@1claw/mcp 0.61.0 → 0.63.0

package/dist/client/core.js

@@ -0,0 +1,281 @@
+import { DPoPManager } from "../auth/dpop.js";
+import { OneClawApiError } from "./error.js";
+export { OneClawApiError };
+export function encodePath(path) {
+    return path
+        .split("/")
+        .map((s) => encodeURIComponent(s))
+        .join("/");
+}
+/**
+ * Best-effort extraction of the agent UUID from a 1Claw agent JWT's `sub`
+ * claim (`"agent:<uuid>"`). Used in static-token mode (legacy
+ * `ONECLAW_AGENT_TOKEN`) so agent-scoped tools (transactions, signing,
+ * bindings/execute) can resolve their agent id without a key exchange.
+ * The signature is NOT verified here — the server validates every JWT; we
+ * only read the claim to know which `/v1/agents/{id}` path to call. Returns
+ * `undefined` for non-agent tokens (e.g. user JWTs) or unparseable input.
+ */
+function decodeJwtPayload(token) {
+    try {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return undefined;
+        const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const padded = payload.padEnd(payload.length + ((4 - (payload.length % 4)) % 4), "=");
+        const json = Buffer.from(padded, "base64").toString("utf8");
+        const parsed = JSON.parse(json);
+        return typeof parsed === "object" && parsed !== null
+            ? parsed
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function agentIdFromJwt(token) {
+    const payload = decodeJwtPayload(token);
+    const sub = payload?.sub;
+    if (typeof sub === "string" && sub.startsWith("agent:")) {
+        return sub.slice("agent:".length);
+    }
+    return undefined;
+}
+function runtimeIdFromJwt(token) {
+    const payload = decodeJwtPayload(token);
+    const runtimeId = payload?.runtime_id;
+    return typeof runtimeId === "string" && runtimeId.length > 0
+        ? runtimeId
+        : undefined;
+}
+const REFRESH_BUFFER_MS = 60_000;
+/**
+ * Auth, token exchange and the request primitive. Every domain API class
+ * extends this and is mixed into `OneClawClient` (see ./index.ts).
+ */
+export class ClientCore {
+    baseUrl;
+    token;
+    _vaultId;
+    _resolvedAgentId;
+    _runtimeId;
+    agentCredentials;
+    tokenExpiresAt = 0;
+    _entitlements;
+    dpopManager;
+    dpopReady = null;
+    constructor(config) {
+        this.baseUrl = config.baseUrl.replace(/\/$/, "");
+        this._vaultId = config.vaultId ?? "";
+        if (process.env.ONECLAW_DPOP === "true") {
+            this.dpopManager = new DPoPManager();
+        }
+        if ("apiKey" in config && !("token" in config)) {
+            this.agentCredentials = {
+                agentId: config.agentId,
+                apiKey: config.apiKey,
+            };
+            this.token = "";
+            this._runtimeId =
+                config.runtimeId || process.env.ONECLAW_RUNTIME_ID || undefined;
+        }
+        else {
+            this.token = config.token;
+            // Static-token (legacy ONECLAW_AGENT_TOKEN) mode: resolve the agent
+            // id from the JWT sub claim so agent-scoped tools work without a key
+            // exchange.
+            this._resolvedAgentId = agentIdFromJwt(this.token);
+            this._runtimeId =
+                config.runtimeId ||
+                    runtimeIdFromJwt(this.token) ||
+                    process.env.ONECLAW_RUNTIME_ID ||
+                    undefined;
+        }
+    }
+    /**
+     * Drops the in-memory JWT so the next request re-exchanges the API key.
+     * Used after 401 (revoked) or 403 stale scopes; also safe to call after
+     * dashboard policy changes if you need a fresh token immediately.
+     */
+    invalidateCachedAgentToken() {
+        if (!this.agentCredentials)
+            return;
+        this.token = "";
+        this.tokenExpiresAt = 0;
+    }
+    async ensureDPoP() {
+        if (!this.dpopManager)
+            return;
+        if (!this.dpopReady) {
+            this.dpopReady = this.dpopManager.init();
+        }
+        await this.dpopReady;
+    }
+    async ensureToken() {
+        if (!this.agentCredentials)
+            return;
+        if (this.token && Date.now() < this.tokenExpiresAt - REFRESH_BUFFER_MS)
+            return;
+        await this.ensureDPoP();
+        const body = {
+            api_key: this.agentCredentials.apiKey,
+        };
+        if (this.agentCredentials.agentId) {
+            body.agent_id = this.agentCredentials.agentId;
+        }
+        if (this.dpopManager) {
+            body.dpop_jwk = this.dpopManager.getPublicJwk();
+        }
+        const tokenUrl = `${this.baseUrl}/v1/auth/agent-token`;
+        const tokenHeaders = {
+            "Content-Type": "application/json",
+        };
+        if (this.dpopManager) {
+            tokenHeaders["DPoP"] = await this.dpopManager.generateProof("POST", tokenUrl);
+        }
+        const res = await fetch(tokenUrl, {
+            method: "POST",
+            headers: tokenHeaders,
+            body: JSON.stringify(body),
+        });
+        if (!res.ok) {
+            let detail = `HTTP ${res.status}`;
+            try {
+                const errBody = (await res.json());
+                if (errBody.detail)
+                    detail = errBody.detail;
+            }
+            catch {
+                /* use default */
+            }
