@alfe.ai/agent-api-client 0.13.0 → 0.15.0

package/dist/index.cjs

@@ -20,7 +20,14 @@ function firstFrame(err) {
 	return frame ? ` (${frame.trim()})` : "";
 }
 function buildLine(plugin, tool, kind, message, frame = "") {
-	return `[ERROR] alfe-tool plugin=${plugin} tool=${tool} ${kind}: ${message.replace(/\s+/g, " ").trim()}${frame}`.slice(0, 480);
+	const safeToken = (value) => value.replace(/[^A-Za-z0-9_.@/-]+/g, "_").slice(0, 80);
+	const stripControls = (value) => Array.from(value, (character) => {
+		const code = character.charCodeAt(0);
+		return code < 32 || code >= 127 && code <= 159 ? " " : character;
+	}).join("");
+	const oneLine = stripControls(message).replace(/\s+/g, " ").trim();
+	const safeFrame = stripControls(frame).replace(/\s+/g, " ");
+	return `[ERROR] alfe-tool plugin=${safeToken(plugin)} tool=${safeToken(tool)} ${kind}: ${oneLine}${safeFrame}`.slice(0, 480);
 }
 function wrapExecute(tool, opts) {
 	const execute = tool.execute;
@@ -57,7 +64,6 @@ function installToolErrorCapture(api, options) {
 	try {
 		const markedApi = api;
 		if (markedApi[INSTALLED_MARKER]) return;
-		markedApi[INSTALLED_MARKER] = true;
 		const emit = options.emit ?? ((line) => {
 			process.stderr.write(`${line}\n`);
 		});
@@ -66,28 +72,33 @@ function installToolErrorCapture(api, options) {
 			emit
 		};
 		const original = api.registerTool.bind(api);
-		api.registerTool = (...args) => {
+		const wrappedRegisterTool = (...args) => {
+			let preparedArgs = args;
 			try {
 				const [first, ...rest] = args;
 				if (typeof first === "function") {
 					const factory = first;
 					const wrappedFactory = (...fa) => {
 						const tool = factory(...fa);
-						if (typeof tool === "object" && tool !== null) wrapExecute(tool, opts);
+						if (typeof tool === "object" && tool !== null) try {
+							wrapExecute(tool, opts);
+						} catch {}
 						return tool;
 					};
-					return original(wrappedFactory, ...rest);
+					preparedArgs = [wrappedFactory, ...rest];
 				}
 				if (typeof first === "object" && first !== null) wrapExecute(first, opts);
-				return original(first, ...rest);
 			} catch {
-				return original(...args);
+				preparedArgs = args;
 			}
+			return original(...preparedArgs);
 		};
+		api.registerTool = wrappedRegisterTool;
+		markedApi[INSTALLED_MARKER] = true;
 	} catch {}
 }
 //#endregion
-//#region src/index.ts
+//#region src/transport.ts
 /**
 * Encode each path segment but keep the `/` separators — `encodeURIComponent`
 * would escape the slashes too, breaking greedy proxy routes.
@@ -95,6 +106,25 @@ function installToolErrorCapture(api, options) {
 function encodeFilePath(filePath) {
 	return filePath.split("/").map(encodeURIComponent).join("/");
 }
+/**
+* Build the thrown Error message for a non-2xx response. The
+* @alfe/api-core error envelope carries the server's detail as
+* `{ message }` (Zod failures add `{ issues }`); some handlers use
+* `{ error }`. Surfacing that detail matters for tool-facing callers —
+* e.g. GET /mobile/numbers 404s with "No phone number assigned…
+* use mobile_search_numbers", which guides the agent's next tool call.
+*/
+function formatErrorMessage(status, rawBody) {
+	const prefix = `Agent API request failed (${String(status)})`;
+	try {
+		const json = JSON.parse(rawBody);
+		const issues = json.issues;
+		if (Array.isArray(issues) && issues.length > 0) return `${prefix}: validation failed — ${issues.map((i) => `${i.path?.join(".") ?? "input"}: ${i.message ?? "invalid"}`).join("; ")}`;
+		const detail = typeof json.error === "string" ? json.error : typeof json.message === "string" ? json.message : void 0;
+		if (detail) return `${prefix}: ${detail}`;
+	} catch {}
+	return prefix;
+}
 const REQUEST_TIMEOUT_MS = 2e4;
 const RETRYABLE_STATUS = new Set([
 	500,
@@ -103,8 +133,10 @@ const RETRYABLE_STATUS = new Set([
 	504
 ]);
 const RETRY_DELAY_MS = 500;
-const IMAGE_POLL_INTERVAL_MS = 2e3;
-const IMAGE_JOB_TIMEOUT_MS = 18e4;
+function isSafeRetryMethod(method) {
+	const normalized = (method ?? "GET").toUpperCase();
+	return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS";
+}
 function sleep(ms) {
 	return new Promise((resolve) => {
 		setTimeout(resolve, ms);
@@ -116,30 +148,92 @@ function isRetryableNetworkError(err) {
 	if (err.name === "TypeError") return true;
 	return false;
 }
-var AgentApiClient = class {
+/** Whether a completed request may be retried/polled without masking a real client error. */
+function isTransientRequestError(err) {
+	if (isRetryableNetworkError(err)) return true;
+	const status = err?.status;
+	return typeof status === "number" && RETRYABLE_STATUS.has(status);
+}
+var AgentApiTransport = class {
 	apiKey;
 	apiUrl;
 	constructor(config) {
 		this.apiKey = config.apiKey;
 		this.apiUrl = config.apiUrl;
 	}
-	async request(path, options) {
+	/**
+	* Binary sibling of `request<T>()`. `request()` forces
+	* `Content-Type: application/json` and parses a `{ data: T }` envelope,
+	* neither of which fits a raw-audio flow (voice TTS/STT), so those go
+	* through this instead. Auth (Bearer), the request budget, and the single
+	* retry policy on transient 5xx / network errors is kept in sync with
+	* `request()`. Safe read methods retry once by default; mutation methods do
+	* not, because a response can be lost after a handler or provider call has
+	* already succeeded.
+	*/
+	async rawRequest(path, init, extra) {
+		const url = `${this.apiUrl}${path}`;
+		init.headers.set("Authorization", `Bearer ${this.apiKey}`);
+		const maxAttempts = extra?.retry ?? isSafeRetryMethod(init.method) ? 2 : 1;
+		let lastError;
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
+			const res = await fetch(url, {
+				method: init.method,
+				headers: init.headers,
+				body: init.body,
+				signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+			});
+			if (!res.ok) {
+				const errorBody = await res.text();
+				const error = new Error(formatErrorMessage(res.status, errorBody));
+				error.status = res.status;
+				if (attempt < maxAttempts && RETRYABLE_STATUS.has(res.status)) {
+					lastError = error;
+					await sleep(RETRY_DELAY_MS);
+					continue;
+				}
+				throw error;
+			}
+			return res;
+		} catch (err) {
+			if (attempt < maxAttempts && isRetryableNetworkError(err)) {
+				lastError = err;
+				await sleep(RETRY_DELAY_MS);
+				continue;
+			}
+			throw err;
+		}
+		throw lastError instanceof Error ? lastError : new Error(String(lastError));
+	}
+	/**
+	* @param extra.timeoutMs Per-request abort timeout (default REQUEST_TIMEOUT_MS).
+	*   Long endpoints (image generation) pass a larger value so the gateway's
+	*   own timeout wins with a readable status instead of a client-side abort.
+	* @param extra.retry Whether to retry once on transient failures. Safe reads
+	*   (GET/HEAD/OPTIONS) default to true; mutations default to false. Set true
+	*   only when the endpoint's server-side contract is explicitly idempotent.
+	* @param extra.signal Optional caller cancellation combined with the client's
+	*   own timeout budget. Aborting either signal cancels the request.
+	*/
+	async request(path, options, extra) {
 		const url = `${this.apiUrl}${path}`;
 		const headers = new Headers(options?.headers);
 		headers.set("Authorization", `Bearer ${this.apiKey}`);
 		headers.set("Content-Type", "application/json");
+		const timeoutMs = extra?.timeoutMs ?? 2e4;
+		const maxAttempts = extra?.retry ?? isSafeRetryMethod(options?.method) ? 2 : 1;
 		let lastError;
-		for (let attempt = 1; attempt <= 2; attempt++) try {
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			const res = await fetch(url, {
 				...options,
 				headers,
-				signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+				signal: extra?.signal ? AbortSignal.any([extra.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs)
 			});
 			if (!res.ok) {
-				await res.text();
-				const error = /* @__PURE__ */ new Error(`Agent API request failed (${String(res.status)})`);
+				const errorBody = await res.text();
+				const error = new Error(formatErrorMessage(res.status, errorBody));
 				error.status = res.status;
-				if (attempt === 1 && RETRYABLE_STATUS.has(res.status)) {
+				if (attempt < maxAttempts && RETRYABLE_STATUS.has(res.status)) {
 					lastError = error;
 					await sleep(RETRY_DELAY_MS);
 					continue;
@@ -148,7 +242,7 @@ var AgentApiClient = class {
 			}
 			return (await res.json()).data;
 		} catch (err) {
-			if (attempt === 1 && isRetryableNetworkError(err)) {
+			if (attempt < maxAttempts && isRetryableNetworkError(err)) {
 				lastError = err;
 				await sleep(RETRY_DELAY_MS);
 				continue;
@@ -157,103 +251,45 @@ var AgentApiClient = class {
 		}
 		throw lastError instanceof Error ? lastError : new Error(String(lastError));
 	}
-	async syncRegister(args) {
-		return this.request("/agent/sync/register", {
-			method: "POST",
-			body: JSON.stringify(args ?? {})
-		});
-	}
-	async syncGetManifest() {
-		return this.request("/agent/sync/manifest");
-	}
-	async syncPresign(args) {
-		return this.request("/agent/sync/presign", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
-	}
-	async syncConfirmUpload(args) {
-		return this.request("/agent/sync/confirm", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
+};
+/**
+* Base class for the domain method groups. Holds the shared transport;
+* `AgentApiClient` assembles the groups onto one class via `applyMixins`
+* (prototype copy), so methods keep their original `this`-on-the-client
+* call shape.
+*/
+var ApiBase = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
 	}
-	async syncReconstruct(args) {
-		return this.request("/agent/sync/reconstruct", {
+};
+//#endregion
+//#region src/domains/chat.ts
+/**
+* Chat attachment + activity methods for the Agent API client.
+*/
+var ChatApi = class extends ApiBase {
+	async presignAttachments(files) {
+		return this.transport.request("/agent/chat/attachments/presign", {
 			method: "POST",
-			body: JSON.stringify(args)
-		});
-	}
-	async syncGetStats() {
-		return this.request("/agent/sync/stats");
-	}
-	async syncListFiles(args) {
-		const qs = new URLSearchParams();
-		if (args?.prefix) qs.set("prefix", args.prefix);
-		const query = qs.toString();
-		return this.request(`/agent/sync/files${query ? `?${query}` : ""}`);
-	}
-	async syncListSessions() {
-		return this.request("/agent/sync/sessions");
-	}
-	async syncGetSession(sessionId) {
-		return this.request(`/agent/sync/sessions/${encodeURIComponent(sessionId)}`);
-	}
-	async syncDeleteFile(filePath) {
-		return this.request(`/agent/sync/files/${encodeFilePath(filePath)}`, { method: "DELETE" });
-	}
-	async sharedListFiles(args) {
-		return this.request(`/agent/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}`);
-	}
-	async sharedDownloadUrl(args) {
-		return this.request(`/agent/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/download/${encodeFilePath(args.filePath)}`);
-	}
-	async listIntegrations() {
-		return this.request("/agent/integrations");
-	}
-	async getIntegrationConfig(integrationId) {
-		try {
-			return await this.request(`/agent/integrations/${encodeURIComponent(integrationId)}/config`);
-		} catch (err) {
-			if (err.status === 404) return {
-				integrationId,
-				config: {},
-				configSchema: [],
-				installed: false
-			};
-			throw err;
-		}
-	}
-	async updateIntegrationConfig(integrationId, config) {
-		await this.request(`/agent/integrations/${encodeURIComponent(integrationId)}`, {
-			method: "PATCH",
-			body: JSON.stringify({ config })
+			body: JSON.stringify({ files })
 		});
 	}
-	async installIntegration(integrationId, options) {
-		return this.request("/agent/integrations", {
+	async recordActivity(data) {
+		return this.transport.request("/agent/activity", {
 			method: "POST",
-			body: JSON.stringify({
-				integrationId,
-				version: options?.version,
-				config: options?.config
-			})
+			body: JSON.stringify(data)
 		});
 	}
-	async removeIntegration(integrationId) {
-		return this.request(`/agent/integrations/${encodeURIComponent(integrationId)}`, { method: "DELETE" });
-	}
-	async getOAuthUrl(provider, scopes) {
-		const params = new URLSearchParams({ provider });
-		if (scopes?.length) params.set("scopes", scopes.join(","));
-		return this.request(`/agent/integrations/oauth/url?${params.toString()}`);
-	}
-	async getOAuthStatus(provider) {
-		return this.request(`/agent/integrations/oauth/status?provider=${encodeURIComponent(provider)}`);
-	}
-	async getRegistry() {
-		return this.request("/integrations/registry");
-	}
+};
+//#endregion
+//#region src/domains/connect-credentials.ts
+/**
+* services/connect credential + account methods (Google, GitHub, Xero,
+* Notion, Atlassian, MYOB, Salesforce, Microsoft 365) for the Agent API client.
