run402 4.96.0 → 4.98.0

package/lib/delegates.mjs

@@ -1,189 +0,0 @@
-import { getSdk } from "./sdk.mjs";
-import { reportSdkError, parseFlagJson } from "./sdk-errors.mjs";
-import {
-  normalizeArgv,
-  assertKnownFlags,
-  flagValue,
-  requirePositionalCount,
-  resolveProjectSelector,
-  failUnknownSubcommand,
-} from "./argparse.mjs";
-
-const HELP = `run402 delegates — scoped deploy credentials an owner mints for an agent
-
-Usage:
-  run402 delegates <subcommand> [args...]
-
-Subcommands:
-  create --grant <grant_id> [--project <project_id>] [--capability <cap>] [--kind <kind>]
-         [--scope <json>] [--expires <iso8601>]
-                                 Mint a delegate. The bearer is printed ONCE.
-  list [--project <project_id>]          List delegates (never shows tokens)
-  revoke <delegate_id> [--project <project_id>]
-                                 Revoke immediately
-  rotate <delegate_id> [--project <project_id>]
-                                 Revoke + reissue; new bearer printed ONCE
-
-Notes:
-  - A delegate NARROWS an existing grant, so mint the grant first:
-      run402 grants create <agent-wallet> --capability deploy --project <project_id>
-    then pass the returned grant_id to 'delegates create'.
-  - Mutations require you to be an owner of the project's org (wallet SIWX).
-  - A delegate can never be an owner, and is revocable and expiring.
-  - The token is shown ONCE and is not recoverable. Store it immediately;
-    if you lose it, 'rotate' issues a new one.
-  - Use it with: RUN402_DELEGATE_TOKEN=<token> run402 deploy ...
-  - JSON in, JSON out.
-
-Why this exists:
-  Project API keys are issued once at project-create and are never re-issued.
-  An agent that loses local state therefore cannot deploy to its own project.
-  You still hold the wallet, so SIWX is enough to mint a fresh credential.
-
-Examples:
-  run402 grants create 0x90F3eB...F80a --capability deploy --project prj_abc
-  run402 delegates create --grant 1d86452e-... --project prj_abc
-  run402 delegates list --project prj_abc
-  run402 delegates revoke 5845f17b-... --project prj_abc
-`;
-
-const SUB_HELP = {
-  create: `run402 delegates create — mint a scoped deploy credential
-
-Usage:
-  run402 delegates create --grant <grant_id> [--project <project_id>] [--capability <cap>]
-                          [--kind <kind>] [--scope <json>] [--expires <iso8601>]
-
---capability defaults to "deploy". --kind defaults to "run402_agent_key" (the
-only kind that returns a bearer). --scope, if given, overrides --capability and
-must be a JSON object like {"v":1,"capabilities":["deploy"]}.
-
-The bearer is printed ONCE and cannot be read back. Store it immediately.
-Requires owner of the project's org.
-`,
-  list: `run402 delegates list — list a project's delegates
-
-Usage:
-  run402 delegates list [--project <project_id>]
-
-Never returns tokens or secret material — id, kind, scope, expiry, revocation.
-`,
-  revoke: `run402 delegates revoke — revoke a delegate immediately
-
-Usage:
-  run402 delegates revoke <delegate_id> [--project <project_id>]
-
-Takes effect for every subsequent request. Requires owner of the project's org.
-`,
-  rotate: `run402 delegates rotate — revoke and reissue in one step
-
-Usage:
-  run402 delegates rotate <delegate_id> [--project <project_id>]
-
-Keeps the same principal, grant, kind, scope, cap and expiry. The NEW bearer is
-printed once. Use this when a token is lost or possibly exposed.
-`,
-};
-
-const CREATE_VALUE_FLAGS = ["--project", "--grant", "--capability", "--kind", "--scope", "--expires"];
