@beacon-build/sdk 2.17.1 → 3.0.0

package/dist/factory/tenant-agent-sdk.js

@@ -0,0 +1,136 @@
+/**
+ * B987 (F712 AC-7, D1) — `createTenantAgentClient`: an Agent SDK authenticated with a TENANT
+ * credential (an owner-minted token, or a tenant API key). `services/api` never accepts the
+ * AS-issued token directly, so this client performs, transparently:
+ *
+ *   api_key:      client_credentials at POST /api/oauth/token (client_secret_basic) → AS token
+ *   minted_token: the AS token is the credential itself
+ *   both:         POST /api/v1/oauth/token-exchange → internal agent token (cached until shortly
+ *                 before its expiry), re-obtained on expiry or on a 401 (HttpClient's
+ *                 onUnauthorized hook — one retry, single-flight).
+ *
+ * The secret/token never leaves this module except in the Authorization header of those two
+ * requests. Raw fetch is deliberate here: these are the bootstrap calls that PRODUCE the bearer
+ * every other SDK method uses (same rationale as the mcp-core OAuth client).
+ */
+import { SdkError, statusToSdkCode } from '../transport/errors.js';
+import { createAgentClient } from './agent-sdk.js';
+// Portable (browser + node) base64 helpers — the SDK has no Node-only dependency.
+function base64(value) {
+    return btoa(value);
+}
+function base64UrlDecode(value) {
+    const b64 = value.replace(/-/g, '+').replace(/_/g, '/');
+    return atob(b64 + '='.repeat((4 - (b64.length % 4)) % 4));
+}
+function jwtExpMs(token) {
+    try {
+        const payload = JSON.parse(base64UrlDecode(token.split('.')[1] ?? ''));
+        return typeof payload.exp === 'number' ? payload.exp * 1000 : 0;
+    }
+    catch (_err) {
+        // not a decodable JWT — no expiry known, treated as already expired (re-obtain)
+        return 0;
+    }
+}
+async function failFrom(res, what) {
+    let code;
+    try {
+        const body = (await res.json());
+        code = body.code ?? body.error;
+    }
+    catch (_err) {
+        // non-JSON error body — classify by status only
+    }
+    throw new SdkError(statusToSdkCode(res.status), `${what} failed (${res.status})`, res.status, code);
+}
+export function createTenantAgentTokenProvider(config) {
+    const doFetch = config.fetch ?? fetch;
+    const skewMs = (config.refreshSkewSeconds ?? 30) * 1000;
+    const base = config.baseUrl.replace(/\/+$/, '');
+    let asToken;
+    let internal;
+    let inFlight;
+    const fresh = (c) => !!c && c.expiresAtMs - skewMs > Date.now();
+    async function obtainAsToken() {
+        if (config.credential.kind === 'minted_token')
+            return config.credential.token;
+        if (fresh(asToken))
+            return asToken.token;
+        const { clientId, clientSecret } = config.credential;
+        const basic = base64(`${clientId}:${clientSecret}`);
+        let res;
+        try {
+            res = await doFetch(`${base}/api/oauth/token`, {
+                method: 'POST',
+                headers: {
+                    authorization: `Basic ${basic}`,
+                    'content-type': 'application/x-www-form-urlencoded',
+                },
+                body: 'grant_type=client_credentials',
+            });
+        }
+        catch (err) {
+            throw new SdkError('network_error', `token request failed: ${String(err)}`);
+        }
+        if (!res.ok)
+            return failFrom(res, 'client_credentials token request');
+        const body = (await res.json());
+        asToken = {
+            token: body.access_token,
+            expiresAtMs: body.expires_in
+                ? Date.now() + body.expires_in * 1000
+                : jwtExpMs(body.access_token),
+        };
+        return asToken.token;
+    }
+    async function exchange() {
+        const federated = await obtainAsToken();
+        let res;
+        try {
+            res = await doFetch(`${base}/api/v1/oauth/token-exchange`, {
+                method: 'POST',
+                headers: { authorization: `Bearer ${federated}` },
+            });
+        }
+        catch (err) {
+            throw new SdkError('network_error', `token exchange failed: ${String(err)}`);
+        }
+        if (!res.ok)
+            return failFrom(res, 'token exchange');
+        const body = (await res.json());
+        internal = { token: body.data.token, expiresAtMs: Date.parse(body.data.expiresAt) };
+        return internal.token;
+    }
+    function singleFlight() {
+        if (!inFlight) {
+            inFlight = exchange().finally(() => {
+                inFlight = undefined;
+            });
+        }
+        return inFlight;
+    }
+    return {
+        async getToken() {
+            if (fresh(internal))
+                return internal.token;
+            return singleFlight();
+        },
+        async refresh() {
+            internal = undefined;
+            asToken = undefined;
+            return singleFlight();
+        },
+    };
+}
+/** An Agent SDK authenticated with a tenant credential (exchange + refresh transparent). */
+export function createTenantAgentClient(config) {
+    const provider = createTenantAgentTokenProvider(config);
+    return createAgentClient({
+        baseUrl: config.baseUrl,
+        agentToken: () => provider.getToken(),
+        onUnauthorized: () => provider.refresh(),
+        ...(config.fetch ? { fetch: config.fetch } : {}),
+    });
+}
+//# sourceMappingURL=tenant-agent-sdk.js.map