+*/
+var ConnectCredentialsApi = class extends ApiBase {
 	/**
 	* Returns every connected Google account for the agent. Multi-account by
 	* design — the openclaw-google plugin requires the LLM to pass `email`
@@ -265,7 +301,7 @@ var AgentApiClient = class {
 	* is gone. Iterate over `accounts`.
 	*/
 	async getGoogleCredentials() {
-		return { accounts: (await this.request("/agent/connect/google/accounts")).accounts.map((a) => ({
+		return { accounts: (await this.transport.request("/agent/connect/google/accounts")).accounts.map((a) => ({
 			email: a.accountIdentifier,
 			refreshToken: a.refreshToken ?? "",
 			clientId: a.clientId ?? "",
@@ -275,14 +311,14 @@ var AgentApiClient = class {
 		})) };
 	}
 	async disconnectGoogleAccount(email) {
-		return { accounts: (await this.request(`/agent/connect/google/accounts/${encodeURIComponent(email)}`, { method: "DELETE" })).accounts.map((a) => ({
+		return { accounts: (await this.transport.request(`/agent/connect/google/accounts/${encodeURIComponent(email)}`, { method: "DELETE" })).accounts.map((a) => ({
 			email: a.accountIdentifier,
 			displayName: a.displayName ?? void 0,
 			connectedAt: a.connectedAt
 		})) };
 	}
 	async getGoogleChatCredentials() {
-		return this.request("/agent/google-chat/credentials");
+		return this.transport.request("/agent/google-chat/credentials");
 	}
 	/**
 	* Fetch decrypted credentials for ONE specific connection by its
@@ -298,100 +334,7 @@ var AgentApiClient = class {
 	* the calling agent's effective scope (403 otherwise).
 	*/
 	async getConnectionCredentials(connectionId) {
-		return this.request(`/agent/connect/connections/${encodeURIComponent(connectionId)}/credentials`);
-	}
-	/**
-	* Resolve the primary cTrader Connection's credentials for the calling
-	* agent. Unlike most providers, the cTrader Open API needs app-level auth
-	* (`clientId` + `clientSecret`) AND account auth (`accessToken` +
-	* `accountId`) on the socket, so `@alfe.ai/ctrader-mcp` self-fetches the
-	* full set here at startup (the atlassian/google pattern). `clientId` /
-	* `clientSecret` are the SST-sourced global app credentials the connect
-	* endpoint injects — they are never persisted on the connection. `host` is
-	* the resolved TLS endpoint (`live.ctraderapi.com` / `demo.ctraderapi.com`)
-	* derived from the selected account's live/demo flag.
-	*/
-	async getCTraderCredentials() {
-		const raw = await this.request("/agent/connect/ctrader/credentials");
-		return {
-			accessToken: raw.accessToken ?? "",
-			refreshToken: raw.refreshToken ?? "",
-			accountId: raw.accountId != null ? String(raw.accountId) : "",
-			host: raw.host ?? "",
-			clientId: raw.clientId ?? "",
-			clientSecret: raw.clientSecret ?? ""
-		};
-	}
-	/**
-	* Pattern A: multi-account credential fetch for cTrader.
-	*
-	* Unlike atlassian/salesforce (one Connection row per account/site), a
-	* cTrader is MULTI-grant per agent: an agent may connect several distinct
-	* cTrader logins, each its own Connection row keyed on `accountIdentifier =
-	* ctid:<userId>` (Phase 1). This aggregates the *trading accounts* across
-	* ALL of those Connection rows — each row contributes its `availableAccounts`
-	* flattened, and every account carries ITS OWN grant's `accessToken` (the
-	* token that authenticates that account against the cTrader Open API). One
-	* OAuth grant still covers all accounts under that single login on one shared
-	* token; only the `ctidTraderAccountId` and the protobuf socket `host` (live
-	* vs demo) differ within a grant. Across grants the tokens differ, so the
-	* token is now PER-ACCOUNT rather than hoisted to the top level.
-	*
-	* `host` per account is derived from the account's `isLive` flag
-	* (`live.ctraderapi.com` / `demo.ctraderapi.com`) — the same mapping the
-	* connect provider applies server-side when an account is auto-selected.
-	*
-	* `clientId` / `clientSecret` are the SST-sourced GLOBAL app credentials the
-	* connect endpoint injects — identical across every Connection row (one
-	* cTrader app), never persisted on a connection. We take them from the first
-	* row that carries them.
-	*
-	* Accounts are deduped on `ctidTraderAccountId` first-wins: Spotware ids are
-	* globally unique across logins, so a duplicate can only appear if the same
-	* account somehow surfaced under two grants — first-wins keeps it
-	* deterministic.
-	*
-	* `accounts` may be empty (no cTrader Connection at all), in which case we
-	* return empty creds rather than throwing.
-	*/
-	async getCTraderAccounts() {
-		const raw = await this.request("/agent/connect/ctrader/accounts");
-		if (raw.accounts.length === 0) return {
-			accounts: [],
-			clientId: "",
-			clientSecret: ""
-		};
-		let clientId = "";
-		let clientSecret = "";
-		for (const row of raw.accounts) {
-			if (!clientId && row.clientId) clientId = row.clientId;
-			if (!clientSecret && row.clientSecret) clientSecret = row.clientSecret;
-			if (clientId && clientSecret) break;
-		}
-		const seen = /* @__PURE__ */ new Set();
-		const accounts = [];
-		for (const row of raw.accounts) {
-			const rowToken = row.accessToken ?? "";
-			for (const a of row.availableAccounts ?? []) {
-				const id = a.ctidTraderAccountId != null ? String(a.ctidTraderAccountId) : a.accountId != null ? String(a.accountId) : "";
-				if (id.length === 0 || seen.has(id)) continue;
-				seen.add(id);
-				const isLive = a.isLive === true;
-				accounts.push({
-					ctidTraderAccountId: id,
-					host: isLive ? "live.ctraderapi.com" : "demo.ctraderapi.com",
-					isLive,
-					...a.brokerName != null ? { brokerName: a.brokerName } : {},
-					...a.accountNumber != null ? { accountNumber: String(a.accountNumber) } : {},
-					accessToken: rowToken
-				});
-			}
-		}
-		return {
-			accounts,
-			clientId,
-			clientSecret
-		};
+		return this.transport.request(`/agent/connect/connections/${encodeURIComponent(connectionId)}/credentials`);
 	}
 	/**
 	* @deprecated Returns a single primary credential blob (legacy "pick-the-
@@ -402,7 +345,7 @@ var AgentApiClient = class {
 	* callers will keep hitting `/credentials` until they move to the proxy.
 	*/
 	async getGithubCredentials() {
-		const raw = await this.request("/agent/connect/github/credentials");
+		const raw = await this.transport.request("/agent/connect/github/credentials");
 		return {
 			login: raw.login,
 			accessToken: raw.accessToken
@@ -423,7 +366,7 @@ var AgentApiClient = class {
 	* cross-session identifier the LLM should pass.
 	*/
 	async getGithubAccounts() {
-		return { accounts: (await this.request("/agent/connect/github/accounts")).accounts.map((a) => ({
+		return { accounts: (await this.transport.request("/agent/connect/github/accounts")).accounts.map((a) => ({
 			connectionId: a.connectionId,
 			accountIdentifier: a.accountIdentifier,
 			displayName: a.displayName,
@@ -434,81 +377,13 @@ var AgentApiClient = class {
 		})) };
 	}
 	/**
-	* Pattern A: provider-parameterized multi-account credential fetch for the
-	* social connectors (Bluesky, and the approval-gated backlog: X, Meta,
-	* Threads, LinkedIn, Pinterest, TikTok, Reddit, YouTube).
-	*
-	* Unlike the bespoke `getGithubAccounts()` / `getXeroAccounts()` shapes,
-	* this returns a UNIFORM normalized account shape so `@alfe.ai/social-mcp`'s
-	* shared driver can require a single `account` selector on every
-	* credential-touching tool regardless of platform. The backend
-	* `api-agents/{provider}/accounts` route is already provider-generic; this
-	* is the client-side normalization the plan (`do-we-need-any-moonlit-toucan`
-	* Phase 0, step 5) calls for.
-	*
-	* `accountIdentifier` is the stable per-account selector the LLM should
-	* pass back (for Bluesky: the account DID). `accessToken` carries whatever
-	* the provider's `buildCredentialsResponse` bundles (for Bluesky: the JSON
-	* session bundle — the driver parses the `accessJwt` out of it, or reads the
-	* top-level `accessJwt` from `providerMetadata`-adjacent fields). Everything
-	* else the driver needs for routing (handle, pdsHost, did, …) is on
-	* `providerMetadata`.
-	*
-	* Token refresh is delegated to connect (never done in-plugin) via the
-	* per-account route `POST /agent/connect/{provider}/accounts/{accountIdentifier}/refresh`
-	* — call `refreshSocialAccount(provider, accountIdentifier)`. (The non-account
-	* `POST /agent/connect/{provider}/refresh` route refreshes the provider's
-	* PRIMARY connection, which is wrong under multi-account Pattern A.)
+	* @deprecated Returns a single primary credential blob (legacy "pick-the-
+	* default-connection" shape). Use `getXeroAccounts()` for the multi-
+	* account shape required by Pattern A — explicit selector args on every
+	* tool. This method will be removed once all consumers migrate.
 	*/
-	async getSocialAccounts(provider) {
-		const raw = await this.request(`/agent/connect/${encodeURIComponent(provider)}/accounts`);
-		return {
-			provider: raw.provider ?? provider,
-			accounts: raw.accounts.map((a) => ({
-				connectionId: a.connectionId,
-				accountIdentifier: a.accountIdentifier,
-				displayName: a.displayName,
-				accessToken: a.accessToken ?? "",
-				providerMetadata: a.providerMetadata ?? {},
-				connectedAt: a.connectedAt
-			}))
-		};
-	}
-	/**
-	* Pattern A: refresh a specific social Connection by its stable
-	* `accountIdentifier` (for Bluesky: the account DID) via the
-	* provider-generic per-account refresh route. The counterpart to
-	* `getSocialAccounts(provider)`; `@alfe.ai/social-mcp` calls this on a
-	* 401/ExpiredToken from the platform PDS/API, then re-fetches accounts to
-	* pick up the rotated bundle.
-	*
-	* Refresh itself is ALWAYS delegated to connect — the plugin never calls
-	* the platform's own refresh XRPC (e.g. `com.atproto.server.refreshSession`)
-	* because connect owns the encrypted refresh token + rotation persistence
-	* (Bluesky rotates the refreshJwt; a missed rotation kills the connection
-	* after one refresh). The returned `accessToken` is whatever the provider's
-	* `refreshToken` hook re-bundled (for Bluesky: the JSON session bundle with
-	* the fresh `accessJwt`) — callers typically ignore it and re-fetch via
-	* `getSocialAccounts` for a consistent shape.
-	*/
-	async refreshSocialAccount(provider, accountIdentifier) {
-		const path = `/agent/connect/${encodeURIComponent(provider)}/accounts/${encodeURIComponent(accountIdentifier)}/refresh`;
-		const raw = await this.request(path, { method: "POST" });
-		return {
-			accountIdentifier: raw.accountIdentifier,
-			accessToken: raw.accessToken,
-			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
-			expiresAt: raw.expiresAt ?? ""
-		};
-	}
-	/**
-	* @deprecated Returns a single primary credential blob (legacy "pick-the-
-	* default-connection" shape). Use `getXeroAccounts()` for the multi-
-	* account shape required by Pattern A — explicit selector args on every
-	* tool. This method will be removed once all consumers migrate.
-	*/
-	async getXeroCredentials() {
-		const raw = await this.request("/agent/connect/xero/credentials");
+	async getXeroCredentials() {
+		const raw = await this.transport.request("/agent/connect/xero/credentials");
 		return {
 			accessToken: raw.accessToken,
 			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
@@ -521,32 +396,33 @@ var AgentApiClient = class {
 	* selector arg (e.g. `xeroTenantId`) on every credential-touching tool
 	* and look up the matching account by that selector at dispatch time.
 	*
-	* Returned `accounts[i].accountIdentifier` is the Xero tenantId — the
-	* stable cross-session identifier the LLM should pass.
+	* `xeroTenantId` is the model-facing organisation selector. The separate
+	* `accountIdentifier` is the Connect persistence key used for refresh and
+	* may be an email; never substitute one for the other.
