@alfe.ai/agent-api-client 0.0.6 → 0.0.8

package/dist/index.cjs

@@ -17,25 +17,25 @@ var AgentApiClient = class {
 			headers
 		});
 		if (!res.ok) {
-			const body = await res.text();
-			throw new Error(`Agent API error ${String(res.status)}: ${body}`);
+			await res.text();
+			throw new Error(`Agent API request failed (${String(res.status)})`);
 		}
 		return (await res.json()).data;
 	}
 	async listIntegrations() {
-		return this.request("/agents/integrations");
+		return this.request("/agent/integrations");
 	}
 	async getIntegrationConfig(integrationId) {
-		return this.request(`/agents/integrations/${encodeURIComponent(integrationId)}/config`);
+		return this.request(`/agent/integrations/${encodeURIComponent(integrationId)}/config`);
 	}
 	async updateIntegrationConfig(integrationId, config) {
-		await this.request(`/agents/integrations/${encodeURIComponent(integrationId)}`, {
+		await this.request(`/agent/integrations/${encodeURIComponent(integrationId)}`, {
 			method: "PATCH",
 			body: JSON.stringify({ config })
 		});
 	}
 	async installIntegration(integrationId, options) {
-		return this.request("/agents/integrations", {
+		return this.request("/agent/integrations", {
 			method: "POST",
 			body: JSON.stringify({
 				integrationId,
@@ -45,20 +45,114 @@ var AgentApiClient = class {
 		});
 	}
 	async removeIntegration(integrationId) {
-		return this.request(`/agents/integrations/${encodeURIComponent(integrationId)}`, { method: "DELETE" });
+		return this.request(`/agent/integrations/${encodeURIComponent(integrationId)}`, { method: "DELETE" });
 	}
 	async getRegistry() {
 		return this.request("/integrations/registry");
 	}
 	async getGoogleCredentials() {
-		return this.request("/agents/google/credentials");
+		return this.request("/agent/google/credentials");
+	}
+	async disconnectGoogleAccount(email) {
+		return this.request(`/agent/google/accounts/${encodeURIComponent(email)}`, { method: "DELETE" });
+	}
+	async setDefaultGoogleAccount(email) {
+		return this.request(`/agent/google/accounts/${encodeURIComponent(email)}/default`, { method: "PUT" });
+	}
+	async getGithubCredentials() {
+		return this.request("/agent/github/credentials");
+	}
+	async getXeroCredentials() {
+		return this.request("/agent/xero/credentials");
+	}
+	async refreshXeroToken() {
+		return this.request("/agent/xero/token", { method: "POST" });
+	}
+	async getNotionCredentials() {
+		return this.request("/agent/notion/credentials");
+	}
+	async getAtlassianCredentials() {
+		return this.request("/agent/atlassian/credentials");
+	}
+	async refreshAtlassianToken() {
+		return this.request("/agent/atlassian/token", { method: "POST" });
+	}
+	async getMYOBCredentials() {
+		return this.request("/agent/myob/credentials");
+	}
+	async refreshMYOBToken() {
+		return this.request("/agent/myob/token", { method: "POST" });
+	}
+	async getTeamsCredentials() {
+		return this.request("/agent/microsoft/credentials");
+	}
+	async sendTeamsMessage(data) {
+		return this.request("/agent/microsoft/send", {
+			method: "POST",
+			body: JSON.stringify(data)
+		});
+	}
+	async listTeamsChannels() {
+		return this.request("/agent/microsoft/channels");
+	}
+	async presignAttachments(files) {
+		return this.request("/agent/chat/attachments/presign", {
+			method: "POST",
+			body: JSON.stringify({ files })
+		});
 	}
 	async recordActivity(data) {
-		return this.request("/agents/activity", {
+		return this.request("/agent/activity", {
 			method: "POST",
 			body: JSON.stringify(data)
 		});
 	}
+	/**
+	* Mint a fresh AES-256 data key for a new secret or rotation. The encryption
+	* context is rebuilt server-side from `auth.tenantId` + the body fields; the
+	* agent cannot forge context for a scope it doesn't own.
+	*/
+	async generateSecretDataKey(args) {
+		return this.request("/agent/secrets/generate-data-key", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	/**
+	* Unwrap a wrapped data key so the agent can decrypt the envelope locally.
+	* KMS Decrypt will fail with `InvalidCiphertextException` if the envelope
+	* was tampered with in a way that changes `{ tenantId, scope, scopeId, secretId }`.
+	*/
+	async decryptSecretDataKey(args) {
+		return this.request("/agent/secrets/decrypt-data-key", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	/** Upload a pre-encrypted envelope for a secret. */
+	async putSecretEnvelope(args) {
+		const { scope, scopeId, secretId, ...body } = args;
+		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`, {
+			method: "PUT",
+			body: JSON.stringify(body)
+		});
+	}
+	/** Fetch the encrypted envelope for a single secret. */
+	async getSecretEnvelope(args) {
+		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`);
+	}
+	/** List metadata (never envelopes) for secrets in a scope. */
+	async listSecrets(args) {
+		return (await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`)).secrets;
+	}
+	/** Delete a secret. */
+	async deleteSecret(args) {
+		await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`, { method: "DELETE" });
+	}
+	/** Enumerate scopes (org/team/project/agent) this agent can access. */
+	async listSecretScopes() {
+		return (await this.request("/agent/secrets/scopes")).scopes;
+	}
 };
 //#endregion
 exports.AgentApiClient = AgentApiClient;

package/dist/index.d.cts

@@ -1,9 +1,8 @@
 //#region ../../packages-internal/types/dist/integration.d.ts
 
-/** Controls where an integration appears: public (everyone), dev (non-prod only), hidden (nowhere) */
+/** Controls where an integration appears: public (everyone), hidden (nowhere) */
 declare const IntegrationVisibility: {
   readonly Public: "public";
-  readonly Dev: "dev";
   readonly Hidden: "hidden";
 };
 type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];
@@ -58,6 +57,7 @@ interface IntegrationConfigSchemaField {
   }[];
   oauth_provider?: string;
   editable?: string;
+  hidden?: boolean;
 }
 interface IntegrationConfigResult {
   integrationId: string;
@@ -95,6 +95,61 @@ interface RegistryEntry {
 }
 //# sourceMappingURL=integration.d.ts.map
 //#endregion
+//#region ../../packages-internal/types/dist/secrets.d.ts
+/**
+ * Secrets types — shared between services/secrets, @alfe.ai/agent-api-client,
+ * the openclaw-secrets plugin, and dashboard clients.
+ *
+ * Server-side crypto and KMS glue live in @alfe/secret-store (Node/AWS-only);
+ * this module is a pure, dependency-free shape contract safe for every
+ * environment the agent-api-client ships to.
+ */
+/** Scope levels at which a secret can be owned. */
+type SecretScope = "org" | "team" | "project" | "agent";
+/**
+ * v1 encrypted envelope as persisted by services/secrets and exchanged with
+ * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext
+ * are all base64-encoded.
+ */
+interface EncryptedEnvelopeV1 {
+  version: 1;
+  iv: string;
+  ciphertext: string;
+  authTag: string;
+  dataKeyCiphertext: string;
+}
+/** Opaque metadata about a secret row — never includes plaintext. */
+interface SecretMetadata {
+  secretId: string;
+  secretName: string;
+  description?: string;
+  tags?: string[];
+  createdAt: string;
+  updatedAt: string;
+  rotatedAt?: string;
+}
+/** A single secret row including its encrypted envelope. */
+interface SecretEnvelopeResponse extends SecretMetadata {
+  envelope: EncryptedEnvelopeV1;
+}
+/** A scope the caller can read or write secrets in. */
+interface ScopeInfo {
+  scope: SecretScope;
+  scopeId: string;
+  name?: string;
+}
+/**
+ * KMS-issued data key, returned by the secrets service's
+ * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is
+ * returned base64-encoded; callers MUST decode it to a Buffer and zero the
+ * Buffer after use — never keep the plaintext as a JS string.
+ */
+interface GeneratedDataKey {
+  plaintextKey: string;
+  dataKeyCiphertext: string;
+}
+//# sourceMappingURL=secrets.d.ts.map
+//#endregion
 //#region src/index.d.ts
 interface AgentApiClientConfig {
   apiKey: string;
@@ -117,10 +172,115 @@ declare class AgentApiClient {
     integrations: RegistryEntry[];
   }>;
   getGoogleCredentials(): Promise<{
+    accounts?: {
+      email: string;
+      refreshToken: string;
+      clientId: string;
+      clientSecret: string;
+      enabledServices?: string[];
+      isDefault: boolean;
+      displayName?: string;
+    }[];
     email: string;
     refreshToken: string;
     clientId: string;
     clientSecret: string;
+    projectId: string;
+    enabledServices?: string[];
+  }>;
+  disconnectGoogleAccount(email: string): Promise<{
+    accounts: {
+      email: string;
+      displayName?: string;
+      isDefault: boolean;
+    }[];
+  }>;
+  setDefaultGoogleAccount(email: string): Promise<{
+    accounts: {
+      email: string;
+      displayName?: string;
+      isDefault: boolean;
+    }[];
+  }>;
+  getGithubCredentials(): Promise<{
+    login: string;
+    accessToken: string;
+  }>;
+  getXeroCredentials(): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    xeroTenantId: string;
+  }>;
+  refreshXeroToken(): Promise<{
+    accessToken: string;
+    expiresAt: string;
+  }>;
+  getNotionCredentials(): Promise<{
+    accessToken: string;
+    workspaceId: string;
+    workspaceName: string;
+  }>;
+  getAtlassianCredentials(): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    accessTokenExpiresAt: string;
+    cloudId: string;
+    siteName: string;
+    siteUrl: string;
+    email: string;
+    enabledProducts: string[];
+  }>;
+  refreshAtlassianToken(): Promise<{
+    accessToken: string;
+    expiresAt: string;
+  }>;
+  getMYOBCredentials(): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    myobBusinessId: string;
+    clientId: string;
+  }>;
+  refreshMYOBToken(): Promise<{
+    accessToken: string;
+    expiresAt: string;
+  }>;
+  getTeamsCredentials(): Promise<{
+    agentId: string;
+    tenantId: string;
+    azureAppId: string;
+    azureBotId: string;
+    azureClientSecret: string;
+    botDisplayName?: string;
+    teamsTenantId?: string;
+    serviceUrl?: string;
+  }>;
+  sendTeamsMessage(data: {
+    conversationId: string;
+    text?: string;
+    adaptiveCard?: Record<string, unknown>;
+  }): Promise<{
+    ok: boolean;
+    activityId: string;
+  }>;
+  listTeamsChannels(): Promise<{
+    channels: {
+      id: string;
+      name: string;
+      description?: string;
+    }[];
+  }>;
+  presignAttachments(files: {
+    filename: string;
+    mimeType: string;
+    size: number;
+  }[]): Promise<{
+    attachments: {
+      id: string;
+      uploadUrl: string;
+      downloadUrl: string;
+      s3Key: string;
+      expiresAt: string;
+    }[];
   }>;
   recordActivity(data: {
     userId?: string;
@@ -129,9 +289,62 @@ declare class AgentApiClient {
   }): Promise<{
     recorded: boolean;
   }>;
+  /**
+   * Mint a fresh AES-256 data key for a new secret or rotation. The encryption
+   * context is rebuilt server-side from `auth.tenantId` + the body fields; the
+   * agent cannot forge context for a scope it doesn't own.
+   */
+  generateSecretDataKey(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+  }): Promise<GeneratedDataKey>;
+  /**
+   * Unwrap a wrapped data key so the agent can decrypt the envelope locally.
+   * KMS Decrypt will fail with `InvalidCiphertextException` if the envelope
+   * was tampered with in a way that changes `{ tenantId, scope, scopeId, secretId }`.
