@alfe.ai/agent-api-client 0.0.12 → 0.1.0

package/dist/index.cjs

@@ -1,5 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/index.ts
+/**
+* Encode each path segment but keep the `/` separators — `encodeURIComponent`
+* would escape the slashes too, breaking greedy proxy routes.
+*/
+function encodeFilePath(filePath) {
+	return filePath.split("/").map(encodeURIComponent).join("/");
+}
 var AgentApiClient = class {
 	apiKey;
 	apiUrl;
@@ -22,6 +29,57 @@ var AgentApiClient = class {
 		}
 		return (await res.json()).data;
 	}
+	async syncRegister(args) {
+		return this.request("/agents/sync/register", {
+			method: "POST",
+			body: JSON.stringify(args ?? {})
+		});
+	}
+	async syncGetManifest() {
+		return this.request("/agents/sync/manifest");
+	}
+	async syncPresign(args) {
+		return this.request("/agents/sync/presign", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncConfirmUpload(args) {
+		return this.request("/agents/sync/confirm", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncReconstruct(args) {
+		return this.request("/agents/sync/reconstruct", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncGetStats() {
+		return this.request("/agents/sync/stats");
+	}
+	async syncListFiles(args) {
+		const qs = new URLSearchParams();
+		if (args?.prefix) qs.set("prefix", args.prefix);
+		const query = qs.toString();
+		return this.request(`/agents/sync/files${query ? `?${query}` : ""}`);
+	}
+	async syncListSessions() {
+		return this.request("/agents/sync/sessions");
+	}
+	async syncGetSession(sessionId) {
+		return this.request(`/agents/sync/sessions/${encodeURIComponent(sessionId)}`);
+	}
+	async syncDeleteFile(filePath) {
+		return this.request(`/agents/sync/files/${encodeFilePath(filePath)}`, { method: "DELETE" });
+	}
+	async sharedListFiles(args) {
+		return this.request(`/agents/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`);
+	}
+	async sharedDownloadUrl(args) {
+		return this.request(`/agents/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/download/${encodeFilePath(args.filePath)}`);
+	}
 	async listIntegrations() {
 		return this.request("/agent/integrations");
 	}
@@ -170,26 +228,11 @@ var AgentApiClient = class {
 			body: JSON.stringify(args)
 		});
 	}
-	async enforcePolicy(args) {
-		return this.request("/agent/identity/enforce", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
-	}
-	async checkToolPermission(args) {
-		return this.request("/agent/identity/check-tool", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
-	}
 	async searchIdentities(args) {
 		const qs = new URLSearchParams();
 		if (args?.q) qs.set("q", args.q);
 		if (args?.status) qs.set("status", args.status);
-		if (args?.tag) qs.set("tag", args.tag);
-		if (args?.platform) qs.set("platform", args.platform);
 		if (args?.limit) qs.set("limit", String(args.limit));
-		if (args?.offset) qs.set("offset", String(args.offset));
 		const query = qs.toString();
 		return this.request(`/agent/identity/search${query ? `?${query}` : ""}`);
 	}
@@ -223,7 +266,6 @@ var AgentApiClient = class {
 	async getIdentityChangelog(identityId, args) {
 		const qs = new URLSearchParams();
 		if (args?.limit) qs.set("limit", String(args.limit));
-		if (args?.offset) qs.set("offset", String(args.offset));
 		const query = qs.toString();
 		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/changelog${query ? `?${query}` : ""}`);
 	}
@@ -245,6 +287,29 @@ var AgentApiClient = class {
 			body: JSON.stringify(args)
 		});
 	}
+	/**
+	* Update display-shape fields on an Identity. Body excludes `email` /
+	* `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
+	* via the verify flow, title/company live on OrgMembership, metadata is
+	* not agent-writable.
+	*/
+	async updateIdentity(identityId, args) {
+		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/update`, {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	/**
+	* Phase 2 (Section H): server-side verification of a Google Chat sender via
+	* the agent's existing Google OAuth credentials. Returns the resolved
+	* identity (created or matched via Scenario-B email enrichment).
+	*/
+	async resolveGoogleChatSender(args) {
+		return this.request("/agent/google/resolve-sender", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
 	async memorySearch(query, opts) {
 		return this.request("/agent/memory/search", {
 			method: "POST",
@@ -318,6 +383,15 @@ var AgentApiClient = class {
 			body: JSON.stringify(params)
 		});
 	}
+	async registerDatabaseCredentials() {
+		return this.request("/agent/database/register", { method: "POST" });
+	}
+	async reportDatabaseAudit(entry) {
+		await this.request("/agent/database/audit", {
+			method: "POST",
+			body: JSON.stringify(entry)
+		}).catch(() => {});
+	}
 };
 //#endregion
 exports.AgentApiClient = AgentApiClient;

package/dist/index.d.cts

@@ -1,4 +1,5 @@
 //#region ../../packages-internal/types/dist/access.d.ts
+
 /**
  * The four resource scopes at which a permission can apply.
  * Order is meaningful: broader scopes first (`org`) → narrower last (`agent`).
@@ -166,11 +167,147 @@ interface AgentApiClientConfig {
   apiKey: string;
   apiUrl: string;
 }
+interface SyncAgentInfo {
+  agentId: string;
+  tenantId: string;
+  displayName: string;
+  s3Prefix: string;
+  status: "stale" | "syncing" | "synced";
+  fileCount?: number;
+  totalSize?: number;
+  lastSync?: string;
+}
+interface SyncManifestEntry {
+  hash: string;
+  size: number;
+  modified: string;
+  etag?: string;
+  storageClass?: string;
+  compressed?: boolean;
+}
+interface SyncManifest {
+  version: 1;
+  agentId: string;
+  lastSync: string;
+  files: Record<string, SyncManifestEntry>;
+}
+interface SyncPresignedUrl {
+  path: string;
+  url: string;
+  expiresAt: string;
+}
+interface SyncConfirmedUpload {
+  filePath: string;
+  hash: string;
+  size: number;
+  storageClass: "STANDARD" | "GLACIER_IR";
+  syncedAt: string;
+}
+interface SyncReconstructFile {
+  path: string;
+  size: number;
+  url: string;
+  storageClass?: string;
+  compressed?: boolean;
+}
+interface SyncReconstructBundle {
+  agentId: string;
+  mode: "full" | "active" | "memory";
+  fileCount: number;
+  totalSize: number;
+  files: SyncReconstructFile[];
+  expiresAt: string;
+}
+interface SyncAgentStats {
+  agentId: string;
+  standardBytes: number;
+  glacierBytes: number;
+  fileCount: number;
+  lastSyncAt: string | null;
+}
+interface SyncFileEntry {
+  filePath: string;
+  size: number;
+  modified: string;
+  contentHash: string;
+  storageClass?: string;
+  compressed?: boolean;
+}
+interface SyncSessionEntry {
+  sessionId: string;
+  size: number;
+  lastModified: string;
+  storageClass?: string;
+  isArchived: boolean;
+}
+interface SyncSessionContent {
+  sessionId: string;
+  content: string;
+  compressed: boolean;
+}
+interface SharedFileEntry {
+  filePath: string;
+  fileName: string;
+  size: number;
+  contentType?: string;
+}
 declare class AgentApiClient {
   private readonly apiKey;
   private readonly apiUrl;
   constructor(config: AgentApiClientConfig);
   private request;
+  syncRegister(args?: {
+    displayName?: string;
+  }): Promise<{
+    agent: SyncAgentInfo;
+  }>;
+  syncGetManifest(): Promise<SyncManifest>;
+  syncPresign(args: {
+    files: {
+      path: string;
+      operation: "put" | "get";
+      contentType?: string;
+    }[];
+  }): Promise<{
+    urls: SyncPresignedUrl[];
+  }>;
+  syncConfirmUpload(args: {
+    filePath: string;
+    hash: string;
+    size: number;
+    storageClass?: "STANDARD" | "GLACIER_IR";
+  }): Promise<SyncConfirmedUpload>;
+  syncReconstruct(args: {
+    mode: "full" | "active" | "memory";
+  }): Promise<SyncReconstructBundle>;
+  syncGetStats(): Promise<SyncAgentStats>;
+  syncListFiles(args?: {
+    prefix?: string;
+  }): Promise<{
+    files: SyncFileEntry[];
+  }>;
+  syncListSessions(): Promise<{
+    sessions: SyncSessionEntry[];
+  }>;
+  syncGetSession(sessionId: string): Promise<SyncSessionContent>;
+  syncDeleteFile(filePath: string): Promise<{
+    removed: boolean;
+  }>;
+  sharedListFiles(args: {
+    scope: "org" | "team" | "project";
+    scopeId: string;
+  }): Promise<{
+    files: SharedFileEntry[];
+    nextCursor: string | null;
+  }>;
+  sharedDownloadUrl(args: {
+    scope: "org" | "team" | "project";
+    scopeId: string;
+    filePath: string;
+  }): Promise<{
+    downloadUrl: string;
+    expiresIn: number;
+  }>;
   listIntegrations(): Promise<IntegrationInstall[]>;
   getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult>;
   updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;
@@ -374,8 +511,9 @@ declare class AgentApiClient {
   /** Enumerate scopes (org/team/project/agent) this agent can access. */
   listSecretScopes(): Promise<ScopeInfo[]>;
   resolveIdentity(args: {
-    platform: string;
+    provider: string;
     platformId: string;
+    kind?: "user" | "agent" | "service" | "bot" | "workspace";
     displayName?: string;
   }): Promise<{
     identityId: string | null;
@@ -384,41 +522,15 @@ declare class AgentApiClient {
     created?: boolean;
     reason?: string;
   }>;
-  enforcePolicy(args: {
-    platform: string;
-    senderId: string;
-    channelId?: string;
-  }): Promise<{
-    identityId: string | null;
-    orgId: string | null;
-    role: string | null;
-    allowedTools: string[];
-    deniedTools: string[];
-    identified: boolean;
-  }>;
-  checkToolPermission(args: {
-    platform: string;
-    senderId: string;
-    toolName: string;
-    toolArgs?: Record<string, unknown>;
-    channelId?: string;
-  }): Promise<{
-    allowed: boolean;
-    reason?: string;
-  }>;
   searchIdentities(args?: {
     q?: string;
     status?: string;
-    tag?: string;
-    platform?: string;
     limit?: number;
-    offset?: number;
   }): Promise<{
     identities: unknown[];
   }>;
   getIdentityContext(identityId: string): Promise<{
-    identity: unknown;
-    recentChanges: unknown[];
+    context: unknown;
   }>;
   mergeIdentities(survivorId: string, args: {
     mergedId: string;
@@ -465,7 +577,6 @@ declare class AgentApiClient {
   }>;
   getIdentityChangelog(identityId: string, args?: {
     limit?: number;
-    offset?: number;
   }): Promise<{
     entries: unknown[];
   }>;
@@ -483,9 +594,17 @@ declare class AgentApiClient {
   requestIdentityVerification(args: {
     claimedIdentityId: string;
     requestingIdentityId: string;
-    requestingPlatform: string;
+    requestingProvider: string;
     requestingPlatformId: string;
-    preferredChannel?: "sms" | "email";
+    preferredChannel?: "mobile" | "email";
+    /**
+     * Phase 2: agent-supplied contact endpoint. When provided, the top-level
+     * `preferredChannel` is ignored — the contact's channel wins.
+     */
+    contact?: {
+      channel: "email" | "mobile";
+      value: string;
+    };
   }): Promise<{
     verificationId: string;
     channel: string;
@@ -495,15 +614,47 @@ declare class AgentApiClient {
       channel: string;
       deliveredTo: string;
     }[];
+  } | {
+    error: string;
   }>;
   confirmIdentityVerification(args: {
+    claimedIdentityId: string;
     verificationId: string;
     phrase: string;
   }): Promise<{
     verified: boolean;
     identityId?: string;
+    /** Phase 2: how the confirm resolved — Scenario A vs B. */
+    action?: "merged" | "contact_verified";
     error?: string;
   }>;
+  /**
+   * Update display-shape fields on an Identity. Body excludes `email` /
+   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
+   * via the verify flow, title/company live on OrgMembership, metadata is
+   * not agent-writable.
+   */
+  updateIdentity(identityId: string, args: {
+    name?: string;
+    avatarUrl?: string;
+    timezone?: string;
+    locale?: string;
+  }): Promise<{
+    ok: boolean;
+  }>;
+  /**
+   * Phase 2 (Section H): server-side verification of a Google Chat sender via
+   * the agent's existing Google OAuth credentials. Returns the resolved
+   * identity (created or matched via Scenario-B email enrichment).
+   */
+  resolveGoogleChatSender(args: {
+    senderUserId: string;
+    spaceId?: string;
+  }): Promise<{
+    identityId: string | null;
+    status: string;
+    accessAllowed: boolean;
+  }>;
   memorySearch(query: string, opts?: {
     limit?: number;
     topic?: string;
@@ -598,8 +749,20 @@ declare class AgentApiClient {
     count?: number;
     freshness?: string;
   }): Promise<unknown>;
+  registerDatabaseCredentials(): Promise<{
+    connectionString: string;
+    username: string;
+    password: string;
+    databases: string[];
+  }>;
+  reportDatabaseAudit(entry: {
+    database: string;
+    collection: string;
+    operation: string;
+    summary?: string;
+  }): Promise<void>;
 }
 //# sourceMappingURL=index.d.ts.map
 //#endregion
-export { AgentApiClient, AgentApiClientConfig, type EncryptedEnvelopeV1, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretEnvelopeResponse, type SecretMetadata, type SecretScope };
+export { AgentApiClient, AgentApiClientConfig, type EncryptedEnvelopeV1, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretEnvelopeResponse, type SecretMetadata, type SecretScope, SharedFileEntry, SyncAgentInfo, SyncAgentStats, SyncConfirmedUpload, SyncFileEntry, SyncManifest, SyncManifestEntry, SyncPresignedUrl, SyncReconstructBundle, SyncReconstructFile, SyncSessionContent, SyncSessionEntry };
 //# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":["ResourceScope","RESOURCE_SCOPES","AccessLevel","ScopedAccess","AllScopedAccess","ResourceScope","DEFAULT_INTEGRATIONS","IntegrationVisibility","INTEGRATION_VISIBILITIES","IntegrationScope","INTEGRATION_SCOPES","IntegrationDesiredStatus","INTEGRATION_DESIRED_STATUSES","IntegrationActualStatus","INTEGRATION_ACTUAL_STATUSES","IntegrationInstall","Record","AgentIntegration","OrgIntegration","IntegrationConfigSchemaField","IntegrationConfigResult","RegistryEntry","ResourceScope","SecretScope","SECRET_SCOPES","EncryptedEnvelopeV1","SecretMetadata","SecretEnvelopeResponse","ScopeInfo","GeneratedDataKey"],"sources":["../../../packages-internal/types/dist/access.d.ts","../../../packages-internal/types/dist/integration.d.ts","../../../packages-internal/types/dist/secrets.d.ts","../src/index.ts"],"sourcesContent":["/**\n * The four resource scopes at which a permission can apply.\n * Order is meaningful: broader scopes first (`org`) → narrower last (`agent`).\n *\n * `IntegrationScope` in integration.ts and `SecretScope` in secrets.ts are\n * intentional aliases of this same enum — there is only one concept of\n * \"scope\" in Alfe.\n */\nexport declare const ResourceScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type ResourceScope = (typeof ResourceScope)[keyof typeof ResourceScope];\n/** Ordered tuple of resource scope string values (broad → narrow). */\nexport declare const RESOURCE_SCOPES: readonly [\"org\" | \"team\" | \"project\" | \"agent\", ...(\"org\" | \"team\" | \"project\" | \"agent\")[]];\nexport declare const AccessLevel: {\n    readonly None: \"none\";\n    readonly Read: \"read\";\n    readonly Write: \"write\";\n    readonly Manage: \"manage\";\n};\nexport type AccessLevel = (typeof AccessLevel)[keyof typeof AccessLevel];\nexport interface ScopedAccess {\n    scope: ResourceScope;\n    scopeId: string;\n    accessLevel: AccessLevel;\n    /** Resolved role label (e.g. \"org_admin\", \"team_member\") */\n    role: string;\n}\nexport interface AllScopedAccess {\n    orgAccess: ScopedAccess;\n    teamAccess: ScopedAccess[];\n    projectAccess: ScopedAccess[];\n}\n//# sourceMappingURL=access.d.ts.map","import { ResourceScope } from \"./access.js\";\n/** Integrations auto-installed for ALL agents regardless of hosting type. Cannot be removed. */\nexport declare const DEFAULT_INTEGRATIONS: readonly string[];\n/** Controls where an integration appears: public (everyone), hidden (nowhere) */\nexport declare const IntegrationVisibility: {\n    readonly Public: \"public\";\n    readonly Hidden: \"hidden\";\n};\nexport type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];\nexport declare const INTEGRATION_VISIBILITIES: readonly [\"public\" | \"hidden\", ...(\"public\" | \"hidden\")[]];\n/** Scope at which an integration is installed */\nexport declare const IntegrationScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type IntegrationScope = ResourceScope;\nexport declare const INTEGRATION_SCOPES: readonly [\"org\" | \"team\" | \"project\" | \"agent\", ...(\"org\" | \"team\" | \"project\" | \"agent\")[]];\nexport declare const IntegrationDesiredStatus: {\n    readonly Active: \"active\";\n    readonly Removed: \"removed\";\n};\nexport type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];\nexport declare const INTEGRATION_DESIRED_STATUSES: readonly [\"active\" | \"removed\", ...(\"active\" | \"removed\")[]];\nexport declare const IntegrationActualStatus: {\n    readonly Installing: \"installing\";\n    readonly Active: \"active\";\n    readonly Error: \"error\";\n    readonly Removing: \"removing\";\n    readonly Inactive: \"inactive\";\n    readonly Unknown: \"unknown\";\n};\nexport type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];\nexport declare const INTEGRATION_ACTUAL_STATUSES: readonly [\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\", ...