAIZ,IAAI,EAAE,aAAa;IAmE/B;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBjD;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKnD;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAiBhC;AAED,uCAAuC;AACvC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAEpE;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAElD;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,mBAAmB,YAAY,CAAC;AAChC,mBAAmB,kBAAkB,CAAC;AACtC,mBAAmB,aAAa,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,mBAAmB,qBAAqB,CAAC;AACzC,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,mBAAmB,gCAAgC,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,oBAAoB,CAAC;AACxC,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,8BAA8B,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,iCAAiC,CAAC;AACrD,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,0BAA0B,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,mBAAmB,kCAAkC,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAClE,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,gCAAgC,CAAC;AACpD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,+BAA+B,CAAC;AACnD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,4BAA4B,CAAC;AAChD,mBAAmB,sBAAsB,CAAC"}

package/sdk/dist/index.js CHANGED Viewed

@@ -241,11 +241,13 @@ export function run402(opts) {
 export { Run402Error, PaymentRequired, ProjectNotFound, Unauthorized, NotAuthorizedError, ApiError, NetworkError, LocalError, Run402DeployError, TransferFreezeError, StepUpRequiredError, isRun402Error, isPaymentRequired, isProjectNotFound, isUnauthorized, isNotAuthorized, isApiError, isNetworkError, isLocalError, isDeployError, isTransferFreezeError, isStepUpRequired, isRetryableRun402Error, getQuotaScope, } from "./errors.js";
 export { withRetry } from "./retry.js";
 export { CI_SESSION_CREDENTIALS, createCiSessionCredentials, githubActionsCredentials, isCiSessionCredentials, } from "./ci-credentials.js";
+export { CONTROL_PLANE_SESSION_CREDENTIALS, controlPlaneSessionCredentials, isControlPlaneSessionCredentials, } from "./control-plane-credentials.js";
 export { Deploy } from "./namespaces/deploy.js";
 export { EMPTY_STATIC_MANIFEST_METADATA, ROUTE_HTTP_METHODS, buildDeployResolveSummary, isDeployResolveRouteHit, isDeployResolveStaticHit, normalizeDeployResolveRequest, normalizeStaticManifestMetadata, summarizeDeployResult, } from "./namespaces/deploy.types.js";
 export { Ci, CI_AUDIENCE, CI_GITHUB_ACTIONS_ISSUER, CI_GITHUB_ACTIONS_PROVIDER, DEFAULT_CI_DELEGATION_CHAIN_ID, V1_CI_ALLOWED_ACTIONS, V1_CI_ALLOWED_EVENTS_DEFAULT, assertCiDeployableSpec, buildCiDelegationResourceUri, buildCiDelegationStatement, normalizeCiRouteScopes, normalizeCiDelegationValues, validateCiNonce, validateCiRouteScope, validateCiSubjectMatch, } from "./namespaces/ci.js";
 export { ScopedRun402 } from "./scoped.js";
 export { Transfers } from "./namespaces/transfers.js";
+export { OperatorSession } from "./namespaces/operator-session.js";
 export { Org, OrgMembers, OrgInvites } from "./namespaces/org.js";
 export { Grants } from "./namespaces/grants.js";
 //# sourceMappingURL=index.js.map