package/dist/factory/tenant-agent-sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-agent-sdk.js","sourceRoot":"","sources":["../../src/factory/tenant-agent-sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAiB,MAAM,gBAAgB,CAAA;AA2BjE,kFAAkF;AAClF,SAAS,MAAM,CAAC,KAAa;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACvD,OAAO,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC3B,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAqB,CAAA;QAC1F,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,IAAI,EAAE,CAAC;QACZ,gFAAgF;QAChF,OAAO,CAAC,CAAA;IACZ,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa,EAAE,IAAY;IAC/C,IAAI,IAAwB,CAAA;IAC5B,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAA;QACpE,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAA;IAClC,CAAC;IAAC,OAAO,IAAI,EAAE,CAAC;QACZ,gDAAgD;IACpD,CAAC;IACD,MAAM,IAAI,QAAQ,CACd,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAC3B,GAAG,IAAI,YAAY,GAAG,CAAC,MAAM,GAAG,EAChC,GAAG,CAAC,MAAM,EACV,IAAI,CACP,CAAA;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC1C,MAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAA;IACrC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC/C,IAAI,OAA2B,CAAA;IAC/B,IAAI,QAA4B,CAAA;IAChC,IAAI,QAAqC,CAAA;IAEzC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAEnF,KAAK,UAAU,aAAa;QACxB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAA;QAC7E,IAAI,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,OAAQ,CAAC,KAAK,CAAA;QACzC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,UAAU,CAAA;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAA;QACnD,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,kBAAkB,EAAE;gBAC3C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACL,aAAa,EAAE,SAAS,KAAK,EAAE;oBAC/B,cAAc,EAAE,mCAAmC;iBACtD;gBACD,IAAI,EAAE,+BAA+B;aACxC,CAAC,CAAA;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAA;QACrE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAA;QAChF,OAAO,GAAG;YACN,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,WAAW,EAAE,IAAI,CAAC,UAAU;gBACxB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;SACpC,CAAA;QACD,OAAO,OAAO,CAAC,KAAK,CAAA;IACxB,CAAC;IAED,KAAK,UAAU,QAAQ;QACnB,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAA;QACvC,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,8BAA8B,EAAE;gBACvD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE;aACpD,CAAC,CAAA;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;QACnD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAA;QACjF,QAAQ,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAA;QACnF,OAAO,QAAQ,CAAC,KAAK,CAAA;IACzB,CAAC;IAED,SAAS,YAAY;QACjB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,QAAQ,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC/B,QAAQ,GAAG,SAAS,CAAA;YACxB,CAAC,CAAC,CAAA;QACN,CAAC;QACD,OAAO,QAAQ,CAAA;IACnB,CAAC;IAED,OAAO;QACH,KAAK,CAAC,QAAQ;YACV,IAAI,KAAK,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAS,CAAC,KAAK,CAAA;YAC3C,OAAO,YAAY,EAAE,CAAA;QACzB,CAAC;QACD,KAAK,CAAC,OAAO;YACT,QAAQ,GAAG,SAAS,CAAA;YACpB,OAAO,GAAG,SAAS,CAAA;YACnB,OAAO,YAAY,EAAE,CAAA;QACzB,CAAC;KACJ,CAAA;AACL,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,MAA4B;IAChE,MAAM,QAAQ,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAA;IACvD,OAAO,iBAAiB,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE;QACrC,cAAc,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE;QACxC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAA;AACN,CAAC"}

package/dist/factory/user-sdk.d.ts

@@ -1,5 +1,6 @@
 import { ProjectsClient } from '../clients/projects.client.js';
 import { OnboardingClient } from '../clients/onboarding.client.js';
+import { BillingClient } from '../clients/billing.client.js';
 export interface UserSdkConfig {
     /** Base URL for the beacon API (e.g. 'https://api.beacon.build') */
     baseUrl: string;
@@ -12,6 +13,8 @@ export interface UserSdk {
     projects: ProjectsClient;
     /** Onboarding client for guided wizard draft CRUD (F640) */
     onboarding: OnboardingClient;
+    /** FS64: pricing (F564) + subscription lifecycle (F705) */
+    billing: BillingClient;
 }
 /**
  * createUserClient — creates an SDK instance authenticated with a user JWT.
@@ -19,4 +22,12 @@ export interface UserSdk {
  * the caller must be a human user (F639).
  */
 export declare function createUserClient(config: UserSdkConfig): UserSdk;
+/**
+ * FS64/F564 AC-3 — unauthenticated pricing read (`GET /api/v1/pricing`, authMode 'public') so
+ * beacon-web shows exactly the values the cockpit reads. No token: the route is mounted before
+ * the auth guard.
+ */
+export declare function createPublicPricingClient(config: {
+    baseUrl: string;
+}): Pick<BillingClient, 'pricing'>;
 //# sourceMappingURL=user-sdk.d.ts.map

package/dist/factory/user-sdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-sdk.d.ts","sourceRoot":"","sources":["../../src/factory/user-sdk.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAElE,MAAM,WAAW,aAAa;IAC1B,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IACf,iDAAiD;IACjD,SAAS,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IACpD,cAAc,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,OAAO;IACpB,sDAAsD;IACtD,QAAQ,EAAE,cAAc,CAAA;IACxB,4DAA4D;IAC5D,UAAU,EAAE,gBAAgB,CAAA;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAe/D"}
+{"version":3,"file":"user-sdk.d.ts","sourceRoot":"","sources":["../../src/factory/user-sdk.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE5D,MAAM,WAAW,aAAa;IAC1B,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IACf,iDAAiD;IACjD,SAAS,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IACpD,cAAc,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,OAAO;IACpB,sDAAsD;IACtD,QAAQ,EAAE,cAAc,CAAA;IACxB,4DAA4D;IAC5D,UAAU,EAAE,gBAAgB,CAAA;IAC5B,2DAA2D;IAC3D,OAAO,EAAE,aAAa,CAAA;CACzB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAgB/D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAA;CAClB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAQjC"}

package/dist/factory/user-sdk.js

@@ -1,6 +1,7 @@
 import { HttpClient } from '../transport/http-client.js';
 import { ProjectsClient } from '../clients/projects.client.js';
 import { OnboardingClient } from '../clients/onboarding.client.js';
+import { BillingClient } from '../clients/billing.client.js';
 /**
  * createUserClient — creates an SDK instance authenticated with a user JWT.
  * Used for user-scoped operations such as atomic project provisioning where
@@ -18,6 +19,21 @@ export function createUserClient(config) {
     return {
         projects: new ProjectsClient(v1Http),
         onboarding: new OnboardingClient(v1Http),
+        billing: new BillingClient(v1Http),
     };
 }
+/**
+ * FS64/F564 AC-3 — unauthenticated pricing read (`GET /api/v1/pricing`, authMode 'public') so
+ * beacon-web shows exactly the values the cockpit reads. No token: the route is mounted before
+ * the auth guard.
+ */
+export function createPublicPricingClient(config) {
+    const http = new HttpClient({
+        baseUrl: config.baseUrl,
+        basePath: '/api/v1',
+        getToken: () => '',
+    });
+    const client = new BillingClient(http);
+    return { pricing: () => client.pricing() };
+}
 //# sourceMappingURL=user-sdk.js.map

package/dist/factory/user-sdk.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-sdk.js","sourceRoot":"","sources":["../../src/factory/user-sdk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAiBlE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAA;IAC9B,MAAM,QAAQ,GACV,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAA;IACrD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,SAAS;QACnB,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,cAAc;KACxC,CAAC,CAAA;IAEF,OAAO;QACH,QAAQ,EAAE,IAAI,cAAc,CAAC,MAAM,CAAC;QACpC,UAAU,EAAE,IAAI,gBAAgB,CAAC,MAAM,CAAC;KAC3C,CAAA;AACL,CAAC"}
+{"version":3,"file":"user-sdk.js","sourceRoot":"","sources":["../../src/factory/user-sdk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAmB5D;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAA;IAC9B,MAAM,QAAQ,GACV,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAA;IACrD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,SAAS;QACnB,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,cAAc;KACxC,CAAC,CAAA;IAEF,OAAO;QACH,QAAQ,EAAE,IAAI,cAAc,CAAC,MAAM,CAAC;QACpC,UAAU,EAAE,IAAI,gBAAgB,CAAC,MAAM,CAAC;QACxC,OAAO,EAAE,IAAI,aAAa,CAAC,MAAM,CAAC;KACrC,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAEzC;IACG,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACrB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAA;AAC9C,CAAC"}

