@alfe.ai/agent-api-client 0.1.0 → 0.1.2

package/dist/index.d.ts

@@ -130,19 +130,89 @@ interface EncryptedEnvelopeV1 {
   authTag: string;
   dataKeyCiphertext: string;
 }
-/** Opaque metadata about a secret row — never includes plaintext. */
+/**
+ * Display/validation hint for a field's value. `"json"` signals that the
+ * string is a JSON-stringified payload that consumers should `JSON.parse`.
+ */
+declare const FIELD_FORMATS: readonly ["text", "email", "url", "phone", "date", "number", "json"];
+type FieldFormat = (typeof FIELD_FORMATS)[number];
+/**
+ * Whether a field is stored in plaintext (visible to anyone with read access)
+ * or encrypted (requires KMS + the right encryption context to read).
+ */
+declare const FIELD_SENSITIVITIES: readonly ["plaintext", "encrypted"];
+type FieldSensitivity = (typeof FIELD_SENSITIVITIES)[number];
+/**
+ * A field on a secret. `value` is always a string at the wire; for encrypted
+ * fields it's the plaintext at the API edge (the service encrypts before
+ * persistence). Reads from the dashboard omit `value` for encrypted fields;
+ * agents get a `FieldEnvelope` instead and decrypt locally.
+ */
+interface Field {
+  key: string;
+  format?: FieldFormat;
+  sensitivity: FieldSensitivity;
+  value: string;
+}
+/**
+ * Secret category — drives icon/template/filter behaviour. Defaults to
+ * `"other"` for migrated rows.
+ */
+declare const SECRET_CATEGORIES: readonly ["login", "api_key", "database", "ssh_key", "certificate", "secure_note", "credit_card", "identity", "wifi", "other"];
+type SecretCategory = (typeof SECRET_CATEGORIES)[number];
+/**
+ * One field as exposed to readers. Encrypted fields have no `value` on the
+ * dashboard read path; the agent-side aggregate carries `envelope` instead.
+ */
+interface FieldView {
+  key: string;
+  format?: FieldFormat;
+  sensitivity: FieldSensitivity;
+  /** Present for `sensitivity: "plaintext"` only. */
+  value?: string;
+  /** Present for `sensitivity: "encrypted"` on agent-side reads only. */
+  envelope?: EncryptedEnvelopeV1;
+  /** Plaintext fields that opt into `format: "json"` are pre-parsed for callers. */
+  parsedValue?: unknown;
+  rotatedAt?: string;
+  createdAt: string;
+  updatedAt: string;
+}
+/** A secret as assembled from its multi-row aggregate. */
+interface SecretAggregate {
+  secretId: string;
+  secretName: string;
+  description?: string;
+  tags: string[];
+  category: SecretCategory;
+  fields: FieldView[];
+  changelogVersion: number;
+  createdAt: string;
+  updatedAt: string;
+}
+/** Metadata-only projection — used by list endpoints. */
 interface SecretMetadata {
   secretId: string;
   secretName: string;
   description?: string;
-  tags?: string[];
+  tags: string[];
+  category: SecretCategory;
+  fieldKeys: string[];
+  changelogVersion: number;
   createdAt: string;
   updatedAt: string;
-  rotatedAt?: string;
 }
-/** A single secret row including its encrypted envelope. */
-interface SecretEnvelopeResponse extends SecretMetadata {
+/**
+ * Per-field encrypted envelope returned to agents on the agent-side aggregate.
+ * Agents decrypt locally using a data key fetched from `/decrypt-data-key`.
+ */
+interface FieldEnvelope {
+  key: string;
+  format?: FieldFormat;
   envelope: EncryptedEnvelopeV1;
+  rotatedAt?: string;
+  createdAt: string;
+  updatedAt: string;
 }
 /** A scope the caller can read or write secrets in. */
 interface ScopeInfo {
@@ -160,6 +230,30 @@ interface GeneratedDataKey {
   plaintextKey: string;
   dataKeyCiphertext: string;
 }
+/**
+ * Action types recorded in the secret changelog. Append-only.
+ */
+declare const CHANGELOG_ACTIONS: readonly ["created", "deleted", "metadata_updated", "field_added", "field_rotated", "field_removed", "tag_added", "tag_removed"];
+type ChangelogAction = (typeof CHANGELOG_ACTIONS)[number];
+/** Who triggered a changelog entry. */
+interface ChangelogActor {
+  kind: "user" | "agent" | "system";
+  id: string;
+}
+/**
+ * One audit row from the secret's changelog. Metadata only — never carries
+ * field VALUES (old or new). Rolling back a rotated secret is intentionally
+ * not supported.
+ */
+interface ChangelogEntry {
+  changelogVersion: number;
+  action: ChangelogAction;
+  fieldKey?: string;
+  fieldSensitivity?: FieldSensitivity;
+  changedBy: ChangelogActor;
+  reason?: string;
+  timestamp: string;
+}
 //# sourceMappingURL=secrets.d.ts.map
 //#endregion
 //#region src/index.d.ts
@@ -457,52 +551,135 @@ declare class AgentApiClient {
     recorded: boolean;
   }>;
   /**
-   * Mint a fresh AES-256 data key for a new secret or rotation. The encryption
-   * context is rebuilt server-side from `auth.tenantId` + the body fields; the
-   * agent cannot forge context for a scope it doesn't own.
+   * Mint a fresh AES-256 data key for a specific (secret, field) pair. The
+   * encryption context is rebuilt server-side from `auth.tenantId` + the body
+   * fields including `fieldKey`; the agent cannot forge context for a scope
+   * or field it doesn't own. Legacy single-envelope secrets are migrated to
+   * `field#value` rows by the data migration, so call with `fieldKey: "value"`
+   * to reach them.
    */
   generateSecretDataKey(args: {
     scope: SecretScope;
     scopeId: string;
     secretId: string;
+    fieldKey: string;
   }): Promise<GeneratedDataKey>;
   /**
    * Unwrap a wrapped data key so the agent can decrypt the envelope locally.
-   * KMS Decrypt will fail with `InvalidCiphertextException` if the envelope
-   * was tampered with in a way that changes `{ tenantId, scope, scopeId, secretId }`.
+   * `fieldKey` MUST match the value supplied when the data key was generated
+   * (it's bound into KMS encryption context); mismatch fails with
+   * `InvalidCiphertextException`.
    */
   decryptSecretDataKey(args: {
     scope: SecretScope;
     scopeId: string;
     secretId: string;
+    fieldKey: string;
     dataKeyCiphertext: string;
   }): Promise<{
     plaintextKey: string;
   }>;
-  /** Upload a pre-encrypted envelope for a secret. */
-  putSecretEnvelope(args: {
+  /**
+   * Create a new secret with one or more fields. Encrypted fields must arrive
+   * pre-sealed (the agent has already obtained per-field data keys via
+   * `generateSecretDataKey({ ..., fieldKey })` and AES-encrypted locally).
+   * Plaintext fields ship the value inline.
+   */
+  createSecret(args: {
     scope: SecretScope;
     scopeId: string;
     secretId: string;
     secretName: string;
-    envelope: EncryptedEnvelopeV1;
+    category?: SecretCategory;
     description?: string;
     tags?: string[];
+    fields: {
+      key: string;
+      format?: FieldFormat;
+      sensitivity: FieldSensitivity;
+      value?: string;
+      envelope?: EncryptedEnvelopeV1;
+    }[];
+    reason?: string;
+  }): Promise<SecretAggregate>;
+  /** Fetch the secret aggregate plus per-field encrypted envelopes. */
+  getSecret(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
   }): Promise<{
+    aggregate: SecretAggregate;
+    envelopes: FieldEnvelope[];
+  }>;
+  /** Fetch one field. Plaintext: value inline. Encrypted: envelope. */
+  getSecretField(args: {
+    scope: SecretScope;
+    scopeId: string;
     secretId: string;
+    fieldKey: string;
+  }): Promise<{
+    key: string;
+    sensitivity: FieldSensitivity;
+    format?: FieldFormat;
+    value?: string;
+    envelope?: EncryptedEnvelopeV1;
+    rotatedAt?: string;
+    createdAt: string;
+    updatedAt: string;
+  }>;
+  /** Add OR rotate one field. */
+  setSecretField(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+    fieldKey: string;
+    sensitivity: FieldSensitivity;
+    format?: FieldFormat;
+    value?: string;
+    envelope?: EncryptedEnvelopeV1;
+    reason?: string;
+  }): Promise<{
+    fieldKey: string;
+    rotated: boolean;
   }>;
-  /** Fetch the encrypted envelope for a single secret. */
-  getSecretEnvelope(args: {
+  /** Remove one field. */
+  removeSecretField(args: {
     scope: SecretScope;
     scopeId: string;
     secretId: string;
-  }): Promise<SecretEnvelopeResponse>;
-  /** List metadata (never envelopes) for secrets in a scope. */
+    fieldKey: string;
+  }): Promise<void>;
+  /** Update secret-level metadata (name/description/tags/category). */
+  updateSecretMetadata(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+    secretName?: string;
+    description?: string;
+    tags?: string[];
+    category?: SecretCategory;
+    reason?: string;
+  }): Promise<SecretAggregate>;
+  /** List metadata for secrets in a scope. Optional filters route through the byFacet GSI. */
   listSecrets(args: {
     scope: SecretScope;
     scopeId: string;
+    category?: SecretCategory;
+    tag?: string;
+    fieldKey?: string;
   }): Promise<SecretMetadata[]>;
-  /** Delete a secret. */
+  /** Bounded changelog read — metadata-only audit entries. */
+  getSecretHistory(args: {
+    scope: SecretScope;
+    scopeId: string;
+    secretId: string;
+    limit?: number;
+    cursor?: string;
+  }): Promise<{
+    entries: ChangelogEntry[];
+    nextCursor?: string;
+  }>;
+  /** Delete a secret (and all its field rows + tag rows + changelog rows). */
   deleteSecret(args: {
     scope: SecretScope;
     scopeId: string;
@@ -518,9 +695,14 @@ declare class AgentApiClient {
   }): Promise<{
     identityId: string | null;
     status: string;
-    accessAllowed: boolean;
     created?: boolean;
     reason?: string;
+    /**
+     * Flattened auriclabs permission strings for the resolved identity
+     * (scope-prefixed where applicable). Empty array on miss / org service
+     * outage — the runtime gate fails closed in that case.
