@beacon-build/sdk 2.4.4 → 2.5.0

package/dist/clients/admin/tool-calls.client.js

@@ -0,0 +1,29 @@
+function dtoToToolCall(dto) {
+    return { ...dto, createdAt: new Date(dto.createdAt) };
+}
+export class AdminToolCallsClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    async create(input) {
+        const dto = await this.http.post('/tool-calls', input);
+        return dtoToToolCall(dto);
+    }
+    async updateStatus(id, status, durationMs, outputBytes) {
+        await this.http.patch(`/tool-calls/${id}`, { status, durationMs, outputBytes });
+    }
+    async setMessageId(ids, messageId) {
+        await this.http.post('/tool-calls/set-message-id', { ids, messageId });
+    }
+    async findBySession(sessionId) {
+        const dtos = await this.http.get(`/tool-calls/by-session/${encodeURIComponent(sessionId)}`);
+        return dtos.map(dtoToToolCall);
+    }
+    async findBySessionAndTools(sessionId, tools) {
+        const qs = tools.length > 0 ? `?tools=${tools.map(encodeURIComponent).join(',')}` : '';
+        const dtos = await this.http.get(`/tool-calls/by-session/${encodeURIComponent(sessionId)}${qs}`);
+        return dtos.map(dtoToToolCall);
+    }
+}
+//# sourceMappingURL=tool-calls.client.js.map

package/dist/clients/admin/tool-calls.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-calls.client.js","sourceRoot":"","sources":["../../../src/clients/admin/tool-calls.client.ts"],"names":[],"mappings":"AAQA,SAAS,aAAa,CAAC,GAAgB;IACnC,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAA;AACzD,CAAC;AAED,MAAM,OAAO,oBAAoB;IACA;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,MAAM,CAAC,KAA0B;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAc,aAAa,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,CAAC,YAAY,CACd,EAAU,EACV,MAAuC,EACvC,UAAmB,EACnB,WAAoB;QAEpB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAa,EAAE,SAAiB;QAC/C,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5B,0BAA0B,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAC5D,CAAA;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,SAAiB,EAAE,KAAe;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACtF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5B,0BAA0B,kBAAkB,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,CACjE,CAAA;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAClC,CAAC;CACJ"}

