@stina/extension-api 1.6.0 → 1.7.0

package/dist/{types.tools-R0xGhiBa.d.cts → types.tools-DcFBsfRV.d.cts}

@@ -789,6 +789,8 @@ interface ExtensionContributions {
     commands?: CommandDefinition[];
     /** Prompt contributions for the system prompt */
     prompts?: PromptContribution[];
+    /** External accounts the extension works through, signed in once in Stina's settings */
+    accounts?: AccountContribution[];
     /** Storage collection declarations */
     storage?: {
         collections: {
@@ -799,6 +801,45 @@ interface ExtensionContributions {
         };
     };
 }
+/**
+ * An external account provider the host can sign in to on the user's behalf.
+ *
+ * Only Microsoft for now, and only through Microsoft Graph: mail and calendar
+ * then share one sign-in and one token, instead of an IMAP token and a Graph
+ * token that an admin has to approve separately.
+ */
+type AccountProvider = 'microsoft';
+/**
+ * What an extension needs from an account the user connects to Stina.
+ *
+ * Stina asks the provider for every scope that the enabled extensions declare,
+ * all at once, so that the user - and, at work, their administrator - approves
+ * one request instead of one per extension. Declaring a scope here is therefore
+ * also what makes it show up in that request, and in the list of what is asked
+ * for in the settings.
+ *
+ * @example
+ * ```json
+ * "accounts": [
+ *   {
+ *     "provider": "microsoft",
+ *     "scopes": ["Calendars.ReadWrite"],
+ *     "reason": { "en": "Read and book events in your calendar", "sv": "Läsa och boka i din kalender" }
+ *   }
+ * ]
+ * ```
+ */
+interface AccountContribution {
+    provider: AccountProvider;
+    /**
+     * Microsoft Graph delegated permissions, by name: `Mail.Read`,
+     * `Calendars.ReadWrite`. The host adds `offline_access` and `User.Read`
+     * itself, so they are not declared here.
+     */
+    scopes: string[];
+    /** Why the extension needs them, shown next to the scopes in the settings. */
+    reason?: LocalizedString;
+}
 /**
  * Tool settings view definition (UI schema)
  */
@@ -1770,6 +1811,69 @@ interface ExecutionContext {
      * so in its manifest and check before reaching for them.
      */
     readonly attachments?: AttachmentsAPI;
+    /**
+     * The external accounts this user has connected to Stina.
+     *
+     * Present only for an extension holding `accounts.use`, and only on a request
+     * that knows whose it is - an account belongs to somebody, like an attachment.
+     */
+    readonly accounts?: ConnectedAccountsAPI;
+}
+/**
+ * Working through an account the user signed in to in Stina's settings.
+ *
+ * The user connects a Microsoft account once, and every extension that declares
+ * Microsoft under `contributes.accounts` can use it. The extension never sees the
+ * refresh token; it asks for an access token when it needs one and gets a fresh
+ * one back, refreshed by the host when the old one has run out.
+ *
+ * One thing the host cannot narrow: Microsoft issues a Graph token carrying every
+ * permission the user has granted Stina, not only the ones this extension
+ * declared. The declaration decides whether an extension gets a token at all,
+ * and what the user is asked to approve - not what the token can do.
+ */
+interface ConnectedAccountsAPI {
+    /**
+     * The accounts this user has connected for a provider, newest first.
+     *
+     * An empty list is the normal answer for a user who has not connected one yet:
+     * the extension should point them at Stina's settings rather than start a
+     * sign-in of its own.
+     */
+    list(provider: 'microsoft'): Promise<ConnectedAccount[]>;
+    /**
+     * An access token for one of those accounts, for the scopes this extension
+     * declared.
+     *
+     * Rejects when the account is gone, when the user has not granted every
+     * declared scope yet, or when the provider has revoked the sign-in. The
+     * message says which, in words the user can act on - it is fine to show it.
+     */
+    getAccessToken(accountId: string): Promise<AccountAccessToken>;
+}
+/** An account the user has connected, as an extension sees it. */
+interface ConnectedAccount {
+    /** Stable id, to store alongside whatever the extension keeps for this account. */
+    id: string;
+    provider: 'microsoft';
+    /** The address the user signs in with. */
+    email: string;
+    displayName?: string;
+    /**
+     * Whether the user has granted every scope this extension declared. False when
+     * the extension was installed after the account was connected, and the user has
+     * yet to reconnect it in the settings.
+     */
+    hasRequiredScopes: boolean;
+    /** Set when the provider has refused the stored sign-in and it has to be redone. */
+    needsReconnect: boolean;
+}
+/** An access token, and when it stops working. */
+interface AccountAccessToken {
+    /** Bearer token for Microsoft Graph. */
+    token: string;
+    /** ISO timestamp. Ask again after this; the host refreshes. */
+    expiresAt: string;
 }
 /**
  * Reading a file that is already in a conversation.
@@ -2507,4 +2611,4 @@ interface ActionResult {
     error?: string;
 }
 