package/dist/index.d.ts

@@ -15,13 +15,15 @@
  * use. See that package's `index.ts` for the internal surface.
  */
 export { createAgentClient, type AgentSdk, type AgentSdkConfig } from './factory/agent-sdk.js';
-export { createUserClient, type UserSdk, type UserSdkConfig } from './factory/user-sdk.js';
+export { createTenantAgentClient, createTenantAgentTokenProvider, type TenantCredential, type TenantAgentSdkConfig, type TenantAgentTokenProvider, } from './factory/tenant-agent-sdk.js';
+export { createPublicPricingClient, createUserClient, type UserSdk, type UserSdkConfig, } from './factory/user-sdk.js';
 export { createAuthClient, type AuthClient, type LoginResult, type RegisterResult, type RefreshResult, type MeResult, type InviteDetails, } from './clients/auth.client.js';
 export { RealtimeSdkClient, type RealtimeSdkClientConfig } from './realtime/realtime.client.js';
 export * from './index.auth-and-capture.js';
 export { computePermissions, type Permissions, type RoleRow } from './permissions.js';
 export { SdkError, type SdkErrorCode, statusToSdkCode, apiCodeToSdkCode, } from './transport/errors.js';
-export { HttpClient, type HttpClientConfig } from './transport/http-client.js';
+export { HttpClient, type HttpClientConfig, type HttpRequestOptions, } from './transport/http-client.js';
+export { runWithBackgroundOrigin, requestOriginHeaders, withBackgroundRefetchOrigin, installBackgroundRefetchOrigin, } from './transport/request-origin.js';
 export { SseClient, type SseStreamHandler, type SseStreamResult } from './transport/sse-client.js';
 export { MultipartClient, type MultipartClientConfig } from './transport/multipart-client.js';
 export { BinaryClient, type BinaryClientConfig, type BinaryDownloadResult, } from './transport/binary-client.js';
@@ -29,6 +31,9 @@ export { AgentCapabilityClient, type CapabilityCandidateDto, } from './clients/a
 export { AgentControllerClient, type AgentControllerEntryDto, type AgentControllerRevokeResult, type AgentControllerPrincipalIdentity, type MainAgentValidityDto, } from './clients/agent/agent-controller.client.js';
 export { SystemOneClient, type SystemOneClassifyRequest, type SystemOneClassifyResult, type SystemOneClassifyOk, type SystemOneClassifySkipped, type SystemOneQuestion, type SystemOneNoulQuestion, type SystemOneChoiceQuestion, type SystemOneScoreQuestion, type SystemOneAnswer, type SystemOneNoulAnswer, type SystemOneChoiceAnswer, type SystemOneScoreAnswer, type SystemOneUsage, } from './clients/agent/system-one.client.js';
 export { ProjectsClient, type OwnerProvisionDto, type ProjectProvisionDetailsDto, type MainAgentProvisionDetailsDto, type ProvisionProjectRequestDto, type ProvisionedProjectDto, } from './clients/projects.client.js';
+export { BillingClient, BillingEntityInactiveError, PaymentOverdueError, PaymentRequiredError, PersonalSubscriptionRequiredError, ProjectOwnerRequiredError, toTypedBillingError, type BillingStatusDto, type BillingStatusValue, type CompanyBillingStatusDto, type InactiveReasonValue, type PricingDto, type PricingInputDto, type PricingTierDto, type PricingVersionDto, type UserBillingStatusDto, } from './clients/billing.client.js';
+export type { BillingEntityRowDto, BillingTierDto, InvoiceDto, LadderRoleDto, SeatFeePersonDto, SeatFeesDto, SeatFeesQuery, } from './clients/billing-seat-fees.types.js';
+export type { BillableRequestsDto, BillableRequestsPersonDto, BillableRequestsQuery, ProjectRequestsDto, } from './clients/billing-requests.types.js';
 export { OnboardingClient, type OnboardingDraftDto, type SaveOnboardingDraftDto, } from './clients/onboarding.client.js';
 export { SDK_MANIFEST, SDK_NEGATIVE_LIST, type ManifestEntry, type ManifestNegativeEntry, type SdkAuthMode, } from './manifest.js';
 export { TaskConfigClient } from './clients/shared/task-config.client.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,iBAAiB,EAAE,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC9F,OAAO,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAG1F,OAAO,EACH,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,aAAa,GACrB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,+BAA+B,CAAA;AAK/F,cAAc,6BAA6B,CAAA;AAG3C,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGrF,OAAO,EACH,QAAQ,EACR,KAAK,YAAY,EACjB,eAAe,EACf,gBAAgB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAE7F,OAAO,EACH,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC5B,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EACH,qBAAqB,EACrB,KAAK,sBAAsB,GAC9B,MAAM,sCAAsC,CAAA;AAE7C,OAAO,EACH,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,GAC5B,MAAM,4CAA4C,CAAA;AAEnD,OAAO,EACH,eAAe,EACf,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,cAAc,GACtB,MAAM,sCAAsC,CAAA;AAG7C,OAAO,EACH,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,GAC7B,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EACH,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC9B,MAAM,gCAAgC,CAAA;AAGvC,OAAO,EACH,YAAY,EACZ,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,GACnB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAGhF,YAAY,EAER,OAAO,EACP,aAAa,EACb,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,cAAc,EAEd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EAEvB,MAAM,EACN,UAAU,EACV,WAAW,EACX,iBAAiB,EAEjB,QAAQ,EACR,eAAe,EACf,eAAe,EAEf,OAAO,EAEP,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EAErB,cAAc,EAEd,QAAQ,EAER,KAAK,EAEL,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAEhB,WAAW,EACX,kBAAkB,EAElB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EAEZ,eAAe,EACf,eAAe,EACf,iBAAiB,EAEjB,WAAW,EAEX,YAAY,EAEZ,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,YAAY,GACf,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,iBAAiB,EAAE,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE9F,OAAO,EACH,uBAAuB,EACvB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAChC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACH,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,OAAO,EACZ,KAAK,aAAa,GACrB,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EACH,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,aAAa,GACrB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,+BAA+B,CAAA;AAK/F,cAAc,6BAA6B,CAAA;AAG3C,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGrF,OAAO,EACH,QAAQ,EACR,KAAK,YAAY,EACjB,eAAe,EACf,gBAAgB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EACH,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GAC1B,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EACH,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,GACjC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAE7F,OAAO,EACH,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC5B,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EACH,qBAAqB,EACrB,KAAK,sBAAsB,GAC9B,MAAM,sCAAsC,CAAA;AAE7C,OAAO,EACH,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,GAC5B,MAAM,4CAA4C,CAAA;AAEnD,OAAO,EACH,eAAe,EACf,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,cAAc,GACtB,MAAM,sCAAsC,CAAA;AAG7C,OAAO,EACH,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,GAC7B,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EACH,aAAa,EACb,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,GAC5B,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACR,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,aAAa,GAChB,MAAM,sCAAsC,CAAA;AAC7C,YAAY,EACR,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACrB,MAAM,qCAAqC,CAAA;AAE5C,OAAO,EACH,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC9B,MAAM,gCAAgC,CAAA;AAGvC,OAAO,EACH,YAAY,EACZ,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,GACnB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAGhF,YAAY,EAER,OAAO,EACP,aAAa,EACb,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,cAAc,EAEd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EAEvB,MAAM,EACN,UAAU,EACV,WAAW,EACX,iBAAiB,EAEjB,QAAQ,EACR,eAAe,EACf,eAAe,EAEf,OAAO,EAEP,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EAErB,cAAc,EAEd,QAAQ,EAER,KAAK,EAEL,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAEhB,WAAW,EACX,kBAAkB,EAElB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EAEZ,eAAe,EACf,eAAe,EACf,iBAAiB,EAEjB,WAAW,EAEX,YAAY,EAEZ,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,YAAY,GACf,MAAM,oBAAoB,CAAA"}

