@beacon-build/sdk 2.3.0 → 2.4.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @beacon-build/sdk Changelog
 
+## 2.4.0
+
+### Minor Changes
+
+- e2609a8: Split the SDK by auth tier: `@beacon-build/sdk` keeps the tenant-safe public surface (auth, agent client, realtime, React, shared transport); the new `@beacon-build/sdk-internal` package holds ops/admin/vendor clients (`createAdminClient`/`createOpsClient`) and a `createClient` DX facade that hides the by-alias-to-agent-token system-agent mint chain (F603).
+
+### Patch Changes
+
+- 9f00162: F602: fix stale /agent/v1/\* header comment (C572-FS54/10 retired that tree) — no functional change.
+- 4999cf1: Add the missing README, populate `SdkError.apiCode` on the JWT `HttpClient` path (was Ops-only), doc-comment every `SdkErrorCode`, and fix `HttpClient`'s stale `/api/agent/v1` default basePath to `/api/v1` (F603).
+- 2e30d3b: C998: capability catalog consistency — lifetime runs + ref-based attribution for archived skills/sops/workflows, false-orphan sync fix, Reach/Archive UI for all three catalog types (list + detail), backend delete-guard for definitions with run history, and platform-root-only 'global' reach.
+- 1aa0c5d: Add the SDK-boundary drift check (F603/AC-3), the API<->SDK coverage test partitioned across both packages (F603/AC-12), and the public-package no-privileged-exports regression guard (F603/AC-16).
+- 7863185: C999: generalize the cross-org private-share mechanism (selected-org / all-descendants / global) from skill-only to the sop and workflow catalogs — a type-agnostic share core (doCreateShare/doListShares/doRevokeShare), a query-param catalog-share route for workflow/sop, `type` threaded through the SDK/portal client, and cross-org radios re-enabled for all three capability types in the share dialog.
+- Updated dependencies [b31cfda]
+- Updated dependencies [8381639]
+- Updated dependencies [89a935b]
+- Updated dependencies [2e30d3b]
+- Updated dependencies [a0389f9]
+- Updated dependencies [83fd436]
+    - @beacon-build/core@2.4.0
+
 ## 2.3.0
 
 ### Patch Changes

package/README.md

@@ -0,0 +1,134 @@
+# @beacon-build/sdk
+
+The public, third-party-buildable SDK for the [beacon Platform](https://beacon.build) API — the
+tenant-safe surface: authentication, the agent client, realtime (SSE) subscriptions, and public
+reads. This package is intentionally **not** the whole API — ops/admin/vendor tooling lives in
+`@beacon-build/sdk-internal`, a separate, restricted package for beacon's own infrastructure and
+close operational partners. If you are integrating a third-party application or agent against
+beacon, this is the package you want.
+
+## Install
+
+```bash
+npm install @beacon-build/sdk
+# or
+pnpm add @beacon-build/sdk
+```
+
+Requires Node.js 18+ (or a modern browser) and, for the React helpers, `react`/`react-dom` ^19 as
+peer dependencies.
+
+## Entry points
+
+> A `createClient` DX facade also exists, hiding the by-alias → agent-token "system agent"
+> mint chain — but that flow is `OPS_API_KEY`-gated (an internal beacon credential no third
+> party ever holds), so it lives in `@beacon-build/sdk-internal`, not here. Third-party
+> consumers always already hold an Agent-JWT (or authenticate via `createAuthClient` below) —
+> use `createAgentClient` directly.
+
+### `createAgentClient` — when you hold an Agent-JWT
+
+```typescript
+import { createAgentClient } from '@beacon-build/sdk'
+
+const agent = createAgentClient({
+    baseUrl: 'https://api.beacon.build',
+    agentToken, // issued by POST /api/v1/agent-token
+})
+
+const task = await agent.tasks.claim('T42')
+```
+
+### `createAuthClient` — email/password auth flow
+
+```typescript
+import { createAuthClient } from '@beacon-build/sdk'
+
+const auth = createAuthClient('https://api.beacon.build')
+const { accessToken, refreshToken, user } = await auth.login(email, password)
+```
+
+### `RealtimeSdkClient` — SSE subscriptions
+
+```typescript
+import { RealtimeSdkClient } from '@beacon-build/sdk'
+
+const realtime = new RealtimeSdkClient({
+    baseUrl: 'https://api.beacon.build',
+    authToken, // User-JWT or Agent-JWT
+    channels: ['task-updates'],
+    onConnect: () => console.log('connected'),
+})
+```
+
+### React
+
+A React hooks layer is available under the `@beacon-build/sdk/react` subpath for consumers
+already using React.
+
+## Auth model
+
+- **User-JWT** — email/password login via `createAuthClient`. Short-lived access token +
+  refresh token pair.
+- **Agent-JWT** — a project-scoped token minted via `POST /api/v1/agent-token` (typically by
+  beacon's own internal automation, via `@beacon-build/sdk-internal`'s `createClient` by-alias
+  flow). Used by `createAgentClient`.
+- Every HTTP client supports a transparent silent-refresh on `401`: pass `onUnauthorized` and
+  return a fresh token to retry the failed request exactly once.
+
+Tokens are always sent via the `Authorization: Bearer` header — never in a URL or query string.
+
+## Error surface
+
+Every failed call rejects with an `SdkError`:
+
+```typescript
+import { SdkError } from '@beacon-build/sdk'
+
+try {
+    await agent.tasks.claim('T42')
+} catch (err) {
+    if (err instanceof SdkError) {
+        console.error(err.code) // coarse classification, e.g. 'not_found'
+        console.error(err.status) // HTTP status, when available
+        console.error(err.apiCode) // verbatim API body `code`, when the API sent one
+    }
+}
+```
+
+`SdkErrorCode` values (see `transport/errors.ts` for the full doc-commented union):
+`unauthorized`, `forbidden`, `not_found`, `conflict`, `validation`, `invalid_transition`,
+`rate_limited`, `server_error`, `service_unavailable`, `network_error`.
+
+`code` is a coarse, always-present classification derived from the HTTP status (and, where the
+API supplies one, its response-body `code`). `apiCode` is the API's own verbatim body `code`
+string, present whenever the API sent one — useful for distinguishing two failures that share
+the same coarse `code`/status without pattern-matching on error message text.
+
+## Stability
+
+`@beacon-build/sdk` follows [semver](https://semver.org/):
+
+- **Patch** — bug fixes, doc-comment/README fixes, internal refactors with no observable
+  behavior change.
+- **Minor** — new, backward-compatible functionality (a new client method, a new optional
+  config field, a new exported type).
+- **Major** — a breaking change: a removed/renamed export, a changed method signature, a
+  changed error `code`/`apiCode` mapping for an existing failure case, or a changed response
+  shape.
+
+**Deprecation policy:** a deprecated export is annotated with a `@deprecated` JSDoc tag naming
+the replacement and the minor version it was deprecated in, kept functional for at least one
+full major version cycle, and only removed in a subsequent major release — never silently
+dropped in a minor/patch release.
+
+This package is released independently of beacon's internal `@beacon-build/*` scope (F603/AC-9)
+— an internal-only change elsewhere in the monorepo does not force-bump this package's version.
+
+See [CHANGELOG.md](./CHANGELOG.md) for release notes. **Changeset summaries for this package
+MUST be written in plain, human-readable prose** (not a bare ticket ID or commit-hash dump) —
+they are copied verbatim into this file, which ships to third-party consumers.
+
+## License
+
+See [LICENSE](./LICENSE).