(\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\")[]];\nexport interface IntegrationInstall {\n    scope: IntegrationScope;\n    scopeId: string;\n    integrationId: string;\n    tenantId: string;\n    desiredStatus: IntegrationDesiredStatus;\n    actualStatus: IntegrationActualStatus;\n    version: string;\n    config: Record<string, unknown>;\n    errorMessage: string;\n    installedAt: string;\n    updatedAt: string;\n}\n/** @deprecated Use IntegrationInstall instead */\nexport type AgentIntegration = IntegrationInstall;\n/** Org-scoped integration install */\nexport type OrgIntegration = IntegrationInstall;\nexport interface IntegrationConfigSchemaField {\n    key: string;\n    label: string;\n    type: string;\n    description?: string;\n    required?: boolean;\n    default?: string | number | boolean;\n    options?: string[];\n    select_options?: {\n        value: string;\n        label: string;\n    }[];\n    oauth_provider?: string;\n    oauth_scopes?: string[];\n    oauth_integration_id?: string;\n    editable?: string;\n    hidden?: boolean;\n}\nexport interface IntegrationConfigResult {\n    integrationId: string;\n    config: Record<string, unknown>;\n    configSchema: IntegrationConfigSchemaField[];\n}\nexport interface RegistryEntry {\n    id: string;\n    name: string;\n    description: string;\n    versions: string[];\n    latest: string;\n    repository: string;\n    commit: string;\n    icon?: string;\n    author?: {\n        name: string;\n        url?: string;\n    } | string;\n    pricing?: {\n        type: \"free\" | \"paid\" | \"usage\";\n        price?: number;\n        currency?: string;\n        interval?: \"month\" | \"year\";\n        description?: string;\n    };\n    features?: string[];\n    preview_images?: string[];\n    config_schema?: IntegrationConfigSchemaField[];\n    supported_agents?: string[];\n    /** Scopes where this integration can be installed */\n    supported_scopes?: IntegrationScope[];\n    /** Visibility status — controls where integration appears */\n    visibility?: IntegrationVisibility;\n}\n//# sourceMappingURL=integration.d.ts.map","/**\n * Secrets types — shared between services/secrets, @alfe.ai/agent-api-client,\n * the openclaw-secrets plugin, and dashboard clients.\n *\n * Server-side crypto and KMS glue live in @alfe/secret-store (Node/AWS-only);\n * this module is a pure, dependency-free shape contract safe for every\n * environment the agent-api-client ships to.\n */\nimport type { ResourceScope } from \"./access.js\";\n/** Scope levels at which a secret can be owned. Aliased to ResourceScope. */\nexport type SecretScope = ResourceScope;\nexport declare const SECRET_SCOPES: readonly [\"org\" | \"team\" | \"project\" | \"agent\", ...(\"org\" | \"team\" | \"project\" | \"agent\")[]];\n/**\n * v1 encrypted envelope as persisted by services/secrets and exchanged with\n * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext\n * are all base64-encoded.\n */\nexport interface EncryptedEnvelopeV1 {\n    version: 1;\n    iv: string;\n    ciphertext: string;\n    authTag: string;\n    dataKeyCiphertext: string;\n}\n/** Opaque metadata about a secret row — never includes plaintext. */\nexport interface SecretMetadata {\n    secretId: string;\n    secretName: string;\n    description?: string;\n    tags?: string[];\n    createdAt: string;\n    updatedAt: string;\n    rotatedAt?: string;\n}\n/** A single secret row including its encrypted envelope. */\nexport interface SecretEnvelopeResponse extends SecretMetadata {\n    envelope: EncryptedEnvelopeV1;\n}\n/** A scope the caller can read or write secrets in. */\nexport interface ScopeInfo {\n    scope: SecretScope;\n    scopeId: string;\n    name?: string;\n}\n/**\n * KMS-issued data key, returned by the secrets service's\n * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is\n * returned base64-encoded; callers MUST decode it to a Buffer and zero the\n * Buffer after use — never keep the plaintext as a JS string.\n */\nexport interface GeneratedDataKey {\n    plaintextKey: string;\n    dataKeyCiphertext: string;\n}\n//# sourceMappingURL=secrets.d.ts.map"],"mappings":";;AAQA;AAMA;;;;;;cANqBA;;ECJAO,SAAAA,IAAAA,EAAAA,MAAAA;EAITA,SAAAA,OAAAA,EAAAA,SAAqB;EAAA,SAAA,KAAA,EAAA,OAAA;;AAA+CA,KDMpEP,aAAAA,GCNoEO,CAAAA,ODM5CP,aCN4CO,CAAAA,CAAAA,MAAAA,ODMhBP,aCNgBO,CAAAA;;;;;ADM5CP,cCVfO,qBDUeP,EAAAA;WAA4BA,MAAAA,EAAAA,QAAAA;EAAa,SAAA,MAAA,EAAA,QAAA;;KCNjEO,qBAAAA,WAAgCA,oCAAoCA;AAJhF;AAIYA,cAGSE,gBAHY,EAAA;EAAA,SAAA,GAAA,EAAA,KAAA;WAAWF,IAAAA,EAAAA,MAAAA;WAAoCA,OAAAA,EAAAA,SAAAA;EAAqB,SAAA,KAAA,EAAA,OAAA;AAGrG,CAAA;AAMYE,KAAAA,gBAAAA,GAAmBJ,aAAAA;AAMnBM,cAJSA,wBAIe,EAAA;EAAA,SAAA,MAAA,EAAA,QAAA;WAAWA,OAAAA,EAAAA,SAAAA;;AAA+D,KAAlGA,wBAAAA,GAAkG,CAAA,OAA/DA,wBAA+D,CAAA,CAAA,MAAA,OAAxBA,wBAAwB,CAAA;AAUlGE,cARSA,uBAQc,EAAA;EAAA,SAAA,UAAA,EAAA,YAAA;WAAWA,MAAAA,EAAAA,QAAAA;WAAsCA,KAAAA,EAAAA,OAAAA;EAAuB,SAAA,QAAA,EAAA,UAAA;EAE1FE,SAAAA,QAAAA,EAAAA,UAAkB;EAAA,SAAA,OAAA,EAAA,SAAA;;AAKhBJ,KAPPE,uBAAAA,GAOOF,CAAAA,OAP2BE,uBAO3BF,CAAAA,CAAAA,MAAAA,OAPiEE,uBAOjEF,CAAAA;AAGPK,UARKD,kBAAAA,CAQLC;EAAM,KAAA,EAPPP,gBAOO;EASDU,OAAAA,EAAAA,MAAAA;EAkBAC,aAAAA,EAAAA,MAAAA;EAAuB,QAAA,EAAA,MAAA;eAE5BJ,EAhCOL,wBAgCPK;cACMG,EAhCAN,uBAgCAM;EAA4B,OAAA,EAAA,MAAA;EAE7BE,MAAAA,EAhCLL,MAgCKK,CAAAA,MAAa,EAAA,OAAA,CAAA;EAAA,YAAA,EAAA,MAAA;aAsBVF,EAAAA,MAAAA;WAGGV,EAAAA,MAAAA;;;;AC1FXc,UD0CKJ,4BAAAA,CC1CsB;EAOtBM,GAAAA,EAAAA,MAAAA;EAQAC,KAAAA,EAAAA,MAAAA;EAUAC,IAAAA,EAAAA,MAAAA;EAAsB,WAAA,CAAA,EAAA,MAAA;UACzBF,CAAAA,EAAAA,OAAAA;SADkCC,CAAAA,EAAAA,MAAAA,GAAAA,MAAAA,GAAAA,OAAAA;EAAc,OAAA,CAAA,EAAA,MAAA,EAAA;EAI7CE,cAAS,CAAA,EAAA;IAWTC,KAAAA,EAAAA,MAAAA;;;;ECjBA,YAAA,CAAA,EAAA,MAAA,EAAoB;EAKxB,oBAAc,CAAA,EAAA,MAAA;EAAA,QAAA,CAAA,EAAA,MAAA;QAIL,CAAA,EAAA,OAAA;;AAsBM,UFMXT,uBAAAA,CENW;eAIiC,EAAA,MAAA;QAAR,EFIzCJ,MEJyC,CAAA,MAAA,EAAA,OAAA,CAAA;cAQzC,EFHMG,4BEGN,EAAA;;AAa+B,UFd1BE,aAAAA,CEc0B;MAC9B,MAAA;MAAR,EAAA,MAAA;aAWqD,EAAA,MAAA;UAAR,EAAA,MAAA,EAAA;QAU7C,EAAA,MAAA;YAQyD,EAAA,MAAA;QAAzD,EAAA,MAAA;MAM0C,CAAA,EAAA,MAAA;QAAxB,CAAA,EAAA;IAIS,IAAA,EAAA,MAAA;IAoBgB,GAAA,CAAA,EAAA,MAAA;MAQA,MAAA;SAQZ,CAAA,EAAA;IAUJ,IAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA;IAOF,KAAA,CAAA,EAAA,MAAA;IAQF,QAAA,CAAA,EAAA,MAAA;IAOI,QAAA,CAAA,EAAA,OAAA,GAAA,MAAA;IAQG,WAAA,CAAA,EAAA,MAAA;;UAsBL,CAAA,EAAA,MAAA,EAAA;gBASF,CAAA,EAAA,MAAA,EAAA;eAOG,CAAA,EFlJXF,4BEkJW,EAAA;kBAgBZ,CAAA,EAAA,MAAA,EAAA;;kBAQU,CAAA,EFvKNV,gBEuKM,EAAA;;YAmBvB,CAAA,EFxLWF,qBEwLX;;;;;;AF1ReA,KCMTgB,WAAAA,GAAcD,aDHzB;;;;;AAID;AAMYb,UCAKgB,mBAAAA,CDAcpB;EAEVM,OAAAA,EAAAA,CAAAA;EAITA,EAAAA,EAAAA,MAAAA;EAAwB,UAAA,EAAA,MAAA;SAAWA,EAAAA,MAAAA;mBAAuCA,EAAAA,MAAAA;;AAEtF;AAQYE,UCRKa,cAAAA,CDQkB;EAAA,QAAA,EAAA,MAAA;YAAWb,EAAAA,MAAAA;aAAsCA,CAAAA,EAAAA,MAAAA;EAAuB,IAAA,CAAA,EAAA,MAAA,EAAA;EAE1FE,SAAAA,EAAAA,MAAAA;EAAkB,SAAA,EAAA,MAAA;WACxBN,CAAAA,EAAAA,MAAAA;;;AAOCO,UCRKW,sBAAAA,SAA+BD,cDQpCV,CAAAA;EAAM,QAAA,ECPJS,mBDOI;AASlB;AAkBA;AAAwC,UC/BvBG,SAAAA,CD+BuB;OAE5BZ,EChCDO,WDgCCP;SACMG,EAAAA,MAAAA;EAA4B,IAAA,CAAA,EAAA,MAAA;AAE9C;;;;;;;UCzBiBU,gBAAAA;;EAxCLN,iBAAW,EAAA,MAAGD;AAO1B;AAQA;;;UCQiB,oBAAA;EF7BIf,MAAAA,EAAAA,MAAAA;EAITA,MAAAA,EAAAA,MAAAA;;AAAgCA,cE8B/B,cAAA,CF9B+BA;mBAAoCA,MAAAA;EAAqB,iBAAA,MAAA;EAGhFE,WAAAA,CAAAA,MAAAA,EE+BC,oBF1BrB;EACWA,QAAAA,OAAAA;EAESE,gBAAAA,CAAAA,CAAAA,EE6CO,OF1C3B,CE0CmC,kBF1CnC,EAAA,CAAA;EACWA,oBAAAA,CAAAA,aAAwB,EAAA,MAAA,CAAA,EE6CiB,OF7CjB,CE6CyB,uBF7CzB,CAAA;EAAA,uBAAA,CAAA,aAAA,EAAA,MAAA,EAAA,MAAA,EEqDxB,MFrDwB,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EEsD/B,OFtD+B,CAAA,IAAA,CAAA;oBAAWA,CAAAA,aAAAA,EAAAA,MAAAA,EAAAA,OAE1BE,CAF0BF,EAAAA;IAAuCA,OAAAA,CAAAA,EAAAA,MAAAA;IAAwB,MAAA,CAAA,EEkEnE,MFlEmE,CAAA,MAAA,EAAA,OAAA,CAAA;EAEzFE,CAAAA,CAAAA,EEiEhB,OFjEgBA,CEiER,kBF1DZ,CAAA;EACWA,iBAAAA,CAAAA,aAAuB,EAAA,MAAA,CAAA,EEoEe,OFpEf,CEoEuB,kBFpEvB,CAAA;EAAA,WAAA,CAAA,QAAA,EAAA,MAAA,EAAA,MAAA,CAAA,EAAA,MAAA,EAAA,CAAA,EE8E9B,OF9E8B,CAAA;IAAWA,GAAAA,EAAAA,MAAAA;IAAsCA,QAAAA,EAAAA,MAAAA;IAAuB,SAAA,EAAA,MAAA;EAE1FE,CAAAA,CAAAA;EAAkB,cAAA,CAAA,QAAA,EAAA,MAAA,CAAA,EEoF9B,OFpF8B,CAAA;IACxBN,QAAAA,EAAAA,MAAAA;IAIQE,SAAAA,EAAAA,OAAAA;IACDE,MAAAA,CAAAA,EE8E4C,MF9E5CA,CAAAA,MAAAA,EAAAA,MAAAA,CAAAA;;EAEA,WAAA,CAAA,CAAA,EEkFK,OFlFL,CAAA;IASDM,YAAAA,EEyE8B,aFzEF,EAAA;EAkB5BC,CAAAA,CAAAA;EAAuB,oBAAA,CAAA,CAAA,EE2DR,OF3DQ,CAAA;IAE5BJ,QAAAA,CAAAA,EAAAA;MACMG,KAAAA,EAAAA,MAAAA;MAA4B,YAAA,EAAA,MAAA;MAE7BE,QAAa,EAAA,MAAA;MAAA,YAAA,EAAA,MAAA;MAsBVF,eAAAA,CAAAA,EAAAA,MAAAA,EAAAA;MAGGV,SAAAA,EAAAA,OAAAA;MAENF,WAAAA,CAAAA,EAAAA,MAAAA;IAAqB,CAAA,EAAA;;;;IC5F1BgB,YAAW,EAAA,MAAGD;IAOTG,SAAAA,EAAAA,MAAAA;IAQAC,eAAc,CAAA,EAAA,MAAA,EAAA;EAUdC,CAAAA,CAAAA;EAAsB,uBAAA,CAAA,KAAA,EAAA,MAAA,CAAA,ECkHS,ODlHT,CAAA;IACzBF,QAAAA,EAAAA;MADkCC,KAAAA,EAAAA,MAAAA;MAAc,WAAA,CAAA,EAAA,MAAA;MAI7CE,SAAS,EAAA,OACfL;IAUMM,CAAAA,EAAAA;;0CC2G+B;;MA5H/B,KAAA,EAAA,MAAA;MAKJ,WAAc,CAAA,EAAA,MAAA;MAAA,SAAA,EAAA,OAAA;IAIL,CAAA,EAAA;;0BAsBM,CAAA,CAAA,EAqGQ,OArGR,CAAA;IAIiC,KAAA,EAAA,MAAA;IAAR,YAAA,EAAA,MAAA;IAQzC,QAAA,EAAA,MAAA;IACP,YAAA,EAAA,MAAA;IAYsC,WAAA,CAAA,EAAA,MAAA;;sBACtC,CAAA,CAAA,EAqF2B,OArF3B,CAAA;IAWqD,KAAA,EAAA,MAAA;IAAR,WAAA,EAAA,MAAA;;oBAkBY,CAAA,CAAA,EA+DhC,OA/DgC,CAAA;IAAzD,WAAA,EAAA,MAAA;IAM0C,oBAAA,EAAA,MAAA;IAAxB,YAAA,EAAA,MAAA;;kBAwByB,CAAA,CAAA,EAyCpB,OAzCoB,CAAA;IAQA,WAAA,EAAA,MAAA;IAQZ,SAAA,EAAA,MAAA;;sBAiBN,CAAA,CAAA,EAeE,OAfF,CAAA;IAQF,WAAA,EAAA,MAAA;IAOI,WAAA,EAAA,MAAA;IAQG,aAAA,EAAA,MAAA;;yBAsBL,CAAA,CAAA,EAtBK,OAsBL,CAAA;IASF,WAAA,EAAA,MAAA;IAOG,YAAA,EAAA,MAAA;IAgBZ,oBAAA,EAAA,MAAA;IACb,OAAA,EAAA,MAAA;IAOuB,QAAA,EAAA,MAAA;IAM8D,OAAA,EAAA,MAAA;IAarF,KAAA,EAAA,MAAA;IAgCK,eAAA,EAAA,MAAA,EAAA;IAGG,QAAA,EAAA,MAAA;IAAR,YAAA,EAAA,MAAA;;uBAiBA,CAAA,CAAA,EAtH2B,OAsH3B,CAAA;IASK,WAAA,EAAA,MAAA;IAIG,SAAA,EAAA,MAAA;;oBAgBH,CAAA,CAAA,EA5ImB,OA4InB,CAAA;IAGG,WAAA,EAAA,MAAA;IAAR,oBAAA,EAAA,MAAA;IAQK,cAAA,EAAA,MAAA;IAEG,QAAA,EAAA,MAAA;;kBASH,CAAA,CAAA,EAzJiB,OAyJjB,CAAA;IAGL,WAAA,EAAA,MAAA;IAQ8B,SAAA,EAAA,MAAA;;qBAc9B,CAAA,CAAA,EA3KyB,OA2KzB,CAAA;IAiBA,OAAA,EAAA,MAAA;IAkBS,QAAA,EAAA,MAAA;IAET,UAAA,EAAA,MAAA;IAcA,UAAA,EAAA,MAAA;IAY0C,iBAAA,EAAA,MAAA;IAU1C,cAAA,CAAA,EAAA,MAAA;IASA,aAAA,CAAA,EAAA,MAAA;IAWA,UAAA,CAAA,EAAA,MAAA;;kBAqBA,CAAA,IAAA,EAAA;IAWA,cAAA,EAAA,MAAA;IAaA,IAAA,CAAA,EAAA,MAAA;IAgBA,YAAA,CAAA,EArTa,MAqTb,CAAA,MAAA,EAAA,OAAA,CAAA;MApTA,OAsUA,CAAA;IAsBA,EAAA,EAAA,OAAA;IAsBA,UAAA,EAAA,MAAA;;mBAuBuC,CAAA,CAAA,EAlYhB,OAkYgB,CAAA;IAOnB,QAAA,EAAA;MAOc,EAAA,EAAA,MAAA;MAMjB,IAAA,EAAA,MAAA;MAiBjB,WAAA,CAAA,EAAA,MAAA;IAUA,CAAA,EAAA;;EAWO,kBAAA,CAAA,KAAA,EAAA;;;;QAtb8E;;;;;;;;;;;;;MAarF;;;;;;;;;WAgCK;;;MAGL,QAAQ;;;;;;;WAaH;;;;MAIL;;;;;WASK;;;;cAIG;;;MAGR;;;;;WAaK;;;MAGL,QAAQ;;;WAQH;;MAEL,QAAQ;;;WASH;;;MAGL;;sBAQsB,QAAQ;;;;;MAc9B;;;;;;;;;;;MAiBA;;;;;;;;;;;;eAkBS;;MAET;;;;;;;;;;;MAcA;;;0CAY0C;;;;;;;;;;;MAU1C;;;;;;;;;;MASA;;;;;;;;;;;;MAWA;;;;;;;;;;;MAWA;;;;;;MAUA;;;;;;;;;;MAWA;;;;;;;;;;MAaA;;;;;;;;;;;;;MAgBA;;;;;;;;;;;MAkBA;;;;;;;;;;;;;;;;;;;;;;;;MAsBA;;;;;;;;;;;;MAsBA;;;;wDAYwD;;;;uCAWjB;;;;;;;;;;;oBAOnB;;;;;;;;kCAOc;;;iBAMjB;;;;;;;;;;;;MAiBjB;;;;MAUA;;;;;MAWA"}
+{"version":3,"file":"index.d.cts","names":["PERMISSION_CATALOG","Record","TENANT_ALLOWED_SUBJECTS","TenantAllowedSubject","ResourceScope","RESOURCE_SCOPES","AccessLevel","ScopedAccess","AllScopedAccess","ResourceScope","DEFAULT_INTEGRATIONS","IntegrationVisibility","INTEGRATION_VISIBILITIES","IntegrationScope","INTEGRATION_SCOPES","IntegrationDesiredStatus","INTEGRATION_DESIRED_STATUSES","IntegrationActualStatus","INTEGRATION_ACTUAL_STATUSES","IntegrationInstall","Record","AgentIntegration","OrgIntegration","IntegrationConfigSchemaField","IntegrationConfigResult","RegistryEntry","ResourceScope","SecretScope","SECRET_SCOPES","EncryptedEnvelopeV1","SecretMetadata","SecretEnvelopeResponse","ScopeInfo","GeneratedDataKey"],"sources":["../../../packages-internal/types/dist/access.d.ts","../../../packages-internal/types/dist/integration.d.ts","../../../packages-internal/types/dist/secrets.d.ts","../src/index.ts"],"sourcesContent":["/**\n * Runtime catalog of declared permission subjects + allowed actions.\n *\n * Mirrors the compile-time `PermissionDefinitions` augmentation in\n * `@alfe/api-core/auriclabs-roles.ts`. Kept here so browser code\n * (dashboard) can consume it without pulling in server-only deps\n * (`@middy/core`, `aws-lambda`, etc.).\n */\nexport declare const PERMISSION_CATALOG: Record<string, readonly string[]>;\n/**\n * Subjects a tenant may grant via a custom role.\n *\n * Excludes `all` (platform-admin escape hatch) and `admin_*` subjects.\n */\nexport declare const TENANT_ALLOWED_SUBJECTS: readonly [\"agent\", \"sync\", \"integration\", \"secret\", \"database\", \"template\", \"org_file\", \"team\", \"project\", \"model_policy\", \"role_management\", \"billing\", \"identity\", \"token\", \"user\", \"gateway\", \"voice\"];\nexport type TenantAllowedSubject = (typeof TENANT_ALLOWED_SUBJECTS)[number];\n/**\n * The four resource scopes at which a permission can apply.\n * Order is meaningful: broader scopes first (`org`) → narrower last (`agent`).\n *\n * `IntegrationScope` in integration.ts and `SecretScope` in secrets.ts are\n * intentional aliases of this same enum — there is only one concept of\n * \"scope\" in Alfe.\n */\nexport declare const ResourceScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type ResourceScope = (typeof ResourceScope)[keyof typeof ResourceScope];\n/** Ordered tuple of resource scope string values (broad → narrow). */\nexport declare const RESOURCE_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\nexport declare const AccessLevel: {\n    readonly None: \"none\";\n    readonly Read: \"read\";\n    readonly Write: \"write\";\n    readonly Manage: \"manage\";\n};\nexport type AccessLevel = (typeof AccessLevel)[keyof typeof AccessLevel];\nexport interface ScopedAccess {\n    scope: ResourceScope;\n    scopeId: string;\n    accessLevel: AccessLevel;\n    /** Resolved role label (e.g. \"org_admin\", \"team_member\") */\n    role: string;\n}\nexport interface AllScopedAccess {\n    orgAccess: ScopedAccess;\n    teamAccess: ScopedAccess[];\n    projectAccess: ScopedAccess[];\n}\n//# sourceMappingURL=access.d.ts.map","import { ResourceScope } from \"./access.js\";\n/** Integrations auto-installed for ALL agents regardless of hosting type. Cannot be removed. */\nexport declare const DEFAULT_INTEGRATIONS: readonly string[];\n/** Controls where an integration appears: public (everyone), hidden (nowhere) */\nexport declare const IntegrationVisibility: {\n    readonly Public: \"public\";\n    readonly Hidden: \"hidden\";\n};\nexport type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];\nexport declare const INTEGRATION_VISIBILITIES: readonly [\"public\" | \"hidden\", ...(\"public\" | \"hidden\")[]];\n/** Scope at which an integration is installed */\nexport declare const IntegrationScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type IntegrationScope = ResourceScope;\nexport declare const INTEGRATION_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\nexport declare const IntegrationDesiredStatus: {\n    readonly Active: \"active\";\n    readonly Removed: \"removed\";\n};\nexport type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];\nexport declare const INTEGRATION_DESIRED_STATUSES: readonly [\"active\" | \"removed\", ...(\"active\" | \"removed\")[]];\nexport declare const IntegrationActualStatus: {\n    readonly Installing: \"installing\";\n    readonly Active: \"active\";\n    readonly Error: \"error\";\n    readonly Removing: \"removing\";\n    readonly Inactive: \"inactive\";\n    readonly Unknown: \"unknown\";\n};\nexport type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];\nexport declare const INTEGRATION_ACTUAL_STATUSES: readonly [\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\", ...(\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\")[]];\nexport interface IntegrationInstall {\n    scope: IntegrationScope;\n    scopeId: string;\n    integrationId: string;\n    tenantId: string;\n    desiredStatus: IntegrationDesiredStatus;\n    actualStatus: IntegrationActualStatus;\n    version: string;\n    config: Record<string, unknown>;\n    errorMessage: string;\n    installedAt: string;\n    updatedAt: string;\n}\n/** @deprecated Use IntegrationInstall instead */\nexport type AgentIntegration = IntegrationInstall;\n/** Org-scoped integration install */\nexport type OrgIntegration = IntegrationInstall;\nexport interface IntegrationConfigSchemaField {\n    key: string;\n    label: string;\n    type: string;\n    description?: string;\n    required?: boolean;\n    default?: string | number | boolean;\n    options?: string[];\n    select_options?: {\n        value: string;\n        label: string;\n    }[];\n    oauth_provider?: string;\n    oauth_scopes?: string[];\n    oauth_integration_id?: string;\n    editable?: string;\n    hidden?: boolean;\n}\nexport interface IntegrationConfigResult {\n    integrationId: string;\n    config: Record<string, unknown>;\n    configSchema: IntegrationConfigSchemaField[];\n}\nexport interface RegistryEntry {\n    id: string;\n    name: string;\n    description: string;\n    versions: string[];\n    latest: string;\n    repository: string;\n    commit: string;\n    icon?: string;\n    author?: {\n        name: string;\n        url?: string;\n    } | string;\n    pricing?: {\n        type: \"free\" | \"paid\" | \"usage\";\n        price?: number;\n        currency?: string;\n        interval?: \"month\" | \"year\";\n        description?: string;\n    };\n    features?: string[];\n    preview_images?: string[];\n    config_schema?: IntegrationConfigSchemaField[];\n    supported_agents?: string[];\n    /** Scopes where this integration can be installed */\n    supported_scopes?: IntegrationScope[];\n    /** Visibility status — controls where integration appears */\n    visibility?: IntegrationVisibility;\n}\n//# sourceMappingURL=integration.d.ts.map","/**\n * Secrets types — shared between services/secrets, @alfe.ai/agent-api-client,\n * the openclaw-secrets plugin, and dashboard clients.