package/dist/index.js

@@ -16,7 +16,9 @@
  */
 // ── Factory functions ──────────────────────────────────────────────────────────
 export { createAgentClient } from './factory/agent-sdk.js';
-export { createUserClient } from './factory/user-sdk.js';
+// B987: Agent SDK authenticated with a tenant credential (owner-minted token or tenant API key).
+export { createTenantAgentClient, createTenantAgentTokenProvider, } from './factory/tenant-agent-sdk.js';
+export { createPublicPricingClient, createUserClient, } from './factory/user-sdk.js';
 // ── Auth client ────────────────────────────────────────────────────────────────
 export { createAuthClient, } from './clients/auth.client.js';
 // ── Realtime (implemented in F141) ────────────────────────────────────────────
@@ -30,7 +32,9 @@ export { computePermissions } from './permissions.js';
 // ── Errors ────────────────────────────────────────────────────────────────────
 export { SdkError, statusToSdkCode, apiCodeToSdkCode, } from './transport/errors.js';
 // ── Transport (for advanced consumers, incl. @beacon-build/sdk-internal) ─────
-export { HttpClient } from './transport/http-client.js';
+export { HttpClient, } from './transport/http-client.js';
+// C907/AC-8: background (never-billed) request-origin marking — see request-origin.ts.
+export { runWithBackgroundOrigin, requestOriginHeaders, withBackgroundRefetchOrigin, installBackgroundRefetchOrigin, } from './transport/request-origin.js';
 export { SseClient } from './transport/sse-client.js';
 export { MultipartClient } from './transport/multipart-client.js';
 // C434: needed by task-attachment-http.ts (packages/infrastructure) to fetch attachment bytes through the Ops-keyed path, same as AdminTasksClient.downloadAttachment.
@@ -43,6 +47,8 @@ export { AgentControllerClient, } from './clients/agent/agent-controller.client.
 export { SystemOneClient, } from './clients/agent/system-one.client.js';
 // F639: Atomic project provisioning
 export { ProjectsClient, } from './clients/projects.client.js';
+// FS64: pricing (F564) + subscription lifecycle (F705) client and typed billing errors
+export { BillingClient, BillingEntityInactiveError, PaymentOverdueError, PaymentRequiredError, PersonalSubscriptionRequiredError, ProjectOwnerRequiredError, toTypedBillingError, } from './clients/billing.client.js';
 // F640: Onboarding draft client
 export { OnboardingClient, } from './clients/onboarding.client.js';
 // ── Manifest (for drift testing) ──────────────────────────────────────────────

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAsC,MAAM,wBAAwB,CAAA;AAC9F,OAAO,EAAE,gBAAgB,EAAoC,MAAM,uBAAuB,CAAA;AAE1F,kFAAkF;AAClF,OAAO,EACH,gBAAgB,GAOnB,MAAM,0BAA0B,CAAA;AAEjC,iFAAiF;AACjF,OAAO,EAAE,iBAAiB,EAAgC,MAAM,+BAA+B,CAAA;AAE/F,iFAAiF;AACjF,uFAAuF;AACvF,yEAAyE;AACzE,cAAc,6BAA6B,CAAA;AAE3C,iFAAiF;AACjF,OAAO,EAAE,kBAAkB,EAAkC,MAAM,kBAAkB,CAAA;AAErF,iFAAiF;AACjF,OAAO,EACH,QAAQ,EAER,eAAe,EACf,gBAAgB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,gFAAgF;AAChF,OAAO,EAAE,UAAU,EAAyB,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,SAAS,EAA+C,MAAM,2BAA2B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA8B,MAAM,iCAAiC,CAAA;AAC7F,uKAAuK;AACvK,OAAO,EACH,YAAY,GAGf,MAAM,8BAA8B,CAAA;AAErC,iFAAiF;AACjF,OAAO,EACH,qBAAqB,GAExB,MAAM,sCAAsC,CAAA;AAC7C,8DAA8D;AAC9D,OAAO,EACH,qBAAqB,GAKxB,MAAM,4CAA4C,CAAA;AACnD,qDAAqD;AACrD,OAAO,EACH,eAAe,GAclB,MAAM,sCAAsC,CAAA;AAE7C,oCAAoC;AACpC,OAAO,EACH,cAAc,GAMjB,MAAM,8BAA8B,CAAA;AAErC,gCAAgC;AAChC,OAAO,EACH,gBAAgB,GAGnB,MAAM,gCAAgC,CAAA;AAEvC,iFAAiF;AACjF,OAAO,EACH,YAAY,EACZ,iBAAiB,GAIpB,MAAM,eAAe,CAAA;AAEtB,wFAAwF;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAsC,MAAM,wBAAwB,CAAA;AAC9F,iGAAiG;AACjG,OAAO,EACH,uBAAuB,EACvB,8BAA8B,GAIjC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACH,yBAAyB,EACzB,gBAAgB,GAGnB,MAAM,uBAAuB,CAAA;AAE9B,kFAAkF;AAClF,OAAO,EACH,gBAAgB,GAOnB,MAAM,0BAA0B,CAAA;AAEjC,iFAAiF;AACjF,OAAO,EAAE,iBAAiB,EAAgC,MAAM,+BAA+B,CAAA;AAE/F,iFAAiF;AACjF,uFAAuF;AACvF,yEAAyE;AACzE,cAAc,6BAA6B,CAAA;AAE3C,iFAAiF;AACjF,OAAO,EAAE,kBAAkB,EAAkC,MAAM,kBAAkB,CAAA;AAErF,iFAAiF;AACjF,OAAO,EACH,QAAQ,EAER,eAAe,EACf,gBAAgB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,gFAAgF;AAChF,OAAO,EACH,UAAU,GAGb,MAAM,4BAA4B,CAAA;AACnC,uFAAuF;AACvF,OAAO,EACH,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,GACjC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,SAAS,EAA+C,MAAM,2BAA2B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA8B,MAAM,iCAAiC,CAAA;AAC7F,uKAAuK;AACvK,OAAO,EACH,YAAY,GAGf,MAAM,8BAA8B,CAAA;AAErC,iFAAiF;AACjF,OAAO,EACH,qBAAqB,GAExB,MAAM,sCAAsC,CAAA;AAC7C,8DAA8D;AAC9D,OAAO,EACH,qBAAqB,GAKxB,MAAM,4CAA4C,CAAA;AACnD,qDAAqD;AACrD,OAAO,EACH,eAAe,GAclB,MAAM,sCAAsC,CAAA;AAE7C,oCAAoC;AACpC,OAAO,EACH,cAAc,GAMjB,MAAM,8BAA8B,CAAA;AAErC,uFAAuF;AACvF,OAAO,EACH,aAAa,EACb,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,yBAAyB,EACzB,mBAAmB,GAUtB,MAAM,6BAA6B,CAAA;AAgBpC,gCAAgC;AAChC,OAAO,EACH,gBAAgB,GAGnB,MAAM,gCAAgC,CAAA;AAEvC,iFAAiF;AACjF,OAAO,EACH,YAAY,EACZ,iBAAiB,GAIpB,MAAM,eAAe,CAAA;AAEtB,wFAAwF;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA"}

