@alfe.ai/agent-api-client 0.1.4 → 0.2.0

package/dist/index.d.ts

@@ -202,24 +202,125 @@ declare class AgentApiClient {
     clientSecret: string;
     displayName?: string;
   }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getGithubAccounts()` for the multi-
+   * account shape required by Pattern A — explicit selector args on every
+   * tool. Retained because the `@alfe.ai/openclaw-github` proxy is the
+   * only consumer that knows about Pattern A; legacy env-interpolation
+   * callers will keep hitting `/credentials` until they move to the proxy.
+   */
   getGithubCredentials(): Promise<{
     login: string;
     accessToken: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for GitHub.
+   *
+   * Returns every agent-scoped GitHub connection. The caller is expected
+   * to require a `login` selector on every credential-touching tool and
+   * look up the matching account at dispatch time.
+   *
+   * GitHub OAuth tokens have no expiry (`tokenLifecycle: "no_expiry"`),
+   * so there is intentionally no `refreshGithubAccountToken` method — if
+   * a token is revoked the user must re-run the OAuth flow.
+   *
+   * Returned `accounts[i].login` is the GitHub username — the stable
+   * cross-session identifier the LLM should pass.
+   */
+  getGithubAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      login: string;
+      scopes: string;
+    }[];
+  }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getXeroAccounts()` for the multi-
+   * account shape required by Pattern A — explicit selector args on every
+   * tool. This method will be removed once all consumers migrate.
+   */
   getXeroCredentials(): Promise<{
     accessToken: string;
     accessTokenExpiresAt: string;
     xeroTenantId: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for Xero. Returns every
+   * agent-scoped Xero connection. The caller is expected to require a
+   * selector arg (e.g. `xeroTenantId`) on every credential-touching tool
+   * and look up the matching account by that selector at dispatch time.
+   *
+   * Returned `accounts[i].accountIdentifier` is the Xero tenantId — the
+   * stable cross-session identifier the LLM should pass.
+   */
+  getXeroAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      xeroTenantId: string;
+    }[];
+  }>;
   refreshXeroToken(): Promise<{
     accessToken: string;
     expiresAt: string;
   }>;
+  /**
+   * Pattern A: refresh a specific Xero connection by its `accountIdentifier`
+   * (the Xero `tenantId`). The legacy `refreshXeroToken()` only refreshes
+   * the *primary* connection, which is wrong for multi-tenant Xero where
+   * each tenant has its own non-interchangeable access token.
+   */
+  refreshXeroAccountToken(xeroTenantId: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getNotionAccounts()` for the multi-
+   * account shape required by Pattern A.
+   */
   getNotionCredentials(): Promise<{
     accessToken: string;
     workspaceId: string;
     workspaceName: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for Notion. Returns every
+   * agent-scoped Notion connection. The caller is expected to require a
+   * selector arg (e.g. `workspaceId`) on every credential-touching tool.
+   *
+   * Returned `accounts[i].accountIdentifier` is the Notion workspaceId.
+   */
+  getNotionAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      workspaceId: string;
+      workspaceName: string;
+    }[];
+  }>;
+  /**
+   * @deprecated Returns a single primary Atlassian Connection's credentials
+   * (one OAuth user, one cloudId) — the legacy "pick-the-default-connection"
+   * shape. Atlassian is multi-site by nature (each OAuth user may have
+   * access to multiple Cloud sites), so Pattern A plugins MUST use
+   * `getAtlassianAccounts()` to discover the full set and dispatch via
+   * the `cloudId` selector arg.
+   */
   getAtlassianCredentials(): Promise<{
     accessToken: string;
     refreshToken: string;
@@ -236,16 +337,177 @@ declare class AgentApiClient {
     accessToken: string;
     expiresAt: string;
   }>;
+  /**
+   * Pattern A: multi-account / multi-site credential fetch for Atlassian.
+   *
+   * Returns every agent-scoped Atlassian Connection. Each Connection is
+   * one OAuth user with a single access token and N accessible Cloud
+   * sites (`availableSites`). The caller is expected to:
+   *
+   *   1. Flatten (connection × cloudId) into one MCP child per site.
+   *   2. Require a `cloudId` selector on every credential-touching tool.
+   *   3. Use the access token bound to the Connection that owns the
+   *      requested `cloudId` (Atlassian shares one access token across
+   *      all sites accessible to the OAuth user).
+   *
+   * Per-account token refresh uses `refreshAtlassianAccountToken(email)`
+   * — refreshing one Connection rotates its single access token, which
+   * then applies to every cloudId for that Connection.
+   *
+   * Returned `accounts[i].accountIdentifier` is the OAuth user's email
+   * — the stable cross-session identifier for refresh purposes. The LLM
+   * never sees this directly: it picks a site via the `cloudId` arg
+   * instead.
+   */
+  getAtlassianAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      clientId: string;
+      clientSecret: string;
+      cloudId: string;
+      siteName: string;
+      siteUrl: string;
+      availableSites: {
+        id: string;
+        url: string;
+        name: string;
+        scopes?: string[];
+        avatarUrl?: string;
+      }[];
+    }[];
+  }>;
+  /**
+   * Pattern A: refresh a specific Atlassian Connection by `accountIdentifier`
+   * (the OAuth user's email).
+   *
+   * Atlassian rotates refresh tokens (`rotatesRefreshToken: true`); the
+   * server-side per-account refresh endpoint handles rotation and
+   * persistence. Refreshing one Connection updates its single access
+   * token, which applies to every accessible Cloud site (cloudId) for
+   * that OAuth user.
+   *
+   * Returns the new access token + expiry. The proxy is responsible for
+   * fanning the new token out to every child server it spawned for
+   * cloudIds owned by this Connection.