-export { type BackgroundTaskConfig as $, type ActionResult as A, type ActionsAPI as B, type ChatMessage as C, type Disposable as D, type ExtensionContributions as E, type EventsAPI as F, type GetModelsOptions as G, type HugeIconName as H, type SchedulerAPI as I, type SchedulerJobRequest as J, type SchedulerSchedule as K, type LocalizedString as L, type ModelInfo as M, type NetworkAPI as N, type UserProfile as O, type PanelDefinition as P, type ChatAPI as Q, type ChatInstructionMessage as R, type SchedulerFirePayload as S, type ToolResult as T, type UserAPI as U, type VoiceSessionOptions as V, type ConversationPresentation as W, type AttachmentsAPI as X, type AttachmentContent as Y, type LogAPI as Z, type BackgroundWorkersAPI as _, type ChatOptions as a, type WeatherWind as a$, type BackgroundTaskCallback as a0, type BackgroundTaskContext as a1, type BackgroundTaskHealth as a2, type BackgroundRestartPolicy as a3, type Query as a4, type QueryOptions as a5, type StorageAPI as a6, type SecretsAPI as a7, type StorageCollectionConfig as a8, type StorageContributions as a9, type NumberInputProps as aA, type TextAreaProps as aB, type DateTimeInputProps as aC, type SelectProps as aD, type IconPickerProps as aE, type VerticalStackProps as aF, type HorizontalStackProps as aG, type GridProps as aH, type DividerProps as aI, type IconProps as aJ, type IconButtonType as aK, type IconButtonProps as aL, type PanelAction as aM, type PanelProps as aN, type ToggleProps as aO, type CollapsibleProps as aP, type FrameVariant as aQ, type FrameProps as aR, type ListProps as aS, type PillVariant as aT, type PillProps as aU, type CheckboxProps as aV, type MarkdownProps as aW, type TextPreviewProps as aX, type ModalProps as aY, type ConditionalGroupProps as aZ, type WeatherCondition as a_, type AIProvider as aa, type ModelCapabilities as ab, type ChatImage as ac, type ChatFile as ad, type ToolCall as ae, type VoiceTransportRequest as af, type Tool as ag, type ToolAttachment as ah, type Action as ai, type ExtensionModule as aj, type AllowedCSSProperty as ak, type ExtensionComponentStyle as al, type ExtensionComponentData as am, type ExtensionComponentIterator as an, type ExtensionComponentChildren as ao, type ExtensionActionCall as ap, type ExtensionActionRef as aq, type ExtensionDataSource as ar, type ExtensionPanelDefinition as as, type HeaderProps as at, type LabelProps as au, type ClockProps as av, type ParagraphProps as aw, type ButtonProps as ax, type TextInputProps as ay, type PasswordInputProps as az, type StreamEvent as b, type WeatherNowProps as b0, type WeatherForecastStep as b1, type WeatherForecastProps as b2, type ChartKind as b3, type ChartSeries as b4, type ChartProps as b5, type StatTrend as b6, type StatTileProps as b7, type ProgressShape as b8, type ProgressColor as b9, type ProgressBarProps as ba, type KeyValueRow as bb, type KeyValueListProps as bc, type TimelineVariant as bd, type TimelineEntry as be, type TimelineProps as bf, type NoteVariant as bg, type NoteProps as bh, type CalendarEventStatus as bi, type CalendarEventProps as bj, type ExecutionContext as bk, type VoiceSessionDescriptor as c, type ToolSettingsViewDefinition as d, type ToolSettingsView as e, type ToolSettingsListView as f, type ToolSettingsListMapping as g, type ToolSettingsComponentView as h, type ToolSettingsActionDataSource as i, type StatusCardDefinition as j, type PanelView as k, type PanelComponentView as l, type PanelActionDataSource as m, type PanelUnknownView as n, type ProviderDefinition as o, type ProviderConfigView as p, type PromptContribution as q, resolveLocalizedString as r, type PromptSection as s, type ToolDefinition as t, type ToolConfirmationConfig as u, type CommandDefinition as v, type ExtensionContext as w, type SettingsAPI as x, type ProvidersAPI as y, type ToolsAPI as z };
+export { type ConnectedAccountsAPI as $, type ActionResult as A, type ProvidersAPI as B, type ChatMessage as C, type Disposable as D, type ExtensionContributions as E, type ToolsAPI as F, type GetModelsOptions as G, type HugeIconName as H, type ActionsAPI as I, type EventsAPI as J, type SchