@beacon-build/sdk 1.45.0 → 1.46.1

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # @beacon-build/sdk Changelog
 
+## 1.46.1
+
+### Patch Changes
+
+- c8cb537: C584: read-only Org-Settings-Viewer in the org Config tab — typed system-settings panel (source badge, "Verlauf" audit history, Advanced/Raw section for unregistered keys); adds SettingsClient.audit() SDK method for the existing GET /admin/config/audit endpoint.
+- 8868c4f: F447: full-session subagent data foundation — window-uncapped per-subagent aggregate, read-side title/state correlation, GET /sessions/:id/subagents, C374-safe card-badge rollup join
+- 8e089fa: C585: lightweight Project.config KV editor (PATCH /{slug}/config), split config/env write-guard, and enc:-secret masking on project config reads
+- cd20679: F449: unified DB-encrypted secrets across user/org/system/project settings scopes
+- cdda7e9: C595: task thread MCP tools (task_messages_list/post, task_participants_list, task_watch/unwatch) now use the AgentSdk (AgentTasksClient) instead of a raw agentApiFetch call — same behavior, centralized error/auth handling via HttpClient. Adds HttpClient.postWithStatus for endpoints that must recover the HTTP status alongside an identical-body response.
+- 5b28c0c: C606: envelope the CON-25-touched /agents routes (agents.ts, agents-config.ts, agents-identity.ts, agents-mutations.ts, and the task-stats/config GET blind spots a variable-returning handler hid from the static rule) in the standard `{ data }` response shape; OpsApiClient-based readers (agent.service.ts, agents-ops.client.ts, task.service.ts) updated to unwrap.
+- Updated dependencies [8868c4f]
+- Updated dependencies [8e089fa]
+- Updated dependencies [8d49c10]
+- Updated dependencies [cd20679]
+- Updated dependencies [5fa8de7]
+- Updated dependencies [067acca]
+- Updated dependencies [a14db7b]
+- Updated dependencies [d1a5ed9]
+- Updated dependencies [b1aab9d]
+- Updated dependencies [da019c8]
+- Updated dependencies [9cf01a0]
+- Updated dependencies [ee73f04]
+- Updated dependencies [4d34737]
+- Updated dependencies [5a56b1f]
+- Updated dependencies [5b28c0c]
+    - @beacon-build/core@1.46.1
+
+## 1.46.0
+
+### Minor Changes
+
+- ac38e31: F444: Access Console — unified Global/Org/Personal role assignment. Adds AccessGrantService (transactional grant/invite write path), getEffectiveGrants (read facade), resolveScopeTarget (scope→table mapping), additive Invite.grants JSONB column, and an ancestor-aware retrofit for org member grant/revoke authority.
+
+### Patch Changes
+
+- 7179837: chore(C573): extract shared createRotatingJwtProvider helper (packages/sdk) — DRY consolidation of the B468 rotating-JWT pattern (boot-mint fail-fast + unref'd-timer refresh non-fatal) previously duplicated in mcp/agent, apps/ide, and services/janitor. No behavior change.
+- 62d3988: C572 (FS54/10): fold the last /agent/v1 residuals (capabilities, checkins, session anchor, search) onto their canonical /api/v1/{resource} paths with per-audience dispatch; delete the agentV1 tree and its CON-25 allowlist entry.
+- b1c751b: chore(C576): remove dead AgentMessagingClient + the legacy /api/agent/v1 SDK basePath client (no matching server route in services/api; msg_search already migrated to sdk.search under /api/v1). Every agent client now rides the canonical /api/v1 basePath. Also trimmed a stale comment in mcp/agent msg-search that referenced the removed client. No user-facing behavior change.
+- Updated dependencies [1e7fd50]
+- Updated dependencies [3ffafd2]
+- Updated dependencies [354c17a]
+- Updated dependencies [1437bef]
+- Updated dependencies [b17bc28]
+- Updated dependencies [f9e4d8f]
+- Updated dependencies [f2f1b3c]
+- Updated dependencies [ac38e31]
+- Updated dependencies [39405ed]
+- Updated dependencies [5b1c9d8]
+    - @beacon-build/core@1.46.0
+
 ## 1.45.0
 