\n *\n * Server-side crypto and KMS glue live in @alfe/secret-store (Node/AWS-only);\n * this module is a pure, dependency-free shape contract safe for every\n * environment the agent-api-client ships to.\n */\nimport type { ResourceScope } from \"./access.js\";\n/** Scope levels at which a secret can be owned. Aliased to ResourceScope. */\nexport type SecretScope = ResourceScope;\nexport declare const SECRET_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\n/**\n * v1 encrypted envelope as persisted by services/secrets and exchanged with\n * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext\n * are all base64-encoded.\n */\nexport interface EncryptedEnvelopeV1 {\n    version: 1;\n    iv: string;\n    ciphertext: string;\n    authTag: string;\n    dataKeyCiphertext: string;\n}\n/** Opaque metadata about a secret row — never includes plaintext. */\nexport interface SecretMetadata {\n    secretId: string;\n    secretName: string;\n    description?: string;\n    tags?: string[];\n    createdAt: string;\n    updatedAt: string;\n    rotatedAt?: string;\n}\n/** A single secret row including its encrypted envelope. */\nexport interface SecretEnvelopeResponse extends SecretMetadata {\n    envelope: EncryptedEnvelopeV1;\n}\n/** A scope the caller can read or write secrets in. */\nexport interface ScopeInfo {\n    scope: SecretScope;\n    scopeId: string;\n    name?: string;\n}\n/**\n * KMS-issued data key, returned by the secrets service's\n * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is\n * returned base64-encoded; callers MUST decode it to a Buffer and zero the\n * Buffer after use — never keep the plaintext as a JS string.\n */\nexport interface GeneratedDataKey {\n    plaintextKey: string;\n    dataKeyCiphertext: string;\n}\n//# sourceMappingURL=secrets.d.ts.map"],"mappings":";;ACWA;AAMA;AAEA;AAIA;;;;;AAEqBiB,cDDAb,aCQpB,EAAA;EACWa,SAAAA,GAAAA,EAAAA,KAAAA;EAAuB,SAAA,IAAA,EAAA,MAAA;WAAWA,OAAAA,EAAAA,SAAAA;WAAsCA,KAAAA,EAAAA,OAAAA;CAAuB;AAE1FE,KDLLf,aAAAA,GCKuB,CAAA,ODLCA,aCKD,CAAA,CAAA,MAAA,ODL6BA,aCK7B,CAAA;;;;;ADLCA,cC1BfO,qBD0BeP,EAAAA;WAA4BA,MAAAA,EAAAA,QAAAA;EAAa,SAAA,MAAA,EAAA,QAAA;;KCtBjEO,qBAAAA,WAAgCA,oCAAoCA;AAJhF;AAIYA,cAGSE,gBAHY,EAAA;EAAA,SAAA,GAAA,EAAA,KAAA;WAAWF,IAAAA,EAAAA,MAAAA;WAAoCA,OAAAA,EAAAA,SAAAA;EAAqB,SAAA,KAAA,EAAA,OAAA;AAGrG,CAAA;AAMYE,KAAAA,gBAAAA,GAAmBJ,aAAAA;AAMnBM,cAJSA,wBAIe,EAAA;EAAA,SAAA,MAAA,EAAA,QAAA;WAAWA,OAAAA,EAAAA,SAAAA;;AAA+D,KAAlGA,wBAAAA,GAAkG,CAAA,OAA/DA,wBAA+D,CAAA,CAAA,MAAA,OAAxBA,wBAAwB,CAAA;AAUlGE,cARSA,uBAQc,EAAA;EAAA,SAAA,UAAA,EAAA,YAAA;WAAWA,MAAAA,EAAAA,QAAAA;WAAsCA,KAAAA,EAAAA,OAAAA;EAAuB,SAAA,QAAA,EAAA,UAAA;EAE1FE,SAAAA,QAAAA,EAAAA,UAAkB;EAAA,SAAA,OAAA,EAAA,SAAA;;AAKhBJ,KAPPE,uBAAAA,GAOOF,CAAAA,OAP2BE,uBAO3BF,CAAAA,CAAAA,MAAAA,OAPiEE,uBAOjEF,CAAAA;AAGPK,UARKD,kBAAAA,CAQLC;EAAM,KAAA,EAPPP,gBAOO;EASDU,OAAAA,EAAAA,MAAAA;EAkBAC,aAAAA,EAAAA,MAAAA;EAAuB,QAAA,EAAA,MAAA;eAE5BJ,EAhCOL,wBAgCPK;cACMG,EAhCAN,uBAgCAM;EAA4B,OAAA,EAAA,MAAA;EAE7BE,MAAAA,EAhCLL,MAgCKK,CAAAA,MAAa,EAAA,OAAA,CAAA;EAAA,YAAA,EAAA,MAAA;aAsBVF,EAAAA,MAAAA;WAGGV,EAAAA,MAAAA;;;;AC1FXc,UD0CKJ,4BAAAA,CC1CsB;EAOtBM,GAAAA,EAAAA,MAAAA;EAQAC,KAAAA,EAAAA,MAAAA;EAUAC,IAAAA,EAAAA,MAAAA;EAAsB,WAAA,CAAA,EAAA,MAAA;UACzBF,CAAAA,EAAAA,OAAAA;SADkCC,CAAAA,EAAAA,MAAAA,GAAAA,MAAAA,GAAAA,OAAAA;EAAc,OAAA,CAAA,EAAA,MAAA,EAAA;EAI7CE,cAAS,CAAA,EAAA;IAWTC,KAAAA,EAAAA,MAAAA;;;;ECjBA,YAAA,CAAA,EAAA,MAAA,EAAoB;EAOpB,oBAAa,CAAA,EAAA,MAAA;EAWb,QAAA,CAAA,EAAA,MAAA;EASA,MAAA,CAAA,EAAA,OAAY;;AAIL,UFMPT,uBAAAA,CENO;eAAf,EAAA,MAAA;EAAM,MAAA,EFQHJ,MERG,CAAA,MAAA,EAAA,OAAA,CAAA;EAGE,YAAA,EFMCG,4BENe,EAAA;AAMjC;AAQiB,UFNAE,aAAAA,CEMmB;EAQnB,EAAA,EAAA,MAAA;EASA,IAAA,EAAA,MAAA;EAQA,WAAA,EAAA,MAAa;EASb,QAAA,EAAA,MAAA,EAAA;EAQA,MAAA,EAAA,MAAA;EAMA,UAAA,EAAA,MAAe;EAenB,MAAA,EAAA,MAAA;EAAc,IAAA,CAAA,EAAA,MAAA;QAIL,CAAA,EAAA;IA6BkD,IAAA,EAAA,MAAA;IAAjB,GAAA,CAAA,EAAA,MAAA;MAOpB,MAAA;SAAR,CAAA,EAAA;IAML,IAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA;IAAhB,KAAA,CAAA,EAAA,MAAA;IAYQ,QAAA,CAAA,EAAA,MAAA;IAAR,QAAA,CAAA,EAAA,OAAA,GAAA,MAAA;IASQ,WAAA,CAAA,EAAA,MAAA;;UAOkB,CAAA,EAAA,MAAA,EAAA;gBAAR,CAAA,EAAA,MAAA,EAAA;eAI4C,CAAA,EF7HhDF,4BE6HgD,EAAA;kBAAjB,CAAA,EAAA,MAAA,EAAA;;kBAOvB,CAAA,EFjILV,gBEiIK,EAAA;;YAIe,CAAA,EFnI1BF,qBEmI0B;;;;;;AFrOtBA,KCMTgB,WAAAA,GAAcD,aDHzB;;;;;AAID;AAMYb,UCAKgB,mBAAAA,CDAcpB;EAEVM,OAAAA,EAAAA,CAAAA;EAITA,EAAAA,EAAAA,MAAAA;EAAwB,UAAA,EAAA,MAAA;SAAWA,EAAAA,MAAAA;mBAAuCA,EAAAA,MAAAA;;AAEtF;AAQYE,UCRKa,cAAAA,CDQkB;EAAA,QAAA,EAAA,MAAA;YAAWb,EAAAA,MAAAA;aAAsCA,CAAAA,EAAAA,MAAAA;EAAuB,IAAA,CAAA,EAAA,MAAA,EAAA;EAE1FE,SAAAA,EAAAA,MAAAA;EAAkB,SAAA,EAAA,MAAA;WACxBN,CAAAA,EAAAA,MAAAA;;;AAOCO,UCRKW,sBAAAA,SAA+BD,cDQpCV,CAAAA;EAAM,QAAA,ECPJS,mBDOI;AASlB;AAkBA;AAAwC,UC/BvBG,SAAAA,CD+BuB;OAE5BZ,EChCDO,WDgCCP;SACMG,EAAAA,MAAAA;EAA4B,IAAA,CAAA,EAAA,MAAA;AAE9C;;;;;;;UCzBiBU,gBAAAA;;EAxCLN,iBAAW,EAAA,MAAGD;AAO1B;AAQA;;;UCQiB,oBAAA;EF7BIf,MAAAA,EAAAA,MAAAA;EAITA,MAAAA,EAAAA,MAAAA;;AAAgCA,UEgC3B,aAAA,CFhC2BA;SAAoCA,EAAAA,MAAAA;EAAqB,QAAA,EAAA,MAAA;EAGhFE,WAAAA,EAAAA,MAKpB;EACWA,QAAAA,EAAAA,MAAAA;EAESE,MAAAA,EAAAA,OAAAA,GAAAA,SAGpB,GAAA,QAAA;EACWA,SAAAA,CAAAA,EAAAA,MAAAA;EAAwB,SAAA,CAAA,EAAA,MAAA;UAAWA,CAAAA,EAAAA,MAAAA;;AAA+D,UE4B7F,iBAAA,CF5B6F;EAEzFE,IAAAA,EAAAA,MAAAA;EAQTA,IAAAA,EAAAA,MAAAA;EAAuB,QAAA,EAAA,MAAA;MAAWA,CAAAA,EAAAA,MAAAA;cAAsCA,CAAAA,EAAAA,MAAAA;EAAuB,UAAA,CAAA,EAAA,OAAA;AAE3G;AAAmC,UEyBlB,YAAA,CFzBkB;SACxBJ,EAAAA,CAAAA;SAIQE,EAAAA,MAAAA;UACDE,EAAAA,MAAAA;OAENG,EEqBH,MFrBGA,CAAAA,MAAAA,EEqBY,iBFrBZA,CAAAA;;AASKG,UEeA,gBAAA,CFfAA;EAkBAC,IAAAA,EAAAA,MAAAA;EAAuB,GAAA,EAAA,MAAA;WAE5BJ,EAAAA,MAAAA;;AACkC,UEA7B,mBAAA,CFA6B;EAE7BK,QAAAA,EAAAA,MAAa;EAAA,IAAA,EAAA,MAAA;MAsBVF,EAAAA,MAAAA;cAGGV,EAAAA,UAAAA,GAAAA,YAAAA;UAENF,EAAAA,MAAAA;;UErBA,mBAAA;;;EDvELgB,GAAAA,EAAAA,MAAAA;EAOKE,YAAAA,CAAAA,EAAAA,MAAAA;EAQAC,UAAAA,CAAAA,EAAAA,OAAc;AAU/B;AAAuC,UCsDtB,qBAAA,CDtDsB;SACzBD,EAAAA,MAAAA;MADkCC,EAAAA,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;EAAc,SAAA,EAAA,MAAA;EAI7CE,SAAAA,EAAAA,MAAS;EAWTC,KAAAA,EC4CR,mBD5CwB,EAAA;;;UCgDhB,cAAA;EAjEA,OAAA,EAAA,MAAA;EAOA,aAAA,EAAA,MAAa;EAWb,YAAA,EAAA,MAAiB;EASjB,SAAA,EAAA,MAAY;EAAA,UAAA,EAAA,MAAA,GAAA,IAAA;;AAIpB,UA0CQ,aAAA,CA1CR;EAAM,QAAA,EAAA,MAAA;EAGE,IAAA,EAAA,MAAA;EAMA,QAAA,EAAA,MAAA;EAQA,WAAA,EAAA,MAAA;EAQA,YAAA,CAAA,EAAA,MAAA;EASA,UAAA,CAAA,EAAA,OAAc;AAQ/B;AASiB,UAAA,gBAAA,CAAgB;EAQhB,SAAA,EAAA,MAAA;EAMA,IAAA,EAAA,MAAA;EAeJ,YAAA,EAAA,MAAc;EAAA,YAAA,CAAA,EAAA,MAAA;YAIL,EAAA,OAAA;;AA6BiC,UAtDtC,kBAAA,CAsDsC;WAOpB,EAAA,MAAA;SAAR,EAAA,MAAA;YAML,EAAA,OAAA;;AAYR,UAzEG,eAAA,CAyEH;UAAR,EAAA,MAAA;UASQ,EAAA,MAAA;MAAR,EAAA,MAAA;aAO0B,CAAA,EAAA,MAAA;;AAIoC,cA9EvD,cAAA,CA8EuD;mBAAjB,MAAA;mBAOH,MAAA;aAApB,CAAA,MAAA,EAjFN,oBAiFM;UAIuB,OAAA;cAAR,CAAA,KAAA,EAAA;IAID,WAAA,CAAA,EAAA,MAAA;MA5Da,OA0EhC,CAAA;IAAjB,KAAA,EA1EkE,aA0ElE;;iBAgB8B,CAAA,CAAA,EAnFT,OAmFS,CAnFD,YAmFC,CAAA;aAAR,CAAA,IAAA,EAAA;IAIiC,KAAA,EAAA;MAAR,IAAA,EAAA,MAAA;MAQzC,SAAA,EAAA,KAAA,GAAA,KAAA;MACP,WAAA,CAAA,EAAA,MAAA;IAYsC,CAAA,EAAA;MAtGrC,OAuGO,CAAA;IAAR,IAAA,EAvGiB,gBAuGjB,EAAA;;mBAW6C,CAAA,IAAA,EAAA;IAU7C,QAAA,EAAA,MAAA;IAQyD,IAAA,EAAA,MAAA;IAAzD,IAAA,EAAA,MAAA;IAM0C,YAAA,CAAA,EAAA,UAAA,GAAA,YAAA;MA9HzC,OA8HiB,CA9HT,mBA8HS,CAAA;iBAIS,CAAA,IAAA,EAAA;IAoBgB,IAAA,EAAA,MAAA,GAAA,QAAA,GAAA,QAAA;MA7I1C,OAqJ0C,CArJlC,qBAqJkC,CAAA;cAQZ,CAAA,CAAA,EAtJZ,OAsJY,CAtJJ,cAsJI,CAAA;eAUJ,CAAA,KAAA,EAAA;IAOF,MAAA,CAAA,EAAA,MAAA;MAnKqB,OA2KvB,CAAA;IAOI,KAAA,EAlLoC,aAkLpC,EAAA;;kBAuBC,CAAA,CAAA,EAlML,OAkMK,CAAA;IAOH,QAAA,EAzMkB,gBAyMlB,EAAA;;gBAgBC,CAAA,SAAA,EAAA,MAAA,CAAA,EArNY,OAqNZ,CArNoB,kBAqNpB,CAAA;gBAgBZ,CAAA,QAAA,EAAA,MAAA,CAAA,EAjOuB,OAiOvB,CAAA;IACb,OAAA,EAAA,OAAA;;iBAaqF,CAAA,IAAA,EAAA;IAarF,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAgCK,OAAA,EAAA,MAAA;MA9QL,OAiRQ,CAAA;IAAR,KAAA,EAjRiB,eAiRjB,EAAA;IAaK,UAAA,EAAA,MAAA,GAAA,IAAA;;mBAaA,CAAA,IAAA,EAAA;IAIG,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAGR,OAAA,EAAA,MAAA;IAaK,QAAA,EAAA,MAAA;MArTL,OAwTQ,CAAA;IAAR,WAAA,EAAA,MAAA;IAQK,SAAA,EAAA,MAAA;;kBAEL,CAAA,CAAA,EA5TsB,OA4TtB,CA5T8B,kBA4T9B,EAAA,CAAA;sBASK,CAAA,aAAA,EAAA,MAAA,CAAA,EAjU0C,OAiU1C,CAjUkD,uBAiUlD,CAAA;yBAGL,CAAA,aAAA,EAAA,MAAA,EAAA,MAAA,EA5TM,MA4TN,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EA3TD,OA2TC,CAAA,IAAA,CAAA;oBAQ8B,CAAA,aAAA,EAAA,MAAA,EAAA,QAAA,EAAA;IAAR,OAAA,CAAA,EAAA,MAAA;IAetB,MAAA,CAAA,EAtUqC,MAsUrC,CAAA,MAAA,EAAA,OAAA,CAAA;MArUD,OAsVC,CAtVO,kBAsVP,CAAA;mBAS0C,CAAA,aAAA,EAAA,MAAA,CAAA,EApVE,OAoVF,CApVU,kBAoVV,CAAA;aAS1C,CAAA,QAAA,EAAA,MAAA,EAAA,MAAA,CAAA,EAAA,MAAA,EAAA,CAAA,EAnVD,OAmVC,CAAA;IASA,GAAA,EAAA,MAAA;IAWA,QAAA,EAAA,MAAA;IAWA,SAAA,EAAA,MAAA;;gBAmBA,CAAA,QAAA,EAAA,MAAA,CAAA,EA7XD,OA6XC,CAAA;IAkBA,QAAA,EAAA,MAAA;IAiBA,SAAA,EAAA,OAAA;IA2BD,MAAA,CAAA,EA3byD,MA2bzD,CAAA,MAAA,EAAA,MAAA,CAAA;;aAqCC,CAAA,CAAA,EA1diB,OA0djB,CAAA;IAsBA,YAAA,EAhfyC,aAgfzC,EAAA;;sBAkCwD,CAAA,CAAA,EA9gB9B,OA8gB8B,CAAA;IAWjB,QAAA,CAAA,EAAA;MAOnB,KAAA,EAAA,MAAA;MAOc,YAAA,EAAA,MAAA;MAMjB,QAAA,EAAA,MAAA;MAiBjB,YAAA,EAAA,MAAA;MAUA,eAAA,CAAA,EAAA,MAAA,EAAA;MAWA,SAAA,EAAA,OAAA;MASiC,WAAA,CAAA,EAAA,MAAA;IAcjC,CAAA,EAAA;IAAO,KAAA,EAAA,MAAA;;;;;;;0CAtlBmC;;;;;;;0CAQA;;;;;;;8BAQZ;;;;;;;0BAUJ;;;;wBAOF;;;;;sBAQF;;;;0BAOI;;;;;6BAQG;;;;;;;;;;;;2BAeF;;;;wBAOH;;;;;;sBASF;;;;yBAOG;;;;;;;;;;;;;mBAgBZ;MACb;;;;uBAOuB;;;;;;;;;;;QAM8D;;;;;;;;;;;;;MAarF;;;;;;;;;WAgCK;;;MAGL,QAAQ;;;;;;;WAaH;;;;MAIL;;;;;WASK;;;;cAIG;;;MAGR;;;;;WAaK;;;MAGL,QAAQ;;;WAQH;;MAEL,QAAQ;;;WASH;;;MAGL;;sBAQsB,QAAQ;;;;;;MAe9B;;;;;;;;;;;MAiBA;;;0CAS0C;;;;;;;;;;MAS1C;;;;;;;;;;MASA;;;;;;;;;;;;MAWA;;;;;;;;;;;MAWA;;;;;MASA;;;;;;;;;;MAUA;;;;;;;;;;;;;;;;;;MAkBA;;;;;;;;;;;;;;;;MAiBA;;;;;;;;;;;;;;;;;;MA2BD;;;;;;;;;;;MAeC;;;;;;;;;;;MAsBA;;;;;;;;;;;;;;;;;;;;;;;;MAsBA;;;;;;;;;;;;MAsBA;;;;wDAYwD;;;;uCAWjB;;;;;;;;;;;oBAOnB;;;;;;;;kCAOc;;;iBAMjB;;;;;;;;;;;;MAiBjB;;;;MAUA;;;;;MAWA;iCASiC;;;;;;;;;;;MAcjC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 //#region ../../packages-internal/types/dist/access.d.ts
+
 /**
  * The four resource scopes at which a permission can apply.
  * Order is meaningful: broader scopes first (`org`) → narrower last (`agent`).
@@ -166,11 +167,147 @@ interface AgentApiClientConfig {
   apiKey: string;
   apiUrl: string;
 }
+interface SyncAgentInfo {
+  agentId: string;
+  tenantId: string;
+  displayName: string;
+  s3Prefix: string;
+  status: "stale" | "syncing" | "synced";
+  fileCount?: number;
+  totalSize?: number;
+  lastSync?: string;
+}
+interface SyncManifestEntry {
+  hash: string;
+  size: number;
+  modified: string;
+  etag?: string;
+  storageClass?: string;
+  compressed?: boolean;
+}
+interface SyncManifest {
+  version: 1;
+  agentId: string;
+  lastSync: string;
+  files: Record<string, SyncManifestEntry>;
+}
+interface SyncPresignedUrl {
+  path: string;
+  url: string;
+  expiresAt: string;
+}
+interface SyncConfirmedUpload {
+  filePath: string;
+  hash: string;
+  size: number;
+  storageClass: "STANDARD" | "GLACIER_IR";
+  syncedAt: string;
+}
+interface SyncReconstructFile {
+  path: string;
+  size: number;
+  url: string;
+  storageClass?: string;
+  compressed?: boolean;
+}
+interface SyncReconstructBundle {
+  agentId: string;
+  mode: "full" | "active" | "memory";
+  fileCount: number;
+  totalSize: number;
+  files: SyncReconstructFile[];
+  expiresAt: string;
+}
+interface SyncAgentStats {
+  agentId: string;
+  standardBytes: number;
+  glacierBytes: number;
+  fileCount: number;
+  lastSyncAt: string | null;
+}
+interface SyncFileEntry {
+  filePath: string;
+  size: number;
+  modified: string;
+  contentHash: string;
+  storageClass?: string;
+  compressed?: boolean;
+}
+interface SyncSessionEntry {
+  sessionId: string;
+  size: number;
+  lastModified: string;
+  storageClass?: string;
+  isArchived: boolean;
+}
+interface SyncSessionContent {
+  sessionId: string;
+  content: string;
+  compressed: boolean;
+}
+interface SharedFileEntry {
+  filePath: string;
+  fileName: string;
+  size: number;
+  contentType?: string;
+}
 declare class AgentApiClient {
   private readonly apiKey;
   private readonly apiUrl;
   constructor(config: AgentApiClientConfig);
   private request;
+  syncRegister(args?: {
+    displayName?: string;
+  }): Promise<{
+    agent: SyncAgentInfo;
+  }>;
+  syncGetManifest(): Promise<SyncManifest>;
+  syncPresign(args: {
+    files: {
+      path: string;
+      operation: "put" | "get";
+      contentType?: string;
+    }[];
+  }): Promise<{
+    urls: SyncPresignedUrl[];
+  }>;
+  syncConfirmUpload(args: {
+    filePath: string;
+    hash: string;
+    size: number;
+    storageClass?: "STANDARD" | "GLACIER_IR";
+  }): Promise<SyncConfirmedUpload>;
+  syncReconstruct(args: {
+    mode: "full" | "active" | "memory";
+  }): Promise<SyncReconstructBundle>;
+  syncGetStats(): Promise<SyncAgentStats>;
+  syncListFiles(args?: {
+    prefix?: string;
+  }): Promise<{
+    files: SyncFileEntry[];
+  }>;
+  syncListSessions(): Promise<{
+    sessions: SyncSessionEntry[];
+  }>;
+  syncGetSession(sessionId: string): Promise<SyncSessionContent>;
+  syncDeleteFile(filePath: string): Promise<{
+    removed: boolean;
+  }>;
+  sharedListFiles(args: {
+    scope: "org" | "team" | "project";
+    scopeId: string;
+  }): Promise<{
+    files: SharedFileEntry[];
+    nextCursor: string | null;
+  }>;
+  sharedDownloadUrl(args: {
+    scope: "org" | "team" | "project";
+    scopeId: string;
+    filePath: string;
+  }): Promise<{
+    downloadUrl: string;
+    expiresIn: number;
+  }>;
   listIntegrations(): Promise<IntegrationInstall[]>;
   getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult>;
   updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;
@@ -374,8 +511,9 @@ declare class AgentApiClient {
   /** Enumerate scopes (org/team/project/agent) this agent can access. */
   listSecretScopes(): Promise<ScopeInfo[]>;
   resolveIdentity(args: {
-    platform: string;
+    provider: string;
     platformId: string;
+    kind?: "user" | "agent" | "service" | "bot" | "workspace";
     displayName?: string;
   }): Promise<{
     identityId: string | null;
@@ -384,41 +522,15 @@ declare class AgentApiClient {
     created?: boolean;
     reason?: string;
   }>;
-  enforcePolicy(args: {
-    platform: string;
-    senderId: string;
-    channelId?: string;
-  }): Promise<{
-    identityId: string | null;
-    orgId: string | null;
-    role: string | null;
-    allowedTools: string[];
-    deniedTools: string[];
-    identified: boolean;
-  }>;
-  checkToolPermission(args: {
-    platform: string;
-    senderId: string;
-    toolName: string;
-    toolArgs?: Record<string, unknown>;
-    channelId?: string;
-  }): Promise<{
-    allowed: boolean;
-    reason?: string;
-  }>;
   searchIdentities(args?: {
     q?: string;
     status?: string;
-    tag?: string;
-    platform?: string;
     limit?: number;
-    offset?: number;
   }): Promise<{
     identities: unknown[];
   }>;
   getIdentityContext(identityId: string): Promise<{
-    identity: unknown;
-    recentChanges: unknown[];
+    context: unknown;
   }>;
   mergeIdentities(survivorId: string, args: {
     mergedId: string;
@@ -465,7 +577,6 @@ declare class AgentApiClient {
   }>;
   getIdentityChangelog(identityId: string, args?: {
     limit?: number;
-    offset?: number;
   }): Promise<{
     entries: unknown[];
   }>;
@@ -483,9 +594,17 @@ declare class AgentApiClient {
   requestIdentityVerification(args: {
     claimedIdentityId: string;
     requestingIdentityId: string;
-    requestingPlatform: string;
+    requestingProvider: string;
     requestingPlatformId: string;
-    preferredChannel?: "sms" | "email";
+    preferredChannel?: "mobile" | "email";
+    /**
+     * Phase 2: agent-supplied contact endpoint. When provided, the top-level
+     * `preferredChannel` is ignored — the contact's channel wins.
+     */
+    contact?: {
+      channel: "email" | "mobile";
+      value: string;
+    };
   }): Promise<{
     verificationId: string;
     channel: string;
@@ -495,15 +614,47 @@ declare class AgentApiClient {
       channel: string;
       deliveredTo: string;
     }[];
+  } | {
+    error: string;
   }>;
   confirmIdentityVerification(args: {
+    claimedIdentityId: string;
     verificationId: string;
     phrase: string;
   }): Promise<{
     verified: boolean;
     identityId?: string;
+    /** Phase 2: how the confirm resolved — Scenario A vs B. */
+    action?: "merged" | "contact_verified";
     error?: string;
   }>;
+  /**
+   * Update display-shape fields on an Identity. Body excludes `email` /
+   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
+   * via the verify flow, title/company live on OrgMembership, metadata is
+   * not agent-writable.
+   */
+  updateIdentity(identityId: string, args: {
+    name?: string;
+    avatarUrl?: string;
+    timezone?: string;
+    locale?: string;
+  }): Promise<{
+    ok: boolean;
+  }>;
+  /**
+   * Phase 2 (Section H): server-side verification of a Google Chat sender via
+   * the agent's existing Google OAuth credentials. Returns the resolved
+   * identity (created or matched via Scenario-B email enrichment).