-
-async function create(args) {
-  const a = normalizeArgv(args);
-  assertKnownFlags(a, [...CREATE_VALUE_FLAGS, "--help", "-h"], CREATE_VALUE_FLAGS);
-  const grantId = flagValue(a, "--grant");
-  const capability = flagValue(a, "--capability") || "deploy";
-  const kind = flagValue(a, "--kind") || undefined;
-  const scopeRaw = flagValue(a, "--scope");
-  const expiresAt = flagValue(a, "--expires");
-  const { projectId, rest } = resolveProjectSelector(a, { valueFlags: CREATE_VALUE_FLAGS });
-  requirePositionalCount(rest, CREATE_VALUE_FLAGS, {
-    min: 0,
-    max: 0,
-    command: "run402 delegates create --grant <grant_id> [--project <project_id>]",
-    missing: "",
-  });
-  if (!grantId) {
-    console.error("Missing --grant <grant_id>. Mint one first:");
-    console.error("  run402 grants create <agent-wallet> --capability deploy --project <project_id>");
-    process.exit(1);
-  }
-  const scope = scopeRaw != null
-    ? parseFlagJson("--scope", scopeRaw)
-    : { v: 1, capabilities: [capability], projects: [projectId] };
-  try {
-    const res = await getSdk().delegates.create(projectId, {
-      grantId,
-      kind,
-      scope,
-      expiresAt: expiresAt || undefined,
-    });
-    console.log(JSON.stringify(res, null, 2));
-    if (res?.token) {
-      console.error("");
-      console.error("The token above is shown ONCE and cannot be read back.");
-      console.error("Store it now, then use it as: RUN402_DELEGATE_TOKEN=<token>");
-    }
-  } catch (err) {
-    reportSdkError(err);
-  }
-}
-
-async function list(args) {
-  const a = normalizeArgv(args);
-  assertKnownFlags(a, ["--project", "--help", "-h"], ["--project"]);
-  const { projectId, rest } = resolveProjectSelector(a, { valueFlags: ["--project"] });
-  requirePositionalCount(rest, ["--project"], {
-    min: 0,
-    max: 0,
-    command: "run402 delegates list [--project <project_id>]",
-    missing: "",
-  });
-  try {
-    console.log(JSON.stringify(await getSdk().delegates.list(projectId), null, 2));
-  } catch (err) {
-    reportSdkError(err);
-  }
-}
-
-function oneIdCommand(name) {
-  return async (args) => {
-    const a = normalizeArgv(args);
-    assertKnownFlags(a, ["--project", "--help", "-h"], ["--project"]);
-    const { projectId, rest } = resolveProjectSelector(a, { valueFlags: ["--project"] });
-    const [delegateId] = requirePositionalCount(rest, ["--project"], {
-      min: 1,
-      max: 1,
-      command: `run402 delegates ${name} <delegate_id> [--project <project_id>]`,
-      missing: "Missing <delegate_id>.",
-    });
-    try {
-      const res = await getSdk().delegates[name](projectId, delegateId);
-      console.log(JSON.stringify(res, null, 2));
-      if (res?.token) {
-        console.error("");
-        console.error("The token above is shown ONCE and cannot be read back.");
-      }
-    } catch (err) {
-      reportSdkError(err);
-    }
-  };
-}
-
-export async function run(sub, args) {
-  if (!sub || sub === "--help" || sub === "-h") {
-    console.log(HELP);
-    process.exit(0);
-  }
-  if (Array.isArray(args) && (args.includes("--help") || args.includes("-h"))) {
-    console.log(SUB_HELP[sub] || HELP);
-    process.exit(0);
-  }
-  switch (sub) {
-    case "create": await create(args); break;
-    case "list": await list(args); break;
-    case "revoke": await oneIdCommand("revoke")(args); break;
-    case "rotate": await oneIdCommand("rotate")(args); break;
-    default:
-      failUnknownSubcommand("delegates", sub);
-  }
-}

