run402 4.12.0 → 4.12.2

package/sdk/dist/namespaces/delegates.d.ts

@@ -0,0 +1,50 @@
+/**
+ * `delegates` namespace — scoped, revocable, expiring credentials an OWNER
+ * mints for an agent (gateway `cryptographic-delegates`, v1.79). Maps to
+ * `/projects/v1/:project_id/delegates`. Every mutation requires the caller to
+ * be an active owner of the project's owning org.
+ *
+ * A delegate always NARROWS an existing `project_grant` — mint the grant first
+ * (`r.grants.create(...)`), then hang a delegate off its `grant_id`. A delegate
+ * can never be an owner; that is enforced structurally by the gateway.
+ *
+ * The practical reason this exists on the client: project API keys are
+ * stateless JWTs handed out once at create and never re-issued, so an agent
+ * that loses local state has no way back into its own project. A delegate is
+ * the supported recovery path — the owner still holds a wallet, and SIWX is
+ * enough to mint a fresh deploy credential.
+ *
+ * Exposed both unscoped (`r.delegates.create(projectId, …)`) and
+ * project-scoped (`r.project(id).delegates.create(…)`), mirroring `r.grants`.
+ */
+import type { Client } from "../kernel.js";
+import type { CreateDelegateInput, DelegateCreateResult, DelegateListResult, DelegateRevokeResult } from "./delegates.types.js";
+export declare class Delegates {
+    private readonly client;
+    constructor(client: Client);
+    /**
+     * Issue a delegate against an existing grant
+     * (`POST /projects/v1/:project_id/delegates`). Requires owner of the project's org.
+     *
+     * The returned `token` is shown **once**. Persist it immediately; there is no
+     * way to read it back, only to rotate for a new one.
+     */
+    create(projectId: string, input: CreateDelegateInput): Promise<DelegateCreateResult>;
+    /**
+     * List a project's delegates (`GET /projects/v1/:project_id/delegates`).
+     * Never returns a token or any secret material — names, scope and caps only.
+     */
+    list(projectId: string): Promise<DelegateListResult>;
+    /**
+     * Revoke a delegate (`DELETE /projects/v1/:project_id/delegates/:delegate_id`).
+     * Effective immediately for subsequent requests.
+     */
+    revoke(projectId: string, delegateId: string): Promise<DelegateRevokeResult>;
+    /**
+     * Rotate a delegate (`POST /projects/v1/:project_id/delegates/:delegate_id/rotate`)
+     * — revokes the old credential and reissues the same principal/grant/scope/cap.
+     * The new `token` is again shown once.
+     */
+    rotate(projectId: string, delegateId: string): Promise<DelegateCreateResult>;
+}
+//# sourceMappingURL=delegates.d.ts.map

package/sdk/dist/namespaces/delegates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegates.d.ts","sourceRoot":"","sources":["../../src/namespaces/delegates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EAErB,MAAM,sBAAsB,CAAC;AAE9B,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;;;OAMG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgC1F;;;OAGG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAU1D;;;OAGG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAalF;;;;OAIG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAYnF"}

package/sdk/dist/namespaces/delegates.js

@@ -0,0 +1,99 @@
+/**
+ * `delegates` namespace — scoped, revocable, expiring credentials an OWNER
+ * mints for an agent (gateway `cryptographic-delegates`, v1.79). Maps to
+ * `/projects/v1/:project_id/delegates`. Every mutation requires the caller to
+ * be an active owner of the project's owning org.
+ *
+ * A delegate always NARROWS an existing `project_grant` — mint the grant first
+ * (`r.grants.create(...)`), then hang a delegate off its `grant_id`. A delegate
+ * can never be an owner; that is enforced structurally by the gateway.
+ *
+ * The practical reason this exists on the client: project API keys are
+ * stateless JWTs handed out once at create and never re-issued, so an agent
+ * that loses local state has no way back into its own project. A delegate is
+ * the supported recovery path — the owner still holds a wallet, and SIWX is
+ * enough to mint a fresh deploy credential.
+ *
+ * Exposed both unscoped (`r.delegates.create(projectId, …)`) and
+ * project-scoped (`r.project(id).delegates.create(…)`), mirroring `r.grants`.
+ */
+import { LocalError } from "../errors.js";
+export class Delegates {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Issue a delegate against an existing grant
+     * (`POST /projects/v1/:project_id/delegates`). Requires owner of the project's org.
+     *
+     * The returned `token` is shown **once**. Persist it immediately; there is no
+     * way to read it back, only to rotate for a new one.
+     */
+    async create(projectId, input) {
+        if (!projectId) {
+            throw new LocalError("delegates.create requires a projectId", "issuing project delegate");
+        }
+        if (!input?.grantId) {
+            throw new LocalError("delegates.create requires { grantId } — mint a grant first with grants.create()", "issuing project delegate");
+        }
+        // The gateway REQUIRES a scope object and 400s without one. Default to the
+        // common case (this grant's capability on this project) so the caller does
+        // not have to know the wire schema to do the obvious thing.
+        const scope = input.scope ?? {
+            v: 1,
+            capabilities: ["deploy"],
+            projects: [projectId],
+        };
+        const body = {
+            grant_id: input.grantId,
+            kind: input.kind ?? "run402_agent_key",
+            scope,
+        };
+        if (input.spendCap !== undefined)
+            body.spend_cap = input.spendCap;
+        if (input.expiresAt !== undefined)
+            body.expires_at = input.expiresAt;
+        if (input.publicSubject !== undefined)
+            body.public_subject = input.publicSubject;
+        return this.client.request(`/projects/v1/${encodeURIComponent(projectId)}/delegates`, { method: "POST", body, context: "issuing project delegate" });
+    }
+    /**
+     * List a project's delegates (`GET /projects/v1/:project_id/delegates`).
+     * Never returns a token or any secret material — names, scope and caps only.
+     */
+    async list(projectId) {
+        if (!projectId) {
+            throw new LocalError("delegates.list requires a projectId", "listing project delegates");
+        }
+        return this.client.request(`/projects/v1/${encodeURIComponent(projectId)}/delegates`, { method: "GET", context: "listing project delegates" });
+    }
+    /**
+     * Revoke a delegate (`DELETE /projects/v1/:project_id/delegates/:delegate_id`).
+     * Effective immediately for subsequent requests.
+     */
+    async revoke(projectId, delegateId) {
+        if (!projectId) {
+            throw new LocalError("delegates.revoke requires a projectId", "revoking project delegate");
+        }
+        if (!delegateId) {
+            throw new LocalError("delegates.revoke requires a delegateId", "revoking project delegate");
+        }
+        return this.client.request(`/projects/v1/${encodeURIComponent(projectId)}/delegates/${encodeURIComponent(delegateId)}`, { method: "DELETE", context: "revoking project delegate" });
+    }
+    /**
+     * Rotate a delegate (`POST /projects/v1/:project_id/delegates/:delegate_id/rotate`)
+     * — revokes the old credential and reissues the same principal/grant/scope/cap.
+     * The new `token` is again shown once.
+     */
+    async rotate(projectId, delegateId) {
+        if (!projectId) {
+            throw new LocalError("delegates.rotate requires a projectId", "rotating project delegate");
+        }
+        if (!delegateId) {
+            throw new LocalError("delegates.rotate requires a delegateId", "rotating project delegate");
+        }
+        return this.client.request(`/projects/v1/${encodeURIComponent(projectId)}/delegates/${encodeURIComponent(delegateId)}/rotate`, { method: "POST", context: "rotating project delegate" });
+    }
+}
+//# sourceMappingURL=delegates.js.map

package/sdk/dist/namespaces/delegates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegates.js","sourceRoot":"","sources":["../../src/namespaces/delegates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAS1C,MAAM,OAAO,SAAS;IACS;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,KAA0B;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,0BAA0B,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,UAAU,CAClB,iFAAiF,EACjF,0BAA0B,CAC3B,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,KAAK,GAAkB,KAAK,CAAC,KAAK,IAAI;YAC1C,CAAC,EAAE,CAAC;YACJ,YAAY,EAAE,CAAC,QAAQ,CAAC;YACxB,QAAQ,EAAE,CAAC,SAAS,CAAC;SACtB,CAAC;QACF,MAAM,IAAI,GAA4B;YACpC,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,kBAAkB;YACtC,KAAK;SACN,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;QAClE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACrE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC;QACjF,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,YAAY,EACzD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,qCAAqC,EAAE,2BAA2B,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,YAAY,EACzD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,CACxD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,UAAkB;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,2BAA2B,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,UAAU,CAAC,wCAAwC,EAAE,2BAA2B,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAC3F,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,UAAkB;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,2BAA2B,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,UAAU,CAAC,wCAAwC,EAAE,2BAA2B,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAClG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE,CACzD,CAAC;IACJ,CAAC;CACF"}

package/sdk/dist/namespaces/delegates.types.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Request/response types for the `delegates` namespace — scoped, revocable,
+ * expiring credentials an OWNER mints for an agent (gateway
+ * `cryptographic-delegates`). Maps to `/projects/v1/:project_id/delegates`.
+ *
+ * A delegate always NARROWS an existing `project_grant`; it is never broader
+ * than the grant it hangs off, and it can never be an owner.
+ */
+/** Delegate kinds the gateway accepts. Only `run402_agent_key` returns a bearer. */
+export type DelegateKind = "run402_agent_key" | "ci_oidc" | "tempo_access_key" | "base_disposable_eoa" | "erc7710";
+/**
+ * Delegate scope (`scope` JSONB, compiled server-side to `DelegateScopeV1`).
+ * REQUIRED by the gateway — omitting it returns `400 INVALID_DELEGATE_SCOPE`.
+ */
+export interface DelegateScope {
+    /** Schema version. Must be `1`. */
+    v: 1;
+    /** Non-empty capability list, e.g. `["deploy"]`. */
+    capabilities: string[];
+    /** Optional project allowlist. Defaults to the issuing project. */
+    projects?: string[];
+    [key: string]: unknown;
+}
+/** Spend cap (`spend_cap` JSONB). Enforced at SEND time, not control-plane authz. */
+export interface DelegateSpendCap {
+    v: 1;
+    currency: "usd_micros";
+    per_tx?: number;
+    per_period?: number;
+    [key: string]: unknown;
+}
+/** Input to {@link Delegates.create}. */
+export interface CreateDelegateInput {
+    /** The `project_grant` this delegate narrows. Required by the gateway. */
+    grantId: string;
+    /** Delegate kind. Defaults to `"run402_agent_key"` (the bearer-returning kind). */
+    kind?: DelegateKind;
+    /**
+     * Scope. If omitted the SDK sends `{ v:1, capabilities:["deploy"], projects:[projectId] }`
+     * so the common "let this agent deploy this one project" case is one call.
+     */
+    scope?: DelegateScope;
+    /** Optional spend cap (payment rails only). */
+    spendCap?: DelegateSpendCap;
+    /** Optional ISO-8601 expiry. Omit for a non-expiring delegate. */
+    expiresAt?: string | null;
+    /** Optional rail-specific public subject. */
+    publicSubject?: string;
+}
+/**
+ * Result of {@link Delegates.create} / {@link Delegates.rotate}.
+ *
+ * `token` is returned **once** and never again — persist it immediately
+ * (Secrets Manager, CI secret) or you must rotate to get a new one.
+ */
+export interface DelegateCreateResult {
+    status: string;
+    delegate_id: string;
+    /** The bearer. Present for `run402_agent_key`. Shown once. */
+    token?: string;
+    expires_at: string | null;
+    [key: string]: unknown;
+}
+/** A delegate as returned by {@link Delegates.list} — never includes a token. */
+export interface DelegateSummary {
+    id: string;
+    project_id: string;
+    principal_id: string;
+    kind: DelegateKind;
+    scope: Record<string, unknown>;
+    spend_cap: Record<string, unknown> | null;
+    expires_at: string | null;
+    revoked_at: string | null;
+    created_at: string;
+    [key: string]: unknown;
+}
+/** Result of {@link Delegates.list}. */
+export interface DelegateListResult {
+    delegates: DelegateSummary[];
+    [key: string]: unknown;
+}
+/** Result of {@link Delegates.revoke}. */
+export interface DelegateRevokeResult {
+    status: string;
+    delegate_id: string;
+    [key: string]: unknown;
+}
+//# sourceMappingURL=delegates.types.d.ts.map

