@alfe.ai/claude-code-host 0.1.13 → 0.1.14

package/dist/index.d.cts

@@ -48,12 +48,18 @@ declare class AgentApiTransport {
    * @param extra.retry Whether to retry once on transient failures. Safe reads
    *   (GET/HEAD/OPTIONS) default to true; mutations default to false. Set true
    *   only when the endpoint's server-side contract is explicitly idempotent.
+   * @param extra.retryStatuses Narrow the HTTP statuses that trigger the retry
+   *   (default 500/502/503/504). Network errors and timeouts are always retried
+   *   when `retry` is on. Pass a subset when a status in the default set is a
+   *   deterministic answer for this endpoint (e.g. a 502 that means "upstream
+   *   denied", which a retry cannot change).
    * @param extra.signal Optional caller cancellation combined with the client's
    *   own timeout budget. Aborting either signal cancels the request.
    */
   request<T>(path: string, options?: RequestInit, extra?: {
     timeoutMs?: number;
     retry?: boolean;
+    retryStatuses?: ReadonlySet<number>;
     signal?: AbortSignal;
   }): Promise<T>;
 }
@@ -82,7 +88,37 @@ interface ConnectProviderAccounts {
   provider: string;
   accounts: ConnectProviderAccount[];
 }
+/**
+ * One AWS CLI profile an agent may use (`GET /agent/connect/aws/accounts`).
+ * `roleArn` is null for a connection's Direct identity. Carries no secret
+ * material; sessions are minted per call via `getAwsSession`.
+ */
+interface AwsProfile {
+  profile: string;
+  roleArn: string | null;
+  accountId: string;
+  region: string;
+  label: string | null;
+  connectionId: string;
+  accountIdentifier: string;
+  displayName: string | null;
+  connectedAt: string;
+}
+/** AWS CLI `credential_process` output (Version 1), as minted by Connect. */
+interface AwsSessionCredentials {
+  Version: 1;
+  AccessKeyId: string;
+  SecretAccessKey: string;
+  SessionToken: string;
+  /** ISO 8601 expiry. */
+  Expiration: string;
+}
 declare class ConnectCredentialsApi extends ApiBase {
+  /** Platform application identity for private, local Telegram login. Never expose this to tools. */
+  telegramGetApplication(): Promise<{
+    apiId: number;
+    apiHash: string;
+  }>;
   /**
    * Discover all active Connections visible to this agent for one provider.
    * Preserve the provider-specific credential projection without guessing a
@@ -476,7 +512,9 @@ declare class ConnectCredentialsApi extends ApiBase {
    * endpoint walks the agent's full visible scope chain to find a matching
    * connection (works for inherited team/project Microsoft connections).
    */
-  refreshMicrosoftAccountToken(accountIdentifier: string): Promise<{
+  refreshMicrosoftAccountToken(accountIdentifier: string, options?: {
+    connectionId?: string;
+  }): Promise<{
     accessToken: string;
     accessTokenExpiresAt: string;
     expiresAt: string;
@@ -691,12 +729,33 @@ declare class ConnectCredentialsApi extends ApiBase {
    * the fresh `accessJwt`) — callers typically ignore it and re-fetch via
    * `getSocialAccounts` for a consistent shape.
    */
-  refreshSocialAccount(provider: string, accountIdentifier: string): Promise<{
+  refreshSocialAccount(provider: string, accountIdentifier: string, options?: {
+    connectionId?: string;
+  }): Promise<{
     accountIdentifier: string;
     accessToken: string;
     accessTokenExpiresAt: string;
     expiresAt: string;
   }>;
+  /**
+   * List the AWS CLI profiles visible to this agent across every in-scope AWS
+   * connection. Each entry names the `connectionId` + `profile` pair that
+   * {@link getAwsSession} mints a session for. Fields are selected explicitly;
+   * the wire row is never spread.
+   */
+  getAwsProfiles(): Promise<AwsProfile[]>;
+  /**
+   * Mint short-lived AWS session credentials for one profile of one AWS
+   * connection, in the AWS CLI `credential_process` (Version 1) shape. The
+   * server re-checks scope + active status on every call (403 otherwise; 404
+   * for an unknown profile; 403 `aws_access_denied` when AWS denies the
+   * assume, 502 on older servers). Minting has no persistent side effect, so
+   * one retry is safe, but only on genuinely transient failures (500/503/504
+   * and network errors): a denial is deterministic and a retry just doubles
+   * the latency of every failing `aws` call. The response is secret material:
+   * never log it.