+   */
+  resolveGoogleChatSender(args: {
+    senderUserId: string;
+    spaceId?: string;
+  }): Promise<{
+    identityId: string | null;
+    status: string;
+    accessAllowed: boolean;
+  }>;
   memorySearch(query: string, opts?: {
     limit?: number;
     topic?: string;
@@ -598,8 +749,20 @@ declare class AgentApiClient {
     count?: number;
     freshness?: string;
   }): Promise<unknown>;
+  registerDatabaseCredentials(): Promise<{
+    connectionString: string;
+    username: string;
+    password: string;
+    databases: string[];
+  }>;
+  reportDatabaseAudit(entry: {
+    database: string;
+    collection: string;
+    operation: string;
+    summary?: string;
+  }): Promise<void>;
 }
 //# sourceMappingURL=index.d.ts.map
 //#endregion
-export { AgentApiClient, AgentApiClientConfig, type EncryptedEnvelopeV1, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretEnvelopeResponse, type SecretMetadata, type SecretScope };
+export { AgentApiClient, AgentApiClientConfig, type EncryptedEnvelopeV1, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretEnvelopeResponse, type SecretMetadata, type SecretScope, SharedFileEntry, SyncAgentInfo, SyncAgentStats, SyncConfirmedUpload, SyncFileEntry, SyncManifest, SyncManifestEntry, SyncPresignedUrl, SyncReconstructBundle, SyncReconstructFile, SyncSessionContent, SyncSessionEntry };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":["ResourceScope","RESOURCE_SCOPES","AccessLevel","ScopedAccess","AllScopedAccess","ResourceScope","DEFAULT_INTEGRATIONS","IntegrationVisibility","INTEGRATION_VISIBILITIES","IntegrationScope","INTEGRATION_SCOPES","IntegrationDesiredStatus","INTEGRATION_DESIRED_STATUSES","IntegrationActualStatus","INTEGRATION_ACTUAL_STATUSES","IntegrationInstall","Record","AgentIntegration","OrgIntegration","IntegrationConfigSchemaField","IntegrationConfigResult","RegistryEntry","ResourceScope","SecretScope","SECRET_SCOPES","EncryptedEnvelopeV1","SecretMetadata","SecretEnvelopeResponse","ScopeInfo","GeneratedDataKey"],"sources":["../../../packages-internal/types/dist/access.d.ts","../../../packages-internal/types/dist/integration.d.ts","../../../packages-internal/types/dist/secrets.d.ts","../src/index.ts"],"sourcesContent":["/**\n * The four resource scopes at which a permission can apply.\n * Order is meaningful: broader scopes first (`org`) → narrower last (`agent`).\n *\n * `IntegrationScope` in integration.ts and `SecretScope` in secrets.ts are\n * intentional aliases of this same enum — there is only one concept of\n * \"scope\" in Alfe.\n */\nexport declare const ResourceScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type ResourceScope = (typeof ResourceScope)[keyof typeof ResourceScope];\n/** Ordered tuple of resource scope string values (broad → narrow). */\nexport declare const RESOURCE_SCOPES: readonly [\"org\" | \"team\" | \"project\" | \"agent\", ...(\"org\" | \"team\" | \"project\" | \"agent\")[]];\nexport declare const AccessLevel: {\n    readonly None: \"none\";\n    readonly Read: \"read\";\n    readonly Write: \"write\";\n    readonly Manage: \"manage\";\n};\nexport type AccessLevel = (typeof AccessLevel)[keyof typeof AccessLevel];\nexport interface ScopedAccess {\n    scope: ResourceScope;\n    scopeId: string;\n    accessLevel: AccessLevel;\n    /** Resolved role label (e.g. \"org_admin\", \"team_member\") */\n    role: string;\n}\nexport interface AllScopedAccess {\n    orgAccess: ScopedAccess;\n    teamAccess: ScopedAccess[];\n    projectAccess: ScopedAccess[];\n}\n//# sourceMappingURL=access.d.ts.map","import { ResourceScope } from \"./access.js\";\n/** Integrations auto-installed for ALL agents regardless of hosting type. Cannot be removed. */\nexport declare const DEFAULT_INTEGRATIONS: readonly string[];\n/** Controls where an integration appears: public (everyone), hidden (nowhere) */\nexport declare const IntegrationVisibility: {\n    readonly Public: \"public\";\n    readonly Hidden: \"hidden\";\n};\nexport type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];\nexport declare const INTEGRATION_VISIBILITIES: readonly [\"public\" | \"hidden\", ...(\"public\" | \"hidden\")[]];\n/** Scope at which an integration is installed */\nexport declare const IntegrationScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type IntegrationScope = ResourceScope;\nexport declare const INTEGRATION_SCOPES: readonly [\"org\" | \"team\" | \"project\" | \"agent\", ...(\"org\" | \"team\" | \"project\" | \"agent\")[]];\nexport declare const IntegrationDesiredStatus: {\n    readonly Active: \"active\";\n    readonly Removed: \"removed\";\n};\nexport type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];\nexport declare const INTEGRATION_DESIRED_STATUSES: readonly [\"active\" | \"removed\", ...(\"active\" | \"removed\")[]];\nexport declare const IntegrationActualStatus: {\n    readonly Installing: \"installing\";\n    readonly Active: \"active\";\n    readonly Error: \"error\";\n    readonly Removing: \"removing\";\n    readonly Inactive: \"inactive\";\n    readonly Unknown: \"unknown\";\n};\nexport type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];\nexport declare const INTEGRATION_ACTUAL_STATUSES: readonly [\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\", ...(\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\")[]];\nexport interface IntegrationInstall {\n    scope: IntegrationScope;\n    scopeId: string;\n    integrationId: string;\n    tenantId: string;\n    desiredStatus: IntegrationDesiredStatus;\n    actualStatus: IntegrationActualStatus;\n    version: string;\n    config: Record<string, unknown>;\n    errorMessage: string;\n    installedAt: string;\n    updatedAt: string;\n}\n/** @deprecated Use IntegrationInstall instead */\nexport type AgentIntegration = IntegrationInstall;\n/** Org-scoped integration install */\nexport type OrgIntegration = IntegrationInstall;\nexport interface IntegrationConfigSchemaField {\n    key: string;\n    label: string;\n    type: string;\n    description?: string;\n    required?: boolean;\n    default?: string | number | boolean;\n    options?: string[];\n    select_options?: {\n        value: string;\n        label: string;\n    }[];\n    oauth_provider?: string;\n    oauth_scopes?: string[];\n    oauth_integration_id?: string;\n    editable?: string;\n    hidden?: boolean;\n}\nexport interface IntegrationConfigResult {\n    integrationId: string;\n    config: Record<string, unknown>;\n    configSchema: IntegrationConfigSchemaField[];\n}\nexport interface RegistryEntry {\n    id: string;\n    name: string;\n    description: string;\n    versions: string[];\n    latest: string;\n    repository: string;\n    commit: string;\n    icon?: string;\n    author?: {\n        name: string;\n        url?: string;\n    } | string;\n    pricing?: {\n        type: \"free\" | \"paid\" | \"usage\";\n        price?: number;\n        currency?: string;\n        interval?: \"month\" | \"year\";\n        description?: string;\n    };\n    features?: string[];\n    preview_images?: string[];\n    config_schema?: IntegrationConfigSchemaField[];\n    supported_agents?: string[];\n    /** Scopes where this integration can be installed */\n    supported_scopes?: IntegrationScope[];\n    /** Visibility status — controls where integration appears */\n    visibility?: IntegrationVisibility;\n}\n//# sourceMappingURL=integration.d.ts.map","/**\n * Secrets types — shared between services/secrets, @alfe.ai/agent-api-client,\n * the openclaw-secrets plugin, and dashboard clients.\n *\n * Server-side crypto and KMS glue live in @alfe/secret-store (Node/AWS-only);\n * this module is a pure, dependency-free shape contract safe for every\n * environment the agent-api-client ships to.\n */\nimport type { ResourceScope } from \"./access.js\";\n/** Scope levels at which a secret can be owned. Aliased to ResourceScope. */\nexport type SecretScope = ResourceScope;\nexport declare const SECRET_SCOPES: readonly [\"org\" | \"team\" | \"project\" | \"agent\", ...(\"org\" | \"team\" | \"project\" | \"agent\")[]];\n/**\n * v1 encrypted envelope as persisted by services/secrets and exchanged with\n * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext\n * are all base64-encoded.\n */\nexport interface EncryptedEnvelopeV1 {\n    version: 1;\n    iv: string;\n    ciphertext: string;\n    authTag: string;\n    dataKeyCiphertext: string;\n}\n/** Opaque metadata about a secret row — never includes plaintext. */\nexport interface SecretMetadata {\n    secretId: string;\n    secretName: string;\n    description?: string;\n    tags?: string[];\n    createdAt: string;\n    updatedAt: string;\n    rotatedAt?: string;\n}\n/** A single secret row including its encrypted envelope. */\nexport interface SecretEnvelopeResponse extends SecretMetadata {\n    envelope: EncryptedEnvelopeV1;\n}\n/** A scope the caller can read or write secrets in. */\nexport interface ScopeInfo {\n    scope: SecretScope;\n    scopeId: string;\n    name?: string;\n}\n/**\n * KMS-issued data key, returned by the secrets service's\n * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is\n * returned base64-encoded; callers MUST decode it to a Buffer and zero the\n * Buffer after use — never keep the plaintext as a JS string.\n */\nexport interface GeneratedDataKey {\n    plaintextKey: string;\n    dataKeyCiphertext: string;\n}\n//# sourceMappingURL=secrets.d.ts.map"],"mappings":";;AAQA;AAMA;;;;;;cANqBA;;ECJAO,SAAAA,IAAAA,EAAAA,MAAAA;EAITA,SAAAA,OAAAA,EAAAA,SAAqB;EAAA,SAAA,KAAA,EAAA,OAAA;;AAA+CA,KDMpEP,aAAAA,GCNoEO,CAAAA,ODM5CP,aCN4CO,CAAAA,CAAAA,MAAAA,ODMhBP,aCNgBO,CAAAA;;;;;ADM5CP,cCVfO,qBDUeP,EAAAA;WAA4BA,MAAAA,EAAAA,QAAAA;EAAa,SAAA,MAAA,EAAA,QAAA;;KCNjEO,qBAAAA,WAAgCA,oCAAoCA;AAJhF;AAIYA,cAGSE,gBAHY,EAAA;EAAA,SAAA,GAAA,EAAA,KAAA;WAAWF,IAAAA,EAAAA,MAAAA;WAAoCA,OAAAA,EAAAA,SAAAA;EAAqB,SAAA,KAAA,EAAA,OAAA;AAGrG,CAAA;AAMYE,KAAAA,gBAAAA,GAAmBJ,aAAAA;AAMnBM,cAJSA,wBAIe,EAAA;EAAA,SAAA,MAAA,EAAA,QAAA;WAAWA,OAAAA,EAAAA,SAAAA;;AAA+D,KAAlGA,wBAAAA,GAAkG,CAAA,OAA/DA,wBAA+D,CAAA,CAAA,MAAA,OAAxBA,wBAAwB,CAAA;AAUlGE,cARSA,uBAQc,EAAA;EAAA,SAAA,UAAA,EAAA,YAAA;WAAWA,MAAAA,EAAAA,QAAAA;WAAsCA,KAAAA,EAAAA,OAAAA;EAAuB,SAAA,QAAA,EAAA,UAAA;EAE1FE,SAAAA,QAAAA,EAAAA,UAAkB;EAAA,SAAA,OAAA,EAAA,SAAA;;AAKhBJ,KAPPE,uBAAAA,GAOOF,CAAAA,OAP2BE,uBAO3BF,CAAAA,CAAAA,MAAAA,OAPiEE,uBAOjEF,CAAAA;AAGPK,UARKD,kBAAAA,CAQLC;EAAM,KAAA,EAPPP,gBAOO;EASDU,OAAAA,EAAAA,MAAAA;EAkBAC,aAAAA,EAAAA,MAAAA;EAAuB,QAAA,EAAA,MAAA;eAE5BJ,EAhCOL,wBAgCPK;cACMG,EAhCAN,uBAgCAM;EAA4B,OAAA,EAAA,MAAA;EAE7BE,MAAAA,EAhCLL,MAgCKK,CAAAA,MAAa,EAAA,OAAA,CAAA;EAAA,YAAA,EAAA,MAAA;aAsBVF,EAAAA,MAAAA;WAGGV,EAAAA,MAAAA;;;;AC1FXc,UD0CKJ,4BAAAA,CC1CsB;EAOtBM,GAAAA,EAAAA,MAAAA;EAQAC,KAAAA,EAAAA,MAAAA;EAUAC,IAAAA,EAAAA,MAAAA;EAAsB,WAAA,CAAA,EAAA,MAAA;UACzBF,CAAAA,EAAAA,OAAAA;SADkCC,CAAAA,EAAAA,MAAAA,GAAAA,MAAAA,GAAAA,OAAAA;EAAc,OAAA,CAAA,EAAA,MAAA,EAAA;EAI7CE,cAAS,CAAA,EAAA;IAWTC,KAAAA,EAAAA,MAAAA;;;;ECjBA,YAAA,CAAA,EAAA,MAAA,EAAoB;EAKxB,oBAAc,CAAA,EAAA,MAAA;EAAA,QAAA,CAAA,EAAA,MAAA;QAIL,CAAA,EAAA,OAAA;;AAsBM,UFMXT,uBAAAA,CENW;eAIiC,EAAA,MAAA;QAAR,EFIzCJ,MEJyC,CAAA,MAAA,EAAA,OAAA,CAAA;cAQzC,EFHMG,4BEGN,EAAA;;AAa+B,UFd1BE,aAAAA,CEc0B;MAC9B,MAAA;MAAR,EAAA,MAAA;aAWqD,EAAA,MAAA;UAAR,EAAA,MAAA,EAAA;QAU7C,EAAA,MAAA;YAQyD,EAAA,MAAA;QAAzD,EAAA,MAAA;MAM0C,CAAA,EAAA,MAAA;QAAxB,CAAA,EAAA;IAIS,IAAA,EAAA,MAAA;IAoBgB,GAAA,CAAA,EAAA,MAAA;MAQA,MAAA;SAQZ,CAAA,EAAA;IAUJ,IAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA;IAOF,KAAA,CAAA,EAAA,MAAA;IAQF,QAAA,CAAA,EAAA,MAAA;IAOI,QAAA,CAAA,EAAA,OAAA,GAAA,MAAA;IAQG,WAAA,CAAA,EAAA,MAAA;;UAsBL,CAAA,EAAA,MAAA,EAAA;gBASF,CAAA,EAAA,MAAA,EAAA;eAOG,CAAA,EFlJXF,4BEkJW,EAAA;kBAgBZ,CAAA,EAAA,MAAA,EAAA;;kBAQU,CAAA,EFvKNV,gBEuKM,EAAA;;YAmBvB,CAAA,EFxLWF,qBEwLX;;;;;;AF1ReA,KCMTgB,WAAAA,GAAcD,aDHzB;;;;;AAID;AAMYb,UCAKgB,mBAAAA,CDAcpB;EAEVM,OAAAA,EAAAA,CAAAA;EAITA,EAAAA,EAAAA,MAAAA;EAAwB,UAAA,EAAA,MAAA;SAAWA,EAAAA,MAAAA;mBAAuCA,EAAAA,MAAAA;;AAEtF;AAQYE,UCRKa,cAAAA,CDQkB;EAAA,QAAA,EAAA,MAAA;YAAWb,EAAAA,MAAAA;aAAsCA,CAAAA,EAAAA,MAAAA;EAAuB,IAAA,CAAA,EAAA,MAAA,EAAA;EAE1FE,SAAAA,EAAAA,MAAAA;EAAkB,SAAA,EAAA,MAAA;WACxBN,CAAAA,EAAAA,MAAAA;;;AAOCO,UCRKW,sBAAAA,SAA+BD,cDQpCV,CAAAA;EAAM,QAAA,ECPJS,mBDOI;AASlB;AAkBA;AAAwC,UC/BvBG,SAAAA,CD+BuB;OAE5BZ,EChCDO,WDgCCP;SACMG,EAAAA,MAAAA;EAA4B,IAAA,CAAA,EAAA,MAAA;AAE9C;;;;;;;UCzBiBU,gBAAAA;;EAxCLN,iBAAW,EAAA,MAAGD;AAO1B;AAQA;;;UCQiB,oBAAA;EF7BIf,MAAAA,EAAAA,MAAAA;EAITA,MAAAA,EAAAA,MAAAA;;AAAgCA,cE8B/B,cAAA,CF9B+BA;mBAAoCA,MAAAA;EAAqB,iBAAA,MAAA;EAGhFE,WAAAA,CAAAA,MAAAA,EE+BC,oBF1BrB;EACWA,QAAAA,OAAAA;EAESE,gBAAAA,CAAAA,CAAAA,EE6CO,OF1C3B,CE0CmC,kBF1CnC,EAAA,CAAA;EACWA,oBAAAA,CAAAA,aAAwB,EAAA,MAAA,CAAA,EE6CiB,OF7CjB,CE6CyB,uBF7CzB,CAAA;EAAA,uBAAA,CAAA,aAAA,EAAA,MAAA,EAAA,MAAA,EEqDxB,MFrDwB,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EEsD/B,OFtD+B,CAAA,IAAA,CAAA;oBAAWA,CAAAA,aAAAA,EAAAA,MAAAA,EAAAA,OAE1BE,CAF0BF,EAAAA;IAAuCA,OAAAA,CAAAA,EAAAA,MAAAA;IAAwB,MAAA,CAAA,EEkEnE,MFlEmE,CAAA,MAAA,EAAA,OAAA,CAAA;EAEzFE,CAAAA,CAAAA,EEiEhB,OFjEgBA,CEiER,kBF1DZ,CAAA;EACWA,iBAAAA,CAAAA,aAAuB,EAAA,MAAA,CAAA,EEoEe,OFpEf,CEoEuB,kBFpEvB,CAAA;EAAA,WAAA,CAAA,QAAA,EAAA,MAAA,EAAA,MAAA,CAAA,EAAA,MAAA,EAAA,CAAA,EE8E9B,OF9E8B,CAAA;IAAWA,GAAAA,EAAAA,MAAAA;IAAsCA,QAAAA,EAAAA,MAAAA;IAAuB,SAAA,EAAA,MAAA;EAE1FE,CAAAA,CAAAA;EAAkB,cAAA,CAAA,QAAA,EAAA,MAAA,CAAA,EEoF9B,OFpF8B,CAAA;IACxBN,QAAAA,EAAAA,MAAAA;IAIQE,SAAAA,EAAAA,OAAAA;IACDE,MAAAA,CAAAA,EE8E4C,MF9E5CA,CAAAA,MAAAA,EAAAA,MAAAA,CAAAA;;EAEA,WAAA,CAAA,CAAA,EEkFK,OFlFL,CAAA;IASDM,YAAAA,EEyE8B,aFzEF,EAAA;EAkB5BC,CAAAA,CAAAA;EAAuB,oBAAA,CAAA,CAAA,EE2DR,OF3DQ,CAAA;IAE5BJ,QAAAA,CAAAA,EAAAA;MACMG,KAAAA,EAAAA,MAAAA;MAA4B,YAAA,EAAA,MAAA;MAE7BE,QAAa,EAAA,MAAA;MAAA,YAAA,EAAA,MAAA;MAsBVF,eAAAA,CAAAA,EAAAA,MAAAA,EAAAA;MAGGV,SAAAA,EAAAA,OAAAA;MAENF,WAAAA,CAAAA,EAAAA,MAAAA;IAAqB,CAAA,EAAA;;;;IC5F1BgB,YAAW,EAAA,MAAGD;IAOTG,SAAAA,EAAAA,MAAAA;IAQAC,eAAc,CAAA,EAAA,MAAA,EAAA;EAUdC,CAAAA,CAAAA;EAAsB,uBAAA,CAAA,KAAA,EAAA,MAAA,CAAA,ECkHS,ODlHT,CAAA;IACzBF,QAAAA,EAAAA;MADkCC,KAAAA,EAAAA,MAAAA;MAAc,WAAA,CAAA,EAAA,MAAA;MAI7CE,SAAS,EAAA,OACfL;IAUMM,CAAAA,EAAAA;;0CC2G+B;;MA5H/B,KAAA,EAAA,MAAA;MAKJ,WAAc,CAAA,EAAA,MAAA;MAAA,SAAA,EAAA,OAAA;IAIL,CAAA,EAAA;;0BAsBM,CAAA,CAAA,EAqGQ,OArGR,CAAA;IAIiC,KAAA,EAAA,MAAA;IAAR,YAAA,EAAA,MAAA;IAQzC,QAAA,EAAA,MAAA;IACP,YAAA,EAAA,MAAA;IAYsC,WAAA,CAAA,EAAA,MAAA;;sBACtC,CAAA,CAAA,EAqF2B,OArF3B,CAAA;IAWqD,KAAA,EAAA,MAAA;IAAR,WAAA,EAAA,MAAA;;oBAkBY,CAAA,CAAA,EA+DhC,OA/DgC,CAAA;IAAzD,WAAA,EAAA,MAAA;IAM0C,oBAAA,EAAA,MAAA;IAAxB,YAAA,EAAA,MAAA;;kBAwByB,CAAA,CAAA,EAyCpB,OAzCoB,CAAA;IAQA,WAAA,EAAA,MAAA;IAQZ,SAAA,EAAA,MAAA;;sBAiBN,CAAA,CAAA,EAeE,OAfF,CAAA;IAQF,WAAA,EAAA,MAAA;IAOI,WAAA,EAAA,MAAA;IAQG,aAAA,EAAA,MAAA;;yBAsBL,CAAA,CAAA,EAtBK,OAsBL,CAAA;IASF,WAAA,EAAA,MAAA;IAOG,YAAA,EAAA,MAAA;IAgBZ,oBAAA,EAAA,MAAA;IACb,OAAA,EAAA,MAAA;IAOuB,QAAA,EAAA,MAAA;IAM8D,OAAA,EAAA,MAAA;IAarF,KAAA,EAAA,MAAA;IAgCK,eAAA,EAAA,MAAA,EAAA;IAGG,QAAA,EAAA,MAAA;IAAR,YAAA,EAAA,MAAA;;uBAiBA,CAAA,CAAA,EAtH2B,OAsH3B,CAAA;IASK,WAAA,EAAA,MAAA;IAIG,SAAA,EAAA,MAAA;;oBAgBH,CAAA,CAAA,EA5ImB,OA4InB,CAAA;IAGG,WAAA,EAAA,MAAA;IAAR,oBAAA,EAAA,MAAA;IAQK,cAAA,EAAA,MAAA;IAEG,QAAA,EAAA,MAAA;;kBASH,CAAA,CAAA,EAzJiB,OAyJjB,CAAA;IAGL,WAAA,EAAA,MAAA;IAQ8B,SAAA,EAAA,MAAA;;qBAc9B,CAAA,CAAA,EA3KyB,OA2KzB,CAAA;IAiBA,OAAA,EAAA,MAAA;IAkBS,QAAA,EAAA,MAAA;IAET,UAAA,EAAA,MAAA;IAcA,UAAA,EAAA,MAAA;IAY0C,iBAAA,EAAA,MAAA;IAU1C,cAAA,CAAA,EAAA,MAAA;IASA,aAAA,CAAA,EAAA,MAAA;IAWA,UAAA,CAAA,EAAA,MAAA;;kBAqBA,CAAA,IAAA,EAAA;IAWA,cAAA,EAAA,MAAA;IAaA,IAAA,CAAA,EAAA,MAAA;IAgBA,YAAA,CAAA,EArTa,MAqTb,CAAA,MAAA,EAAA,OAAA,CAAA;MApTA,OAsUA,CAAA;IAsBA,EAAA,EAAA,OAAA;IAsBA,UAAA,EAAA,MAAA;;mBAuBuC,CAAA,CAAA,EAlYhB,OAkYgB,CAAA;IAOnB,QAAA,EAAA;MAOc,EAAA,EAAA,MAAA;MAMjB,IAAA,EAAA,MAAA;MAiBjB,WAAA,CAAA,EAAA,MAAA;IAUA,CAAA,EAAA;;EAWO,kBAAA,CAAA,KAAA,EAAA;;;;QAtb8E;;;;;;;;;;;;;MAarF;;;;;;;;;WAgCK;;;MAGL,QAAQ;;;;;;;WAaH;;;;MAIL;;;;;WASK;;;;cAIG;;;MAGR;;;;;WAaK;;;MAGL,QAAQ;;;WAQH;;MAEL,QAAQ;;;WASH;;;MAGL;;sBAQsB,QAAQ;;;;;MAc9B;;;;;;;;;;;MAiBA;;;;;;;;;;;;eAkBS;;MAET;;;;;;;;;;;MAcA;;;0CAY0C;;;;;;;;;;;MAU1C;;;;;;;;;;MASA;;;;;;;;;;;;MAWA;;;;;;;;;;;MAWA;;;;;;MAUA;;;;;;;;;;MAWA;;;;;;;;;;MAaA;;;;;;;;;;;;;MAgBA;;;;;;;;;;;MAkBA;;;;;;;;;;;;;;;;;;;;;;;;MAsBA;;;;;;;;;;;;MAsBA;;;;wDAYwD;;;;uCAWjB;;;;;;;;;;;oBAOnB;;;;;;;;kCAOc;;;iBAMjB;;;;;;;;;;;;MAiBjB;;;;MAUA;;;;;MAWA"}
