run402 4.11.2 → 4.12.1

package/sdk/dist/namespaces/deploy.js

@@ -19,6 +19,7 @@
  * behavior; this file is the implementation.
  */
 import { isCiSessionCredentials } from "../ci-credentials.js";
+import { isDelegateCredentials } from "../delegate-credentials.js";
 import { assertCiDeployableSpec } from "./ci.js";
 import { ROUTE_PRICING_NETWORKS, ROUTE_HTTP_METHODS, normalizeDeployResolveRequest, } from "./deploy.types.js";
 import { ApiError, LocalError, NetworkError, PaymentRequired, Run402DeployError, Unauthorized, isTransferFreezeError, } from "../errors.js";
@@ -3824,7 +3825,11 @@ async function uploadInlineCas(client, projectId, bytes, contentType) {
  * projects in any of today's other apikey-auth tools).
  */
 async function apikeyHeaders(client, projectId) {
-    if (isCiClient(client))
+    // A CI session and a delegate both already authorize these routes via
+    // `Authorization: Bearer`, supplied by the kernel's getAuth. Attaching an
+    // apikey beside a bearer mixes credential families on one request, which the
+    // kernel explicitly forbids — so stand down and let the bearer carry it.
+    if (isCiClient(client) || isDelegateClient(client))
         return {};
     const project = await client.getProject(projectId);
     if (!project)
@@ -3834,6 +3839,9 @@ async function apikeyHeaders(client, projectId) {
 function isCiClient(client) {
     return isCiSessionCredentials(client.credentials);
 }
+function isDelegateClient(client) {
+    return isDelegateCredentials(client.credentials);
+}
 function makeEmitter(cb) {
     if (!cb)
         return () => { };