+            throw new OneClawApiError(res.status, `Agent auth failed: ${detail}`);
+        }
+        const data = (await res.json());
+        this.token = data.access_token;
+        this.tokenExpiresAt = Date.now() + data.expires_in * 1000;
+        this._entitlements = data.entitlements;
+        if (data.agent_id) {
+            this._resolvedAgentId = data.agent_id;
+            if (this.agentCredentials && !this.agentCredentials.agentId) {
+                this.agentCredentials.agentId = data.agent_id;
+            }
+        }
+        if (!this._vaultId && data.vault_ids && data.vault_ids.length === 1) {
+            this._vaultId = data.vault_ids[0];
+        }
+    }
+    async autoDiscoverVault() {
+        // Inline rather than the listVaults method: that method lives in the
+        // secrets domain, and core must not depend on a domain.
+        const vaults = await this.request(`${this.baseUrl}/v1/vaults`);
+        if (!vaults.vaults || vaults.vaults.length === 0) {
+            return;
+        }
+        const preferred = vaults.vaults.find((v) => v.name === "default");
+        this._vaultId = preferred?.id ?? vaults.vaults[0].id;
+    }
+    async headers(method = "GET", url) {
+        await this.ensureToken();
+        const hdrs = {
+            Authorization: `Bearer ${this.token}`,
+            "Content-Type": "application/json",
+        };
+        const runtimeId = this._runtimeId || process.env.ONECLAW_RUNTIME_ID;
+        if (runtimeId) {
+            hdrs["X-1Claw-Runtime-Id"] = runtimeId;
+        }
+        if (this.dpopManager && url) {
+            hdrs["DPoP"] = await this.dpopManager.generateProof(method, url);
+        }
+        return hdrs;
+    }
+    async resolveVaultUrl(suffix = "") {
+        if (!this._vaultId) {
+            await this.autoDiscoverVault();
+        }
+        if (!this._vaultId) {
+            throw new OneClawApiError(400, "No vault configured. Set ONECLAW_VAULT_ID, bind the agent to a vault, or create a vault first.");
+        }
+        return `${this.baseUrl}/v1/vaults/${this._vaultId}${suffix}`;
+    }
+    /** True when a fresh JWT from /v1/auth/agent-token should fix the error (stale cache). */
+    shouldReexchangeAgentToken(status, detail) {
+        if (!this.agentCredentials)
+            return false;
+        if (status === 401)
+            return true;
+        if (status !== 403)
+            return false;
+        const d = detail.toLowerCase();
+        return (d.includes("no scopes") ||
+            d.includes("scopes do not cover") ||
+            d.includes("token has been revoked"));
+    }
+    async request(url, init, isRetry = false) {
+        const method = init?.method ?? "GET";
+        const hdrs = await this.headers(method, url);
+        const res = await fetch(url, {
+            ...init,
+            headers: { ...hdrs, ...init?.headers },
+        });
+        if (!res.ok) {
+            let detail = `HTTP ${res.status}`;
+            let errorType = "";
+            try {
+                const body = (await res.json());
+                if (body.detail)
+                    detail = body.detail;
+                if (body.type)
+                    errorType = body.type;
+            }
+            catch {
+                // use default detail
+            }
+            if (res.status === 402) {
+                throw new OneClawApiError(402, "Quota exhausted. Ask your human to upgrade the plan, add prepaid credits, or enable x402 micropayments at https://1claw.co/settings/billing");
+            }
+            if (res.status === 403 &&
+                errorType === "resource_limit_exceeded") {
+                throw new OneClawApiError(403, `Resource limit reached: ${detail}. Ask your human to upgrade the plan at https://1claw.co/settings/billing`);
+            }
+            if (!isRetry &&
+                this.shouldReexchangeAgentToken(res.status, detail)) {
+                this.invalidateCachedAgentToken();
+                return this.request(url, init, true);
+            }
+            throw new OneClawApiError(res.status, detail);
+        }
+        if (res.status === 204)
+            return undefined;
+        return res.json();
+    }
+    get agentId() {
+        return this._resolvedAgentId ?? this.agentCredentials?.agentId;
+    }
+    /**
+     * Decoded (not verified — the vault verifies) claims of the JWT this
+     * client is presenting. Performs the API-key exchange first if needed,
+     * so a fresh client can answer. Used to derive session entitlements.
+     */
+    async tokenClaims() {
+        await this.ensureToken();
+        return decodeJwtPayload(this.token);
+    }
+    /**
+     * Entitlements the vault returned with the last key exchange, if it is
+     * new enough to send them. Undefined on the static-token path and
+     * against older vaults — callers then fall back to the profile GET.
+     */
+    async tokenEntitlements() {
+        await this.ensureToken();
+        return this._entitlements;
+    }
+    /** `GET /v1/agents/{id}` — the agent's own profile, including its feature flags. */
+    async getAgent(agentId) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}`);
+    }
+    get vaultId() {
+        return this._vaultId;
+    }
+}
+//# sourceMappingURL=core.js.map