package/dist/manifest.negative-list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.negative-list.d.ts","sourceRoot":"","sources":["../src/manifest.negative-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAEhE,eAAO,MAAM,iBAAiB,EAAE,qBAAqB,EA2OpD,CAAA"}
+{"version":3,"file":"manifest.negative-list.d.ts","sourceRoot":"","sources":["../src/manifest.negative-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAEhE,eAAO,MAAM,iBAAiB,EAAE,qBAAqB,EAqPpD,CAAA"}

package/dist/manifest.negative-list.js

@@ -163,7 +163,7 @@ export const SDK_NEGATIVE_LIST = [
     {
         method: 'POST',
         path: '/api/v1/oauth/token-exchange',
-        reason: 'B978/AC-1: client-facing federated→internal token exchange — called by packages/mcp-core/src/login-provider/oauth-client.ts (native mcp/agent + beacon-cli) via raw fetch during bootstrap auth, before any SDK client exists, not the SDK',
+        reason: "B978/AC-1: client-facing federated→internal token exchange — called by packages/mcp-core/src/login-provider/oauth-client.ts (native mcp/agent + beacon-cli) and by the SDK's own createTenantAgentClient token provider (B987) via raw fetch during bootstrap auth: it PRODUCES the bearer every typed SDK method then uses, so it is never itself a typed SDK method",
     },
     {
         method: 'POST',
@@ -243,5 +243,15 @@ export const SDK_NEGATIVE_LIST = [
         path: '/api/v1/ops/identity/federated-tokens',
         reason: 'F496 ops-guarded federated-token mint — consumed by agent/service callers via raw fetch (cross-project trust primitive), no admin-UI/SDK use case',
     },
+    {
+        method: 'GET',
+        path: '/api/v1/files/public/{key}{.+}',
+        reason: 'F709 public read route — a byte stream loaded directly by the browser (<img src>) from the URL toAssetUrl/toAvatarUrl produce; no SDK method needed',
+    },
+    {
+        method: 'GET',
+        path: '/api/v1/assets/{id}/content',
+        reason: 'F709 private content route — a byte stream opened directly by the browser (inline view / ?download=1) from the URL toAssetUrl produces; no SDK method needed',
+    },
 ];
 //# sourceMappingURL=manifest.negative-list.js.map

package/dist/manifest.negative-list.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.negative-list.js","sourceRoot":"","sources":["../src/manifest.negative-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAA4B;IACtD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,+CAA+C;KAC1D;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,+CAA+C;KAC1D;IACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE;IACvE;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,4DAA4D;KACvE;IACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE;IACzE;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,0DAA0D;KACrE;IAED,+EAA+E;IAC/E;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,qEAAqE;KAChF;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,+LAA+L;KAC1M;IACD;QACI,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,uEAAuE;KAClF;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,+CAA+C;KAC1D;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,+CAA+C;KAC1D;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,+CAA+C;KAC1D;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,+CAA+C;KAC1D;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,gFAAgF;KAC3F;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,6JAA6J;KACxK;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,uEAAuE;KAClF;IACD;QACI,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,uEAAuE;KAClF;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,+IAA+I;KAC1J;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,4IAA4I;KACvJ;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,qJAAqJ;KAChK;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,gIAAgI;KAC3I;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,4IAA4I;KACvJ;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,iJAAiJ;KAC5J;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,gFAAgF;KAC3F;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,iKAAiK;KAC5K;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,6FAA6F;KACxG;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,+FAA+F;KAC1G;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,6FAA6F;KACxG;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,iGAAiG;KAC5G;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,2GAA2G;KACtH;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,2LAA2L;KACtM;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,4OAA4O;KACvP;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EAAE,wMAAwM;KACnN;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,8CAA8C;QACpD,MAAM,EAAE,mHAAmH;KAC9H;IAED,kFAAkF;IAClF,2FAA2F;IAC3F,2FAA2F;IAC3F,wFAAwF;IACxF,sFAAsF;IACtF,qFAAqF;IACrF,4CAA4C;IAC5C;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,mLAAmL;KAC9L;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,8JAA8J;KACzK;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,0IAA0I;KACrJ;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,gPAAgP;KAC3P;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,uEAAuE;KAClF;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,uEAAuE;KAClF;IAED,wFAAwF;IACxF,wFAAwF;IACxF,uFAAuF;IACvF,yFAAyF;IACzF,kFAAkF;IAClF,0CAA0C;IAC1C;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,2IAA2I;KACtJ;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,oPAAoP;KAC/P;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,qCAAqC;QAC3C,MAAM,EAAE,sNAAsN;KACjO;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,2NAA2N;KACtO;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,mJAAmJ;KAC9J;CACJ,CAAA"}
+{"version":3,"file":"manifest.negative-list.js","sourceRoot":"","sources":["../src/manifest.negative-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAA4B;IACtD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,+CAA+C;KAC1D;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,+CAA+C;KAC1D;IACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE;IACvE;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,4DAA4D;KACvE;IACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE;IACzE;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,0DAA0D;KACrE;IAED,+EAA+E;IAC/E;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,qEAAqE;KAChF;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,+LAA+L;KAC1M;IACD;QACI,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,uEAAuE;KAClF;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,+CAA+C;KAC1D;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,+CAA+C;KAC1D;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,+CAA+C;KAC1D;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,+CAA+C;KAC1D;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,gFAAgF;KAC3F;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,6JAA6J;KACxK;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,uEAAuE;KAClF;IACD;QACI,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,uEAAuE;KAClF;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,+IAA+I;KAC1J;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,4IAA4I;KACvJ;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,qJAAqJ;KAChK;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,gIAAgI;KAC3I;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,4IAA4I;KACvJ;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,iJAAiJ;KAC5J;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,gFAAgF;KAC3F;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,iKAAiK;KAC5K;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,6FAA6F;KACxG;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,+FAA+F;KAC1G;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,6FAA6F;KACxG;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,iGAAiG;KAC5G;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,2GAA2G;KACtH;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,2LAA2L;KACtM;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,uWAAuW;KAClX;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EAAE,wMAAwM;KACnN;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,8CAA8C;QACpD,MAAM,EAAE,mHAAmH;KAC9H;IAED,kFAAkF;IAClF,2FAA2F;IAC3F,2FAA2F;IAC3F,wFAAwF;IACxF,sFAAsF;IACtF,qFAAqF;IACrF,4CAA4C;IAC5C;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,mLAAmL;KAC9L;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,8JAA8J;KACzK;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,0IAA0I;KACrJ;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,gPAAgP;KAC3P;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,uEAAuE;KAClF;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,uEAAuE;KAClF;IAED,wFAAwF;IACxF,wFAAwF;IACxF,uFAAuF;IACvF,yFAAyF;IACzF,kFAAkF;IAClF,0CAA0C;IAC1C;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,2IAA2I;KACtJ;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,oPAAoP;KAC/P;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,qCAAqC;QAC3C,MAAM,EAAE,sNAAsN;KACjO;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,2NAA2N;KACtO;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,mJAAmJ;KAC9J;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,gCAAgC;QACtC,MAAM,EAAE,qJAAqJ;KAChK;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,8JAA8J;KACzK;CACJ,CAAA"}

