@beacon-build/sdk 2.3.0 → 2.4.0

package/dist/clients/admin/usage.client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"usage.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/usage.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAA;CACtC;AAED,iGAAiG;AACjG,MAAM,WAAW,mBAAmB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EACF,OAAO,GACP,OAAO,GACP,KAAK,GACL,MAAM,GACN,UAAU,GACV,cAAc,GACd,mBAAmB,GACnB,cAAc;IAChB;2BACuB;OACrB,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb;wEACoE;IACpE,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAA;CACpC;AAED,MAAM,WAAW,iBAAiB;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,uGAAuG;IACvG,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAA;IACjC,cAAc,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvD,YAAY,EAAE,gBAAgB,EAAE,CAAA;CACnC;AAED;;mGAEmG;AACnG,MAAM,MAAM,iBAAiB,GACvB,OAAO,GACP,OAAO,GACP,KAAK;AACP,4FAA4F;GAC1F,MAAM,GACN,OAAO,GACP,MAAM,GACN,SAAS;AACX;iFACiF;GAC/E,SAAS,GACT,OAAO,GACP,MAAM,GACN,UAAU;AACZ;;8DAE8D;GAC5D,WAAW,CAAA;AAEjB,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;yDACqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;gEAC4D;IAC5D,GAAG,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,YAAY;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAA;IACjC;oGACgG;IAChG,OAAO,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,UAAU,CAAA;IACtC;mFAC+E;IAC/E,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACpD;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAA;CACpC;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;AAEtE,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,SAAS,GAAG,WAAW,CAAA;IAC7B,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,MAAM,EAAE,cAAc,CAAA;IACtB,cAAc,EAAE,sBAAsB,CAAA;CACzC;AAED,qBAAa,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAM7C;;;;;;;;OAQG;IACG,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,GAAE,qBAA0B,GAAG,OAAO,CAAC,CAAC,CAAC;IAa7E;;;OAGG;IACG,cAAc,CAAC,MAAM,GAAE,mBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAalF;;;;OAIG;IACG,OAAO,CACT,SAAS,EAAE,iBAAiB,EAC5B,MAAM,GAAE,cAAmB,GAC5B,OAAO,CAAC,cAAc,CAAC;CAqB7B"}

package/dist/clients/admin/usage.client.js

@@ -1,96 +0,0 @@
-export class AdminUsageClient {
-    http;
-    constructor(http) {
-        this.http = http;
-    }
-    // C692 (F478/AC-20): summary()/list() (GET /usage/summary, the naive-SUM legacy route; and
-    // a raw-log GET /usage?limit&page shape /usage never actually served post-F478) were
-    // removed — both had zero real callers and backed the now-deleted usage_logs chain.
-    /**
-     * GET /api/v1/usage — aggregated usage data (not log rows).
-     * Returns the unwrapped `data` payload — caller is responsible for typing.
-     *
-     * F478/AC-11 (CON-25 route-response-envelope, C600): the route now wraps its body in the
-     * standard `{ data }` envelope. `http.get` unwraps `body.data` transparently, so this is
-     * NOT a parsed-shape change for callers (AC-11 "Response-Contract unverändert") — only the
-     * wire body changed, from a bare `{ rows, totals }` to `{ data: { rows, totals } }`.
-     */
-    async aggregated(filter = {}) {
-        const params = new URLSearchParams();
-        if (filter.project)
-            params.set('project', filter.project);
-        if (filter.agentId)
-            params.set('agentId', filter.agentId);
-        if (filter.sessionId)
-            params.set('sessionId', filter.sessionId);
-        if (filter.model)
-            params.set('model', filter.model);
-        if (filter.since)
-            params.set('since', filter.since);
-        if (filter.until)
-            params.set('until', filter.until);
-        if (filter.groupBy)
-            params.set('groupBy', filter.groupBy);
-        const qs = params.toString();
-        return this.http.get(`/usage${qs ? `?${qs}` : ''}`);
-    }
-    /**
-     * F478/AC-16b/16c: GET /api/v1/usage/costs — the Cost Cockpit's Execution-axis (skill → task
-     * → workflow), including per-row Σ-inkl.-Sub (subagent-inclusive) totals and coverage.
-     */
-    async executionCosts(filter = {}) {
-        const params = new URLSearchParams();
-        if (filter.project)
-            params.set('project', filter.project);
-        if (filter.agentId)
-            params.set('agentId', filter.agentId);
-        if (filter.taskId)
-            params.set('taskId', filter.taskId);
-        if (filter.skillName)
-            params.set('skillName', filter.skillName);
-        if (filter.from)
-            params.set('from', filter.from);
-        if (filter.to)
-            params.set('to', filter.to);
-        if (filter.groupBy)
-            params.set('groupBy', filter.groupBy);
-        const qs = params.toString();
-        return this.http.get(`/usage/costs${qs ? `?${qs}` : ''}`);
-    }
-    /**
-     * F485: GET /api/v1/usage/costs/explore/:dimension — the Unified Cost Explorer's one
-     * endpoint over both cost axes (Message: agent/model/day/session · Execution: skill/task/
-     * workflow), with combinable filters and response-level childrenCounts.
-     */
-    async explore(dimension, filter = {}) {
-        const params = new URLSearchParams();
-        if (filter.project)
-            params.set('project', filter.project);
-        if (filter.agentId)
-            params.set('agentId', filter.agentId);
-        if (filter.model)
-            params.set('model', filter.model);
-        if (filter.day)
-            params.set('day', filter.day);
-        if (filter.skillName)
-            params.set('skillName', filter.skillName);
-        if (filter.taskId)
-            params.set('taskId', filter.taskId);
-        if (filter.sessionId)
-            params.set('sessionId', filter.sessionId);
-        if (filter.workflowInstanceId)
-            params.set('workflowInstanceId', filter.workflowInstanceId);
-        if (filter.all) {
-            params.set('all', 'true');
-        }
-        else {
-            if (filter.from)
-                params.set('from', filter.from);
-            if (filter.to)
-                params.set('to', filter.to);
-        }
-        const qs = params.toString();
-        return this.http.get(`/usage/costs/explore/${dimension}${qs ? `?${qs}` : ''}`);
-    }
-}
-//# sourceMappingURL=usage.client.js.map