 ### Minor Changes

package/dist/auth/rotating-jwt-provider.d.ts

@@ -0,0 +1,52 @@
+/**
+ * C573 — DRY: shared rotating-JWT provider (B468 follow-up).
+ *
+ * B468 fixed a real outage (an agent-JWT minted once at boot, never refreshed, so a
+ * long-running daemon went dark once past the token's TTL — every `/v1/*` call 401'd
+ * with no self-heal) but landed the fix ~15 lines at a time, near-identically copied into
+ * THREE call sites: `mcp/agent/src/server-setup.ts` (`createServices`), `apps/ide/src/
+ * argus-jwt.ts` (`createRotatingArgusJwt`), and `services/janitor/src/alerts/index.ts`.
+ * This is that pattern, factored once.
+ *
+ * Shape: mint at boot (fail-fast — a boot-time credential failure must be loud, not a
+ * silent degrade to no services at all), hold the token in a mutable binding, hand back a
+ * PROVIDER (`() => string`, re-read per request — give THIS to every HTTP client, never a
+ * captured string) and start an unref'd timer that re-mints on `refreshMs`. The scheduled
+ * refresh is NON-fatal (unlike the boot mint): on failure it keeps the current credential
+ * (still valid for the rest of its TTL window) and retries on the next tick — it never
+ * exits the process.
+ *
+ * Placed in `packages/sdk` (not `packages/infrastructure`): `infrastructure` already
+ * depends on `sdk`, and `sdk` is the deepest layer already imported directly by all three
+ * call sites — putting the helper here adds no new dependency edge.
+ *
+ * `log` is a minimal structural subset of `@beacon-build/logger`'s `ILogger` port (info +
+ * error only) rather than an import of that type — `sdk` has no dependency on
+ * `@beacon-build/logger` today, and every caller's real logger already satisfies this
+ * shape, so no new dependency edge is needed for typing either.
+ */
+export interface RotatingJwtLog {
+    info(message: string, context?: Record<string, unknown>): void;
+    error(message: string, context?: Record<string, unknown>): void;
+}
+/** Result of a single mint call: the token itself, plus optional context merged into the
+ *  helper's own boot/refresh log lines (e.g. `{ agentId }`) — so callers keep their
+ *  existing observability without owning their own boot/refresh log messages. */
+export interface JwtMintResult {
+    token: string;
+    logContext?: Record<string, unknown>;
+}
+export interface RotatingJwtProviderOptions {
+    /** Interval between scheduled refreshes, ms. Convention: HALF the token's TTL, so a
+     *  single failed refresh still leaves the current token valid for the rest of its
+     *  window — one transient mint blip never causes an outage. */
+    refreshMs: number;
+    log: RotatingJwtLog;
+}
+/**
+ * Mint `mintFn` once at boot (fail-fast on failure — exits the process), then keep the
+ * token rotating for the life of a long-running daemon on an unref'd timer. Returns a
+ * PROVIDER — re-read per request — never a captured string.
+ */
+export declare function createRotatingJwtProvider(mintFn: () => Promise<JwtMintResult>, { refreshMs, log }: RotatingJwtProviderOptions): Promise<() => string>;
+//# sourceMappingURL=rotating-jwt-provider.d.ts.map

package/dist/auth/rotating-jwt-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotating-jwt-provider.d.ts","sourceRoot":"","sources":["../../src/auth/rotating-jwt-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,cAAc;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAC9D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CAClE;AAED;;iFAEiF;AACjF,MAAM,WAAW,aAAa;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACvC;AAED,MAAM,WAAW,0BAA0B;IACvC;;mEAE+D;IAC/D,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,cAAc,CAAA;CACtB;AAkBD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC3C,MAAM,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,EACpC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,0BAA0B,GAC/C,OAAO,CAAC,MAAM,MAAM,CAAC,CAsBvB"}

package/dist/auth/rotating-jwt-provider.js

@@ -0,0 +1,68 @@
+/**
+ * C573 — DRY: shared rotating-JWT provider (B468 follow-up).
+ *
+ * B468 fixed a real outage (an agent-JWT minted once at boot, never refreshed, so a
+ * long-running daemon went dark once past the token's TTL — every `/v1/*` call 401'd
+ * with no self-heal) but landed the fix ~15 lines at a time, near-identically copied into
+ * THREE call sites: `mcp/agent/src/server-setup.ts` (`createServices`), `apps/ide/src/
+ * argus-jwt.ts` (`createRotatingArgusJwt`), and `services/janitor/src/alerts/index.ts`.
+ * This is that pattern, factored once.
+ *
+ * Shape: mint at boot (fail-fast — a boot-time credential failure must be loud, not a
+ * silent degrade to no services at all), hold the token in a mutable binding, hand back a
+ * PROVIDER (`() => string`, re-read per request — give THIS to every HTTP client, never a
+ * captured string) and start an unref'd timer that re-mints on `refreshMs`. The scheduled
+ * refresh is NON-fatal (unlike the boot mint): on failure it keeps the current credential
+ * (still valid for the rest of its TTL window) and retries on the next tick — it never
+ * exits the process.
+ *
+ * Placed in `packages/sdk` (not `packages/infrastructure`): `infrastructure` already
+ * depends on `sdk`, and `sdk` is the deepest layer already imported directly by all three
+ * call sites — putting the helper here adds no new dependency edge.
+ *
+ * `log` is a minimal structural subset of `@beacon-build/logger`'s `ILogger` port (info +
+ * error only) rather than an import of that type — `sdk` has no dependency on
+ * `@beacon-build/logger` today, and every caller's real logger already satisfies this
+ * shape, so no new dependency edge is needed for typing either.
+ */
+async function mintAtBoot(mintFn, log) {
+    try {
+        const { token, logContext } = await mintFn();
+        log.info('minted rotating JWT at boot', logContext);
+        return token;
+    }
+    catch (err) {
+        log.error('rotating JWT boot mint failed', {
+            error: err instanceof Error ? err.message : String(err),
+        });
+        process.exit(1);
+    }
+}
+/**
+ * Mint `mintFn` once at boot (fail-fast on failure — exits the process), then keep the
+ * token rotating for the life of a long-running daemon on an unref'd timer. Returns a
+ * PROVIDER — re-read per request — never a captured string.
+ */
+export async function createRotatingJwtProvider(mintFn, { refreshMs, log }) {
+    let current = await mintAtBoot(mintFn, log);
+    const timer = setInterval(() => {
+        void (async () => {
+            try {
+                const { token, logContext } = await mintFn();
+                current = token;
+                log.info('refreshed rotating JWT (scheduled)', logContext);
+            }
+            catch (err) {
+                // Non-fatal (unlike the boot mint): keep the current credential, still
+                // valid for the rest of its TTL window, and retry on the next tick. Never
+                // exit the process on a transient refresh failure.
+                log.error('rotating JWT refresh failed — keeping current', {
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+        })();
+    }, refreshMs);
+    timer.unref();
+    return () => current;
+}
+//# sourceMappingURL=rotating-jwt-provider.js.map