+{"version":3,"file":"index.d.ts","names":["PERMISSION_CATALOG","Record","TENANT_ALLOWED_SUBJECTS","TenantAllowedSubject","ResourceScope","RESOURCE_SCOPES","AccessLevel","ScopedAccess","AllScopedAccess","ResourceScope","DEFAULT_INTEGRATIONS","IntegrationVisibility","INTEGRATION_VISIBILITIES","IntegrationScope","INTEGRATION_SCOPES","IntegrationDesiredStatus","INTEGRATION_DESIRED_STATUSES","IntegrationActualStatus","INTEGRATION_ACTUAL_STATUSES","IntegrationInstall","Record","AgentIntegration","OrgIntegration","IntegrationConfigSchemaField","IntegrationConfigResult","RegistryEntry","ResourceScope","SecretScope","SECRET_SCOPES","EncryptedEnvelopeV1","SecretMetadata","SecretEnvelopeResponse","ScopeInfo","GeneratedDataKey"],"sources":["../../../packages-internal/types/dist/access.d.ts","../../../packages-internal/types/dist/integration.d.ts","../../../packages-internal/types/dist/secrets.d.ts","../src/index.ts"],"sourcesContent":["/**\n * Runtime catalog of declared permission subjects + allowed actions.\n *\n * Mirrors the compile-time `PermissionDefinitions` augmentation in\n * `@alfe/api-core/auriclabs-roles.ts`. Kept here so browser code\n * (dashboard) can consume it without pulling in server-only deps\n * (`@middy/core`, `aws-lambda`, etc.).\n */\nexport declare const PERMISSION_CATALOG: Record<string, readonly string[]>;\n/**\n * Subjects a tenant may grant via a custom role.\n *\n * Excludes `all` (platform-admin escape hatch) and `admin_*` subjects.\n */\nexport declare const TENANT_ALLOWED_SUBJECTS: readonly [\"agent\", \"sync\", \"integration\", \"secret\", \"database\", \"template\", \"org_file\", \"team\", \"project\", \"model_policy\", \"role_management\", \"billing\", \"identity\", \"token\", \"user\", \"gateway\", \"voice\"];\nexport type TenantAllowedSubject = (typeof TENANT_ALLOWED_SUBJECTS)[number];\n/**\n * The four resource scopes at which a permission can apply.\n * Order is meaningful: broader scopes first (`org`) → narrower last (`agent`).\n *\n * `IntegrationScope` in integration.ts and `SecretScope` in secrets.ts are\n * intentional aliases of this same enum — there is only one concept of\n * \"scope\" in Alfe.\n */\nexport declare const ResourceScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type ResourceScope = (typeof ResourceScope)[keyof typeof ResourceScope];\n/** Ordered tuple of resource scope string values (broad → narrow). */\nexport declare const RESOURCE_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\nexport declare const AccessLevel: {\n    readonly None: \"none\";\n    readonly Read: \"read\";\n    readonly Write: \"write\";\n    readonly Manage: \"manage\";\n};\nexport type AccessLevel = (typeof AccessLevel)[keyof typeof AccessLevel];\nexport interface ScopedAccess {\n    scope: ResourceScope;\n    scopeId: string;\n    accessLevel: AccessLevel;\n    /** Resolved role label (e.g. \"org_admin\", \"team_member\") */\n    role: string;\n}\nexport interface AllScopedAccess {\n    orgAccess: ScopedAccess;\n    teamAccess: ScopedAccess[];\n    projectAccess: ScopedAccess[];\n}\n//# sourceMappingURL=access.d.ts.map","import { ResourceScope } from \"./access.js\";\n/** Integrations auto-installed for ALL agents regardless of hosting type. Cannot be removed. */\nexport declare const DEFAULT_INTEGRATIONS: readonly string[];\n/** Controls where an integration appears: public (everyone), hidden (nowhere) */\nexport declare const IntegrationVisibility: {\n    readonly Public: \"public\";\n    readonly Hidden: \"hidden\";\n};\nexport type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];\nexport declare const INTEGRATION_VISIBILITIES: readonly [\"public\" | \"hidden\", ...(\"public\" | \"hidden\")[]];\n/** Scope at which an integration is installed */\nexport declare const IntegrationScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type IntegrationScope = ResourceScope;\nexport declare const INTEGRATION_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\nexport declare const IntegrationDesiredStatus: {\n    readonly Active: \"active\";\n    readonly Removed: \"removed\";\n};\nexport type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];\nexport declare const INTEGRATION_DESIRED_STATUSES: readonly [\"active\" | \"removed\", ...(\"active\" | \"removed\")[]];\nexport declare const IntegrationActualStatus: {\n    readonly Installing: \"installing\";\n    readonly Active: \"active\";\n    readonly Error: \"error\";\n    readonly Removing: \"removing\";\n    readonly Inactive: \"inactive\";\n    readonly Unknown: \"unknown\";\n};\nexport type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];\nexport declare const INTEGRATION_ACTUAL_STATUSES: readonly [\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\", ...(\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\")[]];\nexport interface IntegrationInstall {\n    scope: IntegrationScope;\n    scopeId: string;\n    integrationId: string;\n    tenantId: string;\n    desiredStatus: IntegrationDesiredStatus;\n    actualStatus: IntegrationActualStatus;\n    version: string;\n    config: Record<string, unknown>;\n    errorMessage: string;\n    installedAt: string;\n    updatedAt: string;\n}\n/** @deprecated Use IntegrationInstall instead */\nexport type AgentIntegration = IntegrationInstall;\n/** Org-scoped integration install */\nexport type OrgIntegration = IntegrationInstall;\nexport interface IntegrationConfigSchemaField {\n    key: string;\n    label: string;\n    type: string;\n    description?: string;\n    required?: boolean;\n    default?: string | number | boolean;\n    options?: string[];\n    select_options?: {\n        value: string;\n        label: string;\n    }[];\n    oauth_provider?: string;\n    oauth_scopes?: string[];\n    oauth_integration_id?: string;\n    editable?: string;\n    hidden?: boolean;\n}\nexport interface IntegrationConfigResult {\n    integrationId: string;\n    config: Record<string, unknown>;\n    configSchema: IntegrationConfigSchemaField[];\n}\nexport interface RegistryEntry {\n    id: string;\n    name: string;\n    description: string;\n    versions: string[];\n    latest: string;\n    repository: string;\n    commit: string;\n    icon?: string;\n    author?: {\n        name: string;\n        url?: string;\n    } | string;\n    pricing?: {\n        type: \"free\" | \"paid\" | \"usage\";\n        price?: number;\n        currency?: string;\n        interval?: \"month\" | \"year\";\n        description?: string;\n    };\n    features?: string[];\n    preview_images?: string[];\n    config_schema?: IntegrationConfigSchemaField[];\n    supported_agents?: string[];\n    /** Scopes where this integration can be installed */\n    supported_scopes?: IntegrationScope[];\n    /** Visibility status — controls where integration appears */\n    visibility?: IntegrationVisibility;\n}\n//# sourceMappingURL=integration.d.ts.map","/**\n * Secrets types — shared between services/secrets, @alfe.ai/agent-api-client,\n * the openclaw-secrets plugin, and dashboard clients.\n *\n * Server-side crypto and KMS glue live in @alfe/secret-store (Node/AWS-only);\n * this module is a pure, dependency-free shape contract safe for every\n * environment the agent-api-client ships to.\n */\nimport type { ResourceScope } from \"./access.js\";\n/** Scope levels at which a secret can be owned. Aliased to ResourceScope. */\nexport type SecretScope = ResourceScope;\nexport declare const SECRET_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\n/**\n * v1 encrypted envelope as persisted by services/secrets and exchanged with\n * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext\n * are all base64-encoded.\n */\nexport interface EncryptedEnvelopeV1 {\n    version: 1;\n    iv: string;\n    ciphertext: string;\n    authTag: string;\n    dataKeyCiphertext: string;\n}\n/** Opaque metadata about a secret row — never includes plaintext. */\nexport interface SecretMetadata {\n    secretId: string;\n    secretName: string;\n    description?: string;\n    tags?: string[];\n    createdAt: string;\n    updatedAt: string;\n    rotatedAt?: string;\n}\n/** A single secret row including its encrypted envelope. */\nexport interface SecretEnvelopeResponse extends SecretMetadata {\n    envelope: EncryptedEnvelopeV1;\n}\n/** A scope the caller can read or write secrets in. */\nexport interface ScopeInfo {\n    scope: SecretScope;\n    scopeId: string;\n    name?: string;\n}\n/**\n * KMS-issued data key, returned by the secrets service's\n * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is\n * returned base64-encoded; callers MUST decode it to a Buffer and zero the\n * Buffer after use — never keep the plaintext as a JS string.\n */\nexport interface GeneratedDataKey {\n    plaintextKey: string;\n    dataKeyCiphertext: string;\n}\n//# sourceMappingURL=secrets.d.ts.map"],"mappings":";;ACWA;AAMA;AAEA;AAIA;;;;;AAEqBiB,cDDAb,aCQpB,EAAA;EACWa,SAAAA,GAAAA,EAAAA,KAAAA;EAAuB,SAAA,IAAA,EAAA,MAAA;WAAWA,OAAAA,EAAAA,SAAAA;WAAsCA,KAAAA,EAAAA,OAAAA;CAAuB;AAE1FE,KDLLf,aAAAA,GCKuB,CAAA,ODLCA,aCKD,CAAA,CAAA,MAAA,ODL6BA,aCK7B,CAAA;;;;;ADLCA,cC1BfO,qBD0BeP,EAAAA;WAA4BA,MAAAA,EAAAA,QAAAA;EAAa,SAAA,MAAA,EAAA,QAAA;;KCtBjEO,qBAAAA,WAAgCA,oCAAoCA;AAJhF;AAIYA,cAGSE,gBAHY,EAAA;EAAA,SAAA,GAAA,EAAA,KAAA;WAAWF,IAAAA,EAAAA,MAAAA;WAAoCA,OAAAA,EAAAA,SAAAA;EAAqB,SAAA,KAAA,EAAA,OAAA;AAGrG,CAAA;AAMYE,KAAAA,gBAAAA,GAAmBJ,aAAAA;AAMnBM,cAJSA,wBAIe,EAAA;EAAA,SAAA,MAAA,EAAA,QAAA;WAAWA,OAAAA,EAAAA,SAAAA;;AAA+D,KAAlGA,wBAAAA,GAAkG,CAAA,OAA/DA,wBAA+D,CAAA,CAAA,MAAA,OAAxBA,wBAAwB,CAAA;AAUlGE,cARSA,uBAQc,EAAA;EAAA,SAAA,UAAA,EAAA,YAAA;WAAWA,MAAAA,EAAAA,QAAAA;WAAsCA,KAAAA,EAAAA,OAAAA;EAAuB,SAAA,QAAA,EAAA,UAAA;EAE1FE,SAAAA,QAAAA,EAAAA,UAAkB;EAAA,SAAA,OAAA,EAAA,SAAA;;AAKhBJ,KAPPE,uBAAAA,GAOOF,CAAAA,OAP2BE,uBAO3BF,CAAAA,CAAAA,MAAAA,OAPiEE,uBAOjEF,CAAAA;AAGPK,UARKD,kBAAAA,CAQLC;EAAM,KAAA,EAPPP,gBAOO;EASDU,OAAAA,EAAAA,MAAAA;EAkBAC,aAAAA,EAAAA,MAAAA;EAAuB,QAAA,EAAA,MAAA;eAE5BJ,EAhCOL,wBAgCPK;cACMG,EAhCAN,uBAgCAM;EAA4B,OAAA,EAAA,MAAA;EAE7BE,MAAAA,EAhCLL,MAgCKK,CAAAA,MAAa,EAAA,OAAA,CAAA;EAAA,YAAA,EAAA,MAAA;aAsBVF,EAAAA,MAAAA;WAGGV,EAAAA,MAAAA;;;;AC1FXc,UD0CKJ,4BAAAA,CC1CsB;EAOtBM,GAAAA,EAAAA,MAAAA;EAQAC,KAAAA,EAAAA,MAAAA;EAUAC,IAAAA,EAAAA,MAAAA;EAAsB,WAAA,CAAA,EAAA,MAAA;UACzBF,CAAAA,EAAAA,OAAAA;SADkCC,CAAAA,EAAAA,MAAAA,GAAAA,MAAAA,GAAAA,OAAAA;EAAc,OAAA,CAAA,EAAA,MAAA,EAAA;EAI7CE,cAAS,CAAA,EAAA;IAWTC,KAAAA,EAAAA,MAAAA;;;;ECjBA,YAAA,CAAA,EAAA,MAAA,EAAoB;EAOpB,oBAAa,CAAA,EAAA,MAAA;EAWb,QAAA,CAAA,EAAA,MAAA;EASA,MAAA,CAAA,EAAA,OAAY;;AAIL,UFMPT,uBAAAA,CENO;eAAf,EAAA,MAAA;EAAM,MAAA,EFQHJ,MERG,CAAA,MAAA,EAAA,OAAA,CAAA;EAGE,YAAA,EFMCG,4BENe,EAAA;AAMjC;AAQiB,UFNAE,aAAAA,CEMmB;EAQnB,EAAA,EAAA,MAAA;EASA,IAAA,EAAA,MAAA;EAQA,WAAA,EAAA,MAAa;EASb,QAAA,EAAA,MAAA,EAAA;EAQA,MAAA,EAAA,MAAA;EAMA,UAAA,EAAA,MAAe;EAenB,MAAA,EAAA,MAAA;EAAc,IAAA,CAAA,EAAA,MAAA;QAIL,CAAA,EAAA;IA6BkD,IAAA,EAAA,MAAA;IAAjB,GAAA,CAAA,EAAA,MAAA;MAOpB,MAAA;SAAR,CAAA,EAAA;IAML,IAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA;IAAhB,KAAA,CAAA,EAAA,MAAA;IAYQ,QAAA,CAAA,EAAA,MAAA;IAAR,QAAA,CAAA,EAAA,OAAA,GAAA,MAAA;IASQ,WAAA,CAAA,EAAA,MAAA;;UAOkB,CAAA,EAAA,MAAA,EAAA;gBAAR,CAAA,EAAA,MAAA,EAAA;eAI4C,CAAA,EF7HhDF,4BE6HgD,EAAA;kBAAjB,CAAA,EAAA,MAAA,EAAA;;kBAOvB,CAAA,EFjILV,gBEiIK,EAAA;;YAIe,CAAA,EFnI1BF,qBEmI0B;;;;;;AFrOtBA,KCMTgB,WAAAA,GAAcD,aDHzB;;;;;AAID;AAMYb,UCAKgB,mBAAAA,CDAcpB;EAEVM,OAAAA,EAAAA,CAAAA;EAITA,EAAAA,EAAAA,MAAAA;EAAwB,UAAA,EAAA,MAAA;SAAWA,EAAAA,MAAAA;mBAAuCA,EAAAA,MAAAA;;AAEtF;AAQYE,UCRKa,cAAAA,CDQkB;EAAA,QAAA,EAAA,MAAA;YAAWb,EAAAA,MAAAA;aAAsCA,CAAAA,EAAAA,MAAAA;EAAuB,IAAA,CAAA,EAAA,MAAA,EAAA;EAE1FE,SAAAA,EAAAA,MAAAA;EAAkB,SAAA,EAAA,MAAA;WACxBN,CAAAA,EAAAA,MAAAA;;;AAOCO,UCRKW,sBAAAA,SAA+BD,cDQpCV,CAAAA;EAAM,QAAA,ECPJS,mBDOI;AASlB;AAkBA;AAAwC,UC/BvBG,SAAAA,CD+BuB;OAE5BZ,EChCDO,WDgCCP;SACMG,EAAAA,MAAAA;EAA4B,IAAA,CAAA,EAAA,MAAA;AAE9C;;;;;;;UCzBiBU,gBAAAA;;EAxCLN,iBAAW,EAAA,MAAGD;AAO1B;AAQA;;;UCQiB,oBAAA;EF7BIf,MAAAA,EAAAA,MAAAA;EAITA,MAAAA,EAAAA,MAAAA;;AAAgCA,UEgC3B,aAAA,CFhC2BA;SAAoCA,EAAAA,MAAAA;EAAqB,QAAA,EAAA,MAAA;EAGhFE,WAAAA,EAAAA,MAKpB;EACWA,QAAAA,EAAAA,MAAAA;EAESE,MAAAA,EAAAA,OAAAA,GAAAA,SAGpB,GAAA,QAAA;EACWA,SAAAA,CAAAA,EAAAA,MAAAA;EAAwB,SAAA,CAAA,EAAA,MAAA;UAAWA,CAAAA,EAAAA,MAAAA;;AAA+D,UE4B7F,iBAAA,CF5B6F;EAEzFE,IAAAA,EAAAA,MAAAA;EAQTA,IAAAA,EAAAA,MAAAA;EAAuB,QAAA,EAAA,MAAA;MAAWA,CAAAA,EAAAA,MAAAA;cAAsCA,CAAAA,EAAAA,MAAAA;EAAuB,UAAA,CAAA,EAAA,OAAA;AAE3G;AAAmC,UEyBlB,YAAA,CFzBkB;SACxBJ,EAAAA,CAAAA;SAIQE,EAAAA,MAAAA;UACDE,EAAAA,MAAAA;OAENG,EEqBH,MFrBGA,CAAAA,MAAAA,EEqBY,iBFrBZA,CAAAA;;AASKG,UEeA,gBAAA,CFfAA;EAkBAC,IAAAA,EAAAA,MAAAA;EAAuB,GAAA,EAAA,MAAA;WAE5BJ,EAAAA,MAAAA;;AACkC,UEA7B,mBAAA,CFA6B;EAE7BK,QAAAA,EAAAA,MAAa;EAAA,IAAA,EAAA,MAAA;MAsBVF,EAAAA,MAAAA;cAGGV,EAAAA,UAAAA,GAAAA,YAAAA;UAENF,EAAAA,MAAAA;;UErBA,mBAAA;;;EDvELgB,GAAAA,EAAAA,MAAAA;EAOKE,YAAAA,CAAAA,EAAAA,MAAAA;EAQAC,UAAAA,CAAAA,EAAAA,OAAc;AAU/B;AAAuC,UCsDtB,qBAAA,CDtDsB;SACzBD,EAAAA,MAAAA;MADkCC,EAAAA,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;EAAc,SAAA,EAAA,MAAA;EAI7CE,SAAAA,EAAAA,MAAS;EAWTC,KAAAA,EC4CR,mBD5CwB,EAAA;;;UCgDhB,cAAA;EAjEA,OAAA,EAAA,MAAA;EAOA,aAAA,EAAA,MAAa;EAWb,YAAA,EAAA,MAAiB;EASjB,SAAA,EAAA,MAAY;EAAA,UAAA,EAAA,MAAA,GAAA,IAAA;;AAIpB,UA0CQ,aAAA,CA1CR;EAAM,QAAA,EAAA,MAAA;EAGE,IAAA,EAAA,MAAA;EAMA,QAAA,EAAA,MAAA;EAQA,WAAA,EAAA,MAAA;EAQA,YAAA,CAAA,EAAA,MAAA;EASA,UAAA,CAAA,EAAA,OAAc;AAQ/B;AASiB,UAAA,gBAAA,CAAgB;EAQhB,SAAA,EAAA,MAAA;EAMA,IAAA,EAAA,MAAA;EAeJ,YAAA,EAAA,MAAc;EAAA,YAAA,CAAA,EAAA,MAAA;YAIL,EAAA,OAAA;;AA6BiC,UAtDtC,kBAAA,CAsDsC;WAOpB,EAAA,MAAA;SAAR,EAAA,MAAA;YAML,EAAA,OAAA;;AAYR,UAzEG,eAAA,CAyEH;UAAR,EAAA,MAAA;UASQ,EAAA,MAAA;MAAR,EAAA,MAAA;aAO0B,CAAA,EAAA,MAAA;;AAIoC,cA9EvD,cAAA,CA8EuD;mBAAjB,MAAA;mBAOH,MAAA;aAApB,CAAA,MAAA,EAjFN,oBAiFM;UAIuB,OAAA;cAAR,CAAA,KAAA,EAAA;IAID,WAAA,CAAA,EAAA,MAAA;MA5Da,OA0EhC,CAAA;IAAjB,KAAA,EA1EkE,aA0ElE;;iBAgB8B,CAAA,CAAA,EAnFT,OAmFS,CAnFD,YAmFC,CAAA;aAAR,CAAA,IAAA,EAAA;IAIiC,KAAA,EAAA;MAAR,IAAA,EAAA,MAAA;MAQzC,SAAA,EAAA,KAAA,GAAA,KAAA;MACP,WAAA,CAAA,EAAA,MAAA;IAYsC,CAAA,EAAA;MAtGrC,OAuGO,CAAA;IAAR,IAAA,EAvGiB,gBAuGjB,EAAA;;mBAW6C,CAAA,IAAA,EAAA;IAU7C,QAAA,EAAA,MAAA;IAQyD,IAAA,EAAA,MAAA;IAAzD,IAAA,EAAA,MAAA;IAM0C,YAAA,CAAA,EAAA,UAAA,GAAA,YAAA;MA9HzC,OA8HiB,CA9HT,mBA8HS,CAAA;iBAIS,CAAA,IAAA,EAAA;IAoBgB,IAAA,EAAA,MAAA,GAAA,QAAA,GAAA,QAAA;MA7I1C,OAqJ0C,CArJlC,qBAqJkC,CAAA;cAQZ,CAAA,CAAA,EAtJZ,OAsJY,CAtJJ,cAsJI,CAAA;eAUJ,CAAA,KAAA,EAAA;IAOF,MAAA,CAAA,EAAA,MAAA;MAnKqB,OA2KvB,CAAA;IAOI,KAAA,EAlLoC,aAkLpC,EAAA;;kBAuBC,CAAA,CAAA,EAlML,OAkMK,CAAA;IAOH,QAAA,EAzMkB,gBAyMlB,EAAA;;gBAgBC,CAAA,SAAA,EAAA,MAAA,CAAA,EArNY,OAqNZ,CArNoB,kBAqNpB,CAAA;gBAgBZ,CAAA,QAAA,EAAA,MAAA,CAAA,EAjOuB,OAiOvB,CAAA;IACb,OAAA,EAAA,OAAA;;iBAaqF,CAAA,IAAA,EAAA;IAarF,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAgCK,OAAA,EAAA,MAAA;MA9QL,OAiRQ,CAAA;IAAR,KAAA,EAjRiB,eAiRjB,EAAA;IAaK,UAAA,EAAA,MAAA,GAAA,IAAA;;mBAaA,CAAA,IAAA,EAAA;IAIG,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAGR,OAAA,EAAA,MAAA;IAaK,QAAA,EAAA,MAAA;MArTL,OAwTQ,CAAA;IAAR,WAAA,EAAA,MAAA;IAQK,SAAA,EAAA,MAAA;;kBAEL,CAAA,CAAA,EA5TsB,OA4TtB,CA5T8B,kBA4T9B,EAAA,CAAA;sBASK,CAAA,aAAA,EAAA,MAAA,CAAA,EAjU0C,OAiU1C,CAjUkD,uBAiUlD,CAAA;yBAGL,CAAA,aAAA,EAAA,MAAA,EAAA,MAAA,EA5TM,MA4TN,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EA3TD,OA2TC,CAAA,IAAA,CAAA;oBAQ8B,CAAA,aAAA,EAAA,MAAA,EAAA,QAAA,EAAA;IAAR,OAAA,CAAA,EAAA,MAAA;IAetB,MAAA,CAAA,EAtUqC,MAsUrC,CAAA,MAAA,EAAA,OAAA,CAAA;MArUD,OAsVC,CAtVO,kBAsVP,CAAA;mBAS0C,CAAA,aAAA,EAAA,MAAA,CAAA,EApVE,OAoVF,CApVU,kBAoVV,CAAA;aAS1C,CAAA,QAAA,EAAA,MAAA,EAAA,MAAA,CAAA,EAAA,MAAA,EAAA,CAAA,EAnVD,OAmVC,CAAA;IASA,GAAA,EAAA,MAAA;IAWA,QAAA,EAAA,MAAA;IAWA,SAAA,EAAA,MAAA;;gBAmBA,CAAA,QAAA,EAAA,MAAA,CAAA,EA7XD,OA6XC,CAAA;IAkBA,QAAA,EAAA,MAAA;IAiBA,SAAA,EAAA,OAAA;IA2BD,MAAA,CAAA,EA3byD,MA2bzD,CAAA,MAAA,EAAA,MAAA,CAAA;;aAqCC,CAAA,CAAA,EA1diB,OA0djB,CAAA;IAsBA,YAAA,EAhfyC,aAgfzC,EAAA;;sBAkCwD,CAAA,CAAA,EA9gB9B,OA8gB8B,CAAA;IAWjB,QAAA,CAAA,EAAA;MAOnB,KAAA,EAAA,MAAA;MAOc,YAAA,EAAA,MAAA;MAMjB,QAAA,EAAA,MAAA;MAiBjB,YAAA,EAAA,MAAA;MAUA,eAAA,CAAA,EAAA,MAAA,EAAA;MAWA,SAAA,EAAA,OAAA;MASiC,WAAA,CAAA,EAAA,MAAA;IAcjC,CAAA,EAAA;IAAO,KAAA,EAAA,MAAA;;;;;;;0CAtlBmC;;;;;;;0CAQA;;;;;;;8BAQZ;;;;;;;0BAUJ;;;;wBAOF;;;;;sBAQF;;;;0BAOI;;;;;6BAQG;;;;;;;;;;;;2BAeF;;;;wBAOH;;;;;;sBASF;;;;yBAOG;;;;;;;;;;;;;mBAgBZ;MACb;;;;uBAOuB;;;;;;;;;;;QAM8D;;;;;;;;;;;;;MAarF;;;;;;;;;WAgCK;;;MAGL,QAAQ;;;;;;;WAaH;;;;MAIL;;;;;WASK;;;;cAIG;;;MAGR;;;;;WAaK;;;MAGL,QAAQ;;;WAQH;;MAEL,QAAQ;;;WASH;;;MAGL;;sBAQsB,QAAQ;;;;;;MAe9B;;;;;;;;;;;MAiBA;;;0CAS0C;;;;;;;;;;MAS1C;;;;;;;;;;MASA;;;;;;;;;;;;MAWA;;;;;;;;;;;MAWA;;;;;MASA;;;;;;;;;;MAUA;;;;;;;;;;;;;;;;;;MAkBA;;;;;;;;;;;;;;;;MAiBA;;;;;;;;;;;;;;;;;;MA2BD;;;;;;;;;;;MAeC;;;;;;;;;;;MAsBA;;;;;;;;;;;;;;;;;;;;;;;;MAsBA;;;;;;;;;;;;MAsBA;;;;wDAYwD;;;;uCAWjB;;;;;;;;;;;oBAOnB;;;;;;;;kCAOc;;;iBAMjB;;;;;;;;;;;;MAiBjB;;;;MAUA;;;;;MAWA;iCASiC;;;;;;;;;;;MAcjC"}

package/dist/index.js

@@ -1,4 +1,11 @@
 //#region src/index.ts
+/**
+* Encode each path segment but keep the `/` separators — `encodeURIComponent`
+* would escape the slashes too, breaking greedy proxy routes.
