@alfe.ai/mcp-server 0.1.2 → 0.1.4

package/dist/index.d.cts

@@ -203,24 +203,125 @@ declare class AgentApiClient {
     clientSecret: string;
     displayName?: string;
   }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getGithubAccounts()` for the multi-
+   * account shape required by Pattern A — explicit selector args on every
+   * tool. Retained because the `@alfe.ai/openclaw-github` proxy is the
+   * only consumer that knows about Pattern A; legacy env-interpolation
+   * callers will keep hitting `/credentials` until they move to the proxy.
+   */
   getGithubCredentials(): Promise<{
     login: string;
     accessToken: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for GitHub.
+   *
+   * Returns every agent-scoped GitHub connection. The caller is expected
+   * to require a `login` selector on every credential-touching tool and
+   * look up the matching account at dispatch time.
+   *
+   * GitHub OAuth tokens have no expiry (`tokenLifecycle: "no_expiry"`),
+   * so there is intentionally no `refreshGithubAccountToken` method — if
+   * a token is revoked the user must re-run the OAuth flow.
+   *
+   * Returned `accounts[i].login` is the GitHub username — the stable
+   * cross-session identifier the LLM should pass.
+   */
+  getGithubAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      login: string;
+      scopes: string;
+    }[];
+  }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getXeroAccounts()` for the multi-
+   * account shape required by Pattern A — explicit selector args on every
+   * tool. This method will be removed once all consumers migrate.
+   */
   getXeroCredentials(): Promise<{
     accessToken: string;
     accessTokenExpiresAt: string;
     xeroTenantId: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for Xero. Returns every
+   * agent-scoped Xero connection. The caller is expected to require a
+   * selector arg (e.g. `xeroTenantId`) on every credential-touching tool
+   * and look up the matching account by that selector at dispatch time.
+   *
+   * Returned `accounts[i].accountIdentifier` is the Xero tenantId — the
+   * stable cross-session identifier the LLM should pass.
+   */
+  getXeroAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      xeroTenantId: string;
+    }[];
+  }>;
   refreshXeroToken(): Promise<{
     accessToken: string;
     expiresAt: string;
   }>;
+  /**
+   * Pattern A: refresh a specific Xero connection by its `accountIdentifier`
+   * (the Xero `tenantId`). The legacy `refreshXeroToken()` only refreshes
+   * the *primary* connection, which is wrong for multi-tenant Xero where
+   * each tenant has its own non-interchangeable access token.
+   */
+  refreshXeroAccountToken(xeroTenantId: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getNotionAccounts()` for the multi-
+   * account shape required by Pattern A.
+   */
   getNotionCredentials(): Promise<{
     accessToken: string;
     workspaceId: string;
     workspaceName: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for Notion. Returns every
+   * agent-scoped Notion connection. The caller is expected to require a
+   * selector arg (e.g. `workspaceId`) on every credential-touching tool.
+   *
+   * Returned `accounts[i].accountIdentifier` is the Notion workspaceId.
+   */
+  getNotionAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      workspaceId: string;
+      workspaceName: string;
+    }[];
+  }>;
+  /**
+   * @deprecated Returns a single primary Atlassian Connection's credentials
+   * (one OAuth user, one cloudId) — the legacy "pick-the-default-connection"
+   * shape. Atlassian is multi-site by nature (each OAuth user may have
+   * access to multiple Cloud sites), so Pattern A plugins MUST use
+   * `getAtlassianAccounts()` to discover the full set and dispatch via
+   * the `cloudId` selector arg.
+   */
   getAtlassianCredentials(): Promise<{
     accessToken: string;
     refreshToken: string;
@@ -237,16 +338,177 @@ declare class AgentApiClient {
     accessToken: string;
     expiresAt: string;
   }>;
+  /**
+   * Pattern A: multi-account / multi-site credential fetch for Atlassian.
+   *
+   * Returns every agent-scoped Atlassian Connection. Each Connection is
+   * one OAuth user with a single access token and N accessible Cloud
+   * sites (`availableSites`). The caller is expected to:
+   *
+   *   1. Flatten (connection × cloudId) into one MCP child per site.
+   *   2. Require a `cloudId` selector on every credential-touching tool.
+   *   3. Use the access token bound to the Connection that owns the
+   *      requested `cloudId` (Atlassian shares one access token across
+   *      all sites accessible to the OAuth user).
+   *
+   * Per-account token refresh uses `refreshAtlassianAccountToken(email)`
+   * — refreshing one Connection rotates its single access token, which
+   * then applies to every cloudId for that Connection.
+   *
+   * Returned `accounts[i].accountIdentifier` is the OAuth user's email
+   * — the stable cross-session identifier for refresh purposes. The LLM
+   * never sees this directly: it picks a site via the `cloudId` arg
+   * instead.
+   */
+  getAtlassianAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      clientId: string;
+      clientSecret: string;
+      cloudId: string;
+      siteName: string;
+      siteUrl: string;
+      availableSites: {
+        id: string;
+        url: string;
+        name: string;
+        scopes?: string[];
+        avatarUrl?: string;
+      }[];
+    }[];
+  }>;
+  /**
+   * Pattern A: refresh a specific Atlassian Connection by `accountIdentifier`
+   * (the OAuth user's email).
+   *
+   * Atlassian rotates refresh tokens (`rotatesRefreshToken: true`); the
+   * server-side per-account refresh endpoint handles rotation and
+   * persistence. Refreshing one Connection updates its single access
+   * token, which applies to every accessible Cloud site (cloudId) for
+   * that OAuth user.
+   *
+   * Returns the new access token + expiry. The proxy is responsible for
+   * fanning the new token out to every child server it spawned for
+   * cloudIds owned by this Connection.
+   */
+  refreshAtlassianAccountToken(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getMYOBAccounts()` for the multi-
+   * account shape required by Pattern A.
+   */
   getMYOBCredentials(): Promise<{
     accessToken: string;
     accessTokenExpiresAt: string;
     myobBusinessId: string;
     clientId: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for MYOB. Returns every
+   * agent-scoped MYOB connection. The caller is expected to require a
+   * selector arg (e.g. `myobBusinessId` / `accountIdentifier`) on every
+   * credential-touching tool.
+   *
+   * Returned `accounts[i].accountIdentifier` is the MYOB businessId.
+   */
+  getMYOBAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      myobBusinessId: string;
+      clientId: string;
+    }[];
+  }>;
   refreshMYOBToken(): Promise<{
     accessToken: string;
     expiresAt: string;
   }>;
+  /**
+   * Microsoft 365 (delegated OAuth) credential fetch — single-account shape.
+   *
+   * @deprecated Use `getMicrosoftAccounts()` and dispatch via the `email`
+   *   selector once per-account plugins land. Retained because the existing
+   *   `integrations/connect/microsoft/hooks/post_activate.mjs` writes
+   *   `mgc` credentials for the single (default) Microsoft account.
+   *
+   * Returns the agent's effective Microsoft delegated-OAuth credentials.
+   * Distinct from `getTeamsCredentials()` (Azure bot credentials for the
+   * Teams adapter, which is admin-consent flow on services/microsoft, not
+   * delegated OAuth on services/connect).
+   */
+  getMicrosoftCredentials(): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt?: string;
+    refreshToken: string;
+    clientId: string;
+    clientSecret: string;
+    email?: string;
+    microsoftTenantId?: string;
+    workspaceDomain?: string;
+  }>;
+  /**
+   * Pattern A: multi-account credential fetch for Microsoft 365.
+   *
+   * Returns every agent-scoped Microsoft connection. The caller is expected
+   * to require an `email` selector on every credential-touching tool and
+   * look up the matching account at dispatch time.
+   *
+   * Returned `accounts[i].accountIdentifier` is the user's primary email
+   * (or the tid claim as fallback) — the stable cross-session identifier
+   * the LLM should pass.
+   *
+   * Per-account token refresh is exposed via `refreshMicrosoftAccountToken`,
+   * NOT `refreshXeroAccountToken` — Microsoft refresh tokens are not
+   * interchangeable across (tenant, user) pairs.
+   */
+  getMicrosoftAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      refreshToken: string;
+      clientId: string;
+      clientSecret: string;
+      email: string;
+      microsoftTenantId: string;
+      workspaceDomain: string;
+    }[];
+  }>;
+  /**
+   * Pattern A: refresh a specific Microsoft 365 connection by its
+   * `accountIdentifier`. For Microsoft, `accountIdentifier` is the user's
+   * email when the Graph profile fetch succeeded at connect time, and the
+   * Azure tenant id (`tid` claim) as fallback. Callers should pass the
+   * value returned by `getMicrosoftAccounts()` rather than synthesising
+   * an email locally.
+   *
+   * Microsoft refresh tokens are bound to a specific (tenant, user) pair —
+   * they are NOT interchangeable across accounts, so per-account refresh
+   * is mandatory. The generic /accounts/{accountIdentifier}/refresh
+   * endpoint walks the agent's full visible scope chain to find a matching
+   * connection (works for inherited team/project Microsoft connections).
+   */
+  refreshMicrosoftAccountToken(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
   getTeamsCredentials(): Promise<{
     agentId: string;
     tenantId: string;

package/dist/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":["ChangelogAction","ChangelogActor","ChangelogEntry","ChangelogEntry$1","EncryptedEnvelopeV1","EncryptedEnvelopeV1$1","Field","FieldEnvelope","FieldEnvelope$1","FieldFormat","FieldFormat$1","FieldSensitivity","FieldSensitivity$1","FieldView","GeneratedDataKey","GeneratedDataKey$1","IntegrationConfigResult","IntegrationConfigResult$1","IntegrationConfigSchemaField","IntegrationInstall","IntegrationInstall$1","RegistryEntry","RegistryEntry$1","ScopeInfo","ScopeInfo$1","SecretAggregate","SecretAggregate$1","SecretCategory","SecretCategory$1","SecretMetadata","SecretMetadata$1","SecretScope","SecretScope$1","AgentApiClientConfig","SyncAgentInfo","SyncManifestEntry","SyncManifest","Record","SyncPresignedUrl","SyncConfirmedUpload","SyncReconstructFile","SyncReconstructBundle","SyncAgentStats","SyncFileEntry","SyncSessionEntry","SyncSessionContent","SharedFileEntry","AgentApiClient","Promise"],"sources":["../../agent-api-client/dist/index.d.ts","../src/index.ts"],"sourcesContent":["import { ChangelogAction, ChangelogActor, ChangelogEntry, ChangelogEntry as ChangelogEntry$1, EncryptedEnvelopeV1, EncryptedEnvelopeV1 as EncryptedEnvelopeV1$1, Field, FieldEnvelope, FieldEnvelope as FieldEnvelope$1, FieldFormat, FieldFormat as FieldFormat$1, FieldSensitivity, FieldSensitivity as FieldSensitivity$1, FieldView, GeneratedDataKey, GeneratedDataKey as GeneratedDataKey$1, IntegrationConfigResult, IntegrationConfigResult as IntegrationConfigResult$1, IntegrationConfigSchemaField, IntegrationInstall, IntegrationInstall as IntegrationInstall$1, RegistryEntry, RegistryEntry as RegistryEntry$1, ScopeInfo, ScopeInfo as ScopeInfo$1, SecretAggregate, SecretAggregate as SecretAggregate$1, SecretCategory, SecretCategory as SecretCategory$1, SecretMetadata, SecretMetadata as SecretMetadata$1, SecretScope, SecretScope as SecretScope$1 } from \"@alfe/types\";\n\n//#region src/index.d.ts\n\ninterface AgentApiClientConfig {\n  apiKey: string;\n  apiUrl: string;\n}\ninterface SyncAgentInfo {\n  agentId: string;\n  tenantId: string;\n  displayName: string;\n  s3Prefix: string;\n  status: \"stale\" | \"syncing\" | \"synced\";\n  fileCount?: number;\n  totalSize?: number;\n  lastSync?: string;\n}\ninterface SyncManifestEntry {\n  hash: string;\n  size: number;\n  modified: string;\n  etag?: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncManifest {\n  version: 1;\n  agentId: string;\n  lastSync: string;\n  files: Record<string, SyncManifestEntry>;\n}\ninterface SyncPresignedUrl {\n  path: string;\n  url: string;\n  expiresAt: string;\n}\ninterface SyncConfirmedUpload {\n  filePath: string;\n  hash: string;\n  size: number;\n  storageClass: \"STANDARD\" | \"GLACIER_IR\";\n  syncedAt: string;\n}\ninterface SyncReconstructFile {\n  path: string;\n  size: number;\n  url: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncReconstructBundle {\n  agentId: string;\n  mode: \"full\" | \"active\" | \"memory\";\n  fileCount: number;\n  totalSize: number;\n  files: SyncReconstructFile[];\n  expiresAt: string;\n}\ninterface SyncAgentStats {\n  agentId: string;\n  standardBytes: number;\n  glacierBytes: number;\n  fileCount: number;\n  lastSyncAt: string | null;\n}\ninterface SyncFileEntry {\n  filePath: string;\n  size: number;\n  modified: string;\n  contentHash: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncSessionEntry {\n  sessionId: string;\n  size: number;\n  lastModified: string;\n  storageClass?: string;\n  isArchived: boolean;\n}\ninterface SyncSessionContent {\n  sessionId: string;\n  content: string;\n  compressed: boolean;\n}\ninterface SharedFileEntry {\n  filePath: string;\n  fileName: string;\n  size: number;\n  contentType?: string;\n}\ndeclare class AgentApiClient {\n  private readonly apiKey;\n  private readonly apiUrl;\n  constructor(config: AgentApiClientConfig);\n  private request;\n  syncRegister(args?: {\n    displayName?: string;\n  }): Promise<{\n    agent: SyncAgentInfo;\n  }>;\n  syncGetManifest(): Promise<SyncManifest>;\n  syncPresign(args: {\n    files: {\n      path: string;\n      operation: \"put\" | \"get\";\n      contentType?: string;\n    }[];\n  }): Promise<{\n    urls: SyncPresignedUrl[];\n  }>;\n  syncConfirmUpload(args: {\n    filePath: string;\n    hash: string;\n    size: number;\n    storageClass?: \"STANDARD\" | \"GLACIER_IR\";\n  }): Promise<SyncConfirmedUpload>;\n  syncReconstruct(args: {\n    mode: \"full\" | \"active\" | \"memory\";\n  }): Promise<SyncReconstructBundle>;\n  syncGetStats(): Promise<SyncAgentStats>;\n  syncListFiles(args?: {\n    prefix?: string;\n  }): Promise<{\n    files: SyncFileEntry[];\n  }>;\n  syncListSessions(): Promise<{\n    sessions: SyncSessionEntry[];\n  }>;\n  syncGetSession(sessionId: string): Promise<SyncSessionContent>;\n  syncDeleteFile(filePath: string): Promise<{\n    removed: boolean;\n  }>;\n  sharedListFiles(args: {\n    scope: \"org\" | \"team\" | \"project\";\n    scopeId: string;\n  }): Promise<{\n    files: SharedFileEntry[];\n    nextCursor: string | null;\n  }>;\n  sharedDownloadUrl(args: {\n    scope: \"org\" | \"team\" | \"project\";\n    scopeId: string;\n    filePath: string;\n  }): Promise<{\n    downloadUrl: string;\n    expiresIn: number;\n  }>;\n  listIntegrations(): Promise<IntegrationInstall$1[]>;\n  getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult$1>;\n  updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;\n  installIntegration(integrationId: string, options?: {\n    version?: string;\n    config?: Record<string, unknown>;\n  }): Promise<IntegrationInstall$1>;\n  removeIntegration(integrationId: string): Promise<IntegrationInstall$1>;\n  getOAuthUrl(provider: string, scopes?: string[]): Promise<{\n    url: string;\n    provider: string;\n    expiresIn: number;\n  }>;\n  getOAuthStatus(provider: string): Promise<{\n    provider: string;\n    connected: boolean;\n    config?: Record<string, string>;\n  }>;\n  getRegistry(): Promise<{\n    integrations: RegistryEntry$1[];\n  }>;\n  /**\n   * Returns every connected Google account for the agent. Multi-account by\n   * design — the openclaw-google plugin requires the LLM to pass `email`\n   * explicitly to `google_run_command` so an account is always selected\n   * deliberately.\n   *\n   * 2026-05-14 (connections-redesign PR 1): the legacy flat shape (`email`,\n   * `refreshToken`, `accessToken`, etc., populated from the default account)\n   * is gone. Iterate over `accounts`.\n   */\n  getGoogleCredentials(): Promise<{\n    accounts: {\n      email: string;\n      refreshToken: string;\n      clientId: string;\n      clientSecret: string;\n      displayName?: string;\n      connectedAt?: string;\n    }[];\n  }>;\n  disconnectGoogleAccount(email: string): Promise<{\n    accounts: {\n      email: string;\n      displayName?: string;\n      connectedAt?: string;\n    }[];\n  }>;\n  getGoogleChatCredentials(): Promise<{\n    email: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    displayName?: string;\n  }>;\n  getGithubCredentials(): Promise<{\n    login: string;\n    accessToken: string;\n  }>;\n  getXeroCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    xeroTenantId: string;\n  }>;\n  refreshXeroToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  getNotionCredentials(): Promise<{\n    accessToken: string;\n    workspaceId: string;\n    workspaceName: string;\n  }>;\n  getAtlassianCredentials(): Promise<{\n    accessToken: string;\n    refreshToken: string;\n    accessTokenExpiresAt: string;\n    cloudId: string;\n    siteName: string;\n    siteUrl: string;\n    email: string;\n    enabledProducts: string[];\n    clientId: string;\n    clientSecret: string;\n  }>;\n  refreshAtlassianToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  getMYOBCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    myobBusinessId: string;\n    clientId: string;\n  }>;\n  refreshMYOBToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  getTeamsCredentials(): Promise<{\n    agentId: string;\n    tenantId: string;\n    azureAppId: string;\n    azureBotId: string;\n    azureClientSecret: string;\n    botDisplayName?: string;\n    teamsTenantId?: string;\n    serviceUrl?: string;\n  }>;\n  sendTeamsMessage(data: {\n    conversationId: string;\n    text?: string;\n    adaptiveCard?: Record<string, unknown>;\n  }): Promise<{\n    ok: boolean;\n    activityId: string;\n  }>;\n  listTeamsChannels(): Promise<{\n    channels: {\n      id: string;\n      name: string;\n      description?: string;\n    }[];\n  }>;\n  presignAttachments(files: {\n    filename: string;\n    mimeType: string;\n    size: number;\n  }[]): Promise<{\n    attachments: {\n      id: string;\n      uploadUrl: string;\n      downloadUrl: string;\n      s3Key: string;\n      expiresAt: string;\n    }[];\n  }>;\n  recordActivity(data: {\n    userId?: string;\n    channel: string;\n    role: \"user\" | \"assistant\";\n  }): Promise<{\n    recorded: boolean;\n  }>;\n  /**\n   * Mint a fresh AES-256 data key for a specific (secret, field) pair. The\n   * encryption context is rebuilt server-side from `auth.tenantId` + the body\n   * fields including `fieldKey`; the agent cannot forge context for a scope\n   * or field it doesn't own. Legacy single-envelope secrets are migrated to\n   * `field#value` rows by the data migration, so call with `fieldKey: \"value\"`\n   * to reach them.