package/lib/lightning-wallet.mjs

@@ -1,115 +0,0 @@
-/**
- * The Lightning wallet on the CLI: mint the agent's budgeted wallet on
- * Run402's Hub, keep its pairing in the active profile's wallet.json
- * beside the Base key, report its balance, revoke it. Shared by
- * `run402 init lightning`, `run402 wallets lightning …`, and
- * `run402 wallets current`. The pairing secret is never printed.
- */
-import { readWallet, saveWallet } from "../core-dist/wallet.js";
-import { getSdk } from "./sdk.mjs";
-
-export const LIGHTNING_MINT_TIMEOUT_MS = 45_000;
-
-/** Public facts only: never the pairing. */
-export function describeLightning(localWallet, wallet = null, balance = null) {
-  const local = localWallet?.lightning ?? null;
-  if (!local && !wallet) return null;
-  return {
-    wallet_id: wallet?.wallet_id ?? local?.wallet_id ?? null,
-    status: wallet?.status ?? (local ? "active" : null),
-    custody: "run402_hub",
-    custody_note: "The sats sit on Run402's Lightning Hub; this wallet is a budgeted connection to them, not self-custody.",
-    lightning_address: wallet?.lightning_address ?? local?.lightning_address ?? null,
-    budget_sats: wallet?.budget_sats ?? local?.budget_sats ?? null,
-    starter_sats: wallet?.starter_sats ?? local?.starter_sats ?? null,
-    has_pairing: Boolean(local?.nwc),
-    minted_at: local?.minted_at ?? wallet?.activated_at ?? null,
-    ...(balance ? balance : {}),
-  };
-}
-
-/** Balance and remaining budget over NWC, best-effort (null on any failure). */
-export async function readLightningBalance(localWallet) {
-  const nwc = localWallet?.lightning?.nwc;
-  if (!nwc) return null;
-  try {
-    const { NwcWallet, closeNwcConnections } = await import("#sdk/node");
-    const wallet = new NwcWallet(nwc, { timeoutMs: 15_000 });
-    const [balance_sats, budget] = await Promise.all([wallet.getBalanceSats(), wallet.getBudgetSats().catch(() => null)]);
-    closeNwcConnections();
-    return {
-      balance_sats,
-      budget_remaining_sats: budget && budget.totalSats !== null ? budget.totalSats - budget.usedSats : null,
-    };
-  } catch {
-    return null;
-  }
-}
-
-function storePairing(localWallet, wallet) {
-  const next = {
-    ...localWallet,
-    rail: "lightning",
-    lightning: {
-      wallet_id: wallet.wallet_id,
-      nwc: wallet.pairing,
-      lightning_address: wallet.lightning_address ?? null,
-      budget_sats: wallet.budget_sats,
-      starter_sats: wallet.starter_sats,
-      custody: "run402_hub",
-      minted_at: wallet.activated_at ?? new Date().toISOString(),
-    },
-  };
-  saveWallet(next);
-  return next;
-}
-
-/**
- * Ensure the active profile holds an active Lightning wallet. Returns
- * `{ localWallet, wallet, outcome }` where outcome is `stored` (pairing just
- * saved), `present` (already held locally), `minting` (the platform is still
- * minting; rerun later), `unavailable` (no Hub on this gateway), or
- * `pairing_lost` (the wallet is active but its one-time pairing was handed to
- * another machine; revoke and mint again).
- */
-export async function ensureLightningWallet(options = {}) {
-  let localWallet = readWallet();
-  if (!localWallet) throw new Error("no local wallet configured; run `run402 init` first");
-  if (localWallet.lightning?.nwc) {
-    let wallet = null;
-    try { wallet = await getSdk().agent.lightningWallet.get(); } catch { /* offline read is fine */ }
-    if (wallet && wallet.status !== "active") return { localWallet, wallet, outcome: wallet.status };
-    return { localWallet, wallet, outcome: "present" };
-  }
-  let wallet;
-  try {
-    wallet = await getSdk().agent.lightningWallet.mint({ timeoutMs: options.timeoutMs ?? LIGHTNING_MINT_TIMEOUT_MS });
-  } catch (err) {
-    const code = err?.body?.code ?? err?.code;
-    if (code === "LIGHTNING_WALLET_NOT_AVAILABLE") return { localWallet, wallet: null, outcome: "unavailable", error: err };
-    if (code === "LIGHTNING_WALLET_STILL_MINTING") return { localWallet, wallet: null, outcome: "minting", error: err };
-    throw err;
-  }
-  if (wallet.status === "minting") return { localWallet, wallet, outcome: "minting" };
-  if (wallet.status !== "active") return { localWallet, wallet, outcome: wallet.status };
-  if (typeof wallet.pairing !== "string") return { localWallet, wallet, outcome: "pairing_lost" };
-  localWallet = storePairing(localWallet, wallet);
-  return { localWallet, wallet, outcome: "stored" };
-}
-
-/** Revoke on the platform and forget the pairing locally; the rail returns to x402. */
-export async function revokeLightningWallet() {
-  const localWallet = readWallet();
-  let wallet = null;
-  try {
-    wallet = await getSdk().agent.lightningWallet.revoke();
-  } catch (err) {
-    const code = err?.body?.code ?? err?.code;
-    if (code !== "LIGHTNING_WALLET_NOT_FOUND") throw err;
-  }
-  if (localWallet) {
-    const { lightning: _dropped, ...rest } = localWallet;
-    saveWallet({ ...rest, rail: rest.rail === "lightning" ? "x402" : rest.rail });
-  }
-  return wallet;
-}

