@alfe.ai/microsoft-mcp 0.1.10 → 0.1.12

package/dist/server.d.cts

@@ -667,6 +667,168 @@ declare class VoiceApi extends ApiBase {
 }
 //# sourceMappingURL=voice.d.ts.map
 //#endregion
+//#region src/domains/identity.d.ts
+type IdentityStatus = "anonymous" | "partial" | "identified" | "verified";
+interface IdentityDirectoryEntry {
+  identityId: string;
+  status: IdentityStatus;
+  displayName: string;
+  name?: string;
+  avatarUrl?: string;
+  lastSeenAt: string;
+  lastSeenProvider?: string;
+  messageable: boolean;
+}
+declare class IdentityApi extends ApiBase {
+  /**
+   * Returns the calling agent's own identity context — `{ agentId, tenantId }`
+   * decoded server-side from the agent API token. Used by the
+   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the
+   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.
+   * Plugins should cache this for the daemon's lifetime (single-agent-per-
+   * process invariant). One HTTP round-trip per process activate; not for
+   * per-call use.
+   */
+  whoami(): Promise<{
+    agentId: string;
+    tenantId: string;
+  }>;
+  resolveIdentity(args: {
+    provider: string;
+    platformId: string;
+    kind?: "user" | "agent" | "service" | "bot" | "workspace";
+    displayName?: string;
+  }): Promise<{
+    identityId: string | null;
+    status: string;
+    created?: boolean;
+    reason?: string;
+    /**
+     * Flattened auriclabs permission strings for the resolved identity
+     * (scope-prefixed where applicable). Empty array on miss / org service
+     * outage — the runtime gate fails closed in that case.
+     */
+    permissions: string[];
+  }>;
+  searchIdentities(args?: {
+    q?: string;
+    status?: string;
+    limit?: number;
+  }): Promise<{
+    identities: unknown[];
+  }>;
+  listIdentities(args?: {
+    status?: IdentityStatus;
+    limit?: number;
+    cursor?: string;
+  }): Promise<{
+    identities: IdentityDirectoryEntry[];
+    cursor: string | null;
+  }>;
+  getIdentityContext(identityId: string): Promise<{
+    context: unknown;
+  }>;
+  mergeIdentities(survivorId: string, args: {
+    mergedId: string;
+  }): Promise<{
+    ok: boolean;
+    error?: string;
+  }>;
+  unmergeIdentity(identityId: string): Promise<{
+    ok: boolean;
+    error?: string;
+  }>;
+  addIdentityNote(identityId: string, args: {
+    content: string;
+    category?: string;
+  }): Promise<{
+    noteId: string | null;
+  }>;
+  tagIdentity(identityId: string, args: {
+    tag: string;
+    action: "add" | "remove";
+  }): Promise<{
+    ok: boolean;
+  }>;
+  getIdentityChangelog(identityId: string, args?: {
+    limit?: number;
+    cursor?: string;
+  }): Promise<{
+    entries: unknown[];
+    cursor: string | null;
+  }>;
+  rollbackIdentity(identityId: string, args: {
+    targetVersion: number;
+  }): Promise<{
+    ok: boolean;
+    entry?: unknown;
+  }>;
+  requestIdentityVerification(args: {
+    claimedIdentityId: string;
+    requestingIdentityId: string;
+    requestingProvider: string;
+    requestingPlatformId: string;
+    preferredChannel?: "mobile" | "email";
+    /**
+     * Phase 2: agent-supplied contact endpoint. When provided, the top-level
+     * `preferredChannel` is ignored — the contact's channel wins.
+     */
+    contact?: {
+      channel: "email" | "mobile";
+      value: string;
+    };
+  }): Promise<{
+    verificationId: string;
+    channel: string;
+    deliveredTo: string;
+    expiresAt: string;
+    availableChannels: {
+      channel: string;
+      deliveredTo: string;
+    }[];
+  } | {
+    error: string;
+  }>;
+  confirmIdentityVerification(args: {
+    claimedIdentityId: string;
+    verificationId: string;
+    phrase: string;
+  }): Promise<{
+    verified: boolean;
+    identityId?: string;
+    /** Phase 2: how the confirm resolved — Scenario A vs B. */
+    action?: "merged" | "contact_verified" | "already_confirmed";
+    error?: string;
+  }>;
+  /**
+   * Update display-shape fields on an Identity. Body excludes `email` /
+   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
+   * via the verify flow, title/company live on OrgMembership, metadata is
+   * not agent-writable.
