run402 4.11.2 → 4.12.1

package/cli.mjs

@@ -41,6 +41,7 @@ Commands:
   transfer    Two-party project transfer (init, preview, list, accept, cancel)
   org         Org membership, invites & audit (whoami, list, member, invite, audit)
   grants      Per-project capability grants for agent/CI principals (create, revoke)
+  delegates   Scoped deploy credentials for agents (create, list, revoke, rotate)
   events      What happened to your project since you last looked (cursored feed)
   errors      Grouped error fingerprints + a promote/revert verdict (release-baselined)
   jobs        Submit and inspect platform-managed jobs
@@ -250,6 +251,11 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
+  case "delegates": {
+    const { run } = await import("./lib/delegates.mjs");
+    await run(sub, rest);
+    break;
+  }
   case "events": {
     const { run } = await import("./lib/events.mjs");
     await run(sub, rest);

package/lib/auth.mjs

@@ -9,11 +9,11 @@ Usage:
   run402 auth <subcommand> [args...]
 
 Subcommands:
-  magic-link --email <addr> --redirect <url> [--project <id>]
-    Send a passwordless login link. Use --intent invite with a service key-backed project.
+  magic-link --email <addr> [--delivery link|code|both] [--redirect <url>] [--project <id>]
+    Request passwordless email authentication. Link remains the default.
 
-  verify --token <token> [--project <id>]
-    Exchange a magic link token for access_token + refresh_token.
+  verify (--token <token> | --challenge-id <id> --code <6 digits>) [--project <id>]
+    Exchange one email credential for access_token + refresh_token.
 
   create-user --email <addr> [--admin <true|false>] [--invite] [--redirect <url>] [--project <id>]
     Create or update a project auth user with the service key.
@@ -53,7 +53,7 @@ Subcommands:
 
 Examples:
   run402 auth magic-link --email user@example.com --redirect https://myapp.run402.com/cb
-  run402 auth verify --token abc123def456
+  run402 auth verify --challenge-id 123e4567-e89b-42d3-a456-426614174000 --code 042731
   run402 auth invite-user --email admin@example.com --redirect https://myapp.run402.com/cb --admin true
   run402 auth set-password --token eyJ... --new "new-pass" --current "old-pass"
   run402 auth settings --preferred passkey --require-admin-passkey true
@@ -62,20 +62,23 @@ Examples:
 `;
 
 const SUB_HELP = {
-  "magic-link": `run402 auth magic-link — Send a passwordless login link
+  "magic-link": `run402 auth magic-link — Request passwordless email authentication
 
 Usage:
-  run402 auth magic-link --email <addr> --redirect <url> [options]
+  run402 auth magic-link --email <addr> [options]
 
 Options:
   --email <addr>      Required: recipient email address
-  --redirect <url>    Required: URL to redirect to after the user clicks
+  --delivery <mode>   link (default), code, or both
+  --redirect <url>    Required for link/both; optional for code
   --intent <intent>   signin (default), invite, claim, or recovery
   --state <value>     Optional client_state preserved through verification
   --project <id>      Project ID (defaults to active project)
 
 Notes:
-  Auto-creates the user on first use. Uses the project's anon_key.
+  Acceptance does not prove delivery or disclose whether an account exists.
+  Code/both returns an opaque challenge_id; the six-digit code is sent by email.
+  Uses the project's anon_key (invite intent uses the service key).
 
 Examples:
   run402 auth magic-link --email user@example.com \\
@@ -111,13 +114,16 @@ Options:
   --state <value>     Optional client_state for the invite
   --project <id>      Project ID (defaults to active project)
 `,
-  verify: `run402 auth verify — Exchange a magic-link token for session tokens
+  verify: `run402 auth verify — Exchange an email credential for session tokens
 
 Usage:
   run402 auth verify --token <token> [options]
+  run402 auth verify --challenge-id <id> --code <6 digits> [options]
 
 Options:
   --token <token>     Required: the one-time magic-link token
+  --challenge-id <id> Required with --code: opaque handle from magic-link request
+  --code <digits>     Required with --challenge-id: six-digit email code
   --project <id>      Project ID (defaults to active project)
 
 Notes:
@@ -125,6 +131,7 @@ Notes:
 
 Examples:
   run402 auth verify --token abc123def456
+  run402 auth verify --challenge-id 123e4567-e89b-42d3-a456-426614174000 --code 042731
 `,
   "set-password": `run402 auth set-password — Change, reset, or set a user's password
 