 	*/
 	async getXeroAccounts() {
-		return { accounts: (await this.request("/agent/connect/xero/accounts")).accounts.map((a) => ({
+		return { accounts: (await this.transport.request("/agent/connect/xero/accounts")).accounts.map((a) => ({
 			connectionId: a.connectionId,
 			accountIdentifier: a.accountIdentifier,
 			displayName: a.displayName,
 			connectedAt: a.connectedAt,
 			accessToken: a.accessToken,
 			accessTokenExpiresAt: a.accessTokenExpiresAt ?? "",
-			xeroTenantId: a.xeroTenantId ?? a.accountIdentifier
+			xeroTenantId: a.xeroTenantId ?? ""
 		})) };
 	}
 	async refreshXeroToken() {
-		return this.request("/agent/connect/xero/refresh", { method: "POST" });
+		return this.transport.request("/agent/connect/xero/refresh", { method: "POST" }, { retry: true });
 	}
 	/**
-	* Pattern A: refresh a specific Xero connection by its `accountIdentifier`
-	* (the Xero `tenantId`). The legacy `refreshXeroToken()` only refreshes
-	* the *primary* connection, which is wrong for multi-tenant Xero where
-	* each tenant has its own non-interchangeable access token.
+	* Refresh a specific Xero Connection by its exact `accountIdentifier` from
+	* `getXeroAccounts()`. Do not substitute `xeroTenantId`: current Xero OAuth
+	* rows may use the account email as their persistence key even when a sole
+	* organisation tenant ID is available in provider metadata.
 	*/
-	async refreshXeroAccountToken(xeroTenantId) {
-		const path = `/agent/connect/xero/accounts/${encodeURIComponent(xeroTenantId)}/refresh`;
-		const raw = await this.request(path, { method: "POST" });
+	async refreshXeroAccountToken(accountIdentifier) {
+		const path = `/agent/connect/xero/accounts/${encodeURIComponent(accountIdentifier)}/refresh`;
+		const raw = await this.transport.request(path, { method: "POST" }, { retry: true });
 		return {
 			accessToken: raw.accessToken,
 			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
@@ -559,7 +435,7 @@ var AgentApiClient = class {
 	* account shape required by Pattern A.
 	*/
 	async getNotionCredentials() {
-		const raw = await this.request("/agent/connect/notion/credentials");
+		const raw = await this.transport.request("/agent/connect/notion/credentials");
 		return {
 			accessToken: raw.accessToken,
 			workspaceId: raw.workspaceId ?? "",
@@ -574,7 +450,7 @@ var AgentApiClient = class {
 	* Returned `accounts[i].accountIdentifier` is the Notion workspaceId.
 	*/
 	async getNotionAccounts() {
-		return { accounts: (await this.request("/agent/connect/notion/accounts")).accounts.map((a) => ({
+		return { accounts: (await this.transport.request("/agent/connect/notion/accounts")).accounts.map((a) => ({
 			connectionId: a.connectionId,
 			accountIdentifier: a.accountIdentifier,
 			displayName: a.displayName,
@@ -593,7 +469,7 @@ var AgentApiClient = class {
 	* the `cloudId` selector arg.
 	*/
 	async getAtlassianCredentials() {
-		const raw = await this.request("/agent/connect/atlassian/credentials");
+		const raw = await this.transport.request("/agent/connect/atlassian/credentials");
 		return {
 			accessToken: raw.accessToken,
 			refreshToken: "",
@@ -608,7 +484,7 @@ var AgentApiClient = class {
 		};
 	}
 	async refreshAtlassianToken() {
-		return this.request("/agent/connect/atlassian/refresh", { method: "POST" });
+		return this.transport.request("/agent/connect/atlassian/refresh", { method: "POST" }, { retry: true });
 	}
 	/**
 	* Pattern A: multi-account / multi-site credential fetch for Atlassian.
@@ -633,7 +509,7 @@ var AgentApiClient = class {
 	* instead.
 	*/
 	async getAtlassianAccounts() {
-		return { accounts: (await this.request("/agent/connect/atlassian/accounts")).accounts.map((a) => ({
+		return { accounts: (await this.transport.request("/agent/connect/atlassian/accounts")).accounts.map((a) => ({
 			connectionId: a.connectionId,
 			accountIdentifier: a.accountIdentifier,
 			displayName: a.displayName,
@@ -664,7 +540,7 @@ var AgentApiClient = class {
 	*/
 	async refreshAtlassianAccountToken(accountIdentifier) {
 		const path = `/agent/connect/atlassian/accounts/${encodeURIComponent(accountIdentifier)}/refresh`;
-		const raw = await this.request(path, { method: "POST" });
+		const raw = await this.transport.request(path, { method: "POST" }, { retry: true });
 		return {
 			accessToken: raw.accessToken,
 			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
@@ -677,7 +553,7 @@ var AgentApiClient = class {
 	* account shape required by Pattern A.
 	*/
 	async getMYOBCredentials() {
-		const raw = await this.request("/agent/connect/myob/credentials");
+		const raw = await this.transport.request("/agent/connect/myob/credentials");
 		return {
 			accessToken: raw.accessToken,
 			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
@@ -694,7 +570,7 @@ var AgentApiClient = class {
 	* Returned `accounts[i].accountIdentifier` is the MYOB businessId.
 	*/
 	async getMYOBAccounts() {
-		return { accounts: (await this.request("/agent/connect/myob/accounts")).accounts.map((a) => ({
+		return { accounts: (await this.transport.request("/agent/connect/myob/accounts")).accounts.map((a) => ({
 			connectionId: a.connectionId,
 			accountIdentifier: a.accountIdentifier,
 			displayName: a.displayName,
@@ -706,7 +582,26 @@ var AgentApiClient = class {
 		})) };
 	}
 	async refreshMYOBToken() {
-		return this.request("/agent/connect/myob/refresh", { method: "POST" });
+		return this.transport.request("/agent/connect/myob/refresh", { method: "POST" }, { retry: true });
+	}
+	/**
+	* Pattern A: refresh one MYOB Connection by its stable
+	* `accountIdentifier` (the MYOB business id returned by
+	* `getMYOBAccounts()`).
+	*
+	* MYOB refresh tokens belong to individual Connection rows. A
+	* multi-business client must use this method instead of refreshing the
+	* primary Connection and copying that access token into every cached
+	* business client.
+	*/
+	async refreshMYOBAccountToken(accountIdentifier) {
+		const path = `/agent/connect/myob/accounts/${encodeURIComponent(accountIdentifier)}/refresh`;
+		const raw = await this.transport.request(path, { method: "POST" }, { retry: true });
+		return {
+			accessToken: raw.accessToken,
+			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
+			expiresAt: raw.expiresAt ?? ""
+		};
 	}
 	/**
 	* @deprecated Returns a single primary credential blob. Use
@@ -714,7 +609,7 @@ var AgentApiClient = class {
 	* Pattern A.
 	*/
 	async getSalesforceCredentials() {
-		const raw = await this.request("/agent/connect/salesforce/credentials");
+		const raw = await this.transport.request("/agent/connect/salesforce/credentials");
 		return {
 			accessToken: raw.accessToken,
 			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
@@ -729,7 +624,7 @@ var AgentApiClient = class {
 	* the selector every credential-touching tool requires.
 	*/
 	async getSalesforceAccounts() {
-		return { accounts: (await this.request("/agent/connect/salesforce/accounts")).accounts.map((a) => ({
+		return { accounts: (await this.transport.request("/agent/connect/salesforce/accounts")).accounts.map((a) => ({
 			connectionId: a.connectionId,
 			accountIdentifier: a.accountIdentifier,
 			displayName: a.displayName,
@@ -747,7 +642,7 @@ var AgentApiClient = class {
 	*/
 	async refreshSalesforceAccountToken(orgId) {
 		const path = `/agent/connect/salesforce/accounts/${encodeURIComponent(orgId)}/refresh`;
-		const raw = await this.request(path, { method: "POST" });
+		const raw = await this.transport.request(path, { method: "POST" }, { retry: true });
 		return {
 			accessToken: raw.accessToken,
 			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
@@ -755,70 +650,6 @@ var AgentApiClient = class {
 		};
 	}
 	/**
-	* @deprecated Returns a single primary credential blob. Use
-	* `getShopifyAccounts()` for the multi-account shape required by Pattern A
-	* (`@alfe.ai/shopify-mcp` keys per-shop on the myshopify domain).
-	*/
-	async getShopifyCredentials() {
-		const raw = await this.request("/agent/connect/shopify/credentials");
-		return {
-			accessToken: raw.accessToken,
-			shopDomain: raw.shopDomain ?? "",
-			shopGid: raw.shopGid ?? "",
-			shopName: raw.shopName ?? "",
-			apiVersion: raw.apiVersion ?? ""
-		};
-	}
-	/**
-	* Pattern A: multi-account credential fetch for Shopify. Returns every
-	* agent-scoped Shopify Connection. One OAuth grant maps to one store, so the
-	* stable per-call selector is the store's myshopify domain (`shopDomain`),
-	* NOT `accountIdentifier` — the connect provider keys `accountIdentifier` on
-	* the immutable shop GID (falling back to the domain), so `shopDomain` is the
-	* value the LLM passes and the plugin routes on.
-	*
-	* Each entry is shaped by the connect provider's `buildCredentialsResponse`:
-	* `{ accessToken, shopDomain, shopGid, shopName, apiVersion }` — offline
-	* Shopify tokens never expire, so there is NO token / expiry field and no
-	* refresh method (unlike Salesforce). The GraphQL Admin API authenticates
-	* purely on `X-Shopify-Access-Token`; no client credentials are on the wire.
-	*/
-	async getShopifyAccounts() {
-		return { accounts: (await this.request("/agent/connect/shopify/accounts")).accounts.map((a) => ({
-			connectionId: a.connectionId,
-			accountIdentifier: a.accountIdentifier,
-			displayName: a.displayName,
-			connectedAt: a.connectedAt,
-			accessToken: a.accessToken,
-			shopDomain: a.shopDomain ?? "",
-			shopGid: a.shopGid ?? "",
-			shopName: a.shopName ?? "",
-			apiVersion: a.apiVersion ?? ""
-		})) };
-	}
-	/**
-	* Disconnects one connected Microsoft 365 account for the agent, by its
-	* `accountIdentifier`. Hits the generic per-account disconnect route
-	* (`DELETE /agent/connect/microsoft/accounts/{accountIdentifier}`), which
-	* resolves across the agent's full effective scope chain and deletes the
-	* matching Connection row. Returns the remaining accounts.
-	*
-	* IMPORTANT: pass the `accountIdentifier` from `getMicrosoftAccounts()`, NOT
-	* a synthesised email. For Microsoft, `accountIdentifier` is the user's email
-	* only when the Graph profile fetch succeeded at connect time; it falls back
-	* to the Azure tenant id (`tid` claim) otherwise. The backend matches on
-	* `accountIdentifier` exactly, so passing an email would 404 on those
-	* fallback-identifier accounts. (This is why the param is not named `email`,
-	* unlike `disconnectGoogleAccount` where the identifier is always the email.)
-	*/
-	async disconnectMicrosoftAccount(accountIdentifier) {
-		return { accounts: (await this.request(`/agent/connect/microsoft/accounts/${encodeURIComponent(accountIdentifier)}`, { method: "DELETE" })).accounts.map((a) => ({
-			accountIdentifier: a.accountIdentifier,
-			displayName: a.displayName ?? void 0,
-			connectedAt: a.connectedAt
-		})) };
-	}
-	/**
 	* Pattern A: multi-account credential fetch for Microsoft 365.
 	*
 	* Returns every agent-scoped Microsoft connection. The caller is expected
@@ -834,16 +665,13 @@ var AgentApiClient = class {
 	* interchangeable across (tenant, user) pairs.
 	*/
 	async getMicrosoftAccounts() {
-		return { accounts: (await this.request("/agent/connect/microsoft/accounts")).accounts.map((a) => ({
+		return { accounts: (await this.transport.request("/agent/connect/microsoft/accounts")).accounts.map((a) => ({
 			connectionId: a.connectionId,
 			accountIdentifier: a.accountIdentifier,
 			displayName: a.displayName,
 			connectedAt: a.connectedAt,
 			accessToken: a.accessToken ?? "",
 			accessTokenExpiresAt: a.accessTokenExpiresAt ?? "",
-			refreshToken: a.refreshToken ?? "",
-			clientId: a.clientId ?? "",
-			clientSecret: a.clientSecret ?? "",
 			email: a.email ?? a.accountIdentifier,
 			microsoftTenantId: a.microsoftTenantId ?? "",
 			workspaceDomain: a.workspaceDomain ?? ""
@@ -865,249 +693,261 @@ var AgentApiClient = class {
 	*/
 	async refreshMicrosoftAccountToken(accountIdentifier) {
 		const path = `/agent/connect/microsoft/accounts/${encodeURIComponent(accountIdentifier)}/refresh`;
-		const raw = await this.request(path, { method: "POST" });
+		const raw = await this.transport.request(path, { method: "POST" }, { retry: true });
 		return {
 			accessToken: raw.accessToken,
 			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
 			expiresAt: raw.expiresAt ?? ""
 		};
 	}
-	async getTeamsCredentials() {
-		return this.request("/agent/microsoft/credentials");
-	}
-	async sendTeamsMessage(data) {
-		return this.request("/agent/microsoft/send", {
-			method: "POST",
-			body: JSON.stringify(data)
-		});
-	}
-	async listTeamsChannels() {
-		return this.request("/agent/microsoft/channels");
-	}
-	async presignAttachments(files) {
-		return this.request("/agent/chat/attachments/presign", {
-			method: "POST",
-			body: JSON.stringify({ files })
-		});
-	}
 	/**
-	* Generate an image from a text prompt and get back a STABLE, public URL
-	* (served from the agent-assets CDN — it does not expire). Embed the returned
-	* `imageUrl` in a reply as markdown to show it to the user.
