@alfe.ai/microsoft-mcp 0.1.11 → 0.1.13

package/dist/server.d.cts

@@ -1,5 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { ChangelogEntry, EncryptedEnvelopeV1, FieldEnvelope, FieldFormat, FieldSensitivity, GeneratedDataKey, IntegrationConfigResult, IntegrationInstall, RegistryEntry, ScopeInfo, SecretAggregate, SecretCategory, SecretMetadata, SecretScope } from "@alfe/types";
+import { ChangelogEntry, EncryptedEnvelopeV1, FieldEnvelope, FieldFormat, FieldSensitivity, GeneratedDataKey, IntegrationActivationSource, IntegrationActualStatus, IntegrationConfigResult, IntegrationDesiredStatus, IntegrationInstall, IntegrationScope, RegistryEntry, ScopeInfo, SecretAggregate, SecretCategory, SecretMetadata, SecretScope } from "@alfe/types";
 
 //#region ../agent-api-client/dist/index.d.ts
 
@@ -69,6 +69,69 @@ declare class ApiBase {
 }
 //# sourceMappingURL=transport.d.ts.map
 //#endregion
+//#region src/domains/integrations.d.ts
+/**
+ * One entry in the agent's EFFECTIVE integration list. Agent-scope install
+ * rows keep their full public row shape (config included, `scope: "agent"`);
+ * connection-/channel-/custom-driven activations and inherited
+ * org/team/project installs have no agent-scope row and appear as the
+ * narrower projection. Discriminate on `config`: only the agent-scope row
+ * arm carries it (`source` alone is NOT a discriminator — inherited explicit
+ * rows land in the narrow arm with `source: "explicit"` too).
+ */
+type AgentIntegrationListEntry = (IntegrationInstall & {
+  source: "explicit";
+}) | {
+  integrationId: string;
+  version: string;
+  desiredStatus: IntegrationDesiredStatus;
+  actualStatus: IntegrationActualStatus;
+  source: IntegrationActivationSource;
+  /** Winning row's scope — present only on inherited explicit entries. */
+  scope?: IntegrationScope;
+  scopeId?: string;
+  config?: undefined;
+  connectionId?: string;
+  channelId?: string;
+  displayName?: string;
+  icon?: string;
+  availableVersion?: string;
+  reinstallRequestedAt?: string;
+};
+declare class IntegrationsApi extends ApiBase {
+  /**
+   * List the integrations EFFECTIVE for this agent — explicit agent-scope
+   * installs plus driven activations (google, myob, xero, google-chat, …)
+   * and inherited org-scope installs, discriminated by `source`.
+   */
+  listIntegrations(): Promise<{
+    integrations: AgentIntegrationListEntry[];
+  }>;
+  getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult>;
+  updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;
+  installIntegration(integrationId: string, options?: {
+    version?: string;
+    config?: Record<string, unknown>;
+  }): Promise<IntegrationInstall>;
+  removeIntegration(integrationId: string): Promise<IntegrationInstall>;
+  getOAuthUrl(provider: string, scopes?: string[], options?: {
+    shop?: string;
+  }): Promise<{
+    url: string;
+    provider: string;
+    expiresIn: number;
+  }>;
+  getOAuthStatus(provider: string): Promise<{
+    provider: string;
+    connected: boolean;
+    config?: Record<string, string>;
+  }>;
+  getRegistry(): Promise<{
+    integrations: RegistryEntry[];
+  }>;
+}
+//# sourceMappingURL=integrations.d.ts.map
+//#endregion
 //#region src/domains/workspace.d.ts
 /** Response of GET /agent/workspace (services/agents). */
 interface AgentWorkspaceInfo {
@@ -667,6 +730,168 @@ declare class VoiceApi extends ApiBase {
 }
 //# sourceMappingURL=voice.d.ts.map
 //#endregion
+//#region src/domains/identity.d.ts
+type IdentityStatus = "anonymous" | "partial" | "identified" | "verified";
+interface IdentityDirectoryEntry {
+  identityId: string;
+  status: IdentityStatus;
+  displayName: string;
+  name?: string;
+  avatarUrl?: string;
+  lastSeenAt: string;
+  lastSeenProvider?: string;
+  messageable: boolean;
+}
+declare class IdentityApi extends ApiBase {
+  /**
+   * Returns the calling agent's own identity context — `{ agentId, tenantId }`
+   * decoded server-side from the agent API token. Used by the
+   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the
+   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.