+   */
+  decryptSecretDataKey(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+    dataKeyCiphertext: string;
+  }): Promise<{
+    plaintextKey: string;
+  }>;
+  /** Upload a pre-encrypted envelope for a secret. */
+  putSecretEnvelope(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+    secretName: string;
+    envelope: EncryptedEnvelopeV1;
+    description?: string;
+    tags?: string[];
+  }): Promise<{
+    secretId: string;
+  }>;
+  /** Fetch the encrypted envelope for a single secret. */
+  getSecretEnvelope(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+  }): Promise<SecretEnvelopeResponse>;
+  /** List metadata (never envelopes) for secrets in a scope. */
+  listSecrets(args: {
+    scope: SecretScope;
+    scopeId: string;
+  }): Promise<SecretMetadata[]>;
+  /** Delete a secret. */
+  deleteSecret(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+  }): Promise<void>;
+  /** Enumerate scopes (org/team/project/agent) this agent can access. */
+  listSecretScopes(): Promise<ScopeInfo[]>;
 }
 //# sourceMappingURL=index.d.ts.map
-
 //#endregion
-export { AgentApiClient, AgentApiClientConfig, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry };
+export { AgentApiClient, AgentApiClientConfig, type EncryptedEnvelopeV1, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretEnvelopeResponse, type SecretMetadata, type SecretScope };
 //# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":["DEFAULT_INTEGRATIONS","IntegrationVisibility","INTEGRATION_VISIBILITIES","IntegrationScope","INTEGRATION_SCOPES","IntegrationDesiredStatus","INTEGRATION_DESIRED_STATUSES","IntegrationActualStatus","INTEGRATION_ACTUAL_STATUSES","IntegrationInstall","Record","AgentIntegration","OrgIntegration","IntegrationConfigSchemaField","IntegrationConfigResult","RegistryEntry"],"sources":["../../../packages-internal/types/dist/integration.d.ts","../src/index.ts"],"sourcesContent":["/** Integrations auto-installed for ALL agents regardless of hosting type. Cannot be removed. */\nexport declare const DEFAULT_INTEGRATIONS: readonly string[];\n/** Controls where an integration appears: public (everyone), dev (non-prod only), hidden (nowhere) */\nexport declare const IntegrationVisibility: {\n    readonly Public: \"public\";\n    readonly Dev: \"dev\";\n    readonly Hidden: \"hidden\";\n};\nexport type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];\nexport declare const INTEGRATION_VISIBILITIES: readonly [\"dev\" | \"public\" | \"hidden\", ...(\"dev\" | \"public\" | \"hidden\")[]];\n/** Scope at which an integration is installed */\nexport declare const IntegrationScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type IntegrationScope = (typeof IntegrationScope)[keyof typeof IntegrationScope];\nexport declare const INTEGRATION_SCOPES: readonly [\"org\" | \"team\" | \"project\" | \"agent\", ...(\"org\" | \"team\" | \"project\" | \"agent\")[]];\nexport declare const IntegrationDesiredStatus: {\n    readonly Active: \"active\";\n    readonly Removed: \"removed\";\n};\nexport type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];\nexport declare const INTEGRATION_DESIRED_STATUSES: readonly [\"active\" | \"removed\", ...(\"active\" | \"removed\")[]];\nexport declare const IntegrationActualStatus: {\n    readonly Installing: \"installing\";\n    readonly Active: \"active\";\n    readonly Error: \"error\";\n    readonly Removing: \"removing\";\n    readonly Inactive: \"inactive\";\n    readonly Unknown: \"unknown\";\n};\nexport type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];\nexport declare const INTEGRATION_ACTUAL_STATUSES: readonly [\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\", ...(\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\")[]];\nexport interface IntegrationInstall {\n    scope: IntegrationScope;\n    scopeId: string;\n    integrationId: string;\n    tenantId: string;\n    desiredStatus: IntegrationDesiredStatus;\n    actualStatus: IntegrationActualStatus;\n    version: string;\n    config: Record<string, unknown>;\n    errorMessage: string;\n    installedAt: string;\n    updatedAt: string;\n}\n/** @deprecated Use IntegrationInstall instead */\nexport type AgentIntegration = IntegrationInstall;\n/** Org-scoped integration install */\nexport type OrgIntegration = IntegrationInstall;\nexport interface IntegrationConfigSchemaField {\n    key: string;\n    label: string;\n    type: string;\n    description?: string;\n    required?: boolean;\n    default?: string | number | boolean;\n    options?: string[];\n    select_options?: {\n        value: string;\n        label: string;\n    }[];\n    oauth_provider?: string;\n    editable?: string;\n}\nexport interface IntegrationConfigResult {\n    integrationId: string;\n    config: Record<string, unknown>;\n    configSchema: IntegrationConfigSchemaField[];\n}\nexport interface RegistryEntry {\n    id: string;\n    name: string;\n    description: string;\n    versions: string[];\n    latest: string;\n    repository: string;\n    commit: string;\n    icon?: string;\n    author?: {\n        name: string;\n        url?: string;\n    } | string;\n    pricing?: {\n        type: \"free\" | \"paid\" | \"usage\";\n        price?: number;\n        currency?: string;\n        interval?: \"month\" | \"year\";\n        description?: string;\n    };\n    features?: string[];\n    preview_images?: string[];\n    config_schema?: IntegrationConfigSchemaField[];\n    supported_agents?: string[];\n    /** Scopes where this integration can be installed */\n    supported_scopes?: IntegrationScope[];\n    /** Visibility status — controls where integration appears */\n    visibility?: IntegrationVisibility;\n}\n//# sourceMappingURL=integration.d.ts.map"],"mappings":";;AAQA;AAAiC,cALZC,qBAKY,EAAA;WAAWA,MAAAA,EAAAA,QAAAA;WAAoCA,GAAAA,EAAAA,KAAAA;EAAqB,SAAA,MAAA,EAAA,QAAA;AAGrG,CAAA;AAMYE,KATAF,qBAAAA,GASgB,CAAA,OATgBA,qBAShB,CAAA,CAAA,MAAA,OAToDA,qBASpD,CAAA;;AAA0CE,cANjDA,gBAMiDA,EAAAA;EAAgB,SAAA,GAAA,EAAA,KAAA;EAEjEE,SAAAA,IAAAA,EAAAA,MAAAA;EAITA,SAAAA,OAAAA,EAAAA,SAAwB;EAAA,SAAA,KAAA,EAAA,OAAA;;AAAkDA,KAN1EF,gBAAAA,GAM0EE,CAAAA,OAN/CF,gBAM+CE,CAAAA,CAAAA,MAAAA,OANhBF,gBAMgBE,CAAAA;AAEjEE,cANAF,wBAapB,EAAA;EACWE,SAAAA,MAAAA,EAAAA,QAAAA;EAAuB,SAAA,OAAA,EAAA,SAAA;;AAAiDA,KAVxEF,wBAAAA,GAUwEE,CAAAA,OAVrCF,wBAUqCE,CAAAA,CAAAA,MAAAA,OAVEF,wBAUFE,CAAAA;AAEnEE,cAVIF,uBAUc,EAAA;EAAA,SAAA,UAAA,EAAA,YAAA;WACxBJ,MAAAA,EAAAA,QAAAA;WAIQE,KAAAA,EAAAA,OAAAA;WACDE,QAAAA,EAAAA,UAAAA;WAENG,QAAAA,EAAAA,UAAAA;EAAM,SAAA,OAAA,EAAA,SAAA;AASlB,CAAA;AAeiBI,KAlCLP,uBAAAA,GAkC4B,CAAA,OAlCMA,uBAkCN,CAAA,CAAA,MAAA,OAlC4CA,uBAkC5C,CAAA;AAE5BG,UAlCKD,kBAAAA,CAkCLC;OACMG,EAlCPV,gBAkCOU;EAA4B,OAAA,EAAA,MAAA;EAE7BE,aAAAA,EAAAA,MAAa;EAAA,QAAA,EAAA,MAAA;eAsBVF,EAtDDR,wBAsDCQ;cAGGV,EAxDLI,uBAwDKJ;SAENF,EAAAA,MAAAA;EAAqB,MAAA,EAxD1BS,MAwD0B,CAAA,MAAA,EAAA,OAAA,CAAA;;;;AClFtC;AAKA;;AA0B4B,UDIXG,4BAAAA,CCJW;KAIiC,EAAA,MAAA;OAAR,EAAA,MAAA;MAQzC,EAAA,MAAA;aACP,CAAA,EAAA,MAAA;UAYsC,CAAA,EAAA,OAAA;SAC9B,CAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA;SAAR,CAAA,EAAA,MAAA,EAAA;gBAWqD,CAAA,EAAA;IAAR,KAAA,EAAA,MAAA;IAOH,KAAA,EAAA,MAAA;KAAxB;gBAIS,CAAA,EAAA,MAAA;UAa1B,CAAA,EAAA,MAAA;;UD1CWC,uBAAAA;;UAELJ;gBACMG;;UAEDE,aAAAA;;;;;;;;;;;;;;;;;;;;;;kBAsBGF;;;qBAGGV;;eAENF;;;;;AAlFW,UCAX,oBAAA,CDAW;QAAWE,EAAAA,MAAAA;QAA+BA,EAAAA,MAAAA;;AAEjDE,cCGR,cAAA,CDAZ;EACWA,iBAAAA,MAAAA;EAAwB,iBAAA,MAAA;aAAWA,CAAAA,MAAAA,ECGzB,oBDHyBA;UAAuCA,OAAAA;EAAwB,gBAAA,CAAA,CAAA,ECyBlF,ODzBkF,CCyB1E,kBDzB0E,EAAA,CAAA;EAEzFE,oBAAAA,CAAAA,aAOpB,EAAA,MAAA,CAAA,ECoBoD,ODpBpD,CCoB4D,uBDpB5D,CAAA;EACWA,uBAAAA,CAAAA,aAAuB,EAAA,MAAA,EAAA,MAAA,EC2BvB,MD3BuB,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EC4B9B,OD5B8B,CAAA,IAAA,CAAA;EAAA,kBAAA,CAAA,aAAA,EAAA,MAAA,EAAA,OAAwE,CAAxE,EAAA;IAAWA,OAAAA,CAAAA,EAAAA,MAAAA;IAAsCA,MAAAA,CAAAA,ECwCzC,MDxCyCA,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA;EAAuB,CAAA,CAAA,ECyCtG,ODzCsG,CCyC9F,kBDzC8F,CAAA;EAE1FE,iBAAAA,CAAAA,aAAkB,EAAA,MAAA,CAAA,ECkDe,ODlDf,CCkDuB,kBDlDvB,CAAA;EAAA,WAAA,CAAA,CAAA,ECyDZ,ODzDY,CAAA;IACxBN,YAAAA,ECwDoC,aDxDpCA,EAAAA;;sBAKOI,CAAAA,CAAAA,ECuDc,ODvDdA,CAAAA;IAENG,KAAAA,EAAAA,MAAAA;IAAM,YAAA,EAAA,MAAA;IASDG,QAAAA,EAAAA,MAAAA;IAeAC,YAAAA,EAAAA,MAAAA;EAAuB,CAAA,CAAA;gBAE5BJ,CAAAA,IAAAA,EAAAA;IACMG,MAAAA,CAAAA,EAAAA,MAAAA;IAA4B,OAAA,EAAA,MAAA;IAE7BE,IAAAA,EAAAA,MAAa,GAAA,WAAA;EAAA,CAAA,CAAA,ECqCxB,ODrCwB,CAAA;IAsBVF,QAAAA,EAAAA,OAAAA"}
+{"version":3,"file":"index.d.cts","names":["DEFAULT_INTEGRATIONS","IntegrationVisibility","INTEGRATION_VISIBILITIES","IntegrationScope","INTEGRATION_SCOPES","IntegrationDesiredStatus","INTEGRATION_DESIRED_STATUSES","IntegrationActualStatus","INTEGRATION_ACTUAL_STATUSES","IntegrationInstall","Record","AgentIntegration","OrgIntegration","IntegrationConfigSchemaField","IntegrationConfigResult","RegistryEntry","SecretScope","EncryptedEnvelopeV1","SecretMetadata","SecretEnvelopeResponse","ScopeInfo","GeneratedDataKey"],"sources":["../../../packages-internal/types/dist/integration.d.ts","../../../packages-internal/types/dist/secrets.d.ts","../src/index.ts"],"sourcesContent":["/** Integrations auto-installed for ALL agents regardless of hosting type. Cannot be removed. */\nexport declare const DEFAULT_INTEGRATIONS: readonly string[];\n/** Controls where an integration appears: public (everyone), hidden (nowhere) */\nexport declare const IntegrationVisibility: {\n    readonly Public: \"public\";\n    readonly Hidden: \"hidden\";\n};\nexport type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];\nexport declare const INTEGRATION_VISIBILITIES: readonly [\"public\" | \"hidden\", ...(\"public\" | \"hidden\")[]];\n/** Scope at which an integration is installed */\nexport declare const IntegrationScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type IntegrationScope = (typeof IntegrationScope)[keyof typeof IntegrationScope];\nexport declare const INTEGRATION_SCOPES: readonly [\"org\" | \"team\" | \"project\" | \"agent\", ...(\"org\" | \"team\" | \"project\" | \"agent\")[]];\nexport declare const IntegrationDesiredStatus: {\n    readonly Active: \"active\";\n    readonly Removed: \"removed\";\n};\nexport type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];\nexport declare const INTEGRATION_DESIRED_STATUSES: readonly [\"active\" | \"removed\", ...(\"active\" | \"removed\")[]];\nexport declare const IntegrationActualStatus: {\n    readonly Installing: \"installing\";\n    readonly Active: \"active\";\n    readonly Error: \"error\";\n    readonly Removing: \"removing\";\n    readonly Inactive: \"inactive\";\n    readonly Unknown: \"unknown\";\n};\nexport type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];\nexport declare const INTEGRATION_ACTUAL_STATUSES: readonly [\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\", ...