-	*
-	* ASYNC: `gpt-image-1` routinely runs 30–60s, which exceeds the API Gateway
-	* 30s ceiling, so this enqueues a job (`POST /agent/images/generate` →
-	* `jobId`) then polls (`GET /agent/images/{jobId}`) until it completes. The
-	* worker's real failure message (e.g. an unsupported `size`) surfaces via the
-	* job's `error` field.
-	*/
-	async generateImage(args) {
-		const headers = new Headers();
-		headers.set("Authorization", `Bearer ${this.apiKey}`);
-		headers.set("Content-Type", "application/json");
-		const enqueueRes = await fetch(`${this.apiUrl}/agent/images/generate`, {
-			method: "POST",
-			headers,
-			body: JSON.stringify(args),
-			signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
-		});
-		if (!enqueueRes.ok) throw new Error(`Image generation failed to start (${String(enqueueRes.status)})`);
-		const { data: enqueued } = await enqueueRes.json();
-		const jobId = enqueued.jobId;
-		const deadline = Date.now() + IMAGE_JOB_TIMEOUT_MS;
-		while (Date.now() < deadline) {
-			await sleep(IMAGE_POLL_INTERVAL_MS);
-			let job;
-			try {
-				job = await this.request(`/agent/images/${jobId}`);
-			} catch {
-				continue;
-			}
-			if (job.status === "completed") {
-				if (!job.imageUrl) throw new Error("Image generation completed without a URL");
-				return {
-					imageUrl: job.imageUrl,
-					model: job.model ?? args.model ?? "gpt-image-1"
-				};
-			}
-			if (job.status === "failed") {
-				const detail = job.error ? `: ${job.error.split("\n")[0]}` : "";
-				throw new Error(`Image generation failed${detail}`);
-			}
-		}
-		throw new Error("Image generation timed out");
-	}
-	async recordActivity(data) {
-		return this.request("/agent/activity", {
-			method: "POST",
-			body: JSON.stringify(data)
-		});
-	}
-	/** Update the agent's own name and/or voice config. Returns the updated agent. */
-	async updateSelf(update) {
-		return this.request("/agent/self", {
-			method: "PATCH",
-			body: JSON.stringify(update)
-		});
-	}
-	/**
-	* Generate the agent's own avatar from a text prompt. The image is generated,
-	* stored, and set on the agent server-side; returns the updated agent.
+	* Disconnects one connected Microsoft 365 account for the agent, by its
+	* `accountIdentifier`. Hits the generic per-account disconnect route
+	* (`DELETE /agent/connect/microsoft/accounts/{accountIdentifier}`), which
+	* resolves across the agent's full effective scope chain and deletes the
+	* matching Connection row. Returns the remaining accounts.
 	*
-	* ASYNC (same reason as `generateImage`): avatar gen runs `gpt-image-1`
-	* (30–60s) which exceeds the API Gateway 30s ceiling, so this enqueues a job
-	* (`POST /agent/avatar/generate` → `jobId`) then polls (`GET /agent/avatar/{jobId}`)
-	* until the avatar is set. Signature unchanged — the plugin is unaffected.
+	* IMPORTANT: pass the `accountIdentifier` from `getMicrosoftAccounts()`, NOT
+	* a synthesised email. For Microsoft, `accountIdentifier` is the user's email
+	* only when the Graph profile fetch succeeded at connect time; it falls back
+	* to the Azure tenant id (`tid` claim) otherwise. The backend matches on
+	* `accountIdentifier` exactly, so passing an email would 404 on those
+	* fallback-identifier accounts. (This is why the param is not named `email`,
+	* unlike `disconnectGoogleAccount` where the identifier is always the email.)
 	*/
-	async generateAvatar(args) {
-		const headers = new Headers();
-		headers.set("Authorization", `Bearer ${this.apiKey}`);
-		headers.set("Content-Type", "application/json");
-		const enqueueRes = await fetch(`${this.apiUrl}/agent/avatar/generate`, {
-			method: "POST",
-			headers,
-			body: JSON.stringify(args),
-			signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
-		});
-		if (!enqueueRes.ok) throw new Error(`Avatar generation failed to start (${String(enqueueRes.status)})`);
-		const { data: enqueued } = await enqueueRes.json();
-		const jobId = enqueued.jobId;
-		const deadline = Date.now() + IMAGE_JOB_TIMEOUT_MS;
-		while (Date.now() < deadline) {
-			await sleep(IMAGE_POLL_INTERVAL_MS);
-			let job;
-			try {
-				job = await this.request(`/agent/avatar/${jobId}`);
-			} catch {
-				continue;
-			}
-			if (job.status === "completed") {
-				if (!job.agent) throw new Error("Avatar generation completed without an agent");
-				return job.agent;
-			}
-			if (job.status === "failed") {
-				const detail = job.error ? `: ${job.error.split("\n")[0]}` : "";
-				throw new Error(`Avatar generation failed${detail}`);
-			}
-		}
-		throw new Error("Avatar generation timed out");
+	async disconnectMicrosoftAccount(accountIdentifier) {
+		return { accounts: (await this.transport.request(`/agent/connect/microsoft/accounts/${encodeURIComponent(accountIdentifier)}`, { method: "DELETE" })).accounts.map((a) => ({
+			accountIdentifier: a.accountIdentifier,
+			displayName: a.displayName ?? void 0,
+			connectedAt: a.connectedAt
+		})) };
 	}
 	/**
-	* Get a presigned PUT URL to upload a new avatar image. Upload the bytes to
-	* `uploadUrl`, then call `finalizeAvatar(s3Key)` to set it on the agent.
+	* Resolve the primary cTrader Connection's credentials for the calling
+	* agent. Unlike most providers, the cTrader Open API needs app-level auth
+	* (`clientId` + `clientSecret`) AND account auth (`accessToken` +
+	* `accountId`) on the socket, so `@alfe.ai/ctrader-mcp` self-fetches the
+	* full set here at startup (the atlassian/google pattern). `clientId` /
+	* `clientSecret` are the SST-sourced global app credentials the connect
+	* endpoint injects — they are never persisted on the connection. `host` is
+	* the resolved TLS endpoint (`live.ctraderapi.com` / `demo.ctraderapi.com`)
+	* derived from the selected account's live/demo flag.
 	*/
-	async presignAvatar(args) {
-		return this.request("/agent/avatar/presign", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
+	async getCTraderCredentials() {
+		const raw = await this.transport.request("/agent/connect/ctrader/credentials");
+		return {
+			accessToken: raw.accessToken ?? "",
+			refreshToken: raw.refreshToken ?? "",
+			accountId: raw.accountId != null ? String(raw.accountId) : "",
+			host: raw.host ?? "",
+			clientId: raw.clientId ?? "",
+			clientSecret: raw.clientSecret ?? ""
+		};
 	}
 	/**
-	* Finalize an avatar upload — validates ownership + size, then sets the
-	* agent's `avatarUrl` server-side. Returns the updated agent.
-	*/
-	async finalizeAvatar(s3Key) {
-		return this.request("/agent/avatar", {
-			method: "POST",
-			body: JSON.stringify({ s3Key })
-		});
-	}
-	/** List the platform voice catalogue (ElevenLabs) so the agent can pick its own voice. */
-	async listVoices() {
-		return this.request("/agent/voices");
+	* Pattern A: multi-account credential fetch for cTrader.
+	*
+	* Unlike atlassian/salesforce (one Connection row per account/site), a
+	* cTrader is MULTI-grant per agent: an agent may connect several distinct
+	* cTrader logins, each its own Connection row keyed on `accountIdentifier =
+	* ctid:<userId>` (Phase 1). This aggregates the *trading accounts* across
+	* ALL of those Connection rows — each row contributes its `availableAccounts`
+	* flattened, and every account carries ITS OWN grant's `accessToken` (the
+	* token that authenticates that account against the cTrader Open API). One
+	* OAuth grant still covers all accounts under that single login on one shared
+	* token; only the `ctidTraderAccountId` and the protobuf socket `host` (live
+	* vs demo) differ within a grant. Across grants the tokens differ, so the
+	* token is now PER-ACCOUNT rather than hoisted to the top level.
+	*
+	* `host` per account is derived from the account's `isLive` flag
+	* (`live.ctraderapi.com` / `demo.ctraderapi.com`) — the same mapping the
+	* connect provider applies server-side when an account is auto-selected.
+	*
+	* `clientId` / `clientSecret` are the SST-sourced GLOBAL app credentials the
+	* connect endpoint injects — identical across every Connection row (one
+	* cTrader app), never persisted on a connection. We take them from the first
+	* row that carries them.
+	*
+	* Accounts are deduped on `ctidTraderAccountId` first-wins: Spotware ids are
+	* globally unique across logins, so a duplicate can only appear if the same
+	* account somehow surfaced under two grants — first-wins keeps it
+	* deterministic.
+	*
+	* `accounts` may be empty (no cTrader Connection at all), in which case we
+	* return empty creds rather than throwing.
+	*/
+	async getCTraderAccounts() {
+		const raw = await this.transport.request("/agent/connect/ctrader/accounts");
+		if (raw.accounts.length === 0) return {
+			accounts: [],
+			clientId: "",
+			clientSecret: ""
+		};
+		let clientId = "";
+		let clientSecret = "";
+		for (const row of raw.accounts) {
+			if (!clientId && row.clientId) clientId = row.clientId;
+			if (!clientSecret && row.clientSecret) clientSecret = row.clientSecret;
+			if (clientId && clientSecret) break;
+		}
+		const seen = /* @__PURE__ */ new Set();
+		const accounts = [];
+		for (const row of raw.accounts) {
+			const rowToken = row.accessToken ?? "";
+			for (const a of row.availableAccounts ?? []) {
+				const id = a.ctidTraderAccountId != null ? String(a.ctidTraderAccountId) : a.accountId != null ? String(a.accountId) : "";
+				if (id.length === 0 || seen.has(id)) continue;
+				seen.add(id);
+				const isLive = a.isLive === true;
+				accounts.push({
+					ctidTraderAccountId: id,
+					host: isLive ? "live.ctraderapi.com" : "demo.ctraderapi.com",
+					isLive,
+					...a.brokerName != null ? { brokerName: a.brokerName } : {},
+					...a.accountNumber != null ? { accountNumber: String(a.accountNumber) } : {},
+					accessToken: rowToken
+				});
+			}
+		}
+		return {
+			accounts,
+			clientId,
+			clientSecret
+		};
 	}
 	/**
-	* Mint a fresh AES-256 data key for a specific (secret, field) pair. The
-	* encryption context is rebuilt server-side from `auth.tenantId` + the body
-	* fields including `fieldKey`; the agent cannot forge context for a scope
-	* or field it doesn't own. Legacy single-envelope secrets are migrated to
-	* `field#value` rows by the data migration, so call with `fieldKey: "value"`
-	* to reach them.
+	* @deprecated Returns a single primary credential blob. Use
+	* `getShopifyAccounts()` for the multi-account shape required by Pattern A
+	* (`@alfe.ai/shopify-mcp` keys per-shop on the myshopify domain).
 	*/
-	async generateSecretDataKey(args) {
-		return this.request("/agent/secrets/generate-data-key", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
+	async getShopifyCredentials() {
+		const raw = await this.transport.request("/agent/connect/shopify/credentials");
+		return {
+			accessToken: raw.accessToken,
+			shopDomain: raw.shopDomain ?? "",
+			shopGid: raw.shopGid ?? "",
+			shopName: raw.shopName ?? "",
+			apiVersion: raw.apiVersion ?? ""
+		};
 	}
 	/**
-	* Unwrap a wrapped data key so the agent can decrypt the envelope locally.
-	* `fieldKey` MUST match the value supplied when the data key was generated
-	* (it's bound into KMS encryption context); mismatch fails with
-	* `InvalidCiphertextException`.
+	* Pattern A: multi-account credential fetch for Shopify. Returns every
+	* agent-scoped Shopify Connection. One OAuth grant maps to one store, so the
+	* stable per-call selector is the store's myshopify domain (`shopDomain`),
+	* NOT `accountIdentifier` — the connect provider keys `accountIdentifier` on
+	* the immutable shop GID (falling back to the domain), so `shopDomain` is the
+	* value the LLM passes and the plugin routes on.