package/dist/client/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/client/core.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,CAAC;AAuD3B,MAAM,UAAU,UAAU,CAAC,IAAY;IACnC,OAAO,IAAI;SACN,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;SACjC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACnC,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CACzB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EACjD,GAAG,CACN,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAChD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,SAAS,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,OAAO,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,CAAC;IACtC,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QACxD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC;AAED,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;GAGG;AACH,MAAM,OAAO,UAAU;IACT,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,gBAAgB,CAAU;IAC1B,UAAU,CAAU;IAEpB,gBAAgB,CAAwC;IACxD,cAAc,GAAG,CAAC,CAAC;IACnB,aAAa,CAA6B;IAC1C,WAAW,CAAe;IAC1B,SAAS,GAAyB,IAAI,CAAC;IAEjD,YAAY,MAAuC;QAC/C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAErC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,QAAQ,IAAI,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,gBAAgB,GAAG;gBACpB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;aACxB,CAAC;YACF,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU;gBACX,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAC;QACxE,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,KAAK,GAAI,MAAuB,CAAC,KAAK,CAAC;YAC5C,oEAAoE;YACpE,qEAAqE;YACrE,YAAY;YACZ,IAAI,CAAC,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU;gBACV,MAAuB,CAAC,SAAS;oBAClC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;oBAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBAC9B,SAAS,CAAC;QAClB,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,0BAA0B;QACtB,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO;QACnC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;IAC5B,CAAC;IAES,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC;IACzB,CAAC;IAES,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO;QACnC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,iBAAiB;YAClE,OAAO;QAEX,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAExB,MAAM,IAAI,GAA4B;YAClC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM;SACxC,CAAC;QACF,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,OAAO,sBAAsB,CAAC;QACvD,MAAM,YAAY,GAA2B;YACzC,cAAc,EAAE,kBAAkB;SACrC,CAAC;QACF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CACvD,MAAM,EACN,QAAQ,CACX,CAAC;QACN,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,IAAI,MAAM,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;gBACnD,IAAI,OAAO,CAAC,MAAM;oBAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACL,iBAAiB;YACrB,CAAC;YACD,MAAM,IAAI,eAAe,CACrB,GAAG,CAAC,MAAM,EACV,sBAAsB,MAAM,EAAE,CACjC,CAAC;QACN,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QAEvC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC;YACtC,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;YAClD,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,iBAAiB;QAC7B,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAoB,GAAG,IAAI,CAAC,OAAO,YAAY,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,GAAG,SAAS,EAAE,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IAES,KAAK,CAAC,OAAO,CAAC,SAAiB,KAAK,EAAE,GAAY;QACxD,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,GAA2B;YACjC,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACrC,cAAc,EAAE,kBAAkB;SACrC,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACpE,IAAI,SAAS,EAAE,CAAC;YACZ,IAAI,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,EAAE;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CACrB,GAAG,EACH,gGAAgG,CACnG,CAAC;QACN,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,CAAC;IACjE,CAAC;IAED,0FAA0F;IAChF,0BAA0B,CAAC,MAAc,EAAE,MAAc;QAC/D,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QACzC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CACH,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACvB,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YACjC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CACvC,CAAC;IACN,CAAC;IAES,KAAK,CAAC,OAAO,CACnB,GAAW,EACX,IAAkB,EAClB,OAAO,GAAG,KAAK;QAEf,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACzB,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,GAAI,IAAI,EAAE,OAAkC,EAAE;SACrE,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,IAAI,MAAM,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;gBAChD,IAAI,IAAI,CAAC,MAAM;oBAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBACtC,IAAI,IAAI,CAAC,IAAI;oBAAE,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACL,qBAAqB;YACzB,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,eAAe,CACrB,GAAG,EACH,6IAA6I,CAChJ,CAAC;YACN,CAAC;YAED,IACI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,SAAS,KAAK,yBAAyB,EACzC,CAAC;gBACC,MAAM,IAAI,eAAe,CACrB,GAAG,EACH,2BAA2B,MAAM,2EAA2E,CAC/G,CAAC;YACN,CAAC;YAED,IACI,CAAC,OAAO;gBACR,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACrD,CAAC;gBACC,IAAI,CAAC,0BAA0B,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,OAAO,CAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;YAED,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IACpC,CAAC;IAGD,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW;QACb,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACnB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,EAAE,CACzC,CAAC;IACN,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;CAEJ"}

