run402 3.0.0 → 3.2.0

package/sdk/dist/kernel.js

@@ -10,21 +10,49 @@
  * or a response-shaped error value — they either get the parsed body as T
  * or an exception.
  */
-import { ApiError, NetworkError, NotAuthorizedError, PaymentRequired, StepUpRequiredError, TransferFreezeError, Unauthorized, } from "./errors.js";
+import { ApiError, NetworkError, NotAuthorizedError, OperatorApprovalRequiredError, PaymentRequired, StepUpRequiredError, TransferFreezeError, Unauthorized, } from "./errors.js";
+/** Gateway 403 codes that mean "a passkey operator approval is needed for this (capability, target)". */
+const WRITE_AUTH_CODES = new Set([
+    "WRITE_AUTH_REQUIRED",
+    "WRITE_AUTH_BINDING_MISMATCH",
+    "WRITE_AUTH_SESSION_INVALID",
+]);
 export async function request(kernel, path, opts) {
     return (await requestWithResponse(kernel, path, opts)).body;
 }
+/**
+ * Auth header families. If a request explicitly sets ANY of these, it owns its
+ * credentials and the kernel will not merge a provider auth header alongside —
+ * preventing duplicate/contradictory credentials once dual-header auth exists.
+ */
+const AUTH_HEADER_NAMES = ["authorization", "sign-in-with-x", "x-run402-write-auth"];
+/** Case-insensitive header presence check. */
+function hasHeader(headers, name) {
+    const lower = name.toLowerCase();
+    for (const k of Object.keys(headers)) {
+        if (k.toLowerCase() === lower)
+            return true;
+    }
+    return false;
+}
 export async function requestWithResponse(kernel, path, opts) {
     const { apiBase, fetch, credentials } = kernel;
     const { method = "GET", headers = {}, body, rawBody, withAuth = true, context } = opts;
     const url = `${apiBase}${path}`;
     const fetchHeaders = { ...headers };
     if (withAuth) {
-        const auth = await credentials.getAuth(path);
+        const auth = await credentials.getAuth(path, opts.authMeta);
         if (auth) {
+            // Credential-family atomicity: if the request already set any auth header
+            // (any casing), it owns its credentials — never merge provider auth over
+            // or beside it. Other provider headers still merge (case-insensitively).
+            const requestOwnsAuth = AUTH_HEADER_NAMES.some((h) => hasHeader(fetchHeaders, h));
             for (const [k, v] of Object.entries(auth)) {
-                if (!(k in fetchHeaders))
-                    fetchHeaders[k] = v;
+                if (hasHeader(fetchHeaders, k))
+                    continue;
+                if (requestOwnsAuth && AUTH_HEADER_NAMES.includes(k.toLowerCase()))
+                    continue;
+                fetchHeaders[k] = v;
             }
         }
     }
@@ -71,6 +99,9 @@ export async function requestWithResponse(kernel, path, opts) {
         // generic 401/403 so callers can prompt for access, not re-authentication.
         throw new NotAuthorizedError(`${displayMessage(resBody, "Not authorized")} while ${context} (HTTP ${res.status})`, res.status, resBody, context);
     }
+    if (res.status === 403 && WRITE_AUTH_CODES.has(envelopeCode(resBody) ?? "")) {
+        throw new OperatorApprovalRequiredError(`${displayMessage(resBody, "Operator approval required")} while ${context}`, res.status, resBody, context, { capability: opts.authMeta?.capability ?? null, target: opts.authMeta?.target ?? null });
+    }
     if (res.status === 401 || res.status === 403) {
         throw new Unauthorized(`${displayMessage(resBody, "Unauthorized")} while ${context} (HTTP ${res.status})`, res.status, resBody, context);
     }