package/dist/clients/auth.client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.client.d.ts","sourceRoot":"","sources":["../../src/clients/auth.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAGjD,MAAM,WAAW,WAAW;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,QAAQ;IACrB,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,UAAU;IACvB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACxF,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACrD,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAwE5D"}
+{"version":3,"file":"auth.client.d.ts","sourceRoot":"","sources":["../../src/clients/auth.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAGjD,MAAM,WAAW,WAAW;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,QAAQ;IACrB,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,UAAU;IACvB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACxF,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACrD,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAyE5D"}

package/dist/clients/auth.client.js

@@ -34,8 +34,9 @@ export function createAuthClient(baseUrl) {
                 else if (typeof body?.error === 'string')
                     message = body.error;
             }
-            catch {
-                // ignore
+            catch (_err) {
+                // Deliberately swallowed: an unparsable error body must not block throwing
+                // the SdkError below — it falls back to the status-derived message above.
             }
             throw new SdkError(code, message, res.status);
         }

package/dist/clients/auth.client.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.client.js","sourceRoot":"","sources":["../../src/clients/auth.client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAgClE;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAEvC,KAAK,UAAU,OAAO,CAAI,IAAY,EAAE,OAAoB,EAAE;QAC1D,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,IAAI,EAAE,EAAE;gBACzC,GAAG,IAAI;gBACP,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,GAAG,CAAE,IAAI,CAAC,OAAkC,IAAI,EAAE,CAAC;iBACtD;aACJ,CAAC,CAAA;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,QAAQ,CACd,eAAe,EACf,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAChE,CAAA;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACxC,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAA;YAClC,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;gBAC7B,IAAI,IAAI,EAAE,KAAK,EAAE,OAAO;oBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAA;qBACjD,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ;oBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAA;YAClE,CAAC;YAAC,MAAM,CAAC;gBACL,SAAS;YACb,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QACjD,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAA;QAC7C,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAA;IACnC,CAAC;IAED,OAAO;QACH,KAAK,CAAC,KAAK,EAAE,QAAQ;YACjB,OAAO,OAAO,CAAc,QAAQ,EAAE;gBAClC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;aAC5C,CAAC,CAAA;QACN,CAAC;QAED,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW;YACjC,OAAO,OAAO,CAAiB,WAAW,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;aACzD,CAAC,CAAA;QACN,CAAC;QAED,OAAO,CAAC,YAAY;YAChB,OAAO,OAAO,CAAgB,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;aACzC,CAAC,CAAA;QACN,CAAC;QAED,MAAM,CAAC,YAAY;YACf,OAAO,OAAO,CAAO,SAAS,EAAE;gBAC5B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;aACzC,CAAC,CAAA;QACN,CAAC;QAED,EAAE,CAAC,WAAW;YACV,OAAO,OAAO,CAAW,KAAK,EAAE;gBAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACtD,CAAC,CAAA;QACN,CAAC;KACJ,CAAA;AACL,CAAC"}
+{"version":3,"file":"auth.client.js","sourceRoot":"","sources":["../../src/clients/auth.client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAgClE;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAEvC,KAAK,UAAU,OAAO,CAAI,IAAY,EAAE,OAAoB,EAAE;QAC1D,IAAI,GAAa,CAAA;QACjB,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,IAAI,EAAE,EAAE;gBACzC,GAAG,IAAI;gBACP,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,GAAG,CAAE,IAAI,CAAC,OAAkC,IAAI,EAAE,CAAC;iBACtD;aACJ,CAAC,CAAA;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,QAAQ,CACd,eAAe,EACf,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAChE,CAAA;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACxC,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAA;YAClC,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;gBAC7B,IAAI,IAAI,EAAE,KAAK,EAAE,OAAO;oBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAA;qBACjD,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ;oBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAA;YAClE,CAAC;YAAC,OAAO,IAAI,EAAE,CAAC;gBACZ,2EAA2E;gBAC3E,0EAA0E;YAC9E,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QACjD,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAA;QAC7C,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAA;IACnC,CAAC;IAED,OAAO;QACH,KAAK,CAAC,KAAK,EAAE,QAAQ;YACjB,OAAO,OAAO,CAAc,QAAQ,EAAE;gBAClC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;aAC5C,CAAC,CAAA;QACN,CAAC;QAED,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW;YACjC,OAAO,OAAO,CAAiB,WAAW,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;aACzD,CAAC,CAAA;QACN,CAAC;QAED,OAAO,CAAC,YAAY;YAChB,OAAO,OAAO,CAAgB,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;aACzC,CAAC,CAAA;QACN,CAAC;QAED,MAAM,CAAC,YAAY;YACf,OAAO,OAAO,CAAO,SAAS,EAAE;gBAC5B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;aACzC,CAAC,CAAA;QACN,CAAC;QAED,EAAE,CAAC,WAAW;YACV,OAAO,OAAO,CAAW,KAAK,EAAE;gBAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACtD,CAAC,CAAA;QACN,CAAC;KACJ,CAAA;AACL,CAAC"}