package/dist/clients/admin/usage.client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"usage.client.js","sourceRoot":"","sources":["../../../src/clients/admin/usage.client.ts"],"names":[],"mappings":"AAsIA,MAAM,OAAO,gBAAgB;IACI;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,2FAA2F;IAC3F,qFAAqF;IACrF,oFAAoF;IAEpF;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CAAc,SAAgC,EAAE;QAC5D,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,SAA8B,EAAE;QACjD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAChD,IAAI,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAC1C,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAoB,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAChF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACT,SAA4B,EAC5B,SAAyB,EAAE;QAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,MAAM,CAAC,kBAAkB;YAAE,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC1F,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACJ,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YAChD,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,wBAAwB,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3D,CAAA;IACL,CAAC;CACJ"}

package/dist/clients/admin/users.client.d.ts

@@ -1,137 +0,0 @@
-import type { UserDto, ProjectApiItem } from '@beacon-build/core';
-import type { HttpClient } from '../../transport/http-client.js';
-import type { MultipartClient } from '../../transport/multipart-client.js';
-import type { ScopeSelectorDto } from './access-grants.client.js';
-/** F458/INV-2: one row of `GET /{id}/grants` — the SAME `EffectiveGrant` shape
- * `getEffectiveGrants` (F444) produces server-side, wire-serialized (no `Date` fields to
- * convert — `EffectiveGrant` carries none). */
-export interface EffectiveGrantDto {
-    scope: ScopeSelectorDto;
-    role: string;
-    source: 'actor_role' | 'project_access';
-}
-export interface UpdateProfileInput {
-    name?: string;
-}
-export interface IdentityDto {
-    provider: string;
-    connectedAt: string;
-    label: string;
-}
-export interface SessionDto {
-    id: string;
-    createdAt: string;
-    expiresAt: string;
-    current?: boolean;
-}
-export interface SetPasswordInput {
-    currentPassword?: string;
-    newPassword: string;
-}
-export type UserSettingKey = 'preferences.language' | 'preferences.theme' | 'preferences.notifications_email' | 'preferences.default_project_scope' | 'preferences.groups' | 'preferences.project_favorites' | 'preferences.tasks_project_filter_override' | 'preferences.agents_project_filter';
-/** F121/AC-5/6: one organization's group in the GET /users response.
- * F440/API Contract Changes item 5: each user carries their `role` in this org.
- * F504/AC-9: `role: string` → `roles: string[]` — a member can legally hold more than one
- * org-tier role since F503 (e.g. `admin` + `contributor`); see `GroupedOrgUsers`'s doc
- * comment in `@beacon-build/core` for the full rationale. */
-export interface GroupedOrgUsersDto {
-    orgId: string;
-    orgName: string;
-    users: (UserDto & {
-        roles: string[];
-    })[];
-}
-/** F121/AC-5/6: GET /users response shape — org-grouped, vendor: + unaffiliated. */
-export interface UsersGroupedByOrgDto {
-    orgs: GroupedOrgUsersDto[];
-    unaffiliated: UserDto[];
-}
-/** One org's row in the tree SKELETON — hierarchy shape + direct member COUNT, no user
- * payloads. Field names (`id`/`parentId`) deliberately mirror `OrganizationDto` so the
- * Organizations page's own `buildOrgTree` groups this one too (no second tree builder). */
-export interface OrgMemberTreeEntryDto {
-    id: string;
-    name: string;
-    parentId: string | null;
-    memberCount: number;
-}
-export interface UserOrgTreeDto {
-    orgs: OrgMemberTreeEntryDto[];
-    /** Always 0 for an org-admin scope. */
-    unaffiliatedCount: number;
-}
-/** GET /users/org/{orgId}/members and GET /users/unaffiliated share this shape — `roles` is
- * present for an org member, absent for an unaffiliated one (mirrors `GroupedUserDto`). */
-export type TreeMemberDto = UserDto & {
-    roles?: string[];
-};
-/** GET /users/search — which org(s) contain a match, not the matching users directly (the