+     */
+    permissions: string[];
   }>;
   searchIdentities(args?: {
     q?: string;
@@ -653,7 +835,6 @@ declare class AgentApiClient {
   }): Promise<{
     identityId: string | null;
     status: string;
-    accessAllowed: boolean;
   }>;
   memorySearch(query: string, opts?: {
     limit?: number;
@@ -733,6 +914,29 @@ declare class AgentApiClient {
     storageEstimateBytes: number;
     lastIngestionAt?: string;
   }>;
+  memoryLearn(args: {
+    text: string;
+    source?: string;
+    sourceType?: "file" | "url" | "inline";
+    metadata?: {
+      sessionId?: string;
+      channelId?: string;
+      userName?: string;
+    };
+  }): Promise<{
+    memoriesStored: number;
+    triplesStored: number;
+    chunks: number;
+    source?: string;
+  }>;
+  memoryBootstrapStatus(): Promise<{
+    synced: boolean;
+    syncedAt?: string;
+  }>;
+  memoryBootstrapStatusMark(): Promise<{
+    synced: true;
+    syncedAt: string;
+  }>;
   searchWeb(params: {
     query: string;
     count?: number;
@@ -764,5 +968,5 @@ declare class AgentApiClient {
 }
 //# sourceMappingURL=index.d.ts.map
 //#endregion
-export { AgentApiClient, AgentApiClientConfig, type EncryptedEnvelopeV1, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretEnvelopeResponse, type SecretMetadata, type SecretScope, SharedFileEntry, SyncAgentInfo, SyncAgentStats, SyncConfirmedUpload, SyncFileEntry, SyncManifest, SyncManifestEntry, SyncPresignedUrl, SyncReconstructBundle, SyncReconstructFile, SyncSessionContent, SyncSessionEntry };
+export { AgentApiClient, AgentApiClientConfig, type ChangelogAction, type ChangelogActor, type ChangelogEntry, type EncryptedEnvelopeV1, type Field, type FieldEnvelope, type FieldFormat, type FieldSensitivity, type FieldView, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretAggregate, type SecretCategory, type SecretMetadata, type SecretScope, SharedFileEntry, SyncAgentInfo, SyncAgentStats, SyncConfirmedUpload, SyncFileEntry, SyncManifest, SyncManifestEntry, SyncPresignedUrl, SyncReconstructBundle, SyncReconstructFile, SyncSessionContent, SyncSessionEntry };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":["PERMISSION_CATALOG","Record","TENANT_ALLOWED_SUBJECTS","TenantAllowedSubject","ResourceScope","RESOURCE_SCOPES","AccessLevel","ScopedAccess","AllScopedAccess","ResourceScope","DEFAULT_INTEGRATIONS","IntegrationVisibility","INTEGRATION_VISIBILITIES","IntegrationScope","INTEGRATION_SCOPES","IntegrationDesiredStatus","INTEGRATION_DESIRED_STATUSES","IntegrationActualStatus","INTEGRATION_ACTUAL_STATUSES","IntegrationInstall","Record","AgentIntegration","OrgIntegration","IntegrationConfigSchemaField","IntegrationConfigResult","RegistryEntry","ResourceScope","SecretScope","SECRET_SCOPES","EncryptedEnvelopeV1","SecretMetadata","SecretEnvelopeResponse","ScopeInfo","GeneratedDataKey"],"sources":["../../../packages-internal/types/dist/access.d.ts","../../../packages-internal/types/dist/integration.d.ts","../../../packages-internal/types/dist/secrets.d.ts","../src/index.ts"],"sourcesContent":["/**\n * Runtime catalog of declared permission subjects + allowed actions.\n *\n * Mirrors the compile-time `PermissionDefinitions` augmentation in\n * `@alfe/api-core/auriclabs-roles.ts`. Kept here so browser code\n * (dashboard) can consume it without pulling in server-only deps\n * (`@middy/core`, `aws-lambda`, etc.).\n */\nexport declare const PERMISSION_CATALOG: Record<string, readonly string[]>;\n/**\n * Subjects a tenant may grant via a custom role.\n *\n * Excludes `all` (platform-admin escape hatch) and `admin_*` subjects.\n */\nexport declare const TENANT_ALLOWED_SUBJECTS: readonly [\"agent\", \"sync\", \"integration\", \"secret\", \"database\", \"template\", \"org_file\", \"team\", \"project\", \"model_policy\", \"role_management\", \"billing\", \"identity\", \"token\", \"user\", \"gateway\", \"voice\"];\nexport type TenantAllowedSubject = (typeof TENANT_ALLOWED_SUBJECTS)[number];\n/**\n * The four resource scopes at which a permission can apply.\n * Order is meaningful: broader scopes first (`org`) → narrower last (`agent`).\n *\n * `IntegrationScope` in integration.ts and `SecretScope` in secrets.ts are\n * intentional aliases of this same enum — there is only one concept of\n * \"scope\" in Alfe.\n */\nexport declare const ResourceScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type ResourceScope = (typeof ResourceScope)[keyof typeof ResourceScope];\n/** Ordered tuple of resource scope string values (broad → narrow). */\nexport declare const RESOURCE_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\nexport declare const AccessLevel: {\n    readonly None: \"none\";\n    readonly Read: \"read\";\n    readonly Write: \"write\";\n    readonly Manage: \"manage\";\n};\nexport type AccessLevel = (typeof AccessLevel)[keyof typeof AccessLevel];\nexport interface ScopedAccess {\n    scope: ResourceScope;\n    scopeId: string;\n    accessLevel: AccessLevel;\n    /** Resolved role label (e.g. \"org_admin\", \"team_member\") */\n    role: string;\n}\nexport interface AllScopedAccess {\n    orgAccess: ScopedAccess;\n    teamAccess: ScopedAccess[];\n    projectAccess: ScopedAccess[];\n}\n//# sourceMappingURL=access.d.ts.map","import { ResourceScope } from \"./access.js\";\n/** Integrations auto-installed for ALL agents regardless of hosting type. Cannot be removed. */\nexport declare const DEFAULT_INTEGRATIONS: readonly string[];\n/** Controls where an integration appears: public (everyone), hidden (nowhere) */\nexport declare const IntegrationVisibility: {\n    readonly Public: \"public\";\n    readonly Hidden: \"hidden\";\n};\nexport type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];\nexport declare const INTEGRATION_VISIBILITIES: readonly [\"public\" | \"hidden\", ...(\"public\" | \"hidden\")[]];\n/** Scope at which an integration is installed */\nexport declare const IntegrationScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type IntegrationScope = ResourceScope;\nexport declare const INTEGRATION_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\nexport declare const IntegrationDesiredStatus: {\n    readonly Active: \"active\";\n    readonly Removed: \"removed\";\n};\nexport type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];\nexport declare const INTEGRATION_DESIRED_STATUSES: readonly [\"active\" | \"removed\", ...(\"active\" | \"removed\")[]];\nexport declare const IntegrationActualStatus: {\n    readonly Installing: \"installing\";\n    readonly Active: \"active\";\n    readonly Error: \"error\";\n    readonly Removing: \"removing\";\n    readonly Inactive: \"inactive\";\n    readonly Unknown: \"unknown\";\n};\nexport type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];\nexport declare const INTEGRATION_ACTUAL_STATUSES: readonly [\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\", ...