package/sdk/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAkC,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,MAAM,OAAO,MAAM;IACR,QAAQ,CAAW;IACnB,MAAM,CAAS;IACf,SAAS,CAAY;IACrB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,UAAU,CAAa;IACvB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,SAAS,CAAY;IACrB,EAAE,CAAK;IACP,KAAK,CAAM;IACX,IAAI,CAAO;IACX,YAAY,CAAe;IAC3B,OAAO,CAAU;IACjB,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,KAAK,CAAQ;IACb,SAAS,CAAY;IACrB,KAAK,CAAQ;IACtB;;;;;;OAMG;IACM,YAAY,CAAS;IACrB,EAAE,CAAK;IACP,IAAI,CAAO;IACpB;;;OAGG;IACM,QAAQ,CAAW;IAC5B;;;;;OAKG;IACM,GAAG,CAAM;IAClB;;;OAGG;IACM,MAAM,CAAS;IAEf,OAAO,CAAS;IAEzB,YAAY,IAAmB;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,mCAAmC,EACnC,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,mDAAmD,EACnD,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,gKAAgK,EAChK,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IACE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,KAAK,UAAU;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,KAAK,UAAU,EACjD,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,+EAA+E,EAC/E,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;YACtD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,MAAM,GAAW,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE;YACnC,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,OAAO,CAAC,EAAW;QACvB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,IAAI,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;QACxC,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;QACrE,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB;YAC1C,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC;QACT,OAAO;YACL,WAAW,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI;YACnC,YAAY,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;YACrC,OAAO;YACP,aAAa,EAAE,aAAa,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;CACF;AAcD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,KAAK,CAAC,MAAqC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAmB;IACxC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AAOrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiBtD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAkC,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,MAAM,OAAO,MAAM;IACR,QAAQ,CAAW;IACnB,MAAM,CAAS;IACf,SAAS,CAAY;IACrB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,UAAU,CAAa;IACvB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,SAAS,CAAY;IACrB,EAAE,CAAK;IACP,KAAK,CAAM;IACX,IAAI,CAAO;IACX,YAAY,CAAe;IAC3B,OAAO,CAAU;IACjB,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,KAAK,CAAQ;IACb,SAAS,CAAY;IACrB,KAAK,CAAQ;IACtB;;;;;;OAMG;IACM,YAAY,CAAS;IACrB,EAAE,CAAK;IACP,IAAI,CAAO;IACpB;;;OAGG;IACM,QAAQ,CAAW;IAC5B;;;;;OAKG;IACM,GAAG,CAAM;IAClB;;;OAGG;IACM,MAAM,CAAS;IAEf,OAAO,CAAS;IAEzB,YAAY,IAAmB;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,mCAAmC,EACnC,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,mDAAmD,EACnD,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,gKAAgK,EAChK,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IACE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,KAAK,UAAU;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,KAAK,UAAU,EACjD,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,+EAA+E,EAC/E,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;YACtD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,MAAM,GAAW,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE;YACnC,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,OAAO,CAAC,EAAW;QACvB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,IAAI,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;QACxC,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;QACrE,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB;YAC1C,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC;QACT,OAAO;YACL,WAAW,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI;YACnC,YAAY,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;YACrC,OAAO;YACP,aAAa,EAAE,aAAa,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;CACF;AAcD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,KAAK,CAAC,MAAqC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAmB;IACxC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AAOrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiBtD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}

