@alfe.ai/microsoft-mcp 0.1.8 → 0.1.10

package/dist/server.d.cts

@@ -1274,10 +1274,41 @@ declare class ConnectCredentialsApi extends ApiBase {
       brokerName?: string;
       accountNumber?: string;
       accessToken: string;
+      /**
+       * The stable per-grant Connection key (`ctid:<userId>`) this account
+       * belongs to. Every trading account under one cTrader login shares one
+       * grant (one OAuth token), so this is the identifier the MCP server
+       * passes to `refreshCTraderAccount()` to rotate the token for the whole
+       * grant on a `CH_ACCESS_TOKEN_INVALID` expiry. Empty string when the
+       * server did not supply one (legacy rows) — such an account can still
+       * trade with its current token but cannot self-refresh.
+       */
+      accountIdentifier: string;
     }[];
     clientId: string;
     clientSecret: string;
   }>;
+  /**
+   * Pattern A: refresh a specific cTrader grant by its stable
+   * `accountIdentifier` (`ctid:<userId>` from `getCTraderAccounts()`).
+   *
+   * cTrader access tokens live ~30 days; the `getCTraderAccounts()` /
+   * credentials reads serve the STORED token without refreshing, so refresh is
+   * the consumer's job. `@alfe.ai/ctrader-mcp` calls this when the cTrader Open
+   * API rejects an account-auth with `CH_ACCESS_TOKEN_INVALID`, then re-runs
+   * the socket handshake with the returned `accessToken`.
+   *
+   * Refreshing one grant rotates the single OAuth token that covers EVERY
+   * trading account under that login. cTrader's refresh token itself does not
+   * expire but may rotate on refresh (`rotatesRefreshToken: true`); connect
+   * persists the rotated refresh token server-side, so the caller only needs
+   * the new `accessToken`. Mirrors `refreshXeroAccountToken`.
+   */
+  refreshCTraderAccount(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
   /**
    * @deprecated Returns a single primary credential blob. Use
    * `getShopifyAccounts()` for the multi-account shape required by Pattern A
@@ -1576,7 +1607,9 @@ declare class IntegrationsApi extends ApiBase {
     config?: Record<string, unknown>;
   }): Promise<IntegrationInstall>;
   removeIntegration(integrationId: string): Promise<IntegrationInstall>;
-  getOAuthUrl(provider: string, scopes?: string[]): Promise<{
+  getOAuthUrl(provider: string, scopes?: string[], options?: {
+    shop?: string;
+  }): Promise<{
     url: string;
     provider: string;
     expiresIn: number;

package/dist/server.d.ts

@@ -1274,10 +1274,41 @@ declare class ConnectCredentialsApi extends ApiBase {
       brokerName?: string;
       accountNumber?: string;
       accessToken: string;
+      /**
+       * The stable per-grant Connection key (`ctid:<userId>`) this account
+       * belongs to. Every trading account under one cTrader login shares one
+       * grant (one OAuth token), so this is the identifier the MCP server
+       * passes to `refreshCTraderAccount()` to rotate the token for the whole
+       * grant on a `CH_ACCESS_TOKEN_INVALID` expiry. Empty string when the
+       * server did not supply one (legacy rows) — such an account can still
+       * trade with its current token but cannot self-refresh.
+       */
+      accountIdentifier: string;
     }[];
     clientId: string;
     clientSecret: string;
   }>;
+  /**
+   * Pattern A: refresh a specific cTrader grant by its stable
+   * `accountIdentifier` (`ctid:<userId>` from `getCTraderAccounts()`).
+   *
+   * cTrader access tokens live ~30 days; the `getCTraderAccounts()` /
+   * credentials reads serve the STORED token without refreshing, so refresh is
+   * the consumer's job. `@alfe.ai/ctrader-mcp` calls this when the cTrader Open
+   * API rejects an account-auth with `CH_ACCESS_TOKEN_INVALID`, then re-runs
+   * the socket handshake with the returned `accessToken`.
+   *
+   * Refreshing one grant rotates the single OAuth token that covers EVERY
+   * trading account under that login. cTrader's refresh token itself does not
+   * expire but may rotate on refresh (`rotatesRefreshToken: true`); connect
+   * persists the rotated refresh token server-side, so the caller only needs
+   * the new `accessToken`. Mirrors `refreshXeroAccountToken`.
+   */
+  refreshCTraderAccount(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
   /**
    * @deprecated Returns a single primary credential blob. Use
    * `getShopifyAccounts()` for the multi-account shape required by Pattern A
@@ -1576,7 +1607,9 @@ declare class IntegrationsApi extends ApiBase {
     config?: Record<string, unknown>;
   }): Promise<IntegrationInstall>;
   removeIntegration(integrationId: string): Promise<IntegrationInstall>;
-  getOAuthUrl(provider: string, scopes?: string[]): Promise<{
+  getOAuthUrl(provider: string, scopes?: string[], options?: {
+    shop?: string;
+  }): Promise<{
     url: string;
     provider: string;
     expiresIn: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/microsoft-mcp",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Microsoft 365 MCP server — multi-account Microsoft Graph access using Alfe OAuth credentials with server-mediated token refresh",
   "type": "module",
   "main": "./dist/server.js",
@@ -22,7 +22,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^4.0.5",
     "@alfe.ai/config": "0.4.1",
-    "@alfe.ai/agent-api-client": "0.15.0"
+    "@alfe.ai/agent-api-client": "0.16.1"
   },
   "license": "UNLICENSED",
   "homepage": "https://alfe.ai",