(\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\")[]];\nexport interface IntegrationInstall {\n    scope: IntegrationScope;\n    scopeId: string;\n    integrationId: string;\n    tenantId: string;\n    desiredStatus: IntegrationDesiredStatus;\n    actualStatus: IntegrationActualStatus;\n    version: string;\n    config: Record<string, unknown>;\n    errorMessage: string;\n    installedAt: string;\n    updatedAt: string;\n}\n/** @deprecated Use IntegrationInstall instead */\nexport type AgentIntegration = IntegrationInstall;\n/** Org-scoped integration install */\nexport type OrgIntegration = IntegrationInstall;\nexport interface IntegrationConfigSchemaField {\n    key: string;\n    label: string;\n    type: string;\n    description?: string;\n    required?: boolean;\n    default?: string | number | boolean;\n    options?: string[];\n    select_options?: {\n        value: string;\n        label: string;\n    }[];\n    oauth_provider?: string;\n    editable?: string;\n    hidden?: boolean;\n}\nexport interface IntegrationConfigResult {\n    integrationId: string;\n    config: Record<string, unknown>;\n    configSchema: IntegrationConfigSchemaField[];\n}\nexport interface RegistryEntry {\n    id: string;\n    name: string;\n    description: string;\n    versions: string[];\n    latest: string;\n    repository: string;\n    commit: string;\n    icon?: string;\n    author?: {\n        name: string;\n        url?: string;\n    } | string;\n    pricing?: {\n        type: \"free\" | \"paid\" | \"usage\";\n        price?: number;\n        currency?: string;\n        interval?: \"month\" | \"year\";\n        description?: string;\n    };\n    features?: string[];\n    preview_images?: string[];\n    config_schema?: IntegrationConfigSchemaField[];\n    supported_agents?: string[];\n    /** Scopes where this integration can be installed */\n    supported_scopes?: IntegrationScope[];\n    /** Visibility status — controls where integration appears */\n    visibility?: IntegrationVisibility;\n}\n//# sourceMappingURL=integration.d.ts.map","/**\n * Secrets types — shared between services/secrets, @alfe.ai/agent-api-client,\n * the openclaw-secrets plugin, and dashboard clients.\n *\n * Server-side crypto and KMS glue live in @alfe/secret-store (Node/AWS-only);\n * this module is a pure, dependency-free shape contract safe for every\n * environment the agent-api-client ships to.\n */\n/** Scope levels at which a secret can be owned. */\nexport type SecretScope = \"org\" | \"team\" | \"project\" | \"agent\";\n/**\n * v1 encrypted envelope as persisted by services/secrets and exchanged with\n * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext\n * are all base64-encoded.\n */\nexport interface EncryptedEnvelopeV1 {\n    version: 1;\n    iv: string;\n    ciphertext: string;\n    authTag: string;\n    dataKeyCiphertext: string;\n}\n/** Opaque metadata about a secret row — never includes plaintext. */\nexport interface SecretMetadata {\n    secretId: string;\n    secretName: string;\n    description?: string;\n    tags?: string[];\n    createdAt: string;\n    updatedAt: string;\n    rotatedAt?: string;\n}\n/** A single secret row including its encrypted envelope. */\nexport interface SecretEnvelopeResponse extends SecretMetadata {\n    envelope: EncryptedEnvelopeV1;\n}\n/** A scope the caller can read or write secrets in. */\nexport interface ScopeInfo {\n    scope: SecretScope;\n    scopeId: string;\n    name?: string;\n}\n/**\n * KMS-issued data key, returned by the secrets service's\n * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is\n * returned base64-encoded; callers MUST decode it to a Buffer and zero the\n * Buffer after use — never keep the plaintext as a JS string.\n */\nexport interface GeneratedDataKey {\n    plaintextKey: string;\n    dataKeyCiphertext: string;\n}\n//# sourceMappingURL=secrets.d.ts.map"],"mappings":";;AAOA;AAAiC,cAJZC,qBAIY,EAAA;WAAWA,MAAAA,EAAAA,QAAAA;WAAoCA,MAAAA,EAAAA,QAAAA;CAAqB;AAGhFE,KAHTF,qBAAAA,GAQX,CAAA,OAR2CA,qBAQ3C,CAAA,CAAA,MAAA,OAR+EA,qBAQ/E,CAAA;;AACsCE,cANlBA,gBAMkBA,EAAAA;WAA+BA,GAAAA,EAAAA,KAAAA;EAAgB,SAAA,IAAA,EAAA,MAAA;EAEjEE,SAAAA,OAAAA,EAAAA,SAGpB;EACWA,SAAAA,KAAAA,EAAAA,OAAAA;CAAwB;AAAWA,KANnCF,gBAAAA,GAMmCE,CAAAA,OANRF,gBAMQE,CAAAA,CAAAA,MAAAA,OANuBF,gBAMvBE,CAAAA;AAA+D,cAJzFA,wBAIyF,EAAA;EAEzFE,SAAAA,MAAAA,EAAAA,QAAAA;EAQTA,SAAAA,OAAAA,EAAAA,SAAuB;CAAA;AAAWA,KAVlCF,wBAAAA,GAUkCE,CAAAA,OAVCF,wBAUDE,CAAAA,CAAAA,MAAAA,OAVwCF,wBAUxCE,CAAAA;AAA6D,cARtFA,uBAQsF,EAAA;EAE1FE,SAAAA,UAAAA,EAAkB,YAAA;EAAA,SAAA,MAAA,EAAA,QAAA;WACxBN,KAAAA,EAAAA,OAAAA;WAIQE,QAAAA,EAAAA,UAAAA;WACDE,QAAAA,EAAAA,UAAAA;WAENG,OAAAA,EAAAA,SAAAA;CAAM;AASDG,KAnBLN,uBAAAA,GAmBiC,CAAA,OAnBCA,uBAmBD,CAAA,CAAA,MAAA,OAnBuCA,uBAmBvC,CAAA;AAgBL,UAjCvBE,kBAAAA,CAiCuB;OAE5BC,EAlCDP,gBAkCCO;SACMG,EAAAA,MAAAA;EAA4B,aAAA,EAAA,MAAA;EAE7BE,QAAAA,EAAAA,MAAa;EAAA,aAAA,EAjCXV,wBAiCW;cAsBVQ,EAtDFN,uBAsDEM;SAGGV,EAAAA,MAAAA;QAENF,EAzDLS,MAyDKT,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA;EAAqB,YAAA,EAAA,MAAA;;;;AC1FtC;;AAwBuC,UDkBtBY,4BAAAA,CClBsB;KACzBI,EAAAA,MAAAA;OADkCC,EAAAA,MAAAA;EAAc,IAAA,EAAA,MAAA;EAI7CE,WAAAA,CAAS,EAAA,MAAA;EAWTC,QAAAA,CAAAA,EAAAA,OAAAA;;;;ICfA,KAAA,EAAA,MAAA;IAKJ,KAAA,EAAA,MAAc;EAAA,CAAA,EAAA;gBAIL,CAAA,EAAA,MAAA;UAsBc,CAAA,EAAA,MAAA;QAAR,CAAA,EAAA,OAAA;;AAIyB,UFDpCP,uBAAAA,CECoC;eAQzC,EAAA,MAAA;QACP,EFROJ,MEQP,CAAA,MAAA,EAAA,OAAA,CAAA;cAYsC,EFnBzBG,4BEmByB,EAAA;;AACtC,UFlBYE,aAAAA,CEkBZ;MAWqD,MAAA;MAAR,EAAA,MAAA;aAOH,EAAA,MAAA;UAAxB,EAAA,MAAA,EAAA;QAIS,EAAA,MAAA;YAoBgB,EAAA,MAAA;QAQA,EAAA,MAAA;MAQhB,CAAA,EAAA,MAAA;QAOF,CAAA,EAAA;IAQF,IAAA,EAAA,MAAA;IAOI,GAAA,CAAA,EAAA,MAAA;MAQG,MAAA;SAaF,CAAA,EAAA;IAOH,IAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA;IASF,KAAA,CAAA,EAAA,MAAA;IAOG,QAAA,CAAA,EAAA,MAAA;IAgBZ,QAAA,CAAA,EAAA,OAAA,GAAA,MAAA;IACb,WAAA,CAAA,EAAA,MAAA;;UAaqF,CAAA,EAAA,MAAA,EAAA;gBAarF,CAAA,EAAA,MAAA,EAAA;eAgCK,CAAA,EFnMSF,4BEmMT,EAAA;kBAGG,CAAA,EAAA,MAAA,EAAA;;kBAaH,CAAA,EFhNYV,gBEgNZ,EAAA;;YAaA,CAAA,EF3NMF,qBE2NN;;;;;;AF3TX;AAIA;;;;;AAGA;AAMA;AAA4B,KCPhBe,WAAAA,GDOgB,KAAA,GAAA,MAAA,GAAA,SAAA,GAAA,OAAA;;;;AAE5B;AAIA;AAAoC,UCPnBC,mBAAAA,CDOmB;SAAWZ,EAAAA,CAAAA;MAAuCA,MAAAA;EAAwB,UAAA,EAAA,MAAA;EAEzFE,OAAAA,EAAAA,MAAAA;EAQTA,iBAAAA,EAAAA,MAAAA;;;AAAwEA,UCTnEW,cAAAA,CDSmEX;EAAuB,QAAA,EAAA,MAAA;EAE1FE,UAAAA,EAAAA,MAAAA;EAAkB,WAAA,CAAA,EAAA,MAAA;MACxBN,CAAAA,EAAAA,MAAAA,EAAAA;WAIQE,EAAAA,MAAAA;WACDE,EAAAA,MAAAA;WAENG,CAAAA,EAAAA,MAAAA;;AASZ;AAgBiBI,UClCAK,sBAAAA,SAA+BD,cDkCR,CAAA;EAAA,QAAA,ECjC1BD,mBDiC0B;;;AAGM,UCjC7BG,SAAAA,CDiC6B;EAE7BL,KAAAA,EClCNC,WDkCmB;EAAA,OAAA,EAAA,MAAA;MAsBVH,CAAAA,EAAAA,MAAAA;;;;;;;ACrFpB;AAMiBI,UAiCAI,gBAAAA,CAjCmB;EAQnBH,YAAAA,EAAAA,MAAc;EAUdC,iBAAAA,EAAAA,MAAsB;;;;;ADjBX,UEiBX,oBAAA,CFjBW;QAAWhB,EAAAA,MAAAA;QAA+BA,EAAAA,MAAAA;;AAEjDE,cEoBR,cAAA,CFjBZ;EACWA,iBAAAA,MAAAA;EAAwB,iBAAA,MAAA;aAAWA,CAAAA,MAAAA,EEoBzB,oBFpByBA;UAAuCA,OAAAA;EAAwB,gBAAA,CAAA,CAAA,EE0ClF,OF1CkF,CE0C1E,kBF1C0E,EAAA,CAAA;EAEzFE,oBAAAA,CAAAA,aAOpB,EAAA,MAAA,CAAA,EEqCoD,OFrCpD,CEqC4D,uBFrC5D,CAAA;EACWA,uBAAAA,CAAAA,aAAuB,EAAA,MAAA,EAAA,MAAA,EE4CvB,MF5CuB,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EE6C9B,OF7C8B,CAAA,IAAA,CAAA;EAAA,kBAAA,CAAA,aAAA,EAAA,MAAA,EAAA,OAAwE,CAAxE,EAAA;IAAWA,OAAAA,CAAAA,EAAAA,MAAAA;IAAsCA,MAAAA,CAAAA,EEyDzC,MFzDyCA,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA;EAAuB,CAAA,CAAA,EE0DtG,OF1DsG,CE0D9F,kBF1D8F,CAAA;EAE1FE,iBAAAA,CAAAA,aAAkB,EAAA,MAAA,CAAA,EEmEe,OFnEf,CEmEuB,kBFnEvB,CAAA;EAAA,WAAA,CAAA,CAAA,EE0EZ,OF1EY,CAAA;IACxBN,YAAAA,EEyEoC,aFzEpCA,EAAAA;;sBAKOI,CAAAA,CAAAA,EEwEc,OFxEdA,CAAAA;IAENG,QAAAA,CAAAA,EAAAA;MAAM,KAAA,EAAA,MAAA;MASDG,YAAAA,EAAAA,MAAAA;MAgBAC,QAAAA,EAAAA,MAAAA;MAAuB,YAAA,EAAA,MAAA;MAE5BJ,eAAAA,CAAAA,EAAAA,MAAAA,EAAAA;MACMG,SAAAA,EAAAA,OAAAA;MAA4B,WAAA,CAAA,EAAA,MAAA;IAE7BE,CAAAA,EAAAA;IAAa,KAAA,EAAA,MAAA;IAsBVF,YAAAA,EAAAA,MAAAA;IAGGV,QAAAA,EAAAA,MAAAA;IAENF,YAAAA,EAAAA,MAAAA;IAAqB,SAAA,EAAA,MAAA;;;0CEiCU;ID3HpCe,QAAAA,EAAW;MAMNC,KAAAA,EAAAA,MAAAA;MAQAC,WAAc,CAAA,EAAA,MAAA;MAUdC,SAAAA,EAAAA,OAAsB;IAAA,CAAA,EAAA;;yBAASD,CAAAA,KAAAA,EAAAA,MAAAA,CAAAA,EC2GA,OD3GAA,CAAAA;IAAc,QAAA,EAAA;MAI7CE,KAAS,EAAA,MAAA;MAWTC,WAAgB,CAAA,EAAA,MAAA;;;;ECfhB,oBAAA,CAAA,CAAA,EAmHe,OAnHK,CAAA;IAKxB,KAAA,EAAA,MAAc;IAAA,WAAA,EAAA,MAAA;;oBA0BS,CAAA,CAAA,EA2FN,OA3FM,CAAA;IAAR,WAAA,EAAA,MAAA;IAIiC,oBAAA,EAAA,MAAA;IAAR,YAAA,EAAA,MAAA;;kBAShD,CAAA,CAAA,EAsFuB,OAtFvB,CAAA;IAYsC,WAAA,EAAA,MAAA;IAC9B,SAAA,EAAA,MAAA;;sBAW6C,CAAA,CAAA,EAqE1B,OArE0B,CAAA;IAAR,WAAA,EAAA,MAAA;IAOH,WAAA,EAAA,MAAA;IAAxB,aAAA,EAAA,MAAA;;yBAwByB,CAAA,CAAA,EA8Cb,OA9Ca,CAAA;IAQA,WAAA,EAAA,MAAA;IAQhB,YAAA,EAAA,MAAA;IAOF,oBAAA,EAAA,MAAA;IAQF,OAAA,EAAA,MAAA;IAOI,QAAA,EAAA,MAAA;IAQG,OAAA,EAAA,MAAA;IAaF,KAAA,EAAA,MAAA;IAOH,eAAA,EAAA,MAAA,EAAA;;uBAgBC,CAAA,CAAA,EAvBE,OAuBF,CAAA;IAgBZ,WAAA,EAAA,MAAA;IACb,SAAA,EAAA,MAAA;;oBAaqF,CAAA,CAAA,EA9C7D,OA8C6D,CAAA;IAarF,WAAA,EAAA,MAAA;IAgCK,oBAAA,EAAA,MAAA;IAGG,cAAA,EAAA,MAAA;IAAR,QAAA,EAAA,MAAA;;kBAiBA,CAAA,CAAA,EAtGsB,OAsGtB,CAAA;IASK,WAAA,EAAA,MAAA;IAIG,SAAA,EAAA,MAAA;;qBAgBH,CAAA,CAAA,EA5HoB,OA4HpB,CAAA;IAGG,OAAA,EAAA,MAAA;IAAR,QAAA,EAAA,MAAA;IAQK,UAAA,EAAA,MAAA;IAEG,UAAA,EAAA,MAAA;IAAR,iBAAA,EAAA,MAAA;IASK,cAAA,CAAA,EAAA,MAAA;IAGL,aAAA,CAAA,EAAA,MAAA;IAQ8B,UAAA,CAAA,EAAA,MAAA;;EAAD,gBAAA,CAAA,IAAA,EAAA;;;mBA7IhB;MACb;;;;uBAOuB;;;;;;;;;;;QAM8D;;;;;;;;;;;;;MAarF;;;;;;;;;WAgCK;;;MAGL,QAAQ;;;;;;;WAaH;;;;MAIL;;;;;WASK;;;;cAIG;;;MAGR;;;;;WAaK;;;MAGL,QAAQ;;;WAQH;;MAEL,QAAQ;;;WASH;;;MAGL;;sBAQsB,QAAQ"}

package/dist/index.d.ts

@@ -1,9 +1,8 @@
 //#region ../../packages-internal/types/dist/integration.d.ts
 
-/** Controls where an integration appears: public (everyone), dev (non-prod only), hidden (nowhere) */
+/** Controls where an integration appears: public (everyone), hidden (nowhere) */
 declare const IntegrationVisibility: {
   readonly Public: "public";
-  readonly Dev: "dev";
   readonly Hidden: "hidden";
 };
 type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];
@@ -58,6 +57,7 @@ interface IntegrationConfigSchemaField {
   }[];
   oauth_provider?: string;
   editable?: string;
+  hidden?: boolean;
 }
 interface IntegrationConfigResult {
   integrationId: string;
@@ -95,6 +95,61 @@ interface RegistryEntry {
 }
 //# sourceMappingURL=integration.d.ts.map
 //#endregion
+//#region ../../packages-internal/types/dist/secrets.d.ts
+/**
+ * Secrets types — shared between services/secrets, @alfe.ai/agent-api-client,
+ * the openclaw-secrets plugin, and dashboard clients.