+   */
+  getAwsSession(connectionId: string, profile: string): Promise<AwsSessionCredentials>;
 }
 //# sourceMappingURL=connect-credentials.d.ts.map
 //#endregion
@@ -1392,17 +1451,34 @@ declare class IdentityApi extends ApiBase {
     platformId: string;
     kind?: "user" | "agent" | "service" | "bot" | "workspace";
     displayName?: string;
+    /**
+     * Provider `email` only: the sender address, matched read-only against an
+     * existing identity's verified email contact. Ignored for other providers.
+     */
+    email?: string;
+    /**
+     * Provider `email` only: `true` when this agent verified the sender
+     * (SPF/DKIM/DMARC). Unverified email senders are never matched to an
+     * identity. Ignored for other providers.
+     */
+    emailVerified?: boolean;
   }): Promise<{
     identityId: string | null;
     status: string;
     created?: boolean;
     reason?: string;
     /**
-     * Flattened auriclabs permission strings for the resolved identity
-     * (scope-prefixed where applicable). Empty array on miss / org service
-     * outage — the runtime gate fails closed in that case.
+     * Flattened auriclabs permission strings that apply at the calling
+     * agent's own scope (`agent:<agentId>`, plus unscoped entries). A sender
+     * with no identity still receives the tenant's `principalKind="all"`
+     * grants. Empty when nothing applies, or when `permissionsUnavailable`.
      */
     permissions: string[];
+    /**
+     * `true` when the org service could not resolve permissions. The empty
+     * `permissions` is then an outage, not a denial: retry rather than deny.
+     */
+    permissionsUnavailable?: boolean;
   }>;
   searchIdentities(args?: {
     q?: string;
@@ -1632,6 +1708,48 @@ declare class WebhooksApi extends ApiBase {
 }
 //# sourceMappingURL=webhooks.d.ts.map
 //#endregion
+//#region src/domains/wallet.d.ts
+interface AgentWalletAccount {
+  connectionId: string;
+  chainType: "ethereum" | "solana";
+  address: string;
+}
+type AgentWalletTransferStatus = "pending_approval" | "processing" | "succeeded" | "rejected" | "failed";
+interface AgentWalletTransfer {
+  requestId: string;
+  agentId: string;
+  connectionId: string;
+  chainType: "ethereum" | "solana";
+  network: string;
+  fromAddress: string;
+  toAddress: string;
+  amount: string;
+  reason?: string;
+  status: AgentWalletTransferStatus;
+  providerStatus?: string;
+  providerActionId?: string;
+  failureReason?: string;
+  billingStatus: "unmetered" | "metered" | "failed";
+  createdAt: string;
+  updatedAt: string;
+  decidedAt?: string;
+}
+declare class WalletApi extends ApiBase {
+  listWalletAccounts(): Promise<AgentWalletAccount[]>;
+  /** Create a proposal only; a human approves it in the Alfe dashboard. */
+  requestWalletTransfer(input: {
+    connectionId: string;
+    chainType: "ethereum" | "solana";
+    network: "ethereum" | "base" | "arbitrum" | "optimism" | "solana";
+    fromAddress: string;
+    toAddress: string;
+    amount: string;
+    reason?: string;
+  }): Promise<AgentWalletTransfer>;
+  getWalletTransfer(requestId: string): Promise<AgentWalletTransfer>;
+}
+//# sourceMappingURL=wallet.d.ts.map
+//#endregion
 //#region src/domains/chat.d.ts
 declare class ChatApi extends ApiBase {
   ensureDirectConversation(identityId: string): Promise<{
@@ -2003,7 +2121,7 @@ declare class TeamsApi extends ApiBase {
 
 //#endregion
 //#region src/index.d.ts
-interface AgentApiClient extends SyncApi, IntegrationsApi, WorkspaceApi, ConnectCredentialsApi, TeamsApi, ChatApi, SecretsApi, IdentityApi, MemoryApi, SearchApi, KnowledgeApi, DatabaseApi, MobileApi, RemoteApi, SelfApi, VoiceApi, ImagesApi, WebhooksApi {}
+interface AgentApiClient extends SyncApi, IntegrationsApi, WorkspaceApi, ConnectCredentialsApi, TeamsApi, ChatApi, SecretsApi, IdentityApi, MemoryApi, SearchApi, KnowledgeApi, DatabaseApi, MobileApi, RemoteApi, SelfApi, VoiceApi, ImagesApi, WebhooksApi, WalletApi {}
 declare class AgentApiClient extends ApiBase {
   constructor(config: AgentApiClientConfig);
 }

package/dist/index.d.ts

@@ -48,12 +48,18 @@ declare class AgentApiTransport {
    * @param extra.retry Whether to retry once on transient failures. Safe reads
    *   (GET/HEAD/OPTIONS) default to true; mutations default to false. Set true
    *   only when the endpoint's server-side contract is explicitly idempotent.