+   * Plugins should cache this for the daemon's lifetime (single-agent-per-
+   * process invariant). One HTTP round-trip per process activate; not for
+   * per-call use.
+   */
+  whoami(): Promise<{
+    agentId: string;
+    tenantId: string;
+  }>;
+  resolveIdentity(args: {
+    provider: string;
+    platformId: string;
+    kind?: "user" | "agent" | "service" | "bot" | "workspace";
+    displayName?: string;
+  }): Promise<{
+    identityId: string | null;
+    status: string;
+    created?: boolean;
+    reason?: string;
+    /**
+     * Flattened auriclabs permission strings for the resolved identity
+     * (scope-prefixed where applicable). Empty array on miss / org service
+     * outage — the runtime gate fails closed in that case.
+     */
+    permissions: string[];
+  }>;
+  searchIdentities(args?: {
+    q?: string;
+    status?: string;
+    limit?: number;
+  }): Promise<{
+    identities: unknown[];
+  }>;
+  listIdentities(args?: {
+    status?: IdentityStatus;
+    limit?: number;
+    cursor?: string;
+  }): Promise<{
+    identities: IdentityDirectoryEntry[];
+    cursor: string | null;
+  }>;
+  getIdentityContext(identityId: string): Promise<{
+    context: unknown;
+  }>;
+  mergeIdentities(survivorId: string, args: {
+    mergedId: string;
+  }): Promise<{
+    ok: boolean;
+    error?: string;
+  }>;
+  unmergeIdentity(identityId: string): Promise<{
+    ok: boolean;
+    error?: string;
+  }>;
+  addIdentityNote(identityId: string, args: {
+    content: string;
+    category?: string;
+  }): Promise<{
+    noteId: string | null;
+  }>;
+  tagIdentity(identityId: string, args: {
+    tag: string;
+    action: "add" | "remove";
+  }): Promise<{
+    ok: boolean;
+  }>;
+  getIdentityChangelog(identityId: string, args?: {
+    limit?: number;
+    cursor?: string;
+  }): Promise<{
+    entries: unknown[];
+    cursor: string | null;
+  }>;
+  rollbackIdentity(identityId: string, args: {
+    targetVersion: number;
+  }): Promise<{
+    ok: boolean;
+    entry?: unknown;
+  }>;
+  requestIdentityVerification(args: {
+    claimedIdentityId: string;
+    requestingIdentityId: string;
+    requestingProvider: string;
+    requestingPlatformId: string;
+    preferredChannel?: "mobile" | "email";
+    /**
+     * Phase 2: agent-supplied contact endpoint. When provided, the top-level
+     * `preferredChannel` is ignored — the contact's channel wins.
+     */
+    contact?: {
+      channel: "email" | "mobile";
+      value: string;
+    };
+  }): Promise<{
+    verificationId: string;
+    channel: string;
+    deliveredTo: string;
+    expiresAt: string;
+    availableChannels: {
+      channel: string;
+      deliveredTo: string;
+    }[];
+  } | {
+    error: string;
+  }>;
+  confirmIdentityVerification(args: {
+    claimedIdentityId: string;
+    verificationId: string;
+    phrase: string;
+  }): Promise<{
+    verified: boolean;
+    identityId?: string;
+    /** Phase 2: how the confirm resolved — Scenario A vs B. */
+    action?: "merged" | "contact_verified" | "already_confirmed";
+    error?: string;
+  }>;
+  /**
+   * Update display-shape fields on an Identity. Body excludes `email` /
+   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
+   * via the verify flow, title/company live on OrgMembership, metadata is
+   * not agent-writable.