package/dist/manifest.public-entries.d.ts

@@ -3,7 +3,7 @@
  * F603's package split — the `authMode: 'admin'` entries formerly alongside these moved to
  * `@beacon-build/sdk-internal`).
  *
- * Covers: /api/auth/* (authMode 'public').
+ * Covers: /api/auth/* and the public pricing read GET /api/v1/pricing (F564) — authMode 'public'.
  */
 import type { ManifestEntry } from './manifest.types.js';
 export declare const MANIFEST_PUBLIC_ENTRIES: ManifestEntry[];

package/dist/manifest.public-entries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.public-entries.d.ts","sourceRoot":"","sources":["../src/manifest.public-entries.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,eAAO,MAAM,uBAAuB,EAAE,aAAa,EAgClD,CAAA"}
+{"version":3,"file":"manifest.public-entries.d.ts","sourceRoot":"","sources":["../src/manifest.public-entries.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,eAAO,MAAM,uBAAuB,EAAE,aAAa,EAkClD,CAAA"}

package/dist/manifest.public-entries.js

@@ -3,7 +3,7 @@
  * F603's package split — the `authMode: 'admin'` entries formerly alongside these moved to
  * `@beacon-build/sdk-internal`).
  *
- * Covers: /api/auth/* (authMode 'public').
+ * Covers: /api/auth/* and the public pricing read GET /api/v1/pricing (F564) — authMode 'public'.
  */
 export const MANIFEST_PUBLIC_ENTRIES = [
     // ── Auth ──────────────────────────────────────────────────────────────────
@@ -37,5 +37,7 @@ export const MANIFEST_PUBLIC_ENTRIES = [
         sdkPath: 'auth.redeemMagicLink',
         authMode: 'public',
     },
+    // ── Pricing (F564 AC-3: public, identical to the authenticated read) ─────────
+    { method: 'GET', path: '/api/v1/pricing', sdkPath: 'billing.pricing', authMode: 'public' },
 ];
 //# sourceMappingURL=manifest.public-entries.js.map

package/dist/manifest.public-entries.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.public-entries.js","sourceRoot":"","sources":["../src/manifest.public-entries.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAoB;IACpD,6EAA6E;IAC7E,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACtF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC5F,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC1F,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACxF,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC/E;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;KACrB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;KACrB;IACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC1F;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,uBAAuB;QAChC,QAAQ,EAAE,QAAQ;KACrB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,QAAQ;KACrB;CACJ,CAAA"}
+{"version":3,"file":"manifest.public-entries.js","sourceRoot":"","sources":["../src/manifest.public-entries.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAoB;IACpD,6EAA6E;IAC7E,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACtF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC5F,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC1F,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACxF,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC/E;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;KACrB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;KACrB;IACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC1F;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,uBAAuB;QAChC,QAAQ,EAAE,QAAQ;KACrB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,QAAQ;KACrB;IACD,gFAAgF;IAChF,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE;CAC7F,CAAA"}

package/dist/transport/errors.d.ts

@@ -43,6 +43,9 @@ export declare class SdkError extends Error {
      * without pattern-matching on error prose (B300).
      */
     readonly apiCode?: string | undefined;
+    /** Structured `details` from the error body (`body.details` or `body.error.details`),
+     *  e.g. F705's BILLING_ENTITY_INACTIVE `{ entity, rootOrgId?, inactiveReason }`. */
+    readonly details?: Record<string, unknown> | undefined;
     constructor(code: SdkErrorCode, message: string, status?: number | undefined, 
     /**
      * The VERBATIM `code` from the API response body, when it sent one.
@@ -53,7 +56,10 @@ export declare class SdkError extends Error {
      * keeps the API's own word intact, so a caller can distinguish two different 409s
      * without pattern-matching on error prose (B300).
      */
-    apiCode?: string | undefined);
+    apiCode?: string | undefined, 
+    /** Structured `details` from the error body (`body.details` or `body.error.details`),
+     *  e.g. F705's BILLING_ENTITY_INACTIVE `{ entity, rootOrgId?, inactiveReason }`. */
+    details?: Record<string, unknown> | undefined);
 }
 export declare function statusToSdkCode(status: number): SdkErrorCode;
 /**