\n   */\n  generateSecretDataKey(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<GeneratedDataKey$1>;\n  /**\n   * Unwrap a wrapped data key so the agent can decrypt the envelope locally.\n   * `fieldKey` MUST match the value supplied when the data key was generated\n   * (it's bound into KMS encryption context); mismatch fails with\n   * `InvalidCiphertextException`.\n   */\n  decryptSecretDataKey(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n    dataKeyCiphertext: string;\n  }): Promise<{\n    plaintextKey: string;\n  }>;\n  /**\n   * Create a new secret with one or more fields. Encrypted fields must arrive\n   * pre-sealed (the agent has already obtained per-field data keys via\n   * `generateSecretDataKey({ ..., fieldKey })` and AES-encrypted locally).\n   * Plaintext fields ship the value inline.\n   */\n  createSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    secretName: string;\n    category?: SecretCategory$1;\n    description?: string;\n    tags?: string[];\n    fields: {\n      key: string;\n      format?: FieldFormat$1;\n      sensitivity: FieldSensitivity$1;\n      value?: string;\n      envelope?: EncryptedEnvelopeV1$1;\n    }[];\n    reason?: string;\n  }): Promise<SecretAggregate$1>;\n  /** Fetch the secret aggregate plus per-field encrypted envelopes. */\n  getSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n  }): Promise<{\n    aggregate: SecretAggregate$1;\n    envelopes: FieldEnvelope$1[];\n  }>;\n  /** Fetch one field. Plaintext: value inline. Encrypted: envelope. */\n  getSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<{\n    key: string;\n    sensitivity: FieldSensitivity$1;\n    format?: FieldFormat$1;\n    value?: string;\n    envelope?: EncryptedEnvelopeV1$1;\n    rotatedAt?: string;\n    createdAt: string;\n    updatedAt: string;\n  }>;\n  /** Add OR rotate one field. */\n  setSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n    sensitivity: FieldSensitivity$1;\n    format?: FieldFormat$1;\n    value?: string;\n    envelope?: EncryptedEnvelopeV1$1;\n    reason?: string;\n  }): Promise<{\n    fieldKey: string;\n    rotated: boolean;\n  }>;\n  /** Remove one field. */\n  removeSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<void>;\n  /** Update secret-level metadata (name/description/tags/category). */\n  updateSecretMetadata(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    secretName?: string;\n    description?: string;\n    tags?: string[];\n    category?: SecretCategory$1;\n    reason?: string;\n  }): Promise<SecretAggregate$1>;\n  /** List metadata for secrets in a scope. Optional filters route through the byFacet GSI. */\n  listSecrets(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    category?: SecretCategory$1;\n    tag?: string;\n    fieldKey?: string;\n  }): Promise<SecretMetadata$1[]>;\n  /** Bounded changelog read — metadata-only audit entries. */\n  getSecretHistory(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    limit?: number;\n    cursor?: string;\n  }): Promise<{\n    entries: ChangelogEntry$1[];\n    nextCursor?: string;\n  }>;\n  /** Delete a secret (and all its field rows + tag rows + changelog rows). */\n  deleteSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n  }): Promise<void>;\n  /** Enumerate scopes (org/team/project/agent) this agent can access. */\n  listSecretScopes(): Promise<ScopeInfo$1[]>;\n  /**\n   * Returns the calling agent's own identity context — `{ agentId, tenantId }`\n   * decoded server-side from the agent API token. Used by the\n   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the\n   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.\n   * Plugins should cache this for the daemon's lifetime (single-agent-per-\n   * process invariant). One HTTP round-trip per process activate; not for\n   * per-call use.\n   */\n  whoami(): Promise<{\n    agentId: string;\n    tenantId: string;\n  }>;\n  resolveIdentity(args: {\n    provider: string;\n    platformId: string;\n    kind?: \"user\" | \"agent\" | \"service\" | \"bot\" | \"workspace\";\n    displayName?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n    created?: boolean;\n    reason?: string;\n    /**\n     * Flattened auriclabs permission strings for the resolved identity\n     * (scope-prefixed where applicable). Empty array on miss / org service\n     * outage — the runtime gate fails closed in that case.\n     */\n    permissions: string[];\n  }>;\n  searchIdentities(args?: {\n    q?: string;\n    status?: string;\n    limit?: number;\n  }): Promise<{\n    identities: unknown[];\n  }>;\n  getIdentityContext(identityId: string): Promise<{\n    context: unknown;\n  }>;\n  mergeIdentities(survivorId: string, args: {\n    mergedId: string;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    error?: string;\n  }>;\n  unmergeIdentity(identityId: string, args: {\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    error?: string;\n  }>;\n  addIdentityNote(identityId: string, args: {\n    content: string;\n    category?: string;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    noteId: string | null;\n  }>;\n  tagIdentity(identityId: string, args: {\n    tag: string;\n    action: \"add\" | \"remove\";\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n  }>;\n  getIdentityChangelog(identityId: string, args?: {\n    limit?: number;\n  }): Promise<{\n    entries: unknown[];\n  }>;\n  rollbackIdentity(identityId: string, args: {\n    targetVersion: number;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    entry?: unknown;\n  }>;\n  requestIdentityVerification(args: {\n    claimedIdentityId: string;\n    requestingIdentityId: string;\n    requestingProvider: string;\n    requestingPlatformId: string;\n    preferredChannel?: \"mobile\" | \"email\";\n    /**\n     * Phase 2: agent-supplied contact endpoint. When provided, the top-level\n     * `preferredChannel` is ignored — the contact's channel wins.\n     */\n    contact?: {\n      channel: \"email\" | \"mobile\";\n      value: string;\n    };\n  }): Promise<{\n    verificationId: string;\n    channel: string;\n    deliveredTo: string;\n    expiresAt: string;\n    availableChannels: {\n      channel: string;\n      deliveredTo: string;\n    }[];\n  } | {\n    error: string;\n  }>;\n  confirmIdentityVerification(args: {\n    claimedIdentityId: string;\n    verificationId: string;\n    phrase: string;\n  }): Promise<{\n    verified: boolean;\n    identityId?: string;\n    /** Phase 2: how the confirm resolved — Scenario A vs B. */\n    action?: \"merged\" | \"contact_verified\";\n    error?: string;\n  }>;\n  /**\n   * Update display-shape fields on an Identity. Body excludes `email` /\n   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go\n   * via the verify flow, title/company live on OrgMembership, metadata is\n   * not agent-writable.\n   */\n  updateIdentity(identityId: string, args: {\n    name?: string;\n    avatarUrl?: string;\n    timezone?: string;\n    locale?: string;\n  }): Promise<{\n    ok: boolean;\n  }>;\n  /**\n   * Phase 2 (Section H): server-side verification of a Google Chat sender via\n   * the agent's existing Google OAuth credentials. Returns the resolved\n   * identity (created or matched via Scenario-B email enrichment).\n   */\n  resolveGoogleChatSender(args: {\n    senderUserId: string;\n    spaceId?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n  }>;\n  memorySearch(query: string, opts?: {\n    limit?: number;\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    includeKnowledge?: boolean;\n  }): Promise<{\n    facts: {\n      subject: string;\n      predicate: string;\n      object: string;\n      since: string;\n      confidence: number;\n    }[];\n    memories: {\n      id: string;\n      text: string;\n      topic: string;\n      subtopic: string;\n      tag: string;\n      importance: number;\n      timestamp: number;\n      score: number;\n    }[];\n  }>;\n  memoryStore(text: string, opts?: {\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    importance?: number;\n  }): Promise<{\n    memoryId: string;\n  }>;\n  memoryIngest(sessionKey: string, messages: {\n    role: string;\n    content: string;\n    index: number;\n    timestamp?: string;\n  }[], metadata?: {\n    channelId?: string;\n    userId?: string;\n    userName?: string;\n  }): Promise<{\n    queued: boolean;\n    messageCount: number;\n  }>;\n  memoryLoadContext(tier?: number, topicHint?: string): Promise<{\n    formatted: string;\n    [key: string]: unknown;\n  }>;\n  memoryLookupEntity(subject: string): Promise<{\n    subject: string;\n    triples: {\n      tripleId: string;\n      predicate: string;\n      object: string;\n      validFrom: string;\n      validTo?: string;\n      confidence: number;\n    }[];\n  }>;\n  memoryNavigate(): Promise<{\n    topics: {\n      name: string;\n      tripleCount: number;\n      subtopics: string[];\n    }[];\n    cursor: string | null;\n  }>;\n  memoryDelete(memoryId: string): Promise<{\n    deleted: boolean;\n  }>;\n  memoryStats(): Promise<{\n    vectorCount: number;\n    tripleCount: number;\n    storageEstimateBytes: number;\n    lastIngestionAt?: string;\n  }>;\n  memoryLearn(args: {\n    text: string;\n    source?: string;\n    sourceType?: \"file\" | \"url\" | \"inline\";\n    metadata?: {\n      sessionId?: string;\n      channelId?: string;\n      userName?: string;\n    };\n  }): Promise<{\n    memoriesStored: number;\n    triplesStored: number;\n    chunks: number;\n    source?: string;\n  }>;\n  memoryBootstrapStatus(): Promise<{\n    synced: boolean;\n    syncedAt?: string;\n  }>;\n  memoryBootstrapStatusMark(): Promise<{\n    synced: true;\n    syncedAt: string;\n  }>;\n  searchWeb(params: {\n    query: string;\n    count?: number;\n    offset?: number;\n    country?: string;\n    freshness?: string;\n  }): Promise<unknown>;\n  searchImages(params: {\n    query: string;\n    count?: number;\n  }): Promise<unknown>;\n  searchNews(params: {\n    query: string;\n    count?: number;\n    freshness?: string;\n  }): Promise<unknown>;\n  registerDatabaseCredentials(): Promise<{\n    connectionString: string;\n    username: string;\n    password: string;\n    databases: string[];\n  }>;\n  reportDatabaseAudit(entry: {\n    database: string;\n    collection: string;\n    operation: string;\n    summary?: string;\n  }): Promise<void>;\n}\n//# sourceMappingURL=index.d.ts.map\n//#endregion\nexport { AgentApiClient, AgentApiClientConfig, type ChangelogAction, type ChangelogActor, type ChangelogEntry, type EncryptedEnvelopeV1, type Field, type FieldEnvelope, type FieldFormat, type FieldSensitivity, type FieldView, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretAggregate, type SecretCategory, type SecretMetadata, type SecretScope, SharedFileEntry, SyncAgentInfo, SyncAgentStats, SyncConfirmedUpload, SyncFileEntry, SyncManifest, SyncManifestEntry, SyncPresignedUrl, SyncReconstructBundle, SyncReconstructFile, SyncSessionContent, SyncSessionEntry };\n//# sourceMappingURL=index.d.ts.map"],"mappings":";;;;;AAAo2B,UAI11BiC,oBAAAA,CAAoB;EAAA,MAIpBC,EAAAA,MAAAA;EAAa,MAUbC,EAAAA,MAAAA;AAAiB;UAVjBD,aAAAA,CAkBY;SAIEC,EAAAA,MAAAA;UAAfE,EAAAA,MAAAA;EAAM,WAAA,EAAA,MAAA;EAAA,QAELC,EAAAA,MAAAA;EAAgB,MAKhBC,EAAAA,OAAAA,GAAAA,SAAmB,GAAA,QAAA;EAAA,SAOnBC,CAAAA,EAAAA,MAAAA;EAAmB,SAOnBC,CAAAA,EAAAA,MAAAA;EAKkB,QAGlBC,CAAAA,EAAAA,MAAAA;AAAc;AAOD,UAhDbP,iBAAAA,CAwDgB;EAAA,IAOhBU,EAAAA,MAAAA;EAAkB,IAKlBC,EAAAA,MAAAA;EAAe,QAMXC,EAAAA,MAAAA;EAAc,IAAA,CAAA,EAAA,MAAA;cAGNd,CAAAA,EAAAA,MAAAA;YAKXC,CAAAA,EAAAA,OAAAA;;UA1EDE,YAAAA,CA4EmBA;SAARY,EAAAA,CAAAA;SAQXV,EAAAA,MAAAA;UADJU,EAAAA,MAAAA;OAQQT,EAvFLF,MAuFKE,CAAAA,MAAAA,EAvFUJ,iBAuFVI,CAAAA;;UArFJD,gBAAAA,CAwFIG;QAARO,MAAAA;OACoBN,MAAAA;WAARM,EAAAA,MAAAA;;UApFRT,mBAAAA,CAuFJS;UAIQJ,EAAAA,MAAAA;QADQI,MAAAA;QAGuBH,MAAAA;cAARG,EAAAA,UAAAA,GAAAA,YAAAA;UACDA,EAAAA,MAAAA;;UAvF1BR,mBAAAA,CA6FJQ;QAQAA,MAAAA;QAIwB5B,MAAAA;OAAR4B,MAAAA;cACiC/B,CAAAA,EAAAA,MAAAA;YAAR+B,CAAAA,EAAAA,OAAAA;;UAnGrCP,qBAAAA,CAoGyEO;SAGtEX,EAAAA,MAAAA;QACCjB,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;WAAR4B,EAAAA,MAAAA;WAC8C5B,EAAAA,MAAAA;OAAR4B,EApGnCR,mBAoGmCQ,EAAAA;WACQA,EAAAA,MAAAA;;UAlG1CN,cAAAA,CAuG0BM;SAMlB1B,EAAAA,MAAAA;eADD0B,EAAAA,MAAAA;cAaSA,EAAAA,MAAAA;WAUgBA,EAAAA,MAAAA;YAOZA,EAAAA,MAAAA,GAAAA,IAAAA;;UAnIpBL,aAAAA,CA8IcK;UAKFA,EAAAA,MAAAA;QAIIA,MAAAA;UAKGA,EAAAA,MAAAA;aAYFA,EAAAA,MAAAA;cAIHA,CAAAA,EAAAA,MAAAA;YAMFA,CAAAA,EAAAA,OAAAA;;UA1KZJ,gBAAAA,CA2LSP;WACbW,EAAAA,MAAAA;QAIiBA,MAAAA;cAWfA,EAAAA,MAAAA;cAaFA,CAAAA,EAAAA,MAAAA;YAYKhB,EAAAA,OAAAA;;UA7NDa,kBAAAA,CAiOJG;WAQKhB,EAAAA,MAAAA;SAKLgB,EAAAA,MAAAA;YAUKhB,EAAAA,OAAAA;;UAnPDc,eAAAA,CA4PKpC;UACIE,EAAAA,MAAAA;UAEFP,EAAAA,MAAAA;QAGHqB,MAAAA;aAARsB,CAAAA,EAAAA,MAAAA;;cA5PQD,cAAAA,CAmQCrB;mBACAlB,MAAAA;mBAFTwC,MAAAA;aAMKhB,CAAAA,MAAAA,EArQWC,oBAqQXD;UAMMpB,OAAAA;cACJF,CAAAA,KAAAA,EAAAA;eAEEL,CAAAA,EAAAA,MAAAA;MA1QT2C,OAqQAA,CAAAA;SAYKhB,EAhRAE,aAgRAF;;iBAKEtB,CAAAA,CAAAA,EAnRQsC,OAmRRtC,CAnRgB0B,YAmRhB1B,CAAAA;aAEEL,CAAAA,IAAAA,EAAAA;SAET2C,EAAAA;UAMKhB,EAAAA,MAAAA;eAILgB,EAAAA,KAAAA,GAAAA,KAAAA;iBAGKhB,CAAAA,EAAAA,MAAAA;OAMIJ;MAnSToB,OAqSQtB,CAAAA;QAARsB,EApSIV,gBAoSJU,EAAAA;;mBAKSpB,CAAAA,IAAAA,EAAAA;YAGDE,EAAAA,MAAAA;QAARkB,EAAAA,MAAAA;QAGKhB,EAAAA,MAAAA;gBAME7B,CAAAA,EAAAA,UAAAA,GAAAA,YAAAA;MA9SP6C,OA6SAA,CA7SQT,mBA6SRS,CAAAA;iBAMKhB,CAAAA,IAAAA,EAAAA;QAGLgB,EAAAA,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;MAnTAA,OAqTwBxB,CArThBiB,qBAqTgBjB,CAAAA;cAARwB,CAAAA,CAAAA,EApTJA,OAoTIA,CApTIN,cAoTJM,CAAAA;eAUVA,CAAAA,KAAAA,EAAAA;UASNA,CAAAA,EAAAA,MAAAA;MApUAA,OAoVAA,CAAAA;SAGoCA,EAtV/BL,aAsV+BK,EAAAA;;kBAoBpCA,CAAAA,CAAAA,EAxWgBA,OAwWhBA,CAAAA;YAYAA,EAnXQJ,gBAmXRI,EAAAA;;gBAgBAA,CAAAA,SAAAA,EAAAA,MAAAA,CAAAA,EAjY+BA,OAiY/BA,CAjYuCH,kBAiYvCG,CAAAA;gBAUAA,CAAAA,QAAAA,EAAAA,MAAAA,CAAAA,EA1Y8BA,OA0Y9BA,CAAAA;WAkBAA,EAAAA,OAAAA;;iBAkCAA,CAAAA,IAAAA,EAAAA;SAWAA,EAAAA,KAAAA,GAAAA,MAAAA,GAAAA,SAAAA;WAUAA,EAAAA,MAAAA;MA7cAA,OAqeAA,CAAAA;SAYAA,EAhfKF,eAgfLE,EAAAA;cAIkDA,EAAAA,MAAAA,GAAAA,IAAAA;;mBAepCA,CAAAA,IAAAA,EAAAA;SAQcA,EAAAA,KAAAA,GAAAA,MAAAA,GAAAA,SAAAA;WAGjBA,EAAAA,MAAAA;YAeXA,EAAAA,MAAAA;MAthBAA,OA4hBqBA,CAAAA;eAIIA,EAAAA,MAAAA;aAUzBA,EAAAA,MAAAA;;kBASAA,CAAAA,CAAAA,EA/iBgBA,OA+iBhBA,CA/iBwB5B,kBA+iBxB4B,EAAAA,CAAAA;sBAC2BA,CAAAA,aAAAA,EAAAA,MAAAA,CAAAA,EA/iBcA,OA+iBdA,CA/iBsB/B,uBA+iBtB+B,CAAAA;yBAW3BA,CAAAA,aAAAA,EAAAA,MAAAA,EAAAA,MAAAA,EAzjBmDX,MAyjBnDW,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA,CAAAA,EAzjB6EA,OAyjB7EA,CAAAA,IAAAA,CAAAA;EAAO,kBAAA,CAAA,aAAA,EAAA,MAAA,EAAA,QAAA,EAAA;;aAtjBAX;MACPW,QAAQ5B;EC3Id,iBAAwB,CAAA,aAAA,EAAA,MAAA,CAAA,ED4IoB4B,OC5IpB,CD4I4B5B,kBC5I5B,CAAA;EASxB,WAAa,CAAA,QAA4B,EAAA,MAAA,EAAA,MAAA,CAAA,EAAA,MAAA,EAAA,CAAA,EDoIW4B,OCpIX,CAAA;IAa5B,GAAA,EAAA,MAAA;IAEI,QAAA,EAAA,MAAa;IAqBR,SAAA,EAAA,MAAY;EAAA,CAAA,CAAA;gBAAO,CAAA,QAAA,EAAA,MAAA,CAAA,EDqGLA,OCrGK,CAAA;YAA6B,EAAA,MAAA;aAAR,EAAA,OAAA;IAAO,MAAA,CAAA,EDwGxDX,MCxGwD,CAAA,MAAA,EAAA,MAAA,CAAA;EA6BrE,CAAA,CAAsB;iBD6ELW;kBACC1B;;;;;;;;;;;;0BAYQ0B;;;;;;;;;;0CAUgBA;;;;;;;8BAOZA;;;;;;;0BAOJA;;;;wBAIFA;;;;;sBAKFA;;;;0BAIIA;;;;;6BAKGA;;;;;;;;;;;;2BAYFA;;;;wBAIHA;;;;;;sBAMFA;;;;yBAIGA;;;;;;;;;;;;;mBAaNX;MACbW;;;;uBAIiBA;;;;;;;;;;;QAWfA;;;;;;;;;;;;;MAaFA;;;;;;;;;;;;WAYKhB;;;;MAILgB,QAAQjC;;;;;;;;WAQHiB;;;;;MAKLgB;;;;;;;;;;WAUKhB;;;;eAIIJ;;;;;eAKAlB;mBACIE;;iBAEFP;;;MAGX2C,QAAQtB;;;WAGHM;;;MAGLgB;eACStB;eACAlB;;;;WAIJwB;;;;MAILgB;;iBAEWpC;aACJF;;eAEEL;;;;;;;WAOJ2B;;;;iBAIMpB;aACJF;;eAEEL;;MAET2C;;;;;;WAMKhB;;;;MAILgB;;;WAGKhB;;;;;;eAMIJ;;MAEToB,QAAQtB;;;WAGHM;;eAEIJ;;;MAGToB,QAAQlB;;;WAGHE;;;;;MAKLgB;aACO7C;;;;;WAKF6B;;;MAGLgB;;sBAEgBA,QAAQxB;;;;;;;;;;YAUlBwB;;;;;;;;;MASNA;;;;;;;;;;;;;;;;MAgBAA;;;0CAGoCA;;;;;;;;;;MAUpCA;;;;;;;;;;MAUAA;;;;;;;;;;;;MAYAA;;;;;;;;;;;MAWAA;;;;;MAKAA;;;;;;;;;;MAUAA;;;;;;;;;;;;;;;;;;MAkBAA;;;;;;;;;;;;;;;;MAgBAA;;;;;;;;;;;;;;;;;;MAkBAA;;;;;;;;;;;MAWAA;;;;;;;;;;MAUAA;;;;;;;;;;;;;;;;;;;;;;;;MAwBAA;;;;;;;;;;;;MAYAA;;;;wDAIkDA;;;;uCAIjBA;;;;;;;;;;;oBAWnBA;;;;;;;;kCAQcA;;;iBAGjBA;;;;;;;;;;;;;;;MAeXA;;;;;;2BAMqBA;;;;+BAIIA;;;;;;;;;;MAUzBA;;;;MAIAA;;;;;MAKAA;iCAC2BA;;;;;;;;;;;MAW3BA;;;;;;;;AAhtB81B;AAIt0B;AAIP;AAkBbZ,cCVG,WAAA,GDUS,eAAA;;;;;AAIP;AAEW;AAKG;AAcnBK,cC1BG,cD0BkB,EAAA,MAKtBD;AAAmB;AAGJ;AAOD;AAQG;AAOE;AAKH;;;;;;AAgBJQ,cChER,eDgEQA,EAAAA,MAAAA;AAQXV,UCtEO,aAAA,CDsEPA;;;;;QAUJU,CAAAA,EC3EK,cD2ELA;;UACYA,CAAAA,EAAAA;IAIPL,OAAAA,EAAAA,MAAAA;IADLK,QAAAA,EAAAA,MAAAA;;;QAMuCH,CAAAA,EAAAA,MAAAA;;;;;;;;;;;AAqBsCG,iBC1F7D,YAAA,CD0F6DA,IAAAA,CAAAA,EC1F1C,aD0F0CA,CAAAA,EC1FrB,OD0FqBA,CC1Fb,SD0FaA,CAAAA;;;;;;;AActEX,iBC3ES,IAAA,CAAA,CD2ETA,EC3EiB,OD2EjBA,CAAAA,IAAAA,CAAAA"}