- * caller re-fetches each matched org's members, search-filtered, via `getOrgMembers`). */
-export interface UserOrgSearchMatchesDto {
-    orgIds: string[];
-    unaffiliated: TreeMemberDto[];
-}
-export declare class AdminUsersClient {
-    private readonly http;
-    private readonly multipart;
-    constructor(http: HttpClient, multipart: MultipartClient);
-    me(): Promise<UserDto>;
-    updateProfile(input: UpdateProfileInput): Promise<UserDto>;
-    uploadAvatar(file: Blob | File): Promise<UserDto>;
-    deleteAvatar(): Promise<void>;
-    /**
-     * F121/AC-5/6: GET /users org-grouped list (vendor: all + unaffiliated;
-     * org-admin: own org(s); member: 403 — see server-side ACs).
-     */
-    listGroupedByOrg(search?: string): Promise<UsersGroupedByOrgDto>;
-    /**
-     * F121: flat search, preserved for existing non-org-aware callers
-     * (mentions `@`-autocomplete, useMentionSources.ts) — GET /users itself
-     * moved to org-grouped (AC-5/6, breaking), so this flattens the grouped
-     * result client-side rather than changing every caller's contract. Still
-     * 403s for a plain org-member exactly as the pre-F121 vendor-only search
-     * did (unaffected — org-admin gains access it didn't have before, a
-     * widening, not a narrowing).
-     */
-    search(query: string): Promise<UserDto[]>;
-    /** C801/AC-4 stage 1: the tree skeleton (hierarchy + direct member counts, no payloads). */
-    getOrgTree(): Promise<UserOrgTreeDto>;
-    /** C801/AC-4 stage 2: one org's direct member list, loaded on that org's first expand. */
-    getOrgMembers(orgId: string, search?: string): Promise<TreeMemberDto[]>;
-    /** C801/AC-4: the always-visible "Ohne Organisation" section (vendor only — org-admin
-     * always gets `[]`, mirrors `listGroupedByOrg`'s unaffiliated block). */
-    getUnaffiliatedUsers(search?: string): Promise<TreeMemberDto[]>;
-    /** C801/AC-4: server-side search across every user (even collapsed/unloaded orgs) —
-     * returns which org(s) matched, for the caller to expand against the already-loaded
-     * skeleton tree (`OrganizationsPage`'s `searchExpanded` pattern). */
-    searchOrgTree(q: string): Promise<UserOrgSearchMatchesDto>;
-    get(id: string): Promise<UserDto | null>;
-    /** F458/AC-3/AC-3a: `GET /{id}/owned-projects` — admin-gated (vendor OR any org-admin,
-     * mirrors `canManageUsers`), NOT scoped further to the caller's own visibility (that is
-     * exactly the gap AC-3a closes — see the route's doc comment). */
-    ownedProjects(id: string): Promise<ProjectApiItem[]>;
-    /** F458/INV-2: `GET /{id}/grants` — a thin facade over `getEffectiveGrants(id)` (F444),
-     * same admin gate as `ownedProjects` above. */
-    grants(id: string): Promise<EffectiveGrantDto[]>;
-    listIdentities(): Promise<IdentityDto[]>;
-    disconnectIdentity(provider: string): Promise<void>;
-    /** F526/AC-6/AC-7 — "Link via token": the classic-PAT write-scope fallback. Throws on
-     * an invalid/expired/insufficiently-scoped token or an already-linked-elsewhere GitHub
-     * identity (see `users-identities.ts`'s error mapping) — the caller surfaces the error
-     * message, same pattern as `disconnectIdentity`/`setPassword`. */
-    linkGithubToken(token: string): Promise<void>;
-    setPassword(input: SetPasswordInput): Promise<void>;
-    listSessions(): Promise<SessionDto[]>;
-    revokeSession(id: string): Promise<void>;
-    revokeAllSessions(): Promise<number>;
-    getSettings(): Promise<Record<string, unknown>>;
-    setSetting(key: UserSettingKey, value: unknown): Promise<void>;
-    /** F449/AC-10: a user-scoped secret — `name` is the caller-chosen name (NOT prefixed by
-     * the caller; the `secret.` prefix is added here, mirroring the server's own convention).
-     * Plaintext sent once over TLS; the server encrypts it whole before persisting. */
-    setSecretSetting(name: string, value: string): Promise<void>;
-    /** F446/AC-33: idempotent removal of a user-scoped secret — `name` is the caller-chosen
-     * name (NOT prefixed), mirrors `setSecretSetting`'s own convention. */
-    deleteSecretSetting(name: string): Promise<void>;
-}
-//# sourceMappingURL=users.client.d.ts.map