+	*
+	* Each entry is shaped by the connect provider's `buildCredentialsResponse`:
+	* `{ accessToken, shopDomain, shopGid, shopName, apiVersion }` — offline
+	* Shopify tokens never expire, so there is NO token / expiry field and no
+	* refresh method (unlike Salesforce). The GraphQL Admin API authenticates
+	* purely on `X-Shopify-Access-Token`; no client credentials are on the wire.
 	*/
-	async decryptSecretDataKey(args) {
-		return this.request("/agent/secrets/decrypt-data-key", {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
+	async getShopifyAccounts() {
+		return { accounts: (await this.transport.request("/agent/connect/shopify/accounts")).accounts.map((a) => ({
+			connectionId: a.connectionId,
+			accountIdentifier: a.accountIdentifier,
+			displayName: a.displayName,
+			connectedAt: a.connectedAt,
+			accessToken: a.accessToken,
+			shopDomain: a.shopDomain ?? "",
+			shopGid: a.shopGid ?? "",
+			shopName: a.shopName ?? "",
+			apiVersion: a.apiVersion ?? ""
+		})) };
 	}
 	/**
-	* Create a new secret with one or more fields. Encrypted fields must arrive
-	* pre-sealed (the agent has already obtained per-field data keys via
-	* `generateSecretDataKey({ ..., fieldKey })` and AES-encrypted locally).
-	* Plaintext fields ship the value inline.
+	* Pattern A: provider-parameterized multi-account credential fetch for the
+	* social connectors (Bluesky, and the approval-gated backlog: X, Meta,
+	* Threads, LinkedIn, Pinterest, TikTok, Reddit, YouTube).
+	*
+	* Unlike the bespoke `getGithubAccounts()` / `getXeroAccounts()` shapes,
+	* this returns a UNIFORM normalized account shape so `@alfe.ai/social-mcp`'s
+	* shared driver can require a single `account` selector on every
+	* credential-touching tool regardless of platform. The backend
+	* `api-agents/{provider}/accounts` route is already provider-generic; this
+	* is the client-side normalization the plan (`do-we-need-any-moonlit-toucan`
+	* Phase 0, step 5) calls for.
+	*
+	* `accountIdentifier` is the stable per-account selector the LLM should
+	* pass back (for Bluesky: the account DID). `accessToken` carries whatever
+	* the provider's `buildCredentialsResponse` bundles (for Bluesky: the JSON
+	* session bundle — the driver parses the `accessJwt` out of it, or reads the
+	* top-level `accessJwt` from `providerMetadata`-adjacent fields). Everything
+	* else the driver needs for routing (handle, pdsHost, did, …) is on
+	* `providerMetadata`.
+	*
+	* Token refresh is delegated to connect (never done in-plugin) via the
+	* per-account route `POST /agent/connect/{provider}/accounts/{accountIdentifier}/refresh`
+	* — call `refreshSocialAccount(provider, accountIdentifier)`. (The non-account
+	* `POST /agent/connect/{provider}/refresh` route refreshes the provider's
+	* PRIMARY connection, which is wrong under multi-account Pattern A.)
 	*/
-	async createSecret(args) {
-		const { scope, scopeId, secretId, ...body } = args;
-		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`, {
-			method: "PUT",
-			body: JSON.stringify(body)
-		});
-	}
-	/** Fetch the secret aggregate plus per-field encrypted envelopes. */
-	async getSecret(args) {
-		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`);
-	}
-	/** Fetch one field. Plaintext: value inline. Encrypted: envelope. */
-	async getSecretField(args) {
-		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/fields/${encodeURIComponent(args.fieldKey)}`);
-	}
-	/** Add OR rotate one field. */
-	async setSecretField(args) {
-		const { scope, scopeId, secretId, fieldKey, ...body } = args;
-		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}/fields/${encodeURIComponent(fieldKey)}`, {
-			method: "PUT",
-			body: JSON.stringify(body)
-		});
-	}
-	/** Remove one field. */
-	async removeSecretField(args) {
-		await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/fields/${encodeURIComponent(args.fieldKey)}`, { method: "DELETE" });
-	}
-	/** Update secret-level metadata (name/description/tags/category). */
-	async updateSecretMetadata(args) {
-		const { scope, scopeId, secretId, ...body } = args;
-		return this.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`, {
-			method: "PATCH",
-			body: JSON.stringify(body)
-		});
-	}
-	/** List metadata for secrets in a scope. Optional filters route through the byFacet GSI. */
-	async listSecrets(args) {
-		const params = new URLSearchParams();
-		if (args.category) params.set("category", args.category);
-		if (args.tag) params.set("tag", args.tag);
-		if (args.fieldKey) params.set("fieldKey", args.fieldKey);
-		const qs = params.toString();
-		return (await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}${qs ? `?${qs}` : ""}`)).secrets;
+	async getSocialAccounts(provider) {
+		const raw = await this.transport.request(`/agent/connect/${encodeURIComponent(provider)}/accounts`);
+		return {
+			provider: raw.provider ?? provider,
+			accounts: raw.accounts.map((a) => ({
+				connectionId: a.connectionId,
+				accountIdentifier: a.accountIdentifier,
+				displayName: a.displayName,
+				accessToken: a.accessToken ?? "",
+				providerMetadata: a.providerMetadata ?? {},
+				connectedAt: a.connectedAt
+			}))
+		};
 	}
-	/** Bounded changelog read — metadata-only audit entries. */
-	async getSecretHistory(args) {
-		const params = new URLSearchParams();
-		if (args.limit) params.set("limit", String(args.limit));
-		if (args.cursor) params.set("cursor", args.cursor);
-		const qs = params.toString();
-		return this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/history${qs ? `?${qs}` : ""}`);
+	/**
+	* Pattern A: refresh a specific social Connection by its stable
+	* `accountIdentifier` (for Bluesky: the account DID) via the
+	* provider-generic per-account refresh route. The counterpart to
+	* `getSocialAccounts(provider)`; `@alfe.ai/social-mcp` calls this on a
+	* 401/ExpiredToken from the platform PDS/API, then re-fetches accounts to
+	* pick up the rotated bundle.
+	*
+	* Refresh itself is ALWAYS delegated to connect — the plugin never calls
+	* the platform's own refresh XRPC (e.g. `com.atproto.server.refreshSession`)
+	* because connect owns the encrypted refresh token + rotation persistence
+	* (Bluesky rotates the refreshJwt; a missed rotation kills the connection
+	* after one refresh). The returned `accessToken` is whatever the provider's
+	* `refreshToken` hook re-bundled (for Bluesky: the JSON session bundle with
+	* the fresh `accessJwt`) — callers typically ignore it and re-fetch via
+	* `getSocialAccounts` for a consistent shape.
+	*/
+	async refreshSocialAccount(provider, accountIdentifier) {
+		const path = `/agent/connect/${encodeURIComponent(provider)}/accounts/${encodeURIComponent(accountIdentifier)}/refresh`;
+		const raw = await this.transport.request(path, { method: "POST" }, { retry: true });
+		return {
+			accountIdentifier: raw.accountIdentifier,
+			accessToken: raw.accessToken,
+			accessTokenExpiresAt: raw.accessTokenExpiresAt ?? "",
+			expiresAt: raw.expiresAt ?? ""
+		};
 	}
-	/** Delete a secret (and all its field rows + tag rows + changelog rows). */
-	async deleteSecret(args) {
-		await this.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`, { method: "DELETE" });
+};
+//#endregion
+//#region src/domains/database.ts
+/**
+* Per-tenant MongoDB methods (services/database) for the Agent API client.
+*/
+var DatabaseApi = class extends ApiBase {
+	async registerDatabaseCredentials() {
+		return this.transport.request("/agent/database/register", { method: "POST" });
 	}
-	/** Enumerate scopes (org/team/project/agent) this agent can access. */
-	async listSecretScopes() {
-		return (await this.request("/agent/secrets/scopes")).scopes;
+	async reportDatabaseAudit(entry) {
+		await this.transport.request("/agent/database/audit", {
+			method: "POST",
+			body: JSON.stringify(entry)
+		}).catch(() => {});
 	}
+};
+//#endregion
+//#region src/domains/identity.ts
+/**
+* Identity resolution, verification, and CRM methods for the Agent API client.
+*/
+var IdentityApi = class extends ApiBase {
 	/**
 	* Returns the calling agent's own identity context — `{ agentId, tenantId }`
 	* decoded server-side from the agent API token. Used by the
@@ -1118,10 +958,10 @@ var AgentApiClient = class {
 	* per-call use.
 	*/
 	async whoami() {
-		return this.request("/agent/identity/whoami");
+		return this.transport.request("/agent/identity/whoami");
 	}
 	async resolveIdentity(args) {
-		return this.request("/agent/identity/resolve", {
+		return this.transport.request("/agent/identity/resolve", {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
@@ -1132,31 +972,28 @@ var AgentApiClient = class {
 		if (args?.status) qs.set("status", args.status);
 		if (args?.limit) qs.set("limit", String(args.limit));
 		const query = qs.toString();
-		return this.request(`/agent/identity/search${query ? `?${query}` : ""}`);
+		return this.transport.request(`/agent/identity/search${query ? `?${query}` : ""}`);
 	}
 	async getIdentityContext(identityId) {
-		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/context`);
+		return this.transport.request(`/agent/identity/${encodeURIComponent(identityId)}/context`);
 	}
 	async mergeIdentities(survivorId, args) {
-		return this.request(`/agent/identity/${encodeURIComponent(survivorId)}/merge`, {
+		return this.transport.request(`/agent/identity/${encodeURIComponent(survivorId)}/merge`, {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
 	}
-	async unmergeIdentity(identityId, args) {
-		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/unmerge`, {
-			method: "POST",
-			body: JSON.stringify(args)
-		});
+	async unmergeIdentity(identityId) {
+		return this.transport.request(`/agent/identity/${encodeURIComponent(identityId)}/unmerge`, { method: "POST" });
 	}
 	async addIdentityNote(identityId, args) {
-		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/notes`, {
+		return this.transport.request(`/agent/identity/${encodeURIComponent(identityId)}/notes`, {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
 	}
 	async tagIdentity(identityId, args) {
-		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/tags`, {
+		return this.transport.request(`/agent/identity/${encodeURIComponent(identityId)}/tags`, {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
@@ -1164,23 +1001,24 @@ var AgentApiClient = class {
 	async getIdentityChangelog(identityId, args) {
 		const qs = new URLSearchParams();
 		if (args?.limit) qs.set("limit", String(args.limit));
+		if (args?.cursor) qs.set("cursor", args.cursor);
 		const query = qs.toString();
-		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/changelog${query ? `?${query}` : ""}`);
+		return this.transport.request(`/agent/identity/${encodeURIComponent(identityId)}/changelog${query ? `?${query}` : ""}`);
 	}
 	async rollbackIdentity(identityId, args) {
-		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/rollback`, {
+		return this.transport.request(`/agent/identity/${encodeURIComponent(identityId)}/rollback`, {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
 	}
 	async requestIdentityVerification(args) {
-		return this.request("/agent/identity/verify/request", {
+		return this.transport.request("/agent/identity/verify/request", {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
 	}
 	async confirmIdentityVerification(args) {
-		return this.request("/agent/identity/verify/confirm", {
+		return this.transport.request("/agent/identity/verify/confirm", {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
@@ -1192,7 +1030,7 @@ var AgentApiClient = class {
 	* not agent-writable.
 	*/
 	async updateIdentity(identityId, args) {
-		return this.request(`/agent/identity/${encodeURIComponent(identityId)}/update`, {
+		return this.transport.request(`/agent/identity/${encodeURIComponent(identityId)}/update`, {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
@@ -1203,128 +1041,121 @@ var AgentApiClient = class {
 	* identity (created or matched via Scenario-B email enrichment).
 	*/
 	async resolveGoogleChatSender(args) {
-		return this.request("/agent/google/resolve-sender", {
+		return this.transport.request("/agent/google/resolve-sender", {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
 	}
-	async memorySearch(query, opts) {
-		return this.request("/agent/memory/search", {
-			method: "POST",
-			body: JSON.stringify({
-				query,
-				limit: opts?.limit ?? 10,
-				topic: opts?.topic,
-				subtopic: opts?.subtopic,
-				tag: opts?.tag,
-				includeKnowledge: opts?.includeKnowledge ?? true
-			})
-		});
-	}
-	async memoryStore(text, opts) {
-		return this.request("/agent/memory/store", {
-			method: "POST",
-			body: JSON.stringify({
-				text,
-				topic: opts?.topic ?? "general",
-				subtopic: opts?.subtopic ?? "general",
-				tag: opts?.tag ?? "fact",
-				importance: opts?.importance ?? .7
-			})
-		});
-	}
-	async memoryIngest(sessionKey, messages, metadata, ingestEpoch) {
-		return this.request("/agent/memory/ingest", {
+};
+//#endregion
+//#region src/domains/images.ts
+/**
+* Image-generation method — text prompt → a stable, public CDN image URL.
+* Ported from main's monolith addition into the domain-split layout.