package/dist/clients/admin/usage.client.d.ts

@@ -0,0 +1,138 @@
+import type { HttpClient } from '../../transport/http-client.js';
+/** Aggregated usage data as returned by GET /api/v1/usage (not the raw log). */
+export interface AggregatedUsageFilter {
+    project?: string;
+    agentId?: string;
+    sessionId?: string;
+    model?: string;
+    since?: string;
+    until?: string;
+    /** GET /api/v1/usage accepts only these (VALID_GROUP_BY_NEW); defaults to 'day'. */
+    groupBy?: 'agent' | 'model' | 'day';
+}
+/** F478/AC-16b/16c: GET /api/v1/usage/costs — Execution-axis drilldown (skill/task/workflow). */
+export interface ExecutionCostFilter {
+    project?: string;
+    agentId?: string;
+    taskId?: string;
+    skillName?: string;
+    from?: string;
+    to?: string;
+    groupBy?: 'skill' | 'agent' | 'day' | 'task' | 'workflow' | 'skillVersion' | 'taskCompletionDay' | 'skillCostDay'
+    /** C697: groups execution cost by project — parity with the Message-axis `project`
+     *  entry dimension. */
+     | 'project';
+}
+export interface ExecutionCostRow {
+    dimension: string;
+    cost: number;
+    count: number;
+    /** Distinct tasks in this group — real task-completion count (a task can span several
+     *  executions), the honest per-task denominator (never `count`). */
+    taskCount: number;
+    inputTokens: number;
+    outputTokens: number;
+    costInclSubUsd: number;
+    coverage: 'complete' | 'inflated';
+}
+export interface ExecutionCostData {
+    totalCost: number;
+    totalCount: number;
+    /** Distinct task-completion count in-window — the "Tasks (completions)" KPI + per-task denominator. */
+    taskCount: number;
+    coverage: 'complete' | 'inflated';
+    versionMarkers: Array<{
+        day: string;
+        version: string;
+    }>;
+    groupedCosts: ExecutionCostRow[];
+}
+/** F485/C694/C697: the dimensions the Unified Cost Explorer navigates — top-level entry tabs
+ *  (agent/model/day(as "Date")/session/project/skill/task/workflow) plus the `year`/`month`/
+ *  `week` coarser Date-drill buckets and the `execution` leaf, both reachable only by drilling. */
+export type ExplorerDimension = 'agent' | 'model' | 'day'
+/** C694: Date-drill buckets, coarsest to finest above `day` — Year → Month → Week → Day. */
+ | 'year' | 'month' | 'week' | 'session'
+/** C697: entry dimension — cost grouped by project. Shown only when >1 project is in scope
+ *  (frontend `showProject` gate); server-side always computed (no extra I/O). */
+ | 'project' | 'skill' | 'task' | 'workflow'
+/** F485 leaf: an INDIVIDUAL skill execution (one run, with an id + surface) — never an
+ *  aggregate. Reachable only by drilling (task/skill/session → execution); opens the
+ *  ExecutionDetailOverlay. Not a top-level entry-axis tab. */
+ | 'execution';
+export interface ExplorerFilter {
+    project?: string;
+    agentId?: string;
+    model?: string;
+    day?: string;
+    skillName?: string;
+    taskId?: string;
+    sessionId?: string;
+    /** C695: cross-axis workflow filter — scopes a Workflow-axis node's `task`/`execution`
+     *  children to that ONE workflow instance's runs. */
+    workflowInstanceId?: string;
+    from?: string;
+    to?: string;
+    /** C694: "all" time range — no upper-bound-free query, `from`/`to` are ignored server-side
+     *  and a sane earliest-data lower bound is used instead. */
+    all?: boolean;
+}
+export interface ExplorerItem {
+    key: string;
+    label: string;
+    costUsd: number;
+    inputTokens: number;
+    outputTokens: number;
+    count: number;
+    coverage: 'complete' | 'inflated';
+    /** F485 execution-leaf only: the run's surface, so the UI can open the right
+     *  ExecutionDetailOverlay (`skill` for an individual skill_execution). Absent on aggregates. */
+    surface?: 'skill' | 'sop' | 'workflow';
+    /** F485 execution-leaf only: the run's identifying "main params" resolved DRY server-side —
+     *  the task ref it ran for and/or the PR it produced. Absent on aggregates. */
+    mainParams?: {
+        taskRef?: string;
+        prUrl?: string;
+    };
+}
+export interface ExplorerTotals {
+    costUsd: number;
+    inputTokens: number;
+    outputTokens: number;
+    count: number;
+    coverage: 'complete' | 'inflated';
+}
+export type ExplorerChildrenCounts = Record<ExplorerDimension, number>;
+export interface ExplorerResult {
+    dimension: ExplorerDimension;
+    axis: 'message' | 'execution';
+    items: ExplorerItem[];
+    totals: ExplorerTotals;
+    childrenCounts: ExplorerChildrenCounts;
+}
+export declare class AdminUsageClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * GET /api/v1/usage — aggregated usage data (not log rows).
+     * Returns the unwrapped `data` payload — caller is responsible for typing.
+     *
+     * F478/AC-11 (CON-25 route-response-envelope, C600): the route now wraps its body in the
+     * standard `{ data }` envelope. `http.get` unwraps `body.data` transparently, so this is
+     * NOT a parsed-shape change for callers (AC-11 "Response-Contract unverändert") — only the
+     * wire body changed, from a bare `{ rows, totals }` to `{ data: { rows, totals } }`.
+     */
+    aggregated<T = unknown>(filter?: AggregatedUsageFilter): Promise<T>;
+    /**
+     * F478/AC-16b/16c: GET /api/v1/usage/costs — the Cost Cockpit's Execution-axis (skill → task
+     * → workflow), including per-row Σ-inkl.-Sub (subagent-inclusive) totals and coverage.
+     */
+    executionCosts(filter?: ExecutionCostFilter): Promise<ExecutionCostData>;
+    /**
+     * F485: GET /api/v1/usage/costs/explore/:dimension — the Unified Cost Explorer's one
+     * endpoint over both cost axes (Message: agent/model/day/session · Execution: skill/task/
+     * workflow), with combinable filters and response-level childrenCounts.
+     */
+    explore(dimension: ExplorerDimension, filter?: ExplorerFilter): Promise<ExplorerResult>;
+}
+//# sourceMappingURL=usage.client.d.ts.map