package/dist/clients/admin/users.client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"users.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/users.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AAI1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAEjE;;+CAE+C;AAC/C,MAAM,WAAW,iBAAiB;IAC9B,KAAK,EAAE,gBAAgB,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAAA;CAC1C;AAED,MAAM,WAAW,kBAAkB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;CAChB;AAMD,MAAM,WAAW,WAAW;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,UAAU;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,cAAc,GACpB,sBAAsB,GACtB,mBAAmB,GACnB,iCAAiC,GAEjC,mCAAmC,GAGnC,oBAAoB,GAEpB,+BAA+B,GAG/B,2CAA2C,GAG3C,mCAAmC,CAAA;AAEzC;;;;6DAI6D;AAC7D,MAAM,WAAW,kBAAkB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,CAAC,OAAO,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,EAAE,CAAA;CAC3C;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACjC,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC1B,YAAY,EAAE,OAAO,EAAE,CAAA;CAC1B;AAID;;2FAE2F;AAC3F,MAAM,WAAW,qBAAqB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC7B,uCAAuC;IACvC,iBAAiB,EAAE,MAAM,CAAA;CAC5B;AAED;2FAC2F;AAC3F,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAE1D;0FAC0F;AAC1F,MAAM,WAAW,uBAAuB;IACpC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,YAAY,EAAE,aAAa,EAAE,CAAA;CAChC;AAED,qBAAa,gBAAgB;IAErB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,eAAe;IAGzC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC;IAItB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAI1D,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC;;;OAGG;IACG,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAKtE;;;;;;;;OAQG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAK/C,4FAA4F;IACtF,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC;IAI3C,0FAA0F;IACpF,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAO7E;6EACyE;IACnE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKrE;;yEAEqE;IAC/D,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAI1D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQ9C;;sEAEkE;IAC5D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAI1D;mDAC+C;IACzC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAMhD,cAAc,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAIxC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzD;;;sEAGkE;IAC5D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnD,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAIrC,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAOpC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI/C,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE;;uFAEmF;IAC7E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE;2EACuE;IACjE,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzD"}

package/dist/clients/admin/users.client.js

@@ -1,133 +0,0 @@
-export class AdminUsersClient {
-    http;
-    multipart;
-    constructor(http, multipart) {
-        this.http = http;
-        this.multipart = multipart;
-    }
-    async me() {
-        return this.http.get('/users/me');
-    }
-    async updateProfile(input) {
-        return this.http.patch('/users/me', input);
-    }
-    async uploadAvatar(file) {
-        return this.multipart.upload('/users/me/avatar', { file });
-    }
-    async deleteAvatar() {
-        await this.http.delete('/users/me/avatar');
-    }
-    /**
-     * F121/AC-5/6: GET /users org-grouped list (vendor: all + unaffiliated;
-     * org-admin: own org(s); member: 403 — see server-side ACs).
-     */
-    async listGroupedByOrg(search) {
-        const qs = search ? `?search=${encodeURIComponent(search)}` : '';
-        return this.http.get(`/users${qs}`);
-    }
-    /**
-     * F121: flat search, preserved for existing non-org-aware callers
-     * (mentions `@`-autocomplete, useMentionSources.ts) — GET /users itself
-     * moved to org-grouped (AC-5/6, breaking), so this flattens the grouped
-     * result client-side rather than changing every caller's contract. Still
-     * 403s for a plain org-member exactly as the pre-F121 vendor-only search
-     * did (unaffected — org-admin gains access it didn't have before, a
-     * widening, not a narrowing).
-     */
-    async search(query) {
-        const grouped = await this.listGroupedByOrg(query);
-        return [...grouped.orgs.flatMap((g) => g.users), ...grouped.unaffiliated];
-    }
-    /** C801/AC-4 stage 1: the tree skeleton (hierarchy + direct member counts, no payloads). */
-    async getOrgTree() {
-        return this.http.get('/users/tree');
-    }
-    /** C801/AC-4 stage 2: one org's direct member list, loaded on that org's first expand. */
-    async getOrgMembers(orgId, search) {
-        const qs = search ? `?search=${encodeURIComponent(search)}` : '';
-        return this.http.get(`/users/org/${encodeURIComponent(orgId)}/members${qs}`);
-    }
-    /** C801/AC-4: the always-visible "Ohne Organisation" section (vendor only — org-admin
-     * always gets `[]`, mirrors `listGroupedByOrg`'s unaffiliated block). */
-    async getUnaffiliatedUsers(search) {
-        const qs = search ? `?search=${encodeURIComponent(search)}` : '';
-        return this.http.get(`/users/unaffiliated${qs}`);
-    }
-    /** C801/AC-4: server-side search across every user (even collapsed/unloaded orgs) —
-     * returns which org(s) matched, for the caller to expand against the already-loaded
-     * skeleton tree (`OrganizationsPage`'s `searchExpanded` pattern). */
-    async searchOrgTree(q) {
-        return this.http.get(`/users/search?q=${encodeURIComponent(q)}`);
-    }
-    async get(id) {
-        try {
-            return await this.http.get(`/users/${encodeURIComponent(id)}`);
-        }
-        catch (_err) {
-            return null;
-        }
-    }
-    /** F458/AC-3/AC-3a: `GET /{id}/owned-projects` — admin-gated (vendor OR any org-admin,
-     * mirrors `canManageUsers`), NOT scoped further to the caller's own visibility (that is
-     * exactly the gap AC-3a closes — see the route's doc comment). */
-    async ownedProjects(id) {
-        return this.http.get(`/users/${encodeURIComponent(id)}/owned-projects`);
-    }
-    /** F458/INV-2: `GET /{id}/grants` — a thin facade over `getEffectiveGrants(id)` (F444),
-     * same admin gate as `ownedProjects` above. */
-    async grants(id) {
-        return this.http.get(`/users/${encodeURIComponent(id)}/grants`);
-    }
-    // ── F445: Login & Identities ────────────────────────────────────────────
-    async listIdentities() {
-        return this.http.get('/users/me/identities');
-    }
-    async disconnectIdentity(provider) {
-        await this.http.delete(`/users/me/identities/${encodeURIComponent(provider)}`);
-    }
-    /** F526/AC-6/AC-7 — "Link via token": the classic-PAT write-scope fallback. Throws on
-     * an invalid/expired/insufficiently-scoped token or an already-linked-elsewhere GitHub
-     * identity (see `users-identities.ts`'s error mapping) — the caller surfaces the error
-     * message, same pattern as `disconnectIdentity`/`setPassword`. */
-    async linkGithubToken(token) {
-        await this.http.post('/users/me/identities/github/token', { token });
-    }
-    // ── F445: Password ───────────────────────────────────────────────────────
-    async setPassword(input) {
-        await this.http.post('/users/me/password', input);
-    }
-    // ── F445: Security & Sessions ────────────────────────────────────────────
-    async listSessions() {
-        return this.http.get('/users/me/sessions');
-    }
-    async revokeSession(id) {
-        await this.http.delete(`/users/me/sessions/${encodeURIComponent(id)}`);
-    }
-    async revokeAllSessions() {
-        const result = await this.http.post('/users/me/sessions/revoke-all');
-        return result.revoked;
-    }
-    // ── F445: Preferences ────────────────────────────────────────────────────
-    async getSettings() {
-        return this.http.get('/users/me/settings');
-    }
-    async setSetting(key, value) {
-        await this.http.patch('/users/me/settings', { key, value });
-    }
-    /** F449/AC-10: a user-scoped secret — `name` is the caller-chosen name (NOT prefixed by
-     * the caller; the `secret.` prefix is added here, mirroring the server's own convention).
-     * Plaintext sent once over TLS; the server encrypts it whole before persisting. */
-    async setSecretSetting(name, value) {
-        await this.http.patch('/users/me/settings', {
-            key: `secret.${name}`,
-            value,
-            secret: true,
-        });
-    }
-    /** F446/AC-33: idempotent removal of a user-scoped secret — `name` is the caller-chosen
-     * name (NOT prefixed), mirrors `setSecretSetting`'s own convention. */
-    async deleteSecretSetting(name) {
-        await this.http.delete(`/users/me/settings/${encodeURIComponent(`secret.${name}`)}`);
-    }
-}
-//# sourceMappingURL=users.client.js.map