package/sdk/dist/namespaces/operator-session.d.ts ADDED Viewed

@@ -0,0 +1,223 @@
+/**
+ * `operator.session` — the hosted/browser control-plane **session** surface
+ * (gateway v1.78 `passkey-principals-onboarding`). The write-capable human
+ * principal: log in (email magic-link / passkey / Google / GitHub), manage the
+ * session (whoami / refresh / revoke), enrol a passkey, run a step-up ceremony,
+ * and manage authenticators + recovery codes.
+ *
+ * Reached as `r.operator.session.*`. Distinct from the read-only operator
+ * overview session (`r.operator.deviceStart`/`overview`) and from the CLI
+ * loopback-PKCE write-login (`r.operator.buildCliAuthorizeUrl`/`exchangeCliToken`,
+ * which is the headless variant of this same browser ceremony). All three are
+ * the one human principal; this group is the browser/console front door that the
+ * hosted login pages and `@run402/sdk` consumers call.
+ *
+ * Isomorphic — no Node APIs. The token model mirrors {@link Operator.overview}:
+ * the public *mint* methods (`email`/`verifyEmail`/`passkey*`/`consumeRecoveryCode`)
+ * send no auth (the body or the magic-link token IS the credential); the
+ * *session-bound* methods take `opts.token` to send the `control_plane_session`
+ * bearer explicitly, and fall back to the credential provider's default auth
+ * (e.g. {@link controlPlaneSessionCredentials} or a SIWX wallet) when omitted.
+ *
+ * WebAuthn option/assertion payloads are opaque passthroughs (`unknown`) — the
+ * browser runs the actual ceremony; a headless client cannot.
+ *
+ * High-stakes writes (invite, membership, handoff, delete) require a **fresh
+ * passkey** — a magic-link/OAuth session does NOT satisfy step-up, so the
+ * gateway returns {@link StepUpRequiredError}; `stepUpOptions`/`stepUpVerify`
+ * are how a long-lived session re-establishes that freshness.
+ */
+import type { Client } from "../kernel.js";
+import type { ControlPlaneSession } from "./operator.js";
+import type { Principal, OrgMembership } from "./org.types.js";
+/** OAuth identity providers bridged for control-plane login. */
+export type ControlPlaneOAuthProvider = "google" | "github";
+/** Generic, non-enumerating response from {@link OperatorSession.email}. */
+export interface MagicLinkSendResult {
+    status: string;
+    message: string;
+    [key: string]: unknown;
+}
+/**
+ * Result of {@link OperatorSession.consumeRecoveryCode} — a minted session that
+ * cannot perform high-stakes ops until a passkey is enrolled
+ * (`must_enroll_passkey: true`). Recovery `amr` never satisfies step-up.
+ */
+export interface RecoveryConsumeResult extends ControlPlaneSession {
+    must_enroll_passkey?: boolean;
+    note?: string;
+}
+/**
+ * Result of {@link OperatorSession.whoami} (`GET /agent/v1/control-plane/session`)
+ * — the live session's principal, every org membership (newly-active rows here
+ * are the auto-claimed invites), and the freshness substrate (`amr` + per-AMR
+ * `amr_times`) the step-up gate reads. Forward-compatible.
+ */
+export interface ControlPlaneWhoAmI {
+    principal: Principal;
+    memberships: OrgMembership[];
+    /** Auth methods satisfied on this session, e.g. `["passkey"]`. */
+    amr: string[];
+    /** Per-AMR last-proven time (epoch ms or ISO), the step-up freshness source. */
+    amr_times?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+/** Result of {@link OperatorSession.refresh} (`POST …/session/refresh`). */
+export interface ControlPlaneRefreshResult {
+    control_plane_session_token: string;
+    token_type?: string;
+    expires_in?: number;
+    [key: string]: unknown;
+}
+/** WebAuthn options envelope (`{ options }`) — opaque; handed to the browser. */
+export interface WebAuthnOptionsResult {
+    options: unknown;
+    [key: string]: unknown;
+}
+/** Result of {@link OperatorSession.enrollPasskeyVerify}. */
+export interface EnrollPasskeyResult {
+    status: string;
+    credential_id: string;
+    [key: string]: unknown;
+}
+/** Result of {@link OperatorSession.stepUpVerify}. */
+export interface StepUpVerifyResult {
+    status: string;
+    stepped_up: boolean;
+    [key: string]: unknown;
+}
+/** Result of {@link OperatorSession.issueRecoveryCodes} — shown ONCE. */
+export interface RecoveryCodesResult {
+    status: string;
+    recovery_codes: string[];
+    note?: string;
+    [key: string]: unknown;
+}
+/** One active authenticator (no secret material). Forward-compatible. */
+export interface Authenticator {
+    id: string;
+    kind: string;
+    [key: string]: unknown;
+}
+/** Result of {@link OperatorSession.revokeAuthenticator}. */
+export interface AuthenticatorRevokeResult {
+    status: string;
+    kind: string;
+    [key: string]: unknown;
+}
+/** Options bag carrying the optional `control_plane_session` bearer. */
+export interface SessionTokenOpts {
+    /**
+     * The `control_plane_session` bearer. When omitted, the request falls back to
