@alfe.ai/openclaw-sync 0.3.6 → 0.3.7

package/dist/index.d.cts

@@ -142,26 +142,32 @@ declare class AgentApiTransport {
    * `Content-Type: application/json` and parses a `{ data: T }` envelope,
    * neither of which fits a raw-audio flow (voice TTS/STT), so those go
    * through this instead. Auth (Bearer), the request budget, and the single
-   * retry on transient 5xx / network errors are kept in sync with
-   * `request()`. Retries fire only on statuses produced BEFORE the route
-   * handler runs (authorizer-timeout 500 + LB 502/503/504), so re-issuing a
-   * POST does not risk a duplicate side effect.
+   * retry policy on transient 5xx / network errors is kept in sync with
+   * `request()`. Safe read methods retry once by default; mutation methods do
+   * not, because a response can be lost after a handler or provider call has
+   * already succeeded.
    */
   rawRequest(path: string, init: {
     method: string;
     headers: Headers;
     body?: BodyInit | Uint8Array;
+  }, extra?: {
+    retry?: boolean;
   }): Promise<Response>;
   /**
    * @param extra.timeoutMs Per-request abort timeout (default REQUEST_TIMEOUT_MS).
    *   Long endpoints (image generation) pass a larger value so the gateway's
    *   own timeout wins with a readable status instead of a client-side abort.
-   * @param extra.retry Whether to retry once on transient failures (default
-   *   true). Expensive/non-idempotent endpoints pass false.
+   * @param extra.retry Whether to retry once on transient failures. Safe reads
+   *   (GET/HEAD/OPTIONS) default to true; mutations default to false. Set true
+   *   only when the endpoint's server-side contract is explicitly idempotent.
+   * @param extra.signal Optional caller cancellation combined with the client's
+   *   own timeout budget. Aborting either signal cancels the request.
    */
   request<T>(path: string, options?: RequestInit, extra?: {
     timeoutMs?: number;
     retry?: boolean;
+    signal?: AbortSignal;
   }): Promise<T>;
 }
 /**
@@ -177,7 +183,7 @@ declare class ApiBase {
 //# sourceMappingURL=transport.d.ts.map
 //#endregion
 //#region src/domains/workspace.d.ts
-/** Response of GET /agents/me/workspace (services/agents). */
+/** Response of GET /agent/workspace (services/agents). */
 interface AgentWorkspaceInfo {
   templateKey?: string;
   defaultModel?: string;
@@ -205,7 +211,7 @@ interface AgentWorkspaceInfo {
 }
 declare class WorkspaceApi extends ApiBase {
   /**
-   * GET /agents/me/workspace — workspace config for the authenticated agent
+   * GET /agent/workspace — workspace config for the authenticated agent
    * (template assignment, default model, org roster).
    */
   getWorkspace(): Promise<AgentWorkspaceInfo>;
@@ -348,6 +354,8 @@ declare class SyncApi extends ApiBase {
   sharedListFiles(args: {
     scope: "org" | "team" | "project";
     scopeId: string;
+    limit?: number;
+    cursor?: string;
   }): Promise<{
     files: SharedFileEntry[];
     nextCursor: string | null;
@@ -507,7 +515,9 @@ declare class KnowledgeApi extends ApiBase {
    * from `services/org`, then fetches the bytes directly from S3 (the one
    * legitimate raw fetch in a plugin — same pattern as sync).