package/dist/index.auth-and-capture.d.ts

@@ -2,11 +2,13 @@
  * index.auth-and-capture.ts — Overflow extraction for auth + capture exports
  * (loc-guard, index.ts's 300-line threshold).
  *
- * C958: Argus-JWT minting, rotating JWT provider, and CaptureClient — shared between
- * sidecar, portal, and janitor so every consumer uses the SAME auth shape.
+ * C958: rotating JWT provider and CaptureClient — shared between sidecar, portal, and
+ * janitor so every consumer uses the SAME auth shape. Argus-JWT minting itself (OPS_API_KEY
+ * -gated) and ExternalSessionRegistrar (depends on the Ops-keyed SessionsOpsClient) moved to
+ * `@beacon-build/sdk-internal` (F603) — this generic rotating-JWT provider has no such
+ * dependency and stays here so `@beacon-build/sdk-internal`'s own Argus-JWT helper (and any
+ * other rotating-credential consumer) can build on it without pulling in anything internal.
  */
 export { createRotatingJwtProvider, type RotatingJwtLog, type JwtMintResult, type RotatingJwtProviderOptions, } from './auth/rotating-jwt-provider.js';
-export { createRotatingArgusJwt, doMintArgusJwt } from './auth/argus-jwt.js';
 export { CaptureClient, type CapturedEntry, type CapturedToolUse, type CaptureJob, } from './clients/capture.client.js';
-export { ExternalSessionRegistrar, type ExternalSessionRegistrationFailure, } from './clients/external-session-registrar.js';
 //# sourceMappingURL=index.auth-and-capture.d.ts.map

package/dist/index.auth-and-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.auth-and-capture.d.ts","sourceRoot":"","sources":["../src/index.auth-and-capture.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EACH,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,0BAA0B,GAClC,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAG5E,OAAO,EACH,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,UAAU,GAClB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACH,wBAAwB,EACxB,KAAK,kCAAkC,GAC1C,MAAM,yCAAyC,CAAA"}
+{"version":3,"file":"index.auth-and-capture.d.ts","sourceRoot":"","sources":["../src/index.auth-and-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACH,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,0BAA0B,GAClC,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EACH,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,UAAU,GAClB,MAAM,6BAA6B,CAAA"}

package/dist/index.auth-and-capture.js

@@ -2,14 +2,15 @@
  * index.auth-and-capture.ts — Overflow extraction for auth + capture exports
  * (loc-guard, index.ts's 300-line threshold).
  *
- * C958: Argus-JWT minting, rotating JWT provider, and CaptureClient — shared between
- * sidecar, portal, and janitor so every consumer uses the SAME auth shape.
+ * C958: rotating JWT provider and CaptureClient — shared between sidecar, portal, and
+ * janitor so every consumer uses the SAME auth shape. Argus-JWT minting itself (OPS_API_KEY
+ * -gated) and ExternalSessionRegistrar (depends on the Ops-keyed SessionsOpsClient) moved to
+ * `@beacon-build/sdk-internal` (F603) — this generic rotating-JWT provider has no such
+ * dependency and stays here so `@beacon-build/sdk-internal`'s own Argus-JWT helper (and any
+ * other rotating-credential consumer) can build on it without pulling in anything internal.
  */
 // ── Rotating JWT provider (C573 — DRY, B468 follow-up) ────────────────────────
 export { createRotatingJwtProvider, } from './auth/rotating-jwt-provider.js';
-// ── Argus-JWT mint + rotation (C958 — DRY: sidecar + portal + janitor) ────────
-export { createRotatingArgusJwt, doMintArgusJwt } from './auth/argus-jwt.js';
 // ── Capture client (C958 — DRY: sidecar + portal ingest) ──────────────────────
 export { CaptureClient, } from './clients/capture.client.js';
-export { ExternalSessionRegistrar, } from './clients/external-session-registrar.js';
 //# sourceMappingURL=index.auth-and-capture.js.map

package/dist/index.auth-and-capture.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.auth-and-capture.js","sourceRoot":"","sources":["../src/index.auth-and-capture.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,iFAAiF;AACjF,OAAO,EACH,yBAAyB,GAI5B,MAAM,iCAAiC,CAAA;AAExC,iFAAiF;AACjF,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAE5E,iFAAiF;AACjF,OAAO,EACH,aAAa,GAIhB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACH,wBAAwB,GAE3B,MAAM,yCAAyC,CAAA"}
+{"version":3,"file":"index.auth-and-capture.js","sourceRoot":"","sources":["../src/index.auth-and-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,iFAAiF;AACjF,OAAO,EACH,yBAAyB,GAI5B,MAAM,iCAAiC,CAAA;AAExC,iFAAiF;AACjF,OAAO,EACH,aAAa,GAIhB,MAAM,6BAA6B,CAAA"}

package/dist/index.d.ts

@@ -1,64 +1,33 @@
 /**
- * @beacon-build/sdk — Public SDK for beacon Platform
+ * @beacon-build/sdk — Public, third-party-buildable SDK for beacon Platform (FS68/F603).
+ * Every route lives once at /api/v1/{resource} (F602/AC-15: legacy `/agent/v1/*` retired,
+ * C572-FS54/10); services/api/src/lib/route-tier/ has the authoritative tier.
  *
- * Three entry points:
- *   createAdminClient(config)  — User-JWT, /api/v1/*
- *   createAgentClient(config)  — Agent-JWT, /api/agent/v1/*
- *   createOpsClient(config)    — OPS_API_KEY, /api/v1/*
+ * Tenant-safe entry points:
+ *   createAgentClient(config)  — Agent-JWT, /api/v1/* (project-agent-tier routes)
+ *   createAuthClient(baseUrl)  — /api/auth/* login/register/refresh flow
+ *   RealtimeSdkClient (F141)   — SSE subscription, /api/v1/realtime/subscribe
  *
- * Auth flow helper:
- *   createAuthClient(baseUrl)  — /api/auth/*
- *
- * Realtime (F141):
- *   RealtimeSdkClient          — SSE subscription, /api/v1/realtime/subscribe
+ * `createAdminClient`/`createOpsClient`, every admin/ops/vendor client class, AND the
+ * `createClient` DX facade (F603/AC-4 — its by-alias -> agent-token system-agent mint chain
+ * is OPS_API_KEY-gated, an internal-only credential no third party ever holds) now live in
+ * `@beacon-build/sdk-internal` (F603) — restricted, GitHub-Packages-only, NOT for third-party
+ * use. See that package's `index.ts` for the internal surface.
  */
-export { createAdminClient, type AdminSdk, type AdminSdkConfig } from './factory/admin-sdk.js';
-export type { MessageSearchHit } from './clients/admin/sessions.client.js';
 export { createAgentClient, type AgentSdk, type AgentSdkConfig } from './factory/agent-sdk.js';
-export { createOpsClient, type OpsSdk, type OpsSdkConfig } from './factory/ops-sdk.js';
 export { createAuthClient, type AuthClient, type LoginResult, type RegisterResult, type RefreshResult, type MeResult, } from './clients/auth.client.js';
 export { RealtimeSdkClient, type RealtimeSdkClientConfig } from './realtime/realtime.client.js';
 export * from './index.auth-and-capture.js';
 export { computePermissions, type Permissions, type RoleRow } from './permissions.js';
-export { SdkError, type SdkErrorCode } from './transport/errors.js';
-export { OpsApiClient, type OpsApiClientConfig } from './transport/ops-api-client.js';
+export { SdkError, type SdkErrorCode, statusToSdkCode, apiCodeToSdkCode, } from './transport/errors.js';
 export { HttpClient, type HttpClientConfig } from './transport/http-client.js';
+export { SseClient, type SseStreamHandler, type SseStreamResult } from './transport/sse-client.js';
 export { MultipartClient, type MultipartClientConfig } from './transport/multipart-client.js';
 export { BinaryClient, type BinaryClientConfig, type BinaryDownloadResult, } from './transport/binary-client.js';
-export { createOpsApiClient } from './transport/ops-api-client.js';
-export { AdminAgentsClient } from './clients/admin/agents.client.js';
-export { AdminTasksClient } from './clients/admin/tasks.client.js';
-export type { AdminTaskListFilter, AdminTaskPage, AdminTaskCounts, TaskMessageDto, TaskMessagesListResponse, TaskParticipantDto, TaskParticipantActor, CreateTaskInput, TaskLinkType, TaskLinkDto, TaskDocLinkDto, AdminRankTaskInput, AdminRankResult, AdminReorderScope, } from './clients/admin/tasks.client.js';
-export type { TaskEventDto, TaskEventsListResponse, TaskEventVerifyDto, TaskEventVerifyItemDto, TaskEventActorRefDto, TaskEventDocumentRefDto, } from './clients/admin/task-events.types.js';
-export { AdminAssetsClient } from './clients/admin/assets.client.js';
 export { AgentCapabilityClient, type CapabilityCandidateDto, } from './clients/agent/capability.client.js';
 export { AgentControllerClient, type AgentControllerEntryDto, type AgentControllerRevokeResult, type AgentControllerPrincipalIdentity, type MainAgentValidityDto, } from './clients/agent/agent-controller.client.js';
-export { AdminProjectsClient } from './clients/admin/projects.client.js';
-export type { TransferOwnershipInput, TransferOwnershipResultDto, OrgProjectTreeEntryDto, ProjectOrgTreeDto, TreeProjectDto, ReachSummaryItemDto, ReachSummaryPageDto, } from './clients/admin/projects.client.js';
-export { AdminPlanningClient } from './clients/admin/planning.client.js';
-export { AdminGithubProxyClient, type GithubProxyResponse, type SdkRelease, } from './clients/admin/github-proxy.client.js';
-export { AdminUsersClient } from './clients/admin/users.client.js';
-export type { GroupedOrgUsersDto, UsersGroupedByOrgDto, EffectiveGrantDto, OrgMemberTreeEntryDto, UserOrgTreeDto, TreeMemberDto, UserOrgSearchMatchesDto, IdentityDto, SessionDto, SetPasswordInput, UserSettingKey, } from './clients/admin/users.client.js';
-export { AdminOrganizationsClient, type MemberCandidateDto, type InviteGrantDto, type InviteDto, type OrgConfigAllDto, } from './clients/admin/organizations.client.js';
-export { AccessGrantsClient, type ScopeSelectorDto, type GrantRowDto, type AccessGrantCandidateInput, type CreateAccessGrantInput, type GrantedRowDto, type AccessGrantResultDto, type GlobalVendorDto, } from './clients/admin/access-grants.client.js';
-export { AdminRosterClient, type RosterEntryDto, type RosterListFilter, } from './clients/admin/roster.client.js';
 export { SDK_MANIFEST, SDK_NEGATIVE_LIST, type ManifestEntry, type ManifestNegativeEntry, type SdkAuthMode, } from './manifest.js';
-export { AgentsOpsClient } from './clients/ops/agents-ops.client.js';
-export { AgentsOpsClient as AgentSdkClient } from './clients/ops/agents-ops.client.js';
-export { SessionsOpsClient as SessionSdkClient } from './clients/ops/sessions-ops.client.js';
-export { TasksOpsClient as TaskOpsSdkClient } from './clients/ops/tasks-ops.client.js';
-export { ThreadMessagingOpsClient } from './clients/ops/thread-messaging.client.js';
-export type { ThreadParticipant, ThreadMessage, ThreadWithMessages, InboxItem, InboxResponse, InboxStats, MarkReadInput, SendMessageInput, SendMessageResponse, ApiFetchFn as ThreadMessagingApiFetchFn, BulkArchiveResponse, BulkDeleteResponse, AnnouncementItem, AnnouncementsResponse, } from './clients/ops/thread-messaging.client.js';
-export type { TaskListOpsFilter } from './clients/ops/tasks-ops.client.js';
-export type { SessionsOpsFilter as SessionsFilter, CreateSessionResult, } from './clients/ops/sessions-ops.client.js';
-export { OpsWorkersClient } from './clients/ops/ops-workers.client.js';
-export type { WorkerStatusDto, WorkerRunDto, WorkerConfig as SdkWorkerConfig, WorkerConfigPatch, WorkerDefinition as SdkWorkerDefinition, WorkerType as SdkWorkerType, WorkerCategory as SdkWorkerCategory, WorkerState as SdkWorkerState, WorkerLifecycleConfig as SdkWorkerLifecycleConfig, TriggerWorkerResult as SdkTriggerWorkerResult, WorkerRunsQuery as SdkWorkerRunsQuery, WorkerRunsListResult as SdkWorkerRunsListResult, } from './clients/ops/ops-workers.client.js';
-export { SettingsClient } from './clients/admin/settings.client.js';