+     * the credential provider's default auth (e.g. {@link controlPlaneSessionCredentials}).
+     */
+    token?: string;
+}
+export declare class OperatorSession {
+    private readonly client;
+    constructor(client: Client);
+    /**
+     * Send a control-plane sign-in magic link to `email`
+     * (`POST /agent/v1/control-plane/session/email`). Non-enumerating: an
+     * identical response whether or not the email can sign in. Rate-limited.
+     */
+    email(input: {
+        email: string;
+    }): Promise<MagicLinkSendResult>;
+    /**
+     * Exchange a magic-link token for a control-plane session
+     * (`POST …/session/email/verify`). Verifies the email, resolves/creates the
+     * principal, **auto-claims any pending invites**, and mints the session
+     * (`amr: ["email"]`).
+     */
+    verifyEmail(input: {
+        token: string;
+    }): Promise<ControlPlaneSession>;
+    /**
+     * Get WebAuthn login options for an email's passkeys
+     * (`POST …/session/passkey/options`). Opaque — pass `options` to the browser's
+     * `navigator.credentials.get`.
+     */
+    passkeyOptions(input: {
+        email: string;
+    }): Promise<WebAuthnOptionsResult>;
+    /**
+     * Verify a WebAuthn assertion and mint a session (`amr: ["passkey"]`)
+     * (`POST …/session/passkey/verify`). `response` is the opaque assertion from
+     * the browser.
+     */
+    passkeyVerify(input: {
+        email: string;
+        response: unknown;
+    }): Promise<ControlPlaneSession>;
+    /**
+     * Build the browser OAuth start URL for `provider`
+     * (`GET …/oauth/:provider/start`). Pure — no network. Open it in a browser;
+     * the gateway 302s to the provider, then the callback lands on the console
+     * with the session token in the URL fragment.
+     *
+     * Note: the live bridge can return `503` until the gateway provisions the
+     * provider's `CONTROL_PLANE_{GOOGLE,GITHUB}_*` client credentials.
+     */
+    oauthUrl(provider: ControlPlaneOAuthProvider): string;
+    /**
+     * Run the recovery-code ceremony (`POST …/recovery/consume`). Mints a session
+     * with `amr: ["recovery_code"]` which **cannot** do high-stakes ops
+     * (`must_enroll_passkey: true`) — enrol a passkey to restore full access.
+     */
+    consumeRecoveryCode(input: {
+        code: string;
+    }): Promise<RecoveryConsumeResult>;
+    /**
+     * Resolve the current session's principal + memberships + freshness
+     * (`GET /agent/v1/control-plane/session`). The `memberships` reflect any
+     * invites auto-claimed at login.
+     */
+    whoami(opts?: SessionTokenOpts): Promise<ControlPlaneWhoAmI>;
+    /** Rotate the access token (`POST …/session/refresh`). */
+    refresh(opts?: SessionTokenOpts): Promise<ControlPlaneRefreshResult>;
+    /** Sign out — revoke the session server-side (`POST …/session/revoke`). Idempotent. */
+    revoke(opts?: SessionTokenOpts): Promise<{
+        status: string;
+        [key: string]: unknown;
+    }>;
+    /** WebAuthn registration options for a new passkey (`POST …/passkey/enroll/options`). */
+    enrollPasskeyOptions(opts?: SessionTokenOpts): Promise<WebAuthnOptionsResult>;
+    /** Verify a passkey registration (`POST …/passkey/enroll/verify`). `label` names the authenticator. */
+    enrollPasskeyVerify(input: {
+        response: unknown;
+        label?: string | null;
+    } & SessionTokenOpts): Promise<EnrollPasskeyResult>;
+    /**
+     * WebAuthn step-up options for a high-stakes op (`POST …/step-up/options`).
+     * `opClass` binds the elevation, e.g. `"org.invite"` / `"org.membership"` /
+     * `"project.transfer"` (see {@link StepUpRequiredError.requiredAmr}).
+     */
+    stepUpOptions(input?: {
+        opClass?: string;
+    } & SessionTokenOpts): Promise<WebAuthnOptionsResult>;
+    /**
+     * Verify a step-up assertion (`POST …/step-up/verify`) → refreshes session
+     * passkey-freshness and records an action-bound elevation when `opClass` (and
+     * optionally `objectKind`/`objectId`) are given. Retry the gated write after.
+     */
+    stepUpVerify(input: {
+        response: unknown;
+        opClass?: string;
+        objectKind?: string | null;
+        objectId?: string | null;
+    } & SessionTokenOpts): Promise<StepUpVerifyResult>;
+    /** (Re)issue recovery codes — shown ONCE (`POST …/recovery/issue`). */
+    issueRecoveryCodes(opts?: SessionTokenOpts): Promise<RecoveryCodesResult>;
+    /** List my active authenticators — no secret material (`GET …/authenticators`). */
+    listAuthenticators(opts?: SessionTokenOpts): Promise<Authenticator[]>;
+    /**
+     * Revoke an authenticator (`DELETE …/authenticators/:id`). Step-up enforced;
+     * the gateway refuses to remove the last passkey of a sole org owner
+     * (`OWNER_NEEDS_PASSKEY`).
+     */
+    revokeAuthenticator(input: {
+        id: string;
+    } & SessionTokenOpts): Promise<AuthenticatorRevokeResult>;
+}
+//# sourceMappingURL=operator-session.d.ts.map