package/dist/client/delegation.d.ts

@@ -0,0 +1,17 @@
+import { ClientCore } from "./core.js";
+/** delegation domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export declare class DelegationApi extends ClientCore {
+    listDelegations(agentId: string): Promise<Record<string, unknown>>;
+    createDelegation(agentId: string, data: {
+        delegate_id: string;
+        allowed_tools?: string[];
+        blocked_tools?: string[];
+        max_daily_delegations?: number;
+        max_depth?: number;
+        guardrails?: Record<string, unknown>;
+        delegation_mode?: string;
+        expires_at?: string;
+    }): Promise<Record<string, unknown>>;
+    getEffectiveDelegations(agentId: string): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=delegation.d.ts.map

package/dist/client/delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.d.ts","sourceRoot":"","sources":["../../src/client/delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,mGAAmG;AACnG,qBAAa,aAAc,SAAQ,UAAU;IAGnC,eAAe,CACjB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAM7B,gBAAgB,CAClB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;QACF,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;KACvB,GACF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAU7B,uBAAuB,CACzB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAMtC"}

package/dist/client/delegation.js

@@ -0,0 +1,18 @@
+import { ClientCore } from "./core.js";
+/** delegation domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export class DelegationApi extends ClientCore {
+    // ── Agent Delegations ────────────────────────────────────────────────
+    async listDelegations(agentId) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/delegations`);
+    }
+    async createDelegation(agentId, data) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/delegations`, {
+            method: "POST",
+            body: JSON.stringify(data),
+        });
+    }
+    async getEffectiveDelegations(agentId) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/delegations/effective`);
+    }
+}
+//# sourceMappingURL=delegation.js.map

package/dist/client/delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../src/client/delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,mGAAmG;AACnG,MAAM,OAAO,aAAc,SAAQ,UAAU;IACzC,wEAAwE;IAExE,KAAK,CAAC,eAAe,CACjB,OAAe;QAEf,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,cAAc,CACrD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,gBAAgB,CAClB,OAAe,EACf,IASC;QAED,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,cAAc,EAClD;YACI,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC7B,CACJ,CAAC;IACN,CAAC;IAED,KAAK,CAAC,uBAAuB,CACzB,OAAe;QAEf,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,wBAAwB,CAC/D,CAAC;IACN,CAAC;CAEJ"}

package/dist/client/directory.d.ts

@@ -0,0 +1,18 @@
+import { ClientCore } from "./core.js";
+/** directory domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export declare class DirectoryApi extends ClientCore {
+    listDirectoryJobs(params?: {
+        tags?: string;
+        q?: string;
+        limit?: number;
+    }): Promise<Record<string, unknown>>;
+    getDirectoryJob(jobId: string): Promise<Record<string, unknown>>;
+    submitDirectoryJobBid(jobId: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
+    orgDirectory(params?: {
+        q?: string;
+        tags?: string;
+        page?: number;
+        page_size?: number;
+    }): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=directory.d.ts.map

