run402-mcp/sdk/dist/control-plane-credentials.js

MCP server for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.

/**
 * **Sign-in session** credential provider (gateway v1.78). Carries a
 * `control_plane_session` bearer so the whole SDK authenticates as the person's
 * principal — the token is accepted everywhere a SIWX wallet is, so `r.org.*`,
 * `r.admin.transfers.*`, and `r.session.*` all act as that principal. A
 * `device`-grade session is read-only (`SESSION_READ_ONLY` on every mutation).
 *
 * Isomorphic — no Node APIs. Mint a session with `r.session.verifyEmail`
 * / `passkeyVerify` / the loopback-PKCE `exchangeCliToken`, then:
 *
 *   const r = run402({ credentials: controlPlaneSessionCredentials({ token }) });
 *   await r.orgs.whoami();           // resolves the principal + memberships
 *
 * High-stakes writes still require a fresh passkey — an `email`/`oauth` session
 * gets {@link StepUpRequiredError}; run the step-up ceremony
 * (`r.session.stepUpOptions`/`stepUpVerify`) and retry.
 *
 * This credential authenticates control-plane operations only; it carries no
 * project anon/service keys, so {@link CredentialsProvider.getProject} returns
 * null (project-key operations need the keystore/wallet).
 */
import { LocalError } from "./errors.js";
/** Brand marking a provider as control-plane-session-backed. */
export const CONTROL_PLANE_SESSION_CREDENTIALS = Symbol.for("@run402/sdk/control-plane-session-credentials");
/** True if `credentials` was created by {@link controlPlaneSessionCredentials}. */
export function isControlPlaneSessionCredentials(credentials) {
    return Boolean(credentials[CONTROL_PLANE_SESSION_CREDENTIALS]);
}
/**
 * Build a {@link CredentialsProvider} that authenticates every request with a
 * `control_plane_session` bearer. Pass a static `token`, or a `getToken`
 * resolver for rotation.
 */
export function controlPlaneSessionCredentials(opts) {
    if (!opts?.token && !opts?.getToken) {
        throw new LocalError("controlPlaneSessionCredentials requires token or getToken", "creating control-plane session credentials");
    }
    const provider = {
        async getAuth() {
            const token = opts.getToken ? await opts.getToken() : opts.token;
            if (!token) {
                throw new LocalError("control-plane session credentials did not return a token", "authenticating with control-plane session");
            }
            return { Authorization: `Bearer ${token}` };
        },
        async getProject() {
            // A control-plane session carries no project anon/service keys.
            return null;
        },
    };
    Object.defineProperty(provider, CONTROL_PLANE_SESSION_CREDENTIALS, {
        value: true,
        enumerable: false,
    });
    return provider;
}
//# sourceMappingURL=control-plane-credentials.js.map