package/dist/auth/rotating-jwt-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotating-jwt-provider.js","sourceRoot":"","sources":["../../src/auth/rotating-jwt-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAuBH,KAAK,UAAU,UAAU,CACrB,MAAoC,EACpC,GAAmB;IAEnB,IAAI,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,CAAA;QAC5C,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAA;QACnD,OAAO,KAAK,CAAA;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,+BAA+B,EAAE;YACvC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC,CAAA;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC3C,MAAoC,EACpC,EAAE,SAAS,EAAE,GAAG,EAA8B;IAE9C,IAAI,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAE3C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC3B,KAAK,CAAC,KAAK,IAAI,EAAE;YACb,IAAI,CAAC;gBACD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,CAAA;gBAC5C,OAAO,GAAG,KAAK,CAAA;gBACf,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,UAAU,CAAC,CAAA;YAC9D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,uEAAuE;gBACvE,0EAA0E;gBAC1E,mDAAmD;gBACnD,GAAG,CAAC,KAAK,CAAC,+CAA+C,EAAE;oBACvD,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBAC1D,CAAC,CAAA;YACN,CAAC;QACL,CAAC,CAAC,EAAE,CAAA;IACR,CAAC,EAAE,SAAS,CAAC,CAAA;IACb,KAAK,CAAC,KAAK,EAAE,CAAA;IAEb,OAAO,GAAG,EAAE,CAAC,OAAO,CAAA;AACxB,CAAC"}

package/dist/clients/admin/access-grants.client.d.ts

@@ -0,0 +1,56 @@
+import type { HttpClient } from '../../transport/http-client.js';
+export type ScopeSelectorDto = {
+    type: 'org';
+    orgId: string;
+} | {
+    type: 'project';
+    project: string;
+} | {
+    type: 'global';
+};
+export interface GrantRowDto {
+    scope: ScopeSelectorDto;
+    role: string;
+}
+export interface AccessGrantCandidateInput {
+    userId?: string;
+    email?: string;
+}
+export interface CreateAccessGrantInput {
+    candidate: AccessGrantCandidateInput;
+    contextOrgId?: string;
+    rows: GrantRowDto[];
+}
+export interface GrantedRowDto {
+    scope: ScopeSelectorDto;
+    role: string;
+    table: 'actor_role' | 'project_access';
+}
+export type AccessGrantResultDto = {
+    kind: 'granted';
+    grants: GrantedRowDto[];
+} | {
+    kind: 'invited';
+    invite: {
+        id: string;
+        email: string;
+        token: string;
+        expiresAt: string;
+        grants: GrantRowDto[];
+    };
+};
+export interface GlobalVendorDto {
+    userId: string;
+    email: string | null;
+    name: string | null;
+}
+/**
+ * F444/INV-13 — the SDK client for the Access Console's ONE grant/invite write endpoint.
+ */
+export declare class AccessGrantsClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    create(input: CreateAccessGrantInput): Promise<AccessGrantResultDto>;
+    listVendors(): Promise<GlobalVendorDto[]>;
+}
+//# sourceMappingURL=access-grants.client.d.ts.map

package/dist/clients/admin/access-grants.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-grants.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/access-grants.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE,MAAM,MAAM,gBAAgB,GACtB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAExB,MAAM,WAAW,WAAW;IACxB,KAAK,EAAE,gBAAgB,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,yBAAyB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,sBAAsB;IACnC,SAAS,EAAE,yBAAyB,CAAA;IACpC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,IAAI,EAAE,WAAW,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC1B,KAAK,EAAE,gBAAgB,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,YAAY,GAAG,gBAAgB,CAAA;CACzC;AAED,MAAM,MAAM,oBAAoB,GAC1B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,GAC5C;IACI,IAAI,EAAE,SAAS,CAAA;IACf,MAAM,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,WAAW,EAAE,CAAA;KACxB,CAAA;CACJ,CAAA;AAEP,MAAM,WAAW,eAAe;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED;;GAEG;AACH,qBAAa,kBAAkB;IACf,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAIpE,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;CAGlD"}

package/dist/clients/admin/access-grants.client.js

@@ -0,0 +1,16 @@
+/**
+ * F444/INV-13 — the SDK client for the Access Console's ONE grant/invite write endpoint.
+ */
+export class AccessGrantsClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    async create(input) {
+        return this.http.post('/access-grants', input);
+    }
+    async listVendors() {
+        return this.http.get('/access-grants/vendors');
+    }
+}
+//# sourceMappingURL=access-grants.client.js.map