@@ -267,8 +274,8 @@ Notes:
 
 const AUTH_FLAGS = {
   "magic-link": {
-    known: ["--email", "--redirect", "--intent", "--state", "--project", "--help", "-h"],
-    values: ["--email", "--redirect", "--intent", "--state", "--project"],
+    known: ["--email", "--delivery", "--redirect", "--intent", "--state", "--project", "--help", "-h"],
+    values: ["--email", "--delivery", "--redirect", "--intent", "--state", "--project"],
   },
   "create-user": {
     known: ["--email", "--admin", "--invite", "--redirect", "--state", "--project", "--help", "-h"],
@@ -279,8 +286,8 @@ const AUTH_FLAGS = {
     values: ["--email", "--redirect", "--admin", "--state", "--project"],
   },
   verify: {
-    known: ["--token", "--project", "--help", "-h"],
-    values: ["--token", "--project"],
+    known: ["--token", "--challenge-id", "--code", "--project", "--help", "-h"],
+    values: ["--token", "--challenge-id", "--code", "--project"],
   },
   "set-password": {
     known: ["--token", "--new", "--current", "--project", "--help", "-h"],
@@ -368,13 +375,17 @@ function parseJsonFlag(args, flag) {
 async function magicLink(args) {
   const email = parseFlag(args, "--email");
   const redirect = parseFlag(args, "--redirect");
+  const delivery = parseFlag(args, "--delivery") || "link";
   const projectId = resolveProjectId(parseFlag(args, "--project"));
 
   if (!email) {
     fail({ code: "BAD_USAGE", message: "Missing --email" });
   }
-  if (!redirect) {
-    fail({ code: "BAD_USAGE", message: "Missing --redirect <url>" });
+  if (!["link", "code", "both"].includes(delivery)) {
+    fail({ code: "BAD_FLAG", message: "--delivery must be link, code, or both" });
+  }
+  if (delivery !== "code" && !redirect) {
+    fail({ code: "BAD_USAGE", message: "Missing --redirect <url> for link/both delivery" });
   }
 
   try {
@@ -383,13 +394,23 @@ async function magicLink(args) {
       fail({ code: "BAD_FLAG", message: "--intent must be signin, invite, claim, or recovery" });
     }
     const state = parseFlag(args, "--state");
-    await getSdk().auth.requestMagicLink(projectId, {
+    const result = await getSdk().auth.requestMagicLink(projectId, {
       email,
-      redirectUrl: redirect,
+      delivery,
+      redirectUrl: redirect ?? undefined,
       intent: intent ?? undefined,
       clientState: state ?? undefined,
     });
-    console.log(JSON.stringify({ email, redirect_url: redirect, intent: intent || "signin", sent: true }));
+    console.log(JSON.stringify({
+      email,
+      delivery,
+      ...(redirect ? { redirect_url: redirect } : {}),
+      intent: intent || "signin",
+      accepted: true,
+      message: result.message,
+      ...(result.warnings ? { warnings: result.warnings } : {}),
+      ...(result.challengeId ? { challenge_id: result.challengeId } : {}),
+    }));
   } catch (err) {
     reportSdkError(err);
   }
@@ -453,14 +474,26 @@ async function inviteUser(args) {
 
 async function verify(args) {
   const token = parseFlag(args, "--token");
+  const challengeId = parseFlag(args, "--challenge-id");
+  const code = parseFlag(args, "--code");
   const projectId = resolveProjectId(parseFlag(args, "--project"));
 
-  if (!token) {
-    fail({ code: "BAD_USAGE", message: "Missing --token" });
+  const hasLink = token !== null;
+  const hasCodePart = challengeId !== null || code !== null;
+  if (hasLink === hasCodePart) {
+    fail({
+      code: "BAD_USAGE",
+      message: "Provide either --token, or --challenge-id with --code (not both)",
+    });
+  }
+  if (hasCodePart && (!challengeId || !code)) {
+    fail({ code: "BAD_USAGE", message: "--challenge-id and --code must be provided together" });
   }
 
   try {
-    const data = await getSdk().auth.verifyMagicLink(projectId, token);
+    const data = hasLink
+      ? await getSdk().auth.verifyMagicLink(projectId, token)
+      : await getSdk().auth.verifyEmailCode(projectId, { challengeId, code });
     console.log(JSON.stringify(data));
   } catch (err) {
     reportSdkError(err);

package/lib/command-manifest.mjs

@@ -175,6 +175,12 @@ export const COMMAND_MANIFEST = [
   { path: ["grants", "create"], positionals: [p("wallet")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["0x1111111111111111111111111111111111111111", "--capability", "deploy"] },
   { path: ["grants", "revoke"], positionals: [p("grant_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["grt_gate1"] },
 