package/dist/clients/admin/usage.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/usage.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAA;CACtC;AAED,iGAAiG;AACjG,MAAM,WAAW,mBAAmB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EACF,OAAO,GACP,OAAO,GACP,KAAK,GACL,MAAM,GACN,UAAU,GACV,cAAc,GACd,mBAAmB,GACnB,cAAc;IAChB;2BACuB;OACrB,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb;wEACoE;IACpE,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAA;CACpC;AAED,MAAM,WAAW,iBAAiB;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,uGAAuG;IACvG,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAA;IACjC,cAAc,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvD,YAAY,EAAE,gBAAgB,EAAE,CAAA;CACnC;AAED;;mGAEmG;AACnG,MAAM,MAAM,iBAAiB,GACvB,OAAO,GACP,OAAO,GACP,KAAK;AACP,4FAA4F;GAC1F,MAAM,GACN,OAAO,GACP,MAAM,GACN,SAAS;AACX;iFACiF;GAC/E,SAAS,GACT,OAAO,GACP,MAAM,GACN,UAAU;AACZ;;8DAE8D;GAC5D,WAAW,CAAA;AAEjB,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;yDACqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;gEAC4D;IAC5D,GAAG,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,YAAY;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAA;IACjC;oGACgG;IAChG,OAAO,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,UAAU,CAAA;IACtC;mFAC+E;IAC/E,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACpD;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAA;CACpC;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;AAEtE,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,SAAS,GAAG,WAAW,CAAA;IAC7B,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,MAAM,EAAE,cAAc,CAAA;IACtB,cAAc,EAAE,sBAAsB,CAAA;CACzC;AAED,qBAAa,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAM7C;;;;;;;;OAQG;IACG,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,GAAE,qBAA0B,GAAG,OAAO,CAAC,CAAC,CAAC;IAa7E;;;OAGG;IACG,cAAc,CAAC,MAAM,GAAE,mBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAalF;;;;OAIG;IACG,OAAO,CACT,SAAS,EAAE,iBAAiB,EAC5B,MAAM,GAAE,cAAmB,GAC5B,OAAO,CAAC,cAAc,CAAC;CAqB7B"}

package/dist/clients/admin/usage.client.js

@@ -0,0 +1,96 @@
+export class AdminUsageClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    // C692 (F478/AC-20): summary()/list() (GET /usage/summary, the naive-SUM legacy route; and
+    // a raw-log GET /usage?limit&page shape /usage never actually served post-F478) were
+    // removed — both had zero real callers and backed the now-deleted usage_logs chain.
+    /**
+     * GET /api/v1/usage — aggregated usage data (not log rows).
+     * Returns the unwrapped `data` payload — caller is responsible for typing.
+     *
+     * F478/AC-11 (CON-25 route-response-envelope, C600): the route now wraps its body in the
+     * standard `{ data }` envelope. `http.get` unwraps `body.data` transparently, so this is
+     * NOT a parsed-shape change for callers (AC-11 "Response-Contract unverändert") — only the
+     * wire body changed, from a bare `{ rows, totals }` to `{ data: { rows, totals } }`.
+     */
+    async aggregated(filter = {}) {
+        const params = new URLSearchParams();
+        if (filter.project)
+            params.set('project', filter.project);
+        if (filter.agentId)
+            params.set('agentId', filter.agentId);
+        if (filter.sessionId)
+            params.set('sessionId', filter.sessionId);
+        if (filter.model)
+            params.set('model', filter.model);
+        if (filter.since)
+            params.set('since', filter.since);
+        if (filter.until)
+            params.set('until', filter.until);
+        if (filter.groupBy)
+            params.set('groupBy', filter.groupBy);
+        const qs = params.toString();
+        return this.http.get(`/usage${qs ? `?${qs}` : ''}`);
+    }
+    /**
+     * F478/AC-16b/16c: GET /api/v1/usage/costs — the Cost Cockpit's Execution-axis (skill → task
+     * → workflow), including per-row Σ-inkl.-Sub (subagent-inclusive) totals and coverage.
+     */
+    async executionCosts(filter = {}) {
+        const params = new URLSearchParams();
+        if (filter.project)
+            params.set('project', filter.project);
+        if (filter.agentId)
+            params.set('agentId', filter.agentId);
+        if (filter.taskId)
+            params.set('taskId', filter.taskId);
+        if (filter.skillName)
+            params.set('skillName', filter.skillName);
+        if (filter.from)
+            params.set('from', filter.from);
+        if (filter.to)
+            params.set('to', filter.to);
+        if (filter.groupBy)
+            params.set('groupBy', filter.groupBy);
+        const qs = params.toString();
+        return this.http.get(`/usage/costs${qs ? `?${qs}` : ''}`);
+    }
+    /**
+     * F485: GET /api/v1/usage/costs/explore/:dimension — the Unified Cost Explorer's one
+     * endpoint over both cost axes (Message: agent/model/day/session · Execution: skill/task/
+     * workflow), with combinable filters and response-level childrenCounts.
+     */
+    async explore(dimension, filter = {}) {
+        const params = new URLSearchParams();
+        if (filter.project)
+            params.set('project', filter.project);
+        if (filter.agentId)
+            params.set('agentId', filter.agentId);
+        if (filter.model)
+            params.set('model', filter.model);
+        if (filter.day)
+            params.set('day', filter.day);
+        if (filter.skillName)
+            params.set('skillName', filter.skillName);
+        if (filter.taskId)
+            params.set('taskId', filter.taskId);
+        if (filter.sessionId)
+            params.set('sessionId', filter.sessionId);
+        if (filter.workflowInstanceId)
+            params.set('workflowInstanceId', filter.workflowInstanceId);
+        if (filter.all) {
+            params.set('all', 'true');
+        }
+        else {
+            if (filter.from)
+                params.set('from', filter.from);
+            if (filter.to)
+                params.set('to', filter.to);
+        }
+        const qs = params.toString();
+        return this.http.get(`/usage/costs/explore/${dimension}${qs ? `?${qs}` : ''}`);
+    }
+}
+//# sourceMappingURL=usage.client.js.map