+{"version":3,"file":"index.d.cts","names":["ChangelogAction","ChangelogActor","ChangelogEntry","ChangelogEntry$1","EncryptedEnvelopeV1","EncryptedEnvelopeV1$1","Field","FieldEnvelope","FieldEnvelope$1","FieldFormat","FieldFormat$1","FieldSensitivity","FieldSensitivity$1","FieldView","GeneratedDataKey","GeneratedDataKey$1","IntegrationConfigResult","IntegrationConfigResult$1","IntegrationConfigSchemaField","IntegrationInstall","IntegrationInstall$1","RegistryEntry","RegistryEntry$1","ScopeInfo","ScopeInfo$1","SecretAggregate","SecretAggregate$1","SecretCategory","SecretCategory$1","SecretMetadata","SecretMetadata$1","SecretScope","SecretScope$1","AgentApiClientConfig","SyncAgentInfo","SyncManifestEntry","SyncManifest","Record","SyncPresignedUrl","SyncConfirmedUpload","SyncReconstructFile","SyncReconstructBundle","SyncAgentStats","SyncFileEntry","SyncSessionEntry","SyncSessionContent","SharedFileEntry","AgentApiClient","Promise"],"sources":["../../agent-api-client/dist/index.d.ts","../src/index.ts"],"sourcesContent":["import { ChangelogAction, ChangelogActor, ChangelogEntry, ChangelogEntry as ChangelogEntry$1, EncryptedEnvelopeV1, EncryptedEnvelopeV1 as EncryptedEnvelopeV1$1, Field, FieldEnvelope, FieldEnvelope as FieldEnvelope$1, FieldFormat, FieldFormat as FieldFormat$1, FieldSensitivity, FieldSensitivity as FieldSensitivity$1, FieldView, GeneratedDataKey, GeneratedDataKey as GeneratedDataKey$1, IntegrationConfigResult, IntegrationConfigResult as IntegrationConfigResult$1, IntegrationConfigSchemaField, IntegrationInstall, IntegrationInstall as IntegrationInstall$1, RegistryEntry, RegistryEntry as RegistryEntry$1, ScopeInfo, ScopeInfo as ScopeInfo$1, SecretAggregate, SecretAggregate as SecretAggregate$1, SecretCategory, SecretCategory as SecretCategory$1, SecretMetadata, SecretMetadata as SecretMetadata$1, SecretScope, SecretScope as SecretScope$1 } from \"@alfe/types\";\n\n//#region src/index.d.ts\n\ninterface AgentApiClientConfig {\n  apiKey: string;\n  apiUrl: string;\n}\ninterface SyncAgentInfo {\n  agentId: string;\n  tenantId: string;\n  displayName: string;\n  s3Prefix: string;\n  status: \"stale\" | \"syncing\" | \"synced\";\n  fileCount?: number;\n  totalSize?: number;\n  lastSync?: string;\n}\ninterface SyncManifestEntry {\n  hash: string;\n  size: number;\n  modified: string;\n  etag?: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncManifest {\n  version: 1;\n  agentId: string;\n  lastSync: string;\n  files: Record<string, SyncManifestEntry>;\n}\ninterface SyncPresignedUrl {\n  path: string;\n  url: string;\n  expiresAt: string;\n}\ninterface SyncConfirmedUpload {\n  filePath: string;\n  hash: string;\n  size: number;\n  storageClass: \"STANDARD\" | \"GLACIER_IR\";\n  syncedAt: string;\n}\ninterface SyncReconstructFile {\n  path: string;\n  size: number;\n  url: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncReconstructBundle {\n  agentId: string;\n  mode: \"full\" | \"active\" | \"memory\";\n  fileCount: number;\n  totalSize: number;\n  files: SyncReconstructFile[];\n  expiresAt: string;\n}\ninterface SyncAgentStats {\n  agentId: string;\n  standardBytes: number;\n  glacierBytes: number;\n  fileCount: number;\n  lastSyncAt: string | null;\n}\ninterface SyncFileEntry {\n  filePath: string;\n  size: number;\n  modified: string;\n  contentHash: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncSessionEntry {\n  sessionId: string;\n  size: number;\n  lastModified: string;\n  storageClass?: string;\n  isArchived: boolean;\n}\ninterface SyncSessionContent {\n  sessionId: string;\n  content: string;\n  compressed: boolean;\n}\ninterface SharedFileEntry {\n  filePath: string;\n  fileName: string;\n  size: number;\n  contentType?: string;\n}\ndeclare class AgentApiClient {\n  private readonly apiKey;\n  private readonly apiUrl;\n  constructor(config: AgentApiClientConfig);\n  private request;\n  syncRegister(args?: {\n    displayName?: string;\n  }): Promise<{\n    agent: SyncAgentInfo;\n  }>;\n  syncGetManifest(): Promise<SyncManifest>;\n  syncPresign(args: {\n    files: {\n      path: string;\n      operation: \"put\" | \"get\";\n      contentType?: string;\n    }[];\n  }): Promise<{\n    urls: SyncPresignedUrl[];\n  }>;\n  syncConfirmUpload(args: {\n    filePath: string;\n    hash: string;\n    size: number;\n    storageClass?: \"STANDARD\" | \"GLACIER_IR\";\n  }): Promise<SyncConfirmedUpload>;\n  syncReconstruct(args: {\n    mode: \"full\" | \"active\" | \"memory\";\n  }): Promise<SyncReconstructBundle>;\n  syncGetStats(): Promise<SyncAgentStats>;\n  syncListFiles(args?: {\n    prefix?: string;\n  }): Promise<{\n    files: SyncFileEntry[];\n  }>;\n  syncListSessions(): Promise<{\n    sessions: SyncSessionEntry[];\n  }>;\n  syncGetSession(sessionId: string): Promise<SyncSessionContent>;\n  syncDeleteFile(filePath: string): Promise<{\n    removed: boolean;\n  }>;\n  sharedListFiles(args: {\n    scope: \"org\" | \"team\" | \"project\";\n    scopeId: string;\n  }): Promise<{\n    files: SharedFileEntry[];\n    nextCursor: string | null;\n  }>;\n  sharedDownloadUrl(args: {\n    scope: \"org\" | \"team\" | \"project\";\n    scopeId: string;\n    filePath: string;\n  }): Promise<{\n    downloadUrl: string;\n    expiresIn: number;\n  }>;\n  listIntegrations(): Promise<IntegrationInstall$1[]>;\n  getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult$1>;\n  updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;\n  installIntegration(integrationId: string, options?: {\n    version?: string;\n    config?: Record<string, unknown>;\n  }): Promise<IntegrationInstall$1>;\n  removeIntegration(integrationId: string): Promise<IntegrationInstall$1>;\n  getOAuthUrl(provider: string, scopes?: string[]): Promise<{\n    url: string;\n    provider: string;\n    expiresIn: number;\n  }>;\n  getOAuthStatus(provider: string): Promise<{\n    provider: string;\n    connected: boolean;\n    config?: Record<string, string>;\n  }>;\n  getRegistry(): Promise<{\n    integrations: RegistryEntry$1[];\n  }>;\n  /**\n   * Returns every connected Google account for the agent. Multi-account by\n   * design — the openclaw-google plugin requires the LLM to pass `email`\n   * explicitly to `google_run_command` so an account is always selected\n   * deliberately.\n   *\n   * 2026-05-14 (connections-redesign PR 1): the legacy flat shape (`email`,\n   * `refreshToken`, `accessToken`, etc., populated from the default account)\n   * is gone. Iterate over `accounts`.\n   */\n  getGoogleCredentials(): Promise<{\n    accounts: {\n      email: string;\n      refreshToken: string;\n      clientId: string;\n      clientSecret: string;\n      displayName?: string;\n      connectedAt?: string;\n    }[];\n  }>;\n  disconnectGoogleAccount(email: string): Promise<{\n    accounts: {\n      email: string;\n      displayName?: string;\n      connectedAt?: string;\n    }[];\n  }>;\n  getGoogleChatCredentials(): Promise<{\n    email: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    displayName?: string;\n  }>;\n  /**\n   * @deprecated Returns a single primary credential blob (legacy \"pick-the-\n   * default-connection\" shape). Use `getGithubAccounts()` for the multi-\n   * account shape required by Pattern A — explicit selector args on every\n   * tool. Retained because the `@alfe.ai/openclaw-github` proxy is the\n   * only consumer that knows about Pattern A; legacy env-interpolation\n   * callers will keep hitting `/credentials` until they move to the proxy.\n   */\n  getGithubCredentials(): Promise<{\n    login: string;\n    accessToken: string;\n  }>;\n  /**\n   * Pattern A: multi-account credential fetch for GitHub.\n   *\n   * Returns every agent-scoped GitHub connection. The caller is expected\n   * to require a `login` selector on every credential-touching tool and\n   * look up the matching account at dispatch time.\n   *\n   * GitHub OAuth tokens have no expiry (`tokenLifecycle: \"no_expiry\"`),\n   * so there is intentionally no `refreshGithubAccountToken` method — if\n   * a token is revoked the user must re-run the OAuth flow.\n   *\n   * Returned `accounts[i].login` is the GitHub username — the stable\n   * cross-session identifier the LLM should pass.\n   */\n  getGithubAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      login: string;\n      scopes: string;\n    }[];\n  }>;\n  /**\n   * @deprecated Returns a single primary credential blob (legacy \"pick-the-\n   * default-connection\" shape). Use `getXeroAccounts()` for the multi-\n   * account shape required by Pattern A — explicit selector args on every\n   * tool. This method will be removed once all consumers migrate.\n   */\n  getXeroCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    xeroTenantId: string;\n  }>;\n  /**\n   * Pattern A: multi-account credential fetch for Xero. Returns every\n   * agent-scoped Xero connection. The caller is expected to require a\n   * selector arg (e.g. `xeroTenantId`) on every credential-touching tool\n   * and look up the matching account by that selector at dispatch time.\n   *\n   * Returned `accounts[i].accountIdentifier` is the Xero tenantId — the\n   * stable cross-session identifier the LLM should pass.\n   */\n  getXeroAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      accessTokenExpiresAt: string;\n      xeroTenantId: string;\n    }[];\n  }>;\n  refreshXeroToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  /**\n   * Pattern A: refresh a specific Xero connection by its `accountIdentifier`\n   * (the Xero `tenantId`). The legacy `refreshXeroToken()` only refreshes\n   * the *primary* connection, which is wrong for multi-tenant Xero where\n   * each tenant has its own non-interchangeable access token.\n   */\n  refreshXeroAccountToken(xeroTenantId: string): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    expiresAt: string;\n  }>;\n  /**\n   * @deprecated Returns a single primary credential blob (legacy \"pick-the-\n   * default-connection\" shape). Use `getNotionAccounts()` for the multi-\n   * account shape required by Pattern A.\n   */\n  getNotionCredentials(): Promise<{\n    accessToken: string;\n    workspaceId: string;\n    workspaceName: string;\n  }>;\n  /**\n   * Pattern A: multi-account credential fetch for Notion. Returns every\n   * agent-scoped Notion connection. The caller is expected to require a\n   * selector arg (e.g. `workspaceId`) on every credential-touching tool.\n   *\n   * Returned `accounts[i].accountIdentifier` is the Notion workspaceId.\n   */\n  getNotionAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      workspaceId: string;\n      workspaceName: string;\n    }[];\n  }>;\n  /**\n   * @deprecated Returns a single primary Atlassian Connection's credentials\n   * (one OAuth user, one cloudId) — the legacy \"pick-the-default-connection\"\n   * shape. Atlassian is multi-site by nature (each OAuth user may have\n   * access to multiple Cloud sites), so Pattern A plugins MUST use\n   * `getAtlassianAccounts()` to discover the full set and dispatch via\n   * the `cloudId` selector arg.\n   */\n  getAtlassianCredentials(): Promise<{\n    accessToken: string;\n    refreshToken: string;\n    accessTokenExpiresAt: string;\n    cloudId: string;\n    siteName: string;\n    siteUrl: string;\n    email: string;\n    enabledProducts: string[];\n    clientId: string;\n    clientSecret: string;\n  }>;\n  refreshAtlassianToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  /**\n   * Pattern A: multi-account / multi-site credential fetch for Atlassian.\n   *\n   * Returns every agent-scoped Atlassian Connection. Each Connection is\n   * one OAuth user with a single access token and N accessible Cloud\n   * sites (`availableSites`). The caller is expected to:\n   *\n   *   1. Flatten (connection × cloudId) into one MCP child per site.\n   *   2. Require a `cloudId` selector on every credential-touching tool.\n   *   3. Use the access token bound to the Connection that owns the\n   *      requested `cloudId` (Atlassian shares one access token across\n   *      all sites accessible to the OAuth user).\n   *\n   * Per-account token refresh uses `refreshAtlassianAccountToken(email)`\n   * — refreshing one Connection rotates its single access token, which\n   * then applies to every cloudId for that Connection.\n   *\n   * Returned `accounts[i].accountIdentifier` is the OAuth user's email\n   * — the stable cross-session identifier for refresh purposes. The LLM\n   * never sees this directly: it picks a site via the `cloudId` arg\n   * instead.\n   */\n  getAtlassianAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      accessTokenExpiresAt: string;\n      clientId: string;\n      clientSecret: string;\n      cloudId: string;\n      siteName: string;\n      siteUrl: string;\n      availableSites: {\n        id: string;\n        url: string;\n        name: string;\n        scopes?: string[];\n        avatarUrl?: string;\n      }[];\n    }[];\n  }>;\n  /**\n   * Pattern A: refresh a specific Atlassian Connection by `accountIdentifier`\n   * (the OAuth user's email).\n   *\n   * Atlassian rotates refresh tokens (`rotatesRefreshToken: true`); the\n   * server-side per-account refresh endpoint handles rotation and\n   * persistence. Refreshing one Connection updates its single access\n   * token, which applies to every accessible Cloud site (cloudId) for\n   * that OAuth user.\n   *\n   * Returns the new access token + expiry. The proxy is responsible for\n   * fanning the new token out to every child server it spawned for\n   * cloudIds owned by this Connection.\n   */\n  refreshAtlassianAccountToken(accountIdentifier: string): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    expiresAt: string;\n  }>;\n  /**\n   * @deprecated Returns a single primary credential blob (legacy \"pick-the-\n   * default-connection\" shape). Use `getMYOBAccounts()` for the multi-\n   * account shape required by Pattern A.\n   */\n  getMYOBCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    myobBusinessId: string;\n    clientId: string;\n  }>;\n  /**\n   * Pattern A: multi-account credential fetch for MYOB. Returns every\n   * agent-scoped MYOB connection. The caller is expected to require a\n   * selector arg (e.g. `myobBusinessId` / `accountIdentifier`) on every\n   * credential-touching tool.\n   *\n   * Returned `accounts[i].accountIdentifier` is the MYOB businessId.\n   */\n  getMYOBAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      accessTokenExpiresAt: string;\n      myobBusinessId: string;\n      clientId: string;\n    }[];\n  }>;\n  refreshMYOBToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  /**\n   * Microsoft 365 (delegated OAuth) credential fetch — single-account shape.\n   *\n   * @deprecated Use `getMicrosoftAccounts()` and dispatch via the `email`\n   *   selector once per-account plugins land. Retained because the existing\n   *   `integrations/connect/microsoft/hooks/post_activate.mjs` writes\n   *   `mgc` credentials for the single (default) Microsoft account.\n   *\n   * Returns the agent's effective Microsoft delegated-OAuth credentials.\n   * Distinct from `getTeamsCredentials()` (Azure bot credentials for the\n   * Teams adapter, which is admin-consent flow on services/microsoft, not\n   * delegated OAuth on services/connect).\n   */\n  getMicrosoftCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt?: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    email?: string;\n    microsoftTenantId?: string;\n    workspaceDomain?: string;\n  }>;\n  /**\n   * Pattern A: multi-account credential fetch for Microsoft 365.\n   *\n   * Returns every agent-scoped Microsoft connection. The caller is expected\n   * to require an `email` selector on every credential-touching tool and\n   * look up the matching account at dispatch time.\n   *\n   * Returned `accounts[i].accountIdentifier` is the user's primary email\n   * (or the tid claim as fallback) — the stable cross-session identifier\n   * the LLM should pass.\n   *\n   * Per-account token refresh is exposed via `refreshMicrosoftAccountToken`,\n   * NOT `refreshXeroAccountToken` — Microsoft refresh tokens are not\n   * interchangeable across (tenant, user) pairs.\n   */\n  getMicrosoftAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      accessTokenExpiresAt: string;\n      refreshToken: string;\n      clientId: string;\n      clientSecret: string;\n      email: string;\n      microsoftTenantId: string;\n      workspaceDomain: string;\n    }[];\n  }>;\n  /**\n   * Pattern A: refresh a specific Microsoft 365 connection by its\n   * `accountIdentifier`. For Microsoft, `accountIdentifier` is the user's\n   * email when the Graph profile fetch succeeded at connect time, and the\n   * Azure tenant id (`tid` claim) as fallback. Callers should pass the\n   * value returned by `getMicrosoftAccounts()` rather than synthesising\n   * an email locally.\n   *\n   * Microsoft refresh tokens are bound to a specific (tenant, user) pair —\n   * they are NOT interchangeable across accounts, so per-account refresh\n   * is mandatory. The generic /accounts/{accountIdentifier}/refresh\n   * endpoint walks the agent's full visible scope chain to find a matching\n   * connection (works for inherited team/project Microsoft connections).\n   */\n  refreshMicrosoftAccountToken(accountIdentifier: string): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    expiresAt: string;\n  }>;\n  getTeamsCredentials(): Promise<{\n    agentId: string;\n    tenantId: string;\n    azureAppId: string;\n    azureBotId: string;\n    azureClientSecret: string;\n    botDisplayName?: string;\n    teamsTenantId?: string;\n    serviceUrl?: string;\n  }>;\n  sendTeamsMessage(data: {\n    conversationId: string;\n    text?: string;\n    adaptiveCard?: Record<string, unknown>;\n  }): Promise<{\n    ok: boolean;\n    activityId: string;\n  }>;\n  listTeamsChannels(): Promise<{\n    channels: {\n      id: string;\n      name: string;\n      description?: string;\n    }[];\n  }>;\n  presignAttachments(files: {\n    filename: string;\n    mimeType: string;\n    size: number;\n  }[]): Promise<{\n    attachments: {\n      id: string;\n      uploadUrl: string;\n      downloadUrl: string;\n      s3Key: string;\n      expiresAt: string;\n    }[];\n  }>;\n  recordActivity(data: {\n    userId?: string;\n    channel: string;\n    role: \"user\" | \"assistant\";\n  }): Promise<{\n    recorded: boolean;\n  }>;\n  /**\n   * Mint a fresh AES-256 data key for a specific (secret, field) pair. The\n   * encryption context is rebuilt server-side from `auth.tenantId` + the body\n   * fields including `fieldKey`; the agent cannot forge context for a scope\n   * or field it doesn't own. Legacy single-envelope secrets are migrated to\n   * `field#value` rows by the data migration, so call with `fieldKey: \"value\"`\n   * to reach them.