+ *
+ * Server-side crypto and KMS glue live in @alfe/secret-store (Node/AWS-only);
+ * this module is a pure, dependency-free shape contract safe for every
+ * environment the agent-api-client ships to.
+ */
+/** Scope levels at which a secret can be owned. */
+type SecretScope = "org" | "team" | "project" | "agent";
+/**
+ * v1 encrypted envelope as persisted by services/secrets and exchanged with
+ * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext
+ * are all base64-encoded.
+ */
+interface EncryptedEnvelopeV1 {
+  version: 1;
+  iv: string;
+  ciphertext: string;
+  authTag: string;
+  dataKeyCiphertext: string;
+}
+/** Opaque metadata about a secret row — never includes plaintext. */
+interface SecretMetadata {
+  secretId: string;
+  secretName: string;
+  description?: string;
+  tags?: string[];
+  createdAt: string;
+  updatedAt: string;
+  rotatedAt?: string;
+}
+/** A single secret row including its encrypted envelope. */
+interface SecretEnvelopeResponse extends SecretMetadata {
+  envelope: EncryptedEnvelopeV1;
+}
+/** A scope the caller can read or write secrets in. */
+interface ScopeInfo {
+  scope: SecretScope;
+  scopeId: string;
+  name?: string;
+}
+/**
+ * KMS-issued data key, returned by the secrets service's
+ * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is
+ * returned base64-encoded; callers MUST decode it to a Buffer and zero the
+ * Buffer after use — never keep the plaintext as a JS string.
+ */
+interface GeneratedDataKey {
+  plaintextKey: string;
+  dataKeyCiphertext: string;
+}
+//# sourceMappingURL=secrets.d.ts.map
+//#endregion
 //#region src/index.d.ts
 interface AgentApiClientConfig {
   apiKey: string;
@@ -117,10 +172,115 @@ declare class AgentApiClient {
     integrations: RegistryEntry[];
   }>;
   getGoogleCredentials(): Promise<{
+    accounts?: {
+      email: string;
+      refreshToken: string;
+      clientId: string;
+      clientSecret: string;
+      enabledServices?: string[];
+      isDefault: boolean;
+      displayName?: string;
+    }[];
     email: string;
     refreshToken: string;
     clientId: string;
     clientSecret: string;
+    projectId: string;
+    enabledServices?: string[];
+  }>;
+  disconnectGoogleAccount(email: string): Promise<{
+    accounts: {
+      email: string;
+      displayName?: string;
+      isDefault: boolean;
+    }[];
+  }>;
+  setDefaultGoogleAccount(email: string): Promise<{
+    accounts: {
+      email: string;
+      displayName?: string;
+      isDefault: boolean;
+    }[];
+  }>;
+  getGithubCredentials(): Promise<{
+    login: string;
+    accessToken: string;
+  }>;
+  getXeroCredentials(): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    xeroTenantId: string;
+  }>;
+  refreshXeroToken(): Promise<{
+    accessToken: string;
+    expiresAt: string;
+  }>;
+  getNotionCredentials(): Promise<{
+    accessToken: string;
+    workspaceId: string;
+    workspaceName: string;
+  }>;
+  getAtlassianCredentials(): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    accessTokenExpiresAt: string;
+    cloudId: string;
+    siteName: string;
+    siteUrl: string;
+    email: string;
+    enabledProducts: string[];
+  }>;
+  refreshAtlassianToken(): Promise<{
+    accessToken: string;
+    expiresAt: string;
+  }>;
+  getMYOBCredentials(): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    myobBusinessId: string;
+    clientId: string;
+  }>;
+  refreshMYOBToken(): Promise<{
+    accessToken: string;
+    expiresAt: string;
+  }>;
+  getTeamsCredentials(): Promise<{
+    agentId: string;
+    tenantId: string;
+    azureAppId: string;
+    azureBotId: string;
+    azureClientSecret: string;
+    botDisplayName?: string;
+    teamsTenantId?: string;
+    serviceUrl?: string;
+  }>;
+  sendTeamsMessage(data: {
+    conversationId: string;
+    text?: string;
+    adaptiveCard?: Record<string, unknown>;
+  }): Promise<{
+    ok: boolean;
+    activityId: string;
+  }>;
+  listTeamsChannels(): Promise<{
+    channels: {
+      id: string;
+      name: string;
+      description?: string;
+    }[];
+  }>;
+  presignAttachments(files: {
+    filename: string;
+    mimeType: string;
+    size: number;
+  }[]): Promise<{
+    attachments: {
+      id: string;
+      uploadUrl: string;
+      downloadUrl: string;
+      s3Key: string;
+      expiresAt: string;
+    }[];
   }>;
   recordActivity(data: {
     userId?: string;
@@ -129,9 +289,62 @@ declare class AgentApiClient {
   }): Promise<{
     recorded: boolean;
   }>;
+  /**
+   * Mint a fresh AES-256 data key for a new secret or rotation. The encryption
+   * context is rebuilt server-side from `auth.tenantId` + the body fields; the
+   * agent cannot forge context for a scope it doesn't own.
+   */
+  generateSecretDataKey(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+  }): Promise<GeneratedDataKey>;
+  /**
+   * Unwrap a wrapped data key so the agent can decrypt the envelope locally.
+   * KMS Decrypt will fail with `InvalidCiphertextException` if the envelope
+   * was tampered with in a way that changes `{ tenantId, scope, scopeId, secretId }`.
+   */
+  decryptSecretDataKey(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+    dataKeyCiphertext: string;
+  }): Promise<{
+    plaintextKey: string;
+  }>;
+  /** Upload a pre-encrypted envelope for a secret. */
+  putSecretEnvelope(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+    secretName: string;
+    envelope: EncryptedEnvelopeV1;
+    description?: string;
+    tags?: string[];
+  }): Promise<{
+    secretId: string;
+  }>;
+  /** Fetch the encrypted envelope for a single secret. */
+  getSecretEnvelope(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+  }): Promise<SecretEnvelopeResponse>;
+  /** List metadata (never envelopes) for secrets in a scope. */
+  listSecrets(args: {
+    scope: SecretScope;
+    scopeId: string;
+  }): Promise<SecretMetadata[]>;
+  /** Delete a secret. */
+  deleteSecret(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+  }): Promise<void>;
+  /** Enumerate scopes (org/team/project/agent) this agent can access. */
+  listSecretScopes(): Promise<ScopeInfo[]>;
 }
 //# sourceMappingURL=index.d.ts.map
-
 //#endregion
-export { AgentApiClient, AgentApiClientConfig, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry };
+export { AgentApiClient, AgentApiClientConfig, type EncryptedEnvelopeV1, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretEnvelopeResponse, type SecretMetadata, type SecretScope };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":["DEFAULT_INTEGRATIONS","IntegrationVisibility","INTEGRATION_VISIBILITIES","IntegrationScope","INTEGRATION_SCOPES","IntegrationDesiredStatus","INTEGRATION_DESIRED_STATUSES","IntegrationActualStatus","INTEGRATION_ACTUAL_STATUSES","IntegrationInstall","Record","AgentIntegration","OrgIntegration","IntegrationConfigSchemaField","IntegrationConfigResult","RegistryEntry"],"sources":["../../../packages-internal/types/dist/integration.d.ts","../src/index.ts"],"sourcesContent":["/** Integrations auto-installed for ALL agents regardless of hosting type. Cannot be removed. */\nexport declare const DEFAULT_INTEGRATIONS: readonly string[];\n/** Controls where an integration appears: public (everyone), dev (non-prod only), hidden (nowhere) */\nexport declare const IntegrationVisibility: {\n    readonly Public: \"public\";\n    readonly Dev: \"dev\";\n    readonly Hidden: \"hidden\";\n};\nexport type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];\nexport declare const INTEGRATION_VISIBILITIES: readonly [\"dev\" | \"public\" | \"hidden\", ...(\"dev\" | \"public\" | \"hidden\")[]];\n/** Scope at which an integration is installed */\nexport declare const IntegrationScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type IntegrationScope = (typeof IntegrationScope)[keyof typeof IntegrationScope];\nexport declare const INTEGRATION_SCOPES: readonly [\"org\" | \"team\" | \"project\" | \"agent\", ...(\"org\" | \"team\" | \"project\" | \"agent\")[]];\nexport declare const IntegrationDesiredStatus: {\n    readonly Active: \"active\";\n    readonly Removed: \"removed\";\n};\nexport type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];\nexport declare const INTEGRATION_DESIRED_STATUSES: readonly [\"active\" | \"removed\", ...(\"active\" | \"removed\")[]];\nexport declare const IntegrationActualStatus: {\n    readonly Installing: \"installing\";\n    readonly Active: \"active\";\n    readonly Error: \"error\";\n    readonly Removing: \"removing\";\n    readonly Inactive: \"inactive\";\n    readonly Unknown: \"unknown\";\n};\nexport type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];\nexport declare const INTEGRATION_ACTUAL_STATUSES: readonly [\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\", ...