package/dist/transport/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/transport/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,YAAY;AACpB,uFAAuF;AACrF,cAAc;AAChB,wFAAwF;GACtF,WAAW;AACb,gFAAgF;GAC9E,WAAW;AACb;+FAC+F;GAC7F,UAAU;AACZ,4FAA4F;GAC1F,YAAY;AACd;;gGAEgG;GAC9F,oBAAoB;AACtB,4EAA4E;GAC1E,cAAc;AAChB;wFACwF;GACtF,cAAc;AAChB;yFACyF;GACvF,qBAAqB;AACvB;sEACsE;GACpE,eAAe,CAAA;AAErB,qBAAa,QAAS,SAAQ,KAAK;aAEX,IAAI,EAAE,YAAY;aAElB,MAAM,CAAC,EAAE,MAAM;IAC/B;;;;;;;;OAQG;aACa,OAAO,CAAC,EAAE,MAAM;gBAZhB,IAAI,EAAE,YAAY,EAClC,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA;IAC/B;;;;;;;;OAQG;IACa,OAAO,CAAC,EAAE,MAAM,YAAA;CAKvC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAoB5D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAmB9E"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/transport/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,YAAY;AACpB,uFAAuF;AACrF,cAAc;AAChB,wFAAwF;GACtF,WAAW;AACb,gFAAgF;GAC9E,WAAW;AACb;+FAC+F;GAC7F,UAAU;AACZ,4FAA4F;GAC1F,YAAY;AACd;;gGAEgG;GAC9F,oBAAoB;AACtB,4EAA4E;GAC1E,cAAc;AAChB;wFACwF;GACtF,cAAc;AAChB;yFACyF;GACvF,qBAAqB;AACvB;sEACsE;GACpE,eAAe,CAAA;AAErB,qBAAa,QAAS,SAAQ,KAAK;aAEX,IAAI,EAAE,YAAY;aAElB,MAAM,CAAC,EAAE,MAAM;IAC/B;;;;;;;;OAQG;aACa,OAAO,CAAC,EAAE,MAAM;IAChC;wFACoF;aACpE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAfjC,IAAI,EAAE,YAAY,EAClC,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA;IAC/B;;;;;;;;OAQG;IACa,OAAO,CAAC,EAAE,MAAM,YAAA;IAChC;wFACoF;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKxD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAoB5D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAmB9E"}

package/dist/transport/errors.js

@@ -2,6 +2,7 @@ export class SdkError extends Error {
     code;
     status;
     apiCode;
+    details;
     constructor(code, message, status, 
     /**
      * The VERBATIM `code` from the API response body, when it sent one.
@@ -12,11 +13,15 @@ export class SdkError extends Error {
      * keeps the API's own word intact, so a caller can distinguish two different 409s
      * without pattern-matching on error prose (B300).
      */
-    apiCode) {
+    apiCode, 
+    /** Structured `details` from the error body (`body.details` or `body.error.details`),
+     *  e.g. F705's BILLING_ENTITY_INACTIVE `{ entity, rootOrgId?, inactiveReason }`. */
+    details) {
         super(message);
         this.code = code;
         this.status = status;
         this.apiCode = apiCode;
+        this.details = details;
         this.name = 'SdkError';
     }
 }

package/dist/transport/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/transport/errors.ts"],"names":[],"mappings":"AAiCA,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEX;IAEA;IAUA;IAbpB,YACoB,IAAkB,EAClC,OAAe,EACC,MAAe;IAC/B;;;;;;;;OAQG;IACa,OAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAA;QAdE,SAAI,GAAJ,IAAI,CAAc;QAElB,WAAM,GAAN,MAAM,CAAS;QAUf,YAAO,GAAP,OAAO,CAAS;QAGhC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;IAC1B,CAAC;CACJ;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC1C,QAAQ,MAAM,EAAE,CAAC;QACb,KAAK,GAAG;YACJ,OAAO,cAAc,CAAA;QACzB,KAAK,GAAG;YACJ,OAAO,WAAW,CAAA;QACtB,KAAK,GAAG;YACJ,OAAO,WAAW,CAAA;QACtB,KAAK,GAAG;YACJ,OAAO,UAAU,CAAA;QACrB,KAAK,GAAG;YACJ,iFAAiF;YACjF,OAAO,oBAAoB,CAAA;QAC/B,KAAK,GAAG;YACJ,OAAO,cAAc,CAAA;QACzB,KAAK,GAAG;YACJ,OAAO,qBAAqB,CAAA;QAChC;YACI,OAAO,cAAc,CAAA;IAC7B,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAc;IAC5D,QAAQ,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,KAAK,YAAY;YACb,OAAO,YAAY,CAAA;QACvB,KAAK,oBAAoB;YACrB,OAAO,oBAAoB,CAAA;QAC/B,KAAK,WAAW;YACZ,OAAO,WAAW,CAAA;QACtB,KAAK,UAAU;YACX,OAAO,UAAU,CAAA;QACrB,KAAK,cAAc;YACf,OAAO,cAAc,CAAA;QACzB,KAAK,WAAW;YACZ,OAAO,WAAW,CAAA;QACtB,KAAK,cAAc;YACf,OAAO,cAAc,CAAA;QACzB;YACI,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;AACL,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/transport/errors.ts"],"names":[],"mappings":"AAiCA,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEX;IAEA;IAUA;IAGA;IAhBpB,YACoB,IAAkB,EAClC,OAAe,EACC,MAAe;IAC/B;;;;;;;;OAQG;IACa,OAAgB;IAChC;wFACoF;IACpE,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAA;QAjBE,SAAI,GAAJ,IAAI,CAAc;QAElB,WAAM,GAAN,MAAM,CAAS;QAUf,YAAO,GAAP,OAAO,CAAS;QAGhB,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;IAC1B,CAAC;CACJ;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC1C,QAAQ,MAAM,EAAE,CAAC;QACb,KAAK,GAAG;YACJ,OAAO,cAAc,CAAA;QACzB,KAAK,GAAG;YACJ,OAAO,WAAW,CAAA;QACtB,KAAK,GAAG;YACJ,OAAO,WAAW,CAAA;QACtB,KAAK,GAAG;YACJ,OAAO,UAAU,CAAA;QACrB,KAAK,GAAG;YACJ,iFAAiF;YACjF,OAAO,oBAAoB,CAAA;QAC/B,KAAK,GAAG;YACJ,OAAO,cAAc,CAAA;QACzB,KAAK,GAAG;YACJ,OAAO,qBAAqB,CAAA;QAChC;YACI,OAAO,cAAc,CAAA;IAC7B,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAc;IAC5D,QAAQ,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,KAAK,YAAY;YACb,OAAO,YAAY,CAAA;QACvB,KAAK,oBAAoB;YACrB,OAAO,oBAAoB,CAAA;QAC/B,KAAK,WAAW;YACZ,OAAO,WAAW,CAAA;QACtB,KAAK,UAAU;YACX,OAAO,UAAU,CAAA;QACrB,KAAK,cAAc;YACf,OAAO,cAAc,CAAA;QACzB,KAAK,WAAW;YACZ,OAAO,WAAW,CAAA;QACtB,KAAK,cAAc;YACf,OAAO,cAAc,CAAA;QACzB;YACI,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;AACL,CAAC"}

