@beacon-build/sdk 2.4.4 → 2.5.0

package/dist/clients/agent/messaging.client.js

@@ -0,0 +1,40 @@
+import { SdkError } from '../../transport/errors.js';
+export class AgentMessagingClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    inbox() {
+        return this.http.get('/messages/inbox');
+    }
+    async thread(id) {
+        try {
+            return await this.http.get(`/messages/threads/${encodeURIComponent(id)}`);
+        }
+        catch (err) {
+            if (err instanceof SdkError && err.code === 'not_found')
+                return null;
+            throw err;
+        }
+    }
+    send(input) {
+        return this.http.post('/messages', input);
+    }
+    reply(threadId, content) {
+        return this.http.post(`/messages/threads/${encodeURIComponent(threadId)}/reply`, {
+            content,
+        });
+    }
+    acknowledge(threadId, note) {
+        return this.http.post(`/messages/threads/${encodeURIComponent(threadId)}/ack`, {
+            note,
+        });
+    }
+    claim(threadId) {
+        return this.http.post(`/messages/threads/${encodeURIComponent(threadId)}/claim`);
+    }
+    searchMessages(input) {
+        return this.http.post('/threads/messages/search', input);
+    }
+}
+//# sourceMappingURL=messaging.client.js.map

package/dist/clients/agent/messaging.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messaging.client.js","sourceRoot":"","sources":["../../../src/clients/agent/messaging.client.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAEpD,MAAM,OAAO,oBAAoB;IACT;IAApB,YAAoB,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAExC,KAAK;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAQ,iBAAiB,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACnB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAS,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACrF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAA;YACpE,MAAM,GAAG,CAAA;QACb,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAgB;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAS,WAAW,EAAE,KAAK,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,QAAgB,EAAE,OAAe;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAU,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,EAAE;YACtF,OAAO;SACV,CAAC,CAAA;IACN,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,IAAa;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAO,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE;YACjF,IAAI;SACP,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,QAAgB;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAU,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC7F,CAAC;IAED,cAAc,CAAC,KAId;QAcG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;IAC5D,CAAC;CACJ"}

package/dist/clients/external-session-registrar.d.ts

@@ -0,0 +1,16 @@
+import type { SessionsOpsClient } from './ops/sessions-ops.client.js';
+export interface ExternalSessionRegistrationFailure {
+    beaconSessionId: string;
+    externalId: string;
+    error: unknown;
+}
+/** Idempotently associates an external runtime session with its Beacon session. */
+export declare class ExternalSessionRegistrar {
+    private readonly sessions;
+    private readonly provider;
+    private readonly onFailure?;
+    private readonly registrations;
+    constructor(sessions: Pick<SessionsOpsClient, 'registerExternalId'>, provider: string, onFailure?: ((failure: ExternalSessionRegistrationFailure) => void) | undefined);
+    register(beaconSessionId: string, externalId: string): Promise<boolean>;
+}
+//# sourceMappingURL=external-session-registrar.d.ts.map

package/dist/clients/external-session-registrar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-session-registrar.d.ts","sourceRoot":"","sources":["../../src/clients/external-session-registrar.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAErE,MAAM,WAAW,kCAAkC;IAC/C,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,OAAO,CAAA;CACjB;AAED,mFAAmF;AACnF,qBAAa,wBAAwB;IAI7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAL/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;gBAG/C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,EACvD,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,GAAE,CAAC,OAAO,EAAE,kCAAkC,KAAK,IAAI,aAAA;IAGhF,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAgBhF"}

package/dist/clients/external-session-registrar.js

@@ -0,0 +1,29 @@
+/** Idempotently associates an external runtime session with its Beacon session. */
+export class ExternalSessionRegistrar {
+    sessions;
+    provider;
+    onFailure;
+    registrations = new Map();
+    constructor(sessions, provider, onFailure) {
+        this.sessions = sessions;
+        this.provider = provider;
+        this.onFailure = onFailure;
+    }
+    async register(beaconSessionId, externalId) {
+        const key = `${beaconSessionId}:${externalId}`;
+        const existing = this.registrations.get(key);
+        if (existing)
+            return existing;
+        const registration = this.sessions
+            .registerExternalId(beaconSessionId, this.provider, externalId)
+            .then(() => true)
+            .catch((error) => {
+            this.registrations.delete(key);
+            this.onFailure?.({ beaconSessionId, externalId, error });
+            return false;
+        });
+        this.registrations.set(key, registration);
+        return registration;
+    }
+}
+//# sourceMappingURL=external-session-registrar.js.map