(\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\")[]];\nexport interface IntegrationInstall {\n    scope: IntegrationScope;\n    scopeId: string;\n    integrationId: string;\n    tenantId: string;\n    desiredStatus: IntegrationDesiredStatus;\n    actualStatus: IntegrationActualStatus;\n    version: string;\n    config: Record<string, unknown>;\n    errorMessage: string;\n    installedAt: string;\n    updatedAt: string;\n}\n/** @deprecated Use IntegrationInstall instead */\nexport type AgentIntegration = IntegrationInstall;\n/** Org-scoped integration install */\nexport type OrgIntegration = IntegrationInstall;\nexport interface IntegrationConfigSchemaField {\n    key: string;\n    label: string;\n    type: string;\n    description?: string;\n    required?: boolean;\n    default?: string | number | boolean;\n    options?: string[];\n    select_options?: {\n        value: string;\n        label: string;\n    }[];\n    oauth_provider?: string;\n    editable?: string;\n}\nexport interface IntegrationConfigResult {\n    integrationId: string;\n    config: Record<string, unknown>;\n    configSchema: IntegrationConfigSchemaField[];\n}\nexport interface RegistryEntry {\n    id: string;\n    name: string;\n    description: string;\n    versions: string[];\n    latest: string;\n    repository: string;\n    commit: string;\n    icon?: string;\n    author?: {\n        name: string;\n        url?: string;\n    } | string;\n    pricing?: {\n        type: \"free\" | \"paid\" | \"usage\";\n        price?: number;\n        currency?: string;\n        interval?: \"month\" | \"year\";\n        description?: string;\n    };\n    features?: string[];\n    preview_images?: string[];\n    config_schema?: IntegrationConfigSchemaField[];\n    supported_agents?: string[];\n    /** Scopes where this integration can be installed */\n    supported_scopes?: IntegrationScope[];\n    /** Visibility status — controls where integration appears */\n    visibility?: IntegrationVisibility;\n}\n//# sourceMappingURL=integration.d.ts.map"],"mappings":";;AAQA;AAAiC,cALZC,qBAKY,EAAA;WAAWA,MAAAA,EAAAA,QAAAA;WAAoCA,GAAAA,EAAAA,KAAAA;EAAqB,SAAA,MAAA,EAAA,QAAA;AAGrG,CAAA;AAMYE,KATAF,qBAAAA,GASgB,CAAA,OATgBA,qBAShB,CAAA,CAAA,MAAA,OAToDA,qBASpD,CAAA;;AAA0CE,cANjDA,gBAMiDA,EAAAA;EAAgB,SAAA,GAAA,EAAA,KAAA;EAEjEE,SAAAA,IAAAA,EAAAA,MAAAA;EAITA,SAAAA,OAAAA,EAAAA,SAAwB;EAAA,SAAA,KAAA,EAAA,OAAA;;AAAkDA,KAN1EF,gBAAAA,GAM0EE,CAAAA,OAN/CF,gBAM+CE,CAAAA,CAAAA,MAAAA,OANhBF,gBAMgBE,CAAAA;AAEjEE,cANAF,wBAapB,EAAA;EACWE,SAAAA,MAAAA,EAAAA,QAAAA;EAAuB,SAAA,OAAA,EAAA,SAAA;;AAAiDA,KAVxEF,wBAAAA,GAUwEE,CAAAA,OAVrCF,wBAUqCE,CAAAA,CAAAA,MAAAA,OAVEF,wBAUFE,CAAAA;AAEnEE,cAVIF,uBAUc,EAAA;EAAA,SAAA,UAAA,EAAA,YAAA;WACxBJ,MAAAA,EAAAA,QAAAA;WAIQE,KAAAA,EAAAA,OAAAA;WACDE,QAAAA,EAAAA,UAAAA;WAENG,QAAAA,EAAAA,UAAAA;EAAM,SAAA,OAAA,EAAA,SAAA;AASlB,CAAA;AAeiBI,KAlCLP,uBAAAA,GAkC4B,CAAA,OAlCMA,uBAkCN,CAAA,CAAA,MAAA,OAlC4CA,uBAkC5C,CAAA;AAE5BG,UAlCKD,kBAAAA,CAkCLC;OACMG,EAlCPV,gBAkCOU;EAA4B,OAAA,EAAA,MAAA;EAE7BE,aAAAA,EAAAA,MAAa;EAAA,QAAA,EAAA,MAAA;eAsBVF,EAtDDR,wBAsDCQ;cAGGV,EAxDLI,uBAwDKJ;SAENF,EAAAA,MAAAA;EAAqB,MAAA,EAxD1BS,MAwD0B,CAAA,MAAA,EAAA,OAAA,CAAA;;;;AClFtC;AAKA;;AA0B4B,UDIXG,4BAAAA,CCJW;KAIiC,EAAA,MAAA;OAAR,EAAA,MAAA;MAQzC,EAAA,MAAA;aACP,CAAA,EAAA,MAAA;UAYsC,CAAA,EAAA,OAAA;SAC9B,CAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA;SAAR,CAAA,EAAA,MAAA,EAAA;gBAWqD,CAAA,EAAA;IAAR,KAAA,EAAA,MAAA;IAOH,KAAA,EAAA,MAAA;KAAxB;gBAIS,CAAA,EAAA,MAAA;UAa1B,CAAA,EAAA,MAAA;;UD1CWC,uBAAAA;;UAELJ;gBACMG;;UAEDE,aAAAA;;;;;;;;;;;;;;;;;;;;;;kBAsBGF;;;qBAGGV;;eAENF;;;;;AAlFW,UCAX,oBAAA,CDAW;QAAWE,EAAAA,MAAAA;QAA+BA,EAAAA,MAAAA;;AAEjDE,cCGR,cAAA,CDAZ;EACWA,iBAAAA,MAAAA;EAAwB,iBAAA,MAAA;aAAWA,CAAAA,MAAAA,ECGzB,oBDHyBA;UAAuCA,OAAAA;EAAwB,gBAAA,CAAA,CAAA,ECyBlF,ODzBkF,CCyB1E,kBDzB0E,EAAA,CAAA;EAEzFE,oBAAAA,CAAAA,aAOpB,EAAA,MAAA,CAAA,ECoBoD,ODpBpD,CCoB4D,uBDpB5D,CAAA;EACWA,uBAAAA,CAAAA,aAAuB,EAAA,MAAA,EAAA,MAAA,EC2BvB,MD3BuB,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EC4B9B,OD5B8B,CAAA,IAAA,CAAA;EAAA,kBAAA,CAAA,aAAA,EAAA,MAAA,EAAA,OAAwE,CAAxE,EAAA;IAAWA,OAAAA,CAAAA,EAAAA,MAAAA;IAAsCA,MAAAA,CAAAA,ECwCzC,MDxCyCA,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA;EAAuB,CAAA,CAAA,ECyCtG,ODzCsG,CCyC9F,kBDzC8F,CAAA;EAE1FE,iBAAAA,CAAAA,aAAkB,EAAA,MAAA,CAAA,ECkDe,ODlDf,CCkDuB,kBDlDvB,CAAA;EAAA,WAAA,CAAA,CAAA,ECyDZ,ODzDY,CAAA;IACxBN,YAAAA,ECwDoC,aDxDpCA,EAAAA;;sBAKOI,CAAAA,CAAAA,ECuDc,ODvDdA,CAAAA;IAENG,KAAAA,EAAAA,MAAAA;IAAM,YAAA,EAAA,MAAA;IASDG,QAAAA,EAAAA,MAAAA;IAeAC,YAAAA,EAAAA,MAAAA;EAAuB,CAAA,CAAA;gBAE5BJ,CAAAA,IAAAA,EAAAA;IACMG,MAAAA,CAAAA,EAAAA,MAAAA;IAA4B,OAAA,EAAA,MAAA;IAE7BE,IAAAA,EAAAA,MAAa,GAAA,WAAA;EAAA,CAAA,CAAA,ECqCxB,ODrCwB,CAAA;IAsBVF,QAAAA,EAAAA,OAAAA"}
+{"version":3,"file":"index.d.ts","names":["DEFAULT_INTEGRATIONS","IntegrationVisibility","INTEGRATION_VISIBILITIES","IntegrationScope","INTEGRATION_SCOPES","IntegrationDesiredStatus","INTEGRATION_DESIRED_STATUSES","IntegrationActualStatus","INTEGRATION_ACTUAL_STATUSES","IntegrationInstall","Record","AgentIntegration","OrgIntegration","IntegrationConfigSchemaField","IntegrationConfigResult","RegistryEntry","SecretScope","EncryptedEnvelopeV1","SecretMetadata","SecretEnvelopeResponse","ScopeInfo","GeneratedDataKey"],"sources":["../../../packages-internal/types/dist/integration.d.ts","../../../packages-internal/types/dist/secrets.d.ts","../src/index.ts"],"sourcesContent":["/** Integrations auto-installed for ALL agents regardless of hosting type. Cannot be removed. */\nexport declare const DEFAULT_INTEGRATIONS: readonly string[];\n/** Controls where an integration appears: public (everyone), hidden (nowhere) */\nexport declare const IntegrationVisibility: {\n    readonly Public: \"public\";\n    readonly Hidden: \"hidden\";\n};\nexport type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];\nexport declare const INTEGRATION_VISIBILITIES: readonly [\"public\" | \"hidden\", ...(\"public\" | \"hidden\")[]];\n/** Scope at which an integration is installed */\nexport declare const IntegrationScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type IntegrationScope = (typeof IntegrationScope)[keyof typeof IntegrationScope];\nexport declare const INTEGRATION_SCOPES: readonly [\"org\" | \"team\" | \"project\" | \"agent\", ...(\"org\" | \"team\" | \"project\" | \"agent\")[]];\nexport declare const IntegrationDesiredStatus: {\n    readonly Active: \"active\";\n    readonly Removed: \"removed\";\n};\nexport type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];\nexport declare const INTEGRATION_DESIRED_STATUSES: readonly [\"active\" | \"removed\", ...(\"active\" | \"removed\")[]];\nexport declare const IntegrationActualStatus: {\n    readonly Installing: \"installing\";\n    readonly Active: \"active\";\n    readonly Error: \"error\";\n    readonly Removing: \"removing\";\n    readonly Inactive: \"inactive\";\n    readonly Unknown: \"unknown\";\n};\nexport type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];\nexport declare const INTEGRATION_ACTUAL_STATUSES: readonly [\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\", ...(\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\")[]];\nexport interface IntegrationInstall {\n    scope: IntegrationScope;\n    scopeId: string;\n    integrationId: string;\n    tenantId: string;\n    desiredStatus: IntegrationDesiredStatus;\n    actualStatus: IntegrationActualStatus;\n    version: string;\n    config: Record<string, unknown>;\n    errorMessage: string;\n    installedAt: string;\n    updatedAt: string;\n}\n/** @deprecated Use IntegrationInstall instead */\nexport type AgentIntegration = IntegrationInstall;\n/** Org-scoped integration install */\nexport type OrgIntegration = IntegrationInstall;\nexport interface IntegrationConfigSchemaField {\n    key: string;\n    label: string;\n    type: string;\n    description?: string;\n    required?: boolean;\n    default?: string | number | boolean;\n    options?: string[];\n    select_options?: {\n        value: string;\n        label: string;\n    }[];\n    oauth_provider?: string;\n    editable?: string;\n    hidden?: boolean;\n}\nexport interface IntegrationConfigResult {\n    integrationId: string;\n    config: Record<string, unknown>;\n    configSchema: IntegrationConfigSchemaField[];\n}\nexport interface RegistryEntry {\n    id: string;\n    name: string;\n    description: string;\n    versions: string[];\n    latest: string;\n    repository: string;\n    commit: string;\n    icon?: string;\n    author?: {\n        name: string;\n        url?: string;\n    } | string;\n    pricing?: {\n        type: \"free\" | \"paid\" | \"usage\";\n        price?: number;\n        currency?: string;\n        interval?: \"month\" | \"year\";\n        description?: string;\n    };\n    features?: string[];\n    preview_images?: string[];\n    config_schema?: IntegrationConfigSchemaField[];\n    supported_agents?: string[];\n    /** Scopes where this integration can be installed */\n    supported_scopes?: IntegrationScope[];\n    /** Visibility status — controls where integration appears */\n    visibility?: IntegrationVisibility;\n}\n//# sourceMappingURL=integration.d.ts.map","/**\n * Secrets types — shared between services/secrets, @alfe.ai/agent-api-client,\n * the openclaw-secrets plugin, and dashboard clients.\n *\n * Server-side crypto and KMS glue live in @alfe/secret-store (Node/AWS-only);\n * this module is a pure, dependency-free shape contract safe for every\n * environment the agent-api-client ships to.\n */\n/** Scope levels at which a secret can be owned. */\nexport type SecretScope = \"org\" | \"team\" | \"project\" | \"agent\";\n/**\n * v1 encrypted envelope as persisted by services/secrets and exchanged with\n * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext\n * are all base64-encoded.\n */\nexport interface EncryptedEnvelopeV1 {\n    version: 1;\n    iv: string;\n    ciphertext: string;\n    authTag: string;\n    dataKeyCiphertext: string;\n}\n/** Opaque metadata about a secret row — never includes plaintext. */\nexport interface SecretMetadata {\n    secretId: string;\n    secretName: string;\n    description?: string;\n    tags?: string[];\n    createdAt: string;\n    updatedAt: string;\n    rotatedAt?: string;\n}\n/** A single secret row including its encrypted envelope. */\nexport interface SecretEnvelopeResponse extends SecretMetadata {\n    envelope: EncryptedEnvelopeV1;\n}\n/** A scope the caller can read or write secrets in. */\nexport interface ScopeInfo {\n    scope: SecretScope;\n    scopeId: string;\n    name?: string;\n}\n/**\n * KMS-issued data key, returned by the secrets service's\n * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is\n * returned base64-encoded; callers MUST decode it to a Buffer and zero the\n * Buffer after use — never keep the plaintext as a JS string.