+   */
+  refreshAtlassianAccountToken(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getMYOBAccounts()` for the multi-
+   * account shape required by Pattern A.
+   */
   getMYOBCredentials(): Promise<{
     accessToken: string;
     accessTokenExpiresAt: string;
     myobBusinessId: string;
     clientId: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for MYOB. Returns every
+   * agent-scoped MYOB connection. The caller is expected to require a
+   * selector arg (e.g. `myobBusinessId` / `accountIdentifier`) on every
+   * credential-touching tool.
+   *
+   * Returned `accounts[i].accountIdentifier` is the MYOB businessId.
+   */
+  getMYOBAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      myobBusinessId: string;
+      clientId: string;
+    }[];
+  }>;
   refreshMYOBToken(): Promise<{
     accessToken: string;
     expiresAt: string;
   }>;
+  /**
+   * Microsoft 365 (delegated OAuth) credential fetch — single-account shape.
+   *
+   * @deprecated Use `getMicrosoftAccounts()` and dispatch via the `email`
+   *   selector once per-account plugins land. Retained because the existing
+   *   `integrations/connect/microsoft/hooks/post_activate.mjs` writes
+   *   `mgc` credentials for the single (default) Microsoft account.
+   *
+   * Returns the agent's effective Microsoft delegated-OAuth credentials.
+   * Distinct from `getTeamsCredentials()` (Azure bot credentials for the
+   * Teams adapter, which is admin-consent flow on services/microsoft, not
+   * delegated OAuth on services/connect).
+   */
+  getMicrosoftCredentials(): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt?: string;
+    refreshToken: string;
+    clientId: string;
+    clientSecret: string;
+    email?: string;
+    microsoftTenantId?: string;
+    workspaceDomain?: string;
+  }>;
+  /**
+   * Pattern A: multi-account credential fetch for Microsoft 365.
+   *
+   * Returns every agent-scoped Microsoft connection. The caller is expected
+   * to require an `email` selector on every credential-touching tool and
+   * look up the matching account at dispatch time.
+   *
+   * Returned `accounts[i].accountIdentifier` is the user's primary email
+   * (or the tid claim as fallback) — the stable cross-session identifier
+   * the LLM should pass.
+   *
+   * Per-account token refresh is exposed via `refreshMicrosoftAccountToken`,
+   * NOT `refreshXeroAccountToken` — Microsoft refresh tokens are not
+   * interchangeable across (tenant, user) pairs.
+   */
+  getMicrosoftAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      refreshToken: string;
+      clientId: string;
+      clientSecret: string;
+      email: string;
+      microsoftTenantId: string;
+      workspaceDomain: string;
+    }[];
+  }>;
+  /**
+   * Pattern A: refresh a specific Microsoft 365 connection by its
+   * `accountIdentifier`. For Microsoft, `accountIdentifier` is the user's
+   * email when the Graph profile fetch succeeded at connect time, and the
+   * Azure tenant id (`tid` claim) as fallback. Callers should pass the