(\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\")[]];\nexport interface IntegrationInstall {\n    scope: IntegrationScope;\n    scopeId: string;\n    integrationId: string;\n    tenantId: string;\n    desiredStatus: IntegrationDesiredStatus;\n    actualStatus: IntegrationActualStatus;\n    version: string;\n    config: Record<string, unknown>;\n    errorMessage: string;\n    installedAt: string;\n    updatedAt: string;\n}\n/** @deprecated Use IntegrationInstall instead */\nexport type AgentIntegration = IntegrationInstall;\n/** Org-scoped integration install */\nexport type OrgIntegration = IntegrationInstall;\nexport interface IntegrationConfigSchemaField {\n    key: string;\n    label: string;\n    type: string;\n    description?: string;\n    required?: boolean;\n    default?: string | number | boolean;\n    options?: string[];\n    select_options?: {\n        value: string;\n        label: string;\n    }[];\n    oauth_provider?: string;\n    oauth_scopes?: string[];\n    oauth_integration_id?: string;\n    editable?: string;\n    hidden?: boolean;\n}\nexport interface IntegrationConfigResult {\n    integrationId: string;\n    config: Record<string, unknown>;\n    configSchema: IntegrationConfigSchemaField[];\n}\nexport interface RegistryEntry {\n    id: string;\n    name: string;\n    description: string;\n    versions: string[];\n    latest: string;\n    repository: string;\n    commit: string;\n    icon?: string;\n    author?: {\n        name: string;\n        url?: string;\n    } | string;\n    pricing?: {\n        type: \"free\" | \"paid\" | \"usage\";\n        price?: number;\n        currency?: string;\n        interval?: \"month\" | \"year\";\n        description?: string;\n    };\n    features?: string[];\n    preview_images?: string[];\n    config_schema?: IntegrationConfigSchemaField[];\n    supported_agents?: string[];\n    /** Scopes where this integration can be installed */\n    supported_scopes?: IntegrationScope[];\n    /** Visibility status — controls where integration appears */\n    visibility?: IntegrationVisibility;\n}\n//# sourceMappingURL=integration.d.ts.map","/**\n * Secrets types — shared between services/secrets, @alfe.ai/agent-api-client,\n * the openclaw-secrets plugin, and dashboard clients.\n *\n * Server-side crypto and KMS glue live in @alfe/secret-store (Node/AWS-only);\n * this module is a pure, dependency-free shape contract safe for every\n * environment the agent-api-client ships to.\n */\nimport type { ResourceScope } from \"./access.js\";\n/** Scope levels at which a secret can be owned. Aliased to ResourceScope. */\nexport type SecretScope = ResourceScope;\nexport declare const SECRET_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\n/**\n * v1 encrypted envelope as persisted by services/secrets and exchanged with\n * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext\n * are all base64-encoded.\n */\nexport interface EncryptedEnvelopeV1 {\n    version: 1;\n    iv: string;\n    ciphertext: string;\n    authTag: string;\n    dataKeyCiphertext: string;\n}\n/** Opaque metadata about a secret row — never includes plaintext. */\nexport interface SecretMetadata {\n    secretId: string;\n    secretName: string;\n    description?: string;\n    tags?: string[];\n    createdAt: string;\n    updatedAt: string;\n    rotatedAt?: string;\n}\n/** A single secret row including its encrypted envelope. */\nexport interface SecretEnvelopeResponse extends SecretMetadata {\n    envelope: EncryptedEnvelopeV1;\n}\n/** A scope the caller can read or write secrets in. */\nexport interface ScopeInfo {\n    scope: SecretScope;\n    scopeId: string;\n    name?: string;\n}\n/**\n * KMS-issued data key, returned by the secrets service's\n * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is\n * returned base64-encoded; callers MUST decode it to a Buffer and zero the\n * Buffer after use — never keep the plaintext as a JS string.\n */\nexport interface GeneratedDataKey {\n    plaintextKey: string;\n    dataKeyCiphertext: string;\n}\n//# sourceMappingURL=secrets.d.ts.map"],"mappings":";;ACWA;AAMA;AAEA;AAIA;;;;;AAEqBiB,cDDAb,aCQpB,EAAA;EACWa,SAAAA,GAAAA,EAAAA,KAAAA;EAAuB,SAAA,IAAA,EAAA,MAAA;WAAWA,OAAAA,EAAAA,SAAAA;WAAsCA,KAAAA,EAAAA,OAAAA;CAAuB;AAE1FE,KDLLf,aAAAA,GCKuB,CAAA,ODLCA,aCKD,CAAA,CAAA,MAAA,ODL6BA,aCK7B,CAAA;;;;;ADLCA,cC1BfO,qBD0BeP,EAAAA;WAA4BA,MAAAA,EAAAA,QAAAA;EAAa,SAAA,MAAA,EAAA,QAAA;;KCtBjEO,qBAAAA,WAAgCA,oCAAoCA;AAJhF;AAIYA,cAGSE,gBAHY,EAAA;EAAA,SAAA,GAAA,EAAA,KAAA;WAAWF,IAAAA,EAAAA,MAAAA;WAAoCA,OAAAA,EAAAA,SAAAA;EAAqB,SAAA,KAAA,EAAA,OAAA;AAGrG,CAAA;AAMYE,KAAAA,gBAAAA,GAAmBJ,aAAAA;AAMnBM,cAJSA,wBAIe,EAAA;EAAA,SAAA,MAAA,EAAA,QAAA;WAAWA,OAAAA,EAAAA,SAAAA;;AAA+D,KAAlGA,wBAAAA,GAAkG,CAAA,OAA/DA,wBAA+D,CAAA,CAAA,MAAA,OAAxBA,wBAAwB,CAAA;AAUlGE,cARSA,uBAQc,EAAA;EAAA,SAAA,UAAA,EAAA,YAAA;WAAWA,MAAAA,EAAAA,QAAAA;WAAsCA,KAAAA,EAAAA,OAAAA;EAAuB,SAAA,QAAA,EAAA,UAAA;EAE1FE,SAAAA,QAAAA,EAAAA,UAAkB;EAAA,SAAA,OAAA,EAAA,SAAA;;AAKhBJ,KAPPE,uBAAAA,GAOOF,CAAAA,OAP2BE,uBAO3BF,CAAAA,CAAAA,MAAAA,OAPiEE,uBAOjEF,CAAAA;AAGPK,UARKD,kBAAAA,CAQLC;EAAM,KAAA,EAPPP,gBAOO;EASDU,OAAAA,EAAAA,MAAAA;EAkBAC,aAAAA,EAAAA,MAAAA;EAAuB,QAAA,EAAA,MAAA;eAE5BJ,EAhCOL,wBAgCPK;cACMG,EAhCAN,uBAgCAM;EAA4B,OAAA,EAAA,MAAA;EAE7BE,MAAAA,EAhCLL,MAgCKK,CAAAA,MAAa,EAAA,OAAA,CAAA;EAAA,YAAA,EAAA,MAAA;aAsBVF,EAAAA,MAAAA;WAGGV,EAAAA,MAAAA;;;;AC1FXc,UD0CKJ,4BAAAA,CC1CsB;EAOtBM,GAAAA,EAAAA,MAAAA;EAQAC,KAAAA,EAAAA,MAAAA;EAUAC,IAAAA,EAAAA,MAAAA;EAAsB,WAAA,CAAA,EAAA,MAAA;UACzBF,CAAAA,EAAAA,OAAAA;SADkCC,CAAAA,EAAAA,MAAAA,GAAAA,MAAAA,GAAAA,OAAAA;EAAc,OAAA,CAAA,EAAA,MAAA,EAAA;EAI7CE,cAAS,CAAA,EAAA;IAWTC,KAAAA,EAAAA,MAAAA;;;;ECjBA,YAAA,CAAA,EAAA,MAAA,EAAoB;EAOpB,oBAAa,CAAA,EAAA,MAAA;EAWb,QAAA,CAAA,EAAA,MAAA;EASA,MAAA,CAAA,EAAA,OAAY;;AAIL,UFMPT,uBAAAA,CENO;eAAf,EAAA,MAAA;EAAM,MAAA,EFQHJ,MERG,CAAA,MAAA,EAAA,OAAA,CAAA;EAGE,YAAA,EFMCG,4BENe,EAAA;AAMjC;AAQiB,UFNAE,aAAAA,CEMmB;EAQnB,EAAA,EAAA,MAAA;EASA,IAAA,EAAA,MAAA;EAQA,WAAA,EAAA,MAAa;EASb,QAAA,EAAA,MAAA,EAAA;EAQA,MAAA,EAAA,MAAA;EAMA,UAAA,EAAA,MAAe;EAenB,MAAA,EAAA,MAAA;EAAc,IAAA,CAAA,EAAA,MAAA;QAIL,CAAA,EAAA;IA6BkD,IAAA,EAAA,MAAA;IAAjB,GAAA,CAAA,EAAA,MAAA;MAOpB,MAAA;SAAR,CAAA,EAAA;IAML,IAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA;IAAhB,KAAA,CAAA,EAAA,MAAA;IAYQ,QAAA,CAAA,EAAA,MAAA;IAAR,QAAA,CAAA,EAAA,OAAA,GAAA,MAAA;IASQ,WAAA,CAAA,EAAA,MAAA;;UAOkB,CAAA,EAAA,MAAA,EAAA;gBAAR,CAAA,EAAA,MAAA,EAAA;eAI4C,CAAA,EF7HhDF,4BE6HgD,EAAA;kBAAjB,CAAA,EAAA,MAAA,EAAA;;kBAOvB,CAAA,EFjILV,gBEiIK,EAAA;;YAIe,CAAA,EFnI1BF,qBEmI0B;;;;;;AFrOtBA,KCMTgB,WAAAA,GAAcD,aDHzB;;;;;AAID;AAMYb,UCAKgB,mBAAAA,CDAcpB;EAEVM,OAAAA,EAAAA,CAAAA;EAITA,EAAAA,EAAAA,MAAAA;EAAwB,UAAA,EAAA,MAAA;SAAWA,EAAAA,MAAAA;mBAAuCA,EAAAA,MAAAA;;AAEtF;AAQYE,UCRKa,cAAAA,CDQkB;EAAA,QAAA,EAAA,MAAA;YAAWb,EAAAA,MAAAA;aAAsCA,CAAAA,EAAAA,MAAAA;EAAuB,IAAA,CAAA,EAAA,MAAA,EAAA;EAE1FE,SAAAA,EAAAA,MAAAA;EAAkB,SAAA,EAAA,MAAA;WACxBN,CAAAA,EAAAA,MAAAA;;;AAOCO,UCRKW,sBAAAA,SAA+BD,cDQpCV,CAAAA;EAAM,QAAA,ECPJS,mBDOI;AASlB;AAkBA;AAAwC,UC/BvBG,SAAAA,CD+BuB;OAE5BZ,EChCDO,WDgCCP;SACMG,EAAAA,MAAAA;EAA4B,IAAA,CAAA,EAAA,MAAA;AAE9C;;;;;;;UCzBiBU,gBAAAA;;EAxCLN,iBAAW,EAAA,MAAGD;AAO1B;AAQA;;;UCQiB,oBAAA;EF7BIf,MAAAA,EAAAA,MAAAA;EAITA,MAAAA,EAAAA,MAAAA;;AAAgCA,UEgC3B,aAAA,CFhC2BA;SAAoCA,EAAAA,MAAAA;EAAqB,QAAA,EAAA,MAAA;EAGhFE,WAAAA,EAAAA,MAKpB;EACWA,QAAAA,EAAAA,MAAAA;EAESE,MAAAA,EAAAA,OAAAA,GAAAA,SAGpB,GAAA,QAAA;EACWA,SAAAA,CAAAA,EAAAA,MAAAA;EAAwB,SAAA,CAAA,EAAA,MAAA;UAAWA,CAAAA,EAAAA,MAAAA;;AAA+D,UE4B7F,iBAAA,CF5B6F;EAEzFE,IAAAA,EAAAA,MAAAA;EAQTA,IAAAA,EAAAA,MAAAA;EAAuB,QAAA,EAAA,MAAA;MAAWA,CAAAA,EAAAA,MAAAA;cAAsCA,CAAAA,EAAAA,MAAAA;EAAuB,UAAA,CAAA,EAAA,OAAA;AAE3G;AAAmC,UEyBlB,YAAA,CFzBkB;SACxBJ,EAAAA,CAAAA;SAIQE,EAAAA,MAAAA;UACDE,EAAAA,MAAAA;OAENG,EEqBH,MFrBGA,CAAAA,MAAAA,EEqBY,iBFrBZA,CAAAA;;AASKG,UEeA,gBAAA,CFfAA;EAkBAC,IAAAA,EAAAA,MAAAA;EAAuB,GAAA,EAAA,MAAA;WAE5BJ,EAAAA,MAAAA;;AACkC,UEA7B,mBAAA,CFA6B;EAE7BK,QAAAA,EAAAA,MAAa;EAAA,IAAA,EAAA,MAAA;MAsBVF,EAAAA,MAAAA;cAGGV,EAAAA,UAAAA,GAAAA,YAAAA;UAENF,EAAAA,MAAAA;;UErBA,mBAAA;;;EDvELgB,GAAAA,EAAAA,MAAAA;EAOKE,YAAAA,CAAAA,EAAAA,MAAAA;EAQAC,UAAAA,CAAAA,EAAAA,OAAc;AAU/B;AAAuC,UCsDtB,qBAAA,CDtDsB;SACzBD,EAAAA,MAAAA;MADkCC,EAAAA,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;EAAc,SAAA,EAAA,MAAA;EAI7CE,SAAAA,EAAAA,MAAS;EAWTC,KAAAA,EC4CR,mBD5CwB,EAAA;;;UCgDhB,cAAA;EAjEA,OAAA,EAAA,MAAA;EAOA,aAAA,EAAA,MAAa;EAWb,YAAA,EAAA,MAAiB;EASjB,SAAA,EAAA,MAAY;EAAA,UAAA,EAAA,MAAA,GAAA,IAAA;;AAIpB,UA0CQ,aAAA,CA1CR;EAAM,QAAA,EAAA,MAAA;EAGE,IAAA,EAAA,MAAA;EAMA,QAAA,EAAA,MAAA;EAQA,WAAA,EAAA,MAAA;EAQA,YAAA,CAAA,EAAA,MAAA;EASA,UAAA,CAAA,EAAA,OAAc;AAQ/B;AASiB,UAAA,gBAAA,CAAgB;EAQhB,SAAA,EAAA,MAAA;EAMA,IAAA,EAAA,MAAA;EAeJ,YAAA,EAAA,MAAc;EAAA,YAAA,CAAA,EAAA,MAAA;YAIL,EAAA,OAAA;;AA6BiC,UAtDtC,kBAAA,CAsDsC;WAOpB,EAAA,MAAA;SAAR,EAAA,MAAA;YAML,EAAA,OAAA;;AAYR,UAzEG,eAAA,CAyEH;UAAR,EAAA,MAAA;UASQ,EAAA,MAAA;MAAR,EAAA,MAAA;aAO0B,CAAA,EAAA,MAAA;;AAIoC,cA9EvD,cAAA,CA8EuD;mBAAjB,MAAA;mBAOH,MAAA;aAApB,CAAA,MAAA,EAjFN,oBAiFM;UAIuB,OAAA;cAAR,CAAA,KAAA,EAAA;IAID,WAAA,CAAA,EAAA,MAAA;MA5Da,OA0EhC,CAAA;IAAjB,KAAA,EA1EkE,aA0ElE;;iBAgB8B,CAAA,CAAA,EAnFT,OAmFS,CAnFD,YAmFC,CAAA;aAAR,CAAA,IAAA,EAAA;IAIiC,KAAA,EAAA;MAAR,IAAA,EAAA,MAAA;MAQzC,SAAA,EAAA,KAAA,GAAA,KAAA;MACP,WAAA,CAAA,EAAA,MAAA;IAYsC,CAAA,EAAA;MAtGrC,OAuGO,CAAA;IAAR,IAAA,EAvGiB,gBAuGjB,EAAA;;mBAW6C,CAAA,IAAA,EAAA;IAU7C,QAAA,EAAA,MAAA;IAQyD,IAAA,EAAA,MAAA;IAAzD,IAAA,EAAA,MAAA;IAM0C,YAAA,CAAA,EAAA,UAAA,GAAA,YAAA;MA9HzC,OA8HiB,CA9HT,mBA8HS,CAAA;iBAIS,CAAA,IAAA,EAAA;IAoBgB,IAAA,EAAA,MAAA,GAAA,QAAA,GAAA,QAAA;MA7I1C,OAqJ0C,CArJlC,qBAqJkC,CAAA;cAQZ,CAAA,CAAA,EAtJZ,OAsJY,CAtJJ,cAsJI,CAAA;eAUJ,CAAA,KAAA,EAAA;IAOF,MAAA,CAAA,EAAA,MAAA;MAnKqB,OA2KvB,CAAA;IAOI,KAAA,EAlLoC,aAkLpC,EAAA;;kBAuBC,CAAA,CAAA,EAlML,OAkMK,CAAA;IAOH,QAAA,EAzMkB,gBAyMlB,EAAA;;gBAgBC,CAAA,SAAA,EAAA,MAAA,CAAA,EArNY,OAqNZ,CArNoB,kBAqNpB,CAAA;gBAgBZ,CAAA,QAAA,EAAA,MAAA,CAAA,EAjOuB,OAiOvB,CAAA;IACb,OAAA,EAAA,OAAA;;iBAaqF,CAAA,IAAA,EAAA;IAarF,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAgCK,OAAA,EAAA,MAAA;MA9QL,OAiRQ,CAAA;IAAR,KAAA,EAjRiB,eAiRjB,EAAA;IAaK,UAAA,EAAA,MAAA,GAAA,IAAA;;mBAaA,CAAA,IAAA,EAAA;IAIG,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAGR,OAAA,EAAA,MAAA;IAaK,QAAA,EAAA,MAAA;MArTL,OAwTQ,CAAA;IAAR,WAAA,EAAA,MAAA;IAQK,SAAA,EAAA,MAAA;;kBAEL,CAAA,CAAA,EA5TsB,OA4TtB,CA5T8B,kBA4T9B,EAAA,CAAA;sBASK,CAAA,aAAA,EAAA,MAAA,CAAA,EAjU0C,OAiU1C,CAjUkD,uBAiUlD,CAAA;yBAGL,CAAA,aAAA,EAAA,MAAA,EAAA,MAAA,EA5TM,MA4TN,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EA3TD,OA2TC,CAAA,IAAA,CAAA;oBAQ8B,CAAA,aAAA,EAAA,MAAA,EAAA,QAAA,EAAA;IAAR,OAAA,CAAA,EAAA,MAAA;IAetB,MAAA,CAAA,EAtUqC,MAsUrC,CAAA,MAAA,EAAA,OAAA,CAAA;MArUD,OAsVC,CAtVO,kBAsVP,CAAA;mBAS0C,CAAA,aAAA,EAAA,MAAA,CAAA,EApVE,OAoVF,CApVU,kBAoVV,CAAA;aAS1C,CAAA,QAAA,EAAA,MAAA,EAAA,MAAA,CAAA,EAAA,MAAA,EAAA,CAAA,EAnVD,OAmVC,CAAA;IASA,GAAA,EAAA,MAAA;IAWA,QAAA,EAAA,MAAA;IAWA,SAAA,EAAA,MAAA;;gBAmBA,CAAA,QAAA,EAAA,MAAA,CAAA,EA7XD,OA6XC,CAAA;IAkBA,QAAA,EAAA,MAAA;IAiBA,SAAA,EAAA,OAAA;IA2BD,MAAA,CAAA,EA3byD,MA2bzD,CAAA,MAAA,EAAA,MAAA,CAAA;;aAqCC,CAAA,CAAA,EA1diB,OA0djB,CAAA;IAsBA,YAAA,EAhfyC,aAgfzC,EAAA;;sBAkCwD,CAAA,CAAA,EA9gB9B,OA8gB8B,CAAA;IAWjB,QAAA,CAAA,EAAA;MAOnB,KAAA,EAAA,MAAA;MAOc,YAAA,EAAA,MAAA;MAMjB,QAAA,EAAA,MAAA;MAiBjB,YAAA,EAAA,MAAA;MAUA,eAAA,CAAA,EAAA,MAAA,EAAA;MAWA,SAAA,EAAA,OAAA;MASiC,WAAA,CAAA,EAAA,MAAA;IAcjC,CAAA,EAAA;IAAO,KAAA,EAAA,MAAA;;;;;;;0CAtlBmC;;;;;;;0CAQA;;;;;;;8BAQZ;;;;;;;0BAUJ;;;;wBAOF;;;;;sBAQF;;;;0BAOI;;;;;6BAQG;;;;;;;;;;;;2BAeF;;;;wBAOH;;;;;;sBASF;;;;yBAOG;;;;;;;;;;;;;mBAgBZ;MACb;;;;uBAOuB;;;;;;;;;;;QAM8D;;;;;;;;;;;;;MAarF;;;;;;;;;WAgCK;;;MAGL,QAAQ;;;;;;;WAaH;;;;MAIL;;;;;WASK;;;;cAIG;;;MAGR;;;;;WAaK;;;MAGL,QAAQ;;;WAQH;;MAEL,QAAQ;;;WASH;;;MAGL;;sBAQsB,QAAQ;;;;;;MAe9B;;;;;;;;;;;MAiBA;;;0CAS0C;;;;;;;;;;MAS1C;;;;;;;;;;MASA;;;;;;;;;;;;MAWA;;;;;;;;;;;MAWA;;;;;MASA;;;;;;;;;;MAUA;;;;;;;;;;;;;;;;;;MAkBA;;;;;;;;;;;;;;;;MAiBA;;;;;;;;;;;;;;;;;;MA2BD;;;;;;;;;;;MAeC;;;;;;;;;;;MAsBA;;;;;;;;;;;;;;;;;;;;;;;;MAsBA;;;;;;;;;;;;MAsBA;;;;wDAYwD;;;;uCAWjB;;;;;;;;;;;oBAOnB;;;;;;;;kCAOc;;;iBAMjB;;;;;;;;;;;;MAiBjB;;;;MAUA;;;;;MAWA;iCASiC;;;;;;;;;;;MAcjC"}
+{"version":3,"file":"index.d.ts","names":["PERMISSION_CATALOG","Record","TENANT_ALLOWED_SUBJECTS","TenantAllowedSubject","ResourceScope","RESOURCE_SCOPES","AccessLevel","ScopedAccess","AllScopedAccess","ResourceScope","DEFAULT_INTEGRATIONS","IntegrationVisibility","INTEGRATION_VISIBILITIES","IntegrationScope","INTEGRATION_SCOPES","IntegrationDesiredStatus","INTEGRATION_DESIRED_STATUSES","IntegrationActualStatus","INTEGRATION_ACTUAL_STATUSES","IntegrationInstall","Record","AgentIntegration","OrgIntegration","IntegrationConfigSchemaField","IntegrationConfigResult","RegistryEntry","ResourceScope","SecretScope","SECRET_SCOPES","EncryptedEnvelopeV1","FIELD_FORMATS","FieldFormat","FIELD_SENSITIVITIES","FieldSensitivity","Field","SECRET_CATEGORIES","SecretCategory","FieldView","SecretAggregate","SecretMetadata","FieldEnvelope","ScopeInfo","GeneratedDataKey","CHANGELOG_ACTIONS","ChangelogAction","ChangelogActor","ChangelogEntry"],"sources":["../../../packages-internal/types/dist/access.d.ts","../../../packages-internal/types/dist/integration.d.ts","../../../packages-internal/types/dist/secrets.d.ts","../src/index.ts"],"sourcesContent":["/**\n * Runtime catalog of declared permission subjects + allowed actions.\n *\n * Mirrors the compile-time `PermissionDefinitions` augmentation in\n * `@alfe/api-core/auriclabs-roles.ts`. Kept here so browser code\n * (dashboard) can consume it without pulling in server-only deps\n * (`@middy/core`, `aws-lambda`, etc.).\n */\nexport declare const PERMISSION_CATALOG: Record<string, readonly string[]>;\n/**\n * Subjects a tenant may grant via a custom role.\n *\n * Excludes `all` (platform-admin escape hatch) and `admin_*` subjects.\n */\nexport declare const TENANT_ALLOWED_SUBJECTS: readonly [\"agent\", \"sync\", \"integration\", \"secret\", \"database\", \"template\", \"org_file\", \"team\", \"project\", \"model_policy\", \"role_management\", \"billing\", \"identity\", \"token\", \"user\", \"gateway\", \"voice\"];\nexport type TenantAllowedSubject = (typeof TENANT_ALLOWED_SUBJECTS)[number];\n/**\n * The four resource scopes at which a permission can apply.\n * Order is meaningful: broader scopes first (`org`) → narrower last (`agent`).\n *\n * `IntegrationScope` in integration.ts and `SecretScope` in secrets.ts are\n * intentional aliases of this same enum — there is only one concept of\n * \"scope\" in Alfe.