+*/
+function encodeFilePath(filePath) {
+	return filePath.split("/").map(encodeURIComponent).join("/");
+}
 var AgentApiClient = class {
 	apiKey;
 	apiUrl;
@@ -21,6 +28,57 @@ var AgentApiClient = class {
 		}
 		return (await res.json()).data;
 	}
+	async syncRegister(args) {
+		return this.request("/agents/sync/register", {
+			method: "POST",
+			body: JSON.stringify(args ?? {})
+		});
+	}
+	async syncGetManifest() {
+		return this.request("/agents/sync/manifest");
+	}
+	async syncPresign(args) {
+		return this.request("/agents/sync/presign", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncConfirmUpload(args) {
+		return this.request("/agents/sync/confirm", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncReconstruct(args) {
+		return this.request("/agents/sync/reconstruct", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncGetStats() {
+		return this.request("/agents/sync/stats");
+	}
+	async syncListFiles(args) {
+		const qs = new URLSearchParams();
+		if (args?.prefix) qs.set("prefix", args.prefix);
+		const query = qs.toString();
+		return this.request(`/agents/sync/files${query ? `?${query}` : ""}`);
+	}
+	async syncListSessions() {
+		return this.request("/agents/sync/sessions");
+	}
+	async syncGetSession(sessionId) {
+		return this.request(`/agents/sync/sessions/${encodeURIComponent(sessionId)}`);
+	}
+	async syncDeleteFile(filePath) {
+		return this.request(`/agents/sync/files/${encodeFilePath(filePath)}`, { method: "DELETE" });
+	}
+	async sharedListFiles(args) {
+		return this.request(`/agents/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`);
+	}
+	async sharedDownloadUrl(args) {
+		return this.request(`/agents/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/download/${encodeFilePath(args.filePath)}`);
+	}
 	async listIntegrations() {
 		return this.request("/agent/integrations");
 	}
@@ -169,26 +227,11 @@ var AgentApiClient = class {
 			body: JSON.stringify(args)
 		});
 	}
-	async enforcePolicy(args) {
-		return this.request("/agent/identity/enforce", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
-	}
-	async checkToolPermission(args) {
-		return this.request("/agent/identity/check-tool", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
-	}
 	async searchIdentities(args) {
 		const qs = new URLSearchParams();
 		if (args?.q) qs.set("q", args.q);
 		if (args?.status) qs.set("status", args.status);
-		if (args?.tag) qs.set("tag", args.tag);
-		if (args?.platform) qs.set("platform", args.platform);
 		if (args?.limit) qs.set("limit", String(args.limit));
-		if (args?.offset) qs.set("offset", String(args.offset));
 		const query = qs.toString();
 		return this.request(`/agent/identity/search${query ? `?${query}` : ""}`);
 	}
@@ -222,7 +265,6 @@ var AgentApiClient = class {
 	async getIdentityChangelog(identityId, args) {
 		const qs = new URLSearchParams();
 		if (args?.limit) qs.set("limit", String(args.limit));
-		if (args?.offset) qs.set("offset", String(args.offset));
 		const query = qs.toString();
 		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/changelog${query ? `?${query}` : ""}`);
 	}
@@ -244,6 +286,29 @@ var AgentApiClient = class {
 			body: JSON.stringify(args)
 		});
 	}
+	/**
+	* Update display-shape fields on an Identity. Body excludes `email` /
+	* `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
+	* via the verify flow, title/company live on OrgMembership, metadata is
+	* not agent-writable.
+	*/
+	async updateIdentity(identityId, args) {
+		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/update`, {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	/**
+	* Phase 2 (Section H): server-side verification of a Google Chat sender via
+	* the agent's existing Google OAuth credentials. Returns the resolved
+	* identity (created or matched via Scenario-B email enrichment).
+	*/
+	async resolveGoogleChatSender(args) {
+		return this.request("/agent/google/resolve-sender", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
 	async memorySearch(query, opts) {
 		return this.request("/agent/memory/search", {
 			method: "POST",
@@ -317,6 +382,15 @@ var AgentApiClient = class {
 			body: JSON.stringify(params)
 		});
 	}
+	async registerDatabaseCredentials() {
+		return this.request("/agent/database/register", { method: "POST" });
+	}
+	async reportDatabaseAudit(entry) {
+		await this.request("/agent/database/audit", {
+			method: "POST",
+			body: JSON.stringify(entry)
+		}).catch(() => {});
+	}
 };
 //#endregion
 export { AgentApiClient };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @alfe.ai/agent-api-client — Agent self-service API client.\n *\n * Used by agents calling /agent/ endpoints. The agent authenticates\n * with its API key — the backend resolves agentId + tenantId from the token.\n * No agent ID needed in paths or config.\n */\n\nexport type {\n  IntegrationInstall,\n  IntegrationConfigResult,\n  RegistryEntry,\n  IntegrationConfigSchemaField,\n  SecretScope,\n  EncryptedEnvelopeV1,\n  SecretMetadata,\n  SecretEnvelopeResponse,\n  ScopeInfo,\n  GeneratedDataKey,\n} from \"@alfe/types\";\n\nimport type {\n  IntegrationInstall,\n  IntegrationConfigResult,\n  RegistryEntry,\n  SecretScope,\n  EncryptedEnvelopeV1,\n  SecretMetadata,\n  SecretEnvelopeResponse,\n  ScopeInfo,\n  GeneratedDataKey,\n} from \"@alfe/types\";\n\nexport interface AgentApiClientConfig {\n  apiKey: string;\n  apiUrl: string;\n}\n\nexport class AgentApiClient {\n  private readonly apiKey: string;\n  private readonly apiUrl: string;\n\n  constructor(config: AgentApiClientConfig) {\n    this.apiKey = config.apiKey;\n    this.apiUrl = config.apiUrl;\n  }\n\n  private async request<T>(path: string, options?: RequestInit): Promise<T> {\n    const url = `${this.apiUrl}${path}`;\n    const headers = new Headers(options?.headers);\n    headers.set(\"Authorization\", `Bearer ${this.apiKey}`);\n    headers.set(\"Content-Type\", \"application/json\");\n\n    const res = await fetch(url, { ...options, headers });\n\n    if (!res.ok) {\n      await res.text(); // drain body\n      throw new Error(`Agent API request failed (${String(res.status)})`);\n    }\n\n    const body = (await res.json()) as { data: T };\n    return body.data;\n  }\n\n  async listIntegrations(): Promise<IntegrationInstall[]> {\n    return this.request<IntegrationInstall[]>(\"/agent/integrations\");\n  }\n\n  async getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult> {\n    return this.request<IntegrationConfigResult>(\n      `/agent/integrations/${encodeURIComponent(integrationId)}/config`,\n    );\n  }\n\n  async updateIntegrationConfig(\n    integrationId: string,\n    config: Record<string, unknown>,\n  ): Promise<void> {\n    await this.request<unknown>(\n      `/agent/integrations/${encodeURIComponent(integrationId)}`,\n      {\n        method: \"PATCH\",\n        body: JSON.stringify({ config }),\n      },\n    );\n  }\n\n  async installIntegration(\n    integrationId: string,\n    options?: { version?: string; config?: Record<string, unknown> },\n  ): Promise<IntegrationInstall> {\n    return this.request<IntegrationInstall>(\"/agent/integrations\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        integrationId,\n        version: options?.version,\n        config: options?.config,\n      }),\n    });\n  }\n\n  async removeIntegration(integrationId: string): Promise<IntegrationInstall> {\n    return this.request<IntegrationInstall>(\n      `/agent/integrations/${encodeURIComponent(integrationId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n\n  async getOAuthUrl(\n    provider: string,\n    scopes?: string[],\n  ): Promise<{ url: string; provider: string; expiresIn: number }> {\n    const params = new URLSearchParams({ provider });\n    if (scopes?.length) params.set(\"scopes\", scopes.join(\",\"));\n    return this.request(`/agent/integrations/oauth/url?${params.toString()}`);\n  }\n\n  async getOAuthStatus(\n    provider: string,\n  ): Promise<{ provider: string; connected: boolean; config?: Record<string, string> }> {\n    return this.request(\n      `/agent/integrations/oauth/status?provider=${encodeURIComponent(provider)}`,\n    );\n  }\n\n  async getRegistry(): Promise<{ integrations: RegistryEntry[] }> {\n    return this.request<{ integrations: RegistryEntry[] }>(\"/integrations/registry\");\n  }\n\n  async getGoogleCredentials(): Promise<{\n    accounts?: {\n      email: string;\n      refreshToken: string;\n      clientId: string;\n      clientSecret: string;\n      enabledServices?: string[];\n      isDefault: boolean;\n      displayName?: string;\n    }[];\n    email: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    projectId: string;\n    enabledServices?: string[];\n  }> {\n    return this.request(\"/agent/google/credentials\");\n  }\n\n  async disconnectGoogleAccount(email: string): Promise<{\n    accounts: { email: string; displayName?: string; isDefault: boolean }[];\n  }> {\n    return this.request(`/agent/google/accounts/${encodeURIComponent(email)}`, {\n      method: \"DELETE\",\n    });\n  }\n\n  async setDefaultGoogleAccount(email: string): Promise<{\n    accounts: { email: string; displayName?: string; isDefault: boolean }[];\n  }> {\n    return this.request(`/agent/google/accounts/${encodeURIComponent(email)}/default`, {\n      method: \"PUT\",\n    });\n  }\n\n  async getGoogleChatCredentials(): Promise<{\n    email: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    displayName?: string;\n  }> {\n    return this.request(\"/agent/google-chat/credentials\");\n  }\n\n  async getGithubCredentials(): Promise<{\n    login: string;\n    accessToken: string;\n  }> {\n    return this.request(\"/agent/github/credentials\");\n  }\n\n  async getXeroCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    xeroTenantId: string;\n  }> {\n    return this.request(\"/agent/xero/credentials\");\n  }\n\n  async refreshXeroToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }> {\n    return this.request(\"/agent/xero/token\", { method: \"POST\" });\n  }\n\n  async getNotionCredentials(): Promise<{\n    accessToken: string;\n    workspaceId: string;\n    workspaceName: string;\n  }> {\n    return this.request(\"/agent/notion/credentials\");\n  }\n\n  async getAtlassianCredentials(): Promise<{\n    accessToken: string;\n    refreshToken: string;\n    accessTokenExpiresAt: string;\n    cloudId: string;\n    siteName: string;\n    siteUrl: string;\n    email: string;\n    enabledProducts: string[];\n    clientId: string;\n    clientSecret: string;\n  }> {\n    return this.request(\"/agent/atlassian/credentials\");\n  }\n\n  async refreshAtlassianToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }> {\n    return this.request(\"/agent/atlassian/token\", { method: \"POST\" });\n  }\n\n  async getMYOBCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    myobBusinessId: string;\n    clientId: string;\n  }> {\n    return this.request(\"/agent/myob/credentials\");\n  }\n\n  async refreshMYOBToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }> {\n    return this.request(\"/agent/myob/token\", { method: \"POST\" });\n  }\n\n  async getTeamsCredentials(): Promise<{\n    agentId: string;\n    tenantId: string;\n    azureAppId: string;\n    azureBotId: string;\n    azureClientSecret: string;\n    botDisplayName?: string;\n    teamsTenantId?: string;\n    serviceUrl?: string;\n  }> {\n    return this.request(\"/agent/microsoft/credentials\");\n  }\n\n  async sendTeamsMessage(data: {\n    conversationId: string;\n    text?: string;\n    adaptiveCard?: Record<string, unknown>;\n  }): Promise<{ ok: boolean; activityId: string }> {\n    return this.request(\"/agent/microsoft/send\", {\n      method: \"POST\",\n      body: JSON.stringify(data),\n    });\n  }\n\n  async listTeamsChannels(): Promise<{\n    channels: { id: string; name: string; description?: string }[];\n  }> {\n    return this.request(\"/agent/microsoft/channels\");\n  }\n\n  async presignAttachments(files: { filename: string; mimeType: string; size: number }[]): Promise<{\n    attachments: { id: string; uploadUrl: string; downloadUrl: string; s3Key: string; expiresAt: string }[];\n  }> {\n    return this.request(\"/agent/chat/attachments/presign\", {\n      method: \"POST\",\n      body: JSON.stringify({ files }),\n    });\n  }\n\n  async recordActivity(data: {\n    userId?: string;\n    channel: string;\n    role: \"user\" | \"assistant\";\n  }): Promise<{ recorded: boolean }> {\n    return this.request<{ recorded: boolean }>(\"/agent/activity\", {\n      method: \"POST\",\n      body: JSON.stringify(data),\n    });\n  }\n\n  // ─── Secrets ──────────────────────────────────────────────────\n  //\n  // Envelope CRUD + KMS proxy for per-scope encrypted secret storage.\n  // Agents never hold a KMS master key — these proxy endpoints mint one-shot\n  // AES-256 data keys bound (via KMS encryption context) to\n  // `{ tenantId, scope, scopeId, secretId }`. The agent performs AES-256-GCM\n  // locally; the backend only ever sees opaque envelopes.\n  //\n  // Routes resolve to the agent API gateway (mapping key `agent`), where\n  // services/secrets registers its routes with pathPrefix `/secrets`. With\n  // `apiUrl` set to the host root (e.g. `https://api.alfe.ai`), the full URL\n  // is `https://api.alfe.ai/agent/secrets/...`. This is the same mapping as\n  // `/agent/integrations/...` etc. — do NOT hit `/secrets/...` on the root\n  // host: that's the user-auth dashboard gateway, which rejects agent tokens.\n  //\n  // `plaintextKey` in responses is base64 — callers MUST decode to a Node\n  // `Buffer` immediately and zero it after use. NEVER keep plaintext keys\n  // as JS strings (strings are immutable and cannot be wiped).\n\n  /**\n   * Mint a fresh AES-256 data key for a new secret or rotation. The encryption\n   * context is rebuilt server-side from `auth.tenantId` + the body fields; the\n   * agent cannot forge context for a scope it doesn't own.\n   */\n  async generateSecretDataKey(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n  }): Promise<GeneratedDataKey> {\n    return this.request<GeneratedDataKey>(\"/agent/secrets/generate-data-key\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  /**\n   * Unwrap a wrapped data key so the agent can decrypt the envelope locally.\n   * KMS Decrypt will fail with `InvalidCiphertextException` if the envelope\n   * was tampered with in a way that changes `{ tenantId, scope, scopeId, secretId }`.\n   */\n  async decryptSecretDataKey(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n    dataKeyCiphertext: string;\n  }): Promise<{ plaintextKey: string }> {\n    return this.request<{ plaintextKey: string }>(\"/agent/secrets/decrypt-data-key\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  /** Upload a pre-encrypted envelope for a secret. */\n  async putSecretEnvelope(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n    secretName: string;\n    envelope: EncryptedEnvelopeV1;\n    description?: string;\n    tags?: string[];\n  }): Promise<{ secretId: string }> {\n    const { scope, scopeId, secretId, ...body } = args;\n    return this.request<{ secretId: string }>(\n      `/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`,\n      {\n        method: \"PUT\",\n        body: JSON.stringify(body),\n      },\n    );\n  }\n\n  /** Fetch the encrypted envelope for a single secret. */\n  async getSecretEnvelope(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n  }): Promise<SecretEnvelopeResponse> {\n    return this.request<SecretEnvelopeResponse>(\n      `/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`,\n    );\n  }\n\n  /** List metadata (never envelopes) for secrets in a scope. */\n  async listSecrets(args: {\n    scope: SecretScope;\n    scopeId: string;\n  }): Promise<SecretMetadata[]> {\n    const resp = await this.request<{ secrets: SecretMetadata[] }>(\n      `/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`,\n    );\n    return resp.secrets;\n  }\n\n  /** Delete a secret. */\n  async deleteSecret(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n  }): Promise<void> {\n    await this.request<unknown>(\n      `/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n\n  /** Enumerate scopes (org/team/project/agent) this agent can access. */\n  async listSecretScopes(): Promise<ScopeInfo[]> {\n    const resp = await this.request<{ scopes: ScopeInfo[] }>(\"/agent/secrets/scopes\");\n    return resp.scopes;\n  }\n\n  // ─── Identity ─────────────────────────────────────────────\n  //\n  // Identity resolution, permission enforcement, and CRM tools.\n  // The agent API derives tenantId + agentId from the agent token.\n\n  async resolveIdentity(args: {\n    platform: string;\n    platformId: string;\n    displayName?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n    accessAllowed: boolean;\n    created?: boolean;\n    reason?: string;\n  }> {\n    return this.request(\"/agent/identity/resolve\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async enforcePolicy(args: {\n    platform: string;\n    senderId: string;\n    channelId?: string;\n  }): Promise<{\n    identityId: string | null;\n    orgId: string | null;\n    role: string | null;\n    allowedTools: string[];\n    deniedTools: string[];\n    identified: boolean;\n  }> {\n    return this.request(\"/agent/identity/enforce\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async checkToolPermission(args: {\n    platform: string;\n    senderId: string;\n    toolName: string;\n    toolArgs?: Record<string, unknown>;\n    channelId?: string;\n  }): Promise<{ allowed: boolean; reason?: string }> {\n    return this.request(\"/agent/identity/check-tool\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async searchIdentities(args?: {\n    q?: string;\n    status?: string;\n    tag?: string;\n    platform?: string;\n    limit?: number;\n    offset?: number;\n  }): Promise<{ identities: unknown[] }> {\n    const qs = new URLSearchParams();\n    if (args?.q) qs.set(\"q\", args.q);\n    if (args?.status) qs.set(\"status\", args.status);\n    if (args?.tag) qs.set(\"tag\", args.tag);\n    if (args?.platform) qs.set(\"platform\", args.platform);\n    if (args?.limit) qs.set(\"limit\", String(args.limit));\n    if (args?.offset) qs.set(\"offset\", String(args.offset));\n    const query = qs.toString();\n    return this.request(`/agent/identity/search${query ? `?${query}` : \"\"}`);\n  }\n\n  async getIdentityContext(identityId: string): Promise<{\n    identity: unknown;\n    recentChanges: unknown[];\n  }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/context`);\n  }\n\n  async mergeIdentities(survivorId: string, args: {\n    mergedId: string;\n    changedBy: { type: string; id: string; name?: string };\n  }): Promise<{ ok: boolean; error?: string }> {\n    return this.request(`/agent/identity/${encodeURIComponent(survivorId)}/merge`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async unmergeIdentity(identityId: string, args: {\n    changedBy: { type: string; id: string; name?: string };\n  }): Promise<{ ok: boolean; error?: string }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/unmerge`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async addIdentityNote(identityId: string, args: {\n    content: string;\n    category?: string;\n    changedBy: { type: string; id: string; name?: string };\n  }): Promise<{ noteId: string | null }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/notes`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async tagIdentity(identityId: string, args: {\n    tag: string;\n    action: \"add\" | \"remove\";\n    changedBy: { type: string; id: string; name?: string };\n  }): Promise<{ ok: boolean }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/tags`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async getIdentityChangelog(identityId: string, args?: {\n    limit?: number;\n    offset?: number;\n  }): Promise<{ entries: unknown[] }> {\n    const qs = new URLSearchParams();\n    if (args?.limit) qs.set(\"limit\", String(args.limit));\n    if (args?.offset) qs.set(\"offset\", String(args.offset));\n    const query = qs.toString();\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/changelog${query ? `?${query}` : \"\"}`);\n  }\n\n  async rollbackIdentity(identityId: string, args: {\n    targetVersion: number;\n    changedBy: { type: string; id: string; name?: string };\n  }): Promise<{ ok: boolean; entry?: unknown }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/rollback`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async requestIdentityVerification(args: {\n    claimedIdentityId: string;\n    requestingIdentityId: string;\n    requestingPlatform: string;\n    requestingPlatformId: string;\n    preferredChannel?: \"sms\" | \"email\";\n  }): Promise<{\n    verificationId: string;\n    channel: string;\n    deliveredTo: string;\n    expiresAt: string;\n    availableChannels: { channel: string; deliveredTo: string }[];\n  }> {\n    return this.request(\"/agent/identity/verify/request\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async confirmIdentityVerification(args: {\n    verificationId: string;\n    phrase: string;\n  }): Promise<{ verified: boolean; identityId?: string; error?: string }> {\n    return this.request(\"/agent/identity/verify/confirm\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  // ─── Memory ──────────────────────────────────────────────\n  //\n  // Cloud memory (Turbopuffer vectors + DynamoDB knowledge graph).\n  // The agent API derives tenantId + agentId from the agent token.\n\n  async memorySearch(query: string, opts?: {\n    limit?: number;\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    includeKnowledge?: boolean;\n  }): Promise<{\n    facts: { subject: string; predicate: string; object: string; since: string; confidence: number }[];\n    memories: { id: string; text: string; topic: string; subtopic: string; tag: string; importance: number; timestamp: number; score: number }[];\n  }> {\n    return this.request(\"/agent/memory/search\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        query,\n        limit: opts?.limit ?? 10,\n        topic: opts?.topic,\n        subtopic: opts?.subtopic,\n        tag: opts?.tag,\n        includeKnowledge: opts?.includeKnowledge ?? true,\n      }),\n    });\n  }\n\n  async memoryStore(text: string, opts?: {\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    importance?: number;\n  }): Promise<{ memoryId: string }> {\n    return this.request(\"/agent/memory/store\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        text,\n        topic: opts?.topic ?? \"general\",\n        subtopic: opts?.subtopic ?? \"general\",\n        tag: opts?.tag ?? \"fact\",\n        importance: opts?.importance ?? 