package/sdk/dist/kernel.js.map

@@ -1 +1 @@
-{"version":3,"file":"kernel.js","sourceRoot":"","sources":["../src/kernel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,GACb,MAAM,aAAa,CAAC;AA2CrB,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAoB,EACpB,IAAY,EACZ,IAAoB;IAEpB,OAAO,CAAC,MAAM,mBAAmB,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAoB,EACpB,IAAY,EACZ,IAAoB;IAEpB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACvF,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,EAAE,GAAG,OAAO,EAAE,CAAC;IAE5D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;oBAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,SAA0C,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,cAAc,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,cAAc,IAAI,YAAY,CAAC,EAAE,CAAC;YAC3E,YAAY,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACpD,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM;YACN,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,SAAiC;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CACpB,uBAAuB,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,EAC3D,GAAG,EACH,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,OAAgB,CAAC;IACrB,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpC,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAY,EAAE,CAAC;IAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CACvB,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,UAAU,OAAO,EAAE,EACjE,GAAG,EACH,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,kBAAkB,EAAE,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAC3B,GAAG,cAAc,CAAC,OAAO,EAAE,iCAAiC,CAAC,UAAU,OAAO,EAAE,EAChF,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,gBAAgB,EAAE,CAAC;QACrE,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,IAAI,kBAAkB,CAC1B,GAAG,cAAc,CAAC,OAAO,EAAE,gBAAgB,CAAC,UAAU,OAAO,UAAU,GAAG,CAAC,MAAM,GAAG,EACpF,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,IAAI,YAAY,CACpB,GAAG,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,UAAU,OAAO,UAAU,GAAG,CAAC,MAAM,GAAG,EAClF,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,8BAA8B,EAAE,CAAC;QACnF,MAAM,IAAI,mBAAmB,CAC3B,GAAG,cAAc,CAAC,OAAO,EAAE,gCAAgC,CAAC,UAAU,OAAO,EAAE,EAC/E,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,QAAQ,CAChB,GAAG,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,UAAU,OAAO,UAAU,GAAG,CAAC,MAAM,GAAG,EAC/E,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,QAAgB;IACrD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QAClF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAC;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAoB;IAC9C,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,CAAI,IAAY,EAAE,IAAoB,EAAE,EAAE,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAClF,mBAAmB,EAAE,CAAI,IAAY,EAAE,IAAoB,EAAE,EAAE,CAC7D,mBAAmB,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAC5C,UAAU,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"kernel.js","sourceRoot":"","sources":["../src/kernel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,6BAA6B,EAC7B,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,yGAAyG;AACzG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,qBAAqB;IACrB,6BAA6B;IAC7B,4BAA4B;CAC7B,CAAC,CAAC;AA6CH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAoB,EACpB,IAAY,EACZ,IAAoB;IAEpB,OAAO,CAAC,MAAM,mBAAmB,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;AAErF,8CAA8C;AAC9C,SAAS,SAAS,CAAC,OAA+B,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAoB,EACpB,IAAY,EACZ,IAAoB;IAEpB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACvF,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,EAAE,GAAG,OAAO,EAAE,CAAC;IAE5D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,IAAI,EAAE,CAAC;YACT,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;YAClF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;oBAAE,SAAS;gBACzC,IAAI,eAAe,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;oBAAE,SAAS;gBAC7E,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,SAA0C,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,cAAc,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,cAAc,IAAI,YAAY,CAAC,EAAE,CAAC;YAC3E,YAAY,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACpD,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM;YACN,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,SAAiC;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CACpB,uBAAuB,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,EAC3D,GAAG,EACH,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,OAAgB,CAAC;IACrB,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpC,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAY,EAAE,CAAC;IAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CACvB,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,UAAU,OAAO,EAAE,EACjE,GAAG,EACH,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,kBAAkB,EAAE,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAC3B,GAAG,cAAc,CAAC,OAAO,EAAE,iCAAiC,CAAC,UAAU,OAAO,EAAE,EAChF,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,gBAAgB,EAAE,CAAC;QACrE,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,IAAI,kBAAkB,CAC1B,GAAG,cAAc,CAAC,OAAO,EAAE,gBAAgB,CAAC,UAAU,OAAO,UAAU,GAAG,CAAC,MAAM,GAAG,EACpF,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,6BAA6B,CACrC,GAAG,cAAc,CAAC,OAAO,EAAE,4BAA4B,CAAC,UAAU,OAAO,EAAE,EAC3E,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,EACP,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,EAAE,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,IAAI,YAAY,CACpB,GAAG,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,UAAU,OAAO,UAAU,GAAG,CAAC,MAAM,GAAG,EAClF,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,8BAA8B,EAAE,CAAC;QACnF,MAAM,IAAI,mBAAmB,CAC3B,GAAG,cAAc,CAAC,OAAO,EAAE,gCAAgC,CAAC,UAAU,OAAO,EAAE,EAC/E,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,QAAQ,CAChB,GAAG,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,UAAU,OAAO,UAAU,GAAG,CAAC,MAAM,GAAG,EAC/E,GAAG,CAAC,MAAM,EACV,OAAO,EACP,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,QAAgB;IACrD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QAClF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAC;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAoB;IAC9C,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,CAAI,IAAY,EAAE,IAAoB,EAAE,EAAE,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAClF,mBAAmB,EAAE,CAAI,IAAY,EAAE,IAAoB,EAAE,EAAE,CAC7D,mBAAmB,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAC5C,UAAU,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}