package/dist/client/directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory.d.ts","sourceRoot":"","sources":["../../src/client/directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,kGAAkG;AAClG,qBAAa,YAAa,SAAQ,UAAU;IAGlC,iBAAiB,CACnB,MAAM,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC3D,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAW7B,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAMhE,qBAAqB,CACvB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAU7B,YAAY,CAAC,MAAM,CAAC,EAAE;QACxB,CAAC,CAAC,EAAE,MAAM,CAAC;QACX,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAYvC"}

package/dist/client/directory.js

@@ -0,0 +1,37 @@
+import { ClientCore } from "./core.js";
+/** directory domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export class DirectoryApi extends ClientCore {
+    // ── Directory job board (Feature 10) ──────────────────────────────
+    async listDirectoryJobs(params = {}) {
+        const qs = new URLSearchParams();
+        if (params.tags)
+            qs.set("tags", params.tags);
+        if (params.q)
+            qs.set("q", params.q);
+        if (params.limit !== undefined)
+            qs.set("limit", String(params.limit));
+        const s = qs.toString();
+        return this.request(`${this.baseUrl}/v1/directory/jobs${s ? `?${s}` : ""}`);
+    }
+    async getDirectoryJob(jobId) {
+        return this.request(`${this.baseUrl}/v1/directory/jobs/${jobId}`);
+    }
+    async submitDirectoryJobBid(jobId, data) {
+        return this.request(`${this.baseUrl}/v1/directory/jobs/${jobId}/bids`, { method: "POST", body: JSON.stringify(data) });
+    }
+    // ── Org Directory ───────────────────────────────────────────────────
+    async orgDirectory(params) {
+        const searchParams = new URLSearchParams();
+        if (params?.q)
+            searchParams.set("q", params.q);
+        if (params?.tags)
+            searchParams.set("tags", params.tags);
+        if (params?.page)
+            searchParams.set("page", String(params.page));
+        if (params?.page_size)
+            searchParams.set("page_size", String(params.page_size));
+        const qs = searchParams.toString();
+        return this.request(`${this.baseUrl}/v1/agents/org-directory${qs ? `?${qs}` : ""}`);
+    }
+}
+//# sourceMappingURL=directory.js.map

package/dist/client/directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory.js","sourceRoot":"","sources":["../../src/client/directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,kGAAkG;AAClG,MAAM,OAAO,YAAa,SAAQ,UAAU;IACxC,qEAAqE;IAErE,KAAK,CAAC,iBAAiB,CACnB,SAAwD,EAAE;QAE1D,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,CAAC;YAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QAC/B,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,sBAAsB,KAAK,EAAE,CAC/C,CAAC;IACN,CAAC;IAED,KAAK,CAAC,qBAAqB,CACvB,KAAa,EACb,IAA6B;QAE7B,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,sBAAsB,KAAK,OAAO,EACjD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACN,CAAC;IAGD,uEAAuE;IAEvE,KAAK,CAAC,YAAY,CAAC,MAKlB;QACG,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,IAAI;YAAE,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,EAAE,IAAI;YAAE,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,EAAE,SAAS;YAAE,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/E,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,2BAA2B,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjE,CAAC;IACN,CAAC;CAEJ"}

package/dist/client/error.d.ts

@@ -0,0 +1,7 @@
+/** The vault said no (or the network did). Dependency-free so the guard package can reference it. */
+export declare class OneClawApiError extends Error {
+    status: number;
+    detail: string;
+    constructor(status: number, detail: string);
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/client/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,qBAAa,eAAgB,SAAQ,KAAK;IAE3B,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;gBADd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;CAK5B"}

package/dist/client/error.js

@@ -0,0 +1,12 @@
+/** The vault said no (or the network did). Dependency-free so the guard package can reference it. */
+export class OneClawApiError extends Error {
+    status;
+    detail;
+    constructor(status, detail) {
+        super(detail);
+        this.status = status;
+        this.detail = detail;
+        this.name = "OneClawApiError";
+    }
+}
+//# sourceMappingURL=error.js.map