package/dist/clients/admin/usage.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.client.js","sourceRoot":"","sources":["../../../src/clients/admin/usage.client.ts"],"names":[],"mappings":"AAsIA,MAAM,OAAO,gBAAgB;IACI;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,2FAA2F;IAC3F,qFAAqF;IACrF,oFAAoF;IAEpF;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CAAc,SAAgC,EAAE;QAC5D,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,SAA8B,EAAE;QACjD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAChD,IAAI,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAC1C,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAoB,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAChF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACT,SAA4B,EAC5B,SAAyB,EAAE;QAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,MAAM,CAAC,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,MAAM,CAAC,kBAAkB;YAAE,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC1F,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACJ,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YAChD,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,wBAAwB,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3D,CAAA;IACL,CAAC;CACJ"}

package/dist/clients/admin/users.client.d.ts

@@ -0,0 +1,137 @@
+import type { UserDto, ProjectApiItem } from '@beacon-build/core';
+import type { HttpClient } from '../../transport/http-client.js';
+import type { MultipartClient } from '../../transport/multipart-client.js';
+import type { ScopeSelectorDto } from './access-grants.client.js';
+/** F458/INV-2: one row of `GET /{id}/grants` — the SAME `EffectiveGrant` shape
+ * `getEffectiveGrants` (F444) produces server-side, wire-serialized (no `Date` fields to
+ * convert — `EffectiveGrant` carries none). */
+export interface EffectiveGrantDto {
+    scope: ScopeSelectorDto;
+    role: string;
+    source: 'actor_role' | 'project_access';
+}
+export interface UpdateProfileInput {
+    name?: string;
+}
+export interface IdentityDto {
+    provider: string;
+    connectedAt: string;
+    label: string;
+}
+export interface SessionDto {
+    id: string;
+    createdAt: string;
+    expiresAt: string;
+    current?: boolean;
+}
+export interface SetPasswordInput {
+    currentPassword?: string;
+    newPassword: string;
+}
+export type UserSettingKey = 'preferences.language' | 'preferences.theme' | 'preferences.notifications_email' | 'preferences.default_project_scope' | 'preferences.groups' | 'preferences.project_favorites' | 'preferences.tasks_project_filter_override' | 'preferences.agents_project_filter';
+/** F121/AC-5/6: one organization's group in the GET /users response.
+ * F440/API Contract Changes item 5: each user carries their `role` in this org.
+ * F504/AC-9: `role: string` → `roles: string[]` — a member can legally hold more than one
+ * org-tier role since F503 (e.g. `admin` + `contributor`); see `GroupedOrgUsers`'s doc
+ * comment in `@beacon-build/core` for the full rationale. */
+export interface GroupedOrgUsersDto {
+    orgId: string;
+    orgName: string;
+    users: (UserDto & {
+        roles: string[];
+    })[];
+}
+/** F121/AC-5/6: GET /users response shape — org-grouped, vendor: + unaffiliated. */
+export interface UsersGroupedByOrgDto {
+    orgs: GroupedOrgUsersDto[];
+    unaffiliated: UserDto[];
+}
+/** One org's row in the tree SKELETON — hierarchy shape + direct member COUNT, no user
+ * payloads. Field names (`id`/`parentId`) deliberately mirror `OrganizationDto` so the
+ * Organizations page's own `buildOrgTree` groups this one too (no second tree builder). */
+export interface OrgMemberTreeEntryDto {
+    id: string;
+    name: string;
+    parentId: string | null;
+    memberCount: number;
+}
+export interface UserOrgTreeDto {
+    orgs: OrgMemberTreeEntryDto[];
+    /** Always 0 for an org-admin scope. */
+    unaffiliatedCount: number;
+}
+/** GET /users/org/{orgId}/members and GET /users/unaffiliated share this shape — `roles` is
+ * present for an org member, absent for an unaffiliated one (mirrors `GroupedUserDto`). */
+export type TreeMemberDto = UserDto & {
+    roles?: string[];
+};
+/** GET /users/search — which org(s) contain a match, not the matching users directly (the