\n */\nexport declare const ResourceScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type ResourceScope = (typeof ResourceScope)[keyof typeof ResourceScope];\n/** Ordered tuple of resource scope string values (broad → narrow). */\nexport declare const RESOURCE_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\nexport declare const AccessLevel: {\n    readonly None: \"none\";\n    readonly Read: \"read\";\n    readonly Write: \"write\";\n    readonly Manage: \"manage\";\n};\nexport type AccessLevel = (typeof AccessLevel)[keyof typeof AccessLevel];\nexport interface ScopedAccess {\n    scope: ResourceScope;\n    scopeId: string;\n    accessLevel: AccessLevel;\n    /** Resolved role label (e.g. \"org_admin\", \"team_member\") */\n    role: string;\n}\nexport interface AllScopedAccess {\n    orgAccess: ScopedAccess;\n    teamAccess: ScopedAccess[];\n    projectAccess: ScopedAccess[];\n}\n//# sourceMappingURL=access.d.ts.map","import { ResourceScope } from \"./access.js\";\n/** Integrations auto-installed for ALL agents regardless of hosting type. Cannot be removed. */\nexport declare const DEFAULT_INTEGRATIONS: readonly string[];\n/** Controls where an integration appears: public (everyone), hidden (nowhere) */\nexport declare const IntegrationVisibility: {\n    readonly Public: \"public\";\n    readonly Hidden: \"hidden\";\n};\nexport type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];\nexport declare const INTEGRATION_VISIBILITIES: readonly [\"public\" | \"hidden\", ...(\"public\" | \"hidden\")[]];\n/** Scope at which an integration is installed */\nexport declare const IntegrationScope: {\n    readonly Org: \"org\";\n    readonly Team: \"team\";\n    readonly Project: \"project\";\n    readonly Agent: \"agent\";\n};\nexport type IntegrationScope = ResourceScope;\nexport declare const INTEGRATION_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\nexport declare const IntegrationDesiredStatus: {\n    readonly Active: \"active\";\n    readonly Removed: \"removed\";\n};\nexport type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];\nexport declare const INTEGRATION_DESIRED_STATUSES: readonly [\"active\" | \"removed\", ...(\"active\" | \"removed\")[]];\nexport declare const IntegrationActualStatus: {\n    readonly Installing: \"installing\";\n    readonly Active: \"active\";\n    readonly Error: \"error\";\n    readonly Removing: \"removing\";\n    readonly Inactive: \"inactive\";\n    readonly Unknown: \"unknown\";\n};\nexport type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];\nexport declare const INTEGRATION_ACTUAL_STATUSES: readonly [\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\", ...(\"active\" | \"error\" | \"installing\" | \"removing\" | \"inactive\" | \"unknown\")[]];\nexport interface IntegrationInstall {\n    scope: IntegrationScope;\n    scopeId: string;\n    integrationId: string;\n    tenantId: string;\n    desiredStatus: IntegrationDesiredStatus;\n    actualStatus: IntegrationActualStatus;\n    version: string;\n    config: Record<string, unknown>;\n    errorMessage: string;\n    installedAt: string;\n    updatedAt: string;\n}\n/** @deprecated Use IntegrationInstall instead */\nexport type AgentIntegration = IntegrationInstall;\n/** Org-scoped integration install */\nexport type OrgIntegration = IntegrationInstall;\nexport interface IntegrationConfigSchemaField {\n    key: string;\n    label: string;\n    type: string;\n    description?: string;\n    required?: boolean;\n    default?: string | number | boolean;\n    options?: string[];\n    select_options?: {\n        value: string;\n        label: string;\n    }[];\n    oauth_provider?: string;\n    oauth_scopes?: string[];\n    oauth_integration_id?: string;\n    editable?: string;\n    hidden?: boolean;\n}\nexport interface IntegrationConfigResult {\n    integrationId: string;\n    config: Record<string, unknown>;\n    configSchema: IntegrationConfigSchemaField[];\n}\nexport interface RegistryEntry {\n    id: string;\n    name: string;\n    description: string;\n    versions: string[];\n    latest: string;\n    repository: string;\n    commit: string;\n    icon?: string;\n    author?: {\n        name: string;\n        url?: string;\n    } | string;\n    pricing?: {\n        type: \"free\" | \"paid\" | \"usage\";\n        price?: number;\n        currency?: string;\n        interval?: \"month\" | \"year\";\n        description?: string;\n    };\n    features?: string[];\n    preview_images?: string[];\n    config_schema?: IntegrationConfigSchemaField[];\n    supported_agents?: string[];\n    /** Scopes where this integration can be installed */\n    supported_scopes?: IntegrationScope[];\n    /** Visibility status — controls where integration appears */\n    visibility?: IntegrationVisibility;\n}\n//# sourceMappingURL=integration.d.ts.map","/**\n * Secrets types — shared between services/secrets, @alfe.ai/agent-api-client,\n * the openclaw-secrets plugin, and dashboard clients.\n *\n * Server-side crypto and KMS glue live in @alfe/secret-store (Node/AWS-only);\n * this module is a pure, dependency-free shape contract safe for every\n * environment the agent-api-client ships to.\n */\nimport type { ResourceScope } from \"./access.js\";\n/** Scope levels at which a secret can be owned. Aliased to ResourceScope. */\nexport type SecretScope = ResourceScope;\nexport declare const SECRET_SCOPES: readonly [\"agent\" | \"team\" | \"project\" | \"org\", ...(\"agent\" | \"team\" | \"project\" | \"org\")[]];\n/**\n * v1 encrypted envelope as persisted by services/secrets and exchanged with\n * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext\n * are all base64-encoded.\n */\nexport interface EncryptedEnvelopeV1 {\n    version: 1;\n    iv: string;\n    ciphertext: string;\n    authTag: string;\n    dataKeyCiphertext: string;\n}\n/**\n * Display/validation hint for a field's value. `\"json\"` signals that the\n * string is a JSON-stringified payload that consumers should `JSON.parse`.\n */\nexport declare const FIELD_FORMATS: readonly [\"text\", \"email\", \"url\", \"phone\", \"date\", \"number\", \"json\"];\nexport type FieldFormat = (typeof FIELD_FORMATS)[number];\n/**\n * Whether a field is stored in plaintext (visible to anyone with read access)\n * or encrypted (requires KMS + the right encryption context to read).\n */\nexport declare const FIELD_SENSITIVITIES: readonly [\"plaintext\", \"encrypted\"];\nexport type FieldSensitivity = (typeof FIELD_SENSITIVITIES)[number];\n/**\n * A field on a secret. `value` is always a string at the wire; for encrypted\n * fields it's the plaintext at the API edge (the service encrypts before\n * persistence). Reads from the dashboard omit `value` for encrypted fields;\n * agents get a `FieldEnvelope` instead and decrypt locally.\n */\nexport interface Field {\n    key: string;\n    format?: FieldFormat;\n    sensitivity: FieldSensitivity;\n    value: string;\n}\n/**\n * Secret category — drives icon/template/filter behaviour. Defaults to\n * `\"other\"` for migrated rows.\n */\nexport declare const SECRET_CATEGORIES: readonly [\"login\", \"api_key\", \"database\", \"ssh_key\", \"certificate\", \"secure_note\", \"credit_card\", \"identity\", \"wifi\", \"other\"];\nexport type SecretCategory = (typeof SECRET_CATEGORIES)[number];\n/**\n * One field as exposed to readers. Encrypted fields have no `value` on the\n * dashboard read path; the agent-side aggregate carries `envelope` instead.