package/dist/clients/admin/access-grants.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-grants.client.js","sourceRoot":"","sources":["../../../src/clients/admin/access-grants.client.ts"],"names":[],"mappings":"AAgDA;;GAEG;AACH,MAAM,OAAO,kBAAkB;IACE;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,MAAM,CAAC,KAA6B;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,gBAAgB,EAAE,KAAK,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAoB,wBAAwB,CAAC,CAAA;IACrE,CAAC;CACJ"}

package/dist/clients/admin/organizations.client.d.ts

@@ -17,6 +17,33 @@ export interface AddMemberInput {
     userId: string;
     role?: string;
 }
+export interface MemberCandidateDto {
+    userId: string;
+    email: string;
+    name: string | null;
+    contextOrgName: string;
+    isAncestor: boolean;
+}
+export interface InviteGrantDto {
+    role: string;
+    orgId?: string;
+    project?: string;
+}
+export interface InviteDto {
+    id: string;
+    email: string;
+    status: string;
+    role: string;
+    orgId: string | null;
+    project: string | null;
+    grants: InviteGrantDto[] | null;
+    expiresAt: string;
+    createdAt: string;
+}
+export interface OrgConfigAllDto {
+    organizationId: string;
+    settings: Record<string, unknown>;
+}
 export declare class AdminOrganizationsClient {
     private readonly http;
     constructor(http: HttpClient);
@@ -30,5 +57,15 @@ export declare class AdminOrganizationsClient {
     removeMember(slug: string, userId: string): Promise<void>;
     getAncestors(id: string): Promise<OrganizationDto[]>;
     getDescendants(id: string): Promise<OrganizationDto[]>;
+    getMemberCandidates(id: string, q?: string): Promise<MemberCandidateDto[]>;
+    listInvites(id: string): Promise<InviteDto[]>;
+    resendInvite(id: string, inviteId: string): Promise<InviteDto>;
+    revokeInvite(id: string, inviteId: string): Promise<void>;
+    getConfig(id: string): Promise<OrgConfigAllDto>;
+    setConfig(id: string, key: string, value: unknown): Promise<{
+        key: string;
+        organizationId: string;
+        updatedAt: string;
+    }>;
 }
 //# sourceMappingURL=organizations.client.d.ts.map

package/dist/clients/admin/organizations.client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/organizations.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE,MAAM,WAAW,uBAAuB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,qBAAa,wBAAwB;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,IAAI,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAI3C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAa7D,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC;IAIhE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI9E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQ9E,gBAAgB,CAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACb,OAAO,CAAC,qBAAqB,CAAC;IAO3B,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAMpD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;CAK/D"}
+{"version":3,"file":"organizations.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/organizations.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE,MAAM,WAAW,uBAAuB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CAChB;AAID,MAAM,WAAW,kBAAkB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,SAAS;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAe;IAC5B,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED,qBAAa,wBAAwB;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,IAAI,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAI3C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAa7D,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC;IAIhE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI9E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQ9E,gBAAgB,CAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACb,OAAO,CAAC,qBAAqB,CAAC;IAO3B,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAMpD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAQtD,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAS1E,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAI7C,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAO9D,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAI/C,SAAS,CACX,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAGzE"}

package/dist/clients/admin/organizations.client.js

@@ -43,5 +43,27 @@ export class AdminOrganizationsClient {
     async getDescendants(id) {
         return this.http.get(`/organizations/${encodeURIComponent(id)}/descendants`);
     }
+    // ── F444/INV-5/INV-6: Add-Member candidate search ──────────────────────────────────
+    async getMemberCandidates(id, q) {
+        const query = q ? `?q=${encodeURIComponent(q)}` : '';
+        return this.http.get(`/organizations/${encodeURIComponent(id)}/member-candidates${query}`);
+    }
+    // ── F444/AC-13: Invites tab ─────────────────────────────────────────────────────────
+    async listInvites(id) {
+        return this.http.get(`/organizations/${encodeURIComponent(id)}/invites`);
+    }
+    async resendInvite(id, inviteId) {
+        return this.http.post(`/organizations/${encodeURIComponent(id)}/invites/${encodeURIComponent(inviteId)}/resend`, {});
+    }
+    async revokeInvite(id, inviteId) {
+        await this.http.delete(`/organizations/${encodeURIComponent(id)}/invites/${encodeURIComponent(inviteId)}`);
+    }
+    // ── F444/AC-14: Config tab (ancestor-aware) ─────────────────────────────────────────
+    async getConfig(id) {
+        return this.http.get(`/organizations/${encodeURIComponent(id)}/config`);
+    }
+    async setConfig(id, key, value) {
+        return this.http.patch(`/organizations/${encodeURIComponent(id)}/config`, { key, value });
+    }
 }
 //# sourceMappingURL=organizations.client.js.map

