@alfe.ai/agent-api-client 0.0.13 → 0.1.1

package/dist/index.cjs

@@ -1,5 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/index.ts
+/**
+* Encode each path segment but keep the `/` separators — `encodeURIComponent`
+* would escape the slashes too, breaking greedy proxy routes.
+*/
+function encodeFilePath(filePath) {
+	return filePath.split("/").map(encodeURIComponent).join("/");
+}
 var AgentApiClient = class {
 	apiKey;
 	apiUrl;
@@ -22,6 +29,57 @@ var AgentApiClient = class {
 		}
 		return (await res.json()).data;
 	}
+	async syncRegister(args) {
+		return this.request("/agent/sync/register", {
+			method: "POST",
+			body: JSON.stringify(args ?? {})
+		});
+	}
+	async syncGetManifest() {
+		return this.request("/agent/sync/manifest");
+	}
+	async syncPresign(args) {
+		return this.request("/agent/sync/presign", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncConfirmUpload(args) {
+		return this.request("/agent/sync/confirm", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncReconstruct(args) {
+		return this.request("/agent/sync/reconstruct", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncGetStats() {
+		return this.request("/agent/sync/stats");
+	}
+	async syncListFiles(args) {
+		const qs = new URLSearchParams();
+		if (args?.prefix) qs.set("prefix", args.prefix);
+		const query = qs.toString();
+		return this.request(`/agent/sync/files${query ? `?${query}` : ""}`);
+	}
+	async syncListSessions() {
+		return this.request("/agent/sync/sessions");
+	}
+	async syncGetSession(sessionId) {
+		return this.request(`/agent/sync/sessions/${encodeURIComponent(sessionId)}`);
+	}
+	async syncDeleteFile(filePath) {
+		return this.request(`/agent/sync/files/${encodeFilePath(filePath)}`, { method: "DELETE" });
+	}
+	async sharedListFiles(args) {
+		return this.request(`/agent/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`);
+	}
+	async sharedDownloadUrl(args) {
+		return this.request(`/agent/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/download/${encodeFilePath(args.filePath)}`);
+	}
 	async listIntegrations() {
 		return this.request("/agent/integrations");
 	}
@@ -119,9 +177,12 @@ var AgentApiClient = class {
 		});
 	}
 	/**
-	* Mint a fresh AES-256 data key for a new secret or rotation. The encryption
-	* context is rebuilt server-side from `auth.tenantId` + the body fields; the
-	* agent cannot forge context for a scope it doesn't own.
+	* Mint a fresh AES-256 data key for a specific (secret, field) pair. The
+	* encryption context is rebuilt server-side from `auth.tenantId` + the body
+	* fields including `fieldKey`; the agent cannot forge context for a scope
+	* or field it doesn't own. Legacy single-envelope secrets are migrated to
+	* `field#value` rows by the data migration, so call with `fieldKey: "value"`
+	* to reach them.
 	*/
 	async generateSecretDataKey(args) {
 		return this.request("/agent/secrets/generate-data-key", {
@@ -131,8 +192,9 @@ var AgentApiClient = class {
 	}
 	/**
 	* Unwrap a wrapped data key so the agent can decrypt the envelope locally.
-	* KMS Decrypt will fail with `InvalidCiphertextException` if the envelope
-	* was tampered with in a way that changes `{ tenantId, scope, scopeId, secretId }`.
+	* `fieldKey` MUST match the value supplied when the data key was generated
+	* (it's bound into KMS encryption context); mismatch fails with
+	* `InvalidCiphertextException`.
 	*/
 	async decryptSecretDataKey(args) {
 		return this.request("/agent/secrets/decrypt-data-key", {
@@ -140,23 +202,65 @@ var AgentApiClient = class {
 			body: JSON.stringify(args)
 		});
 	}
-	/** Upload a pre-encrypted envelope for a secret. */
-	async putSecretEnvelope(args) {
+	/**
+	* Create a new secret with one or more fields. Encrypted fields must arrive
+	* pre-sealed (the agent has already obtained per-field data keys via
+	* `generateSecretDataKey({ ..., fieldKey })` and AES-encrypted locally).
+	* Plaintext fields ship the value inline.
