@alfe.ai/agent-api-client 0.1.2 → 0.1.4

package/dist/index.cjs

@@ -116,41 +116,91 @@ var AgentApiClient = class {
 	async getRegistry() {
 		return this.request("/integrations/registry");
 	}
+	/**
+	* Returns every connected Google account for the agent. Multi-account by
+	* design — the openclaw-google plugin requires the LLM to pass `email`
+	* explicitly to `google_run_command` so an account is always selected
+	* deliberately.
+	*
+	* 2026-05-14 (connections-redesign PR 1): the legacy flat shape (`email`,
+	* `refreshToken`, `accessToken`, etc., populated from the default account)
+	* is gone. Iterate over `accounts`.
+	*/
 	async getGoogleCredentials() {
-		return this.request("/agent/google/credentials");
+		return { accounts: (await this.request("/agent/connect/google/accounts")).accounts.map((a) => ({
+			email: a.accountIdentifier,
+			refreshToken: a.refreshToken ?? "",
+			clientId: a.clientId ?? "",
+			clientSecret: a.clientSecret ?? "",
+			displayName: a.displayName ?? void 0,
+			connectedAt: a.connectedAt
+		})) };
 	}
 	async disconnectGoogleAccount(email) {
-		return this.request(`/agent/google/accounts/${encodeURIComponent(email)}`, { method: "DELETE" });
-	}
-	async setDefaultGoogleAccount(email) {
-		return this.request(`/agent/google/accounts/${encodeURIComponent(email)}/default`, { method: "PUT" });
+		return { accounts: (await this.request(`/agent/connect/google/accounts/${encodeURIComponent(email)}`, { method: "DELETE" })).accounts.map((a) => ({
+			email: a.accountIdentifier,
+			displayName: a.displayName ?? void 0,
+			connectedAt: a.connectedAt
+		})) };
 	}
 	async getGoogleChatCredentials() {
 		return this.request("/agent/google-chat/credentials");
 	}
 	async getGithubCredentials() {
-		return this.request("/agent/github/credentials");
+		const raw = await this.request("/agent/connect/github/credentials");
+		return {
+			login: raw.login,
+			accessToken: raw.accessToken
+		};
 	}
 	async getXeroCredentials() {
-		return this.request("/agent/xero/credentials");
+		const raw = await this.request("/agent/connect/xero/credentials");
+		return {
+			accessToken: raw.accessToken,
+			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
+			xeroTenantId: raw.xeroTenantId ?? ""
+		};
 	}
 	async refreshXeroToken() {
-		return this.request("/agent/xero/token", { method: "POST" });
+		return this.request("/agent/connect/xero/refresh", { method: "POST" });
 	}
 	async getNotionCredentials() {
-		return this.request("/agent/notion/credentials");
+		const raw = await this.request("/agent/connect/notion/credentials");
+		return {
+			accessToken: raw.accessToken,
+			workspaceId: raw.workspaceId ?? "",
+			workspaceName: raw.workspaceName ?? ""
+		};
 	}
 	async getAtlassianCredentials() {
-		return this.request("/agent/atlassian/credentials");
+		const raw = await this.request("/agent/connect/atlassian/credentials");
+		return {
+			accessToken: raw.accessToken,
+			refreshToken: "",
+			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
+			cloudId: raw.cloudId ?? "",
+			siteName: raw.siteName ?? "",
+			siteUrl: raw.siteUrl ?? "",
+			email: "",
+			enabledProducts: [],
+			clientId: raw.clientId,
+			clientSecret: raw.clientSecret
+		};
 	}
 	async refreshAtlassianToken() {
-		return this.request("/agent/atlassian/token", { method: "POST" });
+		return this.request("/agent/connect/atlassian/refresh", { method: "POST" });
 	}
 	async getMYOBCredentials() {
-		return this.request("/agent/myob/credentials");
+		const raw = await this.request("/agent/connect/myob/credentials");
+		return {
+			accessToken: raw.accessToken,
+			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
+			myobBusinessId: raw.myobBusinessId,
+			clientId: raw.clientId
+		};
 	}
 	async refreshMYOBToken() {
-		return this.request("/agent/myob/token", { method: "POST" });
+		return this.request("/agent/connect/myob/refresh", { method: "POST" });
 	}
 	async getTeamsCredentials() {
 		return this.request("/agent/microsoft/credentials");
@@ -268,6 +318,18 @@ var AgentApiClient = class {
 	async listSecretScopes() {
 		return (await this.request("/agent/secrets/scopes")).scopes;
 	}
+	/**
+	* Returns the calling agent's own identity context — `{ agentId, tenantId }`
+	* decoded server-side from the agent API token. Used by the
+	* `@alfe.ai/openclaw-identity` plugin to bootstrap context when the
+	* OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.