+   */
+  updateIdentity(identityId: string, args: {
+    name?: string;
+    avatarUrl?: string;
+    timezone?: string;
+    locale?: string;
+  }): Promise<{
+    ok: boolean;
+  }>;
+  /**
+   * Phase 2 (Section H): server-side verification of a Google Chat sender via
+   * the agent's existing Google OAuth credentials. Returns the resolved
+   * identity (created or matched via Scenario-B email enrichment).
+   */
+  resolveGoogleChatSender(args: {
+    senderUserId: string;
+    spaceId?: string;
+  }): Promise<{
+    identityId: string | null;
+    status: string;
+  }>;
+}
+//# sourceMappingURL=identity.d.ts.map
+//#endregion
 //#region src/domains/search.d.ts
 /**
  * The broad-news providers behind the metered `services/news` Lambda. The
@@ -778,6 +940,14 @@ declare class WebhooksApi extends ApiBase {
 //#endregion
 //#region src/domains/chat.d.ts
 declare class ChatApi extends ApiBase {
+  ensureDirectConversation(identityId: string): Promise<{
+    conversationId: string;
+    identityId: string;
+    tenantId: string;
+    userId: string;
+    displayName: string;
+    created: boolean;
+  }>;
   presignAttachments(files: {
     filename: string;
     mimeType: string;
@@ -786,6 +956,7 @@ declare class ChatApi extends ApiBase {
     attachments: {
       id: string;
       uploadUrl: string;
+      uploadHeaders: Record<string, string>;
       downloadUrl: string;
       s3Key: string;
       expiresAt: string;
@@ -1429,149 +1600,6 @@ declare class DatabaseApi extends ApiBase {
 }
 //# sourceMappingURL=database.d.ts.map
 //#endregion
-//#region src/domains/identity.d.ts
-declare class IdentityApi extends ApiBase {
-  /**
-   * Returns the calling agent's own identity context — `{ agentId, tenantId }`
-   * decoded server-side from the agent API token. Used by the
-   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the
-   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.
-   * Plugins should cache this for the daemon's lifetime (single-agent-per-
-   * process invariant). One HTTP round-trip per process activate; not for
-   * per-call use.
-   */
-  whoami(): Promise<{
-    agentId: string;
-    tenantId: string;
-  }>;
-  resolveIdentity(args: {
-    provider: string;
-    platformId: string;
-    kind?: "user" | "agent" | "service" | "bot" | "workspace";
-    displayName?: string;
-  }): Promise<{
-    identityId: string | null;
-    status: string;
-    created?: boolean;
-    reason?: string;
-    /**
-     * Flattened auriclabs permission strings for the resolved identity
-     * (scope-prefixed where applicable). Empty array on miss / org service
-     * outage — the runtime gate fails closed in that case.
-     */
-    permissions: string[];
-  }>;
-  searchIdentities(args?: {
-    q?: string;
-    status?: string;
-    limit?: number;
-  }): Promise<{
-    identities: unknown[];
-  }>;
-  getIdentityContext(identityId: string): Promise<{
-    context: unknown;
-  }>;
-  mergeIdentities(survivorId: string, args: {
-    mergedId: string;
-  }): Promise<{
-    ok: boolean;
-    error?: string;
-  }>;
-  unmergeIdentity(identityId: string): Promise<{
-    ok: boolean;
-    error?: string;
-  }>;
-  addIdentityNote(identityId: string, args: {
-    content: string;
-    category?: string;
-  }): Promise<{
-    noteId: string | null;
-  }>;
-  tagIdentity(identityId: string, args: {
-    tag: string;
-    action: "add" | "remove";
-  }): Promise<{
-    ok: boolean;
-  }>;
-  getIdentityChangelog(identityId: string, args?: {
-    limit?: number;
-    cursor?: string;
-  }): Promise<{
-    entries: unknown[];
-    cursor: string | null;
-  }>;
-  rollbackIdentity(identityId: string, args: {
-    targetVersion: number;
-  }): Promise<{
-    ok: boolean;
-    entry?: unknown;
-  }>;
-  requestIdentityVerification(args: {
-    claimedIdentityId: string;
-    requestingIdentityId: string;
-    requestingProvider: string;
-    requestingPlatformId: string;
-    preferredChannel?: "mobile" | "email";
-    /**
-     * Phase 2: agent-supplied contact endpoint. When provided, the top-level
-     * `preferredChannel` is ignored — the contact's channel wins.