\n */\nexport interface FieldView {\n    key: string;\n    format?: FieldFormat;\n    sensitivity: FieldSensitivity;\n    /** Present for `sensitivity: \"plaintext\"` only. */\n    value?: string;\n    /** Present for `sensitivity: \"encrypted\"` on agent-side reads only. */\n    envelope?: EncryptedEnvelopeV1;\n    /** Plaintext fields that opt into `format: \"json\"` are pre-parsed for callers. */\n    parsedValue?: unknown;\n    rotatedAt?: string;\n    createdAt: string;\n    updatedAt: string;\n}\n/** A secret as assembled from its multi-row aggregate. */\nexport interface SecretAggregate {\n    secretId: string;\n    secretName: string;\n    description?: string;\n    tags: string[];\n    category: SecretCategory;\n    fields: FieldView[];\n    changelogVersion: number;\n    createdAt: string;\n    updatedAt: string;\n}\n/** Metadata-only projection — used by list endpoints. */\nexport interface SecretMetadata {\n    secretId: string;\n    secretName: string;\n    description?: string;\n    tags: string[];\n    category: SecretCategory;\n    fieldKeys: string[];\n    changelogVersion: number;\n    createdAt: string;\n    updatedAt: string;\n}\n/**\n * Per-field encrypted envelope returned to agents on the agent-side aggregate.\n * Agents decrypt locally using a data key fetched from `/decrypt-data-key`.\n */\nexport interface FieldEnvelope {\n    key: string;\n    format?: FieldFormat;\n    envelope: EncryptedEnvelopeV1;\n    rotatedAt?: string;\n    createdAt: string;\n    updatedAt: string;\n}\n/** A scope the caller can read or write secrets in. */\nexport interface ScopeInfo {\n    scope: SecretScope;\n    scopeId: string;\n    name?: string;\n}\n/**\n * KMS-issued data key, returned by the secrets service's\n * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is\n * returned base64-encoded; callers MUST decode it to a Buffer and zero the\n * Buffer after use — never keep the plaintext as a JS string.\n */\nexport interface GeneratedDataKey {\n    plaintextKey: string;\n    dataKeyCiphertext: string;\n}\n/**\n * Action types recorded in the secret changelog. Append-only.\n */\nexport declare const CHANGELOG_ACTIONS: readonly [\"created\", \"deleted\", \"metadata_updated\", \"field_added\", \"field_rotated\", \"field_removed\", \"tag_added\", \"tag_removed\"];\nexport type ChangelogAction = (typeof CHANGELOG_ACTIONS)[number];\n/** Who triggered a changelog entry. */\nexport interface ChangelogActor {\n    kind: \"user\" | \"agent\" | \"system\";\n    id: string;\n}\n/**\n * One audit row from the secret's changelog. Metadata only — never carries\n * field VALUES (old or new). Rolling back a rotated secret is intentionally\n * not supported.\n */\nexport interface ChangelogEntry {\n    changelogVersion: number;\n    action: ChangelogAction;\n    fieldKey?: string;\n    fieldSensitivity?: FieldSensitivity;\n    changedBy: ChangelogActor;\n    reason?: string;\n    timestamp: string;\n}\n//# sourceMappingURL=secrets.d.ts.map"],"mappings":";;ACWA;AAMA;AAEA;AAIA;;;;;AAEqBiB,cDDAb,aCQpB,EAAA;EACWa,SAAAA,GAAAA,EAAAA,KAAAA;EAAuB,SAAA,IAAA,EAAA,MAAA;WAAWA,OAAAA,EAAAA,SAAAA;WAAsCA,KAAAA,EAAAA,OAAAA;CAAuB;AAE1FE,KDLLf,aAAAA,GCKuB,CAAA,ODLCA,aCKD,CAAA,CAAA,MAAA,ODL6BA,aCK7B,CAAA;;;;;ADLCA,cC1BfO,qBD0BeP,EAAAA;WAA4BA,MAAAA,EAAAA,QAAAA;EAAa,SAAA,MAAA,EAAA,QAAA;;KCtBjEO,qBAAAA,WAAgCA,oCAAoCA;AAJhF;AAIYA,cAGSE,gBAHY,EAAA;EAAA,SAAA,GAAA,EAAA,KAAA;WAAWF,IAAAA,EAAAA,MAAAA;WAAoCA,OAAAA,EAAAA,SAAAA;EAAqB,SAAA,KAAA,EAAA,OAAA;AAGrG,CAAA;AAMYE,KAAAA,gBAAAA,GAAmBJ,aAAAA;AAMnBM,cAJSA,wBAIe,EAAA;EAAA,SAAA,MAAA,EAAA,QAAA;WAAWA,OAAAA,EAAAA,SAAAA;;AAA+D,KAAlGA,wBAAAA,GAAkG,CAAA,OAA/DA,wBAA+D,CAAA,CAAA,MAAA,OAAxBA,wBAAwB,CAAA;AAUlGE,cARSA,uBAQc,EAAA;EAAA,SAAA,UAAA,EAAA,YAAA;WAAWA,MAAAA,EAAAA,QAAAA;WAAsCA,KAAAA,EAAAA,OAAAA;EAAuB,SAAA,QAAA,EAAA,UAAA;EAE1FE,SAAAA,QAAAA,EAAAA,UAAkB;EAAA,SAAA,OAAA,EAAA,SAAA;;AAKhBJ,KAPPE,uBAAAA,GAOOF,CAAAA,OAP2BE,uBAO3BF,CAAAA,CAAAA,MAAAA,OAPiEE,uBAOjEF,CAAAA;AAGPK,UARKD,kBAAAA,CAQLC;EAAM,KAAA,EAPPP,gBAOO;EASDU,OAAAA,EAAAA,MAAAA;EAkBAC,aAAAA,EAAAA,MAAAA;EAAuB,QAAA,EAAA,MAAA;eAE5BJ,EAhCOL,wBAgCPK;cACMG,EAhCAN,uBAgCAM;EAA4B,OAAA,EAAA,MAAA;EAE7BE,MAAAA,EAhCLL,MAgCKK,CAAAA,MAAa,EAAA,OAAA,CAAA;EAAA,YAAA,EAAA,MAAA;aAsBVF,EAAAA,MAAAA;WAGGV,EAAAA,MAAAA;;;;AC1FXc,UD0CKJ,4BAAAA,CC1CsB;EAOtBM,GAAAA,EAAAA,MAAAA;EAWIC,KAAAA,EAAAA,MAAAA;EACTC,IAAAA,EAAAA,MAAAA;EAKSC,WAAAA,CAAAA,EAAAA,MAAAA;EACTC,QAAAA,CAAAA,EAAAA,OAAAA;EAOKC,OAAAA,CAAK,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA;EAAA,OAAA,CAAA,EAAA,MAAA,EAAA;gBAETH,CAAAA,EAAAA;IACIE,KAAAA,EAAAA,MAAAA;IAAgB,KAAA,EAAA,MAAA;EAOZE,CAAAA,EAAAA;EACTC,cAAAA,CAAAA,EAAc,MAAA;EAKTC,YAAS,CAAA,EAAA,MAAA,EAAA;EAAA,oBAAA,CAAA,EAAA,MAAA;UAEbN,CAAAA,EAAAA,MAAAA;QACIE,CAAAA,EAAAA,OAAAA;;AAIiB,UDKjBT,uBAAAA,CCLiB;EAQjBc,aAAAA,EAAAA,MAAe;EAAA,MAAA,EDDpBlB,MCCoB,CAAA,MAAA,EAAA,OAAA,CAAA;cAKlBgB,EDLIb,4BCKJa,EAAAA;;AACO,UDJJX,aAAAA,CCII;EAMJc,EAAAA,EAAAA,MAAAA;EAeAC,IAAAA,EAAAA,MAAAA;EAAa,WAAA,EAAA,MAAA;UAEjBT,EAAAA,MAAAA,EAAAA;QACCF,EAAAA,MAAAA;EAAmB,UAAA,EAAA,MAAA;EAMhBY,MAAAA,EAAAA,MAAS;EAWTC,IAAAA,CAAAA,EAAAA,MAAAA;EAOIC,MAAAA,CAAAA,EAAAA;IACTC,IAAAA,EAAAA,MAAAA;IAEKC,GAAAA,CAAAA,EAAAA,MAAAA;EASAC,CAAAA,GAAAA,MAAAA;EAAc,OAAA,CAAA,EAAA;IAEnBF,IAAAA,EAAAA,MAAAA,GAAAA,MAAAA,GAAAA,OAAAA;IAEWX,KAAAA,CAAAA,EAAAA,MAAAA;IACRY,QAAAA,CAAAA,EAAAA,MAAAA;IAAc,QAAA,CAAA,EAAA,OAAA,GAAA,MAAA;;;;ECjGZ,cAAA,CAAA,EAAA,MAAoB,EAAA;EAOpB,aAAA,CAAA,EF2CGtB,4BE3CU,EAAA;EAWb,gBAAA,CAAA,EAAA,MAAiB,EAAA;EASjB;EAAY,gBAAA,CAAA,EF0BNV,gBE1BM,EAAA;;YAIpB,CAAA,EFwBQF,qBExBR;;AAGT;;;;AF7EqBA,KCMTgB,WAAAA,GAAcD,aDHzB;;;;;AAID;AAMYb,UCAKgB,mBAAAA,CDAcpB;EAEVM,OAAAA,EAAAA,CAAAA;EAITA,EAAAA,EAAAA,MAAAA;EAAwB,UAAA,EAAA,MAAA;SAAWA,EAAAA,MAAAA;mBAAuCA,EAAAA,MAAAA;;AAEtF;AAQA;;;AAAoFE,cCL/Da,aDK+Db,EAAAA,SAAAA,CAAAA,MAAAA,EAAAA,OAAAA,EAAAA,KAAAA,EAAAA,OAAAA,EAAAA,MAAAA,EAAAA,QAAAA,EAAAA,MAAAA,CAAAA;AAAuB,KCJ/Fc,WAAAA,GDI+F,CAAA,OCJzED,aDIyE,CAAA,CAAA,MAAA,CAAA;AAE3G;;;;AAMkBb,cCPGe,mBDOHf,EAAAA,SAAAA,CAAAA,WAAAA,EAAAA,WAAAA,CAAAA;AAENG,KCRAa,gBAAAA,GDQAb,CAAAA,OCR2BY,mBDQ3BZ,CAAAA,CAAAA,MAAAA,CAAAA;;AASZ;AAkBA;;;;AAG8C,UC/B7Bc,KAAAA,CD+B6B;EAE7BT,GAAAA,EAAAA,MAAAA;EAAa,MAAA,CAAA,EC/BjBM,WD+BiB;aAsBVR,ECpDHU,gBDoDGV;OAGGV,EAAAA,MAAAA;;;;;;AC1FXc,cA0CSQ,iBA1CKT,EAAAA,SAAa,CAAA,OAAA,EAAA,SAAA,EAAA,UAAA,EAAA,SAAA,EAAA,aAAA,EAAA,aAAA,EAAA,aAAA,EAAA,UAAA,EAAA,MAAA,EAAA,OAAA,CAAA;AAOtBG,KAoCLO,cAAAA,GApCwB,CAAA,OAoCCD,iBApCD,CAAA,CAAA,MAAA,CAAA;AAWpC;AACA;AAKA;AACA;AAOiBD,UAgBAG,SAAAA,CAhBK;EAAA,GAAA,EAAA,MAAA;QAETN,CAAAA,EAgBAA,WAhBAA;aACIE,EAgBAA,gBAhBAA;EAAgB;EAOZE,KAAAA,CAAAA,EAAAA,MAAAA;EACTC;EAKKC,QAAAA,CAAAA,EAOFR,mBAPW;EAAA;aAEbE,CAAAA,EAAAA,OAAAA;WACIE,CAAAA,EAAAA,MAAAA;WAIFJ,EAAAA,MAAAA;EAAmB,SAAA,EAAA,MAAA;AAQlC;;AAKcO,UALGE,eAAAA,CAKHF;UACFC,EAAAA,MAAAA;EAAS,UAAA,EAAA,MAAA;EAMJE,WAAAA,CAAAA,EAAAA,MAAc;EAedC,IAAAA,EAAAA,MAAAA,EAAAA;EAAa,QAAA,EAtBhBJ,cAsBgB;QAEjBL,EAvBDM,SAuBCN,EAAAA;kBACCF,EAAAA,MAAAA;EAAmB,SAAA,EAAA,MAAA;EAMhBY,SAAAA,EAAAA,MAAS;AAW1B;AAOA;AACYG,UA3CKL,cAAAA,CA2CU;EAEVM,QAAAA,EAAAA,MAAAA;EASAC,UAAAA,EAAAA,MAAc;EAAA,WAAA,CAAA,EAAA,MAAA;MAEnBF,EAAAA,MAAAA,EAAAA;UAEWX,EArDTG,cAqDSH;WACRY,EAAAA,MAAAA,EAAAA;EAAc,gBAAA,EAAA,MAAA;;;;ACjG7B;AAOA;AAWA;AASA;AAA6B,UD0BZL,aAAAA,CC1BY;KAIL,EAAA,MAAA;QAAf,CAAA,EDwBIT,WCxBJ;EAAM,QAAA,EDyBDF,mBCzBC;EAGE,SAAA,CAAA,EAAA,MAAA;EAMA,SAAA,EAAA,MAAA;EAQA,SAAA,EAAA,MAAA;AAQjB;AASA;AAQiB,UDXAY,SAAAA,CCWa;EASb,KAAA,EDnBNd,WCmBM;EAQA,OAAA,EAAA,MAAA;EAMA,IAAA,CAAA,EAAA,MAAA;AAejB;;;;;;;AA8CsB,UDpFLe,gBAAAA,CCoFK;cAAhB,EAAA,MAAA;mBAYQ,EAAA,MAAA;;;;;AAgBU,cDzGHC,iBCyGG,EAAA,SAAA,CAAA,SAAA,EAAA,SAAA,EAAA,kBAAA,EAAA,aAAA,EAAA,eAAA,EAAA,eAAA,EAAA,WAAA,EAAA,aAAA,CAAA;AAI4C,KD5GxDC,eAAAA,GC4GwD,CAAA,OD5G9BD,iBC4G8B,CAAA,CAAA,MAAA,CAAA;;AAOpB,UDjH/BE,cAAAA,CCiH+B;MAApB,EAAA,MAAA,GAAA,OAAA,GAAA,QAAA;MAIuB,MAAA;;;;;;;AAkCvB,UD9IXC,cAAAA,CC8IW;kBAIiC,EAAA,MAAA;QAAR,EDhJzCF,eCgJyC;UAQzC,CAAA,EAAA,MAAA;kBACP,CAAA,EDvJkBX,gBCuJlB;WAYsC,EDlK5BY,cCkK4B;QAC9B,CAAA,EAAA,MAAA;WAAR,EAAA,MAAA;;;;;UApQY,oBAAA;EF3CIlC,MAAAA,EAAAA,MAAAA;EAITA,MAAAA,EAAAA,MAAAA;;AAAgCA,UE8C3B,aAAA,CF9C2BA;SAAoCA,EAAAA,MAAAA;EAAqB,QAAA,EAAA,MAAA;EAGhFE,WAAAA,EAAAA,MAKpB;EACWA,QAAAA,EAAAA,MAAAA;EAESE,MAAAA,EAAAA,OAAAA,GAAAA,SAGpB,GAAA,QAAA;EACWA,SAAAA,CAAAA,EAAAA,MAAAA;EAAwB,SAAA,CAAA,EAAA,MAAA;UAAWA,CAAAA,EAAAA,MAAAA;;AAA+D,UE0C7F,iBAAA,CF1C6F;EAEzFE,IAAAA,EAAAA,MAAAA;EAQTA,IAAAA,EAAAA,MAAAA;EAAuB,QAAA,EAAA,MAAA;MAAWA,CAAAA,EAAAA,MAAAA;cAAsCA,CAAAA,EAAAA,MAAAA;EAAuB,UAAA,CAAA,EAAA,OAAA;AAE3G;AAAmC,UEuClB,YAAA,CFvCkB;SACxBJ,EAAAA,CAAAA;SAIQE,EAAAA,MAAAA;UACDE,EAAAA,MAAAA;OAENG,EEmCH,MFnCGA,CAAAA,MAAAA,EEmCY,iBFnCZA,CAAAA;;AASKG,UE6BA,gBAAA,CF7BAA;EAkBAC,IAAAA,EAAAA,MAAAA;EAAuB,GAAA,EAAA,MAAA;WAE5BJ,EAAAA,MAAAA;;AACkC,UEc7B,mBAAA,CFd6B;EAE7BK,QAAAA,EAAAA,MAAa;EAAA,IAAA,EAAA,MAAA;MAsBVF,EAAAA,MAAAA;cAGGV,EAAAA,UAAAA,GAAAA,YAAAA;UAENF,EAAAA,MAAAA;;UEPA,mBAAA;;;EDrFLgB,GAAAA,EAAAA,MAAAA;EAOKE,YAAAA,CAAAA,EAAAA,MAAAA;EAWIC,UAAAA,CAAAA,EAAAA,OAAmF;AACxG;AAKqBE,UCqEJ,qBAAA,CDrE4D;EACjEC,OAAAA,EAAAA,MAAAA;EAOKC,IAAAA,EAAAA,MAAK,GAAA,QAAA,GAAA,QAAA;EAAA,SAAA,EAAA,MAAA;WAETH,EAAAA,MAAAA;OACIE,EC+DR,mBD/DQA,EAAAA;EAAgB,SAAA,EAAA,MAAA;AAOjC;AACYG,UC2DK,cAAA,CD3DoBD;EAKpBE,OAAAA,EAAAA,MAAS;EAAA,aAAA,EAAA,MAAA;cAEbN,EAAAA,MAAAA;WACIE,EAAAA,MAAAA;YAIFJ,EAAAA,MAAAA,GAAAA,IAAAA;;AAQES,UC+CA,aAAA,CD/Ce;EAAA,QAAA,EAAA,MAAA;MAKlBF,EAAAA,MAAAA;UACFC,EAAAA,MAAAA;EAAS,WAAA,EAAA,MAAA;EAMJE,YAAAA,CAAAA,EAAAA,MAAc;EAedC,UAAAA,CAAAA,EAAAA,OAAa;;AAEjBT,UC2BI,gBAAA,CD3BJA;WACCF,EAAAA,MAAAA;EAAmB,IAAA,EAAA,MAAA;EAMhBY,YAAS,EAAA,MAAA;EAWTC,YAAAA,CAAAA,EAAAA,MAAgB;EAOZC,UAAAA,EAAAA,OAAAA;AACrB;AAEiBE,UCOA,kBAAA,CDPc;EASdC,SAAAA,EAAAA,MAAc;EAAA,OAAA,EAAA,MAAA;YAEnBF,EAAAA,OAAAA;;AAGGC,UCDE,eAAA,CDCFA;EAAc,QAAA,EAAA,MAAA;;;;ACjG7B;AAOiB,cAwGJ,cAAA,CAxGiB;EAWb,iBAAA,MAAiB;EASjB,iBAAY,MAAA;EAAA,WAAA,CAAA,MAAA,EAwFP,oBAxFO;UAIL,OAAA;cAAf,CAAA,IAGQ,CAHR,EAAA;IAAM,WAAA,CAAA,EAAA,MAAA;EAGE,CAAA,CAAA,EA8GsC,OA9GtC,CAAA;IAMA,KAAA,EAwGuD,aAxGpC;EAQnB,CAAA,CAAA;EAQA,eAAA,CAAA,CAAA,EA+FU,OA/FW,CA+FH,YA1F1B,CAAA;EAIQ,WAAA,CAAA,IAAA,EAAc;IAQd,KAAA,EAAA;MASA,IAAA,EAAA,MAAgB;MAQhB,SAAA,EAAA,KAAkB,GAAA,KAAA;MAMlB,WAAe,CAAA,EAAA,MAAA;IAenB,CAAA,EAAA;EAAc,CAAA,CAAA,EA8CrB,OA9CqB,CAAA;IAIL,IAAA,EA0CA,gBA1CA,EAAA;;mBA6BiC,CAAA,IAAA,EAAA;IAOpB,QAAA,EAAA,MAAA;IAAR,IAAA,EAAA,MAAA;IAML,IAAA,EAAA,MAAA;IAAhB,YAAA,CAAA,EAAA,UAAA,GAAA,YAAA;MAYA,OAAQ,CAAA,mBAAA,CAAA;iBAAR,CAAA,IAAA,EAAA;IASQ,IAAA,EAAA,MAAA,GAAA,QAAA,GAAA,QAAA;MAAR,OAAA,CAAQ,qBAAR,CAAA;cAO0B,CAAA,CAAA,EAAR,OAAQ,CAAA,cAAA,CAAA;eAAR,CAAA,KAAA,EAAA;IAI4C,MAAA,CAAA,EAAA,MAAA;MAAjB,OAAA,CAAA;IAOH,KAAA,EAPoB,aAOpB,EAAA;;kBAIG,CAAA,CAAA,EAJvB,OAIuB,CAAA;IAAR,QAAA,EAJK,gBAIL,EAAA;;gBAkBpB,CAAA,SAAA,EAAA,MAAA,CAAA,EAlBoB,OAkBpB,CAlB4B,kBAkB5B,CAAA;gBAAjB,CAAA,QAAA,EAAA,MAAA,CAAA,EAdoC,OAcpC,CAAA;IAUA,OAAA,EAAA,OAAA;;iBAMsB,CAAA,IAAA,EAAA;IAIiC,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAAR,OAAA,EAAA,MAAA;MApB/C,OA4BM,CAAA;IACP,KAAA,EA7BkB,eA6BlB,EAAA;IAYsC,UAAA,EAAA,MAAA,GAAA,IAAA;;mBACtC,CAAA,IAAA,EAAA;IAWqD,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAAR,OAAA,EAAA,MAAA;IAU7C,QAAA,EAAA,MAAA;MArDC,OA6DwD,CAAA;IAAzD,WAAA,EAAA,MAAA;IAM0C,SAAA,EAAA,MAAA;;kBAIf,CAAA,CAAA,EAjEJ,OAiEI,CAjEI,kBAiEJ,EAAA,CAAA;sBAoBgB,CAAA,aAAA,EAAA,MAAA,CAAA,EAjFK,OAiFL,CAjFa,uBAiFb,CAAA;yBAQA,CAAA,aAAA,EAAA,MAAA,EAAA,MAAA,EAjFpC,MAiFoC,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EAhF3C,OAgF2C,CAAA,IAAA,CAAA;oBAQZ,CAAA,aAAA,EAAA,MAAA,EAAA,QAAA,EAAA;IAUJ,OAAA,CAAA,EAAA,MAAA;IAOF,MAAA,CAAA,EA7Fa,MA6Fb,CAAA,MAAA,EAAA,OAAA,CAAA;MA5FzB,OAoGuB,CApGf,kBAoGe,CAAA;mBAOI,CAAA,aAAA,EAAA,MAAA,CAAA,EAhGkB,OAgGlB,CAhG0B,kBAgG1B,CAAA;aAQG,CAAA,QAAA,EAAA,MAAA,EAAA,MAAA,CAAA,EAAA,MAAA,EAAA,CAAA,EA9F9B,OA8F8B,CAAA;IAeF,GAAA,EAAA,MAAA;IAOH,QAAA,EAAA,MAAA;IASF,SAAA,EAAA,MAAA;;gBAuBT,CAAA,QAAA,EAAA,MAAA,CAAA,EA5Id,OA4Ic,CAAA;IACb,QAAA,EAAA,MAAA;IAOuB,SAAA,EAAA,OAAA;IAM8D,MAAA,CAAA,EA1J7B,MA0J6B,CAAA,MAAA,EAAA,MAAA,CAAA;;aAgDhF,CAAA,CAAA,EApMY,OAoMZ,CAAA;IAIG,YAAA,EAxMiC,aAwMjC,EAAA;;sBAcH,CAAA,CAAA,EAlNqB,OAkNrB,CAAA;IAKL,QAAA,CAAA,EAAA;MAcK,KAAA,EAAA,MAAA;MAII,YAAA,EAAA,MAAA;MAKA,QAAA,EAAA,MAAA;MACI,YAAA,EAAA,MAAA;MAEF,eAAA,CAAA,EAAA,MAAA,EAAA;MAGH,SAAA,EAAA,OAAA;MAAR,WAAA,CAAA,EAAA,MAAA;IAaK,CAAA,EAAA;IAGgB,KAAA,EAAA,MAAA;IAA4B,YAAA,EAAA,MAAA;IAAjD,QAAA,EAAA,MAAA;IAQK,YAAA,EAAA,MAAA;IAMM,SAAA,EAAA,MAAA;IACJ,eAAA,CAAA,EAAA,MAAA,EAAA;;yBAHP,CAAA,KAAA,EAAA,MAAA,CAAA,EA5P0C,OA4P1C,CAAA;IAiBK,QAAA,EAAA;MAIM,KAAA,EAAA,MAAA;MACJ,WAAA,CAAA,EAAA,MAAA;MAEE,SAAA,EAAA,OAAA;IAET,CAAA,EAAA;;yBAcA,CAAA,KAAA,EAAA,MAAA,CAAA,EA5R0C,OA4R1C,CAAA;IASK,QAAA,EAAA;MAMI,KAAA,EAAA,MAAA;MAED,WAAA,CAAA,EAAA,MAAA;MAAR,SAAA,EAAA,OAAA;IAUK,CAAA,EAAA;;0BAKG,CAAA,CAAA,EApTsB,OAoTtB,CAAA;IAAR,KAAA,EAAA,MAAA;IAcK,YAAA,EAAA,MAAA;IAKc,QAAA,EAAA,MAAA;IAAnB,YAAA,EAAA,MAAA;IAYK,WAAA,CAAA,EAAA,MAAA;;sBAWyB,CAAA,CAAA,EApVJ,OAoVI,CAAA;IAAR,KAAA,EAAA,MAAA;IAetB,WAAA,EAAA,MAAA;;oBA+B0C,CAAA,CAAA,EA3XlB,OA2XkB,CAAA;IAS1C,WAAA,EAAA,MAAA;IASA,oBAAA,EAAA,MAAA;IAWA,YAAA,EAAA,MAAA;;kBAoBA,CAAA,CAAA,EApasB,OAoatB,CAAA;IAUA,WAAA,EAAA,MAAA;IAkBA,SAAA,EAAA,MAAA;;sBA4CD,CAAA,CAAA,EAre2B,OAqe3B,CAAA;IAeC,WAAA,EAAA,MAAA;IAqBA,WAAA,EAAA,MAAA;IAsBA,aAAA,EAAA,MAAA;;yBAkCwD,CAAA,CAAA,EAzjB3B,OAyjB2B,CAAA;IAWjB,WAAA,EAAA,MAAA;IAOnB,YAAA,EAAA,MAAA;IAOc,oBAAA,EAAA,MAAA;IAMjB,OAAA,EAAA,MAAA;IAcjB,QAAA,EAAA,MAAA;IAiB2B,OAAA,EAAA,MAAA;IAII,KAAA,EAAA,MAAA;IAY/B,eAAA,EAAA,MAAA,EAAA;IAUA,QAAA,EAAA,MAAA;IAWA,YAAA,EAAA,MAAA;;uBAuBA,CAAA,CAAA,EApqB2B,OAoqB3B,CAAA;IAAO,WAAA,EAAA,MAAA;;;wBA7pBiB;;;;;;sBASF;;;;yBAOG;;;;;;;;;;;;;mBAgBZ;MACb;;;;uBAOuB;;;;;;;;;;;QAM8D;;;;;;;;;;;;;MAarF;;;;;;;;;;;;WAmCK;;;;MAIL,QAAQ;;;;;;;;WAcH;;;;;MAKL;;;;;;;;;;WAcK;;;;eAII;;;;;eAKA;mBACI;;iBAEF;;;MAGX,QAAQ;;;WAaH;;;MAGL;eAAqB;eAA4B;;;;WAQ5C;;;;MAIL;;iBAEW;aACJ;;eAEE;;;;;;;WAYJ;;;;iBAIM;aACJ;;eAEE;;MAET;;;;;;WAUK;;;;MAIL;;;WASK;;;;;;eAMI;;MAET,QAAQ;;;WAUH;;eAEI;;;MAGT,QAAQ;;;WAcH;;;;;MAKL;aAAmB;;;;;WAYd;;;MAGL;;sBAQsB,QAAQ;;;;;;MAe9B;;;;;;;;;;;;;;;;MAsBA;;;0CAS0C;;;;;;;;;;MAS1C;;;;;;;;;;MASA;;;;;;;;;;;;MAWA;;;;;;;;;;;MAWA;;;;;MASA;;;;;;;;;;MAUA;;;;;;;;;;;;;;;;;;MAkBA;;;;;;;;;;;;;;;;MAiBA;;;;;;;;;;;;;;;;;;MA2BD;;;;;;;;;;;MAeC;;;;;;;;;;MAqBA;;;;;;;;;;;;;;;;;;;;;;;;MAsBA;;;;;;;;;;;;MAsBA;;;;wDAYwD;;;;uCAWjB;;;;;;;;;;;oBAOnB;;;;;;;;kCAOc;;;iBAMjB;;;;;;;;;;;;;;;MAcjB;;;;;;2BAiB2B;;;;+BAII;;;;;;;;;;MAY/B;;;;MAUA;;;;;MAWA;iCASiC;;;;;;;;;;;MAcjC"}

package/dist/index.js

@@ -29,55 +29,55 @@ var AgentApiClient = class {
 		return (await res.json()).data;
 	}
 	async syncRegister(args) {
-		return this.request("/agents/sync/register", {
+		return this.request("/agent/sync/register", {
 			method: "POST",
 			body: JSON.stringify(args ?? {})
 		});
 	}
 	async syncGetManifest() {
-		return this.request("/agents/sync/manifest");
+		return this.request("/agent/sync/manifest");
 	}
 	async syncPresign(args) {
-		return this.request("/agents/sync/presign", {