package/sdk/dist/namespaces/operator-session.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"operator-session.d.ts","sourceRoot":"","sources":["../../src/namespaces/operator-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/D,gEAAgE;AAChE,MAAM,MAAM,yBAAyB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,kEAAkE;IAClE,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,WAAW,yBAAyB;IACxC,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAI3C;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IASnE;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IASzE;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAS9E;;;;OAIG;IACG,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAS9F;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,GAAG,MAAM;IAIrD;;;;OAIG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAWlF;;;;OAIG;IACG,MAAM,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOtE,0DAA0D;IACpD,OAAO,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAQ9E,uFAAuF;IACjF,MAAM,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAU9F,yFAAyF;IACnF,oBAAoB,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQvF,uGAAuG;IACjG,mBAAmB,CACvB,KAAK,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,gBAAgB,GACrE,OAAO,CAAC,mBAAmB,CAAC;IAY/B;;;;OAIG;IACG,aAAa,CAAC,KAAK,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAUxG;;;;OAIG;IACG,YAAY,CAChB,KAAK,EAAE;QACL,QAAQ,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,gBAAgB,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAiB9B,uEAAuE;IACjE,kBAAkB,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAUnF,mFAAmF;IAC7E,kBAAkB,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAQ/E;;;;OAIG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAOxG"}