+	* Plugins should cache this for the daemon's lifetime (single-agent-per-
+	* process invariant). One HTTP round-trip per process activate; not for
+	* per-call use.
+	*/
+	async whoami() {
+		return this.request("/agent/identity/whoami");
+	}
 	async resolveIdentity(args) {
 		return this.request("/agent/identity/resolve", {
 			method: "POST",

package/dist/index.d.cts

@@ -1,262 +1,7 @@
-//#region ../../packages-internal/types/dist/access.d.ts
+import { ChangelogAction, ChangelogActor, ChangelogEntry, ChangelogEntry as ChangelogEntry$1, EncryptedEnvelopeV1, EncryptedEnvelopeV1 as EncryptedEnvelopeV1$1, Field, FieldEnvelope, FieldEnvelope as FieldEnvelope$1, FieldFormat, FieldFormat as FieldFormat$1, FieldSensitivity, FieldSensitivity as FieldSensitivity$1, FieldView, GeneratedDataKey, GeneratedDataKey as GeneratedDataKey$1, IntegrationConfigResult, IntegrationConfigResult as IntegrationConfigResult$1, IntegrationConfigSchemaField, IntegrationInstall, IntegrationInstall as IntegrationInstall$1, RegistryEntry, RegistryEntry as RegistryEntry$1, ScopeInfo, ScopeInfo as ScopeInfo$1, SecretAggregate, SecretAggregate as SecretAggregate$1, SecretCategory, SecretCategory as SecretCategory$1, SecretMetadata, SecretMetadata as SecretMetadata$1, SecretScope, SecretScope as SecretScope$1 } from "@alfe/types";
 
-/**
- * The four resource scopes at which a permission can apply.
- * Order is meaningful: broader scopes first (`org`) → narrower last (`agent`).
- *
- * `IntegrationScope` in integration.ts and `SecretScope` in secrets.ts are
- * intentional aliases of this same enum — there is only one concept of
- * "scope" in Alfe.
- */
-declare const ResourceScope: {
-  readonly Org: "org";
-  readonly Team: "team";
-  readonly Project: "project";
-  readonly Agent: "agent";
-};
-type ResourceScope = (typeof ResourceScope)[keyof typeof ResourceScope];
-/** Ordered tuple of resource scope string values (broad → narrow). */
-//#endregion
-//#region ../../packages-internal/types/dist/integration.d.ts
-/** Controls where an integration appears: public (everyone), hidden (nowhere) */
-declare const IntegrationVisibility: {
-  readonly Public: "public";
-  readonly Hidden: "hidden";
-};
-type IntegrationVisibility = (typeof IntegrationVisibility)[keyof typeof IntegrationVisibility];
-/** Scope at which an integration is installed */
-declare const IntegrationScope: {
-  readonly Org: "org";
-  readonly Team: "team";
-  readonly Project: "project";
-  readonly Agent: "agent";
-};
-type IntegrationScope = ResourceScope;
-declare const IntegrationDesiredStatus: {
-  readonly Active: "active";
-  readonly Removed: "removed";
-};
-type IntegrationDesiredStatus = (typeof IntegrationDesiredStatus)[keyof typeof IntegrationDesiredStatus];
-declare const IntegrationActualStatus: {
-  readonly Installing: "installing";
-  readonly Active: "active";
-  readonly Error: "error";
-  readonly Removing: "removing";
-  readonly Inactive: "inactive";
-  readonly Unknown: "unknown";
-};
-type IntegrationActualStatus = (typeof IntegrationActualStatus)[keyof typeof IntegrationActualStatus];
-interface IntegrationInstall {
-  scope: IntegrationScope;
-  scopeId: string;
-  integrationId: string;
-  tenantId: string;
-  desiredStatus: IntegrationDesiredStatus;
-  actualStatus: IntegrationActualStatus;
-  version: string;
-  config: Record<string, unknown>;
-  errorMessage: string;
-  installedAt: string;
-  updatedAt: string;
-}
-/** @deprecated Use IntegrationInstall instead */
-
-interface IntegrationConfigSchemaField {
-  key: string;
-  label: string;
-  type: string;
-  description?: string;
-  required?: boolean;
-  default?: string | number | boolean;
-  options?: string[];
-  select_options?: {
-    value: string;
-    label: string;
-  }[];
-  oauth_provider?: string;
-  oauth_scopes?: string[];
-  oauth_integration_id?: string;
-  editable?: string;
-  hidden?: boolean;
-}
-interface IntegrationConfigResult {
-  integrationId: string;
-  config: Record<string, unknown>;
-  configSchema: IntegrationConfigSchemaField[];
-}
-interface RegistryEntry {