-export type { SettingValue, SettingResponse, SettingsListResponse, SettingChangeType, SettingAuditEntry, SettingAuditResponse, } from './clients/admin/settings.client.js';
 export { TaskConfigClient } from './clients/shared/task-config.client.js';
 export type { TaskConfigResponse } from './clients/shared/task-config.client.js';
-export * from './index.additional-client-types.js';
-export { AdminPortalClient } from './clients/admin/portal.client.js';
-export type { PortalType as SdkPortalType, PortalListResponse as SdkPortalListResponse, PortalDetailResponse as SdkPortalDetailResponse, PortalSkillValidation, } from './clients/admin/portal.client.js';
 export type { TaskDto, TaskDetailDto, TaskStatus, TaskType, TaskSize, TaskResult, TaskQueueStats, SessionSummaryDto, SessionListItemDto, SessionWithCosts, SubagentRollupDto, SubagentGroupSummaryDto, Memory, MemoryType, MemoryScope, UpsertMemoryInput, AgentDto, AgentSummaryDto, AgentSessionDto, UserDto, OrganizationDto, OrganizationWithCountDto, OrganizationWithMembersDto, OrganizationMemberDto, ProjectApiItem, Document, Asset, ConversationMessageDto, SessionMessagesDto, SubagentGroupDto, ToolCallDto, ToolCallSummaryDto, VelocityRow, TimesheetRow, RoadmapData, TaskLogEntry, RealtimePayload, RealtimeChannel, RealtimeEventType, WorkflowLog, AgentContext, TaskConfig, TaskLevelConfig, TaskStateMachineConfig, TaskBoardConfig, SwimLaneConfig, BoardColumnConfig, ConfigSource, } from '@beacon-build/core';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,iBAAiB,EAAE,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE9F,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AAC1E,OAAO,EAAE,iBAAiB,EAAE,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC9F,OAAO,EAAE,eAAe,EAAE,KAAK,MAAM,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGtF,OAAO,EACH,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,QAAQ,GAChB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,+BAA+B,CAAA;AAI/F,cAAc,6BAA6B,CAAA;AAG3C,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGrF,OAAO,EAAE,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAGnE,OAAO,EAAE,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AACrF,OAAO,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAE7F,OAAO,EACH,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC5B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAGlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAClE,YAAY,EACR,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GACpB,MAAM,iCAAiC,CAAA;AACxC,YAAY,EACR,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,GAC1B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EACH,qBAAqB,EACrB,KAAK,sBAAsB,GAC9B,MAAM,sCAAsC,CAAA;AAE7C,OAAO,EACH,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,GAC5B,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,YAAY,EACR,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,GACtB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EACH,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,UAAU,GAClB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAClE,YAAY,EACR,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,cAAc,GACjB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACH,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,eAAe,GACvB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACH,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACvB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACH,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACxB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EACH,YAAY,EACZ,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,GACnB,MAAM,eAAe,CAAA;AAKtB,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,eAAe,IAAI,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACtF,OAAO,EAAE,iBAAiB,IAAI,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AAC5F,OAAO,EAAE,cAAc,IAAI,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAA;AACnF,YAAY,EACR,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,IAAI,yBAAyB,EACvC,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,GACxB,MAAM,0CAA0C,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAC1E,YAAY,EACR,iBAAiB,IAAI,cAAc,EACnC,mBAAmB,GACtB,MAAM,sCAAsC,CAAA;AAG7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAA;AACtE,YAAY,EACR,eAAe,EACf,YAAY,EACZ,YAAY,IAAI,eAAe,EAC/B,iBAAiB,EACjB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,EAC3B,cAAc,IAAI,iBAAiB,EACnC,WAAW,IAAI,cAAc,EAC7B,qBAAqB,IAAI,wBAAwB,EACjD,mBAAmB,IAAI,sBAAsB,EAE7C,eAAe,IAAI,kBAAkB,EACrC,oBAAoB,IAAI,uBAAuB,GAClD,MAAM,qCAAqC,CAAA;AAG5C,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACnE,YAAY,EACR,YAAY,EACZ,eAAe,EACf,oBAAoB,EAEpB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,GACvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAIhF,cAAc,oCAAoC,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,YAAY,EACR,UAAU,IAAI,aAAa,EAC3B,kBAAkB,IAAI,qBAAqB,EAC3C,oBAAoB,IAAI,uBAAuB,EAC/C,qBAAqB,GACxB,MAAM,kCAAkC,CAAA;AAGzC,YAAY,EAER,OAAO,EACP,aAAa,EACb,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,cAAc,EAEd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EAEvB,MAAM,EACN,UAAU,EACV,WAAW,EACX,iBAAiB,EAEjB,QAAQ,EACR,eAAe,EACf,eAAe,EAEf,OAAO,EAEP,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EAErB,cAAc,EAEd,QAAQ,EAER,KAAK,EAEL,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAEhB,WAAW,EACX,kBAAkB,EAElB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EAEZ,eAAe,EACf,eAAe,EACf,iBAAiB,EAEjB,WAAW,EAEX,YAAY,EAEZ,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,YAAY,GACf,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,iBAAiB,EAAE,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAG9F,OAAO,EACH,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,QAAQ,GAChB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,+BAA+B,CAAA;AAK/F,cAAc,6BAA6B,CAAA;AAG3C,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGrF,OAAO,EACH,QAAQ,EACR,KAAK,YAAY,EACjB,eAAe,EACf,gBAAgB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAE7F,OAAO,EACH,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC5B,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EACH,qBAAqB,EACrB,KAAK,sBAAsB,GAC9B,MAAM,sCAAsC,CAAA;AAE7C,OAAO,EACH,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,GAC5B,MAAM,4CAA4C,CAAA;AAGnD,OAAO,EACH,YAAY,EACZ,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,GACnB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAGhF,YAAY,EAER,OAAO,EACP,aAAa,EACb,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,cAAc,EAEd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EAEvB,MAAM,EACN,UAAU,EACV,WAAW,EACX,iBAAiB,EAEjB,QAAQ,EACR,eAAe,EACf,eAAe,EAEf,OAAO,EAEP,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EAErB,cAAc,EAEd,QAAQ,EAER,KAAK,EAEL,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAEhB,WAAW,EACX,kBAAkB,EAElB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EAEZ,eAAe,EACf,eAAe,EACf,iBAAiB,EAEjB,WAAW,EAEX,YAAY,EAEZ,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,YAAY,GACf,MAAM,oBAAoB,CAAA"}