package/dist/client/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE3B;IACA;IAFX,YACW,MAAc,EACd,MAAc;QAErB,KAAK,CAAC,MAAM,CAAC,CAAC;QAHP,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QAGrB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAClC,CAAC;CACJ"}

package/dist/client/execute.d.ts

@@ -0,0 +1,37 @@
+import { ClientCore } from "./core.js";
+/** execute domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export declare class ExecuteApi extends ClientCore {
+    executeIntent(agentId: string, body: {
+        binding: string;
+        intent_type: string;
+        execution_mode?: string;
+        params: Record<string, unknown>;
+        dry_run?: boolean;
+        resume_after_approval_id?: string;
+    }): Promise<Record<string, unknown>>;
+    listBindings(agentId: string): Promise<{
+        bindings: Array<Record<string, unknown>>;
+    }>;
+    createBinding(agentId: string, body: {
+        name: string;
+        binding_type: string;
+        config?: Record<string, unknown>;
+        guardrails?: Record<string, unknown>;
+        credential?: Record<string, unknown>;
+        credential_source?: Record<string, unknown>;
+    } | Record<string, unknown>): Promise<Record<string, unknown>>;
+    testBinding(agentId: string, bindingId: string, timeoutMs?: number): Promise<Record<string, unknown>>;
+    listExecutions(agentId: string, limit?: number, offset?: number): Promise<Record<string, unknown>>;
+    getAgentPeerContext(agentId: string, budget?: number): Promise<Record<string, unknown>>;
+    listNotificationTargets(): Promise<Record<string, unknown>>;
+    listConnectorPresets(): Promise<Record<string, unknown>>;
+    listInstalledConnectors(agentId: string): Promise<Record<string, unknown>>;
+    listOAuthProviders(): Promise<Record<string, unknown>>;
+    listOAuthConnections(agentId: string): Promise<Record<string, unknown>>;
+    oauthRevokeToken(body: {
+        token: string;
+        token_type_hint?: string;
+    }): Promise<void>;
+    oauthRevokeConsent(appId: string): Promise<void>;
+}
+//# sourceMappingURL=execute.d.ts.map

package/dist/client/execute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/client/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,gGAAgG;AAChG,qBAAa,UAAW,SAAQ,UAAU;IAGhC,aAAa,CACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;QACF,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,wBAAwB,CAAC,EAAE,MAAM,CAAC;KACrC,GACF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAO7B,YAAY,CACd,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IAMlD,aAAa,CACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;QACF,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/C,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAO7B,WAAW,CACb,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAU7B,cAAc,CAChB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAa7B,mBAAmB,CACrB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAO7B,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAM3D,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAMxD,uBAAuB,CACzB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAM7B,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAMtD,oBAAoB,CACtB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAS7B,gBAAgB,CAClB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAClD,OAAO,CAAC,IAAI,CAAC;IAOV,kBAAkB,CACpB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;CAOnB"}

package/dist/client/execute.js

@@ -0,0 +1,57 @@
+import { ClientCore } from "./core.js";
+/** execute domain of the vault API. Mixed into OneClawClient; never instantiated on its own. */
+export class ExecuteApi extends ClientCore {
+    // ── Execution Intents ─────────────────────────────────────────
+    async executeIntent(agentId, body) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/execute`, { method: "POST", body: JSON.stringify(body) });
+    }
+    async listBindings(agentId) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/bindings`);
+    }
+    async createBinding(agentId, body) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/bindings`, { method: "POST", body: JSON.stringify(body) });
+    }
+    async testBinding(agentId, bindingId, timeoutMs) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/bindings/${bindingId}/test`, {
+            method: "POST",
+            body: JSON.stringify(timeoutMs ? { timeout_ms: timeoutMs } : {}),
+        });
+    }
+    async listExecutions(agentId, limit, offset) {
+        const qs = new URLSearchParams();
+        if (limit)
+            qs.set("limit", String(limit));
+        if (offset)
+            qs.set("offset", String(offset));
+        const query = qs.toString();
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/executions${query ? `?${query}` : ""}`);
+    }
+    // ── OAuth Connect ───────────────────────────────────────────────────
+    async getAgentPeerContext(agentId, budget) {
+        const qs = budget ? `?budget=${budget}` : "";
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/peer-context${qs}`);
+    }
+    async listNotificationTargets() {
+        return this.request(`${this.baseUrl}/v1/notification-targets`);
+    }
+    async listConnectorPresets() {
+        return this.request(`${this.baseUrl}/v1/connectors/presets`);
+    }
+    async listInstalledConnectors(agentId) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/connectors`);
+    }
+    async listOAuthProviders() {
+        return this.request(`${this.baseUrl}/v1/oauth/providers`);
+    }
+    async listOAuthConnections(agentId) {
+        return this.request(`${this.baseUrl}/v1/agents/${agentId}/oauth/connections`);
+    }
+    // ── OAuth Token/Consent Revocation ───────────────────────────────────
+    async oauthRevokeToken(body) {
+        await this.request(`${this.baseUrl}/v1/oauth/revoke`, { method: "POST", body: JSON.stringify(body) });
+    }
+    async oauthRevokeConsent(appId) {
+        await this.request(`${this.baseUrl}/v1/oauth/consents/${appId}`, { method: "DELETE" });
+    }
+}
+//# sourceMappingURL=execute.js.map