package/sdk/dist/namespaces/operator-session.js ADDED Viewed

@@ -0,0 +1,230 @@
+/**
+ * `operator.session` — the hosted/browser control-plane **session** surface
+ * (gateway v1.78 `passkey-principals-onboarding`). The write-capable human
+ * principal: log in (email magic-link / passkey / Google / GitHub), manage the
+ * session (whoami / refresh / revoke), enrol a passkey, run a step-up ceremony,
+ * and manage authenticators + recovery codes.
+ *
+ * Reached as `r.operator.session.*`. Distinct from the read-only operator
+ * overview session (`r.operator.deviceStart`/`overview`) and from the CLI
+ * loopback-PKCE write-login (`r.operator.buildCliAuthorizeUrl`/`exchangeCliToken`,
+ * which is the headless variant of this same browser ceremony). All three are
+ * the one human principal; this group is the browser/console front door that the
+ * hosted login pages and `@run402/sdk` consumers call.
+ *
+ * Isomorphic — no Node APIs. The token model mirrors {@link Operator.overview}:
+ * the public *mint* methods (`email`/`verifyEmail`/`passkey*`/`consumeRecoveryCode`)
+ * send no auth (the body or the magic-link token IS the credential); the
+ * *session-bound* methods take `opts.token` to send the `control_plane_session`
+ * bearer explicitly, and fall back to the credential provider's default auth
+ * (e.g. {@link controlPlaneSessionCredentials} or a SIWX wallet) when omitted.
+ *
+ * WebAuthn option/assertion payloads are opaque passthroughs (`unknown`) — the
+ * browser runs the actual ceremony; a headless client cannot.
+ *
+ * High-stakes writes (invite, membership, handoff, delete) require a **fresh
+ * passkey** — a magic-link/OAuth session does NOT satisfy step-up, so the
+ * gateway returns {@link StepUpRequiredError}; `stepUpOptions`/`stepUpVerify`
+ * are how a long-lived session re-establishes that freshness.
+ */
+export class OperatorSession {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    // ── login / mint (public — no auth; the body or link token is the credential) ──
+    /**
+     * Send a control-plane sign-in magic link to `email`
+     * (`POST /agent/v1/control-plane/session/email`). Non-enumerating: an
+     * identical response whether or not the email can sign in. Rate-limited.
+     */
+    async email(input) {
+        return this.client.request("/agent/v1/control-plane/session/email", {
+            method: "POST",
+            body: { email: input.email },
+            withAuth: false,
+            context: "sending control-plane magic link",
+        });
+    }
+    /**
+     * Exchange a magic-link token for a control-plane session
+     * (`POST …/session/email/verify`). Verifies the email, resolves/creates the
+     * principal, **auto-claims any pending invites**, and mints the session
+     * (`amr: ["email"]`).
+     */
+    async verifyEmail(input) {
+        return this.client.request("/agent/v1/control-plane/session/email/verify", {
+            method: "POST",
+            body: { token: input.token },
+            withAuth: false,
+            context: "verifying control-plane magic link",
+        });
+    }
+    /**
+     * Get WebAuthn login options for an email's passkeys
+     * (`POST …/session/passkey/options`). Opaque — pass `options` to the browser's
+     * `navigator.credentials.get`.
+     */
+    async passkeyOptions(input) {
+        return this.client.request("/agent/v1/control-plane/session/passkey/options", {
+            method: "POST",
+            body: { email: input.email },
+            withAuth: false,
+            context: "requesting control-plane passkey login options",
+        });
+    }
+    /**
+     * Verify a WebAuthn assertion and mint a session (`amr: ["passkey"]`)
+     * (`POST …/session/passkey/verify`). `response` is the opaque assertion from
+     * the browser.
+     */
+    async passkeyVerify(input) {
+        return this.client.request("/agent/v1/control-plane/session/passkey/verify", {
+            method: "POST",
+            body: { email: input.email, response: input.response },
+            withAuth: false,
+            context: "verifying control-plane passkey login",
+        });
+    }
+    /**
+     * Build the browser OAuth start URL for `provider`
+     * (`GET …/oauth/:provider/start`). Pure — no network. Open it in a browser;
+     * the gateway 302s to the provider, then the callback lands on the console
+     * with the session token in the URL fragment.
+     *
+     * Note: the live bridge can return `503` until the gateway provisions the
+     * provider's `CONTROL_PLANE_{GOOGLE,GITHUB}_*` client credentials.
+     */
+    oauthUrl(provider) {
+        return `${this.client.apiBase}/agent/v1/control-plane/oauth/${encodeURIComponent(provider)}/start`;
+    }
+    /**
+     * Run the recovery-code ceremony (`POST …/recovery/consume`). Mints a session
+     * with `amr: ["recovery_code"]` which **cannot** do high-stakes ops
+     * (`must_enroll_passkey: true`) — enrol a passkey to restore full access.
+     */
+    async consumeRecoveryCode(input) {
+        return this.client.request("/agent/v1/control-plane/recovery/consume", {
+            method: "POST",
+            body: { code: input.code },
+            withAuth: false,
+            context: "consuming control-plane recovery code",
+        });
+    }
+    // ── session lifecycle (bearer; falls back to credential provider) ──
+    /**
+     * Resolve the current session's principal + memberships + freshness
+     * (`GET /agent/v1/control-plane/session`). The `memberships` reflect any
+     * invites auto-claimed at login.
+     */
+    async whoami(opts = {}) {
+        return this.client.request("/agent/v1/control-plane/session", {
+            ...authFor(opts),
+            context: "resolving control-plane session",
+        });
+    }
+    /** Rotate the access token (`POST …/session/refresh`). */
+    async refresh(opts = {}) {
+        return this.client.request("/agent/v1/control-plane/session/refresh", {
+            method: "POST",
+            ...authFor(opts),
+            context: "refreshing control-plane session",
+        });
+    }
+    /** Sign out — revoke the session server-side (`POST …/session/revoke`). Idempotent. */
+    async revoke(opts = {}) {
+        return this.client.request("/agent/v1/control-plane/session/revoke", {
+            method: "POST",
+            ...authFor(opts),
+            context: "revoking control-plane session",
+        });
+    }
+    // ── passkey enrollment (bearer + step-up, enforced by the gateway) ──
+    /** WebAuthn registration options for a new passkey (`POST …/passkey/enroll/options`). */
+    async enrollPasskeyOptions(opts = {}) {
+        return this.client.request("/agent/v1/control-plane/passkey/enroll/options", {
+            method: "POST",
+            ...authFor(opts),
+            context: "requesting control-plane passkey enrollment options",
+        });
+    }
+    /** Verify a passkey registration (`POST …/passkey/enroll/verify`). `label` names the authenticator. */
+    async enrollPasskeyVerify(input) {
+        const { token, response, label } = input;
+        return this.client.request("/agent/v1/control-plane/passkey/enroll/verify", {
+            method: "POST",
+            body: { response, ...(label !== undefined ? { label } : {}) },
+            ...authFor({ token }),
+            context: "verifying control-plane passkey enrollment",
+        });
+    }
+    // ── step-up ceremony (bearer) ──
+    /**
+     * WebAuthn step-up options for a high-stakes op (`POST …/step-up/options`).
+     * `opClass` binds the elevation, e.g. `"org.invite"` / `"org.membership"` /
+     * `"project.transfer"` (see {@link StepUpRequiredError.requiredAmr}).
+     */
+    async stepUpOptions(input = {}) {
+        const { token, opClass } = input;
+        return this.client.request("/agent/v1/control-plane/step-up/options", {
+            method: "POST",
+            body: opClass ? { op_class: opClass } : {},
+            ...authFor({ token }),
+            context: "requesting control-plane step-up options",
+        });
+    }
+    /**
+     * Verify a step-up assertion (`POST …/step-up/verify`) → refreshes session
+     * passkey-freshness and records an action-bound elevation when `opClass` (and
+     * optionally `objectKind`/`objectId`) are given. Retry the gated write after.
+     */
+    async stepUpVerify(input) {
+        const { token, response, opClass, objectKind, objectId } = input;
+        return this.client.request("/agent/v1/control-plane/step-up/verify", {
+            method: "POST",
+            body: {
+                response,
+                ...(opClass !== undefined ? { op_class: opClass } : {}),
+                ...(objectKind !== undefined ? { object_kind: objectKind } : {}),
+                ...(objectId !== undefined ? { object_id: objectId } : {}),
+            },
+            ...authFor({ token }),
+            context: "verifying control-plane step-up",
+        });
+    }
+    // ── recovery codes (bearer + step-up) ──
+    /** (Re)issue recovery codes — shown ONCE (`POST …/recovery/issue`). */
+    async issueRecoveryCodes(opts = {}) {
+        return this.client.request("/agent/v1/control-plane/recovery/issue", {
+            method: "POST",
+            ...authFor(opts),
+            context: "issuing control-plane recovery codes",
+        });
+    }
+    // ── authenticator management (bearer) ──
+    /** List my active authenticators — no secret material (`GET …/authenticators`). */
+    async listAuthenticators(opts = {}) {
+        const res = await this.client.request("/agent/v1/control-plane/authenticators", { ...authFor(opts), context: "listing control-plane authenticators" });
+        return res.authenticators ?? [];
+    }
+    /**
+     * Revoke an authenticator (`DELETE …/authenticators/:id`). Step-up enforced;
+     * the gateway refuses to remove the last passkey of a sole org owner
+     * (`OWNER_NEEDS_PASSKEY`).
+     */
+    async revokeAuthenticator(input) {
+        const { token, id } = input;
+        return this.client.request(`/agent/v1/control-plane/authenticators/${encodeURIComponent(id)}`, { method: "DELETE", ...authFor({ token }), context: "revoking control-plane authenticator" });
+    }
+}
+/**
+ * Build the auth half of a request: explicit `Authorization: Bearer <token>`
+ * (and `withAuth: false`) when a token is passed, else fall through to the
+ * credential provider (`withAuth` defaults true). Mirrors {@link Operator.overview}.
+ */
+function authFor(opts) {
+    return opts.token
+        ? { headers: { Authorization: `Bearer ${opts.token}` }, withAuth: false }
+        : {};
+}
+//# sourceMappingURL=operator-session.js.map