package/dist/clients/admin/users.client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"users.client.js","sourceRoot":"","sources":["../../../src/clients/admin/users.client.ts"],"names":[],"mappings":"AA2GA,MAAM,OAAO,gBAAgB;IAEJ;IACA;IAFrB,YACqB,IAAgB,EAChB,SAA0B;QAD1B,SAAI,GAAJ,IAAI,CAAY;QAChB,cAAS,GAAT,SAAS,CAAiB;IAC5C,CAAC;IAEJ,KAAK,CAAC,EAAE;QACJ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAU,WAAW,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAyB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAU,WAAW,EAAE,KAAK,CAAC,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAiB;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAU,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,YAAY;QACd,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAe;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAChE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAuB,SAAS,EAAE,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC7E,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAiB,aAAa,CAAC,CAAA;IACvD,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAe;QAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAChE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,cAAc,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CACzD,CAAA;IACL,CAAC;IAED;6EACyE;IACzE,KAAK,CAAC,oBAAoB,CAAC,MAAe;QACtC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAChE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAkB,sBAAsB,EAAE,EAAE,CAAC,CAAA;IACrE,CAAC;IAED;;yEAEqE;IACrE,KAAK,CAAC,aAAa,CAAC,CAAS;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAA0B,mBAAmB,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAChB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAU,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC3E,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED;;sEAEkE;IAClE,KAAK,CAAC,aAAa,CAAC,EAAU;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmB,UAAU,kBAAkB,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAA;IAC7F,CAAC;IAED;mDAC+C;IAC/C,KAAK,CAAC,MAAM,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAsB,UAAU,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IACxF,CAAC;IAED,2EAA2E;IAE3E,KAAK,CAAC,cAAc;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAgB,sBAAsB,CAAC,CAAA;IAC/D,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAClF,CAAC;IAED;;;sEAGkE;IAClE,KAAK,CAAC,eAAe,CAAC,KAAa;QAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,WAAW,CAAC,KAAuB;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;IACrD,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAe,oBAAoB,CAAC,CAAA;IAC5D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,KAAK,CAAC,iBAAiB;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,+BAA+B,CAAC,CAAA;QACzF,OAAO,MAAM,CAAC,OAAO,CAAA;IACzB,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAA0B,oBAAoB,CAAC,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAmB,EAAE,KAAc;QAChD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED;;uFAEmF;IACnF,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,KAAa;QAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE;YACxC,GAAG,EAAE,UAAU,IAAI,EAAE;YACrB,KAAK;YACL,MAAM,EAAE,IAAI;SACf,CAAC,CAAA;IACN,CAAC;IAED;2EACuE;IACvE,KAAK,CAAC,mBAAmB,CAAC,IAAY;QAClC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,kBAAkB,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IACxF,CAAC;CACJ"}

