@alfe.ai/claude-code-host 0.1.7 → 0.1.9

package/dist/index.d.cts

@@ -786,6 +786,7 @@ declare class ChatApi extends ApiBase {
     attachments: {
       id: string;
       uploadUrl: string;
+      uploadHeaders: Record<string, string>;
       downloadUrl: string;
       s3Key: string;
       expiresAt: string;
@@ -1274,10 +1275,41 @@ declare class ConnectCredentialsApi extends ApiBase {
       brokerName?: string;
       accountNumber?: string;
       accessToken: string;
+      /**
+       * The stable per-grant Connection key (`ctid:<userId>`) this account
+       * belongs to. Every trading account under one cTrader login shares one
+       * grant (one OAuth token), so this is the identifier the MCP server
+       * passes to `refreshCTraderAccount()` to rotate the token for the whole
+       * grant on a `CH_ACCESS_TOKEN_INVALID` expiry. Empty string when the
+       * server did not supply one (legacy rows) — such an account can still
+       * trade with its current token but cannot self-refresh.
+       */
+      accountIdentifier: string;
     }[];
     clientId: string;
     clientSecret: string;
   }>;
+  /**
+   * Pattern A: refresh a specific cTrader grant by its stable
+   * `accountIdentifier` (`ctid:<userId>` from `getCTraderAccounts()`).
+   *
+   * cTrader access tokens live ~30 days; the `getCTraderAccounts()` /
+   * credentials reads serve the STORED token without refreshing, so refresh is
+   * the consumer's job. `@alfe.ai/ctrader-mcp` calls this when the cTrader Open
+   * API rejects an account-auth with `CH_ACCESS_TOKEN_INVALID`, then re-runs
+   * the socket handshake with the returned `accessToken`.
+   *
+   * Refreshing one grant rotates the single OAuth token that covers EVERY
+   * trading account under that login. cTrader's refresh token itself does not
+   * expire but may rotate on refresh (`rotatesRefreshToken: true`); connect
+   * persists the rotated refresh token server-side, so the caller only needs
+   * the new `accessToken`. Mirrors `refreshXeroAccountToken`.
+   */
+  refreshCTraderAccount(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
   /**
    * @deprecated Returns a single primary credential blob. Use
    * `getShopifyAccounts()` for the multi-account shape required by Pattern A
@@ -1576,7 +1608,9 @@ declare class IntegrationsApi extends ApiBase {
     config?: Record<string, unknown>;
   }): Promise<IntegrationInstall>;
   removeIntegration(integrationId: string): Promise<IntegrationInstall>;
-  getOAuthUrl(provider: string, scopes?: string[]): Promise<{
+  getOAuthUrl(provider: string, scopes?: string[], options?: {
+    shop?: string;
+  }): Promise<{
     url: string;
     provider: string;
     expiresIn: number;

package/dist/index.d.ts

@@ -786,6 +786,7 @@ declare class ChatApi extends ApiBase {
     attachments: {
       id: string;
       uploadUrl: string;
+      uploadHeaders: Record<string, string>;
       downloadUrl: string;
       s3Key: string;
       expiresAt: string;
@@ -1274,10 +1275,41 @@ declare class ConnectCredentialsApi extends ApiBase {
       brokerName?: string;
       accountNumber?: string;
       accessToken: string;
+      /**
+       * The stable per-grant Connection key (`ctid:<userId>`) this account
+       * belongs to. Every trading account under one cTrader login shares one
+       * grant (one OAuth token), so this is the identifier the MCP server
+       * passes to `refreshCTraderAccount()` to rotate the token for the whole
+       * grant on a `CH_ACCESS_TOKEN_INVALID` expiry. Empty string when the
+       * server did not supply one (legacy rows) — such an account can still
+       * trade with its current token but cannot self-refresh.
+       */
+      accountIdentifier: string;
     }[];
     clientId: string;
     clientSecret: string;
   }>;
+  /**
+   * Pattern A: refresh a specific cTrader grant by its stable
+   * `accountIdentifier` (`ctid:<userId>` from `getCTraderAccounts()`).
+   *
+   * cTrader access tokens live ~30 days; the `getCTraderAccounts()` /
+   * credentials reads serve the STORED token without refreshing, so refresh is
+   * the consumer's job. `@alfe.ai/ctrader-mcp` calls this when the cTrader Open
+   * API rejects an account-auth with `CH_ACCESS_TOKEN_INVALID`, then re-runs
+   * the socket handshake with the returned `accessToken`.
+   *
+   * Refreshing one grant rotates the single OAuth token that covers EVERY
+   * trading account under that login. cTrader's refresh token itself does not
+   * expire but may rotate on refresh (`rotatesRefreshToken: true`); connect
+   * persists the rotated refresh token server-side, so the caller only needs
+   * the new `accessToken`. Mirrors `refreshXeroAccountToken`.
+   */
+  refreshCTraderAccount(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
   /**
    * @deprecated Returns a single primary credential blob. Use
    * `getShopifyAccounts()` for the multi-account shape required by Pattern A
@@ -1576,7 +1608,9 @@ declare class IntegrationsApi extends ApiBase {
     config?: Record<string, unknown>;
   }): Promise<IntegrationInstall>;
   removeIntegration(integrationId: string): Promise<IntegrationInstall>;
-  getOAuthUrl(provider: string, scopes?: string[]): Promise<{
+  getOAuthUrl(provider: string, scopes?: string[], options?: {
+    shop?: string;
+  }): Promise<{
     url: string;
     provider: string;
     expiresIn: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/claude-code-host",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Chat bridge that makes a self-hosted Claude Code agent reachable from Alfe chat on the user's Claude subscription",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,7 +19,7 @@
     "dist"
   ],
   "dependencies": {
-    "@alfe.ai/agent-api-client": "^0.15.0",
+    "@alfe.ai/agent-api-client": "^0.17.0",
     "@alfe.ai/chat": "^0.0.18",
     "@alfe.ai/config": "^0.4.1"
   },