package/sdk/dist/delegate-credentials.d.ts

@@ -1,37 +0,0 @@
-/**
- * Delegate-credential helpers.
- *
- * A delegate is a scoped, revocable, expiring bearer an OWNER mints for an
- * agent (gateway `cryptographic-delegates`, v1.79). It authenticates the same
- * routes a CI session does — including the apikey-gated `/content/v1/*` CAS
- * routes — so from the client's perspective it behaves exactly like the CI
- * session path: the bearer rides `Authorization`, and helpers that would
- * otherwise attach a project `apikey` must stand down so the two credential
- * families never mix on one request.
- *
- * Why this exists at all: project API keys are stateless JWTs issued once at
- * project-create and never re-issued. An agent that loses local state (fresh
- * container, new sandbox) therefore has no cached apikey and no way to deploy
- * to a project it owns. The owner still holds the wallet, so they can mint a
- * delegate with SIWX and hand it to the agent.
- */
-import type { CredentialsProvider } from "./credentials.js";
-export declare const DELEGATE_CREDENTIALS: unique symbol;
-export interface DelegateMarkedCredentialsProvider extends CredentialsProvider {
-    readonly [DELEGATE_CREDENTIALS]: true;
-}
-/**
- * True when this provider is presenting a delegate bearer for the current
- * request family. Consumers use it the same way they use
- * `isCiSessionCredentials` — to suppress apikey attachment.
- */
-export declare function isDelegateCredentials(credentials: CredentialsProvider): boolean;
-/** Environment variable carrying a delegate bearer for non-interactive runs. */
-export declare const DELEGATE_TOKEN_ENV = "RUN402_DELEGATE_TOKEN";
-/**
- * Read a delegate bearer from the environment. Whitespace-trimmed; an empty or
- * whitespace-only value is treated as absent so `RUN402_DELEGATE_TOKEN=` in a
- * shell profile does not silently disable every other credential class.
- */
-export declare function delegateTokenFromEnv(env?: NodeJS.ProcessEnv): string | undefined;
-//# sourceMappingURL=delegate-credentials.d.ts.map

package/sdk/dist/delegate-credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegate-credentials.d.ts","sourceRoot":"","sources":["../src/delegate-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,eAAO,MAAM,oBAAoB,eAAiD,CAAC;AAEnF,MAAM,WAAW,iCAAkC,SAAQ,mBAAmB;IAC5E,QAAQ,CAAC,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,mBAAmB,GAAG,OAAO,CAE/E;AAED,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAKpB"}