-     */
-    contact?: {
-      channel: "email" | "mobile";
-      value: string;
-    };
-  }): Promise<{
-    verificationId: string;
-    channel: string;
-    deliveredTo: string;
-    expiresAt: string;
-    availableChannels: {
-      channel: string;
-      deliveredTo: string;
-    }[];
-  } | {
-    error: string;
-  }>;
-  confirmIdentityVerification(args: {
-    claimedIdentityId: string;
-    verificationId: string;
-    phrase: string;
-  }): Promise<{
-    verified: boolean;
-    identityId?: string;
-    /** Phase 2: how the confirm resolved — Scenario A vs B. */
-    action?: "merged" | "contact_verified" | "already_confirmed";
-    error?: string;
-  }>;
-  /**
-   * Update display-shape fields on an Identity. Body excludes `email` /
-   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
-   * via the verify flow, title/company live on OrgMembership, metadata is
-   * not agent-writable.
-   */
-  updateIdentity(identityId: string, args: {
-    name?: string;
-    avatarUrl?: string;
-    timezone?: string;
-    locale?: string;
-  }): Promise<{
-    ok: boolean;
-  }>;
-  /**
-   * Phase 2 (Section H): server-side verification of a Google Chat sender via
-   * the agent's existing Google OAuth credentials. Returns the resolved
-   * identity (created or matched via Scenario-B email enrichment).
-   */
-  resolveGoogleChatSender(args: {
-    senderUserId: string;
-    spaceId?: string;
-  }): Promise<{
-    identityId: string | null;
-    status: string;
-  }>;
-}
-//# sourceMappingURL=identity.d.ts.map
-//#endregion
 //#region src/domains/images.d.ts
 declare class ImagesApi extends ApiBase {
   /**

package/dist/server.d.ts

@@ -667,6 +667,168 @@ declare class VoiceApi extends ApiBase {
 }
 //# sourceMappingURL=voice.d.ts.map
 //#endregion
+//#region src/domains/identity.d.ts
+type IdentityStatus = "anonymous" | "partial" | "identified" | "verified";
+interface IdentityDirectoryEntry {
+  identityId: string;
+  status: IdentityStatus;
+  displayName: string;
+  name?: string;
+  avatarUrl?: string;
+  lastSeenAt: string;
+  lastSeenProvider?: string;
+  messageable: boolean;
+}
+declare class IdentityApi extends ApiBase {
+  /**
+   * Returns the calling agent's own identity context — `{ agentId, tenantId }`
+   * decoded server-side from the agent API token. Used by the
+   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the
+   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.
+   * Plugins should cache this for the daemon's lifetime (single-agent-per-
+   * process invariant). One HTTP round-trip per process activate; not for
+   * per-call use.
+   */
+  whoami(): Promise<{
+    agentId: string;
+    tenantId: string;
+  }>;
+  resolveIdentity(args: {
+    provider: string;
+    platformId: string;
+    kind?: "user" | "agent" | "service" | "bot" | "workspace";
+    displayName?: string;
+  }): Promise<{
+    identityId: string | null;
+    status: string;
+    created?: boolean;
+    reason?: string;
+    /**
+     * Flattened auriclabs permission strings for the resolved identity
+     * (scope-prefixed where applicable). Empty array on miss / org service
+     * outage — the runtime gate fails closed in that case.