+ * caller re-fetches each matched org's members, search-filtered, via `getOrgMembers`). */
+export interface UserOrgSearchMatchesDto {
+    orgIds: string[];
+    unaffiliated: TreeMemberDto[];
+}
+export declare class AdminUsersClient {
+    private readonly http;
+    private readonly multipart;
+    constructor(http: HttpClient, multipart: MultipartClient);
+    me(): Promise<UserDto>;
+    updateProfile(input: UpdateProfileInput): Promise<UserDto>;
+    uploadAvatar(file: Blob | File): Promise<UserDto>;
+    deleteAvatar(): Promise<void>;
+    /**
+     * F121/AC-5/6: GET /users org-grouped list (vendor: all + unaffiliated;
+     * org-admin: own org(s); member: 403 — see server-side ACs).
+     */
+    listGroupedByOrg(search?: string): Promise<UsersGroupedByOrgDto>;
+    /**
+     * F121: flat search, preserved for existing non-org-aware callers
+     * (mentions `@`-autocomplete, useMentionSources.ts) — GET /users itself
+     * moved to org-grouped (AC-5/6, breaking), so this flattens the grouped
+     * result client-side rather than changing every caller's contract. Still
+     * 403s for a plain org-member exactly as the pre-F121 vendor-only search
+     * did (unaffected — org-admin gains access it didn't have before, a
+     * widening, not a narrowing).
+     */
+    search(query: string): Promise<UserDto[]>;
+    /** C801/AC-4 stage 1: the tree skeleton (hierarchy + direct member counts, no payloads). */
+    getOrgTree(): Promise<UserOrgTreeDto>;
+    /** C801/AC-4 stage 2: one org's direct member list, loaded on that org's first expand. */
+    getOrgMembers(orgId: string, search?: string): Promise<TreeMemberDto[]>;
+    /** C801/AC-4: the always-visible "Ohne Organisation" section (vendor only — org-admin
+     * always gets `[]`, mirrors `listGroupedByOrg`'s unaffiliated block). */
+    getUnaffiliatedUsers(search?: string): Promise<TreeMemberDto[]>;
+    /** C801/AC-4: server-side search across every user (even collapsed/unloaded orgs) —
+     * returns which org(s) matched, for the caller to expand against the already-loaded
+     * skeleton tree (`OrganizationsPage`'s `searchExpanded` pattern). */
+    searchOrgTree(q: string): Promise<UserOrgSearchMatchesDto>;
+    get(id: string): Promise<UserDto | null>;
+    /** F458/AC-3/AC-3a: `GET /{id}/owned-projects` — admin-gated (vendor OR any org-admin,
+     * mirrors `canManageUsers`), NOT scoped further to the caller's own visibility (that is
+     * exactly the gap AC-3a closes — see the route's doc comment). */
+    ownedProjects(id: string): Promise<ProjectApiItem[]>;
+    /** F458/INV-2: `GET /{id}/grants` — a thin facade over `getEffectiveGrants(id)` (F444),
+     * same admin gate as `ownedProjects` above. */
+    grants(id: string): Promise<EffectiveGrantDto[]>;
+    listIdentities(): Promise<IdentityDto[]>;
+    disconnectIdentity(provider: string): Promise<void>;
+    /** F526/AC-6/AC-7 — "Link via token": the classic-PAT write-scope fallback. Throws on
+     * an invalid/expired/insufficiently-scoped token or an already-linked-elsewhere GitHub
+     * identity (see `users-identities.ts`'s error mapping) — the caller surfaces the error
+     * message, same pattern as `disconnectIdentity`/`setPassword`. */
+    linkGithubToken(token: string): Promise<void>;
+    setPassword(input: SetPasswordInput): Promise<void>;
+    listSessions(): Promise<SessionDto[]>;
+    revokeSession(id: string): Promise<void>;
+    revokeAllSessions(): Promise<number>;
+    getSettings(): Promise<Record<string, unknown>>;
+    setSetting(key: UserSettingKey, value: unknown): Promise<void>;
+    /** F449/AC-10: a user-scoped secret — `name` is the caller-chosen name (NOT prefixed by
+     * the caller; the `secret.` prefix is added here, mirroring the server's own convention).
+     * Plaintext sent once over TLS; the server encrypts it whole before persisting. */
+    setSecretSetting(name: string, value: string): Promise<void>;
+    /** F446/AC-33: idempotent removal of a user-scoped secret — `name` is the caller-chosen
+     * name (NOT prefixed), mirrors `setSecretSetting`'s own convention. */
+    deleteSecretSetting(name: string): Promise<void>;
+}
+//# sourceMappingURL=users.client.d.ts.map