package/sdk/dist/namespaces/operator-session.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"operator-session.js","sourceRoot":"","sources":["../../src/namespaces/operator-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAqGH,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,kFAAkF;IAElF;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,uCAAuC,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC5B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAAwB;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,8CAA8C,EAAE;YAC9F,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC5B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,KAAwB;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAwB,iDAAiD,EAAE;YACnG,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC5B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,KAA2C;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,gDAAgD,EAAE;YAChG,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YACtD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAmC;QAC1C,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,iCAAiC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACrG,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAuB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAwB,0CAA0C,EAAE;YAC5F,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YAC1B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IAEtE;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAyB,EAAE;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB,iCAAiC,EAAE;YAChF,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,iCAAiC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,OAAO,CAAC,OAAyB,EAAE;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAA4B,yCAAyC,EAAE;YAC/F,MAAM,EAAE,MAAM;YACd,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,MAAM,CAAC,OAAyB,EAAE;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB,wCAAwC,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IAEvE,yFAAyF;IACzF,KAAK,CAAC,oBAAoB,CAAC,OAAyB,EAAE;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAwB,gDAAgD,EAAE;YAClG,MAAM,EAAE,MAAM;YACd,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,uGAAuG;IACvG,KAAK,CAAC,mBAAmB,CACvB,KAAsE;QAEtE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,+CAA+C,EAAE;YAC/F,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC7D,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;YACrB,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAElC;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,QAAiD,EAAE;QACrE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAwB,yCAAyC,EAAE;YAC3F,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;YAC1C,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;YACrB,OAAO,EAAE,0CAA0C;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,KAKoB;QAEpB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QACjE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB,wCAAwC,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,QAAQ;gBACR,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D;YACD,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;YACrB,OAAO,EAAE,iCAAiC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAE1C,uEAAuE;IACvE,KAAK,CAAC,kBAAkB,CAAC,OAAyB,EAAE;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,wCAAwC,EAAE;YACxF,MAAM,EAAE,MAAM;YACd,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,sCAAsC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAE1C,mFAAmF;IACnF,KAAK,CAAC,kBAAkB,CAAC,OAAyB,EAAE;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CACnC,wCAAwC,EACxC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CACtE,CAAC;QACF,OAAO,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAwC;QAChE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,0CAA0C,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAClE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAC7F,CAAC;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,IAAsB;IACrC,OAAO,IAAI,CAAC,KAAK;QACf,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;QACzE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC"}

package/sdk/dist/namespaces/operator.d.ts CHANGED Viewed

@@ -18,6 +18,7 @@
  * Gateway contract: kychee-com/run402-private#443 (RFC 8628 device-auth bridge).
  */
 import type { Client } from "../kernel.js";
+import { OperatorSession } from "./operator-session.js";
 /** RFC 8628 device-authorization start response. */
 export interface DeviceAuthStart {
     device_code: string;
@@ -115,6 +116,15 @@ export interface CliTokenExchange {
 }
 export declare class Operator {
     private readonly client;
+    /**
+     * The hosted/browser control-plane **session** surface (gateway v1.78):
+     * `r.operator.session.email`, `verifyEmail`, `passkeyVerify`, `whoami`,
+     * `refresh`, `revoke`, and the step-up / authenticator helpers.
+     * The write-capable human login + step-up + authenticators, distinct from the
+     * read-only device/overview methods on this class and the loopback-PKCE
+     * CLI write-login below. See {@link OperatorSession}.
+     */
+    readonly session: OperatorSession;
     constructor(client: Client);
     /**
      * Begin the device-authorization flow. Unauthenticated. Returns the codes the