+   */
+  updateIdentity(identityId: string, args: {
+    name?: string;
+    avatarUrl?: string;
+    timezone?: string;
+    locale?: string;
+  }): Promise<{
+    ok: boolean;
+  }>;
+  /**
+   * Phase 2 (Section H): server-side verification of a Google Chat sender via
+   * the agent's existing Google OAuth credentials. Returns the resolved
+   * identity (created or matched via Scenario-B email enrichment).
+   */
+  resolveGoogleChatSender(args: {
+    senderUserId: string;
+    spaceId?: string;
+  }): Promise<{
+    identityId: string | null;
+    status: string;
+  }>;
+}
+//# sourceMappingURL=identity.d.ts.map
+//#endregion
 //#region src/domains/search.d.ts
 /**
  * The broad-news providers behind the metered `services/news` Lambda. The
@@ -778,6 +1003,14 @@ declare class WebhooksApi extends ApiBase {
 //#endregion
 //#region src/domains/chat.d.ts
 declare class ChatApi extends ApiBase {
+  ensureDirectConversation(identityId: string): Promise<{
+    conversationId: string;
+    identityId: string;
+    tenantId: string;
+    userId: string;
+    displayName: string;
+    created: boolean;
+  }>;
   presignAttachments(files: {
     filename: string;
     mimeType: string;
@@ -1430,149 +1663,6 @@ declare class DatabaseApi extends ApiBase {
 }
 //# sourceMappingURL=database.d.ts.map
 //#endregion
-//#region src/domains/identity.d.ts
-declare class IdentityApi extends ApiBase {
-  /**
-   * Returns the calling agent's own identity context — `{ agentId, tenantId }`
-   * decoded server-side from the agent API token. Used by the
-   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the
-   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.
-   * Plugins should cache this for the daemon's lifetime (single-agent-per-
-   * process invariant). One HTTP round-trip per process activate; not for
-   * per-call use.
-   */
-  whoami(): Promise<{
-    agentId: string;
-    tenantId: string;
-  }>;
-  resolveIdentity(args: {
-    provider: string;
-    platformId: string;
-    kind?: "user" | "agent" | "service" | "bot" | "workspace";
-    displayName?: string;
-  }): Promise<{
-    identityId: string | null;
-    status: string;
-    created?: boolean;
-    reason?: string;
-    /**
-     * Flattened auriclabs permission strings for the resolved identity
-     * (scope-prefixed where applicable). Empty array on miss / org service
-     * outage — the runtime gate fails closed in that case.
-     */
-    permissions: string[];
-  }>;
-  searchIdentities(args?: {
-    q?: string;
-    status?: string;
-    limit?: number;
-  }): Promise<{
-    identities: unknown[];
-  }>;
-  getIdentityContext(identityId: string): Promise<{
-    context: unknown;
-  }>;
-  mergeIdentities(survivorId: string, args: {
-    mergedId: string;
-  }): Promise<{
-    ok: boolean;
-    error?: string;
-  }>;
-  unmergeIdentity(identityId: string): Promise<{
-    ok: boolean;
-    error?: string;
-  }>;
-  addIdentityNote(identityId: string, args: {
-    content: string;
-    category?: string;
-  }): Promise<{
-    noteId: string | null;
-  }>;
-  tagIdentity(identityId: string, args: {
-    tag: string;
-    action: "add" | "remove";
-  }): Promise<{
-    ok: boolean;
-  }>;
-  getIdentityChangelog(identityId: string, args?: {
-    limit?: number;
-    cursor?: string;
-  }): Promise<{
-    entries: unknown[];
-    cursor: string | null;
-  }>;
-  rollbackIdentity(identityId: string, args: {
-    targetVersion: number;
-  }): Promise<{
-    ok: boolean;
-    entry?: unknown;
-  }>;
-  requestIdentityVerification(args: {
-    claimedIdentityId: string;
-    requestingIdentityId: string;
-    requestingProvider: string;
-    requestingPlatformId: string;
-    preferredChannel?: "mobile" | "email";
-    /**
-     * Phase 2: agent-supplied contact endpoint. When provided, the top-level
-     * `preferredChannel` is ignored — the contact's channel wins.