+     */
+    permissions: string[];
+  }>;
+  searchIdentities(args?: {
+    q?: string;
+    status?: string;
+    limit?: number;
+  }): Promise<{
+    identities: unknown[];
+  }>;
+  listIdentities(args?: {
+    status?: IdentityStatus;
+    limit?: number;
+    cursor?: string;
+  }): Promise<{
+    identities: IdentityDirectoryEntry[];
+    cursor: string | null;
+  }>;
+  getIdentityContext(identityId: string): Promise<{
+    context: unknown;
+  }>;
+  mergeIdentities(survivorId: string, args: {
+    mergedId: string;
+  }): Promise<{
+    ok: boolean;
+    error?: string;
+  }>;
+  unmergeIdentity(identityId: string): Promise<{
+    ok: boolean;
+    error?: string;
+  }>;
+  addIdentityNote(identityId: string, args: {
+    content: string;
+    category?: string;
+  }): Promise<{
+    noteId: string | null;
+  }>;
+  tagIdentity(identityId: string, args: {
+    tag: string;
+    action: "add" | "remove";
+  }): Promise<{
+    ok: boolean;
+  }>;
+  getIdentityChangelog(identityId: string, args?: {
+    limit?: number;
+    cursor?: string;
+  }): Promise<{
+    entries: unknown[];
+    cursor: string | null;
+  }>;
+  rollbackIdentity(identityId: string, args: {
+    targetVersion: number;
+  }): Promise<{
+    ok: boolean;
+    entry?: unknown;
+  }>;
+  requestIdentityVerification(args: {
+    claimedIdentityId: string;
+    requestingIdentityId: string;
+    requestingProvider: string;
+    requestingPlatformId: string;
+    preferredChannel?: "mobile" | "email";
+    /**
+     * Phase 2: agent-supplied contact endpoint. When provided, the top-level
+     * `preferredChannel` is ignored — the contact's channel wins.
+     */
+    contact?: {
+      channel: "email" | "mobile";
+      value: string;
+    };
+  }): Promise<{
+    verificationId: string;
+    channel: string;
+    deliveredTo: string;
+    expiresAt: string;
+    availableChannels: {
+      channel: string;
+      deliveredTo: string;
+    }[];
+  } | {
+    error: string;
+  }>;
+  confirmIdentityVerification(args: {
+    claimedIdentityId: string;
+    verificationId: string;
+    phrase: string;
+  }): Promise<{
+    verified: boolean;
+    identityId?: string;
+    /** Phase 2: how the confirm resolved — Scenario A vs B. */
+    action?: "merged" | "contact_verified" | "already_confirmed";
+    error?: string;
+  }>;
+  /**
+   * Update display-shape fields on an Identity. Body excludes `email` /
+   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
+   * via the verify flow, title/company live on OrgMembership, metadata is
+   * not agent-writable.
+   */
+  updateIdentity(identityId: string, args: {
+    name?: string;
+    avatarUrl?: string;
+    timezone?: string;
+    locale?: string;
+  }): Promise<{
+    ok: boolean;
+  }>;
+  /**
+   * Phase 2 (Section H): server-side verification of a Google Chat sender via
+   * the agent's existing Google OAuth credentials. Returns the resolved
+   * identity (created or matched via Scenario-B email enrichment).
+   */
+  resolveGoogleChatSender(args: {
+    senderUserId: string;
+    spaceId?: string;
+  }): Promise<{
+    identityId: string | null;
+    status: string;
+  }>;
+}
+//# sourceMappingURL=identity.d.ts.map
+//#endregion
 //#region src/domains/search.d.ts
 /**
  * The broad-news providers behind the metered `services/news` Lambda. The
@@ -778,6 +940,14 @@ declare class WebhooksApi extends ApiBase {
 //#endregion
 //#region src/domains/chat.d.ts
 declare class ChatApi extends ApiBase {
+  ensureDirectConversation(identityId: string): Promise<{
+    conversationId: string;
+    identityId: string;
+    tenantId: string;
+    userId: string;
+    displayName: string;
+    created: boolean;
+  }>;
   presignAttachments(files: {
     filename: string;
     mimeType: string;
@@ -786,6 +956,7 @@ declare class ChatApi extends ApiBase {
     attachments: {
       id: string;
       uploadUrl: string;
+      uploadHeaders: Record<string, string>;
       downloadUrl: string;
       s3Key: string;
       expiresAt: string;
@@ -1429,149 +1600,6 @@ declare class DatabaseApi extends ApiBase {
 }
 //# sourceMappingURL=database.d.ts.map
 //#endregion
-//#region src/domains/identity.d.ts
-declare class IdentityApi extends ApiBase {
-  /**
-   * Returns the calling agent's own identity context — `{ agentId, tenantId }`
-   * decoded server-side from the agent API token. Used by the
-   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the
-   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.
-   * Plugins should cache this for the daemon's lifetime (single-agent-per-
-   * process invariant). One HTTP round-trip per process activate; not for
-   * per-call use.