0.7,\n      }),\n    });\n  }\n\n  async memoryIngest(sessionKey: string, messages: {\n    role: string;\n    content: string;\n    index: number;\n    timestamp?: string;\n  }[], metadata?: {\n    channelId?: string;\n    userId?: string;\n    userName?: string;\n  }): Promise<{ queued: boolean; messageCount: number }> {\n    return this.request(\"/agent/memory/ingest\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        sessionKey,\n        lastProcessedIndex: messages.length > 0 ? messages[messages.length - 1].index : -1,\n        messages,\n        metadata,\n      }),\n    });\n  }\n\n  async memoryLoadContext(tier?: number, topicHint?: string): Promise<{\n    formatted: string;\n    [key: string]: unknown;\n  }> {\n    const params = new URLSearchParams();\n    if (tier !== undefined) params.set(\"tier\", String(tier));\n    if (topicHint) params.set(\"topicHint\", topicHint);\n    const qs = params.toString();\n    return this.request(`/agent/memory/context${qs ? `?${qs}` : \"\"}`);\n  }\n\n  async memoryLookupEntity(subject: string): Promise<{\n    subject: string;\n    triples: { tripleId: string; predicate: string; object: string; validFrom: string; validTo?: string; confidence: number }[];\n  }> {\n    return this.request(`/agent/memory/knowledge/entities?subject=${encodeURIComponent(subject)}`);\n  }\n\n  async memoryNavigate(): Promise<{\n    topics: { name: string; tripleCount: number; subtopics: string[] }[];\n    cursor: string | null;\n  }> {\n    return this.request(\"/agent/memory/navigate\");\n  }\n\n  async memoryDelete(memoryId: string): Promise<{ deleted: boolean }> {\n    return this.request(`/agent/memory/${encodeURIComponent(memoryId)}`, {\n      method: \"DELETE\",\n    });\n  }\n\n  async memoryStats(): Promise<{\n    vectorCount: number;\n    tripleCount: number;\n    storageEstimateBytes: number;\n    lastIngestionAt?: string;\n  }> {\n    return this.request(\"/agent/memory/stats\");\n  }\n\n  // ─── Search ──────────────────────────────────────────────\n\n  async searchWeb(params: {\n    query: string;\n    count?: number;\n    offset?: number;\n    country?: string;\n    freshness?: string;\n  }): Promise<unknown> {\n    return this.request(\"/agent/search/web\", {\n      method: \"POST\",\n      body: JSON.stringify(params),\n    });\n  }\n\n  async searchImages(params: {\n    query: string;\n    count?: number;\n  }): Promise<unknown> {\n    return this.request(\"/agent/search/images\", {\n      method: \"POST\",\n      body: JSON.stringify(params),\n    });\n  }\n\n  async searchNews(params: {\n    query: string;\n    count?: number;\n    freshness?: string;\n  }): Promise<unknown> {\n    return this.request(\"/agent/search/news\", {\n      method: \"POST\",\n      body: JSON.stringify(params),\n    });\n  }\n}\n"],"mappings":";AAsCA,IAAa,iBAAb,MAA4B;CAC1B;CACA;CAEA,YAAY,QAA8B;AACxC,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS,OAAO;;CAGvB,MAAc,QAAW,MAAc,SAAmC;EACxE,MAAM,MAAM,GAAG,KAAK,SAAS;EAC7B,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ;AAC7C,UAAQ,IAAI,iBAAiB,UAAU,KAAK,SAAS;AACrD,UAAQ,IAAI,gBAAgB,mBAAmB;EAE/C,MAAM,MAAM,MAAM,MAAM,KAAK;GAAE,GAAG;GAAS;GAAS,CAAC;AAErD,MAAI,CAAC,IAAI,IAAI;AACX,SAAM,IAAI,MAAM;AAChB,SAAM,IAAI,MAAM,6BAA6B,OAAO,IAAI,OAAO,CAAC,GAAG;;AAIrE,UADc,MAAM,IAAI,MAAM,EAClB;;CAGd,MAAM,mBAAkD;AACtD,SAAO,KAAK,QAA8B,sBAAsB;;CAGlE,MAAM,qBAAqB,eAAyD;AAClF,SAAO,KAAK,QACV,uBAAuB,mBAAmB,cAAc,CAAC,SAC1D;;CAGH,MAAM,wBACJ,eACA,QACe;AACf,QAAM,KAAK,QACT,uBAAuB,mBAAmB,cAAc,IACxD;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC;GACjC,CACF;;CAGH,MAAM,mBACJ,eACA,SAC6B;AAC7B,SAAO,KAAK,QAA4B,uBAAuB;GAC7D,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,SAAS,SAAS;IAClB,QAAQ,SAAS;IAClB,CAAC;GACH,CAAC;;CAGJ,MAAM,kBAAkB,eAAoD;AAC1E,SAAO,KAAK,QACV,uBAAuB,mBAAmB,cAAc,IACxD,EAAE,QAAQ,UAAU,CACrB;;CAGH,MAAM,YACJ,UACA,QAC+D;EAC/D,MAAM,SAAS,IAAI,gBAAgB,EAAE,UAAU,CAAC;AAChD,MAAI,QAAQ,OAAQ,QAAO,IAAI,UAAU,OAAO,KAAK,IAAI,CAAC;AAC1D,SAAO,KAAK,QAAQ,iCAAiC,OAAO,UAAU,GAAG;;CAG3E,MAAM,eACJ,UACoF;AACpF,SAAO,KAAK,QACV,6CAA6C,mBAAmB,SAAS,GAC1E;;CAGH,MAAM,cAA0D;AAC9D,SAAO,KAAK,QAA2C,yBAAyB;;CAGlF,MAAM,uBAgBH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,wBAAwB,OAE3B;AACD,SAAO,KAAK,QAAQ,0BAA0B,mBAAmB,MAAM,IAAI,EACzE,QAAQ,UACT,CAAC;;CAGJ,MAAM,wBAAwB,OAE3B;AACD,SAAO,KAAK,QAAQ,0BAA0B,mBAAmB,MAAM,CAAC,WAAW,EACjF,QAAQ,OACT,CAAC;;CAGJ,MAAM,2BAMH;AACD,SAAO,KAAK,QAAQ,iCAAiC;;CAGvD,MAAM,uBAGH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,qBAIH;AACD,SAAO,KAAK,QAAQ,0BAA0B;;CAGhD,MAAM,mBAGH;AACD,SAAO,KAAK,QAAQ,qBAAqB,EAAE,QAAQ,QAAQ,CAAC;;CAG9D,MAAM,uBAIH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,0BAWH;AACD,SAAO,KAAK,QAAQ,+BAA+B;;CAGrD,MAAM,wBAGH;AACD,SAAO,KAAK,QAAQ,0BAA0B,EAAE,QAAQ,QAAQ,CAAC;;CAGnE,MAAM,qBAKH;AACD,SAAO,KAAK,QAAQ,0BAA0B;;CAGhD,MAAM,mBAGH;AACD,SAAO,KAAK,QAAQ,qBAAqB,EAAE,QAAQ,QAAQ,CAAC;;CAG9D,MAAM,sBASH;AACD,SAAO,KAAK,QAAQ,+BAA+B;;CAGrD,MAAM,iBAAiB,MAI0B;AAC/C,SAAO,KAAK,QAAQ,yBAAyB;GAC3C,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,oBAEH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,mBAAmB,OAEtB;AACD,SAAO,KAAK,QAAQ,mCAAmC;GACrD,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;GAChC,CAAC;;CAGJ,MAAM,eAAe,MAIc;AACjC,SAAO,KAAK,QAA+B,mBAAmB;GAC5D,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;;;;;CA2BJ,MAAM,sBAAsB,MAIE;AAC5B,SAAO,KAAK,QAA0B,oCAAoC;GACxE,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;;;;;CAQJ,MAAM,qBAAqB,MAKW;AACpC,SAAO,KAAK,QAAkC,mCAAmC;GAC/E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;CAIJ,MAAM,kBAAkB,MAQU;EAChC,MAAM,EAAE,OAAO,SAAS,UAAU,GAAG,SAAS;AAC9C,SAAO,KAAK,QACV,kBAAkB,mBAAmB,MAAM,CAAC,GAAG,mBAAmB,QAAQ,CAAC,GAAG,mBAAmB,SAAS,IAC1G;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CACF;;;CAIH,MAAM,kBAAkB,MAIY;AAClC,SAAO,KAAK,QACV,kBAAkB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,CAAC,GAAG,mBAAmB,KAAK,SAAS,GAC1H;;;CAIH,MAAM,YAAY,MAGY;AAI5B,UAHa,MAAM,KAAK,QACtB,kBAAkB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,GACrF,EACW;;;CAId,MAAM,aAAa,MAID;AAChB,QAAM,KAAK,QACT,kBAAkB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,CAAC,GAAG,mBAAmB,KAAK,SAAS,IACzH,EAAE,QAAQ,UAAU,CACrB;;;CAIH,MAAM,mBAAyC;AAE7C,UADa,MAAM,KAAK,QAAiC,wBAAwB,EACrE;;CAQd,MAAM,gBAAgB,MAUnB;AACD,SAAO,KAAK,QAAQ,2BAA2B;GAC7C,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,cAAc,MAWjB;AACD,SAAO,KAAK,QAAQ,2BAA2B;GAC7C,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,oBAAoB,MAMyB;AACjD,SAAO,KAAK,QAAQ,8BAA8B;GAChD,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,iBAAiB,MAOgB;EACrC,MAAM,KAAK,IAAI,iBAAiB;AAChC,MAAI,MAAM,EAAG,IAAG,IAAI,KAAK,KAAK,EAAE;AAChC,MAAI,MAAM,OAAQ,IAAG,IAAI,UAAU,KAAK,OAAO;AAC/C,MAAI,MAAM,IAAK,IAAG,IAAI,OAAO,KAAK,IAAI;AACtC,MAAI,MAAM,SAAU,IAAG,IAAI,YAAY,KAAK,SAAS;AACrD,MAAI,MAAM,MAAO,IAAG,IAAI,SAAS,OAAO,KAAK,MAAM,CAAC;AACpD,MAAI,MAAM,OAAQ,IAAG,IAAI,UAAU,OAAO,KAAK,OAAO,CAAC;EACvD,MAAM,QAAQ,GAAG,UAAU;AAC3B,SAAO,KAAK,QAAQ,yBAAyB,QAAQ,IAAI,UAAU,KAAK;;CAG1E,MAAM,mBAAmB,YAGtB;AACD,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,UAAU;;CAGlF,MAAM,gBAAgB,YAAoB,MAGG;AAC3C,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,SAAS;GAC7E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,gBAAgB,YAAoB,MAEG;AAC3C,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,WAAW;GAC/E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,gBAAgB,YAAoB,MAIH;AACrC,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,SAAS;GAC7E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,YAAY,YAAoB,MAIT;AAC3B,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,QAAQ;GAC5E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,qBAAqB,YAAoB,MAGX;EAClC,MAAM,KAAK,IAAI,iBAAiB;AAChC,MAAI,MAAM,MAAO,IAAG,IAAI,SAAS,OAAO,KAAK,MAAM,CAAC;AACpD,MAAI,MAAM,OAAQ,IAAG,IAAI,UAAU,OAAO,KAAK,OAAO,CAAC;EACvD,MAAM,QAAQ,GAAG,UAAU;AAC3B,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,YAAY,QAAQ,IAAI,UAAU,KAAK;;CAG/G,MAAM,iBAAiB,YAAoB,MAGG;AAC5C,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,YAAY;GAChF,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,4BAA4B,MAY/B;AACD,SAAO,KAAK,QAAQ,kCAAkC;GACpD,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,4BAA4B,MAGsC;AACtE,SAAO,KAAK,QAAQ,kCAAkC;GACpD,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAQJ,MAAM,aAAa,OAAe,MAS/B;AACD,SAAO,KAAK,QAAQ,wBAAwB;GAC1C,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,OAAO,MAAM,SAAS;IACtB,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,KAAK,MAAM;IACX,kBAAkB,MAAM,oBAAoB;IAC7C,CAAC;GACH,CAAC;;CAGJ,MAAM,YAAY,MAAc,MAKE;AAChC,SAAO,KAAK,QAAQ,uBAAuB;GACzC,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,OAAO,MAAM,SAAS;IACtB,UAAU,MAAM,YAAY;IAC5B,KAAK,MAAM,OAAO;IAClB,YAAY,MAAM,cAAc;IACjC,CAAC;GACH,CAAC;;CAGJ,MAAM,aAAa,YAAoB,UAKlC,UAIkD;AACrD,SAAO,KAAK,QAAQ,wBAAwB;GAC1C,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,oBAAoB,SAAS,SAAS,IAAI,SAAS,SAAS,SAAS,GAAG,QAAQ;IAChF;IACA;IACD,CAAC;GACH,CAAC;;CAGJ,MAAM,kBAAkB,MAAe,WAGpC;EACD,MAAM,SAAS,IAAI,iBAAiB;AACpC,MAAI,SAAS,KAAA,EAAW,QAAO,IAAI,QAAQ,OAAO,KAAK,CAAC;AACxD,MAAI,UAAW,QAAO,IAAI,aAAa,UAAU;EACjD,MAAM,KAAK,OAAO,UAAU;AAC5B,SAAO,KAAK,QAAQ,wBAAwB,KAAK,IAAI,OAAO,KAAK;;CAGnE,MAAM,mBAAmB,SAGtB;AACD,SAAO,KAAK,QAAQ,4CAA4C,mBAAmB,QAAQ,GAAG;;CAGhG,MAAM,iBAGH;AACD,SAAO,KAAK,QAAQ,yBAAyB;;CAG/C,MAAM,aAAa,UAAiD;AAClE,SAAO,KAAK,QAAQ,iBAAiB,mBAAmB,SAAS,IAAI,EACnE,QAAQ,UACT,CAAC;;CAGJ,MAAM,cAKH;AACD,SAAO,KAAK,QAAQ,sBAAsB;;CAK5C,MAAM,UAAU,QAMK;AACnB,SAAO,KAAK,QAAQ,qBAAqB;GACvC,QAAQ;GACR,MAAM,KAAK,UAAU,OAAO;GAC7B,CAAC;;CAGJ,MAAM,aAAa,QAGE;AACnB,SAAO,KAAK,QAAQ,wBAAwB;GAC1C,QAAQ;GACR,MAAM,KAAK,UAAU,OAAO;GAC7B,CAAC;;CAGJ,MAAM,WAAW,QAII;AACnB,SAAO,KAAK,QAAQ,sBAAsB;GACxC,QAAQ;GACR,MAAM,KAAK,UAAU,OAAO;GAC7B,CAAC"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @alfe.ai/agent-api-client — Agent self-service API client.\n *\n * Used by agents calling /agent/ endpoints. The agent authenticates\n * with its API key — the backend resolves agentId + tenantId from the token.\n * No agent ID needed in paths or config.\n */\n\nexport type {\n  IntegrationInstall,\n  IntegrationConfigResult,\n  RegistryEntry,\n  IntegrationConfigSchemaField,\n  SecretScope,\n  EncryptedEnvelopeV1,\n  SecretMetadata,\n  SecretEnvelopeResponse,\n  ScopeInfo,\n  GeneratedDataKey,\n} from \"@alfe/types\";\n\nimport type {\n  IntegrationInstall,\n  IntegrationConfigResult,\n  RegistryEntry,\n  SecretScope,\n  EncryptedEnvelopeV1,\n  SecretMetadata,\n  SecretEnvelopeResponse,\n  ScopeInfo,\n  GeneratedDataKey,\n} from \"@alfe/types\";\n\nexport interface AgentApiClientConfig {\n  apiKey: string;\n  apiUrl: string;\n}\n\n// ─── Sync types ──────────────────────────────────────────\n\nexport interface SyncAgentInfo {\n  agentId: string;\n  tenantId: string;\n  displayName: string;\n  s3Prefix: string;\n  status: \"stale\" | \"syncing\" | \"synced\";\n  fileCount?: number;\n  totalSize?: number;\n  lastSync?: string;\n}\n\nexport interface SyncManifestEntry {\n  hash: string;\n  size: number;\n  modified: string;\n  etag?: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\n\nexport interface SyncManifest {\n  version: 1;\n  agentId: string;\n  lastSync: string;\n  files: Record<string, SyncManifestEntry>;\n}\n\nexport interface SyncPresignedUrl {\n  path: string;\n  url: string;\n  expiresAt: string;\n}\n\nexport interface SyncConfirmedUpload {\n  filePath: string;\n  hash: string;\n  size: number;\n  storageClass: \"STANDARD\" | \"GLACIER_IR\";\n  syncedAt: string;\n}\n\nexport interface SyncReconstructFile {\n  path: string;\n  size: number;\n  url: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\n\nexport interface SyncReconstructBundle {\n  agentId: string;\n  mode: \"full\" | \"active\" | \"memory\";\n  fileCount: number;\n  totalSize: number;\n  files: SyncReconstructFile[];\n  expiresAt: string;\n}\n\nexport interface SyncAgentStats {\n  agentId: string;\n  standardBytes: number;\n  glacierBytes: number;\n  fileCount: number;\n  lastSyncAt: string | null;\n}\n\nexport interface SyncFileEntry {\n  filePath: string;\n  size: number;\n  modified: string;\n  contentHash: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\n\nexport interface SyncSessionEntry {\n  sessionId: string;\n  size: number;\n  lastModified: string;\n  storageClass?: string;\n  isArchived: boolean;\n}\n\nexport interface SyncSessionContent {\n  sessionId: string;\n  content: string;\n  compressed: boolean;\n}\n\nexport interface SharedFileEntry {\n  filePath: string;\n  fileName: string;\n  size: number;\n  contentType?: string;\n}\n\n/**\n * Encode each path segment but keep the `/` separators — `encodeURIComponent`\n * would escape the slashes too, breaking greedy proxy routes.\n */\nfunction encodeFilePath(filePath: string): string {\n  return filePath.split(\"/\").map(encodeURIComponent).join(\"/\");\n}\n\nexport class AgentApiClient {\n  private readonly apiKey: string;\n  private readonly apiUrl: string;\n\n  constructor(config: AgentApiClientConfig) {\n    this.apiKey = config.apiKey;\n    this.apiUrl = config.apiUrl;\n  }\n\n  private async request<T>(path: string, options?: RequestInit): Promise<T> {\n    const url = `${this.apiUrl}${path}`;\n    const headers = new Headers(options?.headers);\n    headers.set(\"Authorization\", `Bearer ${this.apiKey}`);\n    headers.set(\"Content-Type\", \"application/json\");\n\n    const res = await fetch(url, { ...options, headers });\n\n    if (!res.ok) {\n      await res.text(); // drain body\n      throw new Error(`Agent API request failed (${String(res.status)})`);\n    }\n\n    const body = (await res.json()) as { data: T };\n    return body.data;\n  }\n\n  // ─── Sync ────────────────────────────────────────────────\n  //\n  // Workspace backup. The agent only ever calls /agents/sync/* — file\n  // bytes go to/from S3 via presigned URLs (S3 fetch is the one\n  // legitimate raw-fetch in a plugin). Dashboard editing uses the\n  // user-API at /sync/agents/{agentId}/* and is not exposed here.\n\n  async syncRegister(args?: { displayName?: string }): Promise<{ agent: SyncAgentInfo }> {\n    return this.request(\"/agents/sync/register\", {\n      method: \"POST\",\n      body: JSON.stringify(args ?? {}),\n    });\n  }\n\n  async syncGetManifest(): Promise<SyncManifest> {\n    return this.request(\"/agents/sync/manifest\");\n  }\n\n  async syncPresign(args: {\n    files: { path: string; operation: \"put\" | \"get\"; contentType?: string }[];\n  }): Promise<{ urls: SyncPresignedUrl[] }> {\n    return this.request(\"/agents/sync/presign\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async syncConfirmUpload(args: {\n    filePath: string;\n    hash: string;\n    size: number;\n    storageClass?: \"STANDARD\" | \"GLACIER_IR\";\n  }): Promise<SyncConfirmedUpload> {\n    return this.request(\"/agents/sync/confirm\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async syncReconstruct(args: {\n    mode: \"full\" | \"active\" | \"memory\";\n  }): Promise<SyncReconstructBundle> {\n    return this.request(\"/agents/sync/reconstruct\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async syncGetStats(): Promise<SyncAgentStats> {\n    return this.request(\"/agents/sync/stats\");\n  }\n\n  async syncListFiles(args?: { prefix?: string }): Promise<{ files: SyncFileEntry[] }> {\n    const qs = new URLSearchParams();\n    if (args?.prefix) qs.set(\"prefix\", args.prefix);\n    const query = qs.toString();\n    return this.request(`/agents/sync/files${query ? `?${query}` : \"\"}`);\n  }\n\n  async syncListSessions(): Promise<{ sessions: SyncSessionEntry[] }> {\n    return this.request(\"/agents/sync/sessions\");\n  }\n\n  async syncGetSession(sessionId: string): Promise<SyncSessionContent> {\n    return this.request(`/agents/sync/sessions/${encodeURIComponent(sessionId)}`);\n  }\n\n  async syncDeleteFile(filePath: string): Promise<{ removed: boolean }> {\n    return this.request(`/agents/sync/files/${encodeFilePath(filePath)}`, {\n      method: \"DELETE\",\n    });\n  }\n\n  // ─── Shared (org/team/project) files ─────────────────────\n  //\n  // Used by the sync plugin's shared-sync engine to mirror org-scoped\n  // files into the agent's `shared/` directory. Routes live in services/org.\n\n  async sharedListFiles(args: {\n    scope: \"org\" | \"team\" | \"project\";\n    scopeId: string;\n  }): Promise<{ files: SharedFileEntry[]; nextCursor: string | null }> {\n    return this.request(\n      `/agents/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`,\n    );\n  }\n\n  async sharedDownloadUrl(args: {\n    scope: \"org\" | \"team\" | \"project\";\n    scopeId: string;\n    filePath: string;\n  }): Promise<{ downloadUrl: string; expiresIn: number }> {\n    return this.request(\n      `/agents/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/download/${encodeFilePath(args.filePath)}`,\n    );\n  }\n\n  async listIntegrations(): Promise<IntegrationInstall[]> {\n    return this.request<IntegrationInstall[]>(\"/agent/integrations\");\n  }\n\n  async getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult> {\n    return this.request<IntegrationConfigResult>(\n      `/agent/integrations/${encodeURIComponent(integrationId)}/config`,\n    );\n  }\n\n  async updateIntegrationConfig(\n    integrationId: string,\n    config: Record<string, unknown>,\n  ): Promise<void> {\n    await this.request<unknown>(\n      `/agent/integrations/${encodeURIComponent(integrationId)}`,\n      {\n        method: \"PATCH\",\n        body: JSON.stringify({ config }),\n      },\n    );\n  }\n\n  async installIntegration(\n    integrationId: string,\n    options?: { version?: string; config?: Record<string, unknown> },\n  ): Promise<IntegrationInstall> {\n    return this.request<IntegrationInstall>(\"/agent/integrations\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        integrationId,\n        version: options?.version,\n        config: options?.config,\n      }),\n    });\n  }\n\n  async removeIntegration(integrationId: string): Promise<IntegrationInstall> {\n    return this.request<IntegrationInstall>(\n      `/agent/integrations/${encodeURIComponent(integrationId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n\n  async getOAuthUrl(\n    provider: string,\n    scopes?: string[],\n  ): Promise<{ url: string; provider: string; expiresIn: number }> {\n    const params = new URLSearchParams({ provider });\n    if (scopes?.length) params.set(\"scopes\", scopes.join(\",\"));\n    return this.request(`/agent/integrations/oauth/url?${params.toString()}`);\n  }\n\n  async getOAuthStatus(\n    provider: string,\n  ): Promise<{ provider: string; connected: boolean; config?: Record<string, string> }> {\n    return this.request(\n      `/agent/integrations/oauth/status?provider=${encodeURIComponent(provider)}`,\n    );\n  }\n\n  async getRegistry(): Promise<{ integrations: RegistryEntry[] }> {\n    return this.request<{ integrations: RegistryEntry[] }>(\"/integrations/registry\");\n  }\n\n  async getGoogleCredentials(): Promise<{\n    accounts?: {\n      email: string;\n      refreshToken: string;\n      clientId: string;\n      clientSecret: string;\n      enabledServices?: string[];\n      isDefault: boolean;\n      displayName?: string;\n    }[];\n    email: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    projectId: string;\n    enabledServices?: string[];\n  }> {\n    return this.request(\"/agent/google/credentials\");\n  }\n\n  async disconnectGoogleAccount(email: string): Promise<{\n    accounts: { email: string; displayName?: string; isDefault: boolean }[];\n  }> {\n    return this.request(`/agent/google/accounts/${encodeURIComponent(email)}`, {\n      method: \"DELETE\",\n    });\n  }\n\n  async setDefaultGoogleAccount(email: string): Promise<{\n    accounts: { email: string; displayName?: string; isDefault: boolean }[];\n  }> {\n    return this.request(`/agent/google/accounts/${encodeURIComponent(email)}/default`, {\n      method: \"PUT\",\n    });\n  }\n\n  async getGoogleChatCredentials(): Promise<{\n    email: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    displayName?: string;\n  }> {\n    return this.request(\"/agent/google-chat/credentials\");\n  }\n\n  async getGithubCredentials(): Promise<{\n    login: string;\n    accessToken: string;\n  }> {\n    return this.request(\"/agent/github/credentials\");\n  }\n\n  async getXeroCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    xeroTenantId: string;\n  }> {\n    return this.request(\"/agent/xero/credentials\");\n  }\n\n  async refreshXeroToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }> {\n    return this.request(\"/agent/xero/token\", { method: \"POST\" });\n  }\n\n  async getNotionCredentials(): Promise<{\n    accessToken: string;\n    workspaceId: string;\n    workspaceName: string;\n  }> {\n    return this.request(\"/agent/notion/credentials\");\n  }\n\n  async getAtlassianCredentials(): Promise<{\n    accessToken: string;\n    refreshToken: string;\n    accessTokenExpiresAt: string;\n    cloudId: string;\n    siteName: string;\n    siteUrl: string;\n    email: string;\n    enabledProducts: string[];\n    clientId: string;\n    clientSecret: string;\n  }> {\n    return this.request(\"/agent/atlassian/credentials\");\n  }\n\n  async refreshAtlassianToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }> {\n    return this.request(\"/agent/atlassian/token\", { method: \"POST\" });\n  }\n\n  async getMYOBCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    myobBusinessId: string;\n    clientId: string;\n  }> {\n    return this.request(\"/agent/myob/credentials\");\n  }\n\n  async refreshMYOBToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }> {\n    return this.request(\"/agent/myob/token\", { method: \"POST\" });\n  }\n\n  async getTeamsCredentials(): Promise<{\n    agentId: string;\n    tenantId: string;\n    azureAppId: string;\n    azureBotId: string;\n    azureClientSecret: string;\n    botDisplayName?: string;\n    teamsTenantId?: string;\n    serviceUrl?: string;\n  }> {\n    return this.request(\"/agent/microsoft/credentials\");\n  }\n\n  async sendTeamsMessage(data: {\n    conversationId: string;\n    text?: string;\n    adaptiveCard?: Record<string, unknown>;\n  }): Promise<{ ok: boolean; activityId: string }> {\n    return this.request(\"/agent/microsoft/send\", {\n      method: \"POST\",\n      body: JSON.stringify(data),\n    });\n  }\n\n  async listTeamsChannels(): Promise<{\n    channels: { id: string; name: string; description?: string }[];\n  }> {\n    return this.request(\"/agent/microsoft/channels\");\n  }\n\n  async presignAttachments(files: { filename: string; mimeType: string; size: number }[]): Promise<{\n    attachments: { id: string; uploadUrl: string; downloadUrl: string; s3Key: string; expiresAt: string }[];\n  }> {\n    return this.request(\"/agent/chat/attachments/presign\", {\n      method: \"POST\",\n      body: JSON.stringify({ files }),\n    });\n  }\n\n  async recordActivity(data: {\n    userId?: string;\n    channel: string;\n    role: \"user\" | \"assistant\";\n  }): Promise<{ recorded: boolean }> {\n    return this.request<{ recorded: boolean }>(\"/agent/activity\", {\n      method: \"POST\",\n      body: JSON.stringify(data),\n    });\n  }\n\n  // ─── Secrets ──────────────────────────────────────────────────\n  //\n  // Envelope CRUD + KMS proxy for per-scope encrypted secret storage.