package/dist/client/execute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../src/client/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,gGAAgG;AAChG,MAAM,OAAO,UAAW,SAAQ,UAAU;IACtC,iEAAiE;IAEjE,KAAK,CAAC,aAAa,CACf,OAAe,EACf,IAOC;QAED,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,UAAU,EAC9C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,YAAY,CACd,OAAe;QAEf,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,WAAW,CAClD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,aAAa,CACf,OAAe,EACf,IAO2B;QAE3B,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,WAAW,EAC/C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,WAAW,CACb,OAAe,EACf,SAAiB,EACjB,SAAkB;QAElB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,aAAa,SAAS,OAAO,EACjE;YACI,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CACJ,CAAC;IACN,CAAC;IAED,KAAK,CAAC,cAAc,CAChB,OAAe,EACf,KAAc,EACd,MAAe;QAEf,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,KAAK;YAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,cAAc,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/E,CAAC;IACN,CAAC;IAGD,uEAAuE;IAEvE,KAAK,CAAC,mBAAmB,CACrB,OAAe,EACf,MAAe;QAEf,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,gBAAgB,EAAE,EAAE,CAC3D,CAAC;IACN,CAAC;IAED,KAAK,CAAC,uBAAuB;QACzB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,0BAA0B,CAC5C,CAAC;IACN,CAAC;IAED,KAAK,CAAC,oBAAoB;QACtB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,wBAAwB,CAC1C,CAAC;IACN,CAAC;IAED,KAAK,CAAC,uBAAuB,CACzB,OAAe;QAEf,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,aAAa,CACpD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,kBAAkB;QACpB,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,qBAAqB,CACvC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,oBAAoB,CACtB,OAAe;QAEf,OAAO,IAAI,CAAC,OAAO,CACf,GAAG,IAAI,CAAC,OAAO,cAAc,OAAO,oBAAoB,CAC3D,CAAC;IACN,CAAC;IAGD,wEAAwE;IAExE,KAAK,CAAC,gBAAgB,CAClB,IAAiD;QAEjD,MAAM,IAAI,CAAC,OAAO,CACd,GAAG,IAAI,CAAC,OAAO,kBAAkB,EACjC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,kBAAkB,CACpB,KAAa;QAEb,MAAM,IAAI,CAAC,OAAO,CACd,GAAG,IAAI,CAAC,OAAO,sBAAsB,KAAK,EAAE,EAC5C,EAAE,MAAM,EAAE,QAAQ,EAAE,CACvB,CAAC;IACN,CAAC;CAEJ"}