package/sdk/dist/delegate-credentials.js

@@ -1,41 +0,0 @@
-/**
- * Delegate-credential helpers.
- *
- * A delegate is a scoped, revocable, expiring bearer an OWNER mints for an
- * agent (gateway `cryptographic-delegates`, v1.79). It authenticates the same
- * routes a CI session does — including the apikey-gated `/content/v1/*` CAS
- * routes — so from the client's perspective it behaves exactly like the CI
- * session path: the bearer rides `Authorization`, and helpers that would
- * otherwise attach a project `apikey` must stand down so the two credential
- * families never mix on one request.
- *
- * Why this exists at all: project API keys are stateless JWTs issued once at
- * project-create and never re-issued. An agent that loses local state (fresh
- * container, new sandbox) therefore has no cached apikey and no way to deploy
- * to a project it owns. The owner still holds the wallet, so they can mint a
- * delegate with SIWX and hand it to the agent.
- */
-export const DELEGATE_CREDENTIALS = Symbol.for("@run402/sdk/delegate-credentials");
-/**
- * True when this provider is presenting a delegate bearer for the current
- * request family. Consumers use it the same way they use
- * `isCiSessionCredentials` — to suppress apikey attachment.
- */
-export function isDelegateCredentials(credentials) {
-    return Boolean(credentials[DELEGATE_CREDENTIALS]);
-}
-/** Environment variable carrying a delegate bearer for non-interactive runs. */
-export const DELEGATE_TOKEN_ENV = "RUN402_DELEGATE_TOKEN";
-/**
- * Read a delegate bearer from the environment. Whitespace-trimmed; an empty or
- * whitespace-only value is treated as absent so `RUN402_DELEGATE_TOKEN=` in a
- * shell profile does not silently disable every other credential class.
- */
-export function delegateTokenFromEnv(env = process.env) {
-    const raw = env[DELEGATE_TOKEN_ENV];
-    if (typeof raw !== "string")
-        return undefined;
-    const trimmed = raw.trim();
-    return trimmed.length > 0 ? trimmed : undefined;
-}
-//# sourceMappingURL=delegate-credentials.js.map

package/sdk/dist/delegate-credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegate-credentials.js","sourceRoot":"","sources":["../src/delegate-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAMnF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAgC;IACpE,OAAO,OAAO,CAAE,WAA0D,CAAC,oBAAoB,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC"}

package/sdk/dist/namespaces/delegates.d.ts

@@ -1,50 +0,0 @@
-/**
- * `delegates` namespace — scoped, revocable, expiring credentials an OWNER
- * mints for an agent (gateway `cryptographic-delegates`, v1.79). Maps to
- * `/projects/v1/:project_id/delegates`. Every mutation requires the caller to
- * be an active owner of the project's owning org.
- *
- * A delegate always NARROWS an existing `project_grant` — mint the grant first
- * (`r.grants.create(...)`), then hang a delegate off its `grant_id`. A delegate
- * can never be an owner; that is enforced structurally by the gateway.
- *
- * The practical reason this exists on the client: project API keys are
- * stateless JWTs handed out once at create and never re-issued, so an agent
- * that loses local state has no way back into its own project. A delegate is
- * the supported recovery path — the owner still holds a wallet, and SIWX is
- * enough to mint a fresh deploy credential.
- *
- * Exposed both unscoped (`r.delegates.create(projectId, …)`) and
- * project-scoped (`r.project(id).delegates.create(…)`), mirroring `r.grants`.
- */
-import type { Client } from "../kernel.js";
-import type { CreateDelegateInput, DelegateCreateResult, DelegateListResult, DelegateRevokeResult } from "./delegates.types.js";
-export declare class Delegates {
-    private readonly client;
-    constructor(client: Client);
-    /**
-     * Issue a delegate against an existing grant
-     * (`POST /projects/v1/:project_id/delegates`). Requires owner of the project's org.
-     *
-     * The returned `token` is shown **once**. Persist it immediately; there is no
-     * way to read it back, only to rotate for a new one.
-     */
-    create(projectId: string, input: CreateDelegateInput): Promise<DelegateCreateResult>;
-    /**
-     * List a project's delegates (`GET /projects/v1/:project_id/delegates`).
-     * Never returns a token or any secret material — names, scope and caps only.
-     */
-    list(projectId: string): Promise<DelegateListResult>;
-    /**
-     * Revoke a delegate (`DELETE /projects/v1/:project_id/delegates/:delegate_id`).
-     * Effective immediately for subsequent requests.
-     */
-    revoke(projectId: string, delegateId: string): Promise<DelegateRevokeResult>;
-    /**
-     * Rotate a delegate (`POST /projects/v1/:project_id/delegates/:delegate_id/rotate`)
-     * — revokes the old credential and reissues the same principal/grant/scope/cap.
-     * The new `token` is again shown once.
-     */
-    rotate(projectId: string, delegateId: string): Promise<DelegateCreateResult>;
-}
-//# sourceMappingURL=delegates.d.ts.map