package/sdk/dist/namespaces/operator.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;~~AAG3C~~,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,uBAAuB,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AASD,qBAAa,QAAQ;~~IACP~~,OAAO,CAAC,QAAQ,CAAC,MAAM;~~gBAAN~~,MAAM,EAAE,MAAM;~~IAE3C~~;;;;OAIG;IACG,WAAW,CAAC,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;IAS/E;;;;;OAKG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgC/D;;;;;;OAMG;IACG,QAAQ,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAaxE;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpD;;;;OAIG;IACH,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM;IAWxD;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAa/E"}
1	+ {"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,uBAAuB,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AASD,qBAAa,QAAQ;IAWP,OAAO,CAAC,QAAQ,CAAC,MAAM;IAVnC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEL,MAAM,EAAE,MAAM;IAI3C;;;;OAIG;IACG,WAAW,CAAC,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;IAS/E;;;;;OAKG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgC/D;;;;;;OAMG;IACG,QAAQ,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAaxE;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpD;;;;OAIG;IACH,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM;IAWxD;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAa/E"}

package/sdk/dist/namespaces/operator.js CHANGED Viewed

@@ -18,6 +18,7 @@
  * Gateway contract: kychee-com/run402-private#443 (RFC 8628 device-auth bridge).
  */
 import { ApiError, NetworkError } from "../errors.js";
+import { OperatorSession } from "./operator-session.js";
 const POLL_ERROR_CODES = new Set([
     "authorization_pending",
     "slow_down",
@@ -26,8 +27,18 @@ const POLL_ERROR_CODES = new Set([
 ]);
 export class Operator {
     client;
+    /**
+     * The hosted/browser control-plane **session** surface (gateway v1.78):
+     * `r.operator.session.email`, `verifyEmail`, `passkeyVerify`, `whoami`,
+     * `refresh`, `revoke`, and the step-up / authenticator helpers.
+     * The write-capable human login + step-up + authenticators, distinct from the
+     * read-only device/overview methods on this class and the loopback-PKCE
+     * CLI write-login below. See {@link OperatorSession}.
+     */
+    session;
     constructor(client) {
         this.client = client;
+        this.session = new OperatorSession(client);
     }
     /**
      * Begin the device-authorization flow. Unauthenticated. Returns the codes the

package/sdk/dist/namespaces/operator.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA+~~FtD~~,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,OAAO,QAAQ;~~IACU~~;~~IAA7B~~,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;~~IAAG~~,CAAC;~~IAE/C~~;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgC,EAAE;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAkB,mCAAmC,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;YAC7D,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC;QAC5E,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,sDAAuD,GAAa,CAAC,OAAO,EAAE,EAC9E,GAAG,EACH,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAuC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,KAAsD,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,mDAAmD,GAAG,CAAC,MAAM,GAAG,EAChE,GAAG,CAAC,MAAM,EACV,IAAI,EACJ,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA2B,EAAE;QAC1C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;gBAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;gBAClD,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;YAC1E,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAAuB;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,mCAAmC,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;YAClD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,gEAAgE;IAChE,8EAA8E;IAC9E,+DAA+D;IAE/D;;;;OAIG;IACH,oBAAoB,CAAC,MAA0B;QAC7C,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;YAC5B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAwB;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,mCAAmC,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;YACD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;CACF"}
1	+ {"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA+FxD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,OAAO,QAAQ;IAWU;IAV7B;;;;;;;OAOG;IACM,OAAO,CAAkB;IAElC,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgC,EAAE;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAkB,mCAAmC,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;YAC7D,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC;QAC5E,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,sDAAuD,GAAa,CAAC,OAAO,EAAE,EAC9E,GAAG,EACH,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAuC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,KAAsD,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,mDAAmD,GAAG,CAAC,MAAM,GAAG,EAChE,GAAG,CAAC,MAAM,EACV,IAAI,EACJ,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA2B,EAAE;QAC1C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;gBAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;gBAClD,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;YAC1E,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAAuB;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,mCAAmC,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;YAClD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,gEAAgE;IAChE,8EAA8E;IAC9E,+DAA+D;IAE/D;;;;OAIG;IACH,oBAAoB,CAAC,MAA0B;QAC7C,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;YAC5B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAwB;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,mCAAmC,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;YACD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;CACF"}