+   * value returned by `getMicrosoftAccounts()` rather than synthesising
+   * an email locally.
+   *
+   * Microsoft refresh tokens are bound to a specific (tenant, user) pair —
+   * they are NOT interchangeable across accounts, so per-account refresh
+   * is mandatory. The generic /accounts/{accountIdentifier}/refresh
+   * endpoint walks the agent's full visible scope chain to find a matching
+   * connection (works for inherited team/project Microsoft connections).
+   */
+  refreshMicrosoftAccountToken(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
   getTeamsCredentials(): Promise<{
     agentId: string;
     tenantId: string;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;;AA8ES,UA/BQ,oBAAA,CA+BR;EAAM,MAAA,EAAA,MAAA;EAGE,MAAA,EAAA,MAAA;AAMjB;AAQiB,UAzCA,aAAA,CAyCmB;EAQnB,OAAA,EAAA,MAAA;EASA,QAAA,EAAA,MAAA;EAQA,WAAA,EAAA,MAAa;EASb,QAAA,EAAA,MAAA;EAQA,MAAA,EAAA,OAAA,GAAA,SAAkB,GAAA,QAAA;EAMlB,SAAA,CAAA,EAAA,MAAe;EAenB,SAAA,CAAA,EAAA,MAAc;EAAA,QAAA,CAAA,EAAA,MAAA;;AAiC6C,UA9HvD,iBAAA,CA8HuD;MAAjB,EAAA,MAAA;MAOpB,EAAA,MAAA;UAAR,EAAA,MAAA;MAML,CAAA,EAAA,MAAA;cAAhB,CAAA,EAAA,MAAA;YAYQ,CAAA,EAAA,OAAA;;AASA,UAvJG,YAAA,CAuJH;SAAR,EAAA,CAAA;SAO0B,EAAA,MAAA;UAAR,EAAA,MAAA;OAI4C,EA9J3D,MA8J2D,CAAA,MAAA,EA9J5C,iBA8J4C,CAAA;;AAOpB,UAlK/B,gBAAA,CAkK+B;MAApB,EAAA,MAAA;KAIuB,EAAA,MAAA;WAAR,EAAA,MAAA;;AAkBpB,UAlLN,mBAAA,CAkLM;UAAjB,EAAA,MAAA;MAUA,EAAA,MAAA;MAM8B,EAAA,MAAA;cAAR,EAAA,UAAA,GAAA,YAAA;UAIiC,EAAA,MAAA;;AAQjD,UAtMK,mBAAA,CAsML;MACP,EAAA,MAAA;MAYsC,EAAA,MAAA;KAC9B,EAAA,MAAA;cAAR,CAAA,EAAA,MAAA;YAWqD,CAAA,EAAA,OAAA;;AAUrD,UAjOY,qBAAA,CAiOZ;SAQyD,EAAA,MAAA;MAAzD,EAAA,MAAA,GAAA,QAAA,GAAA,QAAA;WAM0C,EAAA,MAAA;WAAxB,EAAA,MAAA;OAcS,EAxPvB,mBAwPuB,EAAA;WAoCgB,EAAA,MAAA;;AA2BhB,UAnTf,cAAA,CAmTe;SAgBF,EAAA,MAAA;eAkBF,EAAA,MAAA;cAOI,EAAA,MAAA;WAmBG,EAAA,MAAA;YAoCF,EAAA,MAAA,GAAA,IAAA;;AA6BL,UAxaX,aAAA,CAwaW;UAOG,EAAA,MAAA;MAgBZ,EAAA,MAAA;UACb,EAAA,MAAA;aAOuB,EAAA,MAAA;cAM8D,CAAA,EAAA,MAAA;YAarF,CAAA,EAAA,OAAA;;AAuCQ,UAxfG,gBAAA,CAwfH;WAAR,EAAA,MAAA;MAcK,EAAA,MAAA;cAKL,EAAA,MAAA;cAcK,CAAA,EAAA,MAAA;YAII,EAAA,OAAA;;AAMI,UA3hBF,kBAAA,CA2hBE;WAEF,EAAA,MAAA;SAGH,EAAA,MAAA;YAAR,EAAA,OAAA;;AAgBqB,UA1iBV,eAAA,CA0iBU;UAA4B,EAAA,MAAA;UAAjD,EAAA,MAAA;MAQK,EAAA,MAAA;aAMM,CAAA,EAAA,MAAA;;AAGF,cA5iBF,cAAA,CA4iBE;mBALT,MAAA;mBAiBK,MAAA;aAIM,CAAA,MAAA,EAxjBK,oBAwjBL;UACJ,OAAA;cAEE,CAAA,KAAA,EAAA;IAET,WAAA,CAAA,EAAA,MAAA;MAhiBiD,OA0iB5C,CAAA;IAIL,KAAA,EA9iBkE,aA8iBlE;;iBAeS,CAAA,CAAA,EAtjBY,OAsjBZ,CAtjBoB,YAsjBpB,CAAA;aAED,CAAA,IAAA,EAAA;IAAR,KAAA,EAAA;MAUK,IAAA,EAAA,MAAA;MAEI,SAAA,EAAA,KAAA,GAAA,KAAA;MAGD,WAAA,CAAA,EAAA,MAAA;IAAR,CAAA,EAAA;MAjkBA,OA+kBK,CAAA;IAKc,IAAA,EAplBH,gBAolBG,EAAA;;mBAYd,CAAA,IAAA,EAAA;IAGL,QAAA,EAAA,MAAA;IAQ8B,IAAA,EAAA,MAAA;IAAR,IAAA,EAAA,MAAA;IAmBV,YAAA,CAAA,EAAA,UAAA,GAAA,YAAA;MAlnBZ,OA2nBA,CA3nBQ,mBA2nBR,CAAA;iBAsBA,CAAA,IAAA,EAAA;IAS0C,IAAA,EAAA,MAAA,GAAA,QAAA,GAAA,QAAA;MAjpB1C,OA0pBA,CA1pBQ,qBA0pBR,CAAA;cASA,CAAA,CAAA,EA5pBkB,OA4pBlB,CA5pB0B,cA4pB1B,CAAA;eAWA,CAAA,KAAA,EAAA;IAWA,MAAA,CAAA,EAAA,MAAA;MA9qB6C,OAurB7C,CAAA;IAUA,KAAA,EAjsB8D,aAisB9D,EAAA;;kBAmCA,CAAA,CAAA,EA7tBsB,OA6tBtB,CAAA;IA2BD,QAAA,EAxvB2C,gBAwvB3C,EAAA;;gBAoCC,CAAA,SAAA,EAAA,MAAA,CAAA,EAxxBqC,OAwxBrC,CAxxB6C,kBAwxB7C,CAAA;gBAsBA,CAAA,QAAA,EAAA,MAAA,CAAA,EA1yBoC,OA0yBpC,CAAA;IAsBA,OAAA,EAAA,OAAA;;iBAuBuC,CAAA,IAAA,EAAA;IAOnB,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAOc,OAAA,EAAA,MAAA;MAv1BlC,OA61BiB,CAAA;IAcjB,KAAA,EA32BiB,eA22BjB,EAAA;IAiB2B,UAAA,EAAA,MAAA,GAAA,IAAA;;mBAgB3B,CAAA,IAAA,EAAA;IAUA,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAWA,OAAA,EAAA,MAAA;IASiC,QAAA,EAAA,MAAA;MAh6BjC,OA86BA,CAAA;IAAO,WAAA,EAAA,MAAA;;;sBAx6Be,QAAQ;+CAIiB,QAAQ;yDAQjD,0BACP;;;aAYsC;MACtC,QAAQ;4CAWqC,QAAQ;oDAUrD;;;;;oCAQA;;;aAAyD;;iBAMvC;kBAAwB;;;;;;;;;;;;0BAcf;;;;;;;;;;0CAoCgB;;;;;;;8BAiBZ;;;;;;;0BAUJ;;;;wBAgBF;;;;;sBAkBF;;;;0BAOI;;;;;6BAmBG;;;;;;;;;;;;2BAoCF;;;;wBAOH;;;;;;sBAsBF;;;;yBAOG;;;;;;;;;;;;;mBAgBZ;MACb;;;;uBAOuB;;;;;;;;;;;QAM8D;;;;;;;;;;;;;MAarF;;;;;;;;;;;;WAmCK;;;;MAIL,QAAQ;;;;;;;;WAcH;;;;;MAKL;;;;;;;;;;WAcK;;;;eAII;;;;;eAKA;mBACI;;iBAEF;;;MAGX,QAAQ;;;WAaH;;;MAGL;eAAqB;eAA4B;;;;WAQ5C;;;;MAIL;;iBAEW;aACJ;;eAEE;;;;;;;WAYJ;;;;iBAIM;aACJ;;eAEE;;MAET;;;;;;WAUK;;;;MAIL;;;WASK;;;;;;eAMI;;MAET,QAAQ;;;WAUH;;eAEI;;;MAGT,QAAQ;;;WAcH;;;;;MAKL;aAAmB;;;;;WAYd;;;MAGL;;sBAQsB,QAAQ;;;;;;;;;;YAmBlB;;;;;;;;;MASZ;;;;;;;;;;;;;;;;MAsBA;;;0CAS0C;;;;;;;;;;MAS1C;;;;;;;;;;MASA;;;;;;;;;;;;MAWA;;;;;;;;;;;MAWA;;;;;MASA;;;;;;;;;;MAUA;;;;;;;;;;;;;;;;;;MAkBA;;;;;;;;;;;;;;;;MAiBA;;;;;;;;;;;;;;;;;;MA2BD;;;;;;;;;;;MAeC;;;;;;;;;;MAqBA;;;;;;;;;;;;;;;;;;;;;;;;MAsBA;;;;;;;;;;;;MAsBA;;;;wDAYwD;;;;uCAWjB;;;;;;;;;;;oBAOnB;;;;;;;;kCAOc;;;iBAMjB;;;;;;;;;;;;;;;MAcjB;;;;;;2BAiB2B;;;;+BAII;;;;;;;;;;MAY/B;;;;MAUA;;;;;MAWA;iCASiC;;;;;;;;;;;MAcjC"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;;AA8ES,UA/BQ,oBAAA,CA+BR;EAAM,MAAA,EAAA,MAAA;EAGE,MAAA,EAAA,MAAA;AAMjB;AAQiB,UAzCA,aAAA,CAyCmB;EAQnB,OAAA,EAAA,MAAA;EASA,QAAA,EAAA,MAAA;EAQA,WAAA,EAAA,MAAa;EASb,QAAA,EAAA,MAAA;EAQA,MAAA,EAAA,OAAA,GAAA,SAAkB,GAAA,QAAA;EAMlB,SAAA,CAAA,EAAA,MAAe;EAenB,SAAA,CAAA,EAAA,MAAc;EAAA,QAAA,CAAA,EAAA,MAAA;;AAiC6C,UA9HvD,iBAAA,CA8HuD;MAAjB,EAAA,MAAA;MAOpB,EAAA,MAAA;UAAR,EAAA,MAAA;MAML,CAAA,EAAA,MAAA;cAAhB,CAAA,EAAA,MAAA;YAYQ,CAAA,EAAA,OAAA;;AASA,UAvJG,YAAA,CAuJH;SAAR,EAAA,CAAA;SAO0B,EAAA,MAAA;UAAR,EAAA,MAAA;OAI4C,EA9J3D,MA8J2D,CAAA,MAAA,EA9J5C,iBA8J4C,CAAA;;AAOpB,UAlK/B,gBAAA,CAkK+B;MAApB,EAAA,MAAA;KAIuB,EAAA,MAAA;WAAR,EAAA,MAAA;;AAkBpB,UAlLN,mBAAA,CAkLM;UAAjB,EAAA,MAAA;MAUA,EAAA,MAAA;MAM8B,EAAA,MAAA;cAAR,EAAA,UAAA,GAAA,YAAA;UAIiC,EAAA,MAAA;;AAQjD,UAtMK,mBAAA,CAsML;MACP,EAAA,MAAA;MAYsC,EAAA,MAAA;KAC9B,EAAA,MAAA;cAAR,CAAA,EAAA,MAAA;YAWqD,CAAA,EAAA,OAAA;;AAUrD,UAjOY,qBAAA,CAiOZ;SAQyD,EAAA,MAAA;MAAzD,EAAA,MAAA,GAAA,QAAA,GAAA,QAAA;WAM0C,EAAA,MAAA;WAAxB,EAAA,MAAA;OAcS,EAxPvB,mBAwPuB,EAAA;WAoCgB,EAAA,MAAA;;AAmChB,UA3Tf,cAAA,CA2Te;SA8BH,EAAA,MAAA;eAyCC,EAAA,MAAA;cA2BH,EAAA,MAAA;WAoCC,EAAA,MAAA;YAa2B,EAAA,MAAA,GAAA,IAAA;;AAkD1B,UAxfZ,aAAA,CAwfY;UA6CM,EAAA,MAAA;MAoCF,EAAA,MAAA;UA6BD,EAAA,MAAA;aA4EiC,EAAA,MAAA;cAwBnC,CAAA,EAAA,MAAA;YA8BH,CAAA,EAAA,OAAA;;AA4DQ,UA3xBlB,gBAAA,CA2xBkB;WAgDH,EAAA,MAAA;MAgEiC,EAAA,MAAA;cAmBlC,EAAA,MAAA;cAgBZ,CAAA,EAAA,MAAA;YACb,EAAA,OAAA;;AAaqF,UAp7B1E,kBAAA,CAo7B0E;WAarF,EAAA,MAAA;SAmCK,EAAA,MAAA;YAIG,EAAA,OAAA;;AAcH,UAh/BM,eAAA,CAg/BN;UAKL,EAAA,MAAA;UAcK,EAAA,MAAA;MAII,EAAA,MAAA;aAKA,CAAA,EAAA,MAAA;;AAGE,cAhgCJ,cAAA,CAggCI;mBAGH,MAAA;mBAAR,MAAA;aAaK,CAAA,MAAA,EA5gCW,oBA4gCX;UAGgB,OAAA;cAA4B,CAAA,KAAA,EAAA;IAAjD,WAAA,CAAA,EAAA,MAAA;MAl/BiD,OA0/B5C,CAAA;IAMM,KAAA,EAhgCuD,aAggCvD;;iBAGF,CAAA,CAAA,EA5/BY,OA4/BZ,CA5/BoB,YA4/BpB,CAAA;aALT,CAAA,IAAA,EAAA;IAiBK,KAAA,EAAA;MAIM,IAAA,EAAA,MAAA;MACJ,SAAA,EAAA,KAAA,GAAA,KAAA;MAEE,WAAA,CAAA,EAAA,MAAA;IAET,CAAA,EAAA;MA3gCA,OAqhCK,CAAA;IAIL,IAAA,EAzhCgB,gBAyhChB,EAAA;;mBAeS,CAAA,IAAA,EAAA;IAED,QAAA,EAAA,MAAA;IAAR,IAAA,EAAA,MAAA;IAUK,IAAA,EAAA,MAAA;IAEI,YAAA,CAAA,EAAA,UAAA,GAAA,YAAA;MA1iCT,OA6iCQ,CA7iCA,mBA6iCA,CAAA;iBAAR,CAAA,IAAA,EAAA;IAcK,IAAA,EAAA,MAAA,GAAA,QAAA,GAAA,QAAA;MAljCL,OAujCmB,CAvjCX,qBAujCW,CAAA;cAAnB,CAAA,CAAA,EAhjCkB,OAgjClB,CAhjC0B,cAgjC1B,CAAA;eAYK,CAAA,KAAA,EAAA;IAGL,MAAA,CAAA,EAAA,MAAA;MA3jC6C,OAmkCf,CAAA;IAAR,KAAA,EAnkCwC,aAmkCxC,EAAA;;kBA4BtB,CAAA,CAAA,EAxlCsB,OAwlCtB,CAAA;IAsBA,QAAA,EA9mC0C,gBA8mC1C,EAAA;;gBAkBA,CAAA,SAAA,EAAA,MAAA,CAAA,EA5nCqC,OA4nCrC,CA5nC6C,kBA4nC7C,CAAA;gBASA,CAAA,QAAA,EAAA,MAAA,CAAA,EAjoCoC,OAioCpC,CAAA;IAWA,OAAA,EAAA,OAAA;;iBAoBA,CAAA,IAAA,EAAA;IAUA,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAkBA,OAAA,EAAA,MAAA;MA9qCA,OA+rCA,CAAA;IA2BD,KAAA,EA1tCkB,eA0tClB,EAAA;IAeC,UAAA,EAAA,MAAA,GAAA,IAAA;;mBA2CA,CAAA,IAAA,EAAA;IAsBA,KAAA,EAAA,KAAA,GAAA,MAAA,GAAA,SAAA;IAYwD,OAAA,EAAA,MAAA;IAWjB,QAAA,EAAA,MAAA;MAvzCvC,OA8zCoB,CAAA;IAOc,WAAA,EAAA,MAAA;IAMjB,SAAA,EAAA,MAAA;;kBA+BU,CAAA,CAAA,EAp2CL,OAo2CK,CAp2CG,oBAo2CH,EAAA,CAAA;sBAII,CAAA,aAAA,EAAA,MAAA,CAAA,EAp2CgB,OAo2ChB,CAp2CwB,yBAo2CxB,CAAA;yBAY/B,CAAA,aAAA,EAAA,MAAA,EAAA,MAAA,EAx2CM,MAw2CN,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,EAv2CD,OAu2CC,CAAA,IAAA,CAAA;oBAUA,CAAA,aAAA,EAAA,MAAA,EAAA,QAAA,EAAA;IAWA,OAAA,CAAA,EAAA,MAAA;IASiC,MAAA,CAAA,EAz3CI,MAy3CJ,CAAA,MAAA,EAAA,OAAA,CAAA;MAx3ClC,OAs4CC,CAt4CO,oBAs4CP,CAAA;EAAO,iBAAA,CAAA,aAAA,EAAA,MAAA,CAAA,EA33CqC,OA23CrC,CA33C6C,oBA23C7C,CAAA;oDAj3CR;;;;;oCAQA;;;aAAyD;;iBAMvC;kBAAwB;;;;;;;;;;;;0BAcf;;;;;;;;;;0CAoCgB;;;;;;;8BAiBZ;;;;;;;;;;;;;;;0BAkBJ;;;;;;;;;;;;;;;;;;uBA8BH;;;;;;;;;;;;;;;;;wBAyCC;;;;;;;;;;;;;;qBA2BH;;;;;;;;;;;sBAoCC;;;;;;;;;;iDAa2B;;;;;;;;;;0BAwBvB;;;;;;;;;;;;uBA0BH;;;;;;;;;;;;;;;;;;;6BA6CM;;;;;;;;;;;;2BAoCF;;;;;;;;;;;;;;;;;;;;;;;;;;0BA6BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2DA4EiC;;;;;;;;;;wBAwBnC;;;;;;;;;;;;;;qBA8BH;;;;;;;;;;;;sBAwCC;;;;;;;;;;;;;;;;;6BAoBO;;;;;;;;;;;;;;;;;;;;;;;;;0BAgDH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2DAgEiC;;;;;yBAmBlC;;;;;;;;;;;;;mBAgBZ;MACb;;;;uBAOuB;;;;;;;;;;;QAM8D;;;;;;;;;;;;;MAarF;;;;;;;;;;;;WAmCK;;;;MAIL,QAAQ;;;;;;;;WAcH;;;;;MAKL;;;;;;;;;;WAcK;;;;eAII;;;;;eAKA;mBACI;;iBAEF;;;MAGX,QAAQ;;;WAaH;;;MAGL;eAAqB;eAA4B;;;;WAQ5C;;;;MAIL;;iBAEW;aACJ;;eAEE;;;;;;;WAYJ;;;;iBAIM;aACJ;;eAEE;;MAET;;;;;;WAUK;;;;MAIL;;;WASK;;;;;;eAMI;;MAET,QAAQ;;;WAUH;;eAEI;;;MAGT,QAAQ;;;WAcH;;;;;MAKL;aAAmB;;;;;WAYd;;;MAGL;;sBAQsB,QAAQ;;;;;;;;;;YAmBlB;;;;;;;;;MASZ;;;;;;;;;;;;;;;;MAsBA;;;0CAS0C;;;;;;;;;;MAS1C;;;;;;;;;;MASA;;;;;;;;;;;;MAWA;;;;;;;;;;;MAWA;;;;;MASA;;;;;;;;;;MAUA;;;;;;;;;;;;;;;;;;MAkBA;;;;;;;;;;;;;;;;MAiBA;;;;;;;;;;;;;;;;;;MA2BD;;;;;;;;;;;MAeC;;;;;;;;;;MAqBA;;;;;;;;;;;;;;;;;;;;;;;;MAsBA;;;;;;;;;;;;MAsBA;;;;wDAYwD;;;;uCAWjB;;;;;;;;;;;oBAOnB;;;;;;;;kCAOc;;;iBAMjB;;;;;;;;;;;;;;;MAcjB;;;;;;2BAiB2B;;;;+BAII;;;;;;;;;;MAY/B;;;;MAUA;;;;;MAWA;iCASiC;;;;;;;;;;;MAcjC"}