package/sdk/dist/namespaces/delegates.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegates.d.ts","sourceRoot":"","sources":["../../src/namespaces/delegates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EAErB,MAAM,sBAAsB,CAAC;AAE9B,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;;;OAMG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgC1F;;;OAGG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAU1D;;;OAGG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAalF;;;;OAIG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAYnF"}

package/sdk/dist/namespaces/delegates.js

@@ -1,99 +0,0 @@
-/**
- * `delegates` namespace — scoped, revocable, expiring credentials an OWNER
- * mints for an agent (gateway `cryptographic-delegates`, v1.79). Maps to
- * `/projects/v1/:project_id/delegates`. Every mutation requires the caller to
- * be an active owner of the project's owning org.
- *
- * A delegate always NARROWS an existing `project_grant` — mint the grant first
- * (`r.grants.create(...)`), then hang a delegate off its `grant_id`. A delegate
- * can never be an owner; that is enforced structurally by the gateway.
- *
- * The practical reason this exists on the client: project API keys are
- * stateless JWTs handed out once at create and never re-issued, so an agent
- * that loses local state has no way back into its own project. A delegate is
- * the supported recovery path — the owner still holds a wallet, and SIWX is
- * enough to mint a fresh deploy credential.
- *
- * Exposed both unscoped (`r.delegates.create(projectId, …)`) and
- * project-scoped (`r.project(id).delegates.create(…)`), mirroring `r.grants`.
- */
-import { LocalError } from "../errors.js";
-export class Delegates {
-    client;
-    constructor(client) {
-        this.client = client;
-    }
-    /**
-     * Issue a delegate against an existing grant
-     * (`POST /projects/v1/:project_id/delegates`). Requires owner of the project's org.
-     *
-     * The returned `token` is shown **once**. Persist it immediately; there is no
-     * way to read it back, only to rotate for a new one.
-     */
-    async create(projectId, input) {
-        if (!projectId) {
-            throw new LocalError("delegates.create requires a projectId", "issuing project delegate");
-        }
-        if (!input?.grantId) {
-            throw new LocalError("delegates.create requires { grantId } — mint a grant first with grants.create()", "issuing project delegate");
-        }
-        // The gateway REQUIRES a scope object and 400s without one. Default to the
-        // common case (this grant's capability on this project) so the caller does
-        // not have to know the wire schema to do the obvious thing.
-        const scope = input.scope ?? {
-            v: 1,
-            capabilities: ["deploy"],
-            projects: [projectId],
-        };
-        const body = {
-            grant_id: input.grantId,
-            kind: input.kind ?? "run402_agent_key",
-            scope,
-        };
-        if (input.spendCap !== undefined)
-            body.spend_cap = input.spendCap;
-        if (input.expiresAt !== undefined)
-            body.expires_at = input.expiresAt;
-        if (input.publicSubject !== undefined)
-            body.public_subject = input.publicSubject;
-        return this.client.request(`/projects/v1/${encodeURIComponent(projectId)}/delegates`, { method: "POST", body, context: "issuing project delegate" });
-    }
-    /**
-     * List a project's delegates (`GET /projects/v1/:project_id/delegates`).
-     * Never returns a token or any secret material — names, scope and caps only.
-     */
-    async list(projectId) {
-        if (!projectId) {
-            throw new LocalError("delegates.list requires a projectId", "listing project delegates");
-        }
-        return this.client.request(`/projects/v1/${encodeURIComponent(projectId)}/delegates`, { method: "GET", context: "listing project delegates" });
-    }
-    /**
-     * Revoke a delegate (`DELETE /projects/v1/:project_id/delegates/:delegate_id`).
-     * Effective immediately for subsequent requests.
-     */
-    async revoke(projectId, delegateId) {
-        if (!projectId) {
-            throw new LocalError("delegates.revoke requires a projectId", "revoking project delegate");
-        }
-        if (!delegateId) {
-            throw new LocalError("delegates.revoke requires a delegateId", "revoking project delegate");
-        }
-        return this.client.request(`/projects/v1/${encodeURIComponent(projectId)}/delegates/${encodeURIComponent(delegateId)}`, { method: "DELETE", context: "revoking project delegate" });
-    }
-    /**
-     * Rotate a delegate (`POST /projects/v1/:project_id/delegates/:delegate_id/rotate`)
-     * — revokes the old credential and reissues the same principal/grant/scope/cap.
-     * The new `token` is again shown once.
-     */
-    async rotate(projectId, delegateId) {
-        if (!projectId) {
-            throw new LocalError("delegates.rotate requires a projectId", "rotating project delegate");
-        }
-        if (!delegateId) {
-            throw new LocalError("delegates.rotate requires a delegateId", "rotating project delegate");
-        }
-        return this.client.request(`/projects/v1/${encodeURIComponent(projectId)}/delegates/${encodeURIComponent(delegateId)}/rotate`, { method: "POST", context: "rotating project delegate" });
-    }
-}
-//# sourceMappingURL=delegates.js.map