+  // ── delegates ────────────────────────────────────────────────────────────
+  { path: ["delegates", "create"], legacyPositionalProject: false, positionals: [], projectScoped: true, minimalArgs: ["--grant", "11111111-1111-1111-1111-111111111111"] },
+  { path: ["delegates", "list"], legacyPositionalProject: false, positionals: [], projectScoped: true, minimalArgs: [] },
+  { path: ["delegates", "revoke"], legacyPositionalProject: false, positionals: [p("delegate_id")], projectScoped: true, minimalArgs: ["dlg_gate1"] },
+  { path: ["delegates", "rotate"], legacyPositionalProject: false, positionals: [p("delegate_id")], projectScoped: true, minimalArgs: ["dlg_gate1"] },
+
   // ── events / errors (flat, merged runners) ───────────────────────────────
   { path: ["events"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "merged" },
   { path: ["errors"], positionals: [p("fingerprint_id", { required: false })], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "merged" },

package/lib/delegates.mjs

@@ -0,0 +1,189 @@
+import { getSdk } from "./sdk.mjs";
+import { reportSdkError, parseFlagJson } from "./sdk-errors.mjs";
+import {
+  normalizeArgv,
+  assertKnownFlags,
+  flagValue,
+  requirePositionalCount,
+  resolveProjectSelector,
+  failUnknownSubcommand,
+} from "./argparse.mjs";
+
+const HELP = `run402 delegates — scoped deploy credentials an owner mints for an agent
+
+Usage:
+  run402 delegates <subcommand> [args...]
+
+Subcommands:
+  create --grant <grant_id> [--project <id>] [--capability <cap>] [--kind <kind>]
+         [--scope <json>] [--expires <iso8601>]
+                                 Mint a delegate. The bearer is printed ONCE.
+  list [--project <id>]          List delegates (never shows tokens)
+  revoke <delegate_id> [--project <id>]
+                                 Revoke immediately
+  rotate <delegate_id> [--project <id>]
+                                 Revoke + reissue; new bearer printed ONCE
+
+Notes:
+  - A delegate NARROWS an existing grant, so mint the grant first:
+      run402 grants create <agent-wallet> --capability deploy --project <id>
+    then pass the returned grant_id to 'delegates create'.
+  - Mutations require you to be an owner of the project's org (wallet SIWX).
+  - A delegate can never be an owner, and is revocable and expiring.
+  - The token is shown ONCE and is not recoverable. Store it immediately;
+    if you lose it, 'rotate' issues a new one.
+  - Use it with: RUN402_DELEGATE_TOKEN=<token> run402 deploy apply ...
+  - JSON in, JSON out.
+
+Why this exists:
+  Project API keys are issued once at project-create and are never re-issued.
+  An agent that loses local state therefore cannot deploy to its own project.
+  You still hold the wallet, so SIWX is enough to mint a fresh credential.
+
+Examples:
+  run402 grants create 0x90F3eB...F80a --capability deploy --project prj_abc
+  run402 delegates create --grant 1d86452e-... --project prj_abc
+  run402 delegates list --project prj_abc
+  run402 delegates revoke 5845f17b-... --project prj_abc
+`;
+
+const SUB_HELP = {
+  create: `run402 delegates create — mint a scoped deploy credential
+
+Usage:
+  run402 delegates create --grant <grant_id> [--project <id>] [--capability <cap>]
+                          [--kind <kind>] [--scope <json>] [--expires <iso8601>]
+
+--capability defaults to "deploy". --kind defaults to "run402_agent_key" (the
+only kind that returns a bearer). --scope, if given, overrides --capability and
+must be a JSON object like {"v":1,"capabilities":["deploy"]}.
+
+The bearer is printed ONCE and cannot be read back. Store it immediately.
+Requires owner of the project's org.
+`,
+  list: `run402 delegates list — list a project's delegates
+
+Usage:
+  run402 delegates list [--project <id>]
+
+Never returns tokens or secret material — id, kind, scope, expiry, revocation.
+`,
+  revoke: `run402 delegates revoke — revoke a delegate immediately
+
+Usage:
+  run402 delegates revoke <delegate_id> [--project <id>]