package/dist/index.js

@@ -145,6 +145,14 @@ var AgentApiClient = class {
 	async getGoogleChatCredentials() {
 		return this.request("/agent/google-chat/credentials");
 	}
+	/**
+	* @deprecated Returns a single primary credential blob (legacy "pick-the-
+	* default-connection" shape). Use `getGithubAccounts()` for the multi-
+	* account shape required by Pattern A — explicit selector args on every
+	* tool. Retained because the `@alfe.ai/openclaw-github` proxy is the
+	* only consumer that knows about Pattern A; legacy env-interpolation
+	* callers will keep hitting `/credentials` until they move to the proxy.
+	*/
 	async getGithubCredentials() {
 		const raw = await this.request("/agent/connect/github/credentials");
 		return {
@@ -152,6 +160,37 @@ var AgentApiClient = class {
 			accessToken: raw.accessToken
 		};
 	}
+	/**
+	* Pattern A: multi-account credential fetch for GitHub.
+	*
+	* Returns every agent-scoped GitHub connection. The caller is expected
+	* to require a `login` selector on every credential-touching tool and
+	* look up the matching account at dispatch time.
+	*
+	* GitHub OAuth tokens have no expiry (`tokenLifecycle: "no_expiry"`),
+	* so there is intentionally no `refreshGithubAccountToken` method — if
+	* a token is revoked the user must re-run the OAuth flow.
+	*
+	* Returned `accounts[i].login` is the GitHub username — the stable
+	* cross-session identifier the LLM should pass.
+	*/
+	async getGithubAccounts() {
+		return { accounts: (await this.request("/agent/connect/github/accounts")).accounts.map((a) => ({
+			connectionId: a.connectionId,
+			accountIdentifier: a.accountIdentifier,
+			displayName: a.displayName,
+			connectedAt: a.connectedAt,
+			accessToken: a.accessToken ?? "",
+			login: a.login ?? a.accountIdentifier,
+			scopes: a.scopes ?? ""
+		})) };
+	}
+	/**
+	* @deprecated Returns a single primary credential blob (legacy "pick-the-
+	* default-connection" shape). Use `getXeroAccounts()` for the multi-
+	* account shape required by Pattern A — explicit selector args on every
+	* tool. This method will be removed once all consumers migrate.
+	*/
 	async getXeroCredentials() {
 		const raw = await this.request("/agent/connect/xero/credentials");
 		return {
@@ -160,9 +199,49 @@ var AgentApiClient = class {
 			xeroTenantId: raw.xeroTenantId ?? ""
 		};
 	}
+	/**
+	* Pattern A: multi-account credential fetch for Xero. Returns every
+	* agent-scoped Xero connection. The caller is expected to require a
+	* selector arg (e.g. `xeroTenantId`) on every credential-touching tool
+	* and look up the matching account by that selector at dispatch time.
+	*
+	* Returned `accounts[i].accountIdentifier` is the Xero tenantId — the
+	* stable cross-session identifier the LLM should pass.