-  id: string;
-  name: string;
-  description: string;
-  versions: string[];
-  latest: string;
-  repository: string;
-  commit: string;
-  icon?: string;
-  author?: {
-    name: string;
-    url?: string;
-  } | string;
-  pricing?: {
-    type: "free" | "paid" | "usage";
-    price?: number;
-    currency?: string;
-    interval?: "month" | "year";
-    description?: string;
-  };
-  features?: string[];
-  preview_images?: string[];
-  config_schema?: IntegrationConfigSchemaField[];
-  supported_agents?: string[];
-  /** Scopes where this integration can be installed */
-  supported_scopes?: IntegrationScope[];
-  /** Visibility status — controls where integration appears */
-  visibility?: IntegrationVisibility;
-}
-//# sourceMappingURL=integration.d.ts.map
-//#endregion
-//#region ../../packages-internal/types/dist/secrets.d.ts
-/** Scope levels at which a secret can be owned. Aliased to ResourceScope. */
-type SecretScope = ResourceScope;
-/**
- * v1 encrypted envelope as persisted by services/secrets and exchanged with
- * agents. Values are AES-256-GCM ciphertext; iv/authTag/ciphertext/dataKeyCiphertext
- * are all base64-encoded.
- */
-interface EncryptedEnvelopeV1 {
-  version: 1;
-  iv: string;
-  ciphertext: string;
-  authTag: string;
-  dataKeyCiphertext: string;
-}
-/**
- * Display/validation hint for a field's value. `"json"` signals that the
- * string is a JSON-stringified payload that consumers should `JSON.parse`.
- */
-declare const FIELD_FORMATS: readonly ["text", "email", "url", "phone", "date", "number", "json"];
-type FieldFormat = (typeof FIELD_FORMATS)[number];
-/**
- * Whether a field is stored in plaintext (visible to anyone with read access)
- * or encrypted (requires KMS + the right encryption context to read).
- */
-declare const FIELD_SENSITIVITIES: readonly ["plaintext", "encrypted"];
-type FieldSensitivity = (typeof FIELD_SENSITIVITIES)[number];
-/**
- * A field on a secret. `value` is always a string at the wire; for encrypted
- * fields it's the plaintext at the API edge (the service encrypts before
- * persistence). Reads from the dashboard omit `value` for encrypted fields;
- * agents get a `FieldEnvelope` instead and decrypt locally.
- */
-interface Field {
-  key: string;
-  format?: FieldFormat;
-  sensitivity: FieldSensitivity;
-  value: string;
-}
-/**
- * Secret category — drives icon/template/filter behaviour. Defaults to
- * `"other"` for migrated rows.
- */
-declare const SECRET_CATEGORIES: readonly ["login", "api_key", "database", "ssh_key", "certificate", "secure_note", "credit_card", "identity", "wifi", "other"];
-type SecretCategory = (typeof SECRET_CATEGORIES)[number];
-/**
- * One field as exposed to readers. Encrypted fields have no `value` on the
- * dashboard read path; the agent-side aggregate carries `envelope` instead.
- */
-interface FieldView {
-  key: string;
-  format?: FieldFormat;
-  sensitivity: FieldSensitivity;
-  /** Present for `sensitivity: "plaintext"` only. */
-  value?: string;
-  /** Present for `sensitivity: "encrypted"` on agent-side reads only. */
-  envelope?: EncryptedEnvelopeV1;
-  /** Plaintext fields that opt into `format: "json"` are pre-parsed for callers. */
-  parsedValue?: unknown;
-  rotatedAt?: string;
-  createdAt: string;
-  updatedAt: string;
-}
-/** A secret as assembled from its multi-row aggregate. */
-interface SecretAggregate {
-  secretId: string;
-  secretName: string;
-  description?: string;
-  tags: string[];
-  category: SecretCategory;
-  fields: FieldView[];
-  changelogVersion: number;
-  createdAt: string;
-  updatedAt: string;
-}
-/** Metadata-only projection — used by list endpoints. */
-interface SecretMetadata {
-  secretId: string;
-  secretName: string;
-  description?: string;
-  tags: string[];
-  category: SecretCategory;
-  fieldKeys: string[];
-  changelogVersion: number;
-  createdAt: string;
-  updatedAt: string;
-}
-/**
- * Per-field encrypted envelope returned to agents on the agent-side aggregate.
- * Agents decrypt locally using a data key fetched from `/decrypt-data-key`.