package/dist/clients/external-session-registrar.d.ts

@@ -1,16 +0,0 @@
-import type { SessionsOpsClient } from './ops/sessions-ops.client.js';
-export interface ExternalSessionRegistrationFailure {
-    beaconSessionId: string;
-    externalId: string;
-    error: unknown;
-}
-/** Idempotently associates an external runtime session with its Beacon session. */
-export declare class ExternalSessionRegistrar {
-    private readonly sessions;
-    private readonly provider;
-    private readonly onFailure?;
-    private readonly registrations;
-    constructor(sessions: Pick<SessionsOpsClient, 'registerExternalId'>, provider: string, onFailure?: ((failure: ExternalSessionRegistrationFailure) => void) | undefined);
-    register(beaconSessionId: string, externalId: string): Promise<boolean>;
-}
-//# sourceMappingURL=external-session-registrar.d.ts.map

package/dist/clients/external-session-registrar.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"external-session-registrar.d.ts","sourceRoot":"","sources":["../../src/clients/external-session-registrar.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAErE,MAAM,WAAW,kCAAkC;IAC/C,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,OAAO,CAAA;CACjB;AAED,mFAAmF;AACnF,qBAAa,wBAAwB;IAI7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAL/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;gBAG/C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,EACvD,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,GAAE,CAAC,OAAO,EAAE,kCAAkC,KAAK,IAAI,aAAA;IAGhF,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAgBhF"}

package/dist/clients/external-session-registrar.js

@@ -1,29 +0,0 @@
-/** Idempotently associates an external runtime session with its Beacon session. */
-export class ExternalSessionRegistrar {
-    sessions;
-    provider;
-    onFailure;
-    registrations = new Map();
-    constructor(sessions, provider, onFailure) {
-        this.sessions = sessions;
-        this.provider = provider;
-        this.onFailure = onFailure;
-    }
-    async register(beaconSessionId, externalId) {
-        const key = `${beaconSessionId}:${externalId}`;
-        const existing = this.registrations.get(key);
-        if (existing)
-            return existing;
-        const registration = this.sessions
-            .registerExternalId(beaconSessionId, this.provider, externalId)
-            .then(() => true)
-            .catch((error) => {
-            this.registrations.delete(key);
-            this.onFailure?.({ beaconSessionId, externalId, error });
-            return false;
-        });
-        this.registrations.set(key, registration);
-        return registration;
-    }
-}
-//# sourceMappingURL=external-session-registrar.js.map

package/dist/clients/external-session-registrar.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"external-session-registrar.js","sourceRoot":"","sources":["../../src/clients/external-session-registrar.ts"],"names":[],"mappings":"AAQA,mFAAmF;AACnF,MAAM,OAAO,wBAAwB;IAIZ;IACA;IACA;IALJ,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAA;IAEpE,YACqB,QAAuD,EACvD,QAAgB,EAChB,SAAiE;QAFjE,aAAQ,GAAR,QAAQ,CAA+C;QACvD,aAAQ,GAAR,QAAQ,CAAQ;QAChB,cAAS,GAAT,SAAS,CAAwD;IACnF,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,eAAuB,EAAE,UAAkB;QACtD,MAAM,GAAG,GAAG,GAAG,eAAe,IAAI,UAAU,EAAE,CAAA;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE7B,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ;aAC7B,kBAAkB,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;aAC9D,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aAChB,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACtB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;YACxD,OAAO,KAAK,CAAA;QAChB,CAAC,CAAC,CAAA;QACN,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QACzC,OAAO,YAAY,CAAA;IACvB,CAAC;CACJ"}

package/dist/clients/ops/agent-authorization-ops.client.d.ts

@@ -1,29 +0,0 @@
-import type { CapabilitySource } from '@beacon-build/core';
-import type { OpsApiClient } from '../../transport/ops-api-client.js';
-/**
- * T229/AC-4 — the SDK-side calls to `services/api/src/routes/ops-agent-authorization.ts`
- * (`/v1/ops/agent-authorization/*`). Kept as its own client (not folded into `AgentsOpsClient`,
- * loc-guard, and thematically a different domain — agent-controller/project-access, not
- * agents/sessions) — consumed by `mcp/beacon`'s new caller-identity adapter.
- */
-export declare class AgentAuthorizationOpsClient {
-    private readonly api;
-    constructor(api: OpsApiClient);
-    /** AC-4(b/c): isBound + getCapabilitySources in ONE round trip — the two `AuthorizeAgentDeps`
-     *  reads `mayTriggerAgent` (`@beacon-build/core`) needs (F473 replaced `getProjectRole` with
-     *  `getCapabilitySources`). Fails open (empty defaults) on a transport error — the caller's
-     *  adapter treats that identically to an unknown human (AC-4's "a network/HTTP failure...
-     *  fails open" clause), never breaks the underlying GitHub/ops call. */
-    checkTrigger(agentId: string, humanActorId: string, project: string): Promise<{
-        bound: boolean;
-        capabilitySources: CapabilitySource[];
-    }>;
-    /** F451/AC-1a reverse lookup, now HTTP-reachable for a no-direct-DB-access caller (T229/
-     *  AC-3). `null` covers both "no project claims this repo" and "ambiguous" — resolved
-     *  server-side, never guessed. */
-    findProjectByRepo(repoFullName: string): Promise<{
-        slug: string;
-        kind: 'method' | 'code';
-    } | null>;
-}
-//# sourceMappingURL=agent-authorization-ops.client.d.ts.map