+	*/
+	async getXeroAccounts() {
+		return { accounts: (await this.request("/agent/connect/xero/accounts")).accounts.map((a) => ({
+			connectionId: a.connectionId,
+			accountIdentifier: a.accountIdentifier,
+			displayName: a.displayName,
+			connectedAt: a.connectedAt,
+			accessToken: a.accessToken,
+			accessTokenExpiresAt: a.accessTokenExpiresAt ?? "",
+			xeroTenantId: a.xeroTenantId ?? a.accountIdentifier
+		})) };
+	}
 	async refreshXeroToken() {
 		return this.request("/agent/connect/xero/refresh", { method: "POST" });
 	}
+	/**
+	* Pattern A: refresh a specific Xero connection by its `accountIdentifier`
+	* (the Xero `tenantId`). The legacy `refreshXeroToken()` only refreshes
+	* the *primary* connection, which is wrong for multi-tenant Xero where
+	* each tenant has its own non-interchangeable access token.
+	*/
+	async refreshXeroAccountToken(xeroTenantId) {
+		const path = `/agent/connect/xero/accounts/${encodeURIComponent(xeroTenantId)}/refresh`;
+		const raw = await this.request(path, { method: "POST" });
+		return {
+			accessToken: raw.accessToken,
+			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
+			expiresAt: raw.expiresAt ?? ""
+		};
+	}
+	/**
+	* @deprecated Returns a single primary credential blob (legacy "pick-the-
+	* default-connection" shape). Use `getNotionAccounts()` for the multi-
+	* account shape required by Pattern A.
+	*/
 	async getNotionCredentials() {
 		const raw = await this.request("/agent/connect/notion/credentials");
 		return {
@@ -171,6 +250,32 @@ var AgentApiClient = class {
 			workspaceName: raw.workspaceName ?? ""
 		};
 	}
+	/**
+	* Pattern A: multi-account credential fetch for Notion. Returns every
+	* agent-scoped Notion connection. The caller is expected to require a
+	* selector arg (e.g. `workspaceId`) on every credential-touching tool.
+	*
+	* Returned `accounts[i].accountIdentifier` is the Notion workspaceId.
+	*/
+	async getNotionAccounts() {
+		return { accounts: (await this.request("/agent/connect/notion/accounts")).accounts.map((a) => ({
+			connectionId: a.connectionId,
+			accountIdentifier: a.accountIdentifier,
+			displayName: a.displayName,
+			connectedAt: a.connectedAt,
+			accessToken: a.accessToken,
+			workspaceId: a.workspaceId ?? a.accountIdentifier,
+			workspaceName: a.workspaceName ?? a.displayName ?? ""
+		})) };
+	}
+	/**
+	* @deprecated Returns a single primary Atlassian Connection's credentials
+	* (one OAuth user, one cloudId) — the legacy "pick-the-default-connection"
+	* shape. Atlassian is multi-site by nature (each OAuth user may have
+	* access to multiple Cloud sites), so Pattern A plugins MUST use
+	* `getAtlassianAccounts()` to discover the full set and dispatch via
+	* the `cloudId` selector arg.
+	*/
 	async getAtlassianCredentials() {
 		const raw = await this.request("/agent/connect/atlassian/credentials");
 		return {
@@ -189,6 +294,72 @@ var AgentApiClient = class {
 	async refreshAtlassianToken() {
 		return this.request("/agent/connect/atlassian/refresh", { method: "POST" });
 	}
+	/**
+	* Pattern A: multi-account / multi-site credential fetch for Atlassian.
+	*
+	* Returns every agent-scoped Atlassian Connection. Each Connection is
+	* one OAuth user with a single access token and N accessible Cloud
+	* sites (`availableSites`). The caller is expected to:
+	*
+	*   1. Flatten (connection × cloudId) into one MCP child per site.
+	*   2. Require a `cloudId` selector on every credential-touching tool.
+	*   3. Use the access token bound to the Connection that owns the
+	*      requested `cloudId` (Atlassian shares one access token across
+	*      all sites accessible to the OAuth user).
+	*
+	* Per-account token refresh uses `refreshAtlassianAccountToken(email)`
+	* — refreshing one Connection rotates its single access token, which
+	* then applies to every cloudId for that Connection.
+	*
+	* Returned `accounts[i].accountIdentifier` is the OAuth user's email
+	* — the stable cross-session identifier for refresh purposes. The LLM
+	* never sees this directly: it picks a site via the `cloudId` arg
+	* instead.
+	*/
+	async getAtlassianAccounts() {
+		return { accounts: (await this.request("/agent/connect/atlassian/accounts")).accounts.map((a) => ({
+			connectionId: a.connectionId,
+			accountIdentifier: a.accountIdentifier,
+			displayName: a.displayName,
+			connectedAt: a.connectedAt,
+			accessToken: a.accessToken ?? "",
+			accessTokenExpiresAt: a.accessTokenExpiresAt ?? "",
+			clientId: a.clientId ?? "",
+			clientSecret: a.clientSecret ?? "",
+			cloudId: a.cloudId ?? "",
+			siteName: a.siteName ?? "",
+			siteUrl: a.siteUrl ?? "",
+			availableSites: a.availableSites ?? []
+		})) };
+	}
+	/**
+	* Pattern A: refresh a specific Atlassian Connection by `accountIdentifier`
+	* (the OAuth user's email).
+	*
+	* Atlassian rotates refresh tokens (`rotatesRefreshToken: true`); the
+	* server-side per-account refresh endpoint handles rotation and
+	* persistence. Refreshing one Connection updates its single access
+	* token, which applies to every accessible Cloud site (cloudId) for
+	* that OAuth user.
+	*
+	* Returns the new access token + expiry. The proxy is responsible for
+	* fanning the new token out to every child server it spawned for
+	* cloudIds owned by this Connection.