package/sdk/dist/namespaces/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAkB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EAarB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAqE3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IA4C9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GACvD,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IAIxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;KACb,GACL,OAAO,CAAC,YAAY,CAAC;IAMxB;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAoiDD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAkB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EAarB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAqE3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IA4C9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GACvD,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IAIxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;KACb,GACL,OAAO,CAAC,YAAY,CAAC;IAMxB;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAkjDD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC"}

package/sdk/dist/namespaces/deploy.js

@@ -166,7 +166,7 @@ export class Deploy {
      */
     async commit(planId, opts = {}) {
         const emit = makeEmitter(opts.onEvent);
-        const commit = await commitInternal(this.client, planId, opts.idempotencyKey);
+        const commit = await commitInternal(this.client, planId, opts.idempotencyKey, opts.project);
         return await pollUntilReady(this.client, commit, {}, [], emit, opts.project);
     }
     /**
@@ -479,7 +479,7 @@ async function applyOnce(client, spec, opts, emit) {
         ...(sliceKinds.length > 0 ? { slice_kinds: sliceKinds } : {}),
     });
     const { planId } = requirePersistedPlan(plan, "applying deploy");
-    const commit = await commitInternal(client, planId, opts.idempotencyKey);
+    const commit = await commitInternal(client, planId, opts.idempotencyKey, spec.project);
     const result = await pollUntilReady(client, commit, plan.diff, plan.warnings, emit, spec.project, sliceKinds);
     // v1.48 unified-apply: thread the plan response's `asset_entries[]` back
     // into DeployResult.assets so callers reading `result.assets.byKey[key]`
@@ -673,6 +673,7 @@ function functionToWire(fn) {
                 },
             }
             : {}),
+        ...(fn.deps !== undefined ? { deps: fn.deps } : {}),
         ...(fn.schedule !== undefined ? { schedule: fn.schedule } : {}),
         ...(fn.requireAuth !== undefined ? { require_auth: fn.requireAuth } : {}),
         ...(fn.requireRole !== undefined
@@ -811,6 +812,8 @@ async function planInternal(client, spec, idempotencyKey, dryRun = false) {
         plan = withClientPlanWarnings(normalized, normalizePlanResponse(await client.request(dryRun ? "/apply/v1/plans?dry_run=true" : "/apply/v1/plans", {
             method: "POST",
             body,
+            // Operator-approval scope: deploying a release is `project.deploy` on this project.
+            authMeta: { method: "deploy.plan", capability: "project.deploy", target: { project_id: spec.project } },
             context: "planning deploy",
         })));
     }
@@ -1151,11 +1154,21 @@ function expandCronNumberPart(part, min, max) {
     }
     return values;
 }
-async function commitInternal(client, planId, idempotencyKey) {
+async function commitInternal(client, planId, idempotencyKey, project) {
     try {
         return await client.request(`/apply/v1/plans/${encodeURIComponent(planId)}/commit`, {
             method: "POST",
             body: idempotencyKey ? { idempotency_key: idempotencyKey } : {},
+            // Operator-approval scope: committing a deploy is `project.deploy` on this project.
+            ...(project
+                ? {
+                    authMeta: {
+                        method: "deploy.commit",
+                        capability: "project.deploy",
+                        target: { project_id: project },
+                    },
+                }
+                : {}),
             context: "committing deploy",
         });
     }
@@ -1542,7 +1555,7 @@ async function startInternal(client, spec, opts) {
             ...(sliceKinds.length > 0 ? { slice_kinds: sliceKinds } : {}),
         });
         const { planId } = requirePersistedPlan(plan, "starting deploy");
-        const commit = await commitInternal(client, planId, opts.idempotencyKey);
+        const commit = await commitInternal(client, planId, opts.idempotencyKey, spec.project);
         return await pollUntilReady(client, commit, plan.diff, plan.warnings, emit, spec.project, sliceKinds);
     })();
     // Avoid an unhandled-rejection at construction time. Consumers must call
@@ -1675,6 +1688,7 @@ const FUNCTION_SPEC_FIELDS = new Set([
     "files",
     "entrypoint",
     "config",
+    "deps",
     "schedule",
     "requireAuth",
     "requireRole",
@@ -2641,6 +2655,8 @@ async function normalizeFunction(fn, remember) {
     };
     if (fn.config)
         out.config = fn.config;
+    if (fn.deps !== undefined)
+        out.deps = fn.deps;
     if (fn.schedule !== undefined)
         out.schedule = fn.schedule;
     if (fn.entrypoint)