+   * @param extra.retryStatuses Narrow the HTTP statuses that trigger the retry
+   *   (default 500/502/503/504). Network errors and timeouts are always retried
+   *   when `retry` is on. Pass a subset when a status in the default set is a
+   *   deterministic answer for this endpoint (e.g. a 502 that means "upstream
+   *   denied", which a retry cannot change).
    * @param extra.signal Optional caller cancellation combined with the client's
    *   own timeout budget. Aborting either signal cancels the request.
    */
   request<T>(path: string, options?: RequestInit, extra?: {
     timeoutMs?: number;
     retry?: boolean;
+    retryStatuses?: ReadonlySet<number>;
     signal?: AbortSignal;
   }): Promise<T>;
 }
@@ -82,7 +88,37 @@ interface ConnectProviderAccounts {
   provider: string;
   accounts: ConnectProviderAccount[];
 }
+/**
+ * One AWS CLI profile an agent may use (`GET /agent/connect/aws/accounts`).
+ * `roleArn` is null for a connection's Direct identity. Carries no secret
+ * material; sessions are minted per call via `getAwsSession`.
+ */
+interface AwsProfile {
+  profile: string;
+  roleArn: string | null;
+  accountId: string;
+  region: string;
+  label: string | null;
+  connectionId: string;
+  accountIdentifier: string;
+  displayName: string | null;
+  connectedAt: string;
+}
+/** AWS CLI `credential_process` output (Version 1), as minted by Connect. */
+interface AwsSessionCredentials {
+  Version: 1;
+  AccessKeyId: string;
+  SecretAccessKey: string;
+  SessionToken: string;
+  /** ISO 8601 expiry. */
+  Expiration: string;
+}
 declare class ConnectCredentialsApi extends ApiBase {
+  /** Platform application identity for private, local Telegram login. Never expose this to tools. */
+  telegramGetApplication(): Promise<{
+    apiId: number;
+    apiHash: string;
+  }>;
   /**
    * Discover all active Connections visible to this agent for one provider.
    * Preserve the provider-specific credential projection without guessing a
@@ -476,7 +512,9 @@ declare class ConnectCredentialsApi extends ApiBase {
    * endpoint walks the agent's full visible scope chain to find a matching
    * connection (works for inherited team/project Microsoft connections).
    */
-  refreshMicrosoftAccountToken(accountIdentifier: string): Promise<{
+  refreshMicrosoftAccountToken(accountIdentifier: string, options?: {
+    connectionId?: string;
+  }): Promise<{
     accessToken: string;
     accessTokenExpiresAt: string;
     expiresAt: string;
@@ -691,12 +729,33 @@ declare class ConnectCredentialsApi extends ApiBase {
    * the fresh `accessJwt`) — callers typically ignore it and re-fetch via
    * `getSocialAccounts` for a consistent shape.
    */
-  refreshSocialAccount(provider: string, accountIdentifier: string): Promise<{
+  refreshSocialAccount(provider: string, accountIdentifier: string, options?: {
+    connectionId?: string;
+  }): Promise<{
     accountIdentifier: string;
     accessToken: string;
     accessTokenExpiresAt: string;
     expiresAt: string;
   }>;
+  /**
+   * List the AWS CLI profiles visible to this agent across every in-scope AWS
+   * connection. Each entry names the `connectionId` + `profile` pair that
+   * {@link getAwsSession} mints a session for. Fields are selected explicitly;
+   * the wire row is never spread.
+   */
+  getAwsProfiles(): Promise<AwsProfile[]>;
+  /**
+   * Mint short-lived AWS session credentials for one profile of one AWS
+   * connection, in the AWS CLI `credential_process` (Version 1) shape. The
+   * server re-checks scope + active status on every call (403 otherwise; 404
+   * for an unknown profile; 403 `aws_access_denied` when AWS denies the
+   * assume, 502 on older servers). Minting has no persistent side effect, so
+   * one retry is safe, but only on genuinely transient failures (500/503/504
+   * and network errors): a denial is deterministic and a retry just doubles
+   * the latency of every failing `aws` call. The response is secret material:
+   * never log it.
+   */
+  getAwsSession(connectionId: string, profile: string): Promise<AwsSessionCredentials>;
 }
 //# sourceMappingURL=connect-credentials.d.ts.map
 //#endregion
@@ -1392,17 +1451,34 @@ declare class IdentityApi extends ApiBase {
     platformId: string;
     kind?: "user" | "agent" | "service" | "bot" | "workspace";
     displayName?: string;
+    /**
+     * Provider `email` only: the sender address, matched read-only against an
+     * existing identity's verified email contact. Ignored for other providers.