+	*/
+	async refreshAtlassianAccountToken(accountIdentifier) {
+		const path = `/agent/connect/atlassian/accounts/${encodeURIComponent(accountIdentifier)}/refresh`;
+		const raw = await this.request(path, { method: "POST" });
+		return {
+			accessToken: raw.accessToken,
+			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
+			expiresAt: raw.expiresAt ?? ""
+		};
+	}
+	/**
+	* @deprecated Returns a single primary credential blob (legacy "pick-the-
+	* default-connection" shape). Use `getMYOBAccounts()` for the multi-
+	* account shape required by Pattern A.
+	*/
 	async getMYOBCredentials() {
 		const raw = await this.request("/agent/connect/myob/credentials");
 		return {
@@ -198,9 +369,109 @@ var AgentApiClient = class {
 			clientId: raw.clientId
 		};
 	}
+	/**
+	* Pattern A: multi-account credential fetch for MYOB. Returns every
+	* agent-scoped MYOB connection. The caller is expected to require a
+	* selector arg (e.g. `myobBusinessId` / `accountIdentifier`) on every
+	* credential-touching tool.
+	*
+	* Returned `accounts[i].accountIdentifier` is the MYOB businessId.
+	*/
+	async getMYOBAccounts() {
+		return { accounts: (await this.request("/agent/connect/myob/accounts")).accounts.map((a) => ({
+			connectionId: a.connectionId,
+			accountIdentifier: a.accountIdentifier,
+			displayName: a.displayName,
+			connectedAt: a.connectedAt,
+			accessToken: a.accessToken,
+			accessTokenExpiresAt: a.accessTokenExpiresAt ?? "",
+			myobBusinessId: a.myobBusinessId ?? a.accountIdentifier,
+			clientId: a.clientId
+		})) };
+	}
 	async refreshMYOBToken() {
 		return this.request("/agent/connect/myob/refresh", { method: "POST" });
 	}
+	/**
+	* Microsoft 365 (delegated OAuth) credential fetch — single-account shape.
+	*
+	* @deprecated Use `getMicrosoftAccounts()` and dispatch via the `email`
+	*   selector once per-account plugins land. Retained because the existing
+	*   `integrations/connect/microsoft/hooks/post_activate.mjs` writes
+	*   `mgc` credentials for the single (default) Microsoft account.
+	*
+	* Returns the agent's effective Microsoft delegated-OAuth credentials.
+	* Distinct from `getTeamsCredentials()` (Azure bot credentials for the
+	* Teams adapter, which is admin-consent flow on services/microsoft, not
+	* delegated OAuth on services/connect).
+	*/
+	async getMicrosoftCredentials() {
+		const raw = await this.request("/agent/connect/microsoft/credentials");
+		return {
+			accessToken: raw.accessToken ?? "",
+			accessTokenExpiresAt: raw.accessTokenExpiresAt,
+			refreshToken: raw.refreshToken ?? "",
+			clientId: raw.clientId ?? "",
+			clientSecret: raw.clientSecret ?? "",
+			email: raw.email ?? raw.accountIdentifier,
+			microsoftTenantId: raw.microsoftTenantId,
+			workspaceDomain: raw.workspaceDomain
+		};
+	}
+	/**
+	* Pattern A: multi-account credential fetch for Microsoft 365.
+	*
+	* Returns every agent-scoped Microsoft connection. The caller is expected
+	* to require an `email` selector on every credential-touching tool and
+	* look up the matching account at dispatch time.
+	*
+	* Returned `accounts[i].accountIdentifier` is the user's primary email
+	* (or the tid claim as fallback) — the stable cross-session identifier
+	* the LLM should pass.
+	*
+	* Per-account token refresh is exposed via `refreshMicrosoftAccountToken`,
+	* NOT `refreshXeroAccountToken` — Microsoft refresh tokens are not
+	* interchangeable across (tenant, user) pairs.
+	*/
+	async getMicrosoftAccounts() {
+		return { accounts: (await this.request("/agent/connect/microsoft/accounts")).accounts.map((a) => ({
+			connectionId: a.connectionId,
+			accountIdentifier: a.accountIdentifier,
+			displayName: a.displayName,
+			connectedAt: a.connectedAt,
+			accessToken: a.accessToken ?? "",
+			accessTokenExpiresAt: a.accessTokenExpiresAt ?? "",
+			refreshToken: a.refreshToken ?? "",
+			clientId: a.clientId ?? "",
+			clientSecret: a.clientSecret ?? "",
+			email: a.email ?? a.accountIdentifier,
+			microsoftTenantId: a.microsoftTenantId ?? "",
+			workspaceDomain: a.workspaceDomain ?? ""
+		})) };
+	}
+	/**
+	* Pattern A: refresh a specific Microsoft 365 connection by its
+	* `accountIdentifier`. For Microsoft, `accountIdentifier` is the user's
+	* email when the Graph profile fetch succeeded at connect time, and the
+	* Azure tenant id (`tid` claim) as fallback. Callers should pass the
+	* value returned by `getMicrosoftAccounts()` rather than synthesising
+	* an email locally.
+	*
+	* Microsoft refresh tokens are bound to a specific (tenant, user) pair —
+	* they are NOT interchangeable across accounts, so per-account refresh
+	* is mandatory. The generic /accounts/{accountIdentifier}/refresh
+	* endpoint walks the agent's full visible scope chain to find a matching
+	* connection (works for inherited team/project Microsoft connections).
+	*/
+	async refreshMicrosoftAccountToken(accountIdentifier) {
+		const path = `/agent/connect/microsoft/accounts/${encodeURIComponent(accountIdentifier)}/refresh`;
+		const raw = await this.request(path, { method: "POST" });
+		return {
+			accessToken: raw.accessToken,
+			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
+			expiresAt: raw.expiresAt ?? ""
+		};
+	}
 	async getTeamsCredentials() {
 		return this.request("/agent/microsoft/credentials");
 	}