package/dist/clients/ops/agent-authorization-ops.client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-authorization-ops.client.d.ts","sourceRoot":"","sources":["../../../src/clients/ops/agent-authorization-ops.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAErE;;;;;GAKG;AACH,qBAAa,2BAA2B;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,YAAY;IAE9C;;;;4EAIwE;IAClE,YAAY,CACd,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAUrE;;sCAEkC;IAC5B,iBAAiB,CACnB,YAAY,EAAE,MAAM,GACrB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAU/D"}

package/dist/clients/ops/agent-authorization-ops.client.js

@@ -1,34 +0,0 @@
-/**
- * T229/AC-4 — the SDK-side calls to `services/api/src/routes/ops-agent-authorization.ts`
- * (`/v1/ops/agent-authorization/*`). Kept as its own client (not folded into `AgentsOpsClient`,
- * loc-guard, and thematically a different domain — agent-controller/project-access, not
- * agents/sessions) — consumed by `mcp/beacon`'s new caller-identity adapter.
- */
-export class AgentAuthorizationOpsClient {
-    api;
-    constructor(api) {
-        this.api = api;
-    }
-    /** AC-4(b/c): isBound + getCapabilitySources in ONE round trip — the two `AuthorizeAgentDeps`
-     *  reads `mayTriggerAgent` (`@beacon-build/core`) needs (F473 replaced `getProjectRole` with
-     *  `getCapabilitySources`). Fails open (empty defaults) on a transport error — the caller's
-     *  adapter treats that identically to an unknown human (AC-4's "a network/HTTP failure...
-     *  fails open" clause), never breaks the underlying GitHub/ops call. */
-    async checkTrigger(agentId, humanActorId, project) {
-        const params = new URLSearchParams({ agentId, humanActorId, project });
-        const res = await this.api
-            .get(`/api/v1/ops/agent-authorization/trigger-check?${params.toString()}`)
-            .catch(() => null);
-        return res?.data ?? { bound: false, capabilitySources: [] };
-    }
-    /** F451/AC-1a reverse lookup, now HTTP-reachable for a no-direct-DB-access caller (T229/
-     *  AC-3). `null` covers both "no project claims this repo" and "ambiguous" — resolved
-     *  server-side, never guessed. */
-    async findProjectByRepo(repoFullName) {
-        const res = await this.api
-            .get(`/api/v1/ops/agent-authorization/project-by-repo?repoFullName=${encodeURIComponent(repoFullName)}`)
-            .catch(() => null);
-        return res?.data ?? null;
-    }
-}
-//# sourceMappingURL=agent-authorization-ops.client.js.map

package/dist/clients/ops/agent-authorization-ops.client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-authorization-ops.client.js","sourceRoot":"","sources":["../../../src/clients/ops/agent-authorization-ops.client.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IACP;IAA7B,YAA6B,GAAiB;QAAjB,QAAG,GAAH,GAAG,CAAc;IAAG,CAAC;IAElD;;;;4EAIwE;IACxE,KAAK,CAAC,YAAY,CACd,OAAe,EACf,YAAoB,EACpB,OAAe;QAEf,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAA;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG;aACrB,GAAG,CAED,iDAAiD,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;aACvE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACtB,OAAO,GAAG,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAA;IAC/D,CAAC;IAED;;sCAEkC;IAClC,KAAK,CAAC,iBAAiB,CACnB,YAAoB;QAEpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG;aACrB,GAAG,CAGA,gEAAgE,kBAAkB,CAAC,YAAY,CAAC,EAAE,CACrG;aACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACtB,OAAO,GAAG,EAAE,IAAI,IAAI,IAAI,CAAA;IAC5B,CAAC;CACJ"}