package/dist/clients/external-session-registrar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-session-registrar.js","sourceRoot":"","sources":["../../src/clients/external-session-registrar.ts"],"names":[],"mappings":"AAQA,mFAAmF;AACnF,MAAM,OAAO,wBAAwB;IAIZ;IACA;IACA;IALJ,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAA;IAEpE,YACqB,QAAuD,EACvD,QAAgB,EAChB,SAAiE;QAFjE,aAAQ,GAAR,QAAQ,CAA+C;QACvD,aAAQ,GAAR,QAAQ,CAAQ;QAChB,cAAS,GAAT,SAAS,CAAwD;IACnF,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,eAAuB,EAAE,UAAkB;QACtD,MAAM,GAAG,GAAG,GAAG,eAAe,IAAI,UAAU,EAAE,CAAA;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE7B,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ;aAC7B,kBAAkB,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;aAC9D,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aAChB,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACtB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;YACxD,OAAO,KAAK,CAAA;QAChB,CAAC,CAAC,CAAA;QACN,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QACzC,OAAO,YAAY,CAAA;IACvB,CAAC;CACJ"}

package/dist/clients/ops/agent-authorization-ops.client.d.ts

@@ -0,0 +1,29 @@
+import type { CapabilitySource } from '@beacon-build/core';
+import type { OpsApiClient } from '../../transport/ops-api-client.js';
+/**
+ * T229/AC-4 — the SDK-side calls to `services/api/src/routes/ops-agent-authorization.ts`
+ * (`/v1/ops/agent-authorization/*`). Kept as its own client (not folded into `AgentsOpsClient`,
+ * loc-guard, and thematically a different domain — agent-controller/project-access, not
+ * agents/sessions) — consumed by `mcp/beacon`'s new caller-identity adapter.
+ */
+export declare class AgentAuthorizationOpsClient {
+    private readonly api;
+    constructor(api: OpsApiClient);
+    /** AC-4(b/c): isBound + getCapabilitySources in ONE round trip — the two `AuthorizeAgentDeps`
+     *  reads `mayTriggerAgent` (`@beacon-build/core`) needs (F473 replaced `getProjectRole` with
+     *  `getCapabilitySources`). Fails open (empty defaults) on a transport error — the caller's
+     *  adapter treats that identically to an unknown human (AC-4's "a network/HTTP failure...
+     *  fails open" clause), never breaks the underlying GitHub/ops call. */
+    checkTrigger(agentId: string, humanActorId: string, project: string): Promise<{
+        bound: boolean;
+        capabilitySources: CapabilitySource[];
+    }>;
+    /** F451/AC-1a reverse lookup, now HTTP-reachable for a no-direct-DB-access caller (T229/
+     *  AC-3). `null` covers both "no project claims this repo" and "ambiguous" — resolved
+     *  server-side, never guessed. */
+    findProjectByRepo(repoFullName: string): Promise<{
+        slug: string;
+        kind: 'method' | 'code';
+    } | null>;
+}
+//# sourceMappingURL=agent-authorization-ops.client.d.ts.map

package/dist/clients/ops/agent-authorization-ops.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-authorization-ops.client.d.ts","sourceRoot":"","sources":["../../../src/clients/ops/agent-authorization-ops.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAErE;;;;;GAKG;AACH,qBAAa,2BAA2B;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,YAAY;IAE9C;;;;4EAIwE;IAClE,YAAY,CACd,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAUrE;;sCAEkC;IAC5B,iBAAiB,CACnB,YAAY,EAAE,MAAM,GACrB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAU/D"}

package/dist/clients/ops/agent-authorization-ops.client.js

@@ -0,0 +1,34 @@
+/**
+ * T229/AC-4 — the SDK-side calls to `services/api/src/routes/ops-agent-authorization.ts`
+ * (`/v1/ops/agent-authorization/*`). Kept as its own client (not folded into `AgentsOpsClient`,
+ * loc-guard, and thematically a different domain — agent-controller/project-access, not
+ * agents/sessions) — consumed by `mcp/beacon`'s new caller-identity adapter.
+ */
+export class AgentAuthorizationOpsClient {
+    api;
+    constructor(api) {
+        this.api = api;
+    }
+    /** AC-4(b/c): isBound + getCapabilitySources in ONE round trip — the two `AuthorizeAgentDeps`
+     *  reads `mayTriggerAgent` (`@beacon-build/core`) needs (F473 replaced `getProjectRole` with
+     *  `getCapabilitySources`). Fails open (empty defaults) on a transport error — the caller's
+     *  adapter treats that identically to an unknown human (AC-4's "a network/HTTP failure...
+     *  fails open" clause), never breaks the underlying GitHub/ops call. */
+    async checkTrigger(agentId, humanActorId, project) {
+        const params = new URLSearchParams({ agentId, humanActorId, project });
+        const res = await this.api
+            .get(`/api/v1/ops/agent-authorization/trigger-check?${params.toString()}`)
+            .catch(() => null);
+        return res?.data ?? { bound: false, capabilitySources: [] };
+    }
+    /** F451/AC-1a reverse lookup, now HTTP-reachable for a no-direct-DB-access caller (T229/
+     *  AC-3). `null` covers both "no project claims this repo" and "ambiguous" — resolved
+     *  server-side, never guessed. */
+    async findProjectByRepo(repoFullName) {
+        const res = await this.api
+            .get(`/api/v1/ops/agent-authorization/project-by-repo?repoFullName=${encodeURIComponent(repoFullName)}`)
+            .catch(() => null);
+        return res?.data ?? null;
+    }
+}
+//# sourceMappingURL=agent-authorization-ops.client.js.map

package/dist/clients/ops/agent-authorization-ops.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-authorization-ops.client.js","sourceRoot":"","sources":["../../../src/clients/ops/agent-authorization-ops.client.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IACP;IAA7B,YAA6B,GAAiB;QAAjB,QAAG,GAAH,GAAG,CAAc;IAAG,CAAC;IAElD;;;;4EAIwE;IACxE,KAAK,CAAC,YAAY,CACd,OAAe,EACf,YAAoB,EACpB,OAAe;QAEf,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAA;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG;aACrB,GAAG,CAED,iDAAiD,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;aACvE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACtB,OAAO,GAAG,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAA;IAC/D,CAAC;IAED;;sCAEkC;IAClC,KAAK,CAAC,iBAAiB,CACnB,YAAoB;QAEpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG;aACrB,GAAG,CAGA,gEAAgE,kBAAkB,CAAC,YAAY,CAAC,EAAE,CACrG;aACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACtB,OAAO,GAAG,EAAE,IAAI,IAAI,IAAI,CAAA;IAC5B,CAAC;CACJ"}

package/dist/clients/ops/agents-affinity-ops.client.d.ts

@@ -0,0 +1,27 @@
+/**
+ * agents-affinity-ops.client.ts — loc-guard extraction from `agents-ops.client.ts` (mirrors
+ * `agents-stats-ops.client.ts`/`agents-mint-ops.client.ts`'s free-function-over-`OpsApiClient`
+ * shape): the two identity-resolution lookups `AgentsOpsClient.resolveAffinity`/
+ * `resolveSpawnCredential` delegate to.
+ *
+ * B300: `resolveAffinity` sends no `cwd` — the server never read it.
+ * B753: `resolveSpawnCredential` resolves a delegated call's own `spawn_credential` DIRECTLY
+ * to its issuing agent, non-consuming — `identity-resolve.ts`'s `resolveIdentity` tries this
+ * BEFORE `resolveAffinity`'s project-scoped guessing chain, whenever a credential is present.
+ *
+ * B753/C600: both responses are the standard `{ data }` envelope (CON-25) — `resolve-affinity`'s
+ * bare response lost its baseline grandfathering when `sessions/affinity.ts` was touched for
+ * B753's new sibling route; unwrapped here to keep each method's own return shape unchanged.
+ */
+import type { OpsApiClient } from '../../transport/ops-api-client.js';
+export interface AffinityResult {
+    agentId: string;
+    alias: string;
+    method: string;
+}
+export declare function resolveAffinity(api: OpsApiClient, project: string): Promise<AffinityResult | null>;
+export declare function resolveSpawnCredential(api: OpsApiClient, token: string, project: string): Promise<{
+    agentId: string;
+    alias: string;
+} | null>;
+//# sourceMappingURL=agents-affinity-ops.client.d.ts.map