+*/
+const IMAGE_POLL_INTERVAL_MS = 2e3;
+const IMAGE_JOB_TIMEOUT_MS = 18e4;
+var ImagesApi = class extends ApiBase {
+	/**
+	* Generate an image from a text prompt and get back a STABLE, public URL
+	* (served from the agent-assets CDN — it does not expire). Embed the returned
+	* `imageUrl` in a reply as markdown to show it to the user.
+	*
+	* ASYNC: `gpt-image-1` routinely runs 30–60s, which exceeds the API Gateway
+	* 30s ceiling, so this enqueues a job (`POST /agent/images/generate` →
+	* `jobId`) then polls (`GET /agent/images/{jobId}`) until it completes. The
+	* worker's real failure message (e.g. an unsupported `size`) surfaces via the
+	* job's `error` field.
+	*/
+	async generateImage(args) {
+		const { jobId } = await this.transport.request("/agent/images/generate", {
 			method: "POST",
-			body: JSON.stringify({
-				sessionKey,
-				lastProcessedIndex: messages.length > 0 ? messages[messages.length - 1].index : -1,
-				...ingestEpoch !== void 0 ? { ingestEpoch } : {},
-				messages,
-				metadata
-			})
-		});
-	}
-	async memoryLoadContext(tier, topicHint) {
-		const params = new URLSearchParams();
-		if (tier !== void 0) params.set("tier", String(tier));
-		if (topicHint) params.set("topicHint", topicHint);
-		const qs = params.toString();
-		return this.request(`/agent/memory/context${qs ? `?${qs}` : ""}`);
-	}
-	async memoryLookupEntity(subject) {
-		return this.request(`/agent/memory/knowledge/entities?subject=${encodeURIComponent(subject)}`);
-	}
-	async memoryNavigate() {
-		return this.request("/agent/memory/navigate");
-	}
-	async memoryDelete(memoryId) {
-		return this.request(`/agent/memory/${encodeURIComponent(memoryId)}`, { method: "DELETE" });
-	}
-	async memoryStats() {
-		return this.request("/agent/memory/stats");
+			body: JSON.stringify(args)
+		}, { retry: false });
+		const deadline = Date.now() + IMAGE_JOB_TIMEOUT_MS;
+		while (Date.now() < deadline) {
+			await sleep(IMAGE_POLL_INTERVAL_MS);
+			let job;
+			try {
+				job = await this.transport.request(`/agent/images/${jobId}`);
+			} catch (error) {
+				if (isTransientRequestError(error)) continue;
+				throw error;
+			}
+			if (job.status === "completed") {
+				if (!job.imageUrl) throw new Error("Image generation completed without a URL");
+				return {
+					imageUrl: job.imageUrl,
+					model: job.model ?? args.model ?? "gpt-image-1"
+				};
+			}
+			if (job.status === "failed") {
+				const detail = job.error ? `: ${job.error.split("\n")[0]}` : "";
+				throw new Error(`Image generation failed${detail}`);
+			}
+		}
+		throw new Error("Image generation timed out");
 	}
-	async memoryLearn(args) {
-		return this.request("/agent/memory/learn", {
-			method: "POST",
-			body: JSON.stringify({
-				text: args.text,
-				source: args.source,
-				sourceType: args.sourceType ?? "inline",
-				metadata: args.metadata
-			})
-		});
+};
+//#endregion
+//#region src/domains/integrations.ts
+var IntegrationsApi = class extends ApiBase {
+	async listIntegrations() {
+		return this.transport.request("/agent/integrations");
 	}
-	async memoryBootstrapStatus() {
-		return this.request("/agent/memory/bootstrap-status");
+	async getIntegrationConfig(integrationId) {
+		try {
+			return await this.transport.request(`/agent/integrations/${encodeURIComponent(integrationId)}/config`);
+		} catch (err) {
+			if (err.status === 404) return {
+				integrationId,
+				config: {},
+				configSchema: [],
+				installed: false
+			};
+			throw err;
+		}
 	}
-	async memoryBootstrapStatusMark(scope) {
-		return this.request("/agent/memory/bootstrap-status", {
-			method: "POST",
-			...scope ? { body: JSON.stringify({ scope }) } : {}
+	async updateIntegrationConfig(integrationId, config) {
+		await this.transport.request(`/agent/integrations/${encodeURIComponent(integrationId)}`, {
+			method: "PATCH",
+			body: JSON.stringify({ config })
 		});
 	}
-	async sendSms(args) {
-		return this.request("/mobile/sms/send", {
+	async installIntegration(integrationId, options) {
+		return this.transport.request("/agent/integrations", {
 			method: "POST",
 			body: JSON.stringify({
-				to: args.to,
-				body: args.body
+				integrationId,
+				version: options?.version,
+				config: options?.config
 			})
 		});
 	}
-	async searchWeb(params) {
-		return this.request("/agent/search/web", {
-			method: "POST",
-			body: JSON.stringify(params)
-		});
-	}
-	async searchImages(params) {
-		return this.request("/agent/search/images", {
-			method: "POST",
-			body: JSON.stringify(params)
-		});
+	async removeIntegration(integrationId) {
+		return this.transport.request(`/agent/integrations/${encodeURIComponent(integrationId)}`, { method: "DELETE" });
 	}
-	async searchNews(params) {
-		return this.request("/agent/search/news", {
-			method: "POST",
-			body: JSON.stringify(params)
-		});
+	async getOAuthUrl(provider, scopes) {
+		const params = new URLSearchParams({ provider });
+		if (scopes?.length) params.set("scopes", scopes.join(","));
+		return this.transport.request(`/agent/integrations/oauth/url?${params.toString()}`);
 	}
-	/** Search news across the selected provider's corpus. → POST /agent/news/search */
-	async newsSearch(params) {
-		return this.request("/agent/news/search", {
-			method: "POST",
-			body: JSON.stringify(params)
-		});
+	async getOAuthStatus(provider) {
+		return this.transport.request(`/agent/integrations/oauth/status?provider=${encodeURIComponent(provider)}`);
 	}
-	/** Top headlines for the selected provider. → POST /agent/news/headlines */
-	async newsHeadlines(params) {
-		return this.request("/agent/news/headlines", {
-			method: "POST",
-			body: JSON.stringify(params ?? {})
-		});
+	async getRegistry() {
+		return this.transport.request("/integrations/registry");
 	}
+};
+//#endregion
+//#region src/domains/knowledge.ts
+/**
+* Knowledge resource methods (org/team/project scoped docs, profiles,
+* change requests + RAG search) for the Agent API client.
+*/
+/** Matches services/knowledge's maximum indexed document size. */
+const MAX_KNOWLEDGE_DOCUMENT_BYTES = 2 * 1024 * 1024;
+var KnowledgeApi = class extends ApiBase {
 	/**
 	* Semantic search across the agent's member scopes. Fan-out is gated
 	* server-side by `listScopes` set-inclusion (fail-closed). Pass
@@ -1332,7 +1163,7 @@ var AgentApiClient = class {
 	* yields empty results (never a cross-scope leak).
 	*/
 	async knowledgeSearch(query, opts) {
-		return this.request("/agent/knowledge/search", {
+		return this.transport.request("/agent/knowledge/search", {
 			method: "POST",
 			body: JSON.stringify({
 				query,
@@ -1344,11 +1175,60 @@ var AgentApiClient = class {
 	}
 	/** Enumerate the scopes (org + teams + projects) this agent belongs to. */
 	async listScopes() {
-		return this.request("/agent/org/scopes");
+		return this.transport.request("/agent/org/scopes");
 	}
 	/** Read a scope's structured knowledge profile (after membership check). */
 	async getScopeProfile(scopeType, scopeId) {
-		return this.request(`/agent/org/profile/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}`);
+		return this.transport.request(`/agent/org/profile/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}`);
+	}
+	/**
+	* Open a change request against a scope's knowledge resource. For a doc
+	* create/update, `services/org` returns a presigned staging PUT; this method
+	* uploads the proposed `content` to it (echoing the same Content-Type that
+	* was signed), mirroring `writeScopeDoc`. The staged body is applied to the
+	* canonical doc — attributed to this agent — only when a reviewer approves.
+	*/
+	async proposeScopeChange(scopeType, scopeId, input) {
+		const isDocBody = input.resourceType === "doc" && input.operation !== "delete";
+		const contentType = input.contentType ?? "text/markdown";
+		const result = await this.transport.request(`/agent/org/change-requests/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}`, {
+			method: "POST",
+			body: JSON.stringify({
+				resourceType: input.resourceType,
+				operation: input.operation,
+				rationale: input.rationale,
+				targetPath: input.targetPath,
+				proposedContentType: isDocBody ? contentType : void 0,
+				proposedValue: input.proposedValue
+			})
+		});
+		if (isDocBody && result.uploadUrl) {
+			const putHeaders = new Headers(result.requiredHeaders ?? {});
+			putHeaders.set("Content-Type", contentType);
+			const res = await fetch(result.uploadUrl, {
+				method: "PUT",
+				body: input.content ?? "",
+				headers: putHeaders,
+				signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+			});
+			if (!res.ok) {
+				await res.text();
+				throw new Error(`Change-request body upload failed (${String(res.status)})`);
+			}
+		}
+		return result.changeRequest;
+	}
+	/**
+	* List the agent's OWN change requests in a scope (filtered server-side to
+	* this agent as proposer). Pass `status` to narrow to open / approved / etc.
+	*/
+	async listScopeChangeRequests(scopeType, scopeId, opts) {
+		const qs = new URLSearchParams();
+		if (opts?.status) qs.set("status", opts.status);
+		if (opts?.limit !== void 0) qs.set("limit", String(opts.limit));
+		if (opts?.cursor) qs.set("cursor", opts.cursor);
+		const query = qs.toString();
+		return this.transport.request(`/agent/org/change-requests/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}${query ? `?${query}` : ""}`);
 	}
 	/** List a scope's docs (the org-files corpus; mirrored to shared/<scope>/). */
 	async listScopeDocs(scopeType, scopeId, opts) {
@@ -1356,23 +1236,25 @@ var AgentApiClient = class {
 		if (opts?.limit !== void 0) qs.set("limit", String(opts.limit));
 		if (opts?.cursor) qs.set("cursor", opts.cursor);
 		const query = qs.toString();
-		return this.request(`/agent/org/files/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}${query ? `?${query}` : ""}`);
+		return this.transport.request(`/agent/org/files/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}${query ? `?${query}` : ""}`);
 	}
 	/**
 	* Read the full text of a scope doc. Resolves a presigned download URL
 	* from `services/org`, then fetches the bytes directly from S3 (the one
 	* legitimate raw fetch in a plugin — same pattern as sync).
 	*/
-	async readScopeDoc(scopeType, scopeId, filePath) {
-		const { downloadUrl } = await this.request(`/agent/org/files/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}/download/${encodeFilePath(filePath)}`);
+	async readScopeDoc(scopeType, scopeId, filePath, opts) {
+		const maxBytes = opts?.maxBytes ?? 2097152;
+		if (!Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > 2097152) throw new RangeError(`maxBytes must be an integer from 1 to ${String(MAX_KNOWLEDGE_DOCUMENT_BYTES)}`);
+		const { downloadUrl } = await this.transport.request(`/agent/org/files/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}/download/${encodeFilePath(filePath)}`);
 		const res = await fetch(downloadUrl, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
 		if (!res.ok) {
-			await res.text();
+			await res.body?.cancel().catch(() => void 0);
 			throw new Error(`Doc download failed (${String(res.status)})`);
 		}
 		return {
 			filePath,
-			text: await res.text()
+			text: await readBoundedUtf8(res, maxBytes)
 		};
 	}
 	/**
@@ -1384,7 +1266,7 @@ var AgentApiClient = class {
 	*/
 	async writeScopeDoc(scopeType, scopeId, filePath, content, opts) {
 		const contentType = opts?.contentType ?? "text/markdown";
-		const presign = await this.request(`/agent/org/files/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}/upload/${encodeFilePath(filePath)}`, {
+		const presign = await this.transport.request(`/agent/org/files/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}/upload/${encodeFilePath(filePath)}`, {
 			method: "POST",
 			body: JSON.stringify({
 				contentType,
@@ -1405,123 +1287,449 @@ var AgentApiClient = class {
 		}
 		return { filePath: presign.filePath };
 	}
-	/**
-	* Open a change request against a scope's knowledge resource. For a doc
-	* create/update, `services/org` returns a presigned staging PUT; this method
-	* uploads the proposed `content` to it (echoing the same Content-Type that
-	* was signed), mirroring `writeScopeDoc`. The staged body is applied to the
-	* canonical doc — attributed to this agent — only when a reviewer approves.
-	*/
-	async proposeScopeChange(scopeType, scopeId, input) {
-		const isDocBody = input.resourceType === "doc" && input.operation !== "delete";
-		const contentType = input.contentType ?? "text/markdown";
-		const result = await this.request(`/agent/org/change-requests/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}`, {
-			method: "POST",
-			body: JSON.stringify({
-				resourceType: input.resourceType,
-				operation: input.operation,
-				rationale: input.rationale,
-				targetPath: input.targetPath,
-				proposedContentType: isDocBody ? contentType : void 0,
-				proposedValue: input.proposedValue
-			})
-		});
-		if (isDocBody && result.uploadUrl) {
-			const putHeaders = new Headers(result.requiredHeaders ?? {});
-			putHeaders.set("Content-Type", contentType);
-			const res = await fetch(result.uploadUrl, {
-				method: "PUT",
-				body: input.content ?? "",
-				headers: putHeaders,
-				signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
-			});
-			if (!res.ok) {
-				await res.text();
-				throw new Error(`Change-request body upload failed (${String(res.status)})`);
+};
+async function readBoundedUtf8(response, maxBytes) {
+	const declaredLength = response.headers.get("content-length");
+	if (declaredLength !== null && /^\d+$/u.test(declaredLength) && Number(declaredLength) > maxBytes) {
+		await response.body?.cancel().catch(() => void 0);
+		throw documentTooLargeError(maxBytes);
+	}
+	if (response.body === null) return "";
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	let complete = false;
+	try {
+		while (!complete) {
+			const { done, value } = await reader.read();
+			if (done) {
+				complete = true;
+				continue;
 			}
+			total += value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel().catch(() => void 0);
+				throw documentTooLargeError(maxBytes);
+			}
+			chunks.push(value);
 		}
-		return result.changeRequest;
+	} finally {
+		reader.releaseLock();
 	}
-	/**
-	* List the agent's OWN change requests in a scope (filtered server-side to
-	* this agent as proposer). Pass `status` to narrow to open / approved / etc.
-	*/
-	async listScopeChangeRequests(scopeType, scopeId, opts) {
-		const qs = new URLSearchParams();
-		if (opts?.status) qs.set("status", opts.status);
-		if (opts?.limit !== void 0) qs.set("limit", String(opts.limit));
-		if (opts?.cursor) qs.set("cursor", opts.cursor);
-		const query = qs.toString();
-		return this.request(`/agent/org/change-requests/${encodeURIComponent(scopeType)}/${encodeURIComponent(scopeId)}${query ? `?${query}` : ""}`);
+	const bytes = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
 	}
-	async registerDatabaseCredentials() {
-		return this.request("/agent/database/register", { method: "POST" });
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		throw new Error("Knowledge document is not valid UTF-8 text");
 	}
-	async reportDatabaseAudit(entry) {
-		await this.request("/agent/database/audit", {
+}
+function documentTooLargeError(maxBytes) {
+	const error = /* @__PURE__ */ new Error(`Knowledge document exceeds the ${String(maxBytes)} byte read limit`);
+	error.name = "KnowledgeDocumentTooLargeError";
+	error.code = "KNOWLEDGE_DOCUMENT_TOO_LARGE";
+	return error;
+}
+//#endregion
+//#region src/domains/memory.ts
+/**
+* Cloud memory methods (Turbopuffer vectors + DynamoDB knowledge graph)
+* for the Agent API client.
+*/
+var MemoryApi = class extends ApiBase {
+	async memorySearch(query, opts) {
+		return this.transport.request("/agent/memory/search", {
 			method: "POST",
-			body: JSON.stringify(entry)
-		}).catch(() => {});
-	}
+			body: JSON.stringify({
+				query,
+				limit: opts?.limit ?? 10,
+				topic: opts?.topic,
+				subtopic: opts?.subtopic,
+				tag: opts?.tag,
+				includeKnowledge: opts?.includeKnowledge ?? true
+			})
+		});
+	}
+	async memoryStore(text, opts) {
+		return this.transport.request("/agent/memory/store", {
+			method: "POST",
+			body: JSON.stringify({
+				text,
+				topic: opts?.topic ?? "general",
+				subtopic: opts?.subtopic ?? "general",
+				tag: opts?.tag ?? "fact",
+				importance: opts?.importance ?? .7
+			})
+		});
+	}
+	async memoryIngest(sessionKey, messages, metadata, ingestEpoch) {
+		return this.transport.request("/agent/memory/ingest", {
+			method: "POST",
+			body: JSON.stringify({
+				sessionKey,
+				lastProcessedIndex: messages.length > 0 ? messages[messages.length - 1].index : -1,
+				...ingestEpoch !== void 0 ? { ingestEpoch } : {},
+				messages,
+				metadata
+			})
+		});
+	}
+	async memoryLoadContext(tier, topicHint) {
+		const params = new URLSearchParams();
+		if (tier !== void 0) params.set("tier", String(tier));
+		if (topicHint) params.set("topicHint", topicHint);
+		const qs = params.toString();
+		return this.transport.request(`/agent/memory/context${qs ? `?${qs}` : ""}`);
+	}
+	async memoryLookupEntity(subject) {
+		return this.transport.request(`/agent/memory/knowledge/entities?subject=${encodeURIComponent(subject)}`);
+	}
+	async memoryNavigate() {
+		return this.transport.request("/agent/memory/navigate");
+	}
+	async memoryDelete(memoryId) {
+		return this.transport.request(`/agent/memory/${encodeURIComponent(memoryId)}`, { method: "DELETE" });
+	}
+	async memoryStats() {
+		return this.transport.request("/agent/memory/stats");
+	}
+	async memoryLearn(args) {
+		return this.transport.request("/agent/memory/learn", {
+			method: "POST",
+			body: JSON.stringify({
+				text: args.text,
+				source: args.source,
+				sourceType: args.sourceType ?? "inline",
+				metadata: args.metadata
+			})
+		});
+	}
+	async memoryBootstrapStatus() {
+		return this.transport.request("/agent/memory/bootstrap-status");
+	}
+	async memoryBootstrapStatusMark(scope) {
+		return this.transport.request("/agent/memory/bootstrap-status", {
+			method: "POST",
+			...scope ? { body: JSON.stringify({ scope }) } : {}
+		});
+	}
+};
+//#endregion
+//#region src/domains/mobile.ts
+/**
+* Mobile (numbers / SMS / calls) + WhatsApp methods (services/mobile)
+* for the Agent API client.
+*/
+var MobileApi = class extends ApiBase {
+	async getMobileNumber() {
+		return this.transport.request("/mobile/numbers");
+	}
+	async searchMobileNumbers(args) {
+		const qs = new URLSearchParams();
+		if (args?.country) qs.set("country", args.country);
+		if (args?.query) qs.set("query", args.query);
+		const query = qs.toString();
+		return this.transport.request(`/mobile/numbers/search${query ? `?${query}` : ""}`);
+	}
+	async assignMobileNumber(args) {
+		return this.transport.request("/mobile/numbers/assign", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async releaseMobileNumber() {
+		return this.transport.request("/mobile/numbers/release", {
+			method: "POST",
+			body: JSON.stringify({})
+		});
+	}
+	async sendSms(args) {
+		return this.transport.request("/mobile/sms/send", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async startOutboundCall(args) {
+		return this.transport.request("/mobile/calls/outbound", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async getWhatsAppSession(to) {
+		return this.transport.request(`/mobile/whatsapp/session?to=${encodeURIComponent(to)}`);
+	}
+	async sendWhatsAppMessage(args) {
+		return this.transport.request("/mobile/whatsapp/send", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async sendWhatsAppTemplate(args) {
+		return this.transport.request("/mobile/whatsapp/send-template", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async listWhatsAppTemplates() {
+		return this.transport.request("/mobile/whatsapp/templates");
+	}
+};
+//#endregion
+//#region src/domains/remote.ts
+/**
+* Remote (interactive relay) methods — browser co-browse / terminal takeover
+* sessions brokered by the relay service. Ported from main's monolith
+* additions (b5e3c1e3) into the domain-split layout.
+*/
+var RemoteApi = class extends ApiBase {
 	async requestBrowserTakeover(args) {
-		return this.request("/agent/remote/takeover", {
+		return this.transport.request("/agent/remote/takeover", {
 			method: "POST",
 			body: JSON.stringify(args)
 		});
 	}
 	async getRemoteSession(sessionId) {
-		return this.request(`/agent/remote/sessions/${encodeURIComponent(sessionId)}`);
+		return this.transport.request(`/agent/remote/sessions/${encodeURIComponent(sessionId)}`);
 	}
 	async completeRemoteSession(sessionId) {
-		return this.request(`/agent/remote/sessions/${encodeURIComponent(sessionId)}/complete`, {
+		return this.transport.request(`/agent/remote/sessions/${encodeURIComponent(sessionId)}/complete`, {
 			method: "POST",
 			body: JSON.stringify({})
 		});
 	}
+};
+//#endregion
+//#region src/domains/search.ts
+/**
+* Web/image/news search methods (services/search) for the Agent API client.
+*/
+var SearchApi = class extends ApiBase {
+	async searchWeb(params, options) {
+		return this.transport.request("/agent/search/web", {
+			method: "POST",
+			body: JSON.stringify(params)
+		}, { signal: options?.signal });
+	}
+	async searchImages(params, options) {
+		return this.transport.request("/agent/search/images", {
+			method: "POST",
+			body: JSON.stringify(params)
+		}, { signal: options?.signal });
+	}
+	async searchNews(params, options) {
+		return this.transport.request("/agent/search/news", {
+			method: "POST",
+			body: JSON.stringify(params)
+		}, { signal: options?.signal });
+	}
+	/** Search news across the selected provider's corpus. → POST /agent/news/search */
+	async newsSearch(params) {
+		return this.transport.request("/agent/news/search", {
+			method: "POST",
+			body: JSON.stringify(params)
+		});
+	}
+	/** Top headlines for the selected provider. → POST /agent/news/headlines */
+	async newsHeadlines(params) {
+		return this.transport.request("/agent/news/headlines", {
+			method: "POST",
+			body: JSON.stringify(params ?? {})
+		});
+	}
+};
+//#endregion
+//#region src/domains/secrets.ts
+var SecretsApi = class extends ApiBase {
 	/**
-	* Issue a request that returns the raw `Response` (no JSON parsing, no
-	* forced Content-Type). The caller sets `Content-Type`/`Accept` on `headers`
-	* and reads the body itself (`arrayBuffer()` / `json()`).
+	* Mint a fresh AES-256 data key for a specific (secret, field) pair. The
+	* encryption context is rebuilt server-side from `auth.tenantId` + the body
+	* fields including `fieldKey`; the agent cannot forge context for a scope
+	* or field it doesn't own. Legacy single-envelope secrets are migrated to
+	* `field#value` rows by the data migration, so call with `fieldKey: "value"`
+	* to reach them.
+	*/
+	async generateSecretDataKey(args) {
+		return this.transport.request("/agent/secrets/generate-data-key", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	/**
+	* Unwrap a wrapped data key so the agent can decrypt the envelope locally.
+	* `fieldKey` MUST match the value supplied when the data key was generated
+	* (it's bound into KMS encryption context); mismatch fails with
+	* `InvalidCiphertextException`.
+	*/
+	async decryptSecretDataKey(args) {
+		return this.transport.request("/agent/secrets/decrypt-data-key", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	/**
+	* Create a new secret with one or more fields. Encrypted fields must arrive
+	* pre-sealed (the agent has already obtained per-field data keys via
+	* `generateSecretDataKey({ ..., fieldKey })` and AES-encrypted locally).
+	* Plaintext fields ship the value inline.
+	*/
+	async createSecret(args) {
+		const { scope, scopeId, secretId, ...body } = args;
+		return this.transport.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`, {
+			method: "PUT",
+			body: JSON.stringify(body)
+		});
+	}
+	/** Fetch the secret aggregate plus per-field encrypted envelopes. */
+	async getSecret(args) {
+		return this.transport.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`);
+	}
+	/** Fetch one field. Plaintext: value inline. Encrypted: envelope. */
+	async getSecretField(args) {
+		return this.transport.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/fields/${encodeURIComponent(args.fieldKey)}`);
+	}
+	/** Add OR rotate one field. */
+	async setSecretField(args) {
+		const { scope, scopeId, secretId, fieldKey, ...body } = args;
+		return this.transport.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}/fields/${encodeURIComponent(fieldKey)}`, {
+			method: "PUT",
+			body: JSON.stringify(body)
+		});
+	}
+	/** Remove one field. */
+	async removeSecretField(args) {
+		await this.transport.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/fields/${encodeURIComponent(args.fieldKey)}`, { method: "DELETE" });
+	}
+	/** Update secret-level metadata (name/description/tags/category). */
+	async updateSecretMetadata(args) {
+		const { scope, scopeId, secretId, ...body } = args;
+		return this.transport.request(`/agent/secrets/${encodeURIComponent(scope)}/${encodeURIComponent(scopeId)}/${encodeURIComponent(secretId)}`, {
+			method: "PATCH",
+			body: JSON.stringify(body)
+		});
+	}
+	/** List metadata for secrets in a scope. Optional filters route through the byFacet GSI. */
+	async listSecrets(args) {
+		const params = new URLSearchParams();
+		if (args.category) params.set("category", args.category);
+		if (args.tag) params.set("tag", args.tag);
+		if (args.fieldKey) params.set("fieldKey", args.fieldKey);
+		const qs = params.toString();
+		return (await this.transport.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}${qs ? `?${qs}` : ""}`)).secrets;
+	}
+	/** Bounded changelog read — metadata-only audit entries. */
+	async getSecretHistory(args) {
+		const params = new URLSearchParams();
+		if (args.limit) params.set("limit", String(args.limit));
+		if (args.cursor) params.set("cursor", args.cursor);
+		const qs = params.toString();
+		return this.transport.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}/history${qs ? `?${qs}` : ""}`);
+	}
+	/** Delete a secret (and all its field rows + tag rows + changelog rows). */
+	async deleteSecret(args) {
+		await this.transport.request(`/agent/secrets/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/${encodeURIComponent(args.secretId)}`, { method: "DELETE" });
+	}
+	/** Enumerate scopes (org/team/project/agent) this agent can access. */
+	async listSecretScopes() {
+		return (await this.transport.request("/agent/secrets/scopes")).scopes;
+	}
+};
+//#endregion
+//#region src/domains/self.ts
+/**
+* Self-identity methods — the agent customizing its OWN identity (name,
+* avatar, voice). agentId + tenantId are resolved from the token, so no id
+* appears in the request. Ported from main's monolith additions into the
+* domain-split layout.
+*/
+const AVATAR_POLL_INTERVAL_MS = 2e3;
+const AVATAR_JOB_TIMEOUT_MS = 18e4;
+var SelfApi = class extends ApiBase {
+	/** Update the agent's own name and/or voice config. Returns the updated agent. */
+	async updateSelf(update) {
+		return this.transport.request("/agent/self", {
+			method: "PATCH",
+			body: JSON.stringify(update)
+		});
+	}
+	/**
+	* Generate the agent's own avatar from a text prompt. The image is generated,
+	* stored, and set on the agent server-side; returns the updated agent.
 	*
-	* A single retry fires only on the same transient statuses `request()`
-	* retries (authorizer-timeout 500 + LB 502/503/504) and transient network
-	* errors — before the route handler runs — so re-issuing a POST does not
-	* risk a duplicate side effect. Voice TTS/STT are effectively idempotent
-	* (re-synthesize / re-transcribe) and meter server-side keyed on the
-	* gateway requestId, so a retried transcription doesn't double-bill.
+	* ASYNC (same reason as `generateImage`): avatar gen runs `gpt-image-1`
+	* (30–60s) which exceeds the API Gateway 30s ceiling, so this enqueues a job
+	* (`POST /agent/avatar/generate` → `jobId`) then polls (`GET /agent/avatar/{jobId}`)
+	* until the avatar is set. Signature unchanged — the plugin is unaffected.
 	*/
-	async rawFetch(path, init) {
-		const url = `${this.apiUrl}${path}`;
-		init.headers.set("Authorization", `Bearer ${this.apiKey}`);
-		let lastError;
-		for (let attempt = 1; attempt <= 2; attempt++) try {
-			const res = await fetch(url, {
-				method: init.method,
-				headers: init.headers,
-				body: init.body,
-				signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
-			});
-			if (!res.ok) {
-				await res.text();
-				const error = /* @__PURE__ */ new Error(`Agent API request failed (${String(res.status)})`);
-				if (attempt === 1 && RETRYABLE_STATUS.has(res.status)) {
-					lastError = error;
-					await sleep(RETRY_DELAY_MS);
-					continue;
-				}
+	async generateAvatar(args) {
+		const { jobId } = await this.transport.request("/agent/avatar/generate", {
+			method: "POST",
+			body: JSON.stringify(args)
+		}, { retry: false });
+		const deadline = Date.now() + AVATAR_JOB_TIMEOUT_MS;
+		while (Date.now() < deadline) {
+			await sleep(AVATAR_POLL_INTERVAL_MS);
+			let job;
+			try {
+				job = await this.transport.request(`/agent/avatar/${jobId}`);
+			} catch (error) {
+				if (isTransientRequestError(error)) continue;
 				throw error;
 			}
-			return res;
-		} catch (err) {
-			if (attempt === 1 && isRetryableNetworkError(err)) {
-				lastError = err;
-				await sleep(RETRY_DELAY_MS);
-				continue;
+			if (job.status === "completed") {
+				if (!job.agent) throw new Error("Avatar generation completed without an agent");
+				return job.agent;
+			}
+			if (job.status === "failed") {
+				const detail = job.error ? `: ${job.error.split("\n")[0]}` : "";
+				throw new Error(`Avatar generation failed${detail}`);
 			}
-			throw err;
 		}
-		throw lastError instanceof Error ? lastError : new Error(String(lastError));
+		throw new Error("Avatar generation timed out");
 	}
+	/**
+	* Get a presigned PUT URL to upload a new avatar image. Upload the bytes to
+	* `uploadUrl`, then call `finalizeAvatar(s3Key)` to set it on the agent.
+	*/
+	async presignAvatar(args) {
+		return this.transport.request("/agent/avatar/presign", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	/**
+	* Finalize an avatar upload — validates ownership + size, then sets the
+	* agent's `avatarUrl` server-side. Returns the updated agent.
+	*/
+	async finalizeAvatar(s3Key) {
+		return this.transport.request("/agent/avatar", {
+			method: "POST",
+			body: JSON.stringify({ s3Key })
+		});
+	}
+	/** List the platform voice catalogue (ElevenLabs) so the agent can pick its own voice. */
+	async listVoices() {
+		return this.transport.request("/agent/voices");
+	}
+};
+//#endregion
+//#region src/domains/voice.ts
+/**
+* Voice one-shot TTS / STT methods.
+*
+* These hit the voice service's agent-authed one-shot endpoints
+* (`/voice/tts`, `/voice/stt`), which are Lambda routes co-located on the
+* shared api gateway under the `voice` mapping key. Both are binary flows —
+* TTS returns raw PCM audio bytes, STT accepts raw PCM audio bytes — so they
+* bypass the JSON `{ data: T }` transport used by every other method and go
+* through the transport's `rawRequest` instead. Metering to the tenant credit
+* pool happens server-side; the caller just gets audio (TTS) or a transcript
+* (STT). Ported from main's monolith additions into the domain-split layout.
+*/
+var VoiceApi = class extends ApiBase {
 	/**
 	* Text-to-speech. Returns raw PCM audio bytes plus their framing — the
 	* voice service defaults to 24 kHz / mono / 16-bit. Wrap in a WAV container
@@ -1532,7 +1740,7 @@ var AgentApiClient = class {
 		const headers = new Headers();
 		headers.set("Content-Type", "application/json");
 		headers.set("Accept", "audio/pcm");
-		const res = await this.rawFetch("/voice/tts", {
+		const res = await this.transport.rawRequest("/voice/tts", {
 			method: "POST",
 			headers,
 			body: JSON.stringify(args)
@@ -1555,7 +1763,7 @@ var AgentApiClient = class {
 		const headers = new Headers();
 		headers.set("Content-Type", "application/octet-stream");
 		headers.set("x-sample-rate", String(args.sampleRate));
-		return (await (await this.rawFetch("/voice/stt", {
+		return (await (await this.transport.rawRequest("/voice/stt", {
 			method: "POST",
 			headers,
 			body: args.audio
@@ -1563,5 +1771,168 @@ var AgentApiClient = class {
 	}
 };
 //#endregion
+//#region src/domains/sync.ts
+/**
+* Sync + shared (org/team/project) file methods for the Agent API client.
+*/
+var SyncApi = class extends ApiBase {
+	async syncRegister(args) {
+		return this.transport.request("/agent/sync/register", {
+			method: "POST",
+			body: JSON.stringify(args ?? {})
+		});
+	}
+	async syncGetManifest() {
+		return this.transport.request("/agent/sync/manifest");
+	}
+	async syncPresign(args) {
+		return this.transport.request("/agent/sync/presign", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncConfirmUpload(args) {
+		return this.transport.request("/agent/sync/confirm", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncReconstruct(args) {
+		return this.transport.request("/agent/sync/reconstruct", {
+			method: "POST",
+			body: JSON.stringify(args)
+		});
+	}
+	async syncGetStats() {
+		return this.transport.request("/agent/sync/stats");
+	}
+	async syncListFiles(args) {
+		const qs = new URLSearchParams();
+		if (args?.prefix) qs.set("prefix", args.prefix);
+		const query = qs.toString();
+		return this.transport.request(`/agent/sync/files${query ? `?${query}` : ""}`);
+	}
+	async syncListSessions() {
+		return this.transport.request("/agent/sync/sessions");
+	}
+	async syncGetSession(sessionId) {
+		return this.transport.request(`/agent/sync/sessions/${encodeURIComponent(sessionId)}`);
+	}
+	async syncDeleteFile(filePath) {
+		return this.transport.request(`/agent/sync/files/${encodeFilePath(filePath)}`, { method: "DELETE" });
+	}
+	async sharedListFiles(args) {
+		const params = new URLSearchParams();
+		if (args.limit !== void 0) params.set("limit", String(args.limit));
+		if (args.cursor) params.set("cursor", args.cursor);
+		const query = params.toString();
+		return this.transport.request(`/agent/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}${query ? `?${query}` : ""}`);
+	}
+	async sharedDownloadUrl(args) {
+		return this.transport.request(`/agent/org/files/${encodeURIComponent(args.scope)}/${encodeURIComponent(args.scopeId)}/download/${encodeFilePath(args.filePath)}`);
+	}
+};
+//#endregion
+//#region src/domains/teams.ts
+/**
+* Microsoft Teams adapter methods (services/microsoft bot credentials +
+* messaging) for the Agent API client.
+*/
+var TeamsApi = class extends ApiBase {
+	async getTeamsCredentials() {
+		return this.transport.request("/agent/microsoft/credentials");
+	}
+	async sendTeamsMessage(data) {
+		return this.transport.request("/agent/microsoft/send", {
+			method: "POST",
+			body: JSON.stringify(data)
+		});
+	}
+	async listTeamsChannels() {
+		return this.transport.request("/agent/microsoft/channels");
+	}
+};
+//#endregion
+//#region src/domains/workspace.ts
+/**
+* Workspace + template file methods for the Agent API client.
+*/
+var WorkspaceApi = class extends ApiBase {
+	/**
+	* GET /agent/workspace — workspace config for the authenticated agent
+	* (template assignment, default model, org roster).
+	*/
+	async getWorkspace() {
+		return this.transport.request("/agent/workspace");
+	}
+	/**
+	* GET /templates/{key}/files — persona/workspace file contents for a
+	* template the agent has access to. Pass `version` to pin to the version
+	* the agent was installed from (omit → the endpoint resolves `latest`).
+	*/
+	async getTemplateFiles(templateKey, opts) {
+		const query = opts?.version !== void 0 ? `?version=${String(opts.version)}` : "";
+		return this.transport.request(`/agent/templates/${encodeURIComponent(templateKey)}/files${query}`);
+	}
+};
+//#endregion
+//#region src/domains/webhooks.ts
+/** Agent self-service webhook management methods. */
+var WebhooksApi = class extends ApiBase {
+	async createWebhook(args) {
+		return this.transport.request("/agent/webhooks", {
+			method: "POST",
+			body: JSON.stringify(args)
+		}, { retry: false });
+	}
+	async listWebhooks() {
+		return (await this.transport.request("/agent/webhooks")).webhooks;
+	}
+	async deleteWebhook(webhookId) {
+		return this.transport.request(`/agent/webhooks/${encodeURIComponent(webhookId)}`, { method: "DELETE" });
+	}
+	async rotateWebhookSecret(webhookId) {
+		return this.transport.request(`/agent/webhooks/${encodeURIComponent(webhookId)}/rotate`, { method: "POST" }, { retry: false });
+	}
+	async listWebhookDeliveries(webhookId) {
+		return (await this.transport.request(`/agent/webhooks/${encodeURIComponent(webhookId)}/deliveries`)).deliveries;
+	}
+};
+//#endregion
+//#region src/index.ts
+var AgentApiClient = class extends ApiBase {
+	constructor(config) {
+		super(new AgentApiTransport(config));
+	}
+};
+/** Copy each domain group's prototype methods onto the client class. */
+function applyMixins(derived, bases) {
+	for (const base of bases) for (const name of Object.getOwnPropertyNames(base.prototype)) {
+		if (name === "constructor") continue;
+		const descriptor = Object.getOwnPropertyDescriptor(base.prototype, name);
+		if (descriptor) Object.defineProperty(derived.prototype, name, descriptor);
+	}
+}
+applyMixins(AgentApiClient, [
+	SyncApi,
+	IntegrationsApi,
+	WorkspaceApi,
+	ConnectCredentialsApi,
+	TeamsApi,
+	ChatApi,
+	SecretsApi,
+	IdentityApi,
+	MemoryApi,
+	SearchApi,
+	KnowledgeApi,
+	DatabaseApi,
+	MobileApi,
+	RemoteApi,
+	SelfApi,
+	VoiceApi,
+	ImagesApi,
+	WebhooksApi
+]);
+//#endregion
 exports.AgentApiClient = AgentApiClient;
 exports.installToolErrorCapture = installToolErrorCapture;