package/dist/client/index.d.ts

@@ -0,0 +1,44 @@
+import { ClientCore } from "./core.js";
+import { SecretsApi } from "./secrets.js";
+import { IntentsApi } from "./intents.js";
+import { CardsApi } from "./cards.js";
+import { ApprovalsApi } from "./approvals.js";
+import { PlatformApi } from "./platform.js";
+import { DirectoryApi } from "./directory.js";
+import { TreasuryApi } from "./treasury.js";
+import { ExecuteApi } from "./execute.js";
+import { MemoryApi } from "./memory.js";
+import { AutomationsApi } from "./automations.js";
+import { RuntimesApi } from "./runtimes.js";
+import { ChatApi } from "./chat.js";
+import { DelegationApi } from "./delegation.js";
+import { AdminApi } from "./admin.js";
+export { OneClawApiError, encodePath, type ClientConfig, type AgentCredentials, type AgentEntitlementsResponse, type AgentProfileResponse, } from "./core.js";
+/**
+ * The vault client every tool receives. One class at the call site
+ * (`client.listSecrets()`, `client.simulateTransaction()` …) assembled from
+ * per-domain mixins so each domain's surface lives in its own file and a
+ * later package split can leave whole domains out of the tree.
+ */
+export declare class OneClawClient extends ClientCore {
+}
+export interface OneClawClient extends SecretsApi, IntentsApi, CardsApi, ApprovalsApi, PlatformApi, DirectoryApi, TreasuryApi, ExecuteApi, MemoryApi, AutomationsApi, RuntimesApi, ChatApi, DelegationApi, AdminApi {
+}
+/** Every domain class, for the import-boundary test and Phase 3 packaging. */
+export declare const CLIENT_DOMAINS: {
+    readonly secrets: typeof SecretsApi;
+    readonly intents: typeof IntentsApi;
+    readonly cards: typeof CardsApi;
+    readonly approvals: typeof ApprovalsApi;
+    readonly platform: typeof PlatformApi;
+    readonly directory: typeof DirectoryApi;
+    readonly treasury: typeof TreasuryApi;
+    readonly execute: typeof ExecuteApi;
+    readonly memory: typeof MemoryApi;
+    readonly automations: typeof AutomationsApi;
+    readonly runtimes: typeof RuntimesApi;
+    readonly chat: typeof ChatApi;
+    readonly delegation: typeof DelegationApi;
+    readonly admin: typeof AdminApi;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EACH,eAAe,EACf,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,GAC5B,MAAM,WAAW,CAAC;AAEnB;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,UAAU;CAAG;AAEhD,MAAM,WAAW,aAAc,SAAQ,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ;CAAG;AActN,8EAA8E;AAC9E,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;CAAgU,CAAC"}

package/dist/client/index.js

@@ -0,0 +1,40 @@
+import { ClientCore } from "./core.js";
+import { SecretsApi } from "./secrets.js";
+import { IntentsApi } from "./intents.js";
+import { CardsApi } from "./cards.js";
+import { ApprovalsApi } from "./approvals.js";
+import { PlatformApi } from "./platform.js";
+import { DirectoryApi } from "./directory.js";
+import { TreasuryApi } from "./treasury.js";
+import { ExecuteApi } from "./execute.js";
+import { MemoryApi } from "./memory.js";
+import { AutomationsApi } from "./automations.js";
+import { RuntimesApi } from "./runtimes.js";
+import { ChatApi } from "./chat.js";
+import { DelegationApi } from "./delegation.js";
+import { AdminApi } from "./admin.js";
+export { OneClawApiError, encodePath, } from "./core.js";
+/**
+ * The vault client every tool receives. One class at the call site
+ * (`client.listSecrets()`, `client.simulateTransaction()` …) assembled from
+ * per-domain mixins so each domain's surface lives in its own file and a
+ * later package split can leave whole domains out of the tree.
+ */
+export class OneClawClient extends ClientCore {
+}
+/** Copy each mixin's own prototype methods onto the facade (TS handbook pattern). */
+function applyMixins(target, mixins) {
+    for (const mixin of mixins) {
+        for (const name of Object.getOwnPropertyNames(mixin.prototype)) {
+            if (name === "constructor")
+                continue;
+            const desc = Object.getOwnPropertyDescriptor(mixin.prototype, name);
+            if (desc)
+                Object.defineProperty(target.prototype, name, desc);
+        }
+    }
+}
+applyMixins(OneClawClient, [SecretsApi, IntentsApi, CardsApi, ApprovalsApi, PlatformApi, DirectoryApi, TreasuryApi, ExecuteApi, MemoryApi, AutomationsApi, RuntimesApi, ChatApi, DelegationApi, AdminApi]);
+/** Every domain class, for the import-boundary test and Phase 3 packaging. */
+export const CLIENT_DOMAINS = { secrets: SecretsApi, intents: IntentsApi, cards: CardsApi, approvals: ApprovalsApi, platform: PlatformApi, directory: DirectoryApi, treasury: TreasuryApi, execute: ExecuteApi, memory: MemoryApi, automations: AutomationsApi, runtimes: RuntimesApi, chat: ChatApi, delegation: DelegationApi, admin: AdminApi };
+//# sourceMappingURL=index.js.map