package/dist/clients/ops/agents-affinity-ops.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents-affinity-ops.client.d.ts","sourceRoot":"","sources":["../../../src/clients/ops/agents-affinity-ops.client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAErE,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACjB;AAGD,wBAAsB,eAAe,CACjC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAKhC;AAED,wBAAsB,sBAAsB,CACxC,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAQpD"}

package/dist/clients/ops/agents-affinity-ops.client.js

@@ -0,0 +1,14 @@
+// C566: POST /api/v1/sessions/resolve-affinity (was /api/v1/agents/resolve-affinity).
+export async function resolveAffinity(api, project) {
+    return api
+        .post('/api/v1/sessions/resolve-affinity', { project })
+        .then((res) => res?.data ?? null)
+        .catch(() => null);
+}
+export async function resolveSpawnCredential(api, token, project) {
+    return api
+        .post('/api/v1/sessions/resolve-spawn-credential', { token, project })
+        .then((res) => res?.data ?? null)
+        .catch(() => null);
+}
+//# sourceMappingURL=agents-affinity-ops.client.js.map

package/dist/clients/ops/agents-affinity-ops.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents-affinity-ops.client.js","sourceRoot":"","sources":["../../../src/clients/ops/agents-affinity-ops.client.ts"],"names":[],"mappings":"AAuBA,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,GAAiB,EACjB,OAAe;IAEf,OAAO,GAAG;SACL,IAAI,CAA2B,mCAAmC,EAAE,EAAE,OAAO,EAAE,CAAC;SAChF,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC;SAChC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,GAAiB,EACjB,KAAa,EACb,OAAe;IAEf,OAAO,GAAG;SACL,IAAI,CACD,2CAA2C,EAC3C,EAAE,KAAK,EAAE,OAAO,EAAE,CACrB;SACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC;SAChC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC"}

package/dist/clients/ops/agents-mint-ops.client.d.ts

@@ -0,0 +1,34 @@
+import type { OpsApiClient } from '../../transport/ops-api-client.js';
+/**
+ * Replaces the inline `resolveAgentAndGenerateJwt` duplicated in janitor and sidecar. THROWS
+ * if the agent is not found or the mint fails — callers surface the error.
+ *
+ * Deliberately does NOT go through `byAlias()` — that method swallows every failure (network,
+ * 5xx, 404 alike) into `null`, which would make a transient resolve failure here
+ * indistinguishable from a genuine "no such agent" and misreport it as "not found". This does
+ * its own GET and only degrades a real `not_found` into the friendly not-found message; any
+ * other failure (network/5xx/etc.) propagates as-is so the caller can tell them apart.
+ */
+export declare function resolveSystemAgentAndMintToken(api: OpsApiClient, issueSystemToken: (agentId: string, project: string) => Promise<{
+    token: string;
+    expiresAt: string;
+    seat?: string;
+}>, alias: string, project: string): Promise<{
+    agentId: string;
+    token: string;
+    expiresAt: string;
+}>;
+/**
+ * B793: mints a token for `project`'s `config.main` agent — the ops-authority mint mode
+ * (`opsProject` claim). Replaces the by-role roster-discovery two-step
+ * (`list()` + `resolveSystemAgentAndMintToken`) the probe used to need: the server resolves
+ * the main agent itself (Agent-Service layer, AC-7), so this is a single POST, no discovery
+ * round-trip. NO fallback to `resolveSystemAgentAndMintToken` — a project without a
+ * config.main agent must fail loud (see `agent-token`'s `NoMainAgentConfiguredError` mapping),
+ * never silently retry a different identity.
+ */
+export declare function issueMainAgentToken(api: OpsApiClient, project: string): Promise<{
+    token: string;
+    expiresAt: string;
+}>;
+//# sourceMappingURL=agents-mint-ops.client.d.ts.map