+
+Takes effect for every subsequent request. Requires owner of the project's org.
+`,
+  rotate: `run402 delegates rotate — revoke and reissue in one step
+
+Usage:
+  run402 delegates rotate <delegate_id> [--project <id>]
+
+Keeps the same principal, grant, kind, scope, cap and expiry. The NEW bearer is
+printed once. Use this when a token is lost or possibly exposed.
+`,
+};
+
+const CREATE_VALUE_FLAGS = ["--project", "--grant", "--capability", "--kind", "--scope", "--expires"];
+
+async function create(args) {
+  const a = normalizeArgv(args);
+  assertKnownFlags(a, [...CREATE_VALUE_FLAGS, "--help", "-h"], CREATE_VALUE_FLAGS);
+  const grantId = flagValue(a, "--grant");
+  const capability = flagValue(a, "--capability") || "deploy";
+  const kind = flagValue(a, "--kind") || undefined;
+  const scopeRaw = flagValue(a, "--scope");
+  const expiresAt = flagValue(a, "--expires");
+  const { projectId, rest } = resolveProjectSelector(a, { valueFlags: CREATE_VALUE_FLAGS });
+  requirePositionalCount(rest, CREATE_VALUE_FLAGS, {
+    min: 0,
+    max: 0,
+    command: "run402 delegates create --grant <grant_id> [--project <id>]",
+    missing: "",
+  });
+  if (!grantId) {
+    console.error("Missing --grant <grant_id>. Mint one first:");
+    console.error("  run402 grants create <agent-wallet> --capability deploy --project <id>");
+    process.exit(1);
+  }
+  const scope = scopeRaw != null
+    ? parseFlagJson("--scope", scopeRaw)
+    : { v: 1, capabilities: [capability], projects: [projectId] };
+  try {
+    const res = await getSdk().delegates.create(projectId, {
+      grantId,
+      kind,
+      scope,
+      expiresAt: expiresAt || undefined,
+    });
+    console.log(JSON.stringify(res, null, 2));
+    if (res?.token) {
+      console.error("");
+      console.error("The token above is shown ONCE and cannot be read back.");
+      console.error("Store it now, then use it as: RUN402_DELEGATE_TOKEN=<token>");
+    }
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+async function list(args) {
+  const a = normalizeArgv(args);
+  assertKnownFlags(a, ["--project", "--help", "-h"], ["--project"]);
+  const { projectId, rest } = resolveProjectSelector(a, { valueFlags: ["--project"] });
+  requirePositionalCount(rest, ["--project"], {
+    min: 0,
+    max: 0,
+    command: "run402 delegates list [--project <id>]",
+    missing: "",
+  });
+  try {
+    console.log(JSON.stringify(await getSdk().delegates.list(projectId), null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+function oneIdCommand(name) {
+  return async (args) => {
+    const a = normalizeArgv(args);
+    assertKnownFlags(a, ["--project", "--help", "-h"], ["--project"]);
+    const { projectId, rest } = resolveProjectSelector(a, { valueFlags: ["--project"] });
+    const [delegateId] = requirePositionalCount(rest, ["--project"], {
+      min: 1,
+      max: 1,
+      command: `run402 delegates ${name} <delegate_id> [--project <id>]`,
+      missing: "Missing <delegate_id>.",
+    });
+    try {
+      const res = await getSdk().delegates[name](projectId, delegateId);
+      console.log(JSON.stringify(res, null, 2));
+      if (res?.token) {
+        console.error("");
+        console.error("The token above is shown ONCE and cannot be read back.");
+      }
+    } catch (err) {
+      reportSdkError(err);
+    }
+  };
+}
+
+export async function run(sub, args) {
+  if (!sub || sub === "--help" || sub === "-h") {
+    console.log(HELP);
+    process.exit(0);
+  }
+  if (Array.isArray(args) && (args.includes("--help") || args.includes("-h"))) {
+    console.log(SUB_HELP[sub] || HELP);
+    process.exit(0);
+  }
+  switch (sub) {
+    case "create": await create(args); break;
+    case "list": await list(args); break;
+    case "revoke": await oneIdCommand("revoke")(args); break;
+    case "rotate": await oneIdCommand("rotate")(args); break;
+    default:
+      failUnknownSubcommand("delegates", sub);
+  }
+}