package/dist/clients/admin/organizations.client.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.client.js","sourceRoot":"","sources":["../../../src/clients/admin/organizations.client.ts"],"names":[],"mappings":"AA4BA,MAAM,OAAO,wBAAwB;IACJ;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAA6B,gBAAgB,CAAC,CAAA;IACtE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QAClB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CACtB,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAA;QACL,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,6EAA6E;YAC7E,iFAAiF;YACjF,2EAA2E;YAC3E,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA8B;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAkB,gBAAgB,EAAE,KAAK,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,KAA8B;QACrD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAkB,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAChG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,KAAqB;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACjB,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,UAAU,EACpD,KAAK,CACR,CAAA;IACL,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,gBAAgB,CAClB,IAAY,EACZ,MAAc,EACd,IAAY;QAEZ,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAClB,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAClF,EAAE,IAAI,EAAE,CACX,CAAA;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAAc;QAC3C,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAClB,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,CACrF,CAAA;IACL,CAAC;IAED,sFAAsF;IAEtF,KAAK,CAAC,YAAY,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,YAAY,CACvD,CAAA;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,cAAc,CACzD,CAAA;IACL,CAAC;CACJ"}
+{"version":3,"file":"organizations.client.js","sourceRoot":"","sources":["../../../src/clients/admin/organizations.client.ts"],"names":[],"mappings":"AA6DA,MAAM,OAAO,wBAAwB;IACJ;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAA6B,gBAAgB,CAAC,CAAA;IACtE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QAClB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CACtB,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAA;QACL,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,6EAA6E;YAC7E,iFAAiF;YACjF,2EAA2E;YAC3E,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA8B;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAkB,gBAAgB,EAAE,KAAK,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,KAA8B;QACrD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAkB,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAChG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,KAAqB;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACjB,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,UAAU,EACpD,KAAK,CACR,CAAA;IACL,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,gBAAgB,CAClB,IAAY,EACZ,MAAc,EACd,IAAY;QAEZ,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAClB,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAClF,EAAE,IAAI,EAAE,CACX,CAAA;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAAc;QAC3C,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAClB,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,CACrF,CAAA;IACL,CAAC;IAED,sFAAsF;IAEtF,KAAK,CAAC,YAAY,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,YAAY,CACvD,CAAA;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,cAAc,CACzD,CAAA;IACL,CAAC;IAED,sFAAsF;IAEtF,KAAK,CAAC,mBAAmB,CAAC,EAAU,EAAE,CAAU;QAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,qBAAqB,KAAK,EAAE,CACvE,CAAA;IACL,CAAC;IAED,uFAAuF;IAEvF,KAAK,CAAC,WAAW,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAc,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;IACzF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,QAAgB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACjB,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EACzF,EAAE,CACL,CAAA;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,QAAgB;QAC3C,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAClB,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CACrF,CAAA;IACL,CAAC;IAED,uFAAuF;IAEvF,KAAK,CAAC,SAAS,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAkB,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IAC5F,CAAC;IAED,KAAK,CAAC,SAAS,CACX,EAAU,EACV,GAAW,EACX,KAAc;QAEd,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7F,CAAC;CACJ"}

package/dist/clients/admin/projects.client.d.ts

@@ -38,6 +38,12 @@ export interface ProjectAccessGrantResultDto {
     principalId: string;
     role: string;
 }
+/** F449/AC-9: a project secret's metadata — never a value (INV-1). */
+export interface ProjectSecretEntryDto {
+    name: string;
+    isSet: boolean;
+    updatedAt: string | null;
+}
 export declare class AdminProjectsClient {
     private readonly http;
     constructor(http: HttpClient);
@@ -47,6 +53,9 @@ export declare class AdminProjectsClient {
      * call target (mirrors `AdminOrganizationsClient.create()`). */
     create(input: CreateProjectInput): Promise<ProjectOwnershipDto>;
     delete(slug: string): Promise<void>;
+    /** C585/AC-1: full-replace PATCH of `Project.config` — the lightweight Project-Settings
+     * editor's single "Save" (owner, org-admin, or vendor — see `projects-config.ts`). */
+    updateConfig(slug: string, config: Record<string, unknown>): Promise<void>;
     /** F442/AC-8/FLAG-1: `GET /{slug}/access` — list the project's owner + collaborator
      * grants. Guard is `assertOwnershipForSlug` (any caller who can already see the project). */
     accessList(slug: string): Promise<ProjectAccessListDto>;
@@ -55,5 +64,11 @@ export declare class AdminProjectsClient {
     accessGrant(slug: string, input: GrantProjectAccessInput): Promise<ProjectAccessGrantResultDto>;
     /** F442/AC-6/AC-8/FLAG-1: `DELETE /{slug}/access/{principalId}` — idempotent revoke. */
     accessRevoke(slug: string, principalId: string): Promise<void>;
+    /** F449/AC-9: `GET /{slug}/secrets` — names + isSet + updatedAt, never a value. */
+    listSecrets(slug: string): Promise<ProjectSecretEntryDto[]>;
+    /** F449/AC-9: `PUT /{slug}/secrets/{name}` — plaintext sent once, encrypted server-side. */
+    setSecret(slug: string, name: string, value: string): Promise<ProjectSecretEntryDto>;
+    /** F449/AC-9: `DELETE /{slug}/secrets/{name}` — idempotent. */
+    removeSecret(slug: string, name: string): Promise<void>;
 }
 //# sourceMappingURL=projects.client.d.ts.map