package/dist/index.js

@@ -1,70 +1,45 @@
 /**
- * @beacon-build/sdk — Public SDK for beacon Platform
+ * @beacon-build/sdk — Public, third-party-buildable SDK for beacon Platform (FS68/F603).
+ * Every route lives once at /api/v1/{resource} (F602/AC-15: legacy `/agent/v1/*` retired,
+ * C572-FS54/10); services/api/src/lib/route-tier/ has the authoritative tier.
  *
- * Three entry points:
- *   createAdminClient(config)  — User-JWT, /api/v1/*
- *   createAgentClient(config)  — Agent-JWT, /api/agent/v1/*
- *   createOpsClient(config)    — OPS_API_KEY, /api/v1/*
+ * Tenant-safe entry points:
+ *   createAgentClient(config)  — Agent-JWT, /api/v1/* (project-agent-tier routes)
+ *   createAuthClient(baseUrl)  — /api/auth/* login/register/refresh flow
+ *   RealtimeSdkClient (F141)   — SSE subscription, /api/v1/realtime/subscribe
  *
- * Auth flow helper:
- *   createAuthClient(baseUrl)  — /api/auth/*
- *
- * Realtime (F141):
- *   RealtimeSdkClient          — SSE subscription, /api/v1/realtime/subscribe
+ * `createAdminClient`/`createOpsClient`, every admin/ops/vendor client class, AND the
+ * `createClient` DX facade (F603/AC-4 — its by-alias -> agent-token system-agent mint chain
+ * is OPS_API_KEY-gated, an internal-only credential no third party ever holds) now live in
+ * `@beacon-build/sdk-internal` (F603) — restricted, GitHub-Packages-only, NOT for third-party
+ * use. See that package's `index.ts` for the internal surface.
  */
 // ── Factory functions ──────────────────────────────────────────────────────────
-export { createAdminClient } from './factory/admin-sdk.js';
 export { createAgentClient } from './factory/agent-sdk.js';
-export { createOpsClient } from './factory/ops-sdk.js';
 // ── Auth client ────────────────────────────────────────────────────────────────
 export { createAuthClient, } from './clients/auth.client.js';
 // ── Realtime (implemented in F141) ────────────────────────────────────────────
 export { RealtimeSdkClient } from './realtime/realtime.client.js';
-// ── Auth + Capture overflow (loc-guard, 300-line threshold) ───────────────────
-// C573/C958: Rotating JWT provider, Argus-JWT, CaptureClient — shared exports.
+// ── Rotating JWT provider + Capture overflow (loc-guard, 300-line threshold) ──
+// C573/C958: generic rotating JWT provider + CaptureClient — shared exports. Argus-JWT
+// minting itself (Ops-keyed) moved to @beacon-build/sdk-internal (F603).
 export * from './index.auth-and-capture.js';
 // ── Permissions (F148) — Scoped Permissions API for SDK consumers ─────────────
 export { computePermissions } from './permissions.js';
 // ── Errors ────────────────────────────────────────────────────────────────────
-export { SdkError } from './transport/errors.js';
-// ── Transport (for advanced consumers) ───────────────────────────────────────
-export { OpsApiClient } from './transport/ops-api-client.js';
+export { SdkError, statusToSdkCode, apiCodeToSdkCode, } from './transport/errors.js';
+// ── Transport (for advanced consumers, incl. @beacon-build/sdk-internal) ─────
 export { HttpClient } from './transport/http-client.js';
+export { SseClient } from './transport/sse-client.js';
 export { MultipartClient } from './transport/multipart-client.js';
 // C434: needed by task-attachment-http.ts (packages/infrastructure) to fetch attachment bytes through the Ops-keyed path, same as AdminTasksClient.downloadAttachment.
 export { BinaryClient, } from './transport/binary-client.js';
-export { createOpsApiClient } from './transport/ops-api-client.js'; // Node.js only (reads process.env)
-// ── Admin clients (for DI consumers) ──────────────────────────────────────────
-export { AdminAgentsClient } from './clients/admin/agents.client.js';
-export { AdminTasksClient } from './clients/admin/tasks.client.js';
-export { AdminAssetsClient } from './clients/admin/assets.client.js';
+// ── Agent clients (for DI consumers) ──────────────────────────────────────────
 export { AgentCapabilityClient, } from './clients/agent/capability.client.js';
 // F473/AC-18: agent_controller_grant/_list/_revoke MCP tools.
 export { AgentControllerClient, } from './clients/agent/agent-controller.client.js';
-export { AdminProjectsClient } from './clients/admin/projects.client.js'; // F458/F516/C924 DTOs below
-export { AdminPlanningClient } from './clients/admin/planning.client.js';
-export { AdminGithubProxyClient, } from './clients/admin/github-proxy.client.js';
-export { AdminUsersClient } from './clients/admin/users.client.js';
-export { AdminOrganizationsClient, } from './clients/admin/organizations.client.js';
-export { AccessGrantsClient, } from './clients/admin/access-grants.client.js';
-export { AdminRosterClient, } from './clients/admin/roster.client.js';
 // ── Manifest (for drift testing) ──────────────────────────────────────────────
 export { SDK_MANIFEST, SDK_NEGATIVE_LIST, } from './manifest.js';
-// ── Legacy class exports (backward compat for existing internal consumers) ────
-// Mirrors the old @beacon-build/client class-based API — used by mcp/agent, apps/ide,
-// services/runtime. Internal consumers should migrate to createOpsClient()/createAgentClient().
-export { AgentsOpsClient } from './clients/ops/agents-ops.client.js';
-export { AgentsOpsClient as AgentSdkClient } from './clients/ops/agents-ops.client.js';
-export { SessionsOpsClient as SessionSdkClient } from './clients/ops/sessions-ops.client.js';
-export { TasksOpsClient as TaskOpsSdkClient } from './clients/ops/tasks-ops.client.js';
-export { ThreadMessagingOpsClient } from './clients/ops/thread-messaging.client.js';
-// F331/AC-12: Ops Workers client + wire types
-export { OpsWorkersClient } from './clients/ops/ops-workers.client.js';
-// F143: Config clients
-export { SettingsClient } from './clients/admin/settings.client.js';
+// F143: shared Task Config client (used by both public agent + internal admin surfaces)
 export { TaskConfigClient } from './clients/shared/task-config.client.js';
-// ── Additional client types (usage/activity/documents/metrics/campaign-events) ────────
-// C823: extracted to index.additional-client-types.js (loc-guard, 300-line threshold).
-export * from './index.additional-client-types.js';
-export { AdminPortalClient } from './clients/admin/portal.client.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAsC,MAAM,wBAAwB,CAAA;AAG9F,OAAO,EAAE,iBAAiB,EAAsC,MAAM,wBAAwB,CAAA;AAC9F,OAAO,EAAE,eAAe,EAAkC,MAAM,sBAAsB,CAAA;AAEtF,kFAAkF;AAClF,OAAO,EACH,gBAAgB,GAMnB,MAAM,0BAA0B,CAAA;AAEjC,iFAAiF;AACjF,OAAO,EAAE,iBAAiB,EAAgC,MAAM,+BAA+B,CAAA;AAE/F,iFAAiF;AACjF,+EAA+E;AAC/E,cAAc,6BAA6B,CAAA;AAE3C,iFAAiF;AACjF,OAAO,EAAE,kBAAkB,EAAkC,MAAM,kBAAkB,CAAA;AAErF,iFAAiF;AACjF,OAAO,EAAE,QAAQ,EAAqB,MAAM,uBAAuB,CAAA;AAEnE,gFAAgF;AAChF,OAAO,EAAE,YAAY,EAA2B,MAAM,+BAA+B,CAAA;AACrF,OAAO,EAAE,UAAU,EAAyB,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,eAAe,EAA8B,MAAM,iCAAiC,CAAA;AAC7F,uKAAuK;AACvK,OAAO,EACH,YAAY,GAGf,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA,CAAC,mCAAmC;AAEtG,iFAAiF;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAyBlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EACH,qBAAqB,GAExB,MAAM,sCAAsC,CAAA;AAC7C,8DAA8D;AAC9D,OAAO,EACH,qBAAqB,GAKxB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA,CAAC,4BAA4B;AAUrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EACH,sBAAsB,GAGzB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAclE,OAAO,EACH,wBAAwB,GAK3B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACH,kBAAkB,GAQrB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EACH,iBAAiB,GAGpB,MAAM,kCAAkC,CAAA;AACzC,iFAAiF;AACjF,OAAO,EACH,YAAY,EACZ,iBAAiB,GAIpB,MAAM,eAAe,CAAA;AAEtB,iFAAiF;AACjF,sFAAsF;AACtF,gGAAgG;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,eAAe,IAAI,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACtF,OAAO,EAAE,iBAAiB,IAAI,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AAC5F,OAAO,EAAE,cAAc,IAAI,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAA;AAuBnF,8CAA8C;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAA;AAiBtE,uBAAuB;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAUnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AAGzE,yFAAyF;AACzF,uFAAuF;AACvF,cAAc,oCAAoC,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,kFAAkF;AAClF,OAAO,EAAE,iBAAiB,EAAsC,MAAM,wBAAwB,CAAA;AAE9F,kFAAkF;AAClF,OAAO,EACH,gBAAgB,GAMnB,MAAM,0BAA0B,CAAA;AAEjC,iFAAiF;AACjF,OAAO,EAAE,iBAAiB,EAAgC,MAAM,+BAA+B,CAAA;AAE/F,iFAAiF;AACjF,uFAAuF;AACvF,yEAAyE;AACzE,cAAc,6BAA6B,CAAA;AAE3C,iFAAiF;AACjF,OAAO,EAAE,kBAAkB,EAAkC,MAAM,kBAAkB,CAAA;AAErF,iFAAiF;AACjF,OAAO,EACH,QAAQ,EAER,eAAe,EACf,gBAAgB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,gFAAgF;AAChF,OAAO,EAAE,UAAU,EAAyB,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,SAAS,EAA+C,MAAM,2BAA2B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA8B,MAAM,iCAAiC,CAAA;AAC7F,uKAAuK;AACvK,OAAO,EACH,YAAY,GAGf,MAAM,8BAA8B,CAAA;AAErC,iFAAiF;AACjF,OAAO,EACH,qBAAqB,GAExB,MAAM,sCAAsC,CAAA;AAC7C,8DAA8D;AAC9D,OAAO,EACH,qBAAqB,GAKxB,MAAM,4CAA4C,CAAA;AAEnD,iFAAiF;AACjF,OAAO,EACH,YAAY,EACZ,iBAAiB,GAIpB,MAAM,eAAe,CAAA;AAEtB,wFAAwF;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA"}