\n */\nexport interface GeneratedDataKey {\n    plaintextKey: string;\n    dataKeyCiphertext: string;\n}\n//# sourceMappingURL=secrets.d.ts.map"],"mappings":";;AAOA;AAAiC,cAJZC,qBAIY,EAAA;WAAWA,MAAAA,EAAAA,QAAAA;WAAoCA,MAAAA,EAAAA,QAAAA;CAAqB;AAGhFE,KAHTF,qBAAAA,GAQX,CAAA,OAR2CA,qBAQ3C,CAAA,CAAA,MAAA,OAR+EA,qBAQ/E,CAAA;;AACsCE,cANlBA,gBAMkBA,EAAAA;WAA+BA,GAAAA,EAAAA,KAAAA;EAAgB,SAAA,IAAA,EAAA,MAAA;EAEjEE,SAAAA,OAAAA,EAAAA,SAGpB;EACWA,SAAAA,KAAAA,EAAAA,OAAAA;CAAwB;AAAWA,KANnCF,gBAAAA,GAMmCE,CAAAA,OANRF,gBAMQE,CAAAA,CAAAA,MAAAA,OANuBF,gBAMvBE,CAAAA;AAA+D,cAJzFA,wBAIyF,EAAA;EAEzFE,SAAAA,MAAAA,EAAAA,QAAAA;EAQTA,SAAAA,OAAAA,EAAAA,SAAuB;CAAA;AAAWA,KAVlCF,wBAAAA,GAUkCE,CAAAA,OAVCF,wBAUDE,CAAAA,CAAAA,MAAAA,OAVwCF,wBAUxCE,CAAAA;AAA6D,cARtFA,uBAQsF,EAAA;EAE1FE,SAAAA,UAAAA,EAAkB,YAAA;EAAA,SAAA,MAAA,EAAA,QAAA;WACxBN,KAAAA,EAAAA,OAAAA;WAIQE,QAAAA,EAAAA,UAAAA;WACDE,QAAAA,EAAAA,UAAAA;WAENG,OAAAA,EAAAA,SAAAA;CAAM;AASDG,KAnBLN,uBAAAA,GAmBiC,CAAA,OAnBCA,uBAmBD,CAAA,CAAA,MAAA,OAnBuCA,uBAmBvC,CAAA;AAgBL,UAjCvBE,kBAAAA,CAiCuB;OAE5BC,EAlCDP,gBAkCCO;SACMG,EAAAA,MAAAA;EAA4B,aAAA,EAAA,MAAA;EAE7BE,QAAAA,EAAAA,MAAa;EAAA,aAAA,EAjCXV,wBAiCW;cAsBVQ,EAtDFN,uBAsDEM;SAGGV,EAAAA,MAAAA;QAENF,EAzDLS,MAyDKT,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA;EAAqB,YAAA,EAAA,MAAA;;;;AC1FtC;;AAwBuC,UDkBtBY,4BAAAA,CClBsB;KACzBI,EAAAA,MAAAA;OADkCC,EAAAA,MAAAA;EAAc,IAAA,EAAA,MAAA;EAI7CE,WAAAA,CAAS,EAAA,MAAA;EAWTC,QAAAA,CAAAA,EAAAA,OAAAA;;;;ICfA,KAAA,EAAA,MAAA;IAKJ,KAAA,EAAA,MAAc;EAAA,CAAA,EAAA;gBAIL,CAAA,EAAA,MAAA;UAsBc,CAAA,EAAA,MAAA;QAAR,CAAA,EAAA,OAAA;;AAIyB,UFDpCP,uBAAAA,CECoC;eAQzC,EAAA,MAAA;QACP,EFROJ,MEQP,CAAA,MAAA,EAAA,OAAA,CAAA;cAYsC,EFnBzBG,4BEmByB,EAAA;;AACtC,UFlBYE,aAAAA,CEkBZ;MAWqD,MAAA;MAAR,EAAA,MAAA;aAOH,EAAA,MAAA;UAAxB,EAAA,MAAA,EAAA;QAIS,EAAA,MAAA;YAoBgB,EAAA,MAAA;QAQA,EAAA,MAAA;MAQhB,CAAA,EAAA,MAAA;QAOF,CAAA,EAAA;IAQF,IAAA,EAAA,MAAA;IAOI,GAAA,CAAA,EAAA,MAAA;MAQG,MAAA;SAaF,CAAA,EAAA;IAOH,IAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA;IASF,KAAA,CAAA,EAAA,MAAA;IAOG,QAAA,CAAA,EAAA,MAAA;IAgBZ,QAAA,CAAA,EAAA,OAAA,GAAA,MAAA;IACb,WAAA,CAAA,EAAA,MAAA;;UAaqF,CAAA,EAAA,MAAA,EAAA;gBAarF,CAAA,EAAA,MAAA,EAAA;eAgCK,CAAA,EFnMSF,4BEmMT,EAAA;kBAGG,CAAA,EAAA,MAAA,EAAA;;kBAaH,CAAA,EFhNYV,gBEgNZ,EAAA;;YAaA,CAAA,EF3NMF,qBE2NN;;;;;;AF3TX;AAIA;;;;;AAGA;AAMA;AAA4B,KCPhBe,WAAAA,GDOgB,KAAA,GAAA,MAAA,GAAA,SAAA,GAAA,OAAA;;;;AAE5B;AAIA;AAAoC,UCPnBC,mBAAAA,CDOmB;SAAWZ,EAAAA,CAAAA;MAAuCA,MAAAA;EAAwB,UAAA,EAAA,MAAA;EAEzFE,OAAAA,EAAAA,MAAAA;EAQTA,iBAAAA,EAAAA,MAAAA;;;AAAwEA,UCTnEW,cAAAA,CDSmEX;EAAuB,QAAA,EAAA,MAAA;EAE1FE,UAAAA,EAAAA,MAAAA;EAAkB,WAAA,CAAA,EAAA,MAAA;MACxBN,CAAAA,EAAAA,MAAAA,EAAAA;WAIQE,EAAAA,MAAAA;WACDE,EAAAA,MAAAA;WAENG,CAAAA,EAAAA,MAAAA;;AASZ;AAgBiBI,UClCAK,sBAAAA,SAA+BD,cDkCR,CAAA;EAAA,QAAA,ECjC1BD,mBDiC0B;;;AAGM,UCjC7BG,SAAAA,CDiC6B;EAE7BL,KAAAA,EClCNC,WDkCmB;EAAA,OAAA,EAAA,MAAA;MAsBVH,CAAAA,EAAAA,MAAAA;;;;;;;ACrFpB;AAMiBI,UAiCAI,gBAAAA,CAjCmB;EAQnBH,YAAAA,EAAAA,MAAc;EAUdC,iBAAAA,EAAAA,MAAsB;;;;;ADjBX,UEiBX,oBAAA,CFjBW;QAAWhB,EAAAA,MAAAA;QAA+BA,EAAAA,MAAAA;;AAEjDE,cEoBR,cAAA,CFjBZ;EACWA,iBAAAA,MAAAA;EAAwB,iBAAA,MAAA;aAAWA,CAAAA,MAAAA,EEoBzB,oBFpByBA;UAAuCA,OAAAA;EAAwB,gBAAA,CAAA,CAAA,EE0ClF,OF1CkF,CE0C1E,kBF1C0E,EAAA,CAAA;EAEzFE,oBAAAA,CAAAA,aAOpB,EAAA,MAAA,CAAA,EEqCoD,OFrCpD,CEqC4D,uBFrC5D,CAAA;EACWA,uBAAAA,CAAAA,aAAuB,EAAA,MAAA,EAAA,MAAA,EE4CvB,MF5CuB,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EE6C9B,OF7C8B,CAAA,IAAA,CAAA;EAAA,kBAAA,CAAA,aAAA,EAAA,MAAA,EAAA,OAAwE,CAAxE,EAAA;IAAWA,OAAAA,CAAAA,EAAAA,MAAAA;IAAsCA,MAAAA,CAAAA,EEyDzC,MFzDyCA,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA;EAAuB,CAAA,CAAA,EE0DtG,OF1DsG,CE0D9F,kBF1D8F,CAAA;EAE1FE,iBAAAA,CAAAA,aAAkB,EAAA,MAAA,CAAA,EEmEe,OFnEf,CEmEuB,kBFnEvB,CAAA;EAAA,WAAA,CAAA,CAAA,EE0EZ,OF1EY,CAAA;IACxBN,YAAAA,EEyEoC,aFzEpCA,EAAAA;;sBAKOI,CAAAA,CAAAA,EEwEc,OFxEdA,CAAAA;IAENG,QAAAA,CAAAA,EAAAA;MAAM,KAAA,EAAA,MAAA;MASDG,YAAAA,EAAAA,MAAAA;MAgBAC,QAAAA,EAAAA,MAAAA;MAAuB,YAAA,EAAA,MAAA;MAE5BJ,eAAAA,CAAAA,EAAAA,MAAAA,EAAAA;MACMG,SAAAA,EAAAA,OAAAA;MAA4B,WAAA,CAAA,EAAA,MAAA;IAE7BE,CAAAA,EAAAA;IAAa,KAAA,EAAA,MAAA;IAsBVF,YAAAA,EAAAA,MAAAA;IAGGV,QAAAA,EAAAA,MAAAA;IAENF,YAAAA,EAAAA,MAAAA;IAAqB,SAAA,EAAA,MAAA;;;0CEiCU;ID3HpCe,QAAAA,EAAW;MAMNC,KAAAA,EAAAA,MAAAA;MAQAC,WAAc,CAAA,EAAA,MAAA;MAUdC,SAAAA,EAAAA,OAAsB;IAAA,CAAA,EAAA;;yBAASD,CAAAA,KAAAA,EAAAA,MAAAA,CAAAA,EC2GA,OD3GAA,CAAAA;IAAc,QAAA,EAAA;MAI7CE,KAAS,EAAA,MAAA;MAWTC,WAAgB,CAAA,EAAA,MAAA;;;;ECfhB,oBAAA,CAAA,CAAA,EAmHe,OAnHK,CAAA;IAKxB,KAAA,EAAA,MAAc;IAAA,WAAA,EAAA,MAAA;;oBA0BS,CAAA,CAAA,EA2FN,OA3FM,CAAA;IAAR,WAAA,EAAA,MAAA;IAIiC,oBAAA,EAAA,MAAA;IAAR,YAAA,EAAA,MAAA;;kBAShD,CAAA,CAAA,EAsFuB,OAtFvB,CAAA;IAYsC,WAAA,EAAA,MAAA;IAC9B,SAAA,EAAA,MAAA;;sBAW6C,CAAA,CAAA,EAqE1B,OArE0B,CAAA;IAAR,WAAA,EAAA,MAAA;IAOH,WAAA,EAAA,MAAA;IAAxB,aAAA,EAAA,MAAA;;yBAwByB,CAAA,CAAA,EA8Cb,OA9Ca,CAAA;IAQA,WAAA,EAAA,MAAA;IAQhB,YAAA,EAAA,MAAA;IAOF,oBAAA,EAAA,MAAA;IAQF,OAAA,EAAA,MAAA;IAOI,QAAA,EAAA,MAAA;IAQG,OAAA,EAAA,MAAA;IAaF,KAAA,EAAA,MAAA;IAOH,eAAA,EAAA,MAAA,EAAA;;uBAgBC,CAAA,CAAA,EAvBE,OAuBF,CAAA;IAgBZ,WAAA,EAAA,MAAA;IACb,SAAA,EAAA,MAAA;;oBAaqF,CAAA,CAAA,EA9C7D,OA8C6D,CAAA;IAarF,WAAA,EAAA,MAAA;IAgCK,oBAAA,EAAA,MAAA;IAGG,cAAA,EAAA,MAAA;IAAR,QAAA,EAAA,MAAA;;kBAiBA,CAAA,CAAA,EAtGsB,OAsGtB,CAAA;IASK,WAAA,EAAA,MAAA;IAIG,SAAA,EAAA,MAAA;;qBAgBH,CAAA,CAAA,EA5HoB,OA4HpB,CAAA;IAGG,OAAA,EAAA,MAAA;IAAR,QAAA,EAAA,MAAA;IAQK,UAAA,EAAA,MAAA;IAEG,UAAA,EAAA,MAAA;IAAR,iBAAA,EAAA,MAAA;IASK,cAAA,CAAA,EAAA,MAAA;IAGL,aAAA,CAAA,EAAA,MAAA;IAQ8B,UAAA,CAAA,EAAA,MAAA;;EAAD,gBAAA,CAAA,IAAA,EAAA;;;mBA7IhB;MACb;;;;uBAOuB;;;;;;;;;;;QAM8D;;;;;;;;;;;;;MAarF;;;;;;;;;WAgCK;;;MAGL,QAAQ;;;;;;;WAaH;;;;MAIL;;;;;WASK;;;;cAIG;;;MAGR;;;;;WAaK;;;MAGL,QAAQ;;;WAQH;;MAEL,QAAQ;;;WASH;;;MAGL;;sBAQsB,QAAQ"}

package/dist/index.js

@@ -16,25 +16,25 @@ var AgentApiClient = class {
 			headers
 		});
 		if (!res.ok) {
-			const body = await res.text();
-			throw new Error(`Agent API error ${String(res.status)}: ${body}`);
+			await res.text();
+			throw new Error(`Agent API request failed (${String(res.status)})`);
 		}
 		return (await res.json()).data;
 	}
 	async listIntegrations() {
-		return this.request("/agents/integrations");
+		return this.request("/agent/integrations");
 	}
 	async getIntegrationConfig(integrationId) {
-		return this.request(`/agents/integrations/${encodeURIComponent(integrationId)}/config`);
+		return this.request(`/agent/integrations/${encodeURIComponent(integrationId)}/config`);
 	}
 	async updateIntegrationConfig(integrationId, config) {
-		await this.request(`/agents/integrations/${encodeURIComponent(integrationId)}`, {
+		await this.request(`/agent/integrations/${encodeURIComponent(integrationId)}`, {
 			method: "PATCH",
 			body: JSON.stringify({ config })
 		});
 	}
 	async installIntegration(integrationId, options) {
-		return this.request("/agents/integrations", {
+		return this.request("/agent/integrations", {
 			method: "POST",
 			body: JSON.stringify({
 				integrationId,
@@ -44,20 +44,114 @@ var AgentApiClient = class {
 		});
 	}
 	async removeIntegration(integrationId) {
-		return this.request(`/agents/integrations/${encodeURIComponent(integrationId)}`, { method: "DELETE" });
+		return this.request(`/agent/integrations/${encodeURIComponent(integrationId)}`, { method: "DELETE" });
 	}
 	async getRegistry() {
 		return this.request("/integrations/registry");
 	}
 	async getGoogleCredentials() {
-		return this.request("/agents/google/credentials");
+		return this.request("/agent/google/credentials");
+	}
+	async disconnectGoogleAccount(email) {
+		return this.request(`/agent/google/accounts/${encodeURIComponent(email)}`, { method: "DELETE" });
+	}
+	async setDefaultGoogleAccount(email) {
+		return this.request(`/agent/google/accounts/${encodeURIComponent(email)}/default`, { method: "PUT" });
+	}
+	async getGithubCredentials() {
+		return this.request("/agent/github/credentials");
+	}
+	async getXeroCredentials() {
+		return this.request("/agent/xero/credentials");
+	}
+	async refreshXeroToken() {
+		return this.request("/agent/xero/token", { method: "POST" });
+	}
+	async getNotionCredentials() {
+		return this.request("/agent/notion/credentials");
+	}
+	async getAtlassianCredentials() {
+		return this.request("/agent/atlassian/credentials");
+	}
+	async refreshAtlassianToken() {
+		return this.request("/agent/atlassian/token", { method: "POST" });
+	}
+	async getMYOBCredentials() {
+		return this.request("/agent/myob/credentials");
+	}
+	async refreshMYOBToken() {
+		return this.request("/agent/myob/token", { method: "POST" });
+	}
+	async getTeamsCredentials() {
+		return this.request("/agent/microsoft/credentials");
+	}
+	async sendTeamsMessage(data) {
+		return this.request("/agent/microsoft/send", {
+			method: "POST",
+			body: JSON.stringify(data)
+		});
+	}
+	async listTeamsChannels() {
+		return this.request("/agent/microsoft/channels");
+	}
+	async presignAttachments(files) {
+		return this.request("/agent/chat/attachments/presign", {
+			method: "POST",
+			body: JSON.stringify({ files })
+		});
 	}
 	async recordActivity(data) {
-		return this.request("/agents/activity", {
+		return this.request("/agent/activity", {
 			method: "POST",
 			body: JSON.stringify(data)
 		});
 	}
+	/**
+	* Mint a fresh AES-256 data key for a new secret or rotation. The encryption
+	* context is rebuilt server-side from `auth.tenantId` + the body fields; the
+	* agent cannot forge context for a scope it doesn't own.