package/dist/clients/ops/agents-mint-ops.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents-mint-ops.client.d.ts","sourceRoot":"","sources":["../../../src/clients/ops/agents-mint-ops.client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAGrE;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAChD,GAAG,EAAE,YAAY,EACjB,gBAAgB,EAAE,CACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,KACd,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACjE,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBhE;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACrC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAW/C"}

package/dist/clients/ops/agents-mint-ops.client.js

@@ -0,0 +1,55 @@
+import { SdkError } from '../../transport/errors.js';
+/**
+ * Replaces the inline `resolveAgentAndGenerateJwt` duplicated in janitor and sidecar. THROWS
+ * if the agent is not found or the mint fails — callers surface the error.
+ *
+ * Deliberately does NOT go through `byAlias()` — that method swallows every failure (network,
+ * 5xx, 404 alike) into `null`, which would make a transient resolve failure here
+ * indistinguishable from a genuine "no such agent" and misreport it as "not found". This does
+ * its own GET and only degrades a real `not_found` into the friendly not-found message; any
+ * other failure (network/5xx/etc.) propagates as-is so the caller can tell them apart.
+ */
+export async function resolveSystemAgentAndMintToken(api, issueSystemToken, alias, project) {
+    const params = new URLSearchParams({ alias, project });
+    let agent;
+    try {
+        // C606/CON-25: `{ data }` envelope (see `byAlias`). Argus mint boundary — a silent
+        // `undefined` here fails the process at boot, so keep the unwrap explicit.
+        const res = await api.get(`/api/v1/agents/by-alias?${params.toString()}`);
+        agent = res?.data ?? null;
+    }
+    catch (err) {
+        if (err instanceof SdkError && err.code === 'not_found') {
+            agent = null;
+        }
+        else {
+            throw err;
+        }
+    }
+    if (!agent?.id) {
+        throw new Error(`System agent ${project}/${alias} not found`);
+    }
+    const { token, expiresAt } = await issueSystemToken(agent.id, project);
+    return { agentId: agent.id, token, expiresAt };
+}
+/**
+ * B793: mints a token for `project`'s `config.main` agent — the ops-authority mint mode
+ * (`opsProject` claim). Replaces the by-role roster-discovery two-step
+ * (`list()` + `resolveSystemAgentAndMintToken`) the probe used to need: the server resolves
+ * the main agent itself (Agent-Service layer, AC-7), so this is a single POST, no discovery
+ * round-trip. NO fallback to `resolveSystemAgentAndMintToken` — a project without a
+ * config.main agent must fail loud (see `agent-token`'s `NoMainAgentConfiguredError` mapping),
+ * never silently retry a different identity.
+ */
+export async function issueMainAgentToken(api, project) {
+    try {
+        return await api.post('/api/v1/agent-token', {
+            mainAgent: true,
+            project,
+        });
+    }
+    catch (err) {
+        throw new Error(`main-agent token issuance failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=agents-mint-ops.client.js.map

package/dist/clients/ops/agents-mint-ops.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents-mint-ops.client.js","sourceRoot":"","sources":["../../../src/clients/ops/agents-mint-ops.client.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAEpD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAChD,GAAiB,EACjB,gBAGiE,EACjE,KAAa,EACb,OAAe;IAEf,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,KAA6B,CAAA;IACjC,IAAI,CAAC;QACD,mFAAmF;QACnF,2EAA2E;QAC3E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CACrB,2BAA2B,MAAM,CAAC,QAAQ,EAAE,EAAE,CACjD,CAAA;QACD,KAAK,GAAG,GAAG,EAAE,IAAI,IAAI,IAAI,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACtD,KAAK,GAAG,IAAI,CAAA;QAChB,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,CAAA;QACb,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,IAAI,KAAK,YAAY,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACtE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,GAAiB,EACjB,OAAe;IAEf,IAAI,CAAC;QACD,OAAO,MAAM,GAAG,CAAC,IAAI,CAAuC,qBAAqB,EAAE;YAC/E,SAAS,EAAE,IAAI;YACf,OAAO;SACV,CAAC,CAAA;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACX,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAA;IACL,CAAC;AACL,CAAC"}