-     */
-    contact?: {
-      channel: "email" | "mobile";
-      value: string;
-    };
-  }): Promise<{
-    verificationId: string;
-    channel: string;
-    deliveredTo: string;
-    expiresAt: string;
-    availableChannels: {
-      channel: string;
-      deliveredTo: string;
-    }[];
-  } | {
-    error: string;
-  }>;
-  confirmIdentityVerification(args: {
-    claimedIdentityId: string;
-    verificationId: string;
-    phrase: string;
-  }): Promise<{
-    verified: boolean;
-    identityId?: string;
-    /** Phase 2: how the confirm resolved — Scenario A vs B. */
-    action?: "merged" | "contact_verified" | "already_confirmed";
-    error?: string;
-  }>;
-  /**
-   * Update display-shape fields on an Identity. Body excludes `email` /
-   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
-   * via the verify flow, title/company live on OrgMembership, metadata is
-   * not agent-writable.
-   */
-  updateIdentity(identityId: string, args: {
-    name?: string;
-    avatarUrl?: string;
-    timezone?: string;
-    locale?: string;
-  }): Promise<{
-    ok: boolean;
-  }>;
-  /**
-   * Phase 2 (Section H): server-side verification of a Google Chat sender via
-   * the agent's existing Google OAuth credentials. Returns the resolved
-   * identity (created or matched via Scenario-B email enrichment).
-   */
-  resolveGoogleChatSender(args: {
-    senderUserId: string;
-    spaceId?: string;
-  }): Promise<{
-    identityId: string | null;
-    status: string;
-  }>;
-}
-//# sourceMappingURL=identity.d.ts.map
-//#endregion
 //#region src/domains/images.d.ts
 declare class ImagesApi extends ApiBase {
   /**
@@ -1598,34 +1688,6 @@ declare class ImagesApi extends ApiBase {
 }
 //# sourceMappingURL=images.d.ts.map
 //#endregion
-//#region src/domains/integrations.d.ts
-declare class IntegrationsApi extends ApiBase {
-  listIntegrations(): Promise<IntegrationInstall[]>;
-  getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult>;
-  updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;
-  installIntegration(integrationId: string, options?: {
-    version?: string;
-    config?: Record<string, unknown>;
-  }): Promise<IntegrationInstall>;
-  removeIntegration(integrationId: string): Promise<IntegrationInstall>;
-  getOAuthUrl(provider: string, scopes?: string[], options?: {
-    shop?: string;
-  }): Promise<{
-    url: string;
-    provider: string;
-    expiresIn: number;
-  }>;
-  getOAuthStatus(provider: string): Promise<{
-    provider: string;
-    connected: boolean;
-    config?: Record<string, string>;
-  }>;
-  getRegistry(): Promise<{
-    integrations: RegistryEntry[];
-  }>;
-}
-//# sourceMappingURL=integrations.d.ts.map
-//#endregion
 //#region src/domains/memory.d.ts
 declare class MemoryApi extends ApiBase {
   memorySearch(query: string, opts?: {

package/dist/server.d.ts

@@ -1,5 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { ChangelogEntry, EncryptedEnvelopeV1, FieldEnvelope, FieldFormat, FieldSensitivity, GeneratedDataKey, IntegrationConfigResult, IntegrationInstall, RegistryEntry, ScopeInfo, SecretAggregate, SecretCategory, SecretMetadata, SecretScope } from "@alfe/types";
+import { ChangelogEntry, EncryptedEnvelopeV1, FieldEnvelope, FieldFormat, FieldSensitivity, GeneratedDataKey, IntegrationActivationSource, IntegrationActualStatus, IntegrationConfigResult, IntegrationDesiredStatus, IntegrationInstall, IntegrationScope, RegistryEntry, ScopeInfo, SecretAggregate, SecretCategory, SecretMetadata, SecretScope } from "@alfe/types";
 