\n  // Agents never hold a KMS master key — these proxy endpoints mint one-shot\n  // AES-256 data keys bound (via KMS encryption context) to\n  // `{ tenantId, scope, scopeId, secretId }`. The agent performs AES-256-GCM\n  // locally; the backend only ever sees opaque envelopes.\n  //\n  // Routes resolve to the agent API gateway (mapping key `agent`), where\n  // services/secrets registers its routes with pathPrefix `/secrets`. With\n  // `apiUrl` set to the host root (e.g. `https://api.alfe.ai`), the full URL\n  // is `https://api.alfe.ai/agent/secrets/...`. This is the same mapping as\n  // `/agent/integrations/...` etc. — do NOT hit `/secrets/...` on the root\n  // host: that's the user-auth dashboard gateway, which rejects agent tokens.\n  //\n  // `plaintextKey` in responses is base64 — callers MUST decode to a Node\n  // `Buffer` immediately and zero it after use. NEVER keep plaintext keys\n  // as JS strings (strings are immutable and cannot be wiped).\n\n  /**\n   * Mint a fresh AES-256 data key for a new secret or rotation. The encryption\n   * context is rebuilt server-side from `auth.tenantId` + the body fields; the\n   * agent cannot forge context for a scope it doesn't own.\n   */\n  async generateSecretDataKey(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n  }): Promise<GeneratedDataKey> {\n    return this.request<GeneratedDataKey>(\"/agent/secrets/generate-data-key\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  /**\n   * Unwrap a wrapped data key so the agent can decrypt the envelope locally.\n   * KMS Decrypt will fail with `InvalidCiphertextException` if the envelope\n   * was tampered with in a way that changes `{ tenantId, scope, scopeId, secretId }`.\n   */\n  async decryptSecretDataKey(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n    dataKeyCiphertext: string;\n  }): Promise<{ plaintextKey: string }> {\n    return this.request<{ plaintextKey: string }>(\"/agent/secrets/decrypt-data-key\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  /** Upload a pre-encrypted envelope for a secret. */\n  async putSecretEnvelope(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n    secretName: string;\n    envelope: EncryptedEnvelopeV1;\n    description?: string;\n    tags?: string[];\n  }): Promise<{ secretId: string }> {\n    const { scope, scopeId, secretId, ...body } = args;\n    return this.request<{ secretId: string }>(\n      `/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`,\n      {\n        method: \"PUT\",\n        body: JSON.stringify(body),\n      },\n    );\n  }\n\n  /** Fetch the encrypted envelope for a single secret. */\n  async getSecretEnvelope(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n  }): Promise<SecretEnvelopeResponse> {\n    return this.request<SecretEnvelopeResponse>(\n      `/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`,\n    );\n  }\n\n  /** List metadata (never envelopes) for secrets in a scope. */\n  async listSecrets(args: {\n    scope: SecretScope;\n    scopeId: string;\n  }): Promise<SecretMetadata[]> {\n    const resp = await this.request<{ secrets: SecretMetadata[] }>(\n      `/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`,\n    );\n    return resp.secrets;\n  }\n\n  /** Delete a secret. */\n  async deleteSecret(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n  }): Promise<void> {\n    await this.request<unknown>(\n      `/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n\n  /** Enumerate scopes (org/team/project/agent) this agent can access. */\n  async listSecretScopes(): Promise<ScopeInfo[]> {\n    const resp = await this.request<{ scopes: ScopeInfo[] }>(\"/agent/secrets/scopes\");\n    return resp.scopes;\n  }\n\n  // ─── Identity ─────────────────────────────────────────────\n  //\n  // Identity resolution, permission enforcement, and CRM tools.\n  // The agent API derives tenantId + agentId from the agent token.\n\n  async resolveIdentity(args: {\n    provider: string;\n    platformId: string;\n    kind?: \"user\" | \"agent\" | \"service\" | \"bot\" | \"workspace\";\n    displayName?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n    accessAllowed: boolean;\n    created?: boolean;\n    reason?: string;\n  }> {\n    return this.request(\"/agent/identity/resolve\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async searchIdentities(args?: {\n    q?: string;\n    status?: string;\n    limit?: number;\n  }): Promise<{ identities: unknown[] }> {\n    const qs = new URLSearchParams();\n    if (args?.q) qs.set(\"q\", args.q);\n    if (args?.status) qs.set(\"status\", args.status);\n    if (args?.limit) qs.set(\"limit\", String(args.limit));\n    const query = qs.toString();\n    return this.request(`/agent/identity/search${query ? `?${query}` : \"\"}`);\n  }\n\n  async getIdentityContext(identityId: string): Promise<{\n    context: unknown;\n  }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/context`);\n  }\n\n  async mergeIdentities(survivorId: string, args: {\n    mergedId: string;\n    changedBy: { type: string; id: string; name?: string };\n  }): Promise<{ ok: boolean; error?: string }> {\n    return this.request(`/agent/identity/${encodeURIComponent(survivorId)}/merge`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async unmergeIdentity(identityId: string, args: {\n    changedBy: { type: string; id: string; name?: string };\n  }): Promise<{ ok: boolean; error?: string }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/unmerge`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async addIdentityNote(identityId: string, args: {\n    content: string;\n    category?: string;\n    changedBy: { type: string; id: string; name?: string };\n  }): Promise<{ noteId: string | null }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/notes`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async tagIdentity(identityId: string, args: {\n    tag: string;\n    action: \"add\" | \"remove\";\n    changedBy: { type: string; id: string; name?: string };\n  }): Promise<{ ok: boolean }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/tags`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async getIdentityChangelog(identityId: string, args?: {\n    limit?: number;\n  }): Promise<{ entries: unknown[] }> {\n    const qs = new URLSearchParams();\n    if (args?.limit) qs.set(\"limit\", String(args.limit));\n    const query = qs.toString();\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/changelog${query ? `?${query}` : \"\"}`);\n  }\n\n  async rollbackIdentity(identityId: string, args: {\n    targetVersion: number;\n    changedBy: { type: string; id: string; name?: string };\n  }): Promise<{ ok: boolean; entry?: unknown }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/rollback`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async requestIdentityVerification(args: {\n    claimedIdentityId: string;\n    requestingIdentityId: string;\n    requestingProvider: string;\n    requestingPlatformId: string;\n    preferredChannel?: \"mobile\" | \"email\";\n    /**\n     * Phase 2: agent-supplied contact endpoint. When provided, the top-level\n     * `preferredChannel` is ignored — the contact's channel wins.\n     */\n    contact?: { channel: \"email\" | \"mobile\"; value: string };\n  }): Promise<{\n    verificationId: string;\n    channel: string;\n    deliveredTo: string;\n    expiresAt: string;\n    availableChannels: { channel: string; deliveredTo: string }[];\n  } | { error: string }> {\n    return this.request(\"/agent/identity/verify/request\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  async confirmIdentityVerification(args: {\n    claimedIdentityId: string;\n    verificationId: string;\n    phrase: string;\n  }): Promise<{\n    verified: boolean;\n    identityId?: string;\n    /** Phase 2: how the confirm resolved — Scenario A vs B. */\n    action?: \"merged\" | \"contact_verified\";\n    error?: string;\n  }> {\n    return this.request(\"/agent/identity/verify/confirm\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  /**\n   * Update display-shape fields on an Identity. Body excludes `email` /\n   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go\n   * via the verify flow, title/company live on OrgMembership, metadata is\n   * not agent-writable.\n   */\n  async updateIdentity(\n    identityId: string,\n    args: {\n      name?: string;\n      avatarUrl?: string;\n      timezone?: string;\n      locale?: string;\n    },\n  ): Promise<{ ok: boolean }> {\n    return this.request(`/agent/identity/${encodeURIComponent(identityId)}/update`, {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  /**\n   * Phase 2 (Section H): server-side verification of a Google Chat sender via\n   * the agent's existing Google OAuth credentials. Returns the resolved\n   * identity (created or matched via Scenario-B email enrichment).\n   */\n  async resolveGoogleChatSender(args: {\n    senderUserId: string;\n    spaceId?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n    accessAllowed: boolean;\n  }> {\n    return this.request(\"/agent/google/resolve-sender\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  // ─── Memory ──────────────────────────────────────────────\n  //\n  // Cloud memory (Turbopuffer vectors + DynamoDB knowledge graph).\n  // The agent API derives tenantId + agentId from the agent token.\n\n  async memorySearch(query: string, opts?: {\n    limit?: number;\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    includeKnowledge?: boolean;\n  }): Promise<{\n    facts: { subject: string; predicate: string; object: string; since: string; confidence: number }[];\n    memories: { id: string; text: string; topic: string; subtopic: string; tag: string; importance: number; timestamp: number; score: number }[];\n  }> {\n    return this.request(\"/agent/memory/search\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        query,\n        limit: opts?.limit ?? 10,\n        topic: opts?.topic,\n        subtopic: opts?.subtopic,\n        tag: opts?.tag,\n        includeKnowledge: opts?.includeKnowledge ?? true,\n      }),\n    });\n  }\n\n  async memoryStore(text: string, opts?: {\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    importance?: number;\n  }): Promise<{ memoryId: string }> {\n    return this.request(\"/agent/memory/store\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        text,\n        topic: opts?.topic ?? \"general\",\n        subtopic: opts?.subtopic ?? \"general\",\n        tag: opts?.tag ?? \"fact\",\n        importance: opts?.importance ?? 0.7,\n      }),\n    });\n  }\n\n  async memoryIngest(sessionKey: string, messages: {\n    role: string;\n    content: string;\n    index: number;\n    timestamp?: string;\n  }[], metadata?: {\n    channelId?: string;\n    userId?: string;\n    userName?: string;\n  }): Promise<{ queued: boolean; messageCount: number }> {\n    return this.request(\"/agent/memory/ingest\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        sessionKey,\n        lastProcessedIndex: messages.length > 0 ? messages[messages.length - 1].index : -1,\n        messages,\n        metadata,\n      }),\n    });\n  }\n\n  async memoryLoadContext(tier?: number, topicHint?: string): Promise<{\n    formatted: string;\n    [key: string]: unknown;\n  }> {\n    const params = new URLSearchParams();\n    if (tier !== undefined) params.set(\"tier\", String(tier));\n    if (topicHint) params.set(\"topicHint\", topicHint);\n    const qs = params.toString();\n    return this.request(`/agent/memory/context${qs ? `?${qs}` : \"\"}`);\n  }\n\n  async memoryLookupEntity(subject: string): Promise<{\n    subject: string;\n    triples: { tripleId: string; predicate: string; object: string; validFrom: string; validTo?: string; confidence: number }[];\n  }> {\n    return this.request(`/agent/memory/knowledge/entities?subject=${encodeURIComponent(subject)}`);\n  }\n\n  async memoryNavigate(): Promise<{\n    topics: { name: string; tripleCount: number; subtopics: string[] }[];\n    cursor: string | null;\n  }> {\n    return this.request(\"/agent/memory/navigate\");\n  }\n\n  async memoryDelete(memoryId: string): Promise<{ deleted: boolean }> {\n    return this.request(`/agent/memory/${encodeURIComponent(memoryId)}`, {\n      method: \"DELETE\",\n    });\n  }\n\n  async memoryStats(): Promise<{\n    vectorCount: number;\n    tripleCount: number;\n    storageEstimateBytes: number;\n    lastIngestionAt?: string;\n  }> {\n    return this.request(\"/agent/memory/stats\");\n  }\n\n  // ─── Search ──────────────────────────────────────────────\n\n  async searchWeb(params: {\n    query: string;\n    count?: number;\n    offset?: number;\n    country?: string;\n    freshness?: string;\n  }): Promise<unknown> {\n    return this.request(\"/agent/search/web\", {\n      method: \"POST\",\n      body: JSON.stringify(params),\n    });\n  }\n\n  async searchImages(params: {\n    query: string;\n    count?: number;\n  }): Promise<unknown> {\n    return this.request(\"/agent/search/images\", {\n      method: \"POST\",\n      body: JSON.stringify(params),\n    });\n  }\n\n  async searchNews(params: {\n    query: string;\n    count?: number;\n    freshness?: string;\n  }): Promise<unknown> {\n    return this.request(\"/agent/search/news\", {\n      method: \"POST\",\n      body: JSON.stringify(params),\n    });\n  }\n\n  // ─── Database ───────────────────────────────────────────\n\n  async registerDatabaseCredentials(): Promise<{\n    connectionString: string;\n    username: string;\n    password: string;\n    databases: string[];\n  }> {\n    return this.request(\"/agent/database/register\", { method: \"POST\" });\n  }\n\n  async reportDatabaseAudit(entry: {\n    database: string;\n    collection: string;\n    operation: string;\n    summary?: string;\n  }): Promise<void> {\n    await this.request(\"/agent/database/audit\", {\n      method: \"POST\",\n      body: JSON.stringify(entry),\n    }).catch(() => {\n      // Fire and forget — audit failure doesn't affect operations\n    });\n  }\n}\n"],"mappings":";;;;;AA4IA,SAAS,eAAe,UAA0B;AAChD,QAAO,SAAS,MAAM,IAAI,CAAC,IAAI,mBAAmB,CAAC,KAAK,IAAI;;AAG9D,IAAa,iBAAb,MAA4B;CAC1B;CACA;CAEA,YAAY,QAA8B;AACxC,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS,OAAO;;CAGvB,MAAc,QAAW,MAAc,SAAmC;EACxE,MAAM,MAAM,GAAG,KAAK,SAAS;EAC7B,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ;AAC7C,UAAQ,IAAI,iBAAiB,UAAU,KAAK,SAAS;AACrD,UAAQ,IAAI,gBAAgB,mBAAmB;EAE/C,MAAM,MAAM,MAAM,MAAM,KAAK;GAAE,GAAG;GAAS;GAAS,CAAC;AAErD,MAAI,CAAC,IAAI,IAAI;AACX,SAAM,IAAI,MAAM;AAChB,SAAM,IAAI,MAAM,6BAA6B,OAAO,IAAI,OAAO,CAAC,GAAG;;AAIrE,UADc,MAAM,IAAI,MAAM,EAClB;;CAUd,MAAM,aAAa,MAAoE;AACrF,SAAO,KAAK,QAAQ,yBAAyB;GAC3C,QAAQ;GACR,MAAM,KAAK,UAAU,QAAQ,EAAE,CAAC;GACjC,CAAC;;CAGJ,MAAM,kBAAyC;AAC7C,SAAO,KAAK,QAAQ,wBAAwB;;CAG9C,MAAM,YAAY,MAEwB;AACxC,SAAO,KAAK,QAAQ,wBAAwB;GAC1C,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,kBAAkB,MAKS;AAC/B,SAAO,KAAK,QAAQ,wBAAwB;GAC1C,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,gBAAgB,MAEa;AACjC,SAAO,KAAK,QAAQ,4BAA4B;GAC9C,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,eAAwC;AAC5C,SAAO,KAAK,QAAQ,qBAAqB;;CAG3C,MAAM,cAAc,MAAiE;EACnF,MAAM,KAAK,IAAI,iBAAiB;AAChC,MAAI,MAAM,OAAQ,IAAG,IAAI,UAAU,KAAK,OAAO;EAC/C,MAAM,QAAQ,GAAG,UAAU;AAC3B,SAAO,KAAK,QAAQ,qBAAqB,QAAQ,IAAI,UAAU,KAAK;;CAGtE,MAAM,mBAA8D;AAClE,SAAO,KAAK,QAAQ,wBAAwB;;CAG9C,MAAM,eAAe,WAAgD;AACnE,SAAO,KAAK,QAAQ,yBAAyB,mBAAmB,UAAU,GAAG;;CAG/E,MAAM,eAAe,UAAiD;AACpE,SAAO,KAAK,QAAQ,sBAAsB,eAAe,SAAS,IAAI,EACpE,QAAQ,UACT,CAAC;;CAQJ,MAAM,gBAAgB,MAG+C;AACnE,SAAO,KAAK,QACV,qBAAqB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,GACxF;;CAGH,MAAM,kBAAkB,MAIgC;AACtD,SAAO,KAAK,QACV,qBAAqB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,CAAC,YAAY,eAAe,KAAK,SAAS,GAClI;;CAGH,MAAM,mBAAkD;AACtD,SAAO,KAAK,QAA8B,sBAAsB;;CAGlE,MAAM,qBAAqB,eAAyD;AAClF,SAAO,KAAK,QACV,uBAAuB,mBAAmB,cAAc,CAAC,SAC1D;;CAGH,MAAM,wBACJ,eACA,QACe;AACf,QAAM,KAAK,QACT,uBAAuB,mBAAmB,cAAc,IACxD;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC;GACjC,CACF;;CAGH,MAAM,mBACJ,eACA,SAC6B;AAC7B,SAAO,KAAK,QAA4B,uBAAuB;GAC7D,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,SAAS,SAAS;IAClB,QAAQ,SAAS;IAClB,CAAC;GACH,CAAC;;CAGJ,MAAM,kBAAkB,eAAoD;AAC1E,SAAO,KAAK,QACV,uBAAuB,mBAAmB,cAAc,IACxD,EAAE,QAAQ,UAAU,CACrB;;CAGH,MAAM,YACJ,UACA,QAC+D;EAC/D,MAAM,SAAS,IAAI,gBAAgB,EAAE,UAAU,CAAC;AAChD,MAAI,QAAQ,OAAQ,QAAO,IAAI,UAAU,OAAO,KAAK,IAAI,CAAC;AAC1D,SAAO,KAAK,QAAQ,iCAAiC,OAAO,UAAU,GAAG;;CAG3E,MAAM,eACJ,UACoF;AACpF,SAAO,KAAK,QACV,6CAA6C,mBAAmB,SAAS,GAC1E;;CAGH,MAAM,cAA0D;AAC9D,SAAO,KAAK,QAA2C,yBAAyB;;CAGlF,MAAM,uBAgBH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,wBAAwB,OAE3B;AACD,SAAO,KAAK,QAAQ,0BAA0B,mBAAmB,MAAM,IAAI,EACzE,QAAQ,UACT,CAAC;;CAGJ,MAAM,wBAAwB,OAE3B;AACD,SAAO,KAAK,QAAQ,0BAA0B,mBAAmB,MAAM,CAAC,WAAW,EACjF,QAAQ,OACT,CAAC;;CAGJ,MAAM,2BAMH;AACD,SAAO,KAAK,QAAQ,iCAAiC;;CAGvD,MAAM,uBAGH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,qBAIH;AACD,SAAO,KAAK,QAAQ,0BAA0B;;CAGhD,MAAM,mBAGH;AACD,SAAO,KAAK,QAAQ,qBAAqB,EAAE,QAAQ,QAAQ,CAAC;;CAG9D,MAAM,uBAIH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,0BAWH;AACD,SAAO,KAAK,QAAQ,+BAA+B;;CAGrD,MAAM,wBAGH;AACD,SAAO,KAAK,QAAQ,0BAA0B,EAAE,QAAQ,QAAQ,CAAC;;CAGnE,MAAM,qBAKH;AACD,SAAO,KAAK,QAAQ,0BAA0B;;CAGhD,MAAM,mBAGH;AACD,SAAO,KAAK,QAAQ,qBAAqB,EAAE,QAAQ,QAAQ,CAAC;;CAG9D,MAAM,sBASH;AACD,SAAO,KAAK,QAAQ,+BAA+B;;CAGrD,MAAM,iBAAiB,MAI0B;AAC/C,SAAO,KAAK,QAAQ,yBAAyB;GAC3C,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,oBAEH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,mBAAmB,OAEtB;AACD,SAAO,KAAK,QAAQ,mCAAmC;GACrD,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;GAChC,CAAC;;CAGJ,MAAM,eAAe,MAIc;AACjC,SAAO,KAAK,QAA+B,mBAAmB;GAC5D,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;;;;;CA2BJ,MAAM,sBAAsB,MAIE;AAC5B,SAAO,KAAK,QAA0B,oCAAoC;GACxE,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;;;;;CAQJ,MAAM,qBAAqB,MAKW;AACpC,SAAO,KAAK,QAAkC,mCAAmC;GAC/E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;CAIJ,MAAM,kBAAkB,MAQU;EAChC,MAAM,EAAE,OAAO,SAAS,UAAU,GAAG,SAAS;AAC9C,SAAO,KAAK,QACV,kBAAkB,mBAAmB,MAAM,CAAC,GAAG,mBAAmB,QAAQ,CAAC,GAAG,mBAAmB,SAAS,IAC1G;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CACF;;;CAIH,MAAM,kBAAkB,MAIY;AAClC,SAAO,KAAK,QACV,kBAAkB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,CAAC,GAAG,mBAAmB,KAAK,SAAS,GAC1H;;;CAIH,MAAM,YAAY,MAGY;AAI5B,UAHa,MAAM,KAAK,QACtB,kBAAkB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,GACrF,EACW;;;CAId,MAAM,aAAa,MAID;AAChB,QAAM,KAAK,QACT,kBAAkB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,CAAC,GAAG,mBAAmB,KAAK,SAAS,IACzH,EAAE,QAAQ,UAAU,CACrB;;;CAIH,MAAM,mBAAyC;AAE7C,UADa,MAAM,KAAK,QAAiC,wBAAwB,EACrE;;CAQd,MAAM,gBAAgB,MAWnB;AACD,SAAO,KAAK,QAAQ,2BAA2B;GAC7C,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,iBAAiB,MAIgB;EACrC,MAAM,KAAK,IAAI,iBAAiB;AAChC,MAAI,MAAM,EAAG,IAAG,IAAI,KAAK,KAAK,EAAE;AAChC,MAAI,MAAM,OAAQ,IAAG,IAAI,UAAU,KAAK,OAAO;AAC/C,MAAI,MAAM,MAAO,IAAG,IAAI,SAAS,OAAO,KAAK,MAAM,CAAC;EACpD,MAAM,QAAQ,GAAG,UAAU;AAC3B,SAAO,KAAK,QAAQ,yBAAyB,QAAQ,IAAI,UAAU,KAAK;;CAG1E,MAAM,mBAAmB,YAEtB;AACD,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,UAAU;;CAGlF,MAAM,gBAAgB,YAAoB,MAGG;AAC3C,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,SAAS;GAC7E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,gBAAgB,YAAoB,MAEG;AAC3C,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,WAAW;GAC/E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,gBAAgB,YAAoB,MAIH;AACrC,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,SAAS;GAC7E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,YAAY,YAAoB,MAIT;AAC3B,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,QAAQ;GAC5E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,qBAAqB,YAAoB,MAEX;EAClC,MAAM,KAAK,IAAI,iBAAiB;AAChC,MAAI,MAAM,MAAO,IAAG,IAAI,SAAS,OAAO,KAAK,MAAM,CAAC;EACpD,MAAM,QAAQ,GAAG,UAAU;AAC3B,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,YAAY,QAAQ,IAAI,UAAU,KAAK;;CAG/G,MAAM,iBAAiB,YAAoB,MAGG;AAC5C,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,YAAY;GAChF,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,4BAA4B,MAiBX;AACrB,SAAO,KAAK,QAAQ,kCAAkC;GACpD,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,4BAA4B,MAU/B;AACD,SAAO,KAAK,QAAQ,kCAAkC;GACpD,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;;;;;;CASJ,MAAM,eACJ,YACA,MAM0B;AAC1B,SAAO,KAAK,QAAQ,mBAAmB,mBAAmB,WAAW,CAAC,UAAU;GAC9E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;;;;;CAQJ,MAAM,wBAAwB,MAO3B;AACD,SAAO,KAAK,QAAQ,gCAAgC;GAClD,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAQJ,MAAM,aAAa,OAAe,MAS/B;AACD,SAAO,KAAK,QAAQ,wBAAwB;GAC1C,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,OAAO,MAAM,SAAS;IACtB,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,KAAK,MAAM;IACX,kBAAkB,MAAM,oBAAoB;IAC7C,CAAC;GACH,CAAC;;CAGJ,MAAM,YAAY,MAAc,MAKE;AAChC,SAAO,KAAK,QAAQ,uBAAuB;GACzC,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,OAAO,MAAM,SAAS;IACtB,UAAU,MAAM,YAAY;IAC5B,KAAK,MAAM,OAAO;IAClB,YAAY,MAAM,cAAc;IACjC,CAAC;GACH,CAAC;;CAGJ,MAAM,aAAa,YAAoB,UAKlC,UAIkD;AACrD,SAAO,KAAK,QAAQ,wBAAwB;GAC1C,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,oBAAoB,SAAS,SAAS,IAAI,SAAS,SAAS,SAAS,GAAG,QAAQ;IAChF;IACA;IACD,CAAC;GACH,CAAC;;CAGJ,MAAM,kBAAkB,MAAe,WAGpC;EACD,MAAM,SAAS,IAAI,iBAAiB;AACpC,MAAI,SAAS,KAAA,EAAW,QAAO,IAAI,QAAQ,OAAO,KAAK,CAAC;AACxD,MAAI,UAAW,QAAO,IAAI,aAAa,UAAU;EACjD,MAAM,KAAK,OAAO,UAAU;AAC5B,SAAO,KAAK,QAAQ,wBAAwB,KAAK,IAAI,OAAO,KAAK;;CAGnE,MAAM,mBAAmB,SAGtB;AACD,SAAO,KAAK,QAAQ,4CAA4C,mBAAmB,QAAQ,GAAG;;CAGhG,MAAM,iBAGH;AACD,SAAO,KAAK,QAAQ,yBAAyB;;CAG/C,MAAM,aAAa,UAAiD;AAClE,SAAO,KAAK,QAAQ,iBAAiB,mBAAmB,SAAS,IAAI,EACnE,QAAQ,UACT,CAAC;;CAGJ,MAAM,cAKH;AACD,SAAO,KAAK,QAAQ,sBAAsB;;CAK5C,MAAM,UAAU,QAMK;AACnB,SAAO,KAAK,QAAQ,qBAAqB;GACvC,QAAQ;GACR,MAAM,KAAK,UAAU,OAAO;GAC7B,CAAC;;CAGJ,MAAM,aAAa,QAGE;AACnB,SAAO,KAAK,QAAQ,wBAAwB;GAC1C,QAAQ;GACR,MAAM,KAAK,UAAU,OAAO;GAC7B,CAAC;;CAGJ,MAAM,WAAW,QAII;AACnB,SAAO,KAAK,QAAQ,sBAAsB;GACxC,QAAQ;GACR,MAAM,KAAK,UAAU,OAAO;GAC7B,CAAC;;CAKJ,MAAM,8BAKH;AACD,SAAO,KAAK,QAAQ,4BAA4B,EAAE,QAAQ,QAAQ,CAAC;;CAGrE,MAAM,oBAAoB,OAKR;AAChB,QAAM,KAAK,QAAQ,yBAAyB;GAC1C,QAAQ;GACR,MAAM,KAAK,UAAU,MAAM;GAC5B,CAAC,CAAC,YAAY,GAEb"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/agent-api-client",
-  "version": "0.0.12",
+  "version": "0.1.0",
   "description": "Agent self-service API client — agents calling /agents/ endpoints",
   "type": "module",
   "main": "./dist/index.js",