@integrity-labs/agt-cli 0.28.1040 → 0.28.1042

package/dist/{chunk-UB2HLH5P.js → chunk-TXRZFABA.js}

@@ -11260,10 +11260,45 @@ var OAUTH_PROVIDERS = {
       // bill at creation time. Read-only would force a follow-up manual
       // upload in Xero; write closes the loop.
       "accounting.attachments",
-      // accounting.transactions.read → granular read-only replacements
-      // for the surfaces we don't yet need write access on.
-      "accounting.payments.read",
-      "accounting.banktransactions.read",
+      // payments: write (CS-1845) enables `xero.payment.create`, which does
+      // PUT /Payments. These two were `.read` only, described as "surfaces we
+      // don't yet need write access on" — but the xero-broker had ALREADY
+      // registered write verbs against both, so the claim was false when it was
+      // written and the verbs could never succeed. A live approval of AUD
+      // 57,748.35 against INV-0407 was approved by a human and then failed with
+      // Xero `401 {Title: Unauthorized, Detail: AuthorizationUnsuccessful}`,
+      // AFTER the handler's single 401 refresh-retry — which is what rules out
+      // an expired token: a freshly refreshed token still 401s when the GRANT
+      // never carried the scope.
+      //
+      // banktransactions: write for the same reason — `xero.bank_transaction.delete`
+      // is registered and would have failed identically the first time anyone
+      // approved one. It is a DESTRUCTIVE verb, so it was one approval away from
+      // being the more alarming report.
+      //
+      // The variant without `.read` is the read+write granular scope, so the
+      // `.read` entries are gone from THIS list.
+      //
+      // That is not the same as "consent asks for them once" (Obi Wan
+      // `167f3932fcdf` on #6564 corrected an earlier version of this comment,
+      // which claimed it was). The authorize route unions `defaultScopes` with
+      // `listAgentRequiredOAuthScopes` (lib/agent-oauth-scope-deficit.ts, called
+      // from routes/integrations-oauth.ts), and the catalog's `xero:read` defined
+      // scope still lists `accounting.payments.read` and
+      // `accounting.banktransactions.read` in its `oauth_scopes` — so an agent
+      // with xero:read installed requests the `.read` variants alongside these.
+      // Harmless, because write implies read, but do not write comments here that
+      // describe the consent string as though this array were all of it.
+      //
+      // DO NOT substitute the broad `accounting.transactions`: Xero rejects the
+      // manifest for apps created after 2026-03-02 (see the note above).
+      //
+      // RECONNECT REQUIRED, same as `accounting.manualjournals` below: the broker
+      // posts with the agent's own OAuth access_token, so every existing install
+      // keeps failing until it reconnects and re-consents. Shipping this scope is
+      // necessary and NOT sufficient.
+      "accounting.payments",
+      "accounting.banktransactions",
       // manualjournals: write (CS-1439) enables the xero-broker to post
       // manual journals (reclasses, accruals, corrections) on approval. The
       // variant without `.read` is the read+write granular scope. Note: an
@@ -15648,4 +15683,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-UB2HLH5P.js.map
+//# sourceMappingURL=chunk-TXRZFABA.js.map