package/sdk/dist/namespaces/delegates.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegates.js","sourceRoot":"","sources":["../../src/namespaces/delegates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAS1C,MAAM,OAAO,SAAS;IACS;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,KAA0B;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,0BAA0B,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,UAAU,CAClB,iFAAiF,EACjF,0BAA0B,CAC3B,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,KAAK,GAAkB,KAAK,CAAC,KAAK,IAAI;YAC1C,CAAC,EAAE,CAAC;YACJ,YAAY,EAAE,CAAC,QAAQ,CAAC;YACxB,QAAQ,EAAE,CAAC,SAAS,CAAC;SACtB,CAAC;QACF,MAAM,IAAI,GAA4B;YACpC,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,kBAAkB;YACtC,KAAK;SACN,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;QAClE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACrE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC;QACjF,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,YAAY,EACzD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,qCAAqC,EAAE,2BAA2B,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,YAAY,EACzD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,CACxD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,UAAkB;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,2BAA2B,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,UAAU,CAAC,wCAAwC,EAAE,2BAA2B,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAC3F,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,UAAkB;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,2BAA2B,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,UAAU,CAAC,wCAAwC,EAAE,2BAA2B,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAClG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE,CACzD,CAAC;IACJ,CAAC;CACF"}

package/sdk/dist/namespaces/delegates.types.d.ts

@@ -1,88 +0,0 @@
-/**
- * Request/response types for the `delegates` namespace — scoped, revocable,
- * expiring credentials an OWNER mints for an agent (gateway
- * `cryptographic-delegates`). Maps to `/projects/v1/:project_id/delegates`.
- *
- * A delegate always NARROWS an existing `project_grant`; it is never broader
- * than the grant it hangs off, and it can never be an owner.
- */
-/** Delegate kinds the gateway accepts. Only `run402_agent_key` returns a bearer. */
-export type DelegateKind = "run402_agent_key" | "ci_oidc" | "tempo_access_key" | "base_disposable_eoa" | "erc7710";
-/**
- * Delegate scope (`scope` JSONB, compiled server-side to `DelegateScopeV1`).
- * REQUIRED by the gateway — omitting it returns `400 INVALID_DELEGATE_SCOPE`.
- */
-export interface DelegateScope {
-    /** Schema version. Must be `1`. */
-    v: 1;
-    /** Non-empty capability list, e.g. `["deploy"]`. */
-    capabilities: string[];
-    /** Optional project allowlist. Defaults to the issuing project. */
-    projects?: string[];
-    [key: string]: unknown;
-}
-/** Spend cap (`spend_cap` JSONB). Enforced at SEND time, not control-plane authz. */
-export interface DelegateSpendCap {
-    v: 1;
-    currency: "usd_micros";
-    per_tx?: number;
-    per_period?: number;
-    [key: string]: unknown;
-}
-/** Input to {@link Delegates.create}. */
-export interface CreateDelegateInput {