package/dist/clients/ops/agents-affinity-ops.client.d.ts

@@ -1,27 +0,0 @@
-/**
- * agents-affinity-ops.client.ts — loc-guard extraction from `agents-ops.client.ts` (mirrors
- * `agents-stats-ops.client.ts`/`agents-mint-ops.client.ts`'s free-function-over-`OpsApiClient`
- * shape): the two identity-resolution lookups `AgentsOpsClient.resolveAffinity`/
- * `resolveSpawnCredential` delegate to.
- *
- * B300: `resolveAffinity` sends no `cwd` — the server never read it.
- * B753: `resolveSpawnCredential` resolves a delegated call's own `spawn_credential` DIRECTLY
- * to its issuing agent, non-consuming — `identity-resolve.ts`'s `resolveIdentity` tries this
- * BEFORE `resolveAffinity`'s project-scoped guessing chain, whenever a credential is present.
- *
- * B753/C600: both responses are the standard `{ data }` envelope (CON-25) — `resolve-affinity`'s
- * bare response lost its baseline grandfathering when `sessions/affinity.ts` was touched for
- * B753's new sibling route; unwrapped here to keep each method's own return shape unchanged.
- */
-import type { OpsApiClient } from '../../transport/ops-api-client.js';
-export interface AffinityResult {
-    agentId: string;
-    alias: string;
-    method: string;
-}
-export declare function resolveAffinity(api: OpsApiClient, project: string): Promise<AffinityResult | null>;
-export declare function resolveSpawnCredential(api: OpsApiClient, token: string, project: string): Promise<{
-    agentId: string;
-    alias: string;
-} | null>;
-//# sourceMappingURL=agents-affinity-ops.client.d.ts.map

package/dist/clients/ops/agents-affinity-ops.client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agents-affinity-ops.client.d.ts","sourceRoot":"","sources":["../../../src/clients/ops/agents-affinity-ops.client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAErE,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACjB;AAGD,wBAAsB,eAAe,CACjC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAKhC;AAED,wBAAsB,sBAAsB,CACxC,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAQpD"}

package/dist/clients/ops/agents-affinity-ops.client.js

@@ -1,14 +0,0 @@
-// C566: POST /api/v1/sessions/resolve-affinity (was /api/v1/agents/resolve-affinity).
-export async function resolveAffinity(api, project) {
-    return api
-        .post('/api/v1/sessions/resolve-affinity', { project })
-        .then((res) => res?.data ?? null)
-        .catch(() => null);
-}
-export async function resolveSpawnCredential(api, token, project) {
-    return api
-        .post('/api/v1/sessions/resolve-spawn-credential', { token, project })
-        .then((res) => res?.data ?? null)
-        .catch(() => null);
-}
-//# sourceMappingURL=agents-affinity-ops.client.js.map

package/dist/clients/ops/agents-affinity-ops.client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agents-affinity-ops.client.js","sourceRoot":"","sources":["../../../src/clients/ops/agents-affinity-ops.client.ts"],"names":[],"mappings":"AAuBA,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,GAAiB,EACjB,OAAe;IAEf,OAAO,GAAG;SACL,IAAI,CAA2B,mCAAmC,EAAE,EAAE,OAAO,EAAE,CAAC;SAChF,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC;SAChC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,GAAiB,EACjB,KAAa,EACb,OAAe;IAEf,OAAO,GAAG;SACL,IAAI,CACD,2CAA2C,EAC3C,EAAE,KAAK,EAAE,OAAO,EAAE,CACrB;SACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC;SAChC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC"}

package/dist/clients/ops/agents-mint-ops.client.d.ts

@@ -1,34 +0,0 @@
-import type { OpsApiClient } from '../../transport/ops-api-client.js';
-/**
- * Replaces the inline `resolveAgentAndGenerateJwt` duplicated in janitor and sidecar. THROWS
- * if the agent is not found or the mint fails — callers surface the error.
- *
- * Deliberately does NOT go through `byAlias()` — that method swallows every failure (network,
- * 5xx, 404 alike) into `null`, which would make a transient resolve failure here
- * indistinguishable from a genuine "no such agent" and misreport it as "not found". This does
- * its own GET and only degrades a real `not_found` into the friendly not-found message; any
- * other failure (network/5xx/etc.) propagates as-is so the caller can tell them apart.
- */
-export declare function resolveSystemAgentAndMintToken(api: OpsApiClient, issueSystemToken: (agentId: string, project: string) => Promise<{
-    token: string;
-    expiresAt: string;
-    seat?: string;
-}>, alias: string, project: string): Promise<{
-    agentId: string;
-    token: string;
-    expiresAt: string;
-}>;
-/**
- * B793: mints a token for `project`'s `config.main` agent — the ops-authority mint mode
- * (`opsProject` claim). Replaces the by-role roster-discovery two-step
- * (`list()` + `resolveSystemAgentAndMintToken`) the probe used to need: the server resolves
- * the main agent itself (Agent-Service layer, AC-7), so this is a single POST, no discovery
- * round-trip. NO fallback to `resolveSystemAgentAndMintToken` — a project without a
- * config.main agent must fail loud (see `agent-token`'s `NoMainAgentConfiguredError` mapping),
- * never silently retry a different identity.
- */
-export declare function issueMainAgentToken(api: OpsApiClient, project: string): Promise<{
-    token: string;
-    expiresAt: string;
-}>;
-//# sourceMappingURL=agents-mint-ops.client.d.ts.map

package/dist/clients/ops/agents-mint-ops.client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agents-mint-ops.client.d.ts","sourceRoot":"","sources":["../../../src/clients/ops/agents-mint-ops.client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAGrE;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAChD,GAAG,EAAE,YAAY,EACjB,gBAAgB,EAAE,CACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,KACd,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACjE,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBhE;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACrC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAW/C"}