+	*/
+	async generateSecretDataKey(args) {
+		return this.request("/agent/secrets/generate-data-key", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	/**
+	* Unwrap a wrapped data key so the agent can decrypt the envelope locally.
+	* KMS Decrypt will fail with `InvalidCiphertextException` if the envelope
+	* was tampered with in a way that changes `{ tenantId, scope, scopeId, secretId }`.
+	*/
+	async decryptSecretDataKey(args) {
+		return this.request("/agent/secrets/decrypt-data-key", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	/** Upload a pre-encrypted envelope for a secret. */
+	async putSecretEnvelope(args) {
+		const { scope, scopeId, secretId, ...body } = args;
+		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`, {
+			method: "PUT",
+			body: JSON.stringify(body)
+		});
+	}
+	/** Fetch the encrypted envelope for a single secret. */
+	async getSecretEnvelope(args) {
+		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`);
+	}
+	/** List metadata (never envelopes) for secrets in a scope. */
+	async listSecrets(args) {
+		return (await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`)).secrets;
+	}
+	/** Delete a secret. */
+	async deleteSecret(args) {
+		await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`, { method: "DELETE" });
+	}
+	/** Enumerate scopes (org/team/project/agent) this agent can access. */
+	async listSecretScopes() {
+		return (await this.request("/agent/secrets/scopes")).scopes;
+	}
 };
 //#endregion
 export { AgentApiClient };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @alfe.ai/agent-api-client — Agent self-service API client.\n *\n * Used by agents calling /agents/ endpoints. The agent authenticates\n * with its API key — the backend resolves agentId + tenantId from the token.\n * No agent ID needed in paths or config.\n */\n\nexport type {\n  IntegrationInstall,\n  IntegrationConfigResult,\n  RegistryEntry,\n  IntegrationConfigSchemaField,\n} from \"@alfe/types\";\n\nimport type { IntegrationInstall, IntegrationConfigResult, RegistryEntry } from \"@alfe/types\";\n\nexport interface AgentApiClientConfig {\n  apiKey: string;\n  apiUrl: string;\n}\n\nexport class AgentApiClient {\n  private readonly apiKey: string;\n  private readonly apiUrl: string;\n\n  constructor(config: AgentApiClientConfig) {\n    this.apiKey = config.apiKey;\n    this.apiUrl = config.apiUrl;\n  }\n\n  private async request<T>(path: string, options?: RequestInit): Promise<T> {\n    const url = `${this.apiUrl}${path}`;\n    const headers = new Headers(options?.headers);\n    headers.set(\"Authorization\", `Bearer ${this.apiKey}`);\n    headers.set(\"Content-Type\", \"application/json\");\n\n    const res = await fetch(url, { ...options, headers });\n\n    if (!res.ok) {\n      const body = await res.text();\n      throw new Error(`Agent API error ${String(res.status)}: ${body}`);\n    }\n\n    const body = (await res.json()) as { data: T };\n    return body.data;\n  }\n\n  async listIntegrations(): Promise<IntegrationInstall[]> {\n    return this.request<IntegrationInstall[]>(\"/agents/integrations\");\n  }\n\n  async getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult> {\n    return this.request<IntegrationConfigResult>(\n      `/agents/integrations/${encodeURIComponent(integrationId)}/config`,\n    );\n  }\n\n  async updateIntegrationConfig(\n    integrationId: string,\n    config: Record<string, unknown>,\n  ): Promise<void> {\n    await this.request<unknown>(\n      `/agents/integrations/${encodeURIComponent(integrationId)}`,\n      {\n        method: \"PATCH\",\n        body: JSON.stringify({ config }),\n      },\n    );\n  }\n\n  async installIntegration(\n    integrationId: string,\n    options?: { version?: string; config?: Record<string, unknown> },\n  ): Promise<IntegrationInstall> {\n    return this.request<IntegrationInstall>(\"/agents/integrations\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        integrationId,\n        version: options?.version,\n        config: options?.config,\n      }),\n    });\n  }\n\n  async removeIntegration(integrationId: string): Promise<IntegrationInstall> {\n    return this.request<IntegrationInstall>(\n      `/agents/integrations/${encodeURIComponent(integrationId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n\n  async getRegistry(): Promise<{ integrations: RegistryEntry[] }> {\n    return this.request<{ integrations: RegistryEntry[] }>(\"/integrations/registry\");\n  }\n\n  async getGoogleCredentials(): Promise<{\n    email: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n  }> {\n    return this.request(\"/agents/google/credentials\");\n  }\n\n  async recordActivity(data: {\n    userId?: string;\n    channel: string;\n    role: \"user\" | \"assistant\";\n  }): Promise<{ recorded: boolean }> {\n    return this.request<{ recorded: boolean }>(\"/agents/activity\", {\n      method: \"POST\",\n      body: JSON.stringify(data),\n    });\n  }\n}\n"],"mappings":";AAsBA,IAAa,iBAAb,MAA4B;CAC1B;CACA;CAEA,YAAY,QAA8B;AACxC,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS,OAAO;;CAGvB,MAAc,QAAW,MAAc,SAAmC;EACxE,MAAM,MAAM,GAAG,KAAK,SAAS;EAC7B,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ;AAC7C,UAAQ,IAAI,iBAAiB,UAAU,KAAK,SAAS;AACrD,UAAQ,IAAI,gBAAgB,mBAAmB;EAE/C,MAAM,MAAM,MAAM,MAAM,KAAK;GAAE,GAAG;GAAS;GAAS,CAAC;AAErD,MAAI,CAAC,IAAI,IAAI;GACX,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,SAAM,IAAI,MAAM,mBAAmB,OAAO,IAAI,OAAO,CAAC,IAAI,OAAO;;AAInE,UADc,MAAM,IAAI,MAAM,EAClB;;CAGd,MAAM,mBAAkD;AACtD,SAAO,KAAK,QAA8B,uBAAuB;;CAGnE,MAAM,qBAAqB,eAAyD;AAClF,SAAO,KAAK,QACV,wBAAwB,mBAAmB,cAAc,CAAC,SAC3D;;CAGH,MAAM,wBACJ,eACA,QACe;AACf,QAAM,KAAK,QACT,wBAAwB,mBAAmB,cAAc,IACzD;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC;GACjC,CACF;;CAGH,MAAM,mBACJ,eACA,SAC6B;AAC7B,SAAO,KAAK,QAA4B,wBAAwB;GAC9D,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,SAAS,SAAS;IAClB,QAAQ,SAAS;IAClB,CAAC;GACH,CAAC;;CAGJ,MAAM,kBAAkB,eAAoD;AAC1E,SAAO,KAAK,QACV,wBAAwB,mBAAmB,cAAc,IACzD,EAAE,QAAQ,UAAU,CACrB;;CAGH,MAAM,cAA0D;AAC9D,SAAO,KAAK,QAA2C,yBAAyB;;CAGlF,MAAM,uBAKH;AACD,SAAO,KAAK,QAAQ,6BAA6B;;CAGnD,MAAM,eAAe,MAIc;AACjC,SAAO,KAAK,QAA+B,oBAAoB;GAC7D,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * @alfe.ai/agent-api-client — Agent self-service API client.\n *\n * Used by agents calling /agent/ endpoints. The agent authenticates\n * with its API key — the backend resolves agentId + tenantId from the token.\n * No agent ID needed in paths or config.\n */\n\nexport type {\n  IntegrationInstall,\n  IntegrationConfigResult,\n  RegistryEntry,\n  IntegrationConfigSchemaField,\n  SecretScope,\n  EncryptedEnvelopeV1,\n  SecretMetadata,\n  SecretEnvelopeResponse,\n  ScopeInfo,\n  GeneratedDataKey,\n} from \"@alfe/types\";\n\nimport type {\n  IntegrationInstall,\n  IntegrationConfigResult,\n  RegistryEntry,\n  SecretScope,\n  EncryptedEnvelopeV1,\n  SecretMetadata,\n  SecretEnvelopeResponse,\n  ScopeInfo,\n  GeneratedDataKey,\n} from \"@alfe/types\";\n\nexport interface AgentApiClientConfig {\n  apiKey: string;\n  apiUrl: string;\n}\n\nexport class AgentApiClient {\n  private readonly apiKey: string;\n  private readonly apiUrl: string;\n\n  constructor(config: AgentApiClientConfig) {\n    this.apiKey = config.apiKey;\n    this.apiUrl = config.apiUrl;\n  }\n\n  private async request<T>(path: string, options?: RequestInit): Promise<T> {\n    const url = `${this.apiUrl}${path}`;\n    const headers = new Headers(options?.headers);\n    headers.set(\"Authorization\", `Bearer ${this.apiKey}`);\n    headers.set(\"Content-Type\", \"application/json\");\n\n    const res = await fetch(url, { ...options, headers });\n\n    if (!res.ok) {\n      await res.text(); // drain body\n      throw new Error(`Agent API request failed (${String(res.status)})`);\n    }\n\n    const body = (await res.json()) as { data: T };\n    return body.data;\n  }\n\n  async listIntegrations(): Promise<IntegrationInstall[]> {\n    return this.request<IntegrationInstall[]>(\"/agent/integrations\");\n  }\n\n  async getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult> {\n    return this.request<IntegrationConfigResult>(\n      `/agent/integrations/${encodeURIComponent(integrationId)}/config`,\n    );\n  }\n\n  async updateIntegrationConfig(\n    integrationId: string,\n    config: Record<string, unknown>,\n  ): Promise<void> {\n    await this.request<unknown>(\n      `/agent/integrations/${encodeURIComponent(integrationId)}`,\n      {\n        method: \"PATCH\",\n        body: JSON.stringify({ config }),\n      },\n    );\n  }\n\n  async installIntegration(\n    integrationId: string,\n    options?: { version?: string; config?: Record<string, unknown> },\n  ): Promise<IntegrationInstall> {\n    return this.request<IntegrationInstall>(\"/agent/integrations\", {\n      method: \"POST\",\n      body: JSON.stringify({\n        integrationId,\n        version: options?.version,\n        config: options?.config,\n      }),\n    });\n  }\n\n  async removeIntegration(integrationId: string): Promise<IntegrationInstall> {\n    return this.request<IntegrationInstall>(\n      `/agent/integrations/${encodeURIComponent(integrationId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n\n  async getRegistry(): Promise<{ integrations: RegistryEntry[] }> {\n    return this.request<{ integrations: RegistryEntry[] }>(\"/integrations/registry\");\n  }\n\n  async getGoogleCredentials(): Promise<{\n    accounts?: {\n      email: string;\n      refreshToken: string;\n      clientId: string;\n      clientSecret: string;\n      enabledServices?: string[];\n      isDefault: boolean;\n      displayName?: string;\n    }[];\n    email: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    projectId: string;\n    enabledServices?: string[];\n  }> {\n    return this.request(\"/agent/google/credentials\");\n  }\n\n  async disconnectGoogleAccount(email: string): Promise<{\n    accounts: { email: string; displayName?: string; isDefault: boolean }[];\n  }> {\n    return this.request(`/agent/google/accounts/${encodeURIComponent(email)}`, {\n      method: \"DELETE\",\n    });\n  }\n\n  async setDefaultGoogleAccount(email: string): Promise<{\n    accounts: { email: string; displayName?: string; isDefault: boolean }[];\n  }> {\n    return this.request(`/agent/google/accounts/${encodeURIComponent(email)}/default`, {\n      method: \"PUT\",\n    });\n  }\n\n  async getGithubCredentials(): Promise<{\n    login: string;\n    accessToken: string;\n  }> {\n    return this.request(\"/agent/github/credentials\");\n  }\n\n  async getXeroCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    xeroTenantId: string;\n  }> {\n    return this.request(\"/agent/xero/credentials\");\n  }\n\n  async refreshXeroToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }> {\n    return this.request(\"/agent/xero/token\", { method: \"POST\" });\n  }\n\n  async getNotionCredentials(): Promise<{\n    accessToken: string;\n    workspaceId: string;\n    workspaceName: string;\n  }> {\n    return this.request(\"/agent/notion/credentials\");\n  }\n\n  async getAtlassianCredentials(): Promise<{\n    accessToken: string;\n    refreshToken: string;\n    accessTokenExpiresAt: string;\n    cloudId: string;\n    siteName: string;\n    siteUrl: string;\n    email: string;\n    enabledProducts: string[];\n  }> {\n    return this.request(\"/agent/atlassian/credentials\");\n  }\n\n  async refreshAtlassianToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }> {\n    return this.request(\"/agent/atlassian/token\", { method: \"POST\" });\n  }\n\n  async getMYOBCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    myobBusinessId: string;\n    clientId: string;\n  }> {\n    return this.request(\"/agent/myob/credentials\");\n  }\n\n  async refreshMYOBToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }> {\n    return this.request(\"/agent/myob/token\", { method: \"POST\" });\n  }\n\n  async getTeamsCredentials(): Promise<{\n    agentId: string;\n    tenantId: string;\n    azureAppId: string;\n    azureBotId: string;\n    azureClientSecret: string;\n    botDisplayName?: string;\n    teamsTenantId?: string;\n    serviceUrl?: string;\n  }> {\n    return this.request(\"/agent/microsoft/credentials\");\n  }\n\n  async sendTeamsMessage(data: {\n    conversationId: string;\n    text?: string;\n    adaptiveCard?: Record<string, unknown>;\n  }): Promise<{ ok: boolean; activityId: string }> {\n    return this.request(\"/agent/microsoft/send\", {\n      method: \"POST\",\n      body: JSON.stringify(data),\n    });\n  }\n\n  async listTeamsChannels(): Promise<{\n    channels: { id: string; name: string; description?: string }[];\n  }> {\n    return this.request(\"/agent/microsoft/channels\");\n  }\n\n  async presignAttachments(files: { filename: string; mimeType: string; size: number }[]): Promise<{\n    attachments: { id: string; uploadUrl: string; downloadUrl: string; s3Key: string; expiresAt: string }[];\n  }> {\n    return this.request(\"/agent/chat/attachments/presign\", {\n      method: \"POST\",\n      body: JSON.stringify({ files }),\n    });\n  }\n\n  async recordActivity(data: {\n    userId?: string;\n    channel: string;\n    role: \"user\" | \"assistant\";\n  }): Promise<{ recorded: boolean }> {\n    return this.request<{ recorded: boolean }>(\"/agent/activity\", {\n      method: \"POST\",\n      body: JSON.stringify(data),\n    });\n  }\n\n  // ─── Secrets ──────────────────────────────────────────────────\n  //\n  // Envelope CRUD + KMS proxy for per-scope encrypted secret storage.\n  // Agents never hold a KMS master key — these proxy endpoints mint one-shot\n  // AES-256 data keys bound (via KMS encryption context) to\n  // `{ tenantId, scope, scopeId, secretId }`. The agent performs AES-256-GCM\n  // locally; the backend only ever sees opaque envelopes.\n  //\n  // Routes resolve to the agent API gateway (mapping key `agent`), where\n  // services/secrets registers its routes with pathPrefix `/secrets`. With\n  // `apiUrl` set to the host root (e.g. `https://api.alfe.ai`), the full URL\n  // is `https://api.alfe.ai/agent/secrets/...`. This is the same mapping as\n  // `/agent/integrations/...` etc. — do NOT hit `/secrets/...` on the root\n  // host: that's the user-auth dashboard gateway, which rejects agent tokens.\n  //\n  // `plaintextKey` in responses is base64 — callers MUST decode to a Node\n  // `Buffer` immediately and zero it after use. NEVER keep plaintext keys\n  // as JS strings (strings are immutable and cannot be wiped).\n\n  /**\n   * Mint a fresh AES-256 data key for a new secret or rotation. The encryption\n   * context is rebuilt server-side from `auth.tenantId` + the body fields; the\n   * agent cannot forge context for a scope it doesn't own.\n   */\n  async generateSecretDataKey(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n  }): Promise<GeneratedDataKey> {\n    return this.request<GeneratedDataKey>(\"/agent/secrets/generate-data-key\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  /**\n   * Unwrap a wrapped data key so the agent can decrypt the envelope locally.\n   * KMS Decrypt will fail with `InvalidCiphertextException` if the envelope\n   * was tampered with in a way that changes `{ tenantId, scope, scopeId, secretId }`.\n   */\n  async decryptSecretDataKey(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n    dataKeyCiphertext: string;\n  }): Promise<{ plaintextKey: string }> {\n    return this.request<{ plaintextKey: string }>(\"/agent/secrets/decrypt-data-key\", {\n      method: \"POST\",\n      body: JSON.stringify(args),\n    });\n  }\n\n  /** Upload a pre-encrypted envelope for a secret. */\n  async putSecretEnvelope(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n    secretName: string;\n    envelope: EncryptedEnvelopeV1;\n    description?: string;\n    tags?: string[];\n  }): Promise<{ secretId: string }> {\n    const { scope, scopeId, secretId, ...body } = args;\n    return this.request<{ secretId: string }>(\n      `/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`,\n      {\n        method: \"PUT\",\n        body: JSON.stringify(body),\n      },\n    );\n  }\n\n  /** Fetch the encrypted envelope for a single secret. */\n  async getSecretEnvelope(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n  }): Promise<SecretEnvelopeResponse> {\n    return this.request<SecretEnvelopeResponse>(\n      `/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`,\n    );\n  }\n\n  /** List metadata (never envelopes) for secrets in a scope. */\n  async listSecrets(args: {\n    scope: SecretScope;\n    scopeId: string;\n  }): Promise<SecretMetadata[]> {\n    const resp = await this.request<{ secrets: SecretMetadata[] }>(\n      `/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`,\n    );\n    return resp.secrets;\n  }\n\n  /** Delete a secret. */\n  async deleteSecret(args: {\n    scope: SecretScope;\n    scopeId: string;\n    secretId: string;\n  }): Promise<void> {\n    await this.request<unknown>(\n      `/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`,\n      { method: \"DELETE\" },\n    );\n  }\n\n  /** Enumerate scopes (org/team/project/agent) this agent can access. */\n  async listSecretScopes(): Promise<ScopeInfo[]> {\n    const resp = await this.request<{ scopes: ScopeInfo[] }>(\"/agent/secrets/scopes\");\n    return resp.scopes;\n  }\n}\n"],"mappings":";AAsCA,IAAa,iBAAb,MAA4B;CAC1B;CACA;CAEA,YAAY,QAA8B;AACxC,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS,OAAO;;CAGvB,MAAc,QAAW,MAAc,SAAmC;EACxE,MAAM,MAAM,GAAG,KAAK,SAAS;EAC7B,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ;AAC7C,UAAQ,IAAI,iBAAiB,UAAU,KAAK,SAAS;AACrD,UAAQ,IAAI,gBAAgB,mBAAmB;EAE/C,MAAM,MAAM,MAAM,MAAM,KAAK;GAAE,GAAG;GAAS;GAAS,CAAC;AAErD,MAAI,CAAC,IAAI,IAAI;AACX,SAAM,IAAI,MAAM;AAChB,SAAM,IAAI,MAAM,6BAA6B,OAAO,IAAI,OAAO,CAAC,GAAG;;AAIrE,UADc,MAAM,IAAI,MAAM,EAClB;;CAGd,MAAM,mBAAkD;AACtD,SAAO,KAAK,QAA8B,sBAAsB;;CAGlE,MAAM,qBAAqB,eAAyD;AAClF,SAAO,KAAK,QACV,uBAAuB,mBAAmB,cAAc,CAAC,SAC1D;;CAGH,MAAM,wBACJ,eACA,QACe;AACf,QAAM,KAAK,QACT,uBAAuB,mBAAmB,cAAc,IACxD;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC;GACjC,CACF;;CAGH,MAAM,mBACJ,eACA,SAC6B;AAC7B,SAAO,KAAK,QAA4B,uBAAuB;GAC7D,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA,SAAS,SAAS;IAClB,QAAQ,SAAS;IAClB,CAAC;GACH,CAAC;;CAGJ,MAAM,kBAAkB,eAAoD;AAC1E,SAAO,KAAK,QACV,uBAAuB,mBAAmB,cAAc,IACxD,EAAE,QAAQ,UAAU,CACrB;;CAGH,MAAM,cAA0D;AAC9D,SAAO,KAAK,QAA2C,yBAAyB;;CAGlF,MAAM,uBAgBH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,wBAAwB,OAE3B;AACD,SAAO,KAAK,QAAQ,0BAA0B,mBAAmB,MAAM,IAAI,EACzE,QAAQ,UACT,CAAC;;CAGJ,MAAM,wBAAwB,OAE3B;AACD,SAAO,KAAK,QAAQ,0BAA0B,mBAAmB,MAAM,CAAC,WAAW,EACjF,QAAQ,OACT,CAAC;;CAGJ,MAAM,uBAGH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,qBAIH;AACD,SAAO,KAAK,QAAQ,0BAA0B;;CAGhD,MAAM,mBAGH;AACD,SAAO,KAAK,QAAQ,qBAAqB,EAAE,QAAQ,QAAQ,CAAC;;CAG9D,MAAM,uBAIH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,0BASH;AACD,SAAO,KAAK,QAAQ,+BAA+B;;CAGrD,MAAM,wBAGH;AACD,SAAO,KAAK,QAAQ,0BAA0B,EAAE,QAAQ,QAAQ,CAAC;;CAGnE,MAAM,qBAKH;AACD,SAAO,KAAK,QAAQ,0BAA0B;;CAGhD,MAAM,mBAGH;AACD,SAAO,KAAK,QAAQ,qBAAqB,EAAE,QAAQ,QAAQ,CAAC;;CAG9D,MAAM,sBASH;AACD,SAAO,KAAK,QAAQ,+BAA+B;;CAGrD,MAAM,iBAAiB,MAI0B;AAC/C,SAAO,KAAK,QAAQ,yBAAyB;GAC3C,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;CAGJ,MAAM,oBAEH;AACD,SAAO,KAAK,QAAQ,4BAA4B;;CAGlD,MAAM,mBAAmB,OAEtB;AACD,SAAO,KAAK,QAAQ,mCAAmC;GACrD,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;GAChC,CAAC;;CAGJ,MAAM,eAAe,MAIc;AACjC,SAAO,KAAK,QAA+B,mBAAmB;GAC5D,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;;;;;CA2BJ,MAAM,sBAAsB,MAIE;AAC5B,SAAO,KAAK,QAA0B,oCAAoC;GACxE,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;;;;;CAQJ,MAAM,qBAAqB,MAKW;AACpC,SAAO,KAAK,QAAkC,mCAAmC;GAC/E,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;;;CAIJ,MAAM,kBAAkB,MAQU;EAChC,MAAM,EAAE,OAAO,SAAS,UAAU,GAAG,SAAS;AAC9C,SAAO,KAAK,QACV,kBAAkB,mBAAmB,MAAM,CAAC,GAAG,mBAAmB,QAAQ,CAAC,GAAG,mBAAmB,SAAS,IAC1G;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,KAAK;GAC3B,CACF;;;CAIH,MAAM,kBAAkB,MAIY;AAClC,SAAO,KAAK,QACV,kBAAkB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,CAAC,GAAG,mBAAmB,KAAK,SAAS,GAC1H;;;CAIH,MAAM,YAAY,MAGY;AAI5B,UAHa,MAAM,KAAK,QACtB,kBAAkB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,GACrF,EACW;;;CAId,MAAM,aAAa,MAID;AAChB,QAAM,KAAK,QACT,kBAAkB,mBAAmB,KAAK,MAAM,CAAC,GAAG,mBAAmB,KAAK,QAAQ,CAAC,GAAG,mBAAmB,KAAK,SAAS,IACzH,EAAE,QAAQ,UAAU,CACrB;;;CAIH,MAAM,mBAAyC;AAE7C,UADa,MAAM,KAAK,QAAiC,wBAAwB,EACrE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/agent-api-client",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Agent self-service API client — agents calling /agents/ endpoints",
   "type": "module",
   "main": "./dist/index.js",