- */
-interface FieldEnvelope {
-  key: string;
-  format?: FieldFormat;
-  envelope: EncryptedEnvelopeV1;
-  rotatedAt?: string;
-  createdAt: string;
-  updatedAt: string;
-}
-/** A scope the caller can read or write secrets in. */
-interface ScopeInfo {
-  scope: SecretScope;
-  scopeId: string;
-  name?: string;
-}
-/**
- * KMS-issued data key, returned by the secrets service's
- * `/secrets/generate-data-key` KMS proxy endpoint. The plaintext key is
- * returned base64-encoded; callers MUST decode it to a Buffer and zero the
- * Buffer after use — never keep the plaintext as a JS string.
- */
-interface GeneratedDataKey {
-  plaintextKey: string;
-  dataKeyCiphertext: string;
-}
-/**
- * Action types recorded in the secret changelog. Append-only.
- */
-declare const CHANGELOG_ACTIONS: readonly ["created", "deleted", "metadata_updated", "field_added", "field_rotated", "field_removed", "tag_added", "tag_removed"];
-type ChangelogAction = (typeof CHANGELOG_ACTIONS)[number];
-/** Who triggered a changelog entry. */
-interface ChangelogActor {
-  kind: "user" | "agent" | "system";
-  id: string;
-}
-/**
- * One audit row from the secret's changelog. Metadata only — never carries
- * field VALUES (old or new). Rolling back a rotated secret is intentionally
- * not supported.
- */
-interface ChangelogEntry {
-  changelogVersion: number;
-  action: ChangelogAction;
-  fieldKey?: string;
-  fieldSensitivity?: FieldSensitivity;
-  changedBy: ChangelogActor;
-  reason?: string;
-  timestamp: string;
-}
-//# sourceMappingURL=secrets.d.ts.map
-//#endregion
 //#region src/index.d.ts
+
 interface AgentApiClientConfig {
   apiKey: string;
   apiUrl: string;
@@ -402,14 +147,14 @@ declare class AgentApiClient {
     downloadUrl: string;
     expiresIn: number;
   }>;
-  listIntegrations(): Promise<IntegrationInstall[]>;
-  getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult>;
+  listIntegrations(): Promise<IntegrationInstall$1[]>;
+  getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult$1>;
   updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;
   installIntegration(integrationId: string, options?: {
     version?: string;
     config?: Record<string, unknown>;
-  }): Promise<IntegrationInstall>;
-  removeIntegration(integrationId: string): Promise<IntegrationInstall>;
+  }): Promise<IntegrationInstall$1>;
+  removeIntegration(integrationId: string): Promise<IntegrationInstall$1>;
   getOAuthUrl(provider: string, scopes?: string[]): Promise<{
     url: string;
     provider: string;
@@ -421,37 +166,33 @@ declare class AgentApiClient {
     config?: Record<string, string>;
   }>;
   getRegistry(): Promise<{
-    integrations: RegistryEntry[];
+    integrations: RegistryEntry$1[];
   }>;
+  /**
+   * Returns every connected Google account for the agent. Multi-account by
+   * design — the openclaw-google plugin requires the LLM to pass `email`
+   * explicitly to `google_run_command` so an account is always selected
+   * deliberately.
+   *
+   * 2026-05-14 (connections-redesign PR 1): the legacy flat shape (`email`,
+   * `refreshToken`, `accessToken`, etc., populated from the default account)
+   * is gone. Iterate over `accounts`.
+   */
   getGoogleCredentials(): Promise<{
-    accounts?: {
+    accounts: {
       email: string;
       refreshToken: string;
       clientId: string;
       clientSecret: string;
-      enabledServices?: string[];
-      isDefault: boolean;
       displayName?: string;
+      connectedAt?: string;
     }[];
-    email: string;
-    refreshToken: string;
-    clientId: string;
-    clientSecret: string;
-    projectId: string;
-    enabledServices?: string[];
   }>;
   disconnectGoogleAccount(email: string): Promise<{
     accounts: {
       email: string;
       displayName?: string;
-      isDefault: boolean;
-    }[];
-  }>;
-  setDefaultGoogleAccount(email: string): Promise<{
-    accounts: {
-      email: string;
-      displayName?: string;
-      isDefault: boolean;
+      connectedAt?: string;
     }[];
   }>;
   getGoogleChatCredentials(): Promise<{
@@ -559,11 +300,11 @@ declare class AgentApiClient {
    * to reach them.
    */
   generateSecretDataKey(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
     secretId: string;
     fieldKey: string;
-  }): Promise<GeneratedDataKey>;
+  }): Promise<GeneratedDataKey$1>;
   /**
    * Unwrap a wrapped data key so the agent can decrypt the envelope locally.