+		return this.request("/agent/sync/presign", {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
 	}
 	async syncConfirmUpload(args) {
-		return this.request("/agents/sync/confirm", {
+		return this.request("/agent/sync/confirm", {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
 	}
 	async syncReconstruct(args) {
-		return this.request("/agents/sync/reconstruct", {
+		return this.request("/agent/sync/reconstruct", {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
 	}
 	async syncGetStats() {
-		return this.request("/agents/sync/stats");
+		return this.request("/agent/sync/stats");
 	}
 	async syncListFiles(args) {
 		const qs = new URLSearchParams();
 		if (args?.prefix) qs.set("prefix", args.prefix);
 		const query = qs.toString();
-		return this.request(`/agents/sync/files${query ? `?${query}` : ""}`);
+		return this.request(`/agent/sync/files${query ? `?${query}` : ""}`);
 	}
 	async syncListSessions() {
-		return this.request("/agents/sync/sessions");
+		return this.request("/agent/sync/sessions");
 	}
 	async syncGetSession(sessionId) {
-		return this.request(`/agents/sync/sessions/${encodeURIComponent(sessionId)}`);
+		return this.request(`/agent/sync/sessions/${encodeURIComponent(sessionId)}`);
 	}
 	async syncDeleteFile(filePath) {
-		return this.request(`/agents/sync/files/${encodeFilePath(filePath)}`, { method: "DELETE" });
+		return this.request(`/agent/sync/files/${encodeFilePath(filePath)}`, { method: "DELETE" });
 	}
 	async sharedListFiles(args) {
-		return this.request(`/agents/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`);
+		return this.request(`/agent/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`);
 	}
 	async sharedDownloadUrl(args) {
-		return this.request(`/agents/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/download/${encodeFilePath(args.filePath)}`);
+		return this.request(`/agent/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/download/${encodeFilePath(args.filePath)}`);
 	}
 	async listIntegrations() {
 		return this.request("/agent/integrations");
@@ -176,9 +176,12 @@ var AgentApiClient = class {
 		});
 	}
 	/**
-	* Mint a fresh AES-256 data key for a new secret or rotation. The encryption
-	* context is rebuilt server-side from `auth.tenantId` + the body fields; the
-	* agent cannot forge context for a scope it doesn't own.
+	* Mint a fresh AES-256 data key for a specific (secret, field) pair. The
+	* encryption context is rebuilt server-side from `auth.tenantId` + the body
+	* fields including `fieldKey`; the agent cannot forge context for a scope
+	* or field it doesn't own. Legacy single-envelope secrets are migrated to
+	* `field#value` rows by the data migration, so call with `fieldKey: "value"`
+	* to reach them.
 	*/
 	async generateSecretDataKey(args) {
 		return this.request("/agent/secrets/generate-data-key", {
@@ -188,8 +191,9 @@ var AgentApiClient = class {
 	}
 	/**
 	* Unwrap a wrapped data key so the agent can decrypt the envelope locally.
-	* KMS Decrypt will fail with `InvalidCiphertextException` if the envelope
-	* was tampered with in a way that changes `{ tenantId, scope, scopeId, secretId }`.
+	* `fieldKey` MUST match the value supplied when the data key was generated
+	* (it's bound into KMS encryption context); mismatch fails with
+	* `InvalidCiphertextException`.
 	*/
 	async decryptSecretDataKey(args) {
 		return this.request("/agent/secrets/decrypt-data-key", {
@@ -197,23 +201,65 @@ var AgentApiClient = class {
 			body: JSON.stringify(args)
 		});
 	}
-	/** Upload a pre-encrypted envelope for a secret. */
-	async putSecretEnvelope(args) {
+	/**
+	* Create a new secret with one or more fields. Encrypted fields must arrive
+	* pre-sealed (the agent has already obtained per-field data keys via
+	* `generateSecretDataKey({ ..., fieldKey })` and AES-encrypted locally).
+	* Plaintext fields ship the value inline.
+	*/
+	async createSecret(args) {
 		const { scope, scopeId, secretId, ...body } = args;
 		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`, {
 			method: "PUT",
 			body: JSON.stringify(body)
 		});
 	}
-	/** Fetch the encrypted envelope for a single secret. */
-	async getSecretEnvelope(args) {
+	/** Fetch the secret aggregate plus per-field encrypted envelopes. */
+	async getSecret(args) {
 		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`);
 	}
-	/** List metadata (never envelopes) for secrets in a scope. */
+	/** Fetch one field. Plaintext: value inline. Encrypted: envelope. */
+	async getSecretField(args) {
+		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/fields/${encodeURIComponent(args.fieldKey)}`);
+	}
+	/** Add OR rotate one field. */
+	async setSecretField(args) {
+		const { scope, scopeId, secretId, fieldKey, ...body } = args;
+		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}/fields/${encodeURIComponent(fieldKey)}`, {
+			method: "PUT",
+			body: JSON.stringify(body)
+		});
+	}
+	/** Remove one field. */
+	async removeSecretField(args) {
+		await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/fields/${encodeURIComponent(args.fieldKey)}`, { method: "DELETE" });
+	}
+	/** Update secret-level metadata (name/description/tags/category). */
+	async updateSecretMetadata(args) {
+		const { scope, scopeId, secretId, ...body } = args;
+		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`, {
+			method: "PATCH",
+			body: JSON.stringify(body)
+		});
+	}
+	/** List metadata for secrets in a scope. Optional filters route through the byFacet GSI. */
 	async listSecrets(args) {
-		return (await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`)).secrets;
+		const params = new URLSearchParams();
+		if (args.category) params.set("category", args.category);
+		if (args.tag) params.set("tag", args.tag);
+		if (args.fieldKey) params.set("fieldKey", args.fieldKey);
+		const qs = params.toString();
+		return (await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}${qs ? `?${qs}` : ""}`)).secrets;
 	}
-	/** Delete a secret. */
+	/** Bounded changelog read — metadata-only audit entries. */
+	async getSecretHistory(args) {
+		const params = new URLSearchParams();
+		if (args.limit) params.set("limit", String(args.limit));
+		if (args.cursor) params.set("cursor", args.cursor);
+		const qs = params.toString();
+		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/history${qs ? `?${qs}` : ""}`);
+	}
+	/** Delete a secret (and all its field rows + tag rows + changelog rows). */
 	async deleteSecret(args) {
 		await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`, { method: "DELETE" });
 	}
@@ -364,6 +410,23 @@ var AgentApiClient = class {
 	async memoryStats() {
 		return this.request("/agent/memory/stats");
 	}
+	async memoryLearn(args) {
+		return this.request("/agent/memory/learn", {
+			method: "POST",
+			body: JSON.stringify({
+				text: args.text,
+				source: args.source,
+				sourceType: args.sourceType ?? "inline",
+				metadata: args.metadata
+			})
+		});
+	}
+	async memoryBootstrapStatus() {
+		return this.request("/agent/memory/bootstrap-status");
+	}
+	async memoryBootstrapStatusMark() {
+		return this.request("/agent/memory/bootstrap-status", { method: "POST" });
+	}
 	async searchWeb(params) {
 		return this.request("/agent/search/web", {
 			method: "POST",