 //#region ../agent-api-client/dist/index.d.ts
 
@@ -69,6 +69,69 @@ declare class ApiBase {
 }
 //# sourceMappingURL=transport.d.ts.map
 //#endregion
+//#region src/domains/integrations.d.ts
+/**
+ * One entry in the agent's EFFECTIVE integration list. Agent-scope install
+ * rows keep their full public row shape (config included, `scope: "agent"`);
+ * connection-/channel-/custom-driven activations and inherited
+ * org/team/project installs have no agent-scope row and appear as the
+ * narrower projection. Discriminate on `config`: only the agent-scope row
+ * arm carries it (`source` alone is NOT a discriminator — inherited explicit
+ * rows land in the narrow arm with `source: "explicit"` too).
+ */
+type AgentIntegrationListEntry = (IntegrationInstall & {
+  source: "explicit";
+}) | {
+  integrationId: string;
+  version: string;
+  desiredStatus: IntegrationDesiredStatus;
+  actualStatus: IntegrationActualStatus;
+  source: IntegrationActivationSource;
+  /** Winning row's scope — present only on inherited explicit entries. */
+  scope?: IntegrationScope;
+  scopeId?: string;
+  config?: undefined;
+  connectionId?: string;
+  channelId?: string;
+  displayName?: string;
+  icon?: string;
+  availableVersion?: string;
+  reinstallRequestedAt?: string;
+};
+declare class IntegrationsApi extends ApiBase {
+  /**
+   * List the integrations EFFECTIVE for this agent — explicit agent-scope
+   * installs plus driven activations (google, myob, xero, google-chat, …)
+   * and inherited org-scope installs, discriminated by `source`.
+   */
+  listIntegrations(): Promise<{
+    integrations: AgentIntegrationListEntry[];
+  }>;
+  getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult>;
+  updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;
+  installIntegration(integrationId: string, options?: {
+    version?: string;
+    config?: Record<string, unknown>;
+  }): Promise<IntegrationInstall>;
+  removeIntegration(integrationId: string): Promise<IntegrationInstall>;
+  getOAuthUrl(provider: string, scopes?: string[], options?: {
+    shop?: string;
+  }): Promise<{
+    url: string;
+    provider: string;
+    expiresIn: number;
+  }>;
+  getOAuthStatus(provider: string): Promise<{
+    provider: string;
+    connected: boolean;
+    config?: Record<string, string>;
+  }>;
+  getRegistry(): Promise<{
+    integrations: RegistryEntry[];
+  }>;
+}
+//# sourceMappingURL=integrations.d.ts.map
+//#endregion
 //#region src/domains/workspace.d.ts
 /** Response of GET /agent/workspace (services/agents). */
 interface AgentWorkspaceInfo {
@@ -667,6 +730,168 @@ declare class VoiceApi extends ApiBase {
 }
 //# sourceMappingURL=voice.d.ts.map
 //#endregion
+//#region src/domains/identity.d.ts
+type IdentityStatus = "anonymous" | "partial" | "identified" | "verified";
+interface IdentityDirectoryEntry {
+  identityId: string;
+  status: IdentityStatus;
+  displayName: string;
+  name?: string;
+  avatarUrl?: string;
+  lastSeenAt: string;
+  lastSeenProvider?: string;
+  messageable: boolean;
+}
+declare class IdentityApi extends ApiBase {
+  /**
+   * Returns the calling agent's own identity context — `{ agentId, tenantId }`
+   * decoded server-side from the agent API token. Used by the
+   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the
+   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.