package/dist/clients/ops/agents-ops.client.d.ts

@@ -0,0 +1,120 @@
+import type { AgentDto, AgentSummaryDto, ActiveAgentSessionDto } from '@beacon-build/core';
+import type { OpsApiClient } from '../../transport/ops-api-client.js';
+import * as statsOps from './agents-stats-ops.client.js';
+import * as affinityOps from './agents-affinity-ops.client.js';
+export type { AffinityResult } from './agents-affinity-ops.client.js';
+export interface AgentIdentityFields {
+    character?: string;
+    instructions?: string;
+    defaultModel?: string;
+}
+export declare class AgentsOpsClient {
+    private readonly api;
+    constructor(api: OpsApiClient);
+    list(project?: string): Promise<AgentDto[]>;
+    get(agentId: string): Promise<AgentDto | null>;
+    getById(agentId: string): Promise<AgentDto | null>;
+    byAlias(alias: string, project?: string): Promise<AgentSummaryDto | null>;
+    create(alias: string, project: string): Promise<AgentSummaryDto>;
+    upsert(alias: string, project: string): Promise<AgentSummaryDto>;
+    listActive(): Promise<AgentSummaryDto[]>;
+    /**
+     * F320: one row per ACTIVE session (env/client/cwd) — GET /sessions/active-sessions.
+     * THROWS on transport/API error (does not swallow) so callers can distinguish a real
+     * failure from "no active sessions" — e.g. agent_status's best-effort fallback to the
+     * per-agent list (INV-F320-3) only fires when this rejects.
+     * C566: path moved from /agents/active-sessions.
+     */
+    listActiveSessions(): Promise<ActiveAgentSessionDto[]>;
+    listAliasesByProject(project: string): Promise<string[]>;
+    /** B300/C566: see `agents-affinity-ops.client.ts` (loc-guard extraction) for the doc comment. */
+    resolveAffinity(project: string): ReturnType<typeof affinityOps.resolveAffinity>;
+    /** B753: see `agents-affinity-ops.client.ts` (loc-guard extraction) for the doc comment. */
+    resolveSpawnCredential(token: string, project: string): ReturnType<typeof affinityOps.resolveSpawnCredential>;
+    rename(agentId: string, alias: string): Promise<void>;
+    updateIdentity(agentId: string, fields: AgentIdentityFields): Promise<void>;
+    configSet(agentId: string, key: string, value: unknown): Promise<void>;
+    configGetAll(agentId: string): Promise<Record<string, unknown>>;
+    configDelete(agentId: string, key: string): Promise<void>;
+    getActiveSession(agentId: string): Promise<{
+        sessionId: string;
+        sessionKey: string;
+    } | null>;
+    /**
+     * Resolve the active session for an agent (GET /api/v1/sessions/active-session, C566:
+     * was /api/v1/agents/active-session).
+     *
+     * F328/AC-1/AC-4: when `opts.claudeSessionId` (CLAUDE_CODE_SESSION_ID) is given, the
+     * endpoint resolves via the F216 external-id map FIRST (`externalSessionIds.claude`),
+     * independent of cwd and robust to one agent owning multiple sessions. `opts.cwd`
+     * stays a back-compat fallback (worktree affinity). Returns the session's denormalized
+     * env/client (F322) so the capture pipeline can stamp them onto conversation rows.
+     */
+    activeSession(alias: string, project: string, opts?: {
+        cwd?: string;
+        claudeSessionId?: string;
+    }): Promise<{
+        agentId: string;
+        sessionId: string;
+        env?: 'local' | 'cloud' | null;
+        client?: 'claude' | 'opencode' | 'antigravity' | null;
+    } | null>;
+    /**
+     * Issue a scoped agent JWT (POST /api/v1/agent-token).
+     *
+     * B177: previously this swallowed every failure with `catch { return null }`, so a
+     * transient hiccup left the session with no agent token while session_start still
+     * reported success — the agent-JWT path (messaging/search) was then silently dead.
+     * Now: surface the failure. Transient 5xx/429/network are already retried by
+     * `OpsApiClient.executeWithRetry` (we deliberately do NOT add a second retry layer);
+     * on persistent failure we THROW with the underlying reason so the caller surfaces it
+     * instead of degrading invisibly to a token-less session.
+     * B384: `seatCtx` (cwd + optional client/env) lets the mint authority derive a signed
+     * `seat` claim SERVER-SIDE (`deriveSeat`) — omit it for a project-only token (unchanged
+     * pre-B384 behaviour). The returned `seat` (when present) is the SAME value embedded in
+     * `token`'s claim, echoed back for the caller's convenience only.
+     *
+     * T183/Goal 9/AC-14: `sessionId` is now REQUIRED and is the SOLE identity carried on the
+     * wire — the server reads `agentId`/`project`/`session_kind` off the referenced, active
+     * session row, never trusts a client-asserted `agentId` field (INV-T183-7). `agentId`
+     * stays a parameter here purely so call sites keep a familiar, self-documenting signature
+     * (and can log/assert against it) — it is deliberately NEVER put on the wire. `project` is
+     * still sent as an optional cross-check the server validates against the session row.
+     */
+    issueToken(agentId: string, project: string, sessionId: string, seatCtx?: {
+        cwd?: string;
+        client?: 'claude' | 'opencode' | 'antigravity';
+        env?: 'local' | 'cloud';
+    }): Promise<{
+        token: string;
+        expiresAt: string;
+        seat?: string;
+    }>;
+    /**
+     * T183/Goal 9/INV-T183-8: the ONE exception to the sessionId-required rule above — mints
+     * a token for a `system`-role agent with NO session (the one real production caller,
+     * `services/janitor/src/alerts/index.ts`'s headless Argus daemon, F2). `project` optional
+     * (Goal 6, org-scoped system agents).
+     */
+    issueSystemToken(agentId: string, project?: string): Promise<{
+        token: string;
+        expiresAt: string;
+        seat?: string;
+    }>;
+    /** B452: see `agents-mint-ops.client.ts` (loc-guard extraction) for the doc comment. */
+    resolveSystemAgentAndMintToken(alias: string, project: string): Promise<{
+        agentId: string;
+        token: string;
+        expiresAt: string;
+    }>;
+    /** B793: see `agents-mint-ops.client.ts` (loc-guard extraction) for the doc comment. */
+    issueMainAgentToken(project: string): Promise<{
+        token: string;
+        expiresAt: string;
+    }>;
+    /** @deprecated Use ops.projects.upsert() instead */
+    upsertProject(slug: string): Promise<void>;
+    /** T266: see `agents-stats-ops.client.ts` (loc-guard extraction) for the doc comment. */
+    stats(agentId: string): ReturnType<typeof statsOps.stats>;
+}
+//# sourceMappingURL=agents-ops.client.d.ts.map