\n   */\n  generateSecretDataKey(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<GeneratedDataKey$1>;\n  /**\n   * Unwrap a wrapped data key so the agent can decrypt the envelope locally.\n   * `fieldKey` MUST match the value supplied when the data key was generated\n   * (it's bound into KMS encryption context); mismatch fails with\n   * `InvalidCiphertextException`.\n   */\n  decryptSecretDataKey(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n    dataKeyCiphertext: string;\n  }): Promise<{\n    plaintextKey: string;\n  }>;\n  /**\n   * Create a new secret with one or more fields. Encrypted fields must arrive\n   * pre-sealed (the agent has already obtained per-field data keys via\n   * `generateSecretDataKey({ ..., fieldKey })` and AES-encrypted locally).\n   * Plaintext fields ship the value inline.\n   */\n  createSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    secretName: string;\n    category?: SecretCategory$1;\n    description?: string;\n    tags?: string[];\n    fields: {\n      key: string;\n      format?: FieldFormat$1;\n      sensitivity: FieldSensitivity$1;\n      value?: string;\n      envelope?: EncryptedEnvelopeV1$1;\n    }[];\n    reason?: string;\n  }): Promise<SecretAggregate$1>;\n  /** Fetch the secret aggregate plus per-field encrypted envelopes. */\n  getSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n  }): Promise<{\n    aggregate: SecretAggregate$1;\n    envelopes: FieldEnvelope$1[];\n  }>;\n  /** Fetch one field. Plaintext: value inline. Encrypted: envelope. */\n  getSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<{\n    key: string;\n    sensitivity: FieldSensitivity$1;\n    format?: FieldFormat$1;\n    value?: string;\n    envelope?: EncryptedEnvelopeV1$1;\n    rotatedAt?: string;\n    createdAt: string;\n    updatedAt: string;\n  }>;\n  /** Add OR rotate one field. */\n  setSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n    sensitivity: FieldSensitivity$1;\n    format?: FieldFormat$1;\n    value?: string;\n    envelope?: EncryptedEnvelopeV1$1;\n    reason?: string;\n  }): Promise<{\n    fieldKey: string;\n    rotated: boolean;\n  }>;\n  /** Remove one field. */\n  removeSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<void>;\n  /** Update secret-level metadata (name/description/tags/category). */\n  updateSecretMetadata(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    secretName?: string;\n    description?: string;\n    tags?: string[];\n    category?: SecretCategory$1;\n    reason?: string;\n  }): Promise<SecretAggregate$1>;\n  /** List metadata for secrets in a scope. Optional filters route through the byFacet GSI. */\n  listSecrets(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    category?: SecretCategory$1;\n    tag?: string;\n    fieldKey?: string;\n  }): Promise<SecretMetadata$1[]>;\n  /** Bounded changelog read — metadata-only audit entries. */\n  getSecretHistory(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    limit?: number;\n    cursor?: string;\n  }): Promise<{\n    entries: ChangelogEntry$1[];\n    nextCursor?: string;\n  }>;\n  /** Delete a secret (and all its field rows + tag rows + changelog rows). */\n  deleteSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n  }): Promise<void>;\n  /** Enumerate scopes (org/team/project/agent) this agent can access. */\n  listSecretScopes(): Promise<ScopeInfo$1[]>;\n  /**\n   * Returns the calling agent's own identity context — `{ agentId, tenantId }`\n   * decoded server-side from the agent API token. Used by the\n   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the\n   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.\n   * Plugins should cache this for the daemon's lifetime (single-agent-per-\n   * process invariant). One HTTP round-trip per process activate; not for\n   * per-call use.\n   */\n  whoami(): Promise<{\n    agentId: string;\n    tenantId: string;\n  }>;\n  resolveIdentity(args: {\n    provider: string;\n    platformId: string;\n    kind?: \"user\" | \"agent\" | \"service\" | \"bot\" | \"workspace\";\n    displayName?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n    created?: boolean;\n    reason?: string;\n    /**\n     * Flattened auriclabs permission strings for the resolved identity\n     * (scope-prefixed where applicable). Empty array on miss / org service\n     * outage — the runtime gate fails closed in that case.\n     */\n    permissions: string[];\n  }>;\n  searchIdentities(args?: {\n    q?: string;\n    status?: string;\n    limit?: number;\n  }): Promise<{\n    identities: unknown[];\n  }>;\n  getIdentityContext(identityId: string): Promise<{\n    context: unknown;\n  }>;\n  mergeIdentities(survivorId: string, args: {\n    mergedId: string;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    error?: string;\n  }>;\n  unmergeIdentity(identityId: string, args: {\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    error?: string;\n  }>;\n  addIdentityNote(identityId: string, args: {\n    content: string;\n    category?: string;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    noteId: string | null;\n  }>;\n  tagIdentity(identityId: string, args: {\n    tag: string;\n    action: \"add\" | \"remove\";\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n  }>;\n  getIdentityChangelog(identityId: string, args?: {\n    limit?: number;\n  }): Promise<{\n    entries: unknown[];\n  }>;\n  rollbackIdentity(identityId: string, args: {\n    targetVersion: number;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    entry?: unknown;\n  }>;\n  requestIdentityVerification(args: {\n    claimedIdentityId: string;\n    requestingIdentityId: string;\n    requestingProvider: string;\n    requestingPlatformId: string;\n    preferredChannel?: \"mobile\" | \"email\";\n    /**\n     * Phase 2: agent-supplied contact endpoint. When provided, the top-level\n     * `preferredChannel` is ignored — the contact's channel wins.\n     */\n    contact?: {\n      channel: \"email\" | \"mobile\";\n      value: string;\n    };\n  }): Promise<{\n    verificationId: string;\n    channel: string;\n    deliveredTo: string;\n    expiresAt: string;\n    availableChannels: {\n      channel: string;\n      deliveredTo: string;\n    }[];\n  } | {\n    error: string;\n  }>;\n  confirmIdentityVerification(args: {\n    claimedIdentityId: string;\n    verificationId: string;\n    phrase: string;\n  }): Promise<{\n    verified: boolean;\n    identityId?: string;\n    /** Phase 2: how the confirm resolved — Scenario A vs B. */\n    action?: \"merged\" | \"contact_verified\";\n    error?: string;\n  }>;\n  /**\n   * Update display-shape fields on an Identity. Body excludes `email` /\n   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go\n   * via the verify flow, title/company live on OrgMembership, metadata is\n   * not agent-writable.\n   */\n  updateIdentity(identityId: string, args: {\n    name?: string;\n    avatarUrl?: string;\n    timezone?: string;\n    locale?: string;\n  }): Promise<{\n    ok: boolean;\n  }>;\n  /**\n   * Phase 2 (Section H): server-side verification of a Google Chat sender via\n   * the agent's existing Google OAuth credentials. Returns the resolved\n   * identity (created or matched via Scenario-B email enrichment).\n   */\n  resolveGoogleChatSender(args: {\n    senderUserId: string;\n    spaceId?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n  }>;\n  memorySearch(query: string, opts?: {\n    limit?: number;\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    includeKnowledge?: boolean;\n  }): Promise<{\n    facts: {\n      subject: string;\n      predicate: string;\n      object: string;\n      since: string;\n      confidence: number;\n    }[];\n    memories: {\n      id: string;\n      text: string;\n      topic: string;\n      subtopic: string;\n      tag: string;\n      importance: number;\n      timestamp: number;\n      score: number;\n    }[];\n  }>;\n  memoryStore(text: string, opts?: {\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    importance?: number;\n  }): Promise<{\n    memoryId: string;\n  }>;\n  memoryIngest(sessionKey: string, messages: {\n    role: string;\n    content: string;\n    index: number;\n    timestamp?: string;\n  }[], metadata?: {\n    channelId?: string;\n    userId?: string;\n    userName?: string;\n  }): Promise<{\n    queued: boolean;\n    messageCount: number;\n  }>;\n  memoryLoadContext(tier?: number, topicHint?: string): Promise<{\n    formatted: string;\n    [key: string]: unknown;\n  }>;\n  memoryLookupEntity(subject: string): Promise<{\n    subject: string;\n    triples: {\n      tripleId: string;\n      predicate: string;\n      object: string;\n      validFrom: string;\n      validTo?: string;\n      confidence: number;\n    }[];\n  }>;\n  memoryNavigate(): Promise<{\n    topics: {\n      name: string;\n      tripleCount: number;\n      subtopics: string[];\n    }[];\n    cursor: string | null;\n  }>;\n  memoryDelete(memoryId: string): Promise<{\n    deleted: boolean;\n  }>;\n  memoryStats(): Promise<{\n    vectorCount: number;\n    tripleCount: number;\n    storageEstimateBytes: number;\n    lastIngestionAt?: string;\n  }>;\n  memoryLearn(args: {\n    text: string;\n    source?: string;\n    sourceType?: \"file\" | \"url\" | \"inline\";\n    metadata?: {\n      sessionId?: string;\n      channelId?: string;\n      userName?: string;\n    };\n  }): Promise<{\n    memoriesStored: number;\n    triplesStored: number;\n    chunks: number;\n    source?: string;\n  }>;\n  memoryBootstrapStatus(): Promise<{\n    synced: boolean;\n    syncedAt?: string;\n  }>;\n  memoryBootstrapStatusMark(): Promise<{\n    synced: true;\n    syncedAt: string;\n  }>;\n  searchWeb(params: {\n    query: string;\n    count?: number;\n    offset?: number;\n    country?: string;\n    freshness?: string;\n  }): Promise<unknown>;\n  searchImages(params: {\n    query: string;\n    count?: number;\n  }): Promise<unknown>;\n  searchNews(params: {\n    query: string;\n    count?: number;\n    freshness?: string;\n  }): Promise<unknown>;\n  registerDatabaseCredentials(): Promise<{\n    connectionString: string;\n    username: string;\n    password: string;\n    databases: string[];\n  }>;\n  reportDatabaseAudit(entry: {\n    database: string;\n    collection: string;\n    operation: string;\n    summary?: string;\n  }): Promise<void>;\n}\n//# sourceMappingURL=index.d.ts.map\n//#endregion\nexport { AgentApiClient, AgentApiClientConfig, type ChangelogAction, type ChangelogActor, type ChangelogEntry, type EncryptedEnvelopeV1, type Field, type FieldEnvelope, type FieldFormat, type FieldSensitivity, type FieldView, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretAggregate, type SecretCategory, type SecretMetadata, type SecretScope, SharedFileEntry, SyncAgentInfo, SyncAgentStats, SyncConfirmedUpload, SyncFileEntry, SyncManifest, SyncManifestEntry, SyncPresignedUrl, SyncReconstructBundle, SyncReconstructFile, SyncSessionContent, SyncSessionEntry };\n//# sourceMappingURL=index.d.ts.map"],"mappings":";;;;;AAAo2B,UAI11BiC,oBAAAA,CAAoB;EAAA,MAIpBC,EAAAA,MAAAA;EAAa,MAUbC,EAAAA,MAAAA;AAAiB;UAVjBD,aAAAA,CAkBY;SAIEC,EAAAA,MAAAA;UAAfE,EAAAA,MAAAA;EAAM,WAAA,EAAA,MAAA;EAAA,QAELC,EAAAA,MAAAA;EAAgB,MAKhBC,EAAAA,OAAAA,GAAAA,SAAmB,GAAA,QAAA;EAAA,SAOnBC,CAAAA,EAAAA,MAAAA;EAAmB,SAOnBC,CAAAA,EAAAA,MAAAA;EAKkB,QAGlBC,CAAAA,EAAAA,MAAAA;AAAc;AAOD,UAhDbP,iBAAAA,CAwDgB;EAAA,IAOhBU,EAAAA,MAAAA;EAAkB,IAKlBC,EAAAA,MAAAA;EAAe,QAMXC,EAAAA,MAAAA;EAAc,IAAA,CAAA,EAAA,MAAA;cAGNd,CAAAA,EAAAA,MAAAA;YAKXC,CAAAA,EAAAA,OAAAA;;UA1EDE,YAAAA,CA4EmBA;SAARY,EAAAA,CAAAA;SAQXV,EAAAA,MAAAA;UADJU,EAAAA,MAAAA;OAQQT,EAvFLF,MAuFKE,CAAAA,MAAAA,EAvFUJ,iBAuFVI,CAAAA;;UArFJD,gBAAAA,CAwFIG;QAARO,MAAAA;OACoBN,MAAAA;WAARM,EAAAA,MAAAA;;UApFRT,mBAAAA,CAuFJS;UAIQJ,EAAAA,MAAAA;QADQI,MAAAA;QAGuBH,MAAAA;cAARG,EAAAA,UAAAA,GAAAA,YAAAA;UACDA,EAAAA,MAAAA;;UAvF1BR,mBAAAA,CA6FJQ;QAQAA,MAAAA;QAIwB5B,MAAAA;OAAR4B,MAAAA;cACiC/B,CAAAA,EAAAA,MAAAA;YAAR+B,CAAAA,EAAAA,OAAAA;;UAnGrCP,qBAAAA,CAoGyEO;SAGtEX,EAAAA,MAAAA;QACCjB,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;WAAR4B,EAAAA,MAAAA;WAC8C5B,EAAAA,MAAAA;OAAR4B,EApGnCR,mBAoGmCQ,EAAAA;WACQA,EAAAA,MAAAA;;UAlG1CN,cAAAA,CAuG0BM;SAMlB1B,EAAAA,MAAAA;eADD0B,EAAAA,MAAAA;cAaSA,EAAAA,MAAAA;WAUgBA,EAAAA,MAAAA;YAOZA,EAAAA,MAAAA,GAAAA,IAAAA;;UAnIpBL,aAAAA,CAoKaK;UAiBCA,EAAAA,MAAAA;QAcHA,MAAAA;UAWCA,EAAAA,MAAAA;aAU2BA,EAAAA,MAAAA;cAUvBA,CAAAA,EAAAA,MAAAA;YAYHA,CAAAA,EAAAA,OAAAA;;UAtObJ,gBAAAA,CAqQiBI;WA0BDA,EAAAA,MAAAA;QAoCiCA,MAAAA;cAUnCA,EAAAA,MAAAA;cAcHA,CAAAA,EAAAA,MAAAA;YAYCA,EAAAA,OAAAA;;UAhWZH,kBAAAA,CA0YgBG;WA8BiCA,EAAAA,MAAAA;SAKlCA,EAAAA,MAAAA;YAaNX,EAAAA,OAAAA;;UArbTS,eAAAA,CA0baE;UAWfA,EAAAA,MAAAA;UAaFA,EAAAA,MAAAA;QAYKhB,MAAAA;aAIGjB,CAAAA,EAAAA,MAAAA;;cA5dAgC,cAAAA,CAoeHf;mBAKLgB,MAAAA;mBAUKhB,MAAAA;aAIIJ,CAAAA,MAAAA,EApfOK,oBAofPL;UAKAlB,OAAAA;cACIE,CAAAA,KAAAA,EAAAA;eAEFP,CAAAA,EAAAA,MAAAA;MAxfX2C,OA2fQtB,CAAAA;SAARsB,EA1fKd,aA0fLc;;iBAOStB,CAAAA,CAAAA,EA/fMsB,OA+fNtB,CA/fcU,YA+fdV,CAAAA;aACAlB,CAAAA,IAAAA,EAAAA;SAFTwC,EAAAA;UAMKhB,EAAAA,MAAAA;eAMMpB,EAAAA,KAAAA,GAAAA,KAAAA;iBACJF,CAAAA,EAAAA,MAAAA;OAEEL;MAtgBT2C,OAigBAA,CAAAA;QAYKhB,EA5gBDM,gBA4gBCN,EAAAA;;mBAKEtB,CAAAA,IAAAA,EAAAA;YAEEL,EAAAA,MAAAA;QAET2C,EAAAA,MAAAA;QAMKhB,EAAAA,MAAAA;gBAILgB,CAAAA,EAAAA,UAAAA,GAAAA,YAAAA;MAxhBAA,OA2hBKhB,CA3hBGO,mBA2hBHP,CAAAA;iBAMIJ,CAAAA,IAAAA,EAAAA;QAEDF,EAAAA,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;MAhiBRsB,OAgiBAA,CAhiBQP,qBAgiBRO,CAAAA;cAGKhB,CAAAA,CAAAA,EAliBOgB,OAkiBPhB,CAliBeU,cAkiBfV,CAAAA;eAEIJ,CAAAA,KAAAA,EAAAA;UAGDE,CAAAA,EAAAA,MAAAA;MApiBRkB,OAoiBAA,CAAAA;SAGKhB,EAtiBAW,aAsiBAX,EAAAA;;kBAKLgB,CAAAA,CAAAA,EAziBgBA,OAyiBhBA,CAAAA;YAMKhB,EA9iBGY,gBA8iBHZ,EAAAA;;gBAKmBR,CAAAA,SAAAA,EAAAA,MAAAA,CAAAA,EAjjBOwB,OAijBPxB,CAjjBeqB,kBAijBfrB,CAAAA;gBAARwB,CAAAA,QAAAA,EAAAA,MAAAA,CAAAA,EAhjBcA,OAgjBdA,CAAAA;WAUVA,EAAAA,OAAAA;;iBAyBNA,CAAAA,IAAAA,EAAAA;SAGoCA,EAAAA,KAAAA,GAAAA,MAAAA,GAAAA,SAAAA;WAUpCA,EAAAA,MAAAA;MA1lBAA,OAomBAA,CAAAA;SAYAA,EA/mBKF,eA+mBLE,EAAAA;cAWAA,EAAAA,MAAAA,GAAAA,IAAAA;;mBAeAA,CAAAA,IAAAA,EAAAA;SAkBAA,EAAAA,KAAAA,GAAAA,MAAAA,GAAAA,SAAAA;WAgBAA,EAAAA,MAAAA;YAkBAA,EAAAA,MAAAA;MAtrBAA,OAisBAA,CAAAA;eAUAA,EAAAA,MAAAA;aAwBAA,EAAAA,MAAAA;;kBAgBkDA,CAAAA,CAAAA,EA/uBlCA,OA+uBkCA,CA/uB1B5B,kBA+uB0B4B,EAAAA,CAAAA;sBAIjBA,CAAAA,aAAAA,EAAAA,MAAAA,CAAAA,EAlvBQA,OAkvBRA,CAlvBgB/B,uBAkvBhB+B,CAAAA;yBAWnBA,CAAAA,aAAAA,EAAAA,MAAAA,EAAAA,MAAAA,EA5vBqCX,MA4vBrCW,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA,CAAAA,EA5vB+DA,OA4vB/DA,CAAAA,IAAAA,CAAAA;oBAQcA,CAAAA,aAAAA,EAAAA,MAAAA,EAAAA,QAAAA,EAAAA;WAGjBA,CAAAA,EAAAA,MAAAA;UAeXA,CAAAA,EAnxBOX,MAmxBPW,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA;MAlxBAA,OAwxBqBA,CAxxBb5B,kBAwxBa4B,CAAAA;mBAIIA,CAAAA,aAAAA,EAAAA,MAAAA,CAAAA,EA3xBaA,OA2xBbA,CA3xBqB5B,kBA2xBrB4B,CAAAA;aAUzBA,CAAAA,QAAAA,EAAAA,MAAAA,EAAAA,MAAAA,CAAAA,EAAAA,MAAAA,EAAAA,CAAAA,EApyB8CA,OAoyB9CA,CAAAA;OAIAA,EAAAA,MAAAA;YAKAA,EAAAA,MAAAA;aAC2BA,EAAAA,MAAAA;;EAWpB,cAAA,CAAA,QAAA,EAAA,MAAA,CAAA,EApzBuBA,OAozBvB,CAAA;;;aAjzBAX;ECrJb,CAAA,CAAa;EASb,WAAa,CAAA,CAAA,ED8IIW,OC9IwB,CAAA;IAa5B,YAAA,EDkIK1B,aClIgE,EAAA;EAElF,CAAA,CAAiB;EAqBjB;;;;;;AA6BA;;;;0BD0F0B0B;;;;;;;;;;0CAUgBA;;;;;;;8BAOZA;;;;;;;;;;;;;;;0BAeJA;;;;;;;;;;;;;;;;;;uBAkBHA;;;;;;;;;;;;;;;;;wBAiBCA;;;;;;;;;;;;;;qBAcHA;;;;;;;;;;;sBAWCA;;;;;;;;;;iDAU2BA;;;;;;;;;;0BAUvBA;;;;;;;;;;;;uBAYHA;;;;;;;;;;;;;;;;;;;6BAmBMA;;;;;;;;;;;;2BAYFA;;;;;;;;;;;;;;;;;;;;;;;;;;0BA0BDA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2DAoCiCA;;;;;;;;;;wBAUnCA;;;;;;;;;;;;;;qBAcHA;;;;;;;;;;;;sBAYCA;;;;;;;;;;;;;;;;;6BAiBOA;;;;;;;;;;;;;;;;;;;;;;;;;0BAyBHA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2DA8BiCA;;;;;yBAKlCA;;;;;;;;;;;;;mBAaNX;MACbW;;;;uBAIiBA;;;;;;;;;;;QAWfA;;;;;;;;;;;;;MAaFA;;;;;;;;;;;;WAYKhB;;;;MAILgB,QAAQjC;;;;;;;;WAQHiB;;;;;MAKLgB;;;;;;;;;;WAUKhB;;;;eAIIJ;;;;;eAKAlB;mBACIE;;iBAEFP;;;MAGX2C,QAAQtB;;;WAGHM;;;MAGLgB;eACStB;eACAlB;;;;WAIJwB;;;;MAILgB;;iBAEWpC;aACJF;;eAEEL;;;;;;;WAOJ2B;;;;iBAIMpB;aACJF;;eAEEL;;MAET2C;;;;;;WAMKhB;;;;MAILgB;;;WAGKhB;;;;;;eAMIJ;;MAEToB,QAAQtB;;;WAGHM;;eAEIJ;;;MAGToB,QAAQlB;;;WAGHE;;;;;MAKLgB;aACO7C;;;;;WAKF6B;;;MAGLgB;;sBAEgBA,QAAQxB;;;;;;;;;;YAUlBwB;;;;;;;;;MASNA;;;;;;;;;;;;;;;;MAgBAA;;;0CAGoCA;;;;;;;;;;MAUpCA;;;;;;;;;;MAUAA;;;;;;;;;;;;MAYAA;;;;;;;;;;;MAWAA;;;;;MAKAA;;;;;;;;;;MAUAA;;;;;;;;;;;;;;;;;;MAkBAA;;;;;;;;;;;;;;;;MAgBAA;;;;;;;;;;;;;;;;;;MAkBAA;;;;;;;;;;;MAWAA;;;;;;;;;;MAUAA;;;;;;;;;;;;;;;;;;;;;;;;MAwBAA;;;;;;;;;;;;MAYAA;;;;wDAIkDA;;;;uCAIjBA;;;;;;;;;;;oBAWnBA;;;;;;;;kCAQcA;;;iBAGjBA;;;;;;;;;;;;;;;MAeXA;;;;;;2BAMqBA;;;;+BAIIA;;;;;;;;;;MAUzBA;;;;MAIAA;;;;;MAKAA;iCAC2BA;;;;;;;;;;;MAW3BA;;;;;;;;AAt9B81B;AAIt0B;AAIP;AAkBbZ,cCVG,WAAA,GDUS,eAAA;;;;;AAIP;AAEW;AAKG;AAcnBK,cC1BG,cD0BkB,EAAA,MAKtBD;AAAmB;AAGJ;AAOD;AAQG;AAOE;AAKH;;;;;;AAgBJQ,cChER,eDgEQA,EAAAA,MAAAA;AAQXV,UCtEO,aAAA,CDsEPA;;;;;QAUJU,CAAAA,EC3EK,cD2ELA;;UACYA,CAAAA,EAAAA;IAIPL,OAAAA,EAAAA,MAAAA;IADLK,QAAAA,EAAAA,MAAAA;;;QAMuCH,CAAAA,EAAAA,MAAAA;;;;;;;;;;;AAqBsCG,iBC1F7D,YAAA,CD0F6DA,IAAAA,CAAAA,EC1F1C,aD0F0CA,CAAAA,EC1FrB,OD0FqBA,CC1Fb,SD0FaA,CAAAA;;;;;;;AActEX,iBC3ES,IAAA,CAAA,CD2ETA,EC3EiB,OD2EjBA,CAAAA,IAAAA,CAAAA"}

package/dist/index.d.ts

@@ -203,24 +203,125 @@ declare class AgentApiClient {
     clientSecret: string;
     displayName?: string;
   }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getGithubAccounts()` for the multi-
+   * account shape required by Pattern A — explicit selector args on every
+   * tool. Retained because the `@alfe.ai/openclaw-github` proxy is the
+   * only consumer that knows about Pattern A; legacy env-interpolation
+   * callers will keep hitting `/credentials` until they move to the proxy.
+   */
   getGithubCredentials(): Promise<{
     login: string;
     accessToken: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for GitHub.
+   *
+   * Returns every agent-scoped GitHub connection. The caller is expected
+   * to require a `login` selector on every credential-touching tool and
+   * look up the matching account at dispatch time.
+   *
+   * GitHub OAuth tokens have no expiry (`tokenLifecycle: "no_expiry"`),
+   * so there is intentionally no `refreshGithubAccountToken` method — if
+   * a token is revoked the user must re-run the OAuth flow.
+   *
+   * Returned `accounts[i].login` is the GitHub username — the stable
+   * cross-session identifier the LLM should pass.