package/lib/deploy-v2.mjs

@@ -34,6 +34,7 @@ import {
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { API, allowanceAuthHeaders, getActiveProjectId, resolveProjectId, isCoreApiTarget } from "./config.mjs";
+import { delegateTokenFromEnv } from "#sdk/node";
 import { flagValue, normalizeArgv } from "./argparse.mjs";
 import { loadLiveControlPlaneSession } from "../core-dist/control-plane-session.js";
 import { withAutoApprove } from "./operator.mjs";
@@ -1146,11 +1147,20 @@ async function applyCmd(args) {
   }
 
   let sdkOpts;
+  const delegateToken = delegateTokenFromEnv();
   if (useGithubActionsOidc) {
     sdkOpts = {
       credentials: githubActionsCredentials({ projectId: releaseSpec.project, apiBase: API }),
       disablePaidFetch: true,
     };
+  } else if (delegateToken) {
+    // A delegate is a complete, self-contained deploy credential: the owner
+    // minted it with their wallet and handed it over, so this process needs no
+    // allowance of its own. Skipping the guard is the point — an agent that
+    // lost its local state (or never had a wallet) can still deploy. Paid fetch
+    // is disabled for the same reason it is under CI: a delegate authorizes
+    // deploys, not spending.
+    sdkOpts = { delegateToken, disablePaidFetch: true };
   } else if (!isCoreApiTarget() && !loadLiveControlPlaneSession()) {
     // Aggressive early exit when no allowance is configured — unless a
     // wallet-less human is deploying via their operator (control-plane) session

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.11.2",
+  "version": "4.12.1",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/dist/delegate-credentials.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Delegate-credential helpers.
+ *
+ * A delegate is a scoped, revocable, expiring bearer an OWNER mints for an
+ * agent (gateway `cryptographic-delegates`, v1.79). It authenticates the same
+ * routes a CI session does — including the apikey-gated `/content/v1/*` CAS
+ * routes — so from the client's perspective it behaves exactly like the CI
+ * session path: the bearer rides `Authorization`, and helpers that would
+ * otherwise attach a project `apikey` must stand down so the two credential
+ * families never mix on one request.
+ *
+ * Why this exists at all: project API keys are stateless JWTs issued once at
+ * project-create and never re-issued. An agent that loses local state (fresh
+ * container, new sandbox) therefore has no cached apikey and no way to deploy
+ * to a project it owns. The owner still holds the wallet, so they can mint a
+ * delegate with SIWX and hand it to the agent. See kychee-com/run402-private#624.
+ */
+import type { CredentialsProvider } from "./credentials.js";
+export declare const DELEGATE_CREDENTIALS: unique symbol;
+export interface DelegateMarkedCredentialsProvider extends CredentialsProvider {
+    readonly [DELEGATE_CREDENTIALS]: true;
+}
+/**
+ * True when this provider is presenting a delegate bearer for the current
+ * request family. Consumers use it the same way they use
+ * `isCiSessionCredentials` — to suppress apikey attachment.
+ */
+export declare function isDelegateCredentials(credentials: CredentialsProvider): boolean;
+/** Environment variable carrying a delegate bearer for non-interactive runs. */
+export declare const DELEGATE_TOKEN_ENV = "RUN402_DELEGATE_TOKEN";
+/**
+ * Read a delegate bearer from the environment. Whitespace-trimmed; an empty or
+ * whitespace-only value is treated as absent so `RUN402_DELEGATE_TOKEN=` in a
+ * shell profile does not silently disable every other credential class.
+ */
+export declare function delegateTokenFromEnv(env?: NodeJS.ProcessEnv): string | undefined;
+//# sourceMappingURL=delegate-credentials.d.ts.map

package/sdk/dist/delegate-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegate-credentials.d.ts","sourceRoot":"","sources":["../src/delegate-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,eAAO,MAAM,oBAAoB,eAAiD,CAAC;AAEnF,MAAM,WAAW,iCAAkC,SAAQ,mBAAmB;IAC5E,QAAQ,CAAC,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,mBAAmB,GAAG,OAAO,CAE/E;AAED,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAKpB"}

package/sdk/dist/delegate-credentials.js

@@ -0,0 +1,41 @@
+/**
+ * Delegate-credential helpers.
+ *
+ * A delegate is a scoped, revocable, expiring bearer an OWNER mints for an
+ * agent (gateway `cryptographic-delegates`, v1.79). It authenticates the same
+ * routes a CI session does — including the apikey-gated `/content/v1/*` CAS
+ * routes — so from the client's perspective it behaves exactly like the CI
+ * session path: the bearer rides `Authorization`, and helpers that would
+ * otherwise attach a project `apikey` must stand down so the two credential
+ * families never mix on one request.
+ *
+ * Why this exists at all: project API keys are stateless JWTs issued once at
+ * project-create and never re-issued. An agent that loses local state (fresh
+ * container, new sandbox) therefore has no cached apikey and no way to deploy
+ * to a project it owns. The owner still holds the wallet, so they can mint a
+ * delegate with SIWX and hand it to the agent. See kychee-com/run402-private#624.
+ */
+export const DELEGATE_CREDENTIALS = Symbol.for("@run402/sdk/delegate-credentials");
+/**
+ * True when this provider is presenting a delegate bearer for the current
+ * request family. Consumers use it the same way they use
+ * `isCiSessionCredentials` — to suppress apikey attachment.
+ */
+export function isDelegateCredentials(credentials) {
+    return Boolean(credentials[DELEGATE_CREDENTIALS]);
+}
+/** Environment variable carrying a delegate bearer for non-interactive runs. */
+export const DELEGATE_TOKEN_ENV = "RUN402_DELEGATE_TOKEN";
+/**
+ * Read a delegate bearer from the environment. Whitespace-trimmed; an empty or
+ * whitespace-only value is treated as absent so `RUN402_DELEGATE_TOKEN=` in a
+ * shell profile does not silently disable every other credential class.
+ */
+export function delegateTokenFromEnv(env = process.env) {
+    const raw = env[DELEGATE_TOKEN_ENV];
+    if (typeof raw !== "string")
+        return undefined;
+    const trimmed = raw.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+//# sourceMappingURL=delegate-credentials.js.map

package/sdk/dist/delegate-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegate-credentials.js","sourceRoot":"","sources":["../src/delegate-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAMnF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAgC;IACpE,OAAO,OAAO,CAAE,WAA0D,CAAC,oBAAoB,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC"}

package/sdk/dist/index.d.ts

@@ -37,6 +37,7 @@ import { Branches } from "./namespaces/branches.js";
 import { Operator } from "./namespaces/operator.js";
 import { Orgs, ScopedOrg } from "./namespaces/org.js";
 import { Grants } from "./namespaces/grants.js";
+import { Delegates } from "./namespaces/delegates.js";
 import { Events } from "./namespaces/events.js";
 import { Errors } from "./namespaces/errors.js";
 import { Pay, type PayExecutor } from "./namespaces/pay.js";
@@ -119,6 +120,13 @@ export declare class Run402 {
      * project-scoped as `r.project(id).grants`.
      */
     readonly grants: Grants;
+    /**
+     * Scoped, revocable deploy credentials an owner mints for an agent. The
+     * supported way back in when a project's API keys are lost (they are issued
+     * once at create and never re-issued). Also project-scoped as
+     * `r.project(id).delegates`.
+     */
+    readonly delegates: Delegates;
     /**
      * Cursored project events feed — "what happened since I last looked".
      * Also available project-scoped as `r.project(id).events`.
@@ -244,6 +252,8 @@ export { PROJECT_OPERATION_AUTH_CLASSIFICATIONS, projectOperationAuthClassificat
 export type * from "./project-auth-classification.js";
 export { CI_SESSION_CREDENTIALS, createCiSessionCredentials, githubActionsCredentials, isCiSessionCredentials, } from "./ci-credentials.js";
 export type * from "./ci-credentials.js";
+export { DELEGATE_CREDENTIALS, DELEGATE_TOKEN_ENV, delegateTokenFromEnv, isDelegateCredentials, } from "./delegate-credentials.js";
+export type * from "./delegate-credentials.js";
 export * from "./app-up.js";
 export { CONTROL_PLANE_SESSION_CREDENTIALS, controlPlaneSessionCredentials, isControlPlaneSessionCredentials, } from "./control-plane-credentials.js";
 export type * from "./control-plane-credentials.js";
@@ -278,6 +288,8 @@ export { Orgs, ScopedOrg, OrgMembers, OrgInvites } from "./namespaces/org.js";
 export type * from "./namespaces/org.types.js";
 export { Grants } from "./namespaces/grants.js";
 export type * from "./namespaces/grants.types.js";
+export { Delegates } from "./namespaces/delegates.js";
+export type * from "./namespaces/delegates.types.js";
 export { Events } from "./namespaces/events.js";
 export type * from "./namespaces/events.types.js";
 export { Errors } from "./namespaces/errors.js";