+   * Plugins should cache this for the daemon's lifetime (single-agent-per-
+   * process invariant). One HTTP round-trip per process activate; not for
+   * per-call use.
+   */
+  whoami(): Promise<{
+    agentId: string;
+    tenantId: string;
+  }>;
+  resolveIdentity(args: {
+    provider: string;
+    platformId: string;
+    kind?: "user" | "agent" | "service" | "bot" | "workspace";
+    displayName?: string;
+  }): Promise<{
+    identityId: string | null;
+    status: string;
+    created?: boolean;
+    reason?: string;
+    /**
+     * Flattened auriclabs permission strings for the resolved identity
+     * (scope-prefixed where applicable). Empty array on miss / org service
+     * outage — the runtime gate fails closed in that case.
+     */
+    permissions: string[];
+  }>;
+  searchIdentities(args?: {
+    q?: string;
+    status?: string;
+    limit?: number;
+  }): Promise<{
+    identities: unknown[];
+  }>;
+  listIdentities(args?: {
+    status?: IdentityStatus;
+    limit?: number;
+    cursor?: string;
+  }): Promise<{
+    identities: IdentityDirectoryEntry[];
+    cursor: string | null;
+  }>;
+  getIdentityContext(identityId: string): Promise<{
+    context: unknown;
+  }>;
+  mergeIdentities(survivorId: string, args: {
+    mergedId: string;
+  }): Promise<{
+    ok: boolean;
+    error?: string;
+  }>;
+  unmergeIdentity(identityId: string): Promise<{
+    ok: boolean;
+    error?: string;
+  }>;
+  addIdentityNote(identityId: string, args: {
+    content: string;
+    category?: string;
+  }): Promise<{
+    noteId: string | null;
+  }>;
+  tagIdentity(identityId: string, args: {
+    tag: string;
+    action: "add" | "remove";
+  }): Promise<{
+    ok: boolean;
+  }>;
+  getIdentityChangelog(identityId: string, args?: {
+    limit?: number;
+    cursor?: string;
+  }): Promise<{
+    entries: unknown[];
+    cursor: string | null;
+  }>;
+  rollbackIdentity(identityId: string, args: {
+    targetVersion: number;
+  }): Promise<{
+    ok: boolean;
+    entry?: unknown;
+  }>;
+  requestIdentityVerification(args: {
+    claimedIdentityId: string;
+    requestingIdentityId: string;
+    requestingProvider: string;
+    requestingPlatformId: string;
+    preferredChannel?: "mobile" | "email";
+    /**
+     * Phase 2: agent-supplied contact endpoint. When provided, the top-level
+     * `preferredChannel` is ignored — the contact's channel wins.
+     */
+    contact?: {
+      channel: "email" | "mobile";
+      value: string;
+    };
+  }): Promise<{
+    verificationId: string;
+    channel: string;
+    deliveredTo: string;
+    expiresAt: string;
+    availableChannels: {
+      channel: string;
+      deliveredTo: string;
+    }[];
+  } | {
+    error: string;
+  }>;
+  confirmIdentityVerification(args: {
+    claimedIdentityId: string;
+    verificationId: string;
+    phrase: string;
+  }): Promise<{
+    verified: boolean;
+    identityId?: string;
+    /** Phase 2: how the confirm resolved — Scenario A vs B. */
+    action?: "merged" | "contact_verified" | "already_confirmed";
+    error?: string;
+  }>;
+  /**
+   * Update display-shape fields on an Identity. Body excludes `email` /
+   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
+   * via the verify flow, title/company live on OrgMembership, metadata is
+   * not agent-writable.
+   */
+  updateIdentity(identityId: string, args: {
+    name?: string;
+    avatarUrl?: string;
+    timezone?: string;
+    locale?: string;
+  }): Promise<{
+    ok: boolean;
+  }>;
+  /**
+   * Phase 2 (Section H): server-side verification of a Google Chat sender via
+   * the agent's existing Google OAuth credentials. Returns the resolved
+   * identity (created or matched via Scenario-B email enrichment).