    * `fieldKey` MUST match the value supplied when the data key was generated
@@ -571,7 +312,7 @@ declare class AgentApiClient {
    * `InvalidCiphertextException`.
    */
   decryptSecretDataKey(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
     secretId: string;
     fieldKey: string;
@@ -586,57 +327,57 @@ declare class AgentApiClient {
    * Plaintext fields ship the value inline.
    */
   createSecret(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
     secretId: string;
     secretName: string;
-    category?: SecretCategory;
+    category?: SecretCategory$1;
     description?: string;
     tags?: string[];
     fields: {
       key: string;
-      format?: FieldFormat;
-      sensitivity: FieldSensitivity;
+      format?: FieldFormat$1;
+      sensitivity: FieldSensitivity$1;
       value?: string;
-      envelope?: EncryptedEnvelopeV1;
+      envelope?: EncryptedEnvelopeV1$1;
     }[];
     reason?: string;
-  }): Promise<SecretAggregate>;
+  }): Promise<SecretAggregate$1>;
   /** Fetch the secret aggregate plus per-field encrypted envelopes. */
   getSecret(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
     secretId: string;
   }): Promise<{
-    aggregate: SecretAggregate;
-    envelopes: FieldEnvelope[];
+    aggregate: SecretAggregate$1;
+    envelopes: FieldEnvelope$1[];
   }>;
   /** Fetch one field. Plaintext: value inline. Encrypted: envelope. */
   getSecretField(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
     secretId: string;
     fieldKey: string;
   }): Promise<{
     key: string;
-    sensitivity: FieldSensitivity;
-    format?: FieldFormat;
+    sensitivity: FieldSensitivity$1;
+    format?: FieldFormat$1;
     value?: string;
-    envelope?: EncryptedEnvelopeV1;
+    envelope?: EncryptedEnvelopeV1$1;
     rotatedAt?: string;
     createdAt: string;
     updatedAt: string;
   }>;
   /** Add OR rotate one field. */
   setSecretField(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
     secretId: string;
     fieldKey: string;
-    sensitivity: FieldSensitivity;
-    format?: FieldFormat;
+    sensitivity: FieldSensitivity$1;
+    format?: FieldFormat$1;
     value?: string;
-    envelope?: EncryptedEnvelopeV1;
+    envelope?: EncryptedEnvelopeV1$1;
     reason?: string;
   }): Promise<{
     fieldKey: string;
@@ -644,49 +385,62 @@ declare class AgentApiClient {
   }>;
   /** Remove one field. */
   removeSecretField(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
     secretId: string;
     fieldKey: string;
   }): Promise<void>;
   /** Update secret-level metadata (name/description/tags/category). */
   updateSecretMetadata(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
     secretId: string;
     secretName?: string;
     description?: string;
     tags?: string[];
-    category?: SecretCategory;
+    category?: SecretCategory$1;
     reason?: string;
-  }): Promise<SecretAggregate>;
+  }): Promise<SecretAggregate$1>;
   /** List metadata for secrets in a scope. Optional filters route through the byFacet GSI. */
   listSecrets(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
-    category?: SecretCategory;
+    category?: SecretCategory$1;
     tag?: string;
     fieldKey?: string;
-  }): Promise<SecretMetadata[]>;
+  }): Promise<SecretMetadata$1[]>;
   /** Bounded changelog read — metadata-only audit entries. */
   getSecretHistory(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
     secretId: string;
     limit?: number;
     cursor?: string;
   }): Promise<{
-    entries: ChangelogEntry[];
+    entries: ChangelogEntry$1[];
     nextCursor?: string;
   }>;
   /** Delete a secret (and all its field rows + tag rows + changelog rows). */
   deleteSecret(args: {
-    scope: SecretScope;
+    scope: SecretScope$1;
     scopeId: string;
     secretId: string;
   }): Promise<void>;
   /** Enumerate scopes (org/team/project/agent) this agent can access. */
-  listSecretScopes(): Promise<ScopeInfo[]>;
+  listSecretScopes(): Promise<ScopeInfo$1[]>;
+  /**
+   * Returns the calling agent's own identity context — `{ agentId, tenantId }`
+   * decoded server-side from the agent API token. Used by the
+   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the
+   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.
+   * Plugins should cache this for the daemon's lifetime (single-agent-per-
+   * process invariant). One HTTP round-trip per process activate; not for
+   * per-call use.
+   */
+  whoami(): Promise<{
+    agentId: string;
+    tenantId: string;
+  }>;
   resolveIdentity(args: {
     provider: string;
     platformId: string;