package/dist/transport/http-client.d.ts

@@ -1,3 +1,4 @@
+import type { BillingOrigin } from '@beacon-build/core';
 export interface HttpClientConfig {
     baseUrl: string;
     /** Base path prefix appended before each request path (e.g. '/api/v1') */
@@ -11,6 +12,17 @@ export interface HttpClientConfig {
      * (single-flight) so a burst of 401s rotates the refresh token only once.
      */
     onUnauthorized?: () => void | Promise<string | null | void>;
+    /** Optional fetch implementation (test seam / custom transport). Defaults to global fetch. */
+    fetch?: typeof fetch;
+}
+/** Per-request options for the read methods (`get`/`getEnvelope`). */
+export interface HttpRequestOptions {
+    /**
+     * C907/AC-8: `'background'` marks an automatically repeated call (a poll) — sent as
+     * `X-Beacon-Request-Origin: background`, counted but never billed. Omitted: the ambient
+     * `runWithBackgroundOrigin` scope decides (see `request-origin.ts`), else interactive.
+     */
+    origin?: BillingOrigin;
 }
 /**
  * HttpClient — JSON HTTP wrapper for User-JWT and Agent-JWT authenticated requests.
@@ -30,12 +42,12 @@ export declare class HttpClient {
      * unless a caller genuinely needs the status; see `postWithStatus`.
      */
     private requestFull;
-    get<T>(path: string): Promise<T>;
+    get<T>(path: string, opts?: HttpRequestOptions): Promise<T>;
     /**
      * GET without unwrapping the `{ data }` envelope — returns the full body so
      * callers can read `meta` (e.g. pagination total). F291.
      */
-    getEnvelope<T>(path: string): Promise<T>;
+    getEnvelope<T>(path: string, opts?: HttpRequestOptions): Promise<T>;
     post<T>(path: string, body?: unknown): Promise<T>;
     /**
      * POST without unwrapping the `{ data }` envelope — mirrors `getEnvelope` exactly

package/dist/transport/http-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/transport/http-client.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,CAAA;CAC9D;AAED;;;;;GAKG;AACH,qBAAa,UAAU;IACP,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,gBAAgB;YAE9B,OAAO;IASrB;;;;;;OAMG;YACW,WAAW;IAiGzB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC;;;OAGG;IACH,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIxC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAOjD;;;;;OAKG;IACH,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAQzD;;;OAGG;IACH,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAOrF,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAOjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAOhD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAGtC"}
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/transport/http-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,CAAA;IAC3D,8FAA8F;IAC9F,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACvB;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;CACzB;AAED;;;;;GAKG;AACH,qBAAa,UAAU;IACP,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,gBAAgB;YAE9B,OAAO;IASrB;;;;;;OAMG;YACW,WAAW;IA+GzB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,CAAC,CAAC;IAI/D;;;OAGG;IACH,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,CAAC,CAAC;IAIvE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAOjD;;;;;OAKG;IACH,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAQzD;;;OAGG;IACH,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAOrF,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAOjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAOhD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAGtC"}

package/dist/transport/http-client.js

@@ -1,4 +1,5 @@
 import { SdkError, apiCodeToSdkCode, statusToSdkCode } from './errors.js';
+import { requestOriginHeaders } from './request-origin.js';
 /**
  * HttpClient — JSON HTTP wrapper for User-JWT and Agent-JWT authenticated requests.
  * C213: a single transparent retry on 401 when onUnauthorized yields a fresh token
@@ -22,6 +23,9 @@ export class HttpClient {
      * unless a caller genuinely needs the status; see `postWithStatus`.
      */
     async requestFull(path, init = {}, opts = {}) {
+        // C907/AC-8: resolved BEFORE the first `await` — the ambient background scope is
+        // synchronous-only (see request-origin.ts).
+        const originHeaders = requestOriginHeaders(opts.origin);
         const unwrap = opts.unwrap ?? true;
         let token;
         try {
@@ -39,10 +43,11 @@ export class HttpClient {
             const headers = {
                 'Content-Type': 'application/json',
                 Authorization: `Bearer ${bearer}`,
+                ...originHeaders,
                 ...(init.headers ?? {}),
             };
             try {
-                return await fetch(url, { ...init, headers });
+                return await (this.config.fetch ?? fetch)(url, { ...init, headers });
             }
             catch (err) {
                 throw new SdkError('network_error', err instanceof Error ? err.message : 'Network request failed');
@@ -81,24 +86,33 @@ export class HttpClient {
             // (transport/ops-api-client.ts) — was computed via body.code above but never
             // threaded into the SdkError itself, so JWT-path callers could not read it.
             let apiCode;
+            let details;
             try {
                 const body = await res.json();
-                // Prefer body.code for precise error classification (e.g. 422 VALIDATION vs INVALID_TRANSITION)
-                if (typeof body?.code === 'string') {
-                    apiCode = body.code;
-                    code = apiCodeToSdkCode(body.code, res.status);
+                // Prefer body.code for precise error classification (e.g. 422 VALIDATION vs INVALID_TRANSITION);
+                // the API's global error envelope nests it as body.error.code (F564: e.g. the
+                // contributor-gating 409s thrown from the org-member write path).
+                const bodyCode = typeof body?.code === 'string'
+                    ? body.code
+                    : typeof body?.error?.code === 'string'
+                        ? body.error.code
+                        : undefined;
+                if (bodyCode) {
+                    apiCode = bodyCode;
+                    code = apiCodeToSdkCode(bodyCode, res.status);
                 }
                 if (body?.error?.message)
                     message = body.error.message;
                 else if (typeof body?.error === 'string')
                     message = body.error;
+                details = body?.details ?? body?.error?.details;
             }
             catch (_err) {
                 // Deliberately swallowed: an unparsable error body (e.g. non-JSON) must not
                 // block throwing the SdkError below — it falls back to the status-derived
                 // `code`/`message` computed above the try block.
             }
-            throw new SdkError(code, message, res.status, apiCode);
+            throw new SdkError(code, message, res.status, apiCode, details);
         }
         // 204 No Content
         if (res.status === 204)
@@ -108,15 +122,15 @@ export class HttpClient {
         const data = (!unwrap ? body : body?.data !== undefined ? body.data : body);
         return { data, status: res.status };
     }
-    get(path) {
-        return this.request(path);
+    get(path, opts = {}) {
+        return this.request(path, {}, { origin: opts.origin });
     }
     /**
      * GET without unwrapping the `{ data }` envelope — returns the full body so
      * callers can read `meta` (e.g. pagination total). F291.
      */
-    getEnvelope(path) {
-        return this.request(path, {}, { unwrap: false });
+    getEnvelope(path, opts = {}) {
+        return this.request(path, {}, { unwrap: false, origin: opts.origin });
     }
     post(path, body) {
         return this.request(path, {