    */
-  readScopeDoc(scopeType: KnowledgeScopeType, scopeId: string, filePath: string): Promise<{
+  readScopeDoc(scopeType: KnowledgeScopeType, scopeId: string, filePath: string, opts?: {
+    maxBytes?: number;
+  }): Promise<{
     filePath: string;
     text: string;
   }>;
@@ -546,15 +556,11 @@ interface MobileAvailableNumber {
 }
 /** Approved WhatsApp content template from GET /mobile/whatsapp/templates. */
 interface WhatsAppTemplate {
-  sid: string;
-  friendlyName: string;
+  contentSid: string;
+  name: string;
   language: string;
   body: string;
   variables: Record<string, string>;
-  dateCreated: string;
-  dateUpdated: string;
-  approvalStatus?: string;
-  rejectionReason?: string;
   category?: string;
 }
 declare class MobileApi extends ApiBase {
@@ -802,15 +808,22 @@ declare class SearchApi extends ApiBase {
     offset?: number;
     country?: string;
     freshness?: string;
+  }, options?: {
+    signal?: AbortSignal;
   }): Promise<unknown>;
   searchImages(params: {
     query: string;
     count?: number;
+  }, options?: {
+    signal?: AbortSignal;
   }): Promise<unknown>;
   searchNews(params: {
     query: string;
     count?: number;
+    offset?: number;
     freshness?: string;
+  }, options?: {
+    signal?: AbortSignal;
   }): Promise<unknown>;
   /** Search news across the selected provider's corpus. → POST /agent/news/search */
   newsSearch(params: {
@@ -834,6 +847,48 @@ declare class SearchApi extends ApiBase {
 }
 //# sourceMappingURL=search.d.ts.map
 //#endregion
+//#region src/domains/webhooks.d.ts
+interface AgentWebhook {
+  webhookId: string;
+  tenantId: string;
+  agentId: string;
+  name: string;
+  provider: string;
+  active: boolean;
+  createdBy: string;
+  createdAt: string;
+  updatedAt: string;
+}
+interface CreatedAgentWebhook extends AgentWebhook {
+  url: string;
+  signingSecret: string;
+}
+interface AgentWebhookDelivery {
+  deliveryId: string;
+  webhookId: string;
+  status: string;
+  attempts: number;
+  createdAt: string;
+  deliveredAt?: string;
+}
+declare class WebhooksApi extends ApiBase {
+  createWebhook(args: {
+    name: string;
+    provider?: "generic" | "github" | "stripe" | "slack";
+  }): Promise<CreatedAgentWebhook>;
+  listWebhooks(): Promise<AgentWebhook[]>;
+  deleteWebhook(webhookId: string): Promise<{
+    webhookId: string;
+    active: false;
+  }>;
+  rotateWebhookSecret(webhookId: string): Promise<{
+    webhookId: string;
+    signingSecret: string;
+  }>;
+  listWebhookDeliveries(webhookId: string): Promise<AgentWebhookDelivery[]>;
+}
+//# sourceMappingURL=webhooks.d.ts.map
+//#endregion
 //#region src/domains/chat.d.ts
 declare class ChatApi extends ApiBase {
   presignAttachments(files: {
@@ -970,8 +1025,9 @@ declare class ConnectCredentialsApi extends ApiBase {
    * selector arg (e.g. `xeroTenantId`) on every credential-touching tool
    * and look up the matching account by that selector at dispatch time.
    *
-   * Returned `accounts[i].accountIdentifier` is the Xero tenantId — the
-   * stable cross-session identifier the LLM should pass.
+   * `xeroTenantId` is the model-facing organisation selector. The separate
+   * `accountIdentifier` is the Connect persistence key used for refresh and
+   * may be an email; never substitute one for the other.
    */
   getXeroAccounts(): Promise<{
     accounts: {
@@ -989,12 +1045,12 @@ declare class ConnectCredentialsApi extends ApiBase {
     expiresAt: string;
   }>;
   /**
-   * Pattern A: refresh a specific Xero connection by its `accountIdentifier`
-   * (the Xero `tenantId`). The legacy `refreshXeroToken()` only refreshes
-   * the *primary* connection, which is wrong for multi-tenant Xero where
-   * each tenant has its own non-interchangeable access token.
+   * Refresh a specific Xero Connection by its exact `accountIdentifier` from
+   * `getXeroAccounts()`. Do not substitute `xeroTenantId`: current Xero OAuth
+   * rows may use the account email as their persistence key even when a sole
+   * organisation tenant ID is available in provider metadata.