package/dist/clients/admin/projects.client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projects.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/projects.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE;2FAC2F;AAC3F,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CACpB;AAED;iEACiE;AACjE,MAAM,WAAW,oBAAoB;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,qBAAqB,EAAE,CAAA;CAClC;AAED;8DAC8D;AAC9D,MAAM,WAAW,uBAAuB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;CACtC;AAED,MAAM,WAAW,2BAA2B;IACxC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,mBAAmB;IAChB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAIjC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQvD;oEACgE;IAC1D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAI/D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC;iGAC6F;IACvF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI7D;iEAC6D;IACvD,WAAW,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,uBAAuB,GAC/B,OAAO,CAAC,2BAA2B,CAAC;IAOvC,wFAAwF;IAClF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKvE"}
+{"version":3,"file":"projects.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/projects.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE;2FAC2F;AAC3F,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CACpB;AAED;iEACiE;AACjE,MAAM,WAAW,oBAAoB;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,qBAAqB,EAAE,CAAA;CAClC;AAED;8DAC8D;AAC9D,MAAM,WAAW,uBAAuB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;CACtC;AAED,MAAM,WAAW,2BAA2B;IACxC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACf;AAED,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,qBAAa,mBAAmB;IAChB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAIjC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQvD;oEACgE;IAC1D,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAI/D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC;0FACsF;IAChF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhF;iGAC6F;IACvF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAI7D;iEAC6D;IACvD,WAAW,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,uBAAuB,GAC/B,OAAO,CAAC,2BAA2B,CAAC;IAOvC,wFAAwF;IAClF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE,mFAAmF;IAC7E,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAQjE,4FAA4F;IACtF,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQ1F,+DAA+D;IACzD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKhE"}

package/dist/clients/admin/projects.client.js

@@ -22,6 +22,11 @@ export class AdminProjectsClient {
     async delete(slug) {
         await this.http.delete(`/projects/${encodeURIComponent(slug)}`);
     }
+    /** C585/AC-1: full-replace PATCH of `Project.config` — the lightweight Project-Settings
+     * editor's single "Save" (owner, org-admin, or vendor — see `projects-config.ts`). */
+    async updateConfig(slug, config) {
+        await this.http.patch(`/projects/${encodeURIComponent(slug)}/config`, { config });
+    }
     /** F442/AC-8/FLAG-1: `GET /{slug}/access` — list the project's owner + collaborator
      * grants. Guard is `assertOwnershipForSlug` (any caller who can already see the project). */
     async accessList(slug) {
@@ -36,5 +41,20 @@ export class AdminProjectsClient {
     async accessRevoke(slug, principalId) {
         await this.http.delete(`/projects/${encodeURIComponent(slug)}/access/${encodeURIComponent(principalId)}`);
     }
+    /** F449/AC-9: `GET /{slug}/secrets` — names + isSet + updatedAt, never a value. */
+    async listSecrets(slug) {
+        // this.http already unwraps the `{ data }` envelope (http-client.ts), so return it directly —
+        // a second `.data` here was double-unwrapping to `undefined` (react-query "data is undefined").
+        return this.http.get(`/projects/${encodeURIComponent(slug)}/secrets`);
+    }
+    /** F449/AC-9: `PUT /{slug}/secrets/{name}` — plaintext sent once, encrypted server-side. */
+    async setSecret(slug, name, value) {
+        // this.http already unwraps the `{ data }` envelope — return directly (no second `.data`).
+        return this.http.put(`/projects/${encodeURIComponent(slug)}/secrets/${encodeURIComponent(name)}`, { value });
+    }
+    /** F449/AC-9: `DELETE /{slug}/secrets/{name}` — idempotent. */
+    async removeSecret(slug, name) {
+        await this.http.delete(`/projects/${encodeURIComponent(slug)}/secrets/${encodeURIComponent(name)}`);
+    }
 }
 //# sourceMappingURL=projects.client.js.map

package/dist/clients/admin/projects.client.js.map

@@ -1 +1 @@
-{"version":3,"file":"projects.client.js","sourceRoot":"","sources":["../../../src/clients/admin/projects.client.ts"],"names":[],"mappings":"AA+CA,MAAM,OAAO,mBAAmB;IACC;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmB,WAAW,CAAC,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QAClB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAiB,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvF,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED;oEACgE;IAChE,KAAK,CAAC,MAAM,CAAC,KAAyB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,WAAW,EAAE,KAAK,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnE,CAAC;IAED;iGAC6F;IAC7F,KAAK,CAAC,UAAU,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAuB,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC9F,CAAC;IAED;iEAC6D;IAC7D,KAAK,CAAC,WAAW,CACb,IAAY,EACZ,KAA8B;QAE9B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACjB,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAC9C,KAAK,CACR,CAAA;IACL,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAChD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAClB,aAAa,kBAAkB,CAAC,IAAI,CAAC,WAAW,kBAAkB,CAAC,WAAW,CAAC,EAAE,CACpF,CAAA;IACL,CAAC;CACJ"}
+{"version":3,"file":"projects.client.js","sourceRoot":"","sources":["../../../src/clients/admin/projects.client.ts"],"names":[],"mappings":"AAsDA,MAAM,OAAO,mBAAmB;IACC;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmB,WAAW,CAAC,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QAClB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAiB,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvF,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED;oEACgE;IAChE,KAAK,CAAC,MAAM,CAAC,KAAyB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,WAAW,EAAE,KAAK,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnE,CAAC;IAED;0FACsF;IACtF,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAA+B;QAC5D,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACrF,CAAC;IAED;iGAC6F;IAC7F,KAAK,CAAC,UAAU,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAuB,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC9F,CAAC;IAED;iEAC6D;IAC7D,KAAK,CAAC,WAAW,CACb,IAAY,EACZ,KAA8B;QAE9B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACjB,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAC9C,KAAK,CACR,CAAA;IACL,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAChD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAClB,aAAa,kBAAkB,CAAC,IAAI,CAAC,WAAW,kBAAkB,CAAC,WAAW,CAAC,EAAE,CACpF,CAAA;IACL,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,WAAW,CAAC,IAAY;QAC1B,8FAA8F;QAC9F,gGAAgG;QAChG,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,aAAa,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAClD,CAAA;IACL,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,IAAY,EAAE,KAAa;QACrD,2FAA2F;QAC3F,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,aAAa,kBAAkB,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAC3E,EAAE,KAAK,EAAE,CACZ,CAAA;IACL,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,IAAY;QACzC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAClB,aAAa,kBAAkB,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAC9E,CAAA;IACL,CAAC;CACJ"}