+     */
+    email?: string;
+    /**
+     * Provider `email` only: `true` when this agent verified the sender
+     * (SPF/DKIM/DMARC). Unverified email senders are never matched to an
+     * identity. Ignored for other providers.
+     */
+    emailVerified?: boolean;
   }): Promise<{
     identityId: string | null;
     status: string;
     created?: boolean;
     reason?: string;
     /**
-     * Flattened auriclabs permission strings for the resolved identity
-     * (scope-prefixed where applicable). Empty array on miss / org service
-     * outage — the runtime gate fails closed in that case.
+     * Flattened auriclabs permission strings that apply at the calling
+     * agent's own scope (`agent:<agentId>`, plus unscoped entries). A sender
+     * with no identity still receives the tenant's `principalKind="all"`
+     * grants. Empty when nothing applies, or when `permissionsUnavailable`.
      */
     permissions: string[];
+    /**
+     * `true` when the org service could not resolve permissions. The empty
+     * `permissions` is then an outage, not a denial: retry rather than deny.
+     */
+    permissionsUnavailable?: boolean;
   }>;
   searchIdentities(args?: {
     q?: string;
@@ -1632,6 +1708,48 @@ declare class WebhooksApi extends ApiBase {
 }
 //# sourceMappingURL=webhooks.d.ts.map
 //#endregion
+//#region src/domains/wallet.d.ts
+interface AgentWalletAccount {
+  connectionId: string;
+  chainType: "ethereum" | "solana";
+  address: string;
+}
+type AgentWalletTransferStatus = "pending_approval" | "processing" | "succeeded" | "rejected" | "failed";
+interface AgentWalletTransfer {
+  requestId: string;
+  agentId: string;
+  connectionId: string;
+  chainType: "ethereum" | "solana";
+  network: string;
+  fromAddress: string;
+  toAddress: string;
+  amount: string;
+  reason?: string;
+  status: AgentWalletTransferStatus;
+  providerStatus?: string;
+  providerActionId?: string;
+  failureReason?: string;
+  billingStatus: "unmetered" | "metered" | "failed";
+  createdAt: string;
+  updatedAt: string;
+  decidedAt?: string;
+}
+declare class WalletApi extends ApiBase {
+  listWalletAccounts(): Promise<AgentWalletAccount[]>;
+  /** Create a proposal only; a human approves it in the Alfe dashboard. */
+  requestWalletTransfer(input: {
+    connectionId: string;
+    chainType: "ethereum" | "solana";
+    network: "ethereum" | "base" | "arbitrum" | "optimism" | "solana";
+    fromAddress: string;
+    toAddress: string;
+    amount: string;
+    reason?: string;
+  }): Promise<AgentWalletTransfer>;
+  getWalletTransfer(requestId: string): Promise<AgentWalletTransfer>;
+}
+//# sourceMappingURL=wallet.d.ts.map
+//#endregion
 //#region src/domains/chat.d.ts
 declare class ChatApi extends ApiBase {
   ensureDirectConversation(identityId: string): Promise<{
@@ -2003,7 +2121,7 @@ declare class TeamsApi extends ApiBase {
 
 //#endregion
 //#region src/index.d.ts
-interface AgentApiClient extends SyncApi, IntegrationsApi, WorkspaceApi, ConnectCredentialsApi, TeamsApi, ChatApi, SecretsApi, IdentityApi, MemoryApi, SearchApi, KnowledgeApi, DatabaseApi, MobileApi, RemoteApi, SelfApi, VoiceApi, ImagesApi, WebhooksApi {}
+interface AgentApiClient extends SyncApi, IntegrationsApi, WorkspaceApi, ConnectCredentialsApi, TeamsApi, ChatApi, SecretsApi, IdentityApi, MemoryApi, SearchApi, KnowledgeApi, DatabaseApi, MobileApi, RemoteApi, SelfApi, VoiceApi, ImagesApi, WebhooksApi, WalletApi {}
 declare class AgentApiClient extends ApiBase {
   constructor(config: AgentApiClientConfig);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/claude-code-host",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Chat bridge that makes a self-hosted Claude Code agent reachable from Alfe chat on the user's Claude subscription",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,7 +19,7 @@
     "dist"
   ],
   "dependencies": {
-    "@alfe.ai/agent-api-client": "^0.19.0",
+    "@alfe.ai/agent-api-client": "^0.20.0",
     "@alfe.ai/chat": "^0.0.19",
     "@alfe.ai/config": "^0.4.1"
   },