    */
-  refreshXeroAccountToken(xeroTenantId: string): Promise<{
+  refreshXeroAccountToken(accountIdentifier: string): Promise<{
     accessToken: string;
     accessTokenExpiresAt: string;
     expiresAt: string;
@@ -1149,6 +1205,21 @@ declare class ConnectCredentialsApi extends ApiBase {
     accessToken: string;
     expiresAt: string;
   }>;
+  /**
+   * Pattern A: refresh one MYOB Connection by its stable
+   * `accountIdentifier` (the MYOB business id returned by
+   * `getMYOBAccounts()`).
+   *
+   * MYOB refresh tokens belong to individual Connection rows. A
+   * multi-business client must use this method instead of refreshing the
+   * primary Connection and copying that access token into every cached
+   * business client.
+   */
+  refreshMYOBAccountToken(accountIdentifier: string): Promise<{
+    accessToken: string;
+    accessTokenExpiresAt: string;
+    expiresAt: string;
+  }>;
   /**
    * @deprecated Returns a single primary credential blob. Use
    * `getSalesforceAccounts()` for the multi-account shape required by
@@ -1211,9 +1282,6 @@ declare class ConnectCredentialsApi extends ApiBase {
       connectedAt: string;
       accessToken: string;
       accessTokenExpiresAt: string;
-      refreshToken: string;
-      clientId: string;
-      clientSecret: string;
       email: string;
       microsoftTenantId: string;
       workspaceDomain: string;
@@ -1487,59 +1555,35 @@ declare class IdentityApi extends ApiBase {
   }>;
   mergeIdentities(survivorId: string, args: {
     mergedId: string;
-    changedBy: {
-      type: string;
-      id: string;
-      name?: string;
-    };
   }): Promise<{
     ok: boolean;
     error?: string;
   }>;
-  unmergeIdentity(identityId: string, args: {
-    changedBy: {
-      type: string;
-      id: string;
-      name?: string;
-    };
-  }): Promise<{
+  unmergeIdentity(identityId: string): Promise<{
     ok: boolean;
     error?: string;
   }>;
   addIdentityNote(identityId: string, args: {
     content: string;
     category?: string;
-    changedBy: {
-      type: string;
-      id: string;
-      name?: string;
-    };
   }): Promise<{
     noteId: string | null;
   }>;
   tagIdentity(identityId: string, args: {
     tag: string;
     action: "add" | "remove";
-    changedBy: {
-      type: string;
-      id: string;
-      name?: string;
-    };
   }): Promise<{
     ok: boolean;
   }>;
   getIdentityChangelog(identityId: string, args?: {
     limit?: number;
+    cursor?: string;
   }): Promise<{
     entries: unknown[];
+    cursor: string | null;
   }>;
   rollbackIdentity(identityId: string, args: {
     targetVersion: number;
-    changedBy: {
-      type: string;
-      id: string;
-      name?: string;
-    };
   }): Promise<{
     ok: boolean;
     entry?: unknown;
@@ -1578,7 +1622,7 @@ declare class IdentityApi extends ApiBase {
     verified: boolean;
     identityId?: string;
     /** Phase 2: how the confirm resolved — Scenario A vs B. */
-    action?: "merged" | "contact_verified";
+    action?: "merged" | "contact_verified" | "already_confirmed";
     error?: string;
   }>;
   /**
@@ -1710,8 +1754,21 @@ declare class MemoryApi extends ApiBase {
     messageCount: number;
   }>;
   memoryLoadContext(tier?: number, topicHint?: string): Promise<{
+    tier: number;
+    facts: {
+      subject: string;
+      predicate: string;
+      object: string;
+      since: string;
+    }[];
+    memories: {
+      text: string;
+      topic: string;
+      subtopic: string;
+      score: number;
+    }[];
+    tokenEstimate: number;