package/dist/clients/admin/sessions.client.d.ts

@@ -1,4 +1,4 @@
-import type { SessionSummaryDto, SessionListItemDto, ToolCallSummaryDto, SubagentSummaryDto } from '@beacon-build/core';
+import type { SessionSummaryDto, SessionListItemDto, ToolCallSummaryDto, SubagentSummaryDto, SubagentGroupSummaryDto } from '@beacon-build/core';
 import type { HttpClient } from '../../transport/http-client.js';
 export interface SessionsFilter {
     project?: string;
@@ -24,6 +24,12 @@ export declare class AdminSessionsClient {
      * Never throws — returns zero-counts on error.
      */
     subagentSummary(sessionId: string): Promise<SubagentSummaryDto>;
+    /**
+     * F447 AC-5/AC-18: full-session (not window-capped), title/state-correlated per-subagent
+     * detail array — lazy-loaded when the SessionCard's collapsed subagent section is expanded.
+     * Never throws — returns an empty array on error (matches `subagentSummary`'s convention).
+     */
+    subagentGroups(sessionId: string): Promise<SubagentGroupSummaryDto[]>;
     /**
      * F424: vendor-gated force-terminate — distinct from the agent self-service
      * `POST /sessions/:id/terminate` (F217). 403s for a non-vendor caller. Idempotent —

package/dist/clients/admin/sessions.client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/sessions.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EACrB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qBAAa,mBAAmB;IAChB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAUzD,IAAI,CACN,MAAM,GAAE,cAAmB,GAC5B,OAAO,CAAC;QAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAepF,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAU5D,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAUnF,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAWvE;;;OAGG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAUrE;;;;;;;;OAQG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAKjE"}
+{"version":3,"file":"sessions.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/sessions.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EAC1B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qBAAa,mBAAmB;IAChB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAUzD,IAAI,CACN,MAAM,GAAE,cAAmB,GAC5B,OAAO,CAAC;QAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAepF,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAU5D,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAUnF,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAWvE;;;OAGG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAUrE;;;;OAIG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAW3E;;;;;;;;OAQG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAKjE"}

package/dist/clients/admin/sessions.client.js

@@ -61,6 +61,20 @@ export class AdminSessionsClient {
             return { totalCost: 0, messageCount: 0 };
         }
     }
+    /**
+     * F447 AC-5/AC-18: full-session (not window-capped), title/state-correlated per-subagent
+     * detail array — lazy-loaded when the SessionCard's collapsed subagent section is expanded.
+     * Never throws — returns an empty array on error (matches `subagentSummary`'s convention).
+     */
+    async subagentGroups(sessionId) {
+        try {
+            const res = await this.http.get(`/sessions/${encodeURIComponent(sessionId)}/subagents`);
+            return res.subagents;
+        }
+        catch (_err) {
+            return [];
+        }
+    }
     /**
      * F424: vendor-gated force-terminate — distinct from the agent self-service
      * `POST /sessions/:id/terminate` (F217). 403s for a non-vendor caller. Idempotent —

package/dist/clients/admin/sessions.client.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.client.js","sourceRoot":"","sources":["../../../src/clients/admin/sessions.client.ts"],"names":[],"mappings":"AAeA,MAAM,OAAO,mBAAmB;IACC;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,GAAG,CAAC,SAAiB;QACvB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CACtB,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAC/C,CAAA;QACL,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CACN,SAAyB,EAAE;QAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAChE,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACnE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAKjB,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB;QAC1B,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CACtB,wBAAwB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC3D,CAAA;QACL,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,UAAkB;QACjD,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CACtB,kCAAkC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,CACxG,CAAA;QACL,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACnC,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3B,aAAa,kBAAkB,CAAC,SAAS,CAAC,aAAa,CAC1D,CAAA;YACD,OAAO,GAAG,CAAC,IAAI,CAAA;QACnB,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,EAAE,CAAA;QACb,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB;QACnC,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CACtB,aAAa,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,CAChE,CAAA;QACL,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;QAC5C,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACjB,aAAa,kBAAkB,CAAC,SAAS,CAAC,kBAAkB,CAC/D,CAAA;IACL,CAAC;CACJ"}
+{"version":3,"file":"sessions.client.js","sourceRoot":"","sources":["../../../src/clients/admin/sessions.client.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,mBAAmB;IACC;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,GAAG,CAAC,SAAiB;QACvB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CACtB,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAC/C,CAAA;QACL,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CACN,SAAyB,EAAE;QAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAChE,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACnE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAKjB,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB;QAC1B,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CACtB,wBAAwB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC3D,CAAA;QACL,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,UAAkB;QACjD,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CACtB,kCAAkC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,kBAAkB,CAAC,UAAU,CAAC,EAAE,CACxG,CAAA;QACL,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACnC,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3B,aAAa,kBAAkB,CAAC,SAAS,CAAC,aAAa,CAC1D,CAAA;YACD,OAAO,GAAG,CAAC,IAAI,CAAA;QACnB,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,EAAE,CAAA;QACb,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB;QACnC,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CACtB,aAAa,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,CAChE,CAAA;QACL,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;QAC5C,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QAClC,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3B,aAAa,kBAAkB,CAAC,SAAS,CAAC,YAAY,CACzD,CAAA;YACD,OAAO,GAAG,CAAC,SAAS,CAAA;QACxB,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,EAAE,CAAA;QACb,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACjB,aAAa,kBAAkB,CAAC,SAAS,CAAC,kBAAkB,CAC/D,CAAA;IACL,CAAC;CACJ"}