+   */
+  resolveGoogleChatSender(args: {
+    senderUserId: string;
+    spaceId?: string;
+  }): Promise<{
+    identityId: string | null;
+    status: string;
+  }>;
+}
+//# sourceMappingURL=identity.d.ts.map
+//#endregion
 //#region src/domains/search.d.ts
 /**
  * The broad-news providers behind the metered `services/news` Lambda. The
@@ -778,6 +1003,14 @@ declare class WebhooksApi extends ApiBase {
 //#endregion
 //#region src/domains/chat.d.ts
 declare class ChatApi extends ApiBase {
+  ensureDirectConversation(identityId: string): Promise<{
+    conversationId: string;
+    identityId: string;
+    tenantId: string;
+    userId: string;
+    displayName: string;
+    created: boolean;
+  }>;
   presignAttachments(files: {
     filename: string;
     mimeType: string;
@@ -1430,149 +1663,6 @@ declare class DatabaseApi extends ApiBase {
 }
 //# sourceMappingURL=database.d.ts.map
 //#endregion
-//#region src/domains/identity.d.ts
-declare class IdentityApi extends ApiBase {
-  /**
-   * Returns the calling agent's own identity context — `{ agentId, tenantId }`
-   * decoded server-side from the agent API token. Used by the
-   * `@alfe.ai/openclaw-identity` plugin to bootstrap context when the
-   * OpenClaw daemon doesn't plumb `ctx.agentId` through to plugin hooks.
-   * Plugins should cache this for the daemon's lifetime (single-agent-per-
-   * process invariant). One HTTP round-trip per process activate; not for
-   * per-call use.
-   */
-  whoami(): Promise<{
-    agentId: string;
-    tenantId: string;
-  }>;
-  resolveIdentity(args: {
-    provider: string;
-    platformId: string;
-    kind?: "user" | "agent" | "service" | "bot" | "workspace";
-    displayName?: string;
-  }): Promise<{
-    identityId: string | null;
-    status: string;
-    created?: boolean;
-    reason?: string;
-    /**
-     * Flattened auriclabs permission strings for the resolved identity
-     * (scope-prefixed where applicable). Empty array on miss / org service
-     * outage — the runtime gate fails closed in that case.
-     */
-    permissions: string[];
-  }>;
-  searchIdentities(args?: {
-    q?: string;
-    status?: string;
-    limit?: number;
-  }): Promise<{
-    identities: unknown[];
-  }>;
-  getIdentityContext(identityId: string): Promise<{
-    context: unknown;
-  }>;
-  mergeIdentities(survivorId: string, args: {
-    mergedId: string;
-  }): Promise<{
-    ok: boolean;
-    error?: string;
-  }>;
-  unmergeIdentity(identityId: string): Promise<{
-    ok: boolean;
-    error?: string;
-  }>;
-  addIdentityNote(identityId: string, args: {
-    content: string;
-    category?: string;
-  }): Promise<{
-    noteId: string | null;
-  }>;
-  tagIdentity(identityId: string, args: {
-    tag: string;
-    action: "add" | "remove";
-  }): Promise<{
-    ok: boolean;
-  }>;
-  getIdentityChangelog(identityId: string, args?: {
-    limit?: number;
-    cursor?: string;
-  }): Promise<{
-    entries: unknown[];
-    cursor: string | null;
-  }>;
-  rollbackIdentity(identityId: string, args: {
-    targetVersion: number;
-  }): Promise<{
-    ok: boolean;
-    entry?: unknown;
-  }>;
-  requestIdentityVerification(args: {
-    claimedIdentityId: string;
-    requestingIdentityId: string;
-    requestingProvider: string;
-    requestingPlatformId: string;
-    preferredChannel?: "mobile" | "email";
-    /**
-     * Phase 2: agent-supplied contact endpoint. When provided, the top-level
-     * `preferredChannel` is ignored — the contact's channel wins.