     formatted: string;
-    [key: string]: unknown;
   }>;
   memoryLookupEntity(subject: string): Promise<{
     subject: string;
@@ -1943,7 +2000,7 @@ declare class TeamsApi extends ApiBase {
 
 //#endregion
 //#region src/index.d.ts
-interface AgentApiClient extends SyncApi, IntegrationsApi, WorkspaceApi, ConnectCredentialsApi, TeamsApi, ChatApi, SecretsApi, IdentityApi, MemoryApi, SearchApi, KnowledgeApi, DatabaseApi, MobileApi, RemoteApi, SelfApi, VoiceApi, ImagesApi {}
+interface AgentApiClient extends SyncApi, IntegrationsApi, WorkspaceApi, ConnectCredentialsApi, TeamsApi, ChatApi, SecretsApi, IdentityApi, MemoryApi, SearchApi, KnowledgeApi, DatabaseApi, MobileApi, RemoteApi, SelfApi, VoiceApi, ImagesApi, WebhooksApi {}
 declare class AgentApiClient extends ApiBase {
   constructor(config: AgentApiClientConfig);
 }
@@ -2187,6 +2244,25 @@ interface RetryOptions {
 declare function withRetry<T>(fn: () => Promise<T>, options?: RetryOptions): Promise<T>;
 //# sourceMappingURL=retry.d.ts.map
 //#endregion
+//#region src/path-contract.d.ts
+/**
+ * Canonical path contract for the private workspace sync data plane.
+ *
+ * Paths received from manifests, relays, CLI arguments, and watcher events
+ * are identifiers relative to the configured workspace. Keep validation in
+ * one place so a malformed remote path can never become an arbitrary local
+ * read, write, or delete.
+ */
+declare function validatePrivateRelativePath(relativePath: string): string;
+declare function resolvePrivateWorkspacePath(workspacePath: string, relativePath: string): string;
+/**
+ * Reject an existing symlink in any path component. Lexical containment alone
+ * is insufficient: `workspace/link/file` can escape when `link` points out of
+ * the workspace. This check covers reads, writes, and parent-directory walks.
+ */
+declare function assertNoSymlinkTraversal(workspacePath: string, relativePath: string): Promise<string>;
+//# sourceMappingURL=path-contract.d.ts.map
+//#endregion
 //#region src/shared-sync.d.ts
 interface SharedScope {
   scopeType: "team" | "project" | "org";
@@ -2212,5 +2288,5 @@ interface SharedSyncEngine {
 }
 declare function createSharedSyncEngine(config: SharedSyncConfig, log: PluginLogger): SharedSyncEngine;
 //#endregion
-export { DEFAULT_IGNORES, type DownloadResult, type IgnoreRules, type LocalManifest, type ManifestDiff, type ManifestEntry, type RemoteManifest, type RetryOptions, type SharedScope, type SharedSyncConfig, type SharedSyncEngine, type SyncEngine, type SyncPluginConfig, type SyncResult, type UploadResult, type WatcherOptions, computeFileHash, createSharedSyncEngine, createSyncEngine, diffManifests, downloadFiles, filterIgnored, loadIgnorePatterns, plugin, readManifest, removeManifestEntry, shouldIgnore, shouldIgnoreDir, startWatcher, updateManifestEntry, uploadFiles, withRetry, writeManifest };
+export { DEFAULT_IGNORES, type DownloadResult, type IgnoreRules, type LocalManifest, type ManifestDiff, type ManifestEntry, type RemoteManifest, type RetryOptions, type SharedScope, type SharedSyncConfig, type SharedSyncEngine, type SyncEngine, type SyncPluginConfig, type SyncResult, type UploadResult, type WatcherOptions, assertNoSymlinkTraversal, computeFileHash, createSharedSyncEngine, createSyncEngine, diffManifests, downloadFiles, filterIgnored, loadIgnorePatterns, plugin, readManifest, removeManifestEntry, resolvePrivateWorkspacePath, shouldIgnore, shouldIgnoreDir, startWatcher, updateManifestEntry, uploadFiles, validatePrivateRelativePath, withRetry, writeManifest };
 //# sourceMappingURL=index.d.cts.map