package/dist/clients/ops/agents-ops.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents-ops.client.d.ts","sourceRoot":"","sources":["../../../src/clients/ops/agents-ops.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAErE,OAAO,KAAK,QAAQ,MAAM,8BAA8B,CAAA;AAExD,OAAO,KAAK,WAAW,MAAM,iCAAiC,CAAA;AAE9D,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAIrE,MAAM,WAAW,mBAAmB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,qBAAa,eAAe;IACZ,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,YAAY;IAExC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAO3C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAc9C,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAIlD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAWzE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAKhE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAKhE,UAAU,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAQ9C;;;;;;OAMG;IACG,kBAAkB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAOtD,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK9D,iGAAiG;IAC3F,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,eAAe,CAAC;IAItF,4FAA4F;IACtF,sBAAsB,CACxB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAChB,UAAU,CAAC,OAAO,WAAW,CAAC,sBAAsB,CAAC;IAIlD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrD,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3E,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAM/D,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzD,gBAAgB,CAClB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAc5D;;;;;;;;;OASG;IACG,aAAa,CACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAClD,OAAO,CAAC;QACP,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,MAAM,CAAA;QACjB,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAAA;QAC9B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,IAAI,CAAA;KACxD,GAAG,IAAI,CAAC;IAqBT;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,UAAU,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QACN,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAA;QAC9C,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;KAC1B,GACF,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAoB/D;;;;;OAKG;IACG,gBAAgB,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB/D,wFAAwF;IAClF,8BAA8B,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IASjE,wFAAwF;IAClF,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAIzF,oDAAoD;IAC9C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhD,yFAAyF;IACnF,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,KAAK,CAAC;CAGlE"}