package/dist/clients/admin/users.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/users.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AAI1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAEjE;;+CAE+C;AAC/C,MAAM,WAAW,iBAAiB;IAC9B,KAAK,EAAE,gBAAgB,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAAA;CAC1C;AAED,MAAM,WAAW,kBAAkB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;CAChB;AAMD,MAAM,WAAW,WAAW;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,UAAU;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,cAAc,GACpB,sBAAsB,GACtB,mBAAmB,GACnB,iCAAiC,GAEjC,mCAAmC,GAGnC,oBAAoB,GAEpB,+BAA+B,GAG/B,2CAA2C,GAG3C,mCAAmC,CAAA;AAEzC;;;;6DAI6D;AAC7D,MAAM,WAAW,kBAAkB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,CAAC,OAAO,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,EAAE,CAAA;CAC3C;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACjC,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC1B,YAAY,EAAE,OAAO,EAAE,CAAA;CAC1B;AAID;;2FAE2F;AAC3F,MAAM,WAAW,qBAAqB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,IAAI,EAAE,qBAAqB,EAAE,CAAA;IAC7B,uCAAuC;IACvC,iBAAiB,EAAE,MAAM,CAAA;CAC5B;AAED;2FAC2F;AAC3F,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAE1D;0FAC0F;AAC1F,MAAM,WAAW,uBAAuB;IACpC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,YAAY,EAAE,aAAa,EAAE,CAAA;CAChC;AAED,qBAAa,gBAAgB;IAErB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,eAAe;IAGzC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC;IAItB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAI1D,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC;;;OAGG;IACG,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAKtE;;;;;;;;OAQG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAK/C,4FAA4F;IACtF,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC;IAI3C,0FAA0F;IACpF,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAO7E;6EACyE;IACnE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKrE;;yEAEqE;IAC/D,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAI1D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQ9C;;sEAEkE;IAC5D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAI1D;mDAC+C;IACzC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAMhD,cAAc,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAIxC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzD;;;sEAGkE;IAC5D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnD,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAIrC,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAOpC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI/C,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE;;uFAEmF;IAC7E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE;2EACuE;IACjE,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzD"}