-    /** The `project_grant` this delegate narrows. Required by the gateway. */
-    grantId: string;
-    /** Delegate kind. Defaults to `"run402_agent_key"` (the bearer-returning kind). */
-    kind?: DelegateKind;
-    /**
-     * Scope. If omitted the SDK sends `{ v:1, capabilities:["deploy"], projects:[projectId] }`
-     * so the common "let this agent deploy this one project" case is one call.
-     */
-    scope?: DelegateScope;
-    /** Optional spend cap (payment rails only). */
-    spendCap?: DelegateSpendCap;
-    /** Optional ISO-8601 expiry. Omit for a non-expiring delegate. */
-    expiresAt?: string | null;
-    /** Optional rail-specific public subject. */
-    publicSubject?: string;
-}
-/**
- * Result of {@link Delegates.create} / {@link Delegates.rotate}.
- *
- * `token` is returned **once** and never again — persist it immediately
- * (Secrets Manager, CI secret) or you must rotate to get a new one.
- */
-export interface DelegateCreateResult {
-    status: string;
-    delegate_id: string;
-    /** The bearer. Present for `run402_agent_key`. Shown once. */
-    token?: string;
-    expires_at: string | null;
-    [key: string]: unknown;
-}
-/** A delegate as returned by {@link Delegates.list} — never includes a token. */
-export interface DelegateSummary {
-    id: string;
-    project_id: string;
-    principal_id: string;
-    kind: DelegateKind;
-    scope: Record<string, unknown>;
-    spend_cap: Record<string, unknown> | null;
-    expires_at: string | null;
-    revoked_at: string | null;
-    created_at: string;
-    [key: string]: unknown;
-}
-/** Result of {@link Delegates.list}. */
-export interface DelegateListResult {
-    delegates: DelegateSummary[];
-    [key: string]: unknown;
-}
-/** Result of {@link Delegates.revoke}. */
-export interface DelegateRevokeResult {
-    status: string;
-    delegate_id: string;
-    [key: string]: unknown;
-}
-//# sourceMappingURL=delegates.types.d.ts.map

package/sdk/dist/namespaces/delegates.types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegates.types.d.ts","sourceRoot":"","sources":["../../src/namespaces/delegates.types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oFAAoF;AACpF,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,SAAS,GACT,kBAAkB,GAClB,qBAAqB,GACrB,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,CAAC,EAAE,CAAC,CAAC;IACL,oDAAoD;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yCAAyC;AACzC,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6CAA6C;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/sdk/dist/namespaces/delegates.types.js

@@ -1,10 +0,0 @@
-/**
- * Request/response types for the `delegates` namespace — scoped, revocable,
- * expiring credentials an OWNER mints for an agent (gateway
- * `cryptographic-delegates`). Maps to `/projects/v1/:project_id/delegates`.
- *
- * A delegate always NARROWS an existing `project_grant`; it is never broader
- * than the grant it hangs off, and it can never be an owner.
- */
-export {};
-//# sourceMappingURL=delegates.types.js.map

package/sdk/dist/namespaces/delegates.types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegates.types.js","sourceRoot":"","sources":["../../src/namespaces/delegates.types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}