+	*/
+	async createSecret(args) {
 		const { scope, scopeId, secretId, ...body } = args;
 		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`, {
 			method: "PUT",
 			body: JSON.stringify(body)
 		});
 	}
-	/** Fetch the encrypted envelope for a single secret. */
-	async getSecretEnvelope(args) {
+	/** Fetch the secret aggregate plus per-field encrypted envelopes. */
+	async getSecret(args) {
 		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`);
 	}
-	/** List metadata (never envelopes) for secrets in a scope. */
+	/** Fetch one field. Plaintext: value inline. Encrypted: envelope. */
+	async getSecretField(args) {
+		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/fields/${encodeURIComponent(args.fieldKey)}`);
+	}
+	/** Add OR rotate one field. */
+	async setSecretField(args) {
+		const { scope, scopeId, secretId, fieldKey, ...body } = args;
+		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}/fields/${encodeURIComponent(fieldKey)}`, {
+			method: "PUT",
+			body: JSON.stringify(body)
+		});
+	}
+	/** Remove one field. */
+	async removeSecretField(args) {
+		await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/fields/${encodeURIComponent(args.fieldKey)}`, { method: "DELETE" });
+	}
+	/** Update secret-level metadata (name/description/tags/category). */
+	async updateSecretMetadata(args) {
+		const { scope, scopeId, secretId, ...body } = args;
+		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`, {
+			method: "PATCH",
+			body: JSON.stringify(body)
+		});
+	}
+	/** List metadata for secrets in a scope. Optional filters route through the byFacet GSI. */
 	async listSecrets(args) {
-		return (await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`)).secrets;
+		const params = new URLSearchParams();
+		if (args.category) params.set("category", args.category);
+		if (args.tag) params.set("tag", args.tag);
+		if (args.fieldKey) params.set("fieldKey", args.fieldKey);
+		const qs = params.toString();
+		return (await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}${qs ? `?${qs}` : ""}`)).secrets;
+	}
+	/** Bounded changelog read — metadata-only audit entries. */
+	async getSecretHistory(args) {
+		const params = new URLSearchParams();
+		if (args.limit) params.set("limit", String(args.limit));
+		if (args.cursor) params.set("cursor", args.cursor);
+		const qs = params.toString();
+		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/history${qs ? `?${qs}` : ""}`);
 	}
-	/** Delete a secret. */
+	/** Delete a secret (and all its field rows + tag rows + changelog rows). */
 	async deleteSecret(args) {
 		await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`, { method: "DELETE" });
 	}
@@ -170,26 +274,11 @@ var AgentApiClient = class {
 			body: JSON.stringify(args)
 		});
 	}
-	async enforcePolicy(args) {
-		return this.request("/agent/identity/enforce", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
-	}
-	async checkToolPermission(args) {
-		return this.request("/agent/identity/check-tool", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
-	}
 	async searchIdentities(args) {
 		const qs = new URLSearchParams();
 		if (args?.q) qs.set("q", args.q);
 		if (args?.status) qs.set("status", args.status);
-		if (args?.tag) qs.set("tag", args.tag);
-		if (args?.platform) qs.set("platform", args.platform);
 		if (args?.limit) qs.set("limit", String(args.limit));
-		if (args?.offset) qs.set("offset", String(args.offset));
 		const query = qs.toString();
 		return this.request(`/agent/identity/search${query ? `?${query}` : ""}`);
 	}
@@ -223,7 +312,6 @@ var AgentApiClient = class {
 	async getIdentityChangelog(identityId, args) {
 		const qs = new URLSearchParams();
 		if (args?.limit) qs.set("limit", String(args.limit));
-		if (args?.offset) qs.set("offset", String(args.offset));
 		const query = qs.toString();
 		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/changelog${query ? `?${query}` : ""}`);
 	}
@@ -245,6 +333,29 @@ var AgentApiClient = class {
 			body: JSON.stringify(args)
 		});
 	}
+	/**
+	* Update display-shape fields on an Identity. Body excludes `email` /
+	* `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
+	* via the verify flow, title/company live on OrgMembership, metadata is
+	* not agent-writable.
+	*/
+	async updateIdentity(identityId, args) {
+		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/update`, {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	/**
+	* Phase 2 (Section H): server-side verification of a Google Chat sender via
+	* the agent's existing Google OAuth credentials. Returns the resolved
+	* identity (created or matched via Scenario-B email enrichment).
+	*/
+	async resolveGoogleChatSender(args) {
+		return this.request("/agent/google/resolve-sender", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
 	async memorySearch(query, opts) {
 		return this.request("/agent/memory/search", {
 			method: "POST",