package/dist/clients/admin/users.client.js

@@ -0,0 +1,133 @@
+export class AdminUsersClient {
+    http;
+    multipart;
+    constructor(http, multipart) {
+        this.http = http;
+        this.multipart = multipart;
+    }
+    async me() {
+        return this.http.get('/users/me');
+    }
+    async updateProfile(input) {
+        return this.http.patch('/users/me', input);
+    }
+    async uploadAvatar(file) {
+        return this.multipart.upload('/users/me/avatar', { file });
+    }
+    async deleteAvatar() {
+        await this.http.delete('/users/me/avatar');
+    }
+    /**
+     * F121/AC-5/6: GET /users org-grouped list (vendor: all + unaffiliated;
+     * org-admin: own org(s); member: 403 — see server-side ACs).
+     */
+    async listGroupedByOrg(search) {
+        const qs = search ? `?search=${encodeURIComponent(search)}` : '';
+        return this.http.get(`/users${qs}`);
+    }
+    /**
+     * F121: flat search, preserved for existing non-org-aware callers
+     * (mentions `@`-autocomplete, useMentionSources.ts) — GET /users itself
+     * moved to org-grouped (AC-5/6, breaking), so this flattens the grouped
+     * result client-side rather than changing every caller's contract. Still
+     * 403s for a plain org-member exactly as the pre-F121 vendor-only search
+     * did (unaffected — org-admin gains access it didn't have before, a
+     * widening, not a narrowing).
+     */
+    async search(query) {
+        const grouped = await this.listGroupedByOrg(query);
+        return [...grouped.orgs.flatMap((g) => g.users), ...grouped.unaffiliated];
+    }
+    /** C801/AC-4 stage 1: the tree skeleton (hierarchy + direct member counts, no payloads). */
+    async getOrgTree() {
+        return this.http.get('/users/tree');
+    }
+    /** C801/AC-4 stage 2: one org's direct member list, loaded on that org's first expand. */
+    async getOrgMembers(orgId, search) {
+        const qs = search ? `?search=${encodeURIComponent(search)}` : '';
+        return this.http.get(`/users/org/${encodeURIComponent(orgId)}/members${qs}`);
+    }
+    /** C801/AC-4: the always-visible "Ohne Organisation" section (vendor only — org-admin
+     * always gets `[]`, mirrors `listGroupedByOrg`'s unaffiliated block). */
+    async getUnaffiliatedUsers(search) {
+        const qs = search ? `?search=${encodeURIComponent(search)}` : '';
+        return this.http.get(`/users/unaffiliated${qs}`);
+    }
+    /** C801/AC-4: server-side search across every user (even collapsed/unloaded orgs) —
+     * returns which org(s) matched, for the caller to expand against the already-loaded
+     * skeleton tree (`OrganizationsPage`'s `searchExpanded` pattern). */
+    async searchOrgTree(q) {
+        return this.http.get(`/users/search?q=${encodeURIComponent(q)}`);
+    }
+    async get(id) {
+        try {
+            return await this.http.get(`/users/${encodeURIComponent(id)}`);
+        }
+        catch (_err) {
+            return null;
+        }
+    }
+    /** F458/AC-3/AC-3a: `GET /{id}/owned-projects` — admin-gated (vendor OR any org-admin,
+     * mirrors `canManageUsers`), NOT scoped further to the caller's own visibility (that is
+     * exactly the gap AC-3a closes — see the route's doc comment). */
+    async ownedProjects(id) {
+        return this.http.get(`/users/${encodeURIComponent(id)}/owned-projects`);
+    }
+    /** F458/INV-2: `GET /{id}/grants` — a thin facade over `getEffectiveGrants(id)` (F444),
+     * same admin gate as `ownedProjects` above. */
+    async grants(id) {
+        return this.http.get(`/users/${encodeURIComponent(id)}/grants`);
+    }
+    // ── F445: Login & Identities ────────────────────────────────────────────
+    async listIdentities() {
+        return this.http.get('/users/me/identities');
+    }
+    async disconnectIdentity(provider) {
+        await this.http.delete(`/users/me/identities/${encodeURIComponent(provider)}`);
+    }
+    /** F526/AC-6/AC-7 — "Link via token": the classic-PAT write-scope fallback. Throws on
+     * an invalid/expired/insufficiently-scoped token or an already-linked-elsewhere GitHub
+     * identity (see `users-identities.ts`'s error mapping) — the caller surfaces the error
+     * message, same pattern as `disconnectIdentity`/`setPassword`. */
+    async linkGithubToken(token) {
+        await this.http.post('/users/me/identities/github/token', { token });
+    }
+    // ── F445: Password ───────────────────────────────────────────────────────
+    async setPassword(input) {
+        await this.http.post('/users/me/password', input);
+    }
+    // ── F445: Security & Sessions ────────────────────────────────────────────
+    async listSessions() {
+        return this.http.get('/users/me/sessions');
+    }
+    async revokeSession(id) {
+        await this.http.delete(`/users/me/sessions/${encodeURIComponent(id)}`);
+    }
+    async revokeAllSessions() {
+        const result = await this.http.post('/users/me/sessions/revoke-all');
+        return result.revoked;
+    }
+    // ── F445: Preferences ────────────────────────────────────────────────────
+    async getSettings() {
+        return this.http.get('/users/me/settings');
+    }
+    async setSetting(key, value) {
+        await this.http.patch('/users/me/settings', { key, value });
+    }
+    /** F449/AC-10: a user-scoped secret — `name` is the caller-chosen name (NOT prefixed by
+     * the caller; the `secret.` prefix is added here, mirroring the server's own convention).
+     * Plaintext sent once over TLS; the server encrypts it whole before persisting. */
+    async setSecretSetting(name, value) {
+        await this.http.patch('/users/me/settings', {
+            key: `secret.${name}`,
+            value,
+            secret: true,
+        });
+    }
+    /** F446/AC-33: idempotent removal of a user-scoped secret — `name` is the caller-chosen
+     * name (NOT prefixed), mirrors `setSecretSetting`'s own convention. */
+    async deleteSecretSetting(name) {
+        await this.http.delete(`/users/me/settings/${encodeURIComponent(`secret.${name}`)}`);
+    }
+}
+//# sourceMappingURL=users.client.js.map