-     */
-    contact?: {
-      channel: "email" | "mobile";
-      value: string;
-    };
-  }): Promise<{
-    verificationId: string;
-    channel: string;
-    deliveredTo: string;
-    expiresAt: string;
-    availableChannels: {
-      channel: string;
-      deliveredTo: string;
-    }[];
-  } | {
-    error: string;
-  }>;
-  confirmIdentityVerification(args: {
-    claimedIdentityId: string;
-    verificationId: string;
-    phrase: string;
-  }): Promise<{
-    verified: boolean;
-    identityId?: string;
-    /** Phase 2: how the confirm resolved — Scenario A vs B. */
-    action?: "merged" | "contact_verified" | "already_confirmed";
-    error?: string;
-  }>;
-  /**
-   * Update display-shape fields on an Identity. Body excludes `email` /
-   * `phone` / `title` / `company` / `metadata` per Section D4 — contacts go
-   * via the verify flow, title/company live on OrgMembership, metadata is
-   * not agent-writable.
-   */
-  updateIdentity(identityId: string, args: {
-    name?: string;
-    avatarUrl?: string;
-    timezone?: string;
-    locale?: string;
-  }): Promise<{
-    ok: boolean;
-  }>;
-  /**
-   * Phase 2 (Section H): server-side verification of a Google Chat sender via
-   * the agent's existing Google OAuth credentials. Returns the resolved
-   * identity (created or matched via Scenario-B email enrichment).
-   */
-  resolveGoogleChatSender(args: {
-    senderUserId: string;
-    spaceId?: string;
-  }): Promise<{
-    identityId: string | null;
-    status: string;
-  }>;
-}
-//# sourceMappingURL=identity.d.ts.map
-//#endregion
 //#region src/domains/images.d.ts
 declare class ImagesApi extends ApiBase {
   /**
@@ -1598,34 +1688,6 @@ declare class ImagesApi extends ApiBase {
 }
 //# sourceMappingURL=images.d.ts.map
 //#endregion
-//#region src/domains/integrations.d.ts
-declare class IntegrationsApi extends ApiBase {
-  listIntegrations(): Promise<IntegrationInstall[]>;
-  getIntegrationConfig(integrationId: string): Promise<IntegrationConfigResult>;
-  updateIntegrationConfig(integrationId: string, config: Record<string, unknown>): Promise<void>;
-  installIntegration(integrationId: string, options?: {
-    version?: string;
-    config?: Record<string, unknown>;
-  }): Promise<IntegrationInstall>;
-  removeIntegration(integrationId: string): Promise<IntegrationInstall>;
-  getOAuthUrl(provider: string, scopes?: string[], options?: {
-    shop?: string;
-  }): Promise<{
-    url: string;
-    provider: string;
-    expiresIn: number;
-  }>;
-  getOAuthStatus(provider: string): Promise<{
-    provider: string;
-    connected: boolean;
-    config?: Record<string, string>;
-  }>;
-  getRegistry(): Promise<{
-    integrations: RegistryEntry[];
-  }>;
-}
-//# sourceMappingURL=integrations.d.ts.map
-//#endregion
 //#region src/domains/memory.d.ts
 declare class MemoryApi extends ApiBase {
   memorySearch(query: string, opts?: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/microsoft-mcp",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Microsoft 365 MCP server — multi-account Microsoft Graph access using Alfe OAuth credentials with server-mediated token refresh",
   "type": "module",
   "main": "./dist/server.js",
@@ -22,7 +22,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^4.0.5",
     "@alfe.ai/config": "0.4.1",
-    "@alfe.ai/agent-api-client": "0.17.0"
+    "@alfe.ai/agent-api-client": "0.18.0"
   },
   "license": "UNLICENSED",
   "homepage": "https://alfe.ai",