+   */
+  getGithubAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      login: string;
+      scopes: string;
+    }[];
+  }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getXeroAccounts()` for the multi-
+   * account shape required by Pattern A — explicit selector args on every
+   * tool. This method will be removed once all consumers migrate.
+   */
   getXeroCredentials(): Promise<{
     accessToken: string;
     accessTokenExpiresAt: string;
     xeroTenantId: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for Xero. Returns every
+   * agent-scoped Xero connection. The caller is expected to require a
+   * selector arg (e.g. `xeroTenantId`) on every credential-touching tool
+   * and look up the matching account by that selector at dispatch time.
+   *
+   * Returned `accounts[i].accountIdentifier` is the Xero tenantId — the
+   * stable cross-session identifier the LLM should pass.
+   */
+  getXeroAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      xeroTenantId: string;
+    }[];
+  }>;
   refreshXeroToken(): Promise<{
     accessToken: string;
     expiresAt: string;
   }>;
+  /**
+   * Pattern A: refresh a specific Xero connection by its `accountIdentifier`
+   * (the Xero `tenantId`). The legacy `refreshXeroToken()` only refreshes
+   * the *primary* connection, which is wrong for multi-tenant Xero where
+   * each tenant has its own non-interchangeable access token.
+   */
+  refreshXeroAccountToken(xeroTenantId: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getNotionAccounts()` for the multi-
+   * account shape required by Pattern A.
+   */
   getNotionCredentials(): Promise<{
     accessToken: string;
     workspaceId: string;
     workspaceName: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for Notion. Returns every
+   * agent-scoped Notion connection. The caller is expected to require a
+   * selector arg (e.g. `workspaceId`) on every credential-touching tool.
+   *
+   * Returned `accounts[i].accountIdentifier` is the Notion workspaceId.
+   */
+  getNotionAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      workspaceId: string;
+      workspaceName: string;
+    }[];
+  }>;
+  /**
+   * @deprecated Returns a single primary Atlassian Connection's credentials
+   * (one OAuth user, one cloudId) — the legacy "pick-the-default-connection"
+   * shape. Atlassian is multi-site by nature (each OAuth user may have
+   * access to multiple Cloud sites), so Pattern A plugins MUST use
+   * `getAtlassianAccounts()` to discover the full set and dispatch via
+   * the `cloudId` selector arg.
+   */
   getAtlassianCredentials(): Promise<{
     accessToken: string;
     refreshToken: string;
@@ -237,16 +338,177 @@ declare class AgentApiClient {
     accessToken: string;
     expiresAt: string;
   }>;
+  /**
+   * Pattern A: multi-account / multi-site credential fetch for Atlassian.
+   *
+   * Returns every agent-scoped Atlassian Connection. Each Connection is
+   * one OAuth user with a single access token and N accessible Cloud
+   * sites (`availableSites`). The caller is expected to:
+   *
+   *   1. Flatten (connection × cloudId) into one MCP child per site.
+   *   2. Require a `cloudId` selector on every credential-touching tool.
+   *   3. Use the access token bound to the Connection that owns the
+   *      requested `cloudId` (Atlassian shares one access token across
+   *      all sites accessible to the OAuth user).
+   *
+   * Per-account token refresh uses `refreshAtlassianAccountToken(email)`
+   * — refreshing one Connection rotates its single access token, which
+   * then applies to every cloudId for that Connection.
+   *
+   * Returned `accounts[i].accountIdentifier` is the OAuth user's email
+   * — the stable cross-session identifier for refresh purposes. The LLM
+   * never sees this directly: it picks a site via the `cloudId` arg
+   * instead.
+   */
+  getAtlassianAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      clientId: string;
+      clientSecret: string;
+      cloudId: string;
+      siteName: string;
+      siteUrl: string;
+      availableSites: {
+        id: string;
+        url: string;
+        name: string;
+        scopes?: string[];
+        avatarUrl?: string;
+      }[];
+    }[];
+  }>;
+  /**
+   * Pattern A: refresh a specific Atlassian Connection by `accountIdentifier`
+   * (the OAuth user's email).
+   *
+   * Atlassian rotates refresh tokens (`rotatesRefreshToken: true`); the
+   * server-side per-account refresh endpoint handles rotation and
+   * persistence. Refreshing one Connection updates its single access
+   * token, which applies to every accessible Cloud site (cloudId) for
+   * that OAuth user.
+   *
+   * Returns the new access token + expiry. The proxy is responsible for
+   * fanning the new token out to every child server it spawned for
+   * cloudIds owned by this Connection.
+   */
+  refreshAtlassianAccountToken(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
+  /**
+   * @deprecated Returns a single primary credential blob (legacy "pick-the-
+   * default-connection" shape). Use `getMYOBAccounts()` for the multi-
+   * account shape required by Pattern A.
+   */
   getMYOBCredentials(): Promise<{
     accessToken: string;
     accessTokenExpiresAt: string;
     myobBusinessId: string;
     clientId: string;
   }>;
+  /**
+   * Pattern A: multi-account credential fetch for MYOB. Returns every
+   * agent-scoped MYOB connection. The caller is expected to require a
+   * selector arg (e.g. `myobBusinessId` / `accountIdentifier`) on every
+   * credential-touching tool.
+   *
+   * Returned `accounts[i].accountIdentifier` is the MYOB businessId.
+   */
+  getMYOBAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      myobBusinessId: string;
+      clientId: string;
+    }[];
+  }>;
   refreshMYOBToken(): Promise<{
     accessToken: string;
     expiresAt: string;
   }>;
+  /**
+   * Microsoft 365 (delegated OAuth) credential fetch — single-account shape.
+   *
+   * @deprecated Use `getMicrosoftAccounts()` and dispatch via the `email`
+   *   selector once per-account plugins land. Retained because the existing
+   *   `integrations/connect/microsoft/hooks/post_activate.mjs` writes
+   *   `mgc` credentials for the single (default) Microsoft account.
+   *
+   * Returns the agent's effective Microsoft delegated-OAuth credentials.
+   * Distinct from `getTeamsCredentials()` (Azure bot credentials for the
+   * Teams adapter, which is admin-consent flow on services/microsoft, not
+   * delegated OAuth on services/connect).
+   */
+  getMicrosoftCredentials(): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt?: string;
+    refreshToken: string;
+    clientId: string;
+    clientSecret: string;
+    email?: string;
+    microsoftTenantId?: string;
+    workspaceDomain?: string;
+  }>;
+  /**
+   * Pattern A: multi-account credential fetch for Microsoft 365.
+   *
+   * Returns every agent-scoped Microsoft connection. The caller is expected
+   * to require an `email` selector on every credential-touching tool and
+   * look up the matching account at dispatch time.
+   *
+   * Returned `accounts[i].accountIdentifier` is the user's primary email
+   * (or the tid claim as fallback) — the stable cross-session identifier
+   * the LLM should pass.
+   *
+   * Per-account token refresh is exposed via `refreshMicrosoftAccountToken`,
+   * NOT `refreshXeroAccountToken` — Microsoft refresh tokens are not
+   * interchangeable across (tenant, user) pairs.
+   */
+  getMicrosoftAccounts(): Promise<{
+    accounts: {
+      connectionId: string;
+      accountIdentifier: string;
+      displayName: string | null;
+      connectedAt: string;
+      accessToken: string;
+      accessTokenExpiresAt: string;
+      refreshToken: string;
+      clientId: string;
+      clientSecret: string;
+      email: string;
+      microsoftTenantId: string;
+      workspaceDomain: string;
+    }[];
+  }>;
+  /**
+   * Pattern A: refresh a specific Microsoft 365 connection by its
+   * `accountIdentifier`. For Microsoft, `accountIdentifier` is the user's
+   * email when the Graph profile fetch succeeded at connect time, and the
+   * Azure tenant id (`tid` claim) as fallback. Callers should pass the
+   * value returned by `getMicrosoftAccounts()` rather than synthesising
+   * an email locally.
+   *
+   * Microsoft refresh tokens are bound to a specific (tenant, user) pair —
+   * they are NOT interchangeable across accounts, so per-account refresh
+   * is mandatory. The generic /accounts/{accountIdentifier}/refresh
+   * endpoint walks the agent's full visible scope chain to find a matching
+   * connection (works for inherited team/project Microsoft connections).
+   */
+  refreshMicrosoftAccountToken(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
   getTeamsCredentials(): Promise<{
     agentId: string;
     tenantId: string;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":["ChangelogAction","ChangelogActor","ChangelogEntry","ChangelogEntry$1","EncryptedEnvelopeV1","EncryptedEnvelopeV1$1","Field","FieldEnvelope","FieldEnvelope$1","FieldFormat","FieldFormat$1","FieldSensitivity","FieldSensitivity$1","FieldView","GeneratedDataKey","GeneratedDataKey$1","IntegrationConfigResult","IntegrationConfigResult$1","IntegrationConfigSchemaField","IntegrationInstall","IntegrationInstall$1","RegistryEntry","RegistryEntry$1","ScopeInfo","ScopeInfo$1","SecretAggregate","SecretAggregate$1","SecretCategory","SecretCategory$1","SecretMetadata","SecretMetadata$1","SecretScope","SecretScope$1","AgentApiClientConfig","SyncAgentInfo","SyncManifestEntry","SyncManifest","Record","SyncPresignedUrl","SyncConfirmedUpload","SyncReconstructFile","SyncReconstructBundle","SyncAgentStats","SyncFileEntry","SyncSessionEntry","SyncSessionContent","SharedFileEntry","AgentApiClient","Promise"],"sources":["../../agent-api-client/dist/index.d.ts","../src/index.ts"],"sourcesContent":["import { ChangelogAction, ChangelogActor, ChangelogEntry, ChangelogEntry as ChangelogEntry$1, EncryptedEnvelopeV1, EncryptedEnvelopeV1 as EncryptedEnvelopeV1$1, Field, FieldEnvelope, FieldEnvelope as FieldEnvelope$1, FieldFormat, FieldFormat as FieldFormat$1, FieldSensitivity, FieldSensitivity as FieldSensitivity$1, FieldView, GeneratedDataKey, GeneratedDataKey as GeneratedDataKey$1, IntegrationConfigResult, IntegrationConfigResult as IntegrationConfigResult$1, IntegrationConfigSchemaField, IntegrationInstall, IntegrationInstall as IntegrationInstall$1, RegistryEntry, RegistryEntry as RegistryEntry$1, ScopeInfo, ScopeInfo as ScopeInfo$1, SecretAggregate, SecretAggregate as SecretAggregate$1, SecretCategory, SecretCategory as SecretCategory$1, SecretMetadata, SecretMetadata as SecretMetadata$1, SecretScope, SecretScope as SecretScope$1 } from \"@alfe/types\";\n\n//#region src/index.d.ts\n\ninterface AgentApiClientConfig {\n  apiKey: string;\n  apiUrl: string;\n}\ninterface SyncAgentInfo {\n  agentId: string;\n  tenantId: string;\n  displayName: string;\n  s3Prefix: string;\n  status: \"stale\" | \"syncing\" | \"synced\";\n  fileCount?: number;\n  totalSize?: number;\n  lastSync?: string;\n}\ninterface SyncManifestEntry {\n  hash: string;\n  size: number;\n  modified: string;\n  etag?: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncManifest {\n  version: 1;\n  agentId: string;\n  lastSync: string;\n  files: Record<string, SyncManifestEntry>;\n}\ninterface SyncPresignedUrl {\n  path: string;\n  url: string;\n  expiresAt: string;\n}\ninterface SyncConfirmedUpload {\n  filePath: string;\n  hash: string;\n  size: number;\n  storageClass: \"STANDARD\" | \"GLACIER_IR\";\n  syncedAt: string;\n}\ninterface SyncReconstructFile {\n  path: string;\n  size: number;\n  url: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncReconstructBundle {\n  agentId: string;\n  mode: \"full\" | \"active\" | \"memory\";\n  fileCount: number;\n  totalSize: number;\n  files: SyncReconstructFile[];\n  expiresAt: string;\n}\ninterface SyncAgentStats {\n  agentId: string;\n  standardBytes: number;\n  glacierBytes: number;\n  fileCount: number;\n  lastSyncAt: string | null;\n}\ninterface SyncFileEntry {\n  filePath: string;\n  size: number;\n  modified: string;\n  contentHash: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncSessionEntry {\n  sessionId: string;\n  size: number;\n  lastModified: string;\n  storageClass?: string;\n  isArchived: boolean;\n}\ninterface SyncSessionContent {\n  sessionId: string;\n  content: string;\n  compressed: boolean;\n}\ninterface SharedFileEntry {\n  filePath: string;\n  fileName: string;\n  size: number;\n  contentType?: string;\n}\ndeclare class AgentApiClient {\n  private readonly apiKey;\n  private readonly apiUrl;\n  constructor(config: AgentApiClientConfig);\n  private request;\n  syncRegister(args?: {\n    displayName?: string;\n  }): Promise<{\n    agent: SyncAgentInfo;\n  }>;\n  syncGetManifest(): Promise<SyncManifest>;\n  syncPresign(args: {\n    files: {\n      path: string;\n      operation: \"put\" | \"get\";\n      contentType?: string;\n    }[];\n  }): Promise<{\n    urls: SyncPresignedUrl[];\n  }>;\n  syncConfirmUpload(args: {\n    filePath: string;\n    hash: string;\n    size: number;\n    storageClass?: \"STANDARD\" | \"GLACIER_IR\";\n  }): Promise<SyncConfirmedUpload>;\n  syncReconstruct(args: {\n    mode: \"full\" | \"active\" | \"memory\";\n  }): Promise<SyncReconstructBundle>;\n  syncGetStats(): Promise<SyncAgentStats>;\n  syncListFiles(args?: {\n    prefix?: string;\n  }): Promise<{\n    files: SyncFileEntry[];\n  }>;\n  syncListSessions(): Promise<{\n    sessions: SyncSessionEntry[];\n  }>;\n  syncGetSession(sessionId: string): Promise<SyncSessionContent>;\n  syncDeleteFile(filePath: string): Promise<{\n    removed: boolean;\n  }>;\n  sharedListFiles(args: {\n    scope: \"org\" | \"team\" | \"project\";\n    scopeId: string;\n  }): Promise<{\n    files: SharedFileEntry[];\n    nextCursor: string | null;\n  }>;\n  sharedDownloadUrl(args: {\n    scope: \"org\" | \"team\" | \"project\";\n    scopeId: string;\n    filePath: string;\n  }): Promise<{\n    downloadUrl: string;\n    expiresIn: number;\n  }>;\n  listIntegrations(): Promise<IntegrationInstall$1[]>;\n  getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult$1>;\n  updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;\n  installIntegration(integrationId: string, options?: {\n    version?: string;\n    config?: Record<string, unknown>;\n  }): Promise<IntegrationInstall$1>;\n  removeIntegration(integrationId: string): Promise<IntegrationInstall$1>;\n  getOAuthUrl(provider: string, scopes?: string[]): Promise<{\n    url: string;\n    provider: string;\n    expiresIn: number;\n  }>;\n  getOAuthStatus(provider: string): Promise<{\n    provider: string;\n    connected: boolean;\n    config?: Record<string, string>;\n  }>;\n  getRegistry(): Promise<{\n    integrations: RegistryEntry$1[];\n  }>;\n  /**\n   * Returns every connected Google account for the agent. Multi-account by\n   * design — the openclaw-google plugin requires the LLM to pass `email`\n   * explicitly to `google_run_command` so an account is always selected\n   * deliberately.\n   *\n   * 2026-05-14 (connections-redesign PR 1): the legacy flat shape (`email`,\n   * `refreshToken`, `accessToken`, etc., populated from the default account)\n   * is gone. Iterate over `accounts`.\n   */\n  getGoogleCredentials(): Promise<{\n    accounts: {\n      email: string;\n      refreshToken: string;\n      clientId: string;\n      clientSecret: string;\n      displayName?: string;\n      connectedAt?: string;\n    }[];\n  }>;\n  disconnectGoogleAccount(email: string): Promise<{\n    accounts: {\n      email: string;\n      displayName?: string;\n      connectedAt?: string;\n    }[];\n  }>;\n  getGoogleChatCredentials(): Promise<{\n    email: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    displayName?: string;\n  }>;\n  getGithubCredentials(): Promise<{\n    login: string;\n    accessToken: string;\n  }>;\n  getXeroCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    xeroTenantId: string;\n  }>;\n  refreshXeroToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  getNotionCredentials(): Promise<{\n    accessToken: string;\n    workspaceId: string;\n    workspaceName: string;\n  }>;\n  getAtlassianCredentials(): Promise<{\n    accessToken: string;\n    refreshToken: string;\n    accessTokenExpiresAt: string;\n    cloudId: string;\n    siteName: string;\n    siteUrl: string;\n    email: string;\n    enabledProducts: string[];\n    clientId: string;\n    clientSecret: string;\n  }>;\n  refreshAtlassianToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  getMYOBCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    myobBusinessId: string;\n    clientId: string;\n  }>;\n  refreshMYOBToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  getTeamsCredentials(): Promise<{\n    agentId: string;\n    tenantId: string;\n    azureAppId: string;\n    azureBotId: string;\n    azureClientSecret: string;\n    botDisplayName?: string;\n    teamsTenantId?: string;\n    serviceUrl?: string;\n  }>;\n  sendTeamsMessage(data: {\n    conversationId: string;\n    text?: string;\n    adaptiveCard?: Record<string, unknown>;\n  }): Promise<{\n    ok: boolean;\n    activityId: string;\n  }>;\n  listTeamsChannels(): Promise<{\n    channels: {\n      id: string;\n      name: string;\n      description?: string;\n    }[];\n  }>;\n  presignAttachments(files: {\n    filename: string;\n    mimeType: string;\n    size: number;\n  }[]): Promise<{\n    attachments: {\n      id: string;\n      uploadUrl: string;\n      downloadUrl: string;\n      s3Key: string;\n      expiresAt: string;\n    }[];\n  }>;\n  recordActivity(data: {\n    userId?: string;\n    channel: string;\n    role: \"user\" | \"assistant\";\n  }): Promise<{\n    recorded: boolean;\n  }>;\n  /**\n   * Mint a fresh AES-256 data key for a specific (secret, field) pair. The\n   * encryption context is rebuilt server-side from `auth.tenantId` + the body\n   * fields including `fieldKey`; the agent cannot forge context for a scope\n   * or field it doesn't own. Legacy single-envelope secrets are migrated to\n   * `field#value` rows by the data migration, so call with `fieldKey: \"value\"`\n   * to reach them.