package/dist/clients/admin/settings.client.d.ts

@@ -19,12 +19,39 @@ export interface SettingsListResponse {
     organizationId: string | null;
     settings: Record<string, SettingValue>;
 }
+/**
+ * C584: audit history entry for a config key (`services/api/src/routes/admin-config-audit.route.ts`).
+ * `changeType` also covers the F429 Project→Org ownership-transfer log, which reuses this same
+ * audit table/endpoint for a non-config change — kept here rather than a separate type since the
+ * SDK response shape is identical either way.
+ */
+export type SettingChangeType = 'set' | 'delete' | 'project_ownership_transfer';
+export interface SettingAuditEntry {
+    id: string;
+    changeType: SettingChangeType;
+    oldValue: SettingValue;
+    newValue: SettingValue;
+    changedBy: {
+        id: string;
+        name: string | null;
+    };
+    changedAt: string;
+}
+/**
+ * Audit history response for a config key.
+ */
+export interface SettingAuditResponse {
+    key: string;
+    organizationId: string | null;
+    history: SettingAuditEntry[];
+}
 /**
  * F143: Client for admin config API endpoints (Admin/Vendor only).
  *
  * Endpoints:
  *   GET /api/v1/admin/config?key=&organizationId=
  *   GET /api/v1/admin/config/all?organizationId=
+ *   GET /api/v1/admin/config/audit?key=&organizationId=&limit= (C584)
  *   PATCH /api/v1/admin/config
  */
 export declare class SettingsClient {
@@ -45,7 +72,10 @@ export declare class SettingsClient {
      * Set or delete a config value.
      * value=null deletes the entry.
      */
-    set(key: string, value: SettingValue, organizationId?: string | null): Promise<{
+    set(key: string, value: SettingValue, organizationId?: string | null, 
+    /** F449/AC-6/AC-7/AC-8: when true, the server encrypts `value` whole before persisting
+     * — the unified system/org secret contract. */
+    secret?: boolean): Promise<{
         key: string;
         organizationId: string | null;
         updatedAt: string;
@@ -59,5 +89,10 @@ export declare class SettingsClient {
         organizationId: string | null;
         updatedAt: string;
     }>;
+    /**
+     * GET /api/v1/admin/config/audit?key=&organizationId=&limit=
+     * Get audit history for a config key (C584 — "Verlauf" affordance).
+     */
+    audit(key: string, organizationId?: string | null, limit?: number): Promise<SettingAuditResponse>;
 }
 //# sourceMappingURL=settings.client.d.ts.map

package/dist/clients/admin/settings.client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/settings.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAA;AAElC;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,YAAY,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACzC;AAaD;;;;;;;GAOG;AACH,qBAAa,cAAc;IACX,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C;;;OAGG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IAKhF;;;OAGG;IACG,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAKzE;;;;OAIG;IACG,GAAG,CACL,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,YAAY,EACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAO7E;;;OAGG;IACG,MAAM,CACR,GAAG,EAAE,MAAM,EACX,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAGhF"}
+{"version":3,"file":"settings.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/settings.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAA;AAElC;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,YAAY,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACzC;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,4BAA4B,CAAA;AAE/E,MAAM,WAAW,iBAAiB;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,iBAAiB,CAAA;IAC7B,QAAQ,EAAE,YAAY,CAAA;IACtB,QAAQ,EAAE,YAAY,CAAA;IACtB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC9C,SAAS,EAAE,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAA;CAC/B;AAaD;;;;;;;;GAQG;AACH,qBAAa,cAAc;IACX,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C;;;OAGG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IAKhF;;;OAGG;IACG,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAKzE;;;;OAIG;IACG,GAAG,CACL,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,YAAY,EACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI;IAC9B;mDAC+C;IAC/C,MAAM,CAAC,EAAE,OAAO,GACjB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAO7E;;;OAGG;IACG,MAAM,CACR,GAAG,EAAE,MAAM,EACX,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAI7E;;;OAGG;IACG,KAAK,CACP,GAAG,EAAE,MAAM,EACX,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;CAQnC"}