feat(cloud): enforce host governance budgets

cloud-console/src/api.ts

@@ -1,6 +1,8 @@
 import type {
   CloudUser,
   DeviceRecord,
+  HostGovernancePolicy,
+  HostTokenUsageSummary,
   HostRecord,
   PluginRecord,
   PluginRegistrationPayload,
@@ -8,6 +10,8 @@ import type {
   TaskListResponse,
   TaskSubmissionPayload,
   TaskStatus,
+  UserListResponse,
+  UserSubmissionPolicy,
 } from "./types";
 
 const configuredBaseUrl = import.meta.env.VITE_CLOUD_API_BASE_URL as
@@ -119,6 +123,87 @@ export function changePassword(
   });
 }
 
+export function listUsers(): Promise<UserListResponse> {
+  return request<UserListResponse>("/v1/users?limit=100&offset=0");
+}
+
+export function createUser(payload: {
+  username: string;
+  display_name: string;
+  role: "viewer" | "operator" | "admin";
+  password: string;
+}): Promise<CloudUser> {
+  return request<CloudUser>("/v1/users", {
+    method: "POST",
+    body: JSON.stringify(payload),
+  });
+}
+
+export function updateUser(
+  userId: string,
+  payload: { display_name?: string; role?: "viewer" | "operator" | "admin"; enabled?: boolean },
+): Promise<CloudUser> {
+  return request<CloudUser>(`/v1/users/${encodeURIComponent(userId)}`, {
+    method: "PATCH",
+    body: JSON.stringify(payload),
+  });
+}
+
+export function resetUserPassword(userId: string, password: string): Promise<CloudUser> {
+  return request<CloudUser>(`/v1/users/${encodeURIComponent(userId)}/password`, {
+    method: "POST",
+    body: JSON.stringify({ password }),
+  });
+}
+
+export function revokeUserSessions(userId: string): Promise<void> {
+  return request<void>(`/v1/users/${encodeURIComponent(userId)}/sessions`, {
+    method: "DELETE",
+  });
+}
+
+export function getUserSubmissionPolicy(userId: string): Promise<UserSubmissionPolicy> {
+  return request<UserSubmissionPolicy>(
+    `/v1/users/${encodeURIComponent(userId)}/submission-policy`,
+  );
+}
+
+export function updateUserSubmissionPolicy(
+  userId: string,
+  payload: Omit<UserSubmissionPolicy, "user_id" | "revision" | "updated_at"> & {
+    expected_revision?: number;
+  },
+): Promise<UserSubmissionPolicy> {
+  return request<UserSubmissionPolicy>(
+    `/v1/users/${encodeURIComponent(userId)}/submission-policy`,
+    { method: "PUT", body: JSON.stringify(payload) },
+  );
+}
+
+export function getHostGovernancePolicy(hostId: string): Promise<HostGovernancePolicy> {
+  return request<HostGovernancePolicy>(
+    `/v1/hosts/${encodeURIComponent(hostId)}/governance-policy`,
+  );
+}
+
+export function updateHostGovernancePolicy(
+  hostId: string,
+  payload: Omit<HostGovernancePolicy, "host_id" | "revision" | "updated_at"> & {
+    expected_revision?: number;
+  },
+): Promise<HostGovernancePolicy> {
+  return request<HostGovernancePolicy>(
+    `/v1/hosts/${encodeURIComponent(hostId)}/governance-policy`,
+    { method: "PUT", body: JSON.stringify(payload) },
+  );
+}
+
+export function getHostTokenUsage(hostId: string): Promise<HostTokenUsageSummary> {
+  return request<HostTokenUsageSummary>(
+    `/v1/hosts/${encodeURIComponent(hostId)}/token-usage`,
+  );
+}
+
 export function listTasks(options?: {
   status?: TaskStatus;
   limit?: number;