package/dist/clients/admin/users.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.client.js","sourceRoot":"","sources":["../../../src/clients/admin/users.client.ts"],"names":[],"mappings":"AA2GA,MAAM,OAAO,gBAAgB;IAEJ;IACA;IAFrB,YACqB,IAAgB,EAChB,SAA0B;QAD1B,SAAI,GAAJ,IAAI,CAAY;QAChB,cAAS,GAAT,SAAS,CAAiB;IAC5C,CAAC;IAEJ,KAAK,CAAC,EAAE;QACJ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAU,WAAW,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAyB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAU,WAAW,EAAE,KAAK,CAAC,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAiB;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAU,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,YAAY;QACd,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAe;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAChE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAuB,SAAS,EAAE,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC7E,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAiB,aAAa,CAAC,CAAA;IACvD,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAe;QAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAChE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,cAAc,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CACzD,CAAA;IACL,CAAC;IAED;6EACyE;IACzE,KAAK,CAAC,oBAAoB,CAAC,MAAe;QACtC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAChE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAkB,sBAAsB,EAAE,EAAE,CAAC,CAAA;IACrE,CAAC;IAED;;yEAEqE;IACrE,KAAK,CAAC,aAAa,CAAC,CAAS;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAA0B,mBAAmB,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAChB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAU,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC3E,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAED;;sEAEkE;IAClE,KAAK,CAAC,aAAa,CAAC,EAAU;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmB,UAAU,kBAAkB,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAA;IAC7F,CAAC;IAED;mDAC+C;IAC/C,KAAK,CAAC,MAAM,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAsB,UAAU,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IACxF,CAAC;IAED,2EAA2E;IAE3E,KAAK,CAAC,cAAc;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAgB,sBAAsB,CAAC,CAAA;IAC/D,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAClF,CAAC;IAED;;;sEAGkE;IAClE,KAAK,CAAC,eAAe,CAAC,KAAa;QAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,WAAW,CAAC,KAAuB;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;IACrD,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAe,oBAAoB,CAAC,CAAA;IAC5D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,KAAK,CAAC,iBAAiB;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,+BAA+B,CAAC,CAAA;QACzF,OAAO,MAAM,CAAC,OAAO,CAAA;IACzB,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAA0B,oBAAoB,CAAC,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAmB,EAAE,KAAc;QAChD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED;;uFAEmF;IACnF,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,KAAa;QAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE;YACxC,GAAG,EAAE,UAAU,IAAI,EAAE;YACrB,KAAK;YACL,MAAM,EAAE,IAAI;SACf,CAAC,CAAA;IACN,CAAC;IAED;2EACuE;IACvE,KAAK,CAAC,mBAAmB,CAAC,IAAY;QAClC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,kBAAkB,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IACxF,CAAC;CACJ"}

package/dist/clients/agent/messaging.client.d.ts

@@ -0,0 +1,34 @@
+import type { IMessagingService, Inbox, BoardInboxThread as Thread, BoardInboxMessage as Message, SendInput } from '@beacon-build/core';
+import type { HttpClient } from '../../transport/http-client.js';
+export declare class AgentMessagingClient implements IMessagingService {
+    private http;
+    constructor(http: HttpClient);
+    inbox(): Promise<Inbox>;
+    thread(id: string): Promise<Thread | null>;
+    send(input: SendInput): Promise<Thread>;
+    reply(threadId: string, content: string): Promise<Message>;
+    acknowledge(threadId: string, note?: string): Promise<void>;
+    claim(threadId: string): Promise<boolean>;
+    searchMessages(input: {
+        embedding: number[];
+        limit?: number;
+        filters?: {
+            project?: string;
+            threadId?: string;
+        };
+    }): Promise<{
+        results: Array<{
+            id: string;
+            content: string;
+            score: number;
+            metadata: {
+                threadId: string;
+                project: string | null;
+                createdAt: string;
+                kind: string;
+            };
+        }>;
+        total: number;
+    }>;
+}
+//# sourceMappingURL=messaging.client.d.ts.map

package/dist/clients/agent/messaging.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messaging.client.d.ts","sourceRoot":"","sources":["../../../src/clients/agent/messaging.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACR,iBAAiB,EACjB,KAAK,EACL,gBAAgB,IAAI,MAAM,EAC1B,iBAAiB,IAAI,OAAO,EAC5B,SAAS,EACZ,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAGhE,qBAAa,oBAAqB,YAAW,iBAAiB;IAC9C,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEpC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAIjB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAShD,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAIvC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM1D,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3D,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIzC,cAAc,CAAC,KAAK,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KACpD,GAAG,OAAO,CAAC;QACR,OAAO,EAAE,KAAK,CAAC;YACX,EAAE,EAAE,MAAM,CAAA;YACV,OAAO,EAAE,MAAM,CAAA;YACf,KAAK,EAAE,MAAM,CAAA;YACb,QAAQ,EAAE;gBACN,QAAQ,EAAE,MAAM,CAAA;gBAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;gBACtB,SAAS,EAAE,MAAM,CAAA;gBACjB,IAAI,EAAE,MAAM,CAAA;aACf,CAAA;SACJ,CAAC,CAAA;QACF,KAAK,EAAE,MAAM,CAAA;KAChB,CAAC;CAGL"}