\n   */\n  generateSecretDataKey(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<GeneratedDataKey$1>;\n  /**\n   * Unwrap a wrapped data key so the agent can decrypt the envelope locally.\n   * `fieldKey` MUST match the value supplied when the data key was generated\n   * (it's bound into KMS encryption context); mismatch fails with\n   * `InvalidCiphertextException`.\n   */\n  decryptSecretDataKey(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n    dataKeyCiphertext: string;\n  }): Promise<{\n    plaintextKey: string;\n  }>;\n  /**\n   * Create a new secret with one or more fields. Encrypted fields must arrive\n   * pre-sealed (the agent has already obtained per-field data keys via\n   * `generateSecretDataKey({ ..., fieldKey })` and AES-encrypted locally).\n   * Plaintext fields ship the value inline.\n   */\n  createSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    secretName: string;\n    category?: SecretCategory$1;\n    description?: string;\n    tags?: string[];\n    fields: {\n      key: string;\n      format?: FieldFormat$1;\n      sensitivity: FieldSensitivity$1;\n      value?: string;\n      envelope?: EncryptedEnvelopeV1$1;\n    }[];\n    reason?: string;\n  }): Promise<SecretAggregate$1>;\n  /** Fetch the secret aggregate plus per-field encrypted envelopes. */\n  getSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n  }): Promise<{\n    aggregate: SecretAggregate$1;\n    envelopes: FieldEnvelope$1[];\n  }>;\n  /** Fetch one field. Plaintext: value inline. Encrypted: envelope. */\n  getSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<{\n    key: string;\n    sensitivity: FieldSensitivity$1;\n    format?: FieldFormat$1;\n    value?: string;\n    envelope?: EncryptedEnvelopeV1$1;\n    rotatedAt?: string;\n    createdAt: string;\n    updatedAt: string;\n  }>;\n  /** Add OR rotate one field. */\n  setSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n    sensitivity: FieldSensitivity$1;\n    format?: FieldFormat$1;\n    value?: string;\n    envelope?: EncryptedEnvelopeV1$1;\n    reason?: string;\n  }): Promise<{\n    fieldKey: string;\n    rotated: boolean;\n  }>;\n  /** Remove one field. */\n  removeSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<void>;\n  /** Update secret-level metadata (name/description/tags/category). */\n  updateSecretMetadata(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    secretName?: string;\n    description?: string;\n    tags?: string[];\n    category?: SecretCategory$1;\n    reason?: string;\n  }): Promise<SecretAggregate$1>;\n  /** List metadata for secrets in a scope. Optional filters route through the byFacet GSI. */\n  listSecrets(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    category?: SecretCategory$1;\n    tag?: string;\n    fieldKey?: string;\n  }): Promise<SecretMetadata$1[]>;\n  /** Bounded changelog read — metadata-only audit entries. */\n  getSecretHistory(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    limit?: number;\n    cursor?: string;\n  }): Promise<{\n    entries: ChangelogEntry$1[];\n    nextCursor?: string;\n  }>;\n  /** Delete a secret (and all its field rows + tag rows + changelog rows). */\n  deleteSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n  }): Promise<void>;\n  /** Enumerate scopes (org/team/project/agent) this agent can access. */\n  listSecretScopes(): Promise<ScopeInfo$1[]>;\n  /**\n   * Returns the calling agent's own identity context — `{ agentId, tenantId }`\n   * decoded server-side from the agent API token. Used by the\n   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the\n   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.\n   * Plugins should cache this for the daemon's lifetime (single-agent-per-\n   * process invariant). One HTTP round-trip per process activate; not for\n   * per-call use.\n   */\n  whoami(): Promise<{\n    agentId: string;\n    tenantId: string;\n  }>;\n  resolveIdentity(args: {\n    provider: string;\n    platformId: string;\n    kind?: \"user\" | \"agent\" | \"service\" | \"bot\" | \"workspace\";\n    displayName?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n    created?: boolean;\n    reason?: string;\n    /**\n     * Flattened auriclabs permission strings for the resolved identity\n     * (scope-prefixed where applicable). Empty array on miss / org service\n     * outage — the runtime gate fails closed in that case.\n     */\n    permissions: string[];\n  }>;\n  searchIdentities(args?: {\n    q?: string;\n    status?: string;\n    limit?: number;\n  }): Promise<{\n    identities: unknown[];\n  }>;\n  getIdentityContext(identityId: string): Promise<{\n    context: unknown;\n  }>;\n  mergeIdentities(survivorId: string, args: {\n    mergedId: string;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    error?: string;\n  }>;\n  unmergeIdentity(identityId: string, args: {\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    error?: string;\n  }>;\n  addIdentityNote(identityId: string, args: {\n    content: string;\n    category?: string;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    noteId: string | null;\n  }>;\n  tagIdentity(identityId: string, args: {\n    tag: string;\n    action: \"add\" | \"remove\";\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n  }>;\n  getIdentityChangelog(identityId: string, args?: {\n    limit?: number;\n  }): Promise<{\n    entries: unknown[];\n  }>;\n  rollbackIdentity(identityId: string, args: {\n    targetVersion: number;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    entry?: unknown;\n  }>;\n  requestIdentityVerification(args: {\n    claimedIdentityId: string;\n    requestingIdentityId: string;\n    requestingProvider: string;\n    requestingPlatformId: string;\n    preferredChannel?: \"mobile\" | \"email\";\n    /**\n     * Phase 2: agent-supplied contact endpoint. When provided, the top-level\n     * `preferredChannel` is ignored — the contact's channel wins.\n     */\n    contact?: {\n      channel: \"email\" | \"mobile\";\n      value: string;\n    };\n  }): Promise<{\n    verificationId: string;\n    channel: string;\n    deliveredTo: string;\n    expiresAt: string;\n    availableChannels: {\n      channel: string;\n      deliveredTo: string;\n    }[];\n  } | {\n    error: string;\n  }>;\n  confirmIdentityVerification(args: {\n    claimedIdentityId: string;\n    verificationId: string;\n    phrase: string;\n  }): Promise<{\n    verified: boolean;\n    identityId?: string;\n    /** Phase 2: how the confirm resolved — Scenario A vs B. */\n    action?: \"merged\" | \"contact_verified\";\n    error?: string;\n  }>;\n  /**\n   * Update display-shape fields on an Identity. Body excludes `email` /\n   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go\n   * via the verify flow, title/company live on OrgMembership, metadata is\n   * not agent-writable.\n   */\n  updateIdentity(identityId: string, args: {\n    name?: string;\n    avatarUrl?: string;\n    timezone?: string;\n    locale?: string;\n  }): Promise<{\n    ok: boolean;\n  }>;\n  /**\n   * Phase 2 (Section H): server-side verification of a Google Chat sender via\n   * the agent's existing Google OAuth credentials. Returns the resolved\n   * identity (created or matched via Scenario-B email enrichment).\n   */\n  resolveGoogleChatSender(args: {\n    senderUserId: string;\n    spaceId?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n  }>;\n  memorySearch(query: string, opts?: {\n    limit?: number;\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    includeKnowledge?: boolean;\n  }): Promise<{\n    facts: {\n      subject: string;\n      predicate: string;\n      object: string;\n      since: string;\n      confidence: number;\n    }[];\n    memories: {\n      id: string;\n      text: string;\n      topic: string;\n      subtopic: string;\n      tag: string;\n      importance: number;\n      timestamp: number;\n      score: number;\n    }[];\n  }>;\n  memoryStore(text: string, opts?: {\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    importance?: number;\n  }): Promise<{\n    memoryId: string;\n  }>;\n  memoryIngest(sessionKey: string, messages: {\n    role: string;\n    content: string;\n    index: number;\n    timestamp?: string;\n  }[], metadata?: {\n    channelId?: string;\n    userId?: string;\n    userName?: string;\n  }): Promise<{\n    queued: boolean;\n    messageCount: number;\n  }>;\n  memoryLoadContext(tier?: number, topicHint?: string): Promise<{\n    formatted: string;\n    [key: string]: unknown;\n  }>;\n  memoryLookupEntity(subject: string): Promise<{\n    subject: string;\n    triples: {\n      tripleId: string;\n      predicate: string;\n      object: string;\n      validFrom: string;\n      validTo?: string;\n      confidence: number;\n    }[];\n  }>;\n  memoryNavigate(): Promise<{\n    topics: {\n      name: string;\n      tripleCount: number;\n      subtopics: string[];\n    }[];\n    cursor: string | null;\n  }>;\n  memoryDelete(memoryId: string): Promise<{\n    deleted: boolean;\n  }>;\n  memoryStats(): Promise<{\n    vectorCount: number;\n    tripleCount: number;\n    storageEstimateBytes: number;\n    lastIngestionAt?: string;\n  }>;\n  memoryLearn(args: {\n    text: string;\n    source?: string;\n    sourceType?: \"file\" | \"url\" | \"inline\";\n    metadata?: {\n      sessionId?: string;\n      channelId?: string;\n      userName?: string;\n    };\n  }): Promise<{\n    memoriesStored: number;\n    triplesStored: number;\n    chunks: number;\n    source?: string;\n  }>;\n  memoryBootstrapStatus(): Promise<{\n    synced: boolean;\n    syncedAt?: string;\n  }>;\n  memoryBootstrapStatusMark(): Promise<{\n    synced: true;\n    syncedAt: string;\n  }>;\n  searchWeb(params: {\n    query: string;\n    count?: number;\n    offset?: number;\n    country?: string;\n    freshness?: string;\n  }): Promise<unknown>;\n  searchImages(params: {\n    query: string;\n    count?: number;\n  }): Promise<unknown>;\n  searchNews(params: {\n    query: string;\n    count?: number;\n    freshness?: string;\n  }): Promise<unknown>;\n  registerDatabaseCredentials(): Promise<{\n    connectionString: string;\n    username: string;\n    password: string;\n    databases: string[];\n  }>;\n  reportDatabaseAudit(entry: {\n    database: string;\n    collection: string;\n    operation: string;\n    summary?: string;\n  }): Promise<void>;\n}\n//# sourceMappingURL=index.d.ts.map\n//#endregion\nexport { AgentApiClient, AgentApiClientConfig, type ChangelogAction, type ChangelogActor, type ChangelogEntry, type EncryptedEnvelopeV1, type Field, type FieldEnvelope, type FieldFormat, type FieldSensitivity, type FieldView, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretAggregate, type SecretCategory, type SecretMetadata, type SecretScope, SharedFileEntry, SyncAgentInfo, SyncAgentStats, SyncConfirmedUpload, SyncFileEntry, SyncManifest, SyncManifestEntry, SyncPresignedUrl, SyncReconstructBundle, SyncReconstructFile, SyncSessionContent, SyncSessionEntry };\n//# sourceMappingURL=index.d.ts.map"],"mappings":";;;;;AAAo2B,UAI11BiC,oBAAAA,CAAoB;EAAA,MAIpBC,EAAAA,MAAAA;EAAa,MAUbC,EAAAA,MAAAA;AAAiB;UAVjBD,aAAAA,CAkBY;SAIEC,EAAAA,MAAAA;UAAfE,EAAAA,MAAAA;EAAM,WAAA,EAAA,MAAA;EAAA,QAELC,EAAAA,MAAAA;EAAgB,MAKhBC,EAAAA,OAAAA,GAAAA,SAAmB,GAAA,QAAA;EAAA,SAOnBC,CAAAA,EAAAA,MAAAA;EAAmB,SAOnBC,CAAAA,EAAAA,MAAAA;EAKkB,QAGlBC,CAAAA,EAAAA,MAAAA;AAAc;AAOD,UAhDbP,iBAAAA,CAwDgB;EAAA,IAOhBU,EAAAA,MAAAA;EAAkB,IAKlBC,EAAAA,MAAAA;EAAe,QAMXC,EAAAA,MAAAA;EAAc,IAAA,CAAA,EAAA,MAAA;cAGNd,CAAAA,EAAAA,MAAAA;YAKXC,CAAAA,EAAAA,OAAAA;;UA1EDE,YAAAA,CA4EmBA;SAARY,EAAAA,CAAAA;SAQXV,EAAAA,MAAAA;UADJU,EAAAA,MAAAA;OAQQT,EAvFLF,MAuFKE,CAAAA,MAAAA,EAvFUJ,iBAuFVI,CAAAA;;UArFJD,gBAAAA,CAwFIG;QAARO,MAAAA;OACoBN,MAAAA;WAARM,EAAAA,MAAAA;;UApFRT,mBAAAA,CAuFJS;UAIQJ,EAAAA,MAAAA;QADQI,MAAAA;QAGuBH,MAAAA;cAARG,EAAAA,UAAAA,GAAAA,YAAAA;UACDA,EAAAA,MAAAA;;UAvF1BR,mBAAAA,CA6FJQ;QAQAA,MAAAA;QAIwB5B,MAAAA;OAAR4B,MAAAA;cACiC/B,CAAAA,EAAAA,MAAAA;YAAR+B,CAAAA,EAAAA,OAAAA;;UAnGrCP,qBAAAA,CAoGyEO;SAGtEX,EAAAA,MAAAA;QACCjB,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;WAAR4B,EAAAA,MAAAA;WAC8C5B,EAAAA,MAAAA;OAAR4B,EApGnCR,mBAoGmCQ,EAAAA;WACQA,EAAAA,MAAAA;;UAlG1CN,cAAAA,CAuG0BM;SAMlB1B,EAAAA,MAAAA;eADD0B,EAAAA,MAAAA;cAaSA,EAAAA,MAAAA;WAUgBA,EAAAA,MAAAA;YAOZA,EAAAA,MAAAA,GAAAA,IAAAA;;UAnIpBL,aAAAA,CA8IcK;UAKFA,EAAAA,MAAAA;QAIIA,MAAAA;UAKGA,EAAAA,MAAAA;aAYFA,EAAAA,MAAAA;cAIHA,CAAAA,EAAAA,MAAAA;YAMFA,CAAAA,EAAAA,OAAAA;;UA1KZJ,gBAAAA,CA2LSP;WACbW,EAAAA,MAAAA;QAIiBA,MAAAA;cAWfA,EAAAA,MAAAA;cAaFA,CAAAA,EAAAA,MAAAA;YAYKhB,EAAAA,OAAAA;;UA7NDa,kBAAAA,CAiOJG;WAQKhB,EAAAA,MAAAA;SAKLgB,EAAAA,MAAAA;YAUKhB,EAAAA,OAAAA;;UAnPDc,eAAAA,CA4PKpC;UACIE,EAAAA,MAAAA;UAEFP,EAAAA,MAAAA;QAGHqB,MAAAA;aAARsB,CAAAA,EAAAA,MAAAA;;cA5PQD,cAAAA,CAmQCrB;mBACAlB,MAAAA;mBAFTwC,MAAAA;aAMKhB,CAAAA,MAAAA,EArQWC,oBAqQXD;UAMMpB,OAAAA;cACJF,CAAAA,KAAAA,EAAAA;eAEEL,CAAAA,EAAAA,MAAAA;MA1QT2C,OAqQAA,CAAAA;SAYKhB,EAhRAE,aAgRAF;;iBAKEtB,CAAAA,CAAAA,EAnRQsC,OAmRRtC,CAnRgB0B,YAmRhB1B,CAAAA;aAEEL,CAAAA,IAAAA,EAAAA;SAET2C,EAAAA;UAMKhB,EAAAA,MAAAA;eAILgB,EAAAA,KAAAA,GAAAA,KAAAA;iBAGKhB,CAAAA,EAAAA,MAAAA;OAMIJ;MAnSToB,OAqSQtB,CAAAA;QAARsB,EApSIV,gBAoSJU,EAAAA;;mBAKSpB,CAAAA,IAAAA,EAAAA;YAGDE,EAAAA,MAAAA;QAARkB,EAAAA,MAAAA;QAGKhB,EAAAA,MAAAA;gBAME7B,CAAAA,EAAAA,UAAAA,GAAAA,YAAAA;MA9SP6C,OA6SAA,CA7SQT,mBA6SRS,CAAAA;iBAMKhB,CAAAA,IAAAA,EAAAA;QAGLgB,EAAAA,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;MAnTAA,OAqTwBxB,CArThBiB,qBAqTgBjB,CAAAA;cAARwB,CAAAA,CAAAA,EApTJA,OAoTIA,CApTIN,cAoTJM,CAAAA;eAUVA,CAAAA,KAAAA,EAAAA;UASNA,CAAAA,EAAAA,MAAAA;MApUAA,OAoVAA,CAAAA;SAGoCA,EAtV/BL,aAsV+BK,EAAAA;;kBAoBpCA,CAAAA,CAAAA,EAxWgBA,OAwWhBA,CAAAA;YAYAA,EAnXQJ,gBAmXRI,EAAAA;;gBAgBAA,CAAAA,SAAAA,EAAAA,MAAAA,CAAAA,EAjY+BA,OAiY/BA,CAjYuCH,kBAiYvCG,CAAAA;gBAUAA,CAAAA,QAAAA,EAAAA,MAAAA,CAAAA,EA1Y8BA,OA0Y9BA,CAAAA;WAkBAA,EAAAA,OAAAA;;iBAkCAA,CAAAA,IAAAA,EAAAA;SAWAA,EAAAA,KAAAA,GAAAA,MAAAA,GAAAA,SAAAA;WAUAA,EAAAA,MAAAA;MA7cAA,OAqeAA,CAAAA;SAYAA,EAhfKF,eAgfLE,EAAAA;cAIkDA,EAAAA,MAAAA,GAAAA,IAAAA;;mBAepCA,CAAAA,IAAAA,EAAAA;SAQcA,EAAAA,KAAAA,GAAAA,MAAAA,GAAAA,SAAAA;WAGjBA,EAAAA,MAAAA;YAeXA,EAAAA,MAAAA;MAthBAA,OA4hBqBA,CAAAA;eAIIA,EAAAA,MAAAA;aAUzBA,EAAAA,MAAAA;;kBASAA,CAAAA,CAAAA,EA/iBgBA,OA+iBhBA,CA/iBwB5B,kBA+iBxB4B,EAAAA,CAAAA;sBAC2BA,CAAAA,aAAAA,EAAAA,MAAAA,CAAAA,EA/iBcA,OA+iBdA,CA/iBsB/B,uBA+iBtB+B,CAAAA;yBAW3BA,CAAAA,aAAAA,EAAAA,MAAAA,EAAAA,MAAAA,EAzjBmDX,MAyjBnDW,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA,CAAAA,EAzjB6EA,OAyjB7EA,CAAAA,IAAAA,CAAAA;EAAO,kBAAA,CAAA,aAAA,EAAA,MAAA,EAAA,QAAA,EAAA;;aAtjBAX;MACPW,QAAQ5B;EC3Id,iBAAwB,CAAA,aAAA,EAAA,MAAA,CAAA,ED4IoB4B,OC5IpB,CD4I4B5B,kBC5I5B,CAAA;EASxB,WAAa,CAAA,QAA4B,EAAA,MAAA,EAAA,MAAA,CAAA,EAAA,MAAA,EAAA,CAAA,EDoIW4B,OCpIX,CAAA;IAa5B,GAAA,EAAA,MAAA;IAEI,QAAA,EAAA,MAAa;IAqBR,SAAA,EAAA,MAAY;EAAA,CAAA,CAAA;gBAAO,CAAA,QAAA,EAAA,MAAA,CAAA,EDqGLA,OCrGK,CAAA;YAA6B,EAAA,MAAA;aAAR,EAAA,OAAA;IAAO,MAAA,CAAA,EDwGxDX,MCxGwD,CAAA,MAAA,EAAA,MAAA,CAAA;EA6BrE,CAAA,CAAsB;iBD6ELW;kBACC1B;;;;;;;;;;;;0BAYQ0B;;;;;;;;;;0CAUgBA;;;;;;;8BAOZA;;;;;;;0BAOJA;;;;wBAIFA;;;;;sBAKFA;;;;0BAIIA;;;;;6BAKGA;;;;;;;;;;;;2BAYFA;;;;wBAIHA;;;;;;sBAMFA;;;;yBAIGA;;;;;;;;;;;;;mBAaNX;MACbW;;;;uBAIiBA;;;;;;;;;;;QAWfA;;;;;;;;;;;;;MAaFA;;;;;;;;;;;;WAYKhB;;;;MAILgB,QAAQjC;;;;;;;;WAQHiB;;;;;MAKLgB;;;;;;;;;;WAUKhB;;;;eAIIJ;;;;;eAKAlB;mBACIE;;iBAEFP;;;MAGX2C,QAAQtB;;;WAGHM;;;MAGLgB;eACStB;eACAlB;;;;WAIJwB;;;;MAILgB;;iBAEWpC;aACJF;;eAEEL;;;;;;;WAOJ2B;;;;iBAIMpB;aACJF;;eAEEL;;MAET2C;;;;;;WAMKhB;;;;MAILgB;;;WAGKhB;;;;;;eAMIJ;;MAEToB,QAAQtB;;;WAGHM;;eAEIJ;;;MAGToB,QAAQlB;;;WAGHE;;;;;MAKLgB;aACO7C;;;;;WAKF6B;;;MAGLgB;;sBAEgBA,QAAQxB;;;;;;;;;;YAUlBwB;;;;;;;;;MASNA;;;;;;;;;;;;;;;;MAgBAA;;;0CAGoCA;;;;;;;;;;MAUpCA;;;;;;;;;;MAUAA;;;;;;;;;;;;MAYAA;;;;;;;;;;;MAWAA;;;;;MAKAA;;;;;;;;;;MAUAA;;;;;;;;;;;;;;;;;;MAkBAA;;;;;;;;;;;;;;;;MAgBAA;;;;;;;;;;;;;;;;;;MAkBAA;;;;;;;;;;;MAWAA;;;;;;;;;;MAUAA;;;;;;;;;;;;;;;;;;;;;;;;MAwBAA;;;;;;;;;;;;MAYAA;;;;wDAIkDA;;;;uCAIjBA;;;;;;;;;;;oBAWnBA;;;;;;;;kCAQcA;;;iBAGjBA;;;;;;;;;;;;;;;MAeXA;;;;;;2BAMqBA;;;;+BAIIA;;;;;;;;;;MAUzBA;;;;MAIAA;;;;;MAKAA;iCAC2BA;;;;;;;;;;;MAW3BA;;;;;;;;AAhtB81B;AAIt0B;AAIP;AAkBbZ,cCVG,WAAA,GDUS,eAAA;;;;;AAIP;AAEW;AAKG;AAcnBK,cC1BG,cD0BkB,EAAA,MAKtBD;AAAmB;AAGJ;AAOD;AAQG;AAOE;AAKH;;;;;;AAgBJQ,cChER,eDgEQA,EAAAA,MAAAA;AAQXV,UCtEO,aAAA,CDsEPA;;;;;QAUJU,CAAAA,EC3EK,cD2ELA;;UACYA,CAAAA,EAAAA;IAIPL,OAAAA,EAAAA,MAAAA;IADLK,QAAAA,EAAAA,MAAAA;;;QAMuCH,CAAAA,EAAAA,MAAAA;;;;;;;;;;;AAqBsCG,iBC1F7D,YAAA,CD0F6DA,IAAAA,CAAAA,EC1F1C,aD0F0CA,CAAAA,EC1FrB,OD0FqBA,CC1Fb,SD0FaA,CAAAA;;;;;;;AActEX,iBC3ES,IAAA,CAAA,CD2ETA,EC3EiB,OD2EjBA,CAAAA,IAAAA,CAAAA"}