package/dist/manifest.agent-entries.d.ts

@@ -1,7 +1,8 @@
 /**
  * SDK Endpoint Manifest — Agent entries (F224)
  *
- * Covers: /api/agent/v1/* with authMode 'agent'.
+ * Covers: /api/v1/* (Agent-JWT reachable routes) with authMode 'agent' (F603/AC-13: corrected
+ * from the retired /api/agent/v1/* — see the C565 note immediately below for when/why).
  *
  * C565 (FS54/4, hard cutover 2026-08-04): the Agent Tasks entries below now point at the
  * ONE canonical `/api/v1/tasks` tree (was `/api/agent/v1/tasks/*`, a separate namespace —

package/dist/manifest.agent-entries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.agent-entries.d.ts","sourceRoot":"","sources":["../src/manifest.agent-entries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,eAAO,MAAM,sBAAsB,EAAE,aAAa,EA+DjD,CAAA"}
+{"version":3,"file":"manifest.agent-entries.d.ts","sourceRoot":"","sources":["../src/manifest.agent-entries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,eAAO,MAAM,sBAAsB,EAAE,aAAa,EA+DjD,CAAA"}

package/dist/manifest.agent-entries.js

@@ -1,7 +1,8 @@
 /**
  * SDK Endpoint Manifest — Agent entries (F224)
  *
- * Covers: /api/agent/v1/* with authMode 'agent'.
+ * Covers: /api/v1/* (Agent-JWT reachable routes) with authMode 'agent' (F603/AC-13: corrected
+ * from the retired /api/agent/v1/* — see the C565 note immediately below for when/why).
  *
  * C565 (FS54/4, hard cutover 2026-08-04): the Agent Tasks entries below now point at the
  * ONE canonical `/api/v1/tasks` tree (was `/api/agent/v1/tasks/*`, a separate namespace —

package/dist/manifest.agent-entries.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.agent-entries.js","sourceRoot":"","sources":["../src/manifest.agent-entries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACnD,iFAAiF;IACjF;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,OAAO;KACpB;IACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;IACxF;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,OAAO;KACpB;CACJ,CAAA"}
+{"version":3,"file":"manifest.agent-entries.js","sourceRoot":"","sources":["../src/manifest.agent-entries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACnD,iFAAiF;IACjF;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,OAAO;KACpB;IACD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;IACxF;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,OAAO;KACpB;IACD;QACI,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,OAAO;KACpB;CACJ,CAAA"}