package/sdk/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAA+C,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,8EAA8E;IAC9E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;CAC/C;AAED,qBAAa,MAAM;;IACjB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAG,EAAE,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW;;MAElB;gBAIU,IAAI,EAAE,aAAa;IA+E/B;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBjD;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKnD;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS;IAI1B;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY;IAIrC;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAiBhC;AAED,uCAAuC;AACvC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAEpE;AAED,wBAAgB,SAAS,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,CAW/F;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAElD;AAED,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EACL,WAAW,EACX,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,8BAA8B,EAC9B,aAAa,EACb,iBAAiB,EACjB,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,kCAAkC,EAClC,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,0BAA0B,EAC1B,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,mBAAmB,YAAY,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,mBAAmB,cAAc,CAAC;AAClC,OAAO,EACL,YAAY,EACZ,GAAG,EACH,YAAY,EACZ,IAAI,EACJ,YAAY,EACZ,eAAe,EACf,OAAO,GACR,MAAM,aAAa,CAAC;AACrB,mBAAmB,aAAa,CAAC;AACjC,mBAAmB,kBAAkB,CAAC;AACtC,mBAAmB,aAAa,CAAC;AACjC,OAAO,EACL,sCAAsC,EACtC,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,mBAAmB,kCAAkC,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,mBAAmB,qBAAqB,CAAC;AACzC,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,mBAAmB,gCAAgC,CAAC;AACpD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,oBAAoB,CAAC;AACxC,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,6BAA6B,CAAC;AACjD,mBAAmB,8BAA8B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACnF,mBAAmB,iCAAiC,CAAC;AACrD,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,0BAA0B,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,mBAAmB,kCAAkC,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC9E,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,mBAAmB,8BAA8B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,mBAAmB,8BAA8B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,mBAAmB,8BAA8B,CAAC;AAClD,OAAO,EACL,GAAG,EACH,iBAAiB,EACjB,kBAAkB,EAClB,8BAA8B,EAC9B,mCAAmC,EACnC,sBAAsB,EACtB,oCAAoC,EACpC,oBAAoB,EACpB,+BAA+B,EAC/B,qBAAqB,EACrB,iCAAiC,EACjC,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,mBAAmB,qBAAqB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,mBAAmB,gCAAgC,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,iCAAiC,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,mBAAmB,gCAAgC,CAAC;AACpD,mBAAmB,gCAAgC,CAAC;AACpD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,+BAA+B,CAAC;AACnD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,4BAA4B,CAAC;AAChD,mBAAmB,sBAAsB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,mBAAmB,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAA+C,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,8EAA8E;IAC9E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;CAC/C;AAED,qBAAa,MAAM;;IACjB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAG,EAAE,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW;;MAElB;gBAIU,IAAI,EAAE,aAAa;IAgF/B;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBjD;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKnD;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS;IAI1B;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY;IAIrC;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAiBhC;AAED,uCAAuC;AACvC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAEpE;AAED,wBAAgB,SAAS,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,CAW/F;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAElD;AAED,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EACL,WAAW,EACX,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,8BAA8B,EAC9B,aAAa,EACb,iBAAiB,EACjB,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,kCAAkC,EAClC,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,0BAA0B,EAC1B,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,mBAAmB,YAAY,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,mBAAmB,cAAc,CAAC;AAClC,OAAO,EACL,YAAY,EACZ,GAAG,EACH,YAAY,EACZ,IAAI,EACJ,YAAY,EACZ,eAAe,EACf,OAAO,GACR,MAAM,aAAa,CAAC;AACrB,mBAAmB,aAAa,CAAC;AACjC,mBAAmB,kBAAkB,CAAC;AACtC,mBAAmB,aAAa,CAAC;AACjC,OAAO,EACL,sCAAsC,EACtC,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,mBAAmB,kCAAkC,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,mBAAmB,qBAAqB,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AACnC,mBAAmB,2BAA2B,CAAC;AAC/C,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,mBAAmB,gCAAgC,CAAC;AACpD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,oBAAoB,CAAC;AACxC,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,6BAA6B,CAAC;AACjD,mBAAmB,8BAA8B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACnF,mBAAmB,iCAAiC,CAAC;AACrD,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,0BAA0B,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,mBAAmB,kCAAkC,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC9E,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,mBAAmB,8BAA8B,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,iCAAiC,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,mBAAmB,8BAA8B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,mBAAmB,8BAA8B,CAAC;AAClD,OAAO,EACL,GAAG,EACH,iBAAiB,EACjB,kBAAkB,EAClB,8BAA8B,EAC9B,mCAAmC,EACnC,sBAAsB,EACtB,oCAAoC,EACpC,oBAAoB,EACpB,+BAA+B,EAC/B,qBAAqB,EACrB,iCAAiC,EACjC,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,mBAAmB,qBAAqB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,mBAAmB,gCAAgC,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,iCAAiC,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,mBAAmB,gCAAgC,CAAC;AACpD,mBAAmB,gCAAgC,CAAC;AACpD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,+BAA+B,CAAC;AACnD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,4BAA4B,CAAC;AAChD,mBAAmB,sBAAsB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,mBAAmB,yBAAyB,CAAC"}

package/sdk/dist/index.js

@@ -36,6 +36,7 @@ import { Branches } from "./namespaces/branches.js";
 import { Operator } from "./namespaces/operator.js";
 import { Orgs, ScopedOrg } from "./namespaces/org.js";
 import { Grants } from "./namespaces/grants.js";
+import { Delegates } from "./namespaces/delegates.js";
 import { Events } from "./namespaces/events.js";
 import { Errors } from "./namespaces/errors.js";
 import { Pay } from "./namespaces/pay.js";
@@ -96,6 +97,13 @@ export class Run402 {
      * project-scoped as `r.project(id).grants`.
      */
     grants;
+    /**
+     * Scoped, revocable deploy credentials an owner mints for an agent. The
+     * supported way back in when a project's API keys are lost (they are issued
+     * once at create and never re-issued). Also project-scoped as
+     * `r.project(id).delegates`.
+     */
+    delegates;
     /**
      * Cursored project events feed — "what happened since I last looked".
      * Also available project-scoped as `r.project(id).events`.
@@ -172,6 +180,7 @@ export class Run402 {
         this.operator = new Operator(client);
         this.orgs = new Orgs(client);
         this.grants = new Grants(client);
+        this.delegates = new Delegates(client);
         this.events = new Events(client);
         this.pay = new Pay(client, opts.payExecutor);
         this.errors = new Errors(client);
@@ -312,6 +321,7 @@ export { Run402Action } from "./actions.js";
 export { defineConfig, dir, emailTrigger, file, nodeFunction, scheduleTrigger, sqlFile, } from "./config.js";
 export { PROJECT_OPERATION_AUTH_CLASSIFICATIONS, projectOperationAuthClassification, } from "./project-auth-classification.js";
 export { CI_SESSION_CREDENTIALS, createCiSessionCredentials, githubActionsCredentials, isCiSessionCredentials, } from "./ci-credentials.js";
+export { DELEGATE_CREDENTIALS, DELEGATE_TOKEN_ENV, delegateTokenFromEnv, isDelegateCredentials, } from "./delegate-credentials.js";
 export * from "./app-up.js";
 export { CONTROL_PLANE_SESSION_CREDENTIALS, controlPlaneSessionCredentials, isControlPlaneSessionCredentials, } from "./control-plane-credentials.js";
 export { EMPTY_STATIC_MANIFEST_METADATA, ROUTE_HTTP_METHODS, buildDeployResolveSummary, isDeployResolveRouteHit, isDeployResolveStaticHit, normalizeDeployResolveRequest, normalizeStaticManifestMetadata, summarizeDeployResult, } from "./namespaces/deploy.types.js";
@@ -323,6 +333,7 @@ export { FunctionRunTerminalError, FunctionRuns } from "./namespaces/functions.j
 export { OperatorSession } from "./namespaces/operator-session.js";
 export { Orgs, ScopedOrg, OrgMembers, OrgInvites } from "./namespaces/org.js";
 export { Grants } from "./namespaces/grants.js";
+export { Delegates } from "./namespaces/delegates.js";
 export { Events } from "./namespaces/events.js";
 export { Errors } from "./namespaces/errors.js";
 export { Pay, PaymentBuyerError, PaymentPolicyError, DEFAULT_PAYMENT_MAX_USD_MICROS, X402_COMMERCE_RESULT_SCHEMA_VERSION, X402_EVIDENCE_STATUSES, X402_GATEWAY_AVAILABILITY_ERROR_CODE, X402_MUTATION_STATES, X402_PAYMENT_POLICY_ERROR_CODES, X402_RECOVERY_ACTIONS, RUN402_PENDING_CLASSIFIER_VERSION, isPaymentBuyerError, isPaymentPolicyError, isTrustedRun402PaymentUrl, isTrustedRun402PendingResponse, payFetchResultToJson, } from "./namespaces/pay.js";