+{"version":3,"file":"index.d.ts","names":["ChangelogAction","ChangelogActor","ChangelogEntry","ChangelogEntry$1","EncryptedEnvelopeV1","EncryptedEnvelopeV1$1","Field","FieldEnvelope","FieldEnvelope$1","FieldFormat","FieldFormat$1","FieldSensitivity","FieldSensitivity$1","FieldView","GeneratedDataKey","GeneratedDataKey$1","IntegrationConfigResult","IntegrationConfigResult$1","IntegrationConfigSchemaField","IntegrationInstall","IntegrationInstall$1","RegistryEntry","RegistryEntry$1","ScopeInfo","ScopeInfo$1","SecretAggregate","SecretAggregate$1","SecretCategory","SecretCategory$1","SecretMetadata","SecretMetadata$1","SecretScope","SecretScope$1","AgentApiClientConfig","SyncAgentInfo","SyncManifestEntry","SyncManifest","Record","SyncPresignedUrl","SyncConfirmedUpload","SyncReconstructFile","SyncReconstructBundle","SyncAgentStats","SyncFileEntry","SyncSessionEntry","SyncSessionContent","SharedFileEntry","AgentApiClient","Promise"],"sources":["../../agent-api-client/dist/index.d.ts","../src/index.ts"],"sourcesContent":["import { ChangelogAction, ChangelogActor, ChangelogEntry, ChangelogEntry as ChangelogEntry$1, EncryptedEnvelopeV1, EncryptedEnvelopeV1 as EncryptedEnvelopeV1$1, Field, FieldEnvelope, FieldEnvelope as FieldEnvelope$1, FieldFormat, FieldFormat as FieldFormat$1, FieldSensitivity, FieldSensitivity as FieldSensitivity$1, FieldView, GeneratedDataKey, GeneratedDataKey as GeneratedDataKey$1, IntegrationConfigResult, IntegrationConfigResult as IntegrationConfigResult$1, IntegrationConfigSchemaField, IntegrationInstall, IntegrationInstall as IntegrationInstall$1, RegistryEntry, RegistryEntry as RegistryEntry$1, ScopeInfo, ScopeInfo as ScopeInfo$1, SecretAggregate, SecretAggregate as SecretAggregate$1, SecretCategory, SecretCategory as SecretCategory$1, SecretMetadata, SecretMetadata as SecretMetadata$1, SecretScope, SecretScope as SecretScope$1 } from \"@alfe/types\";\n\n//#region src/index.d.ts\n\ninterface AgentApiClientConfig {\n  apiKey: string;\n  apiUrl: string;\n}\ninterface SyncAgentInfo {\n  agentId: string;\n  tenantId: string;\n  displayName: string;\n  s3Prefix: string;\n  status: \"stale\" | \"syncing\" | \"synced\";\n  fileCount?: number;\n  totalSize?: number;\n  lastSync?: string;\n}\ninterface SyncManifestEntry {\n  hash: string;\n  size: number;\n  modified: string;\n  etag?: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncManifest {\n  version: 1;\n  agentId: string;\n  lastSync: string;\n  files: Record<string, SyncManifestEntry>;\n}\ninterface SyncPresignedUrl {\n  path: string;\n  url: string;\n  expiresAt: string;\n}\ninterface SyncConfirmedUpload {\n  filePath: string;\n  hash: string;\n  size: number;\n  storageClass: \"STANDARD\" | \"GLACIER_IR\";\n  syncedAt: string;\n}\ninterface SyncReconstructFile {\n  path: string;\n  size: number;\n  url: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncReconstructBundle {\n  agentId: string;\n  mode: \"full\" | \"active\" | \"memory\";\n  fileCount: number;\n  totalSize: number;\n  files: SyncReconstructFile[];\n  expiresAt: string;\n}\ninterface SyncAgentStats {\n  agentId: string;\n  standardBytes: number;\n  glacierBytes: number;\n  fileCount: number;\n  lastSyncAt: string | null;\n}\ninterface SyncFileEntry {\n  filePath: string;\n  size: number;\n  modified: string;\n  contentHash: string;\n  storageClass?: string;\n  compressed?: boolean;\n}\ninterface SyncSessionEntry {\n  sessionId: string;\n  size: number;\n  lastModified: string;\n  storageClass?: string;\n  isArchived: boolean;\n}\ninterface SyncSessionContent {\n  sessionId: string;\n  content: string;\n  compressed: boolean;\n}\ninterface SharedFileEntry {\n  filePath: string;\n  fileName: string;\n  size: number;\n  contentType?: string;\n}\ndeclare class AgentApiClient {\n  private readonly apiKey;\n  private readonly apiUrl;\n  constructor(config: AgentApiClientConfig);\n  private request;\n  syncRegister(args?: {\n    displayName?: string;\n  }): Promise<{\n    agent: SyncAgentInfo;\n  }>;\n  syncGetManifest(): Promise<SyncManifest>;\n  syncPresign(args: {\n    files: {\n      path: string;\n      operation: \"put\" | \"get\";\n      contentType?: string;\n    }[];\n  }): Promise<{\n    urls: SyncPresignedUrl[];\n  }>;\n  syncConfirmUpload(args: {\n    filePath: string;\n    hash: string;\n    size: number;\n    storageClass?: \"STANDARD\" | \"GLACIER_IR\";\n  }): Promise<SyncConfirmedUpload>;\n  syncReconstruct(args: {\n    mode: \"full\" | \"active\" | \"memory\";\n  }): Promise<SyncReconstructBundle>;\n  syncGetStats(): Promise<SyncAgentStats>;\n  syncListFiles(args?: {\n    prefix?: string;\n  }): Promise<{\n    files: SyncFileEntry[];\n  }>;\n  syncListSessions(): Promise<{\n    sessions: SyncSessionEntry[];\n  }>;\n  syncGetSession(sessionId: string): Promise<SyncSessionContent>;\n  syncDeleteFile(filePath: string): Promise<{\n    removed: boolean;\n  }>;\n  sharedListFiles(args: {\n    scope: \"org\" | \"team\" | \"project\";\n    scopeId: string;\n  }): Promise<{\n    files: SharedFileEntry[];\n    nextCursor: string | null;\n  }>;\n  sharedDownloadUrl(args: {\n    scope: \"org\" | \"team\" | \"project\";\n    scopeId: string;\n    filePath: string;\n  }): Promise<{\n    downloadUrl: string;\n    expiresIn: number;\n  }>;\n  listIntegrations(): Promise<IntegrationInstall$1[]>;\n  getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult$1>;\n  updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;\n  installIntegration(integrationId: string, options?: {\n    version?: string;\n    config?: Record<string, unknown>;\n  }): Promise<IntegrationInstall$1>;\n  removeIntegration(integrationId: string): Promise<IntegrationInstall$1>;\n  getOAuthUrl(provider: string, scopes?: string[]): Promise<{\n    url: string;\n    provider: string;\n    expiresIn: number;\n  }>;\n  getOAuthStatus(provider: string): Promise<{\n    provider: string;\n    connected: boolean;\n    config?: Record<string, string>;\n  }>;\n  getRegistry(): Promise<{\n    integrations: RegistryEntry$1[];\n  }>;\n  /**\n   * Returns every connected Google account for the agent. Multi-account by\n   * design — the openclaw-google plugin requires the LLM to pass `email`\n   * explicitly to `google_run_command` so an account is always selected\n   * deliberately.\n   *\n   * 2026-05-14 (connections-redesign PR 1): the legacy flat shape (`email`,\n   * `refreshToken`, `accessToken`, etc., populated from the default account)\n   * is gone. Iterate over `accounts`.\n   */\n  getGoogleCredentials(): Promise<{\n    accounts: {\n      email: string;\n      refreshToken: string;\n      clientId: string;\n      clientSecret: string;\n      displayName?: string;\n      connectedAt?: string;\n    }[];\n  }>;\n  disconnectGoogleAccount(email: string): Promise<{\n    accounts: {\n      email: string;\n      displayName?: string;\n      connectedAt?: string;\n    }[];\n  }>;\n  getGoogleChatCredentials(): Promise<{\n    email: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    displayName?: string;\n  }>;\n  /**\n   * @deprecated Returns a single primary credential blob (legacy \"pick-the-\n   * default-connection\" shape). Use `getGithubAccounts()` for the multi-\n   * account shape required by Pattern A — explicit selector args on every\n   * tool. Retained because the `@alfe.ai/openclaw-github` proxy is the\n   * only consumer that knows about Pattern A; legacy env-interpolation\n   * callers will keep hitting `/credentials` until they move to the proxy.\n   */\n  getGithubCredentials(): Promise<{\n    login: string;\n    accessToken: string;\n  }>;\n  /**\n   * Pattern A: multi-account credential fetch for GitHub.\n   *\n   * Returns every agent-scoped GitHub connection. The caller is expected\n   * to require a `login` selector on every credential-touching tool and\n   * look up the matching account at dispatch time.\n   *\n   * GitHub OAuth tokens have no expiry (`tokenLifecycle: \"no_expiry\"`),\n   * so there is intentionally no `refreshGithubAccountToken` method — if\n   * a token is revoked the user must re-run the OAuth flow.\n   *\n   * Returned `accounts[i].login` is the GitHub username — the stable\n   * cross-session identifier the LLM should pass.\n   */\n  getGithubAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      login: string;\n      scopes: string;\n    }[];\n  }>;\n  /**\n   * @deprecated Returns a single primary credential blob (legacy \"pick-the-\n   * default-connection\" shape). Use `getXeroAccounts()` for the multi-\n   * account shape required by Pattern A — explicit selector args on every\n   * tool. This method will be removed once all consumers migrate.\n   */\n  getXeroCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    xeroTenantId: string;\n  }>;\n  /**\n   * Pattern A: multi-account credential fetch for Xero. Returns every\n   * agent-scoped Xero connection. The caller is expected to require a\n   * selector arg (e.g. `xeroTenantId`) on every credential-touching tool\n   * and look up the matching account by that selector at dispatch time.\n   *\n   * Returned `accounts[i].accountIdentifier` is the Xero tenantId — the\n   * stable cross-session identifier the LLM should pass.\n   */\n  getXeroAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      accessTokenExpiresAt: string;\n      xeroTenantId: string;\n    }[];\n  }>;\n  refreshXeroToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  /**\n   * Pattern A: refresh a specific Xero connection by its `accountIdentifier`\n   * (the Xero `tenantId`). The legacy `refreshXeroToken()` only refreshes\n   * the *primary* connection, which is wrong for multi-tenant Xero where\n   * each tenant has its own non-interchangeable access token.\n   */\n  refreshXeroAccountToken(xeroTenantId: string): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    expiresAt: string;\n  }>;\n  /**\n   * @deprecated Returns a single primary credential blob (legacy \"pick-the-\n   * default-connection\" shape). Use `getNotionAccounts()` for the multi-\n   * account shape required by Pattern A.\n   */\n  getNotionCredentials(): Promise<{\n    accessToken: string;\n    workspaceId: string;\n    workspaceName: string;\n  }>;\n  /**\n   * Pattern A: multi-account credential fetch for Notion. Returns every\n   * agent-scoped Notion connection. The caller is expected to require a\n   * selector arg (e.g. `workspaceId`) on every credential-touching tool.\n   *\n   * Returned `accounts[i].accountIdentifier` is the Notion workspaceId.\n   */\n  getNotionAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      workspaceId: string;\n      workspaceName: string;\n    }[];\n  }>;\n  /**\n   * @deprecated Returns a single primary Atlassian Connection's credentials\n   * (one OAuth user, one cloudId) — the legacy \"pick-the-default-connection\"\n   * shape. Atlassian is multi-site by nature (each OAuth user may have\n   * access to multiple Cloud sites), so Pattern A plugins MUST use\n   * `getAtlassianAccounts()` to discover the full set and dispatch via\n   * the `cloudId` selector arg.\n   */\n  getAtlassianCredentials(): Promise<{\n    accessToken: string;\n    refreshToken: string;\n    accessTokenExpiresAt: string;\n    cloudId: string;\n    siteName: string;\n    siteUrl: string;\n    email: string;\n    enabledProducts: string[];\n    clientId: string;\n    clientSecret: string;\n  }>;\n  refreshAtlassianToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  /**\n   * Pattern A: multi-account / multi-site credential fetch for Atlassian.\n   *\n   * Returns every agent-scoped Atlassian Connection. Each Connection is\n   * one OAuth user with a single access token and N accessible Cloud\n   * sites (`availableSites`). The caller is expected to:\n   *\n   *   1. Flatten (connection × cloudId) into one MCP child per site.\n   *   2. Require a `cloudId` selector on every credential-touching tool.\n   *   3. Use the access token bound to the Connection that owns the\n   *      requested `cloudId` (Atlassian shares one access token across\n   *      all sites accessible to the OAuth user).\n   *\n   * Per-account token refresh uses `refreshAtlassianAccountToken(email)`\n   * — refreshing one Connection rotates its single access token, which\n   * then applies to every cloudId for that Connection.\n   *\n   * Returned `accounts[i].accountIdentifier` is the OAuth user's email\n   * — the stable cross-session identifier for refresh purposes. The LLM\n   * never sees this directly: it picks a site via the `cloudId` arg\n   * instead.\n   */\n  getAtlassianAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      accessTokenExpiresAt: string;\n      clientId: string;\n      clientSecret: string;\n      cloudId: string;\n      siteName: string;\n      siteUrl: string;\n      availableSites: {\n        id: string;\n        url: string;\n        name: string;\n        scopes?: string[];\n        avatarUrl?: string;\n      }[];\n    }[];\n  }>;\n  /**\n   * Pattern A: refresh a specific Atlassian Connection by `accountIdentifier`\n   * (the OAuth user's email).\n   *\n   * Atlassian rotates refresh tokens (`rotatesRefreshToken: true`); the\n   * server-side per-account refresh endpoint handles rotation and\n   * persistence. Refreshing one Connection updates its single access\n   * token, which applies to every accessible Cloud site (cloudId) for\n   * that OAuth user.\n   *\n   * Returns the new access token + expiry. The proxy is responsible for\n   * fanning the new token out to every child server it spawned for\n   * cloudIds owned by this Connection.\n   */\n  refreshAtlassianAccountToken(accountIdentifier: string): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    expiresAt: string;\n  }>;\n  /**\n   * @deprecated Returns a single primary credential blob (legacy \"pick-the-\n   * default-connection\" shape). Use `getMYOBAccounts()` for the multi-\n   * account shape required by Pattern A.\n   */\n  getMYOBCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    myobBusinessId: string;\n    clientId: string;\n  }>;\n  /**\n   * Pattern A: multi-account credential fetch for MYOB. Returns every\n   * agent-scoped MYOB connection. The caller is expected to require a\n   * selector arg (e.g. `myobBusinessId` / `accountIdentifier`) on every\n   * credential-touching tool.\n   *\n   * Returned `accounts[i].accountIdentifier` is the MYOB businessId.\n   */\n  getMYOBAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      accessTokenExpiresAt: string;\n      myobBusinessId: string;\n      clientId: string;\n    }[];\n  }>;\n  refreshMYOBToken(): Promise<{\n    accessToken: string;\n    expiresAt: string;\n  }>;\n  /**\n   * Microsoft 365 (delegated OAuth) credential fetch — single-account shape.\n   *\n   * @deprecated Use `getMicrosoftAccounts()` and dispatch via the `email`\n   *   selector once per-account plugins land. Retained because the existing\n   *   `integrations/connect/microsoft/hooks/post_activate.mjs` writes\n   *   `mgc` credentials for the single (default) Microsoft account.\n   *\n   * Returns the agent's effective Microsoft delegated-OAuth credentials.\n   * Distinct from `getTeamsCredentials()` (Azure bot credentials for the\n   * Teams adapter, which is admin-consent flow on services/microsoft, not\n   * delegated OAuth on services/connect).\n   */\n  getMicrosoftCredentials(): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt?: string;\n    refreshToken: string;\n    clientId: string;\n    clientSecret: string;\n    email?: string;\n    microsoftTenantId?: string;\n    workspaceDomain?: string;\n  }>;\n  /**\n   * Pattern A: multi-account credential fetch for Microsoft 365.\n   *\n   * Returns every agent-scoped Microsoft connection. The caller is expected\n   * to require an `email` selector on every credential-touching tool and\n   * look up the matching account at dispatch time.\n   *\n   * Returned `accounts[i].accountIdentifier` is the user's primary email\n   * (or the tid claim as fallback) — the stable cross-session identifier\n   * the LLM should pass.\n   *\n   * Per-account token refresh is exposed via `refreshMicrosoftAccountToken`,\n   * NOT `refreshXeroAccountToken` — Microsoft refresh tokens are not\n   * interchangeable across (tenant, user) pairs.\n   */\n  getMicrosoftAccounts(): Promise<{\n    accounts: {\n      connectionId: string;\n      accountIdentifier: string;\n      displayName: string | null;\n      connectedAt: string;\n      accessToken: string;\n      accessTokenExpiresAt: string;\n      refreshToken: string;\n      clientId: string;\n      clientSecret: string;\n      email: string;\n      microsoftTenantId: string;\n      workspaceDomain: string;\n    }[];\n  }>;\n  /**\n   * Pattern A: refresh a specific Microsoft 365 connection by its\n   * `accountIdentifier`. For Microsoft, `accountIdentifier` is the user's\n   * email when the Graph profile fetch succeeded at connect time, and the\n   * Azure tenant id (`tid` claim) as fallback. Callers should pass the\n   * value returned by `getMicrosoftAccounts()` rather than synthesising\n   * an email locally.\n   *\n   * Microsoft refresh tokens are bound to a specific (tenant, user) pair —\n   * they are NOT interchangeable across accounts, so per-account refresh\n   * is mandatory. The generic /accounts/{accountIdentifier}/refresh\n   * endpoint walks the agent's full visible scope chain to find a matching\n   * connection (works for inherited team/project Microsoft connections).\n   */\n  refreshMicrosoftAccountToken(accountIdentifier: string): Promise<{\n    accessToken: string;\n    accessTokenExpiresAt: string;\n    expiresAt: string;\n  }>;\n  getTeamsCredentials(): Promise<{\n    agentId: string;\n    tenantId: string;\n    azureAppId: string;\n    azureBotId: string;\n    azureClientSecret: string;\n    botDisplayName?: string;\n    teamsTenantId?: string;\n    serviceUrl?: string;\n  }>;\n  sendTeamsMessage(data: {\n    conversationId: string;\n    text?: string;\n    adaptiveCard?: Record<string, unknown>;\n  }): Promise<{\n    ok: boolean;\n    activityId: string;\n  }>;\n  listTeamsChannels(): Promise<{\n    channels: {\n      id: string;\n      name: string;\n      description?: string;\n    }[];\n  }>;\n  presignAttachments(files: {\n    filename: string;\n    mimeType: string;\n    size: number;\n  }[]): Promise<{\n    attachments: {\n      id: string;\n      uploadUrl: string;\n      downloadUrl: string;\n      s3Key: string;\n      expiresAt: string;\n    }[];\n  }>;\n  recordActivity(data: {\n    userId?: string;\n    channel: string;\n    role: \"user\" | \"assistant\";\n  }): Promise<{\n    recorded: boolean;\n  }>;\n  /**\n   * Mint a fresh AES-256 data key for a specific (secret, field) pair. The\n   * encryption context is rebuilt server-side from `auth.tenantId` + the body\n   * fields including `fieldKey`; the agent cannot forge context for a scope\n   * or field it doesn't own. Legacy single-envelope secrets are migrated to\n   * `field#value` rows by the data migration, so call with `fieldKey: \"value\"`\n   * to reach them.\n   */\n  generateSecretDataKey(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<GeneratedDataKey$1>;\n  /**\n   * Unwrap a wrapped data key so the agent can decrypt the envelope locally.\n   * `fieldKey` MUST match the value supplied when the data key was generated\n   * (it's bound into KMS encryption context); mismatch fails with\n   * `InvalidCiphertextException`.\n   */\n  decryptSecretDataKey(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n    dataKeyCiphertext: string;\n  }): Promise<{\n    plaintextKey: string;\n  }>;\n  /**\n   * Create a new secret with one or more fields. Encrypted fields must arrive\n   * pre-sealed (the agent has already obtained per-field data keys via\n   * `generateSecretDataKey({ ..., fieldKey })` and AES-encrypted locally).\n   * Plaintext fields ship the value inline.\n   */\n  createSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    secretName: string;\n    category?: SecretCategory$1;\n    description?: string;\n    tags?: string[];\n    fields: {\n      key: string;\n      format?: FieldFormat$1;\n      sensitivity: FieldSensitivity$1;\n      value?: string;\n      envelope?: EncryptedEnvelopeV1$1;\n    }[];\n    reason?: string;\n  }): Promise<SecretAggregate$1>;\n  /** Fetch the secret aggregate plus per-field encrypted envelopes. */\n  getSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n  }): Promise<{\n    aggregate: SecretAggregate$1;\n    envelopes: FieldEnvelope$1[];\n  }>;\n  /** Fetch one field. Plaintext: value inline. Encrypted: envelope. */\n  getSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<{\n    key: string;\n    sensitivity: FieldSensitivity$1;\n    format?: FieldFormat$1;\n    value?: string;\n    envelope?: EncryptedEnvelopeV1$1;\n    rotatedAt?: string;\n    createdAt: string;\n    updatedAt: string;\n  }>;\n  /** Add OR rotate one field. */\n  setSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n    sensitivity: FieldSensitivity$1;\n    format?: FieldFormat$1;\n    value?: string;\n    envelope?: EncryptedEnvelopeV1$1;\n    reason?: string;\n  }): Promise<{\n    fieldKey: string;\n    rotated: boolean;\n  }>;\n  /** Remove one field. */\n  removeSecretField(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    fieldKey: string;\n  }): Promise<void>;\n  /** Update secret-level metadata (name/description/tags/category). */\n  updateSecretMetadata(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    secretName?: string;\n    description?: string;\n    tags?: string[];\n    category?: SecretCategory$1;\n    reason?: string;\n  }): Promise<SecretAggregate$1>;\n  /** List metadata for secrets in a scope. Optional filters route through the byFacet GSI. */\n  listSecrets(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    category?: SecretCategory$1;\n    tag?: string;\n    fieldKey?: string;\n  }): Promise<SecretMetadata$1[]>;\n  /** Bounded changelog read — metadata-only audit entries. */\n  getSecretHistory(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n    limit?: number;\n    cursor?: string;\n  }): Promise<{\n    entries: ChangelogEntry$1[];\n    nextCursor?: string;\n  }>;\n  /** Delete a secret (and all its field rows + tag rows + changelog rows). */\n  deleteSecret(args: {\n    scope: SecretScope$1;\n    scopeId: string;\n    secretId: string;\n  }): Promise<void>;\n  /** Enumerate scopes (org/team/project/agent) this agent can access. */\n  listSecretScopes(): Promise<ScopeInfo$1[]>;\n  /**\n   * Returns the calling agent's own identity context — `{ agentId, tenantId }`\n   * decoded server-side from the agent API token. Used by the\n   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the\n   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.\n   * Plugins should cache this for the daemon's lifetime (single-agent-per-\n   * process invariant). One HTTP round-trip per process activate; not for\n   * per-call use.\n   */\n  whoami(): Promise<{\n    agentId: string;\n    tenantId: string;\n  }>;\n  resolveIdentity(args: {\n    provider: string;\n    platformId: string;\n    kind?: \"user\" | \"agent\" | \"service\" | \"bot\" | \"workspace\";\n    displayName?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n    created?: boolean;\n    reason?: string;\n    /**\n     * Flattened auriclabs permission strings for the resolved identity\n     * (scope-prefixed where applicable). Empty array on miss / org service\n     * outage — the runtime gate fails closed in that case.\n     */\n    permissions: string[];\n  }>;\n  searchIdentities(args?: {\n    q?: string;\n    status?: string;\n    limit?: number;\n  }): Promise<{\n    identities: unknown[];\n  }>;\n  getIdentityContext(identityId: string): Promise<{\n    context: unknown;\n  }>;\n  mergeIdentities(survivorId: string, args: {\n    mergedId: string;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    error?: string;\n  }>;\n  unmergeIdentity(identityId: string, args: {\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    error?: string;\n  }>;\n  addIdentityNote(identityId: string, args: {\n    content: string;\n    category?: string;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    noteId: string | null;\n  }>;\n  tagIdentity(identityId: string, args: {\n    tag: string;\n    action: \"add\" | \"remove\";\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n  }>;\n  getIdentityChangelog(identityId: string, args?: {\n    limit?: number;\n  }): Promise<{\n    entries: unknown[];\n  }>;\n  rollbackIdentity(identityId: string, args: {\n    targetVersion: number;\n    changedBy: {\n      type: string;\n      id: string;\n      name?: string;\n    };\n  }): Promise<{\n    ok: boolean;\n    entry?: unknown;\n  }>;\n  requestIdentityVerification(args: {\n    claimedIdentityId: string;\n    requestingIdentityId: string;\n    requestingProvider: string;\n    requestingPlatformId: string;\n    preferredChannel?: \"mobile\" | \"email\";\n    /**\n     * Phase 2: agent-supplied contact endpoint. When provided, the top-level\n     * `preferredChannel` is ignored — the contact's channel wins.\n     */\n    contact?: {\n      channel: \"email\" | \"mobile\";\n      value: string;\n    };\n  }): Promise<{\n    verificationId: string;\n    channel: string;\n    deliveredTo: string;\n    expiresAt: string;\n    availableChannels: {\n      channel: string;\n      deliveredTo: string;\n    }[];\n  } | {\n    error: string;\n  }>;\n  confirmIdentityVerification(args: {\n    claimedIdentityId: string;\n    verificationId: string;\n    phrase: string;\n  }): Promise<{\n    verified: boolean;\n    identityId?: string;\n    /** Phase 2: how the confirm resolved — Scenario A vs B. */\n    action?: \"merged\" | \"contact_verified\";\n    error?: string;\n  }>;\n  /**\n   * Update display-shape fields on an Identity. Body excludes `email` /\n   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go\n   * via the verify flow, title/company live on OrgMembership, metadata is\n   * not agent-writable.\n   */\n  updateIdentity(identityId: string, args: {\n    name?: string;\n    avatarUrl?: string;\n    timezone?: string;\n    locale?: string;\n  }): Promise<{\n    ok: boolean;\n  }>;\n  /**\n   * Phase 2 (Section H): server-side verification of a Google Chat sender via\n   * the agent's existing Google OAuth credentials. Returns the resolved\n   * identity (created or matched via Scenario-B email enrichment).\n   */\n  resolveGoogleChatSender(args: {\n    senderUserId: string;\n    spaceId?: string;\n  }): Promise<{\n    identityId: string | null;\n    status: string;\n  }>;\n  memorySearch(query: string, opts?: {\n    limit?: number;\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    includeKnowledge?: boolean;\n  }): Promise<{\n    facts: {\n      subject: string;\n      predicate: string;\n      object: string;\n      since: string;\n      confidence: number;\n    }[];\n    memories: {\n      id: string;\n      text: string;\n      topic: string;\n      subtopic: string;\n      tag: string;\n      importance: number;\n      timestamp: number;\n      score: number;\n    }[];\n  }>;\n  memoryStore(text: string, opts?: {\n    topic?: string;\n    subtopic?: string;\n    tag?: string;\n    importance?: number;\n  }): Promise<{\n    memoryId: string;\n  }>;\n  memoryIngest(sessionKey: string, messages: {\n    role: string;\n    content: string;\n    index: number;\n    timestamp?: string;\n  }[], metadata?: {\n    channelId?: string;\n    userId?: string;\n    userName?: string;\n  }): Promise<{\n    queued: boolean;\n    messageCount: number;\n  }>;\n  memoryLoadContext(tier?: number, topicHint?: string): Promise<{\n    formatted: string;\n    [key: string]: unknown;\n  }>;\n  memoryLookupEntity(subject: string): Promise<{\n    subject: string;\n    triples: {\n      tripleId: string;\n      predicate: string;\n      object: string;\n      validFrom: string;\n      validTo?: string;\n      confidence: number;\n    }[];\n  }>;\n  memoryNavigate(): Promise<{\n    topics: {\n      name: string;\n      tripleCount: number;\n      subtopics: string[];\n    }[];\n    cursor: string | null;\n  }>;\n  memoryDelete(memoryId: string): Promise<{\n    deleted: boolean;\n  }>;\n  memoryStats(): Promise<{\n    vectorCount: number;\n    tripleCount: number;\n    storageEstimateBytes: number;\n    lastIngestionAt?: string;\n  }>;\n  memoryLearn(args: {\n    text: string;\n    source?: string;\n    sourceType?: \"file\" | \"url\" | \"inline\";\n    metadata?: {\n      sessionId?: string;\n      channelId?: string;\n      userName?: string;\n    };\n  }): Promise<{\n    memoriesStored: number;\n    triplesStored: number;\n    chunks: number;\n    source?: string;\n  }>;\n  memoryBootstrapStatus(): Promise<{\n    synced: boolean;\n    syncedAt?: string;\n  }>;\n  memoryBootstrapStatusMark(): Promise<{\n    synced: true;\n    syncedAt: string;\n  }>;\n  searchWeb(params: {\n    query: string;\n    count?: number;\n    offset?: number;\n    country?: string;\n    freshness?: string;\n  }): Promise<unknown>;\n  searchImages(params: {\n    query: string;\n    count?: number;\n  }): Promise<unknown>;\n  searchNews(params: {\n    query: string;\n    count?: number;\n    freshness?: string;\n  }): Promise<unknown>;\n  registerDatabaseCredentials(): Promise<{\n    connectionString: string;\n    username: string;\n    password: string;\n    databases: string[];\n  }>;\n  reportDatabaseAudit(entry: {\n    database: string;\n    collection: string;\n    operation: string;\n    summary?: string;\n  }): Promise<void>;\n}\n//# sourceMappingURL=index.d.ts.map\n//#endregion\nexport { AgentApiClient, AgentApiClientConfig, type ChangelogAction, type ChangelogActor, type ChangelogEntry, type EncryptedEnvelopeV1, type Field, type FieldEnvelope, type FieldFormat, type FieldSensitivity, type FieldView, type GeneratedDataKey, type IntegrationConfigResult, type IntegrationConfigSchemaField, type IntegrationInstall, type RegistryEntry, type ScopeInfo, type SecretAggregate, type SecretCategory, type SecretMetadata, type SecretScope, SharedFileEntry, SyncAgentInfo, SyncAgentStats, SyncConfirmedUpload, SyncFileEntry, SyncManifest, SyncManifestEntry, SyncPresignedUrl, SyncReconstructBundle, SyncReconstructFile, SyncSessionContent, SyncSessionEntry };\n//# sourceMappingURL=index.d.ts.map"],"mappings":";;;;;AAAo2B,UAI11BiC,oBAAAA,CAAoB;EAAA,MAIpBC,EAAAA,MAAAA;EAAa,MAUbC,EAAAA,MAAAA;AAAiB;UAVjBD,aAAAA,CAkBY;SAIEC,EAAAA,MAAAA;UAAfE,EAAAA,MAAAA;EAAM,WAAA,EAAA,MAAA;EAAA,QAELC,EAAAA,MAAAA;EAAgB,MAKhBC,EAAAA,OAAAA,GAAAA,SAAmB,GAAA,QAAA;EAAA,SAOnBC,CAAAA,EAAAA,MAAAA;EAAmB,SAOnBC,CAAAA,EAAAA,MAAAA;EAKkB,QAGlBC,CAAAA,EAAAA,MAAAA;AAAc;AAOD,UAhDbP,iBAAAA,CAwDgB;EAAA,IAOhBU,EAAAA,MAAAA;EAAkB,IAKlBC,EAAAA,MAAAA;EAAe,QAMXC,EAAAA,MAAAA;EAAc,IAAA,CAAA,EAAA,MAAA;cAGNd,CAAAA,EAAAA,MAAAA;YAKXC,CAAAA,EAAAA,OAAAA;;UA1EDE,YAAAA,CA4EmBA;SAARY,EAAAA,CAAAA;SAQXV,EAAAA,MAAAA;UADJU,EAAAA,MAAAA;OAQQT,EAvFLF,MAuFKE,CAAAA,MAAAA,EAvFUJ,iBAuFVI,CAAAA;;UArFJD,gBAAAA,CAwFIG;QAARO,MAAAA;OACoBN,MAAAA;WAARM,EAAAA,MAAAA;;UApFRT,mBAAAA,CAuFJS;UAIQJ,EAAAA,MAAAA;QADQI,MAAAA;QAGuBH,MAAAA;cAARG,EAAAA,UAAAA,GAAAA,YAAAA;UACDA,EAAAA,MAAAA;;UAvF1BR,mBAAAA,CA6FJQ;QAQAA,MAAAA;QAIwB5B,MAAAA;OAAR4B,MAAAA;cACiC/B,CAAAA,EAAAA,MAAAA;YAAR+B,CAAAA,EAAAA,OAAAA;;UAnGrCP,qBAAAA,CAoGyEO;SAGtEX,EAAAA,MAAAA;QACCjB,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;WAAR4B,EAAAA,MAAAA;WAC8C5B,EAAAA,MAAAA;OAAR4B,EApGnCR,mBAoGmCQ,EAAAA;WACQA,EAAAA,MAAAA;;UAlG1CN,cAAAA,CAuG0BM;SAMlB1B,EAAAA,MAAAA;eADD0B,EAAAA,MAAAA;cAaSA,EAAAA,MAAAA;WAUgBA,EAAAA,MAAAA;YAOZA,EAAAA,MAAAA,GAAAA,IAAAA;;UAnIpBL,aAAAA,CAoKaK;UAiBCA,EAAAA,MAAAA;QAcHA,MAAAA;UAWCA,EAAAA,MAAAA;aAU2BA,EAAAA,MAAAA;cAUvBA,CAAAA,EAAAA,MAAAA;YAYHA,CAAAA,EAAAA,OAAAA;;UAtObJ,gBAAAA,CAqQiBI;WA0BDA,EAAAA,MAAAA;QAoCiCA,MAAAA;cAUnCA,EAAAA,MAAAA;cAcHA,CAAAA,EAAAA,MAAAA;YAYCA,EAAAA,OAAAA;;UAhWZH,kBAAAA,CA0YgBG;WA8BiCA,EAAAA,MAAAA;SAKlCA,EAAAA,MAAAA;YAaNX,EAAAA,OAAAA;;UArbTS,eAAAA,CA0baE;UAWfA,EAAAA,MAAAA;UAaFA,EAAAA,MAAAA;QAYKhB,MAAAA;aAIGjB,CAAAA,EAAAA,MAAAA;;cA5dAgC,cAAAA,CAoeHf;mBAKLgB,MAAAA;mBAUKhB,MAAAA;aAIIJ,CAAAA,MAAAA,EApfOK,oBAofPL;UAKAlB,OAAAA;cACIE,CAAAA,KAAAA,EAAAA;eAEFP,CAAAA,EAAAA,MAAAA;MAxfX2C,OA2fQtB,CAAAA;SAARsB,EA1fKd,aA0fLc;;iBAOStB,CAAAA,CAAAA,EA/fMsB,OA+fNtB,CA/fcU,YA+fdV,CAAAA;aACAlB,CAAAA,IAAAA,EAAAA;SAFTwC,EAAAA;UAMKhB,EAAAA,MAAAA;eAMMpB,EAAAA,KAAAA,GAAAA,KAAAA;iBACJF,CAAAA,EAAAA,MAAAA;OAEEL;MAtgBT2C,OAigBAA,CAAAA;QAYKhB,EA5gBDM,gBA4gBCN,EAAAA;;mBAKEtB,CAAAA,IAAAA,EAAAA;YAEEL,EAAAA,MAAAA;QAET2C,EAAAA,MAAAA;QAMKhB,EAAAA,MAAAA;gBAILgB,CAAAA,EAAAA,UAAAA,GAAAA,YAAAA;MAxhBAA,OA2hBKhB,CA3hBGO,mBA2hBHP,CAAAA;iBAMIJ,CAAAA,IAAAA,EAAAA;QAEDF,EAAAA,MAAAA,GAAAA,QAAAA,GAAAA,QAAAA;MAhiBRsB,OAgiBAA,CAhiBQP,qBAgiBRO,CAAAA;cAGKhB,CAAAA,CAAAA,EAliBOgB,OAkiBPhB,CAliBeU,cAkiBfV,CAAAA;eAEIJ,CAAAA,KAAAA,EAAAA;UAGDE,CAAAA,EAAAA,MAAAA;MApiBRkB,OAoiBAA,CAAAA;SAGKhB,EAtiBAW,aAsiBAX,EAAAA;;kBAKLgB,CAAAA,CAAAA,EAziBgBA,OAyiBhBA,CAAAA;YAMKhB,EA9iBGY,gBA8iBHZ,EAAAA;;gBAKmBR,CAAAA,SAAAA,EAAAA,MAAAA,CAAAA,EAjjBOwB,OAijBPxB,CAjjBeqB,kBAijBfrB,CAAAA;gBAARwB,CAAAA,QAAAA,EAAAA,MAAAA,CAAAA,EAhjBcA,OAgjBdA,CAAAA;WAUVA,EAAAA,OAAAA;;iBAyBNA,CAAAA,IAAAA,EAAAA;SAGoCA,EAAAA,KAAAA,GAAAA,MAAAA,GAAAA,SAAAA;WAUpCA,EAAAA,MAAAA;MA1lBAA,OAomBAA,CAAAA;SAYAA,EA/mBKF,eA+mBLE,EAAAA;cAWAA,EAAAA,MAAAA,GAAAA,IAAAA;;mBAeAA,CAAAA,IAAAA,EAAAA;SAkBAA,EAAAA,KAAAA,GAAAA,MAAAA,GAAAA,SAAAA;WAgBAA,EAAAA,MAAAA;YAkBAA,EAAAA,MAAAA;MAtrBAA,OAisBAA,CAAAA;eAUAA,EAAAA,MAAAA;aAwBAA,EAAAA,MAAAA;;kBAgBkDA,CAAAA,CAAAA,EA/uBlCA,OA+uBkCA,CA/uB1B5B,kBA+uB0B4B,EAAAA,CAAAA;sBAIjBA,CAAAA,aAAAA,EAAAA,MAAAA,CAAAA,EAlvBQA,OAkvBRA,CAlvBgB/B,uBAkvBhB+B,CAAAA;yBAWnBA,CAAAA,aAAAA,EAAAA,MAAAA,EAAAA,MAAAA,EA5vBqCX,MA4vBrCW,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA,CAAAA,EA5vB+DA,OA4vB/DA,CAAAA,IAAAA,CAAAA;oBAQcA,CAAAA,aAAAA,EAAAA,MAAAA,EAAAA,QAAAA,EAAAA;WAGjBA,CAAAA,EAAAA,MAAAA;UAeXA,CAAAA,EAnxBOX,MAmxBPW,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA;MAlxBAA,OAwxBqBA,CAxxBb5B,kBAwxBa4B,CAAAA;mBAIIA,CAAAA,aAAAA,EAAAA,MAAAA,CAAAA,EA3xBaA,OA2xBbA,CA3xBqB5B,kBA2xBrB4B,CAAAA;aAUzBA,CAAAA,QAAAA,EAAAA,MAAAA,EAAAA,MAAAA,CAAAA,EAAAA,MAAAA,EAAAA,CAAAA,EApyB8CA,OAoyB9CA,CAAAA;OAIAA,EAAAA,MAAAA;YAKAA,EAAAA,MAAAA;aAC2BA,EAAAA,MAAAA;;EAWpB,cAAA,CAAA,QAAA,EAAA,MAAA,CAAA,EApzBuBA,OAozBvB,CAAA;;;aAjzBAX;ECrJb,CAAA,CAAa;EASb,WAAa,CAAA,CAAA,ED8IIW,OC9IwB,CAAA;IAa5B,YAAA,EDkIK1B,aClIgE,EAAA;EAElF,CAAA,CAAiB;EAqBjB;;;;;;AA6BA;;;;0BD0F0B0B;;;;;;;;;;0CAUgBA;;;;;;;8BAOZA;;;;;;;;;;;;;;;0BAeJA;;;;;;;;;;;;;;;;;;uBAkBHA;;;;;;;;;;;;;;;;;wBAiBCA;;;;;;;;;;;;;;qBAcHA;;;;;;;;;;;sBAWCA;;;;;;;;;;iDAU2BA;;;;;;;;;;0BAUvBA;;;;;;;;;;;;uBAYHA;;;;;;;;;;;;;;;;;;;6BAmBMA;;;;;;;;;;;;2BAYFA;;;;;;;;;;;;;;;;;;;;;;;;;;0BA0BDA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2DAoCiCA;;;;;;;;;;wBAUnCA;;;;;;;;;;;;;;qBAcHA;;;;;;;;;;;;sBAYCA;;;;;;;;;;;;;;;;;6BAiBOA;;;;;;;;;;;;;;;;;;;;;;;;;0BAyBHA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2DA8BiCA;;;;;yBAKlCA;;;;;;;;;;;;;mBAaNX;MACbW;;;;uBAIiBA;;;;;;;;;;;QAWfA;;;;;;;;;;;;;MAaFA;;;;;;;;;;;;WAYKhB;;;;MAILgB,QAAQjC;;;;;;;;WAQHiB;;;;;MAKLgB;;;;;;;;;;WAUKhB;;;;eAIIJ;;;;;eAKAlB;mBACIE;;iBAEFP;;;MAGX2C,QAAQtB;;;WAGHM;;;MAGLgB;eACStB;eACAlB;;;;WAIJwB;;;;MAILgB;;iBAEWpC;aACJF;;eAEEL;;;;;;;WAOJ2B;;;;iBAIMpB;aACJF;;eAEEL;;MAET2C;;;;;;WAMKhB;;;;MAILgB;;;WAGKhB;;;;;;eAMIJ;;MAEToB,QAAQtB;;;WAGHM;;eAEIJ;;;MAGToB,QAAQlB;;;WAGHE;;;;;MAKLgB;aACO7C;;;;;WAKF6B;;;MAGLgB;;sBAEgBA,QAAQxB;;;;;;;;;;YAUlBwB;;;;;;;;;MASNA;;;;;;;;;;;;;;;;MAgBAA;;;0CAGoCA;;;;;;;;;;MAUpCA;;;;;;;;;;MAUAA;;;;;;;;;;;;MAYAA;;;;;;;;;;;MAWAA;;;;;MAKAA;;;;;;;;;;MAUAA;;;;;;;;;;;;;;;;;;MAkBAA;;;;;;;;;;;;;;;;MAgBAA;;;;;;;;;;;;;;;;;;MAkBAA;;;;;;;;;;;MAWAA;;;;;;;;;;MAUAA;;;;;;;;;;;;;;;;;;;;;;;;MAwBAA;;;;;;;;;;;;MAYAA;;;;wDAIkDA;;;;uCAIjBA;;;;;;;;;;;oBAWnBA;;;;;;;;kCAQcA;;;iBAGjBA;;;;;;;;;;;;;;;MAeXA;;;;;;2BAMqBA;;;;+BAIIA;;;;;;;;;;MAUzBA;;;;MAIAA;;;;;MAKAA;iCAC2BA;;;;;;;;;;;MAW3BA;;;;;;;;AAt9B81B;AAIt0B;AAIP;AAkBbZ,cCVG,WAAA,GDUS,eAAA;;;;;AAIP;AAEW;AAKG;AAcnBK,cC1BG,cD0BkB,EAAA,MAKtBD;AAAmB;AAGJ;AAOD;AAQG;AAOE;AAKH;;;;;;AAgBJQ,cChER,eDgEQA,EAAAA,MAAAA;AAQXV,UCtEO,aAAA,CDsEPA;;;;;QAUJU,CAAAA,EC3EK,cD2ELA;;UACYA,CAAAA,EAAAA;IAIPL,OAAAA,EAAAA,MAAAA;IADLK,QAAAA,EAAAA,MAAAA;;;QAMuCH,CAAAA,EAAAA,MAAAA;;;;;;;;;;;AAqBsCG,iBC1F7D,YAAA,CD0F6DA,IAAAA,CAAAA,EC1F1C,aD0F0CA,CAAAA,EC1FrB,OD0FqBA,CC1Fb,SD0FaA,CAAAA;;;;;;;AActEX,iBC3ES,IAAA,CAAA,CD2ETA,EC3EiB,OD2EjBA,CAAAA,IAAAA,CAAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/mcp-server",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Local stdio MCP server bundled with the Alfe CLI. Auto-registered as `alfe-platform` in the bundler store; surfaces Alfe platform tools to the agent runtime via @alfe.ai/mcp-tools using AgentApiClient against public /agent/... endpoints.",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,9 +21,9 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^3.25.0",
-    "@alfe.ai/agent-api-client": "0.1.4",
-    "@alfe.ai/config": "0.0.8",
-    "@alfe.ai/mcp-tools": "0.1.0"
+    "@alfe.ai/agent-api-client": "0.2.0",
+    "@alfe.ai/config": "0.0.9",
+    "@alfe.ai/mcp-tools": "0.1.1"
   },
   "license": "UNLICENSED",
   "scripts": {