package/dist/manifest.d.ts

@@ -1,23 +1,26 @@
 /**
- * SDK Endpoint Manifest — F224
+ * SDK Endpoint Manifest — Public package (F224; F603 split)
  *
- * Maps every (method, path) tuple from the beacon OpenAPI spec to an SDK method.
+ * Maps every PUBLIC (method, path) tuple from the beacon OpenAPI spec to an SDK method.
  * Used by the OpenAPI coverage test to prevent drift between API and SDK.
  *
- * INV-3: every (method, path) in /api/openapi-generated.json must appear either
- * in SDK_MANIFEST or SDK_NEGATIVE_LIST.
+ * The admin/ops manifests moved to `@beacon-build/sdk-internal` (F603) — see that package's
+ * `manifest.ts` for the internal surface. `SDK_NEGATIVE_LIST` stays authoritative HERE (routes
+ * excluded from BOTH packages) since it is a public export any coverage test can import
+ * alongside either package's own manifest.
+ *
+ * INV-3: every (method, path) in /api/openapi-generated.json must appear in SDK_MANIFEST,
+ * `@beacon-build/sdk-internal`'s SDK_MANIFEST, or SDK_NEGATIVE_LIST.
  * INV-11: handwritten, not code-generated. Maintain this file when adding new API endpoints.
  *
  * Sub-modules:
- *   manifest.types.ts         — SdkAuthMode, ManifestEntry, ManifestNegativeEntry
- *   manifest.admin-entries.ts — public + admin endpoint entries
- *   manifest.ops-entries.ts   — ops endpoint entries
- *   manifest.agent-entries.ts — agent endpoint entries
- *   manifest.negative-list.ts — SDK_NEGATIVE_LIST
+ *   manifest.types.ts          — SdkAuthMode, ManifestEntry, ManifestNegativeEntry
+ *   manifest.public-entries.ts — public (authMode 'public') entries
+ *   manifest.agent-entries.ts  — agent (authMode 'agent') entries
+ *   manifest.negative-list.ts  — SDK_NEGATIVE_LIST
  */
 export type { SdkAuthMode, ManifestEntry, ManifestNegativeEntry } from './manifest.types.js';
-export { MANIFEST_PUBLIC_ADMIN_ENTRIES } from './manifest.admin-entries.js';
-export { MANIFEST_OPS_ENTRIES } from './manifest.ops-entries.js';
+export { MANIFEST_PUBLIC_ENTRIES } from './manifest.public-entries.js';
 export { MANIFEST_AGENT_ENTRIES } from './manifest.agent-entries.js';
 export { SDK_NEGATIVE_LIST } from './manifest.negative-list.js';
 import type { ManifestEntry } from './manifest.types.js';

package/dist/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAK/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,eAAO,MAAM,YAAY,EAAE,aAAa,EAIvC,CAAA"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAI/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD,eAAO,MAAM,YAAY,EAAE,aAAa,EAA4D,CAAA"}

package/dist/manifest.js

@@ -1,30 +1,28 @@
 /**
- * SDK Endpoint Manifest — F224
+ * SDK Endpoint Manifest — Public package (F224; F603 split)
  *
- * Maps every (method, path) tuple from the beacon OpenAPI spec to an SDK method.
+ * Maps every PUBLIC (method, path) tuple from the beacon OpenAPI spec to an SDK method.
  * Used by the OpenAPI coverage test to prevent drift between API and SDK.
  *
- * INV-3: every (method, path) in /api/openapi-generated.json must appear either
- * in SDK_MANIFEST or SDK_NEGATIVE_LIST.
+ * The admin/ops manifests moved to `@beacon-build/sdk-internal` (F603) — see that package's
+ * `manifest.ts` for the internal surface. `SDK_NEGATIVE_LIST` stays authoritative HERE (routes
+ * excluded from BOTH packages) since it is a public export any coverage test can import
+ * alongside either package's own manifest.
+ *
+ * INV-3: every (method, path) in /api/openapi-generated.json must appear in SDK_MANIFEST,
+ * `@beacon-build/sdk-internal`'s SDK_MANIFEST, or SDK_NEGATIVE_LIST.
  * INV-11: handwritten, not code-generated. Maintain this file when adding new API endpoints.
  *
  * Sub-modules:
- *   manifest.types.ts         — SdkAuthMode, ManifestEntry, ManifestNegativeEntry
- *   manifest.admin-entries.ts — public + admin endpoint entries
- *   manifest.ops-entries.ts   — ops endpoint entries
- *   manifest.agent-entries.ts — agent endpoint entries
- *   manifest.negative-list.ts — SDK_NEGATIVE_LIST
+ *   manifest.types.ts          — SdkAuthMode, ManifestEntry, ManifestNegativeEntry
+ *   manifest.public-entries.ts — public (authMode 'public') entries
+ *   manifest.agent-entries.ts  — agent (authMode 'agent') entries
+ *   manifest.negative-list.ts  — SDK_NEGATIVE_LIST
  */
-export { MANIFEST_PUBLIC_ADMIN_ENTRIES } from './manifest.admin-entries.js';
-export { MANIFEST_OPS_ENTRIES } from './manifest.ops-entries.js';
+export { MANIFEST_PUBLIC_ENTRIES } from './manifest.public-entries.js';
 export { MANIFEST_AGENT_ENTRIES } from './manifest.agent-entries.js';
 export { SDK_NEGATIVE_LIST } from './manifest.negative-list.js';
-import { MANIFEST_PUBLIC_ADMIN_ENTRIES } from './manifest.admin-entries.js';
-import { MANIFEST_OPS_ENTRIES } from './manifest.ops-entries.js';
+import { MANIFEST_PUBLIC_ENTRIES } from './manifest.public-entries.js';
 import { MANIFEST_AGENT_ENTRIES } from './manifest.agent-entries.js';
-export const SDK_MANIFEST = [
-    ...MANIFEST_PUBLIC_ADMIN_ENTRIES,
-    ...MANIFEST_OPS_ENTRIES,
-    ...MANIFEST_AGENT_ENTRIES,
-];
+export const SDK_MANIFEST = [...MANIFEST_PUBLIC_ENTRIES, ...MANIFEST_AGENT_ENTRIES];
 //# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAE/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAGpE,MAAM,CAAC,MAAM,YAAY,GAAoB;IACzC,GAAG,6BAA6B;IAChC,GAAG,oBAAoB;IACvB,GAAG,sBAAsB;CAC5B,CAAA"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAE/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAGpE,MAAM,CAAC,MAAM,YAAY,GAAoB,CAAC,GAAG,uBAAuB,EAAE,GAAG,sBAAsB,CAAC,CAAA"}