package/sdk/dist/namespaces/delegates.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegates.types.d.ts","sourceRoot":"","sources":["../../src/namespaces/delegates.types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oFAAoF;AACpF,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,SAAS,GACT,kBAAkB,GAClB,qBAAqB,GACrB,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,oDAAoD;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yCAAyC;AACzC,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6CAA6C;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/sdk/dist/namespaces/delegates.types.js

@@ -0,0 +1,10 @@
+/**
+ * Request/response types for the `delegates` namespace — scoped, revocable,
+ * expiring credentials an OWNER mints for an agent (gateway
+ * `cryptographic-delegates`). Maps to `/projects/v1/:project_id/delegates`.
+ *
+ * A delegate always NARROWS an existing `project_grant`; it is never broader
+ * than the grant it hangs off, and it can never be an owner.
+ */
+export {};
+//# sourceMappingURL=delegates.types.js.map

package/sdk/dist/namespaces/delegates.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegates.types.js","sourceRoot":"","sources":["../../src/namespaces/delegates.types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/sdk/dist/namespaces/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAmB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAavB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAiF3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IA4C9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACxD,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IAQxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACxD,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAk5DD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAoB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAavB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAiF3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IA4C9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACxD,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IAQxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACxD,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAk5DD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC"}

package/sdk/dist/namespaces/deploy.js

@@ -19,6 +19,7 @@
  * behavior; this file is the implementation.
  */
 import { isCiSessionCredentials } from "../ci-credentials.js";
+import { isDelegateCredentials } from "../delegate-credentials.js";
 import { assertCiDeployableSpec } from "./ci.js";
 import { ROUTE_PRICING_NETWORKS, ROUTE_HTTP_METHODS, normalizeDeployResolveRequest, } from "./deploy.types.js";
 import { ApiError, LocalError, NetworkError, PaymentRequired, Run402DeployError, Unauthorized, isTransferFreezeError, } from "../errors.js";
@@ -3824,7 +3825,11 @@ async function uploadInlineCas(client, projectId, bytes, contentType) {
  * projects in any of today's other apikey-auth tools).
  */
 async function apikeyHeaders(client, projectId) {
-    if (isCiClient(client))
+    // A CI session and a delegate both already authorize these routes via
+    // `Authorization: Bearer`, supplied by the kernel's getAuth. Attaching an
+    // apikey beside a bearer mixes credential families on one request, which the
+    // kernel explicitly forbids — so stand down and let the bearer carry it.
+    if (isCiClient(client) || isDelegateClient(client))
         return {};
     const project = await client.getProject(projectId);
     if (!project)
@@ -3834,6 +3839,9 @@ async function apikeyHeaders(client, projectId) {
 function isCiClient(client) {
     return isCiSessionCredentials(client.credentials);
 }
+function isDelegateClient(client) {
+    return isDelegateCredentials(client.credentials);
+}
 function makeEmitter(cb) {
     if (!cb)
         return () => { };