-   */
-  whoami(): Promise<{
-    agentId: string;
-    tenantId: string;
-  }>;
-  resolveIdentity(args: {
-    provider: string;
-    platformId: string;
-    kind?: "user" | "agent" | "service" | "bot" | "workspace";
-    displayName?: string;
-  }): Promise<{
-    identityId: string | null;
-    status: string;
-    created?: boolean;
-    reason?: string;
-    /**
-     * Flattened auriclabs permission strings for the resolved identity
-     * (scope-prefixed where applicable). Empty array on miss / org service
-     * outage — the runtime gate fails closed in that case.
-     */
-    permissions: string[];
-  }>;
-  searchIdentities(args?: {
-    q?: string;
-    status?: string;
-    limit?: number;
-  }): Promise<{
-    identities: unknown[];
-  }>;
-  getIdentityContext(identityId: string): Promise<{
-    context: unknown;
-  }>;
-  mergeIdentities(survivorId: string, args: {
-    mergedId: string;
-  }): Promise<{
-    ok: boolean;
-    error?: string;
-  }>;
-  unmergeIdentity(identityId: string): Promise<{
-    ok: boolean;
-    error?: string;
-  }>;
-  addIdentityNote(identityId: string, args: {
-    content: string;
-    category?: string;
-  }): Promise<{
-    noteId: string | null;
-  }>;
-  tagIdentity(identityId: string, args: {
-    tag: string;
-    action: "add" | "remove";
-  }): Promise<{
-    ok: boolean;
-  }>;
-  getIdentityChangelog(identityId: string, args?: {
-    limit?: number;
-    cursor?: string;
-  }): Promise<{
-    entries: unknown[];
-    cursor: string | null;
-  }>;
-  rollbackIdentity(identityId: string, args: {
-    targetVersion: number;
-  }): Promise<{
-    ok: boolean;
-    entry?: unknown;
-  }>;
-  requestIdentityVerification(args: {
-    claimedIdentityId: string;
-    requestingIdentityId: string;
-    requestingProvider: string;
-    requestingPlatformId: string;
-    preferredChannel?: "mobile" | "email";
-    /**
-     * Phase 2: agent-supplied contact endpoint. When provided, the top-level
-     * `preferredChannel` is ignored — the contact's channel wins.
-     */
-    contact?: {
-      channel: "email" | "mobile";
-      value: string;
-    };
-  }): Promise<{
-    verificationId: string;
-    channel: string;
-    deliveredTo: string;
-    expiresAt: string;
-    availableChannels: {
-      channel: string;
-      deliveredTo: string;
-    }[];
-  } | {
-    error: string;
-  }>;
-  confirmIdentityVerification(args: {
-    claimedIdentityId: string;
-    verificationId: string;
-    phrase: string;
-  }): Promise<{
-    verified: boolean;
-    identityId?: string;
-    /** Phase 2: how the confirm resolved — Scenario A vs B. */
-    action?: "merged" | "contact_verified" | "already_confirmed";
-    error?: string;
-  }>;
-  /**
-   * Update display-shape fields on an Identity. Body excludes `email` /
-   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
-   * via the verify flow, title/company live on OrgMembership, metadata is
-   * not agent-writable.
-   */
-  updateIdentity(identityId: string, args: {
-    name?: string;
-    avatarUrl?: string;
-    timezone?: string;
-    locale?: string;
-  }): Promise<{
-    ok: boolean;
-  }>;
-  /**
-   * Phase 2 (Section H): server-side verification of a Google Chat sender via
-   * the agent's existing Google OAuth credentials. Returns the resolved
-   * identity (created or matched via Scenario-B email enrichment).
-   */
-  resolveGoogleChatSender(args: {
-    senderUserId: string;
-    spaceId?: string;
-  }): Promise<{
-    identityId: string | null;
-    status: string;
-  }>;
-}
-//# sourceMappingURL=identity.d.ts.map
-//#endregion
 //#region src/domains/images.d.ts
 declare class ImagesApi extends ApiBase {
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/microsoft-mcp",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Microsoft 365 MCP server — multi-account Microsoft Graph access using Alfe OAuth credentials with server-mediated token refresh",
   "type": "module",
   "main": "./dist/server.js",
@@ -22,7 +22,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^4.0.5",
     "@alfe.ai/config": "0.4.1",
-    "@alfe.ai/agent-api-client": "0.16.1"
+    "@alfe.ai/agent-api-client": "0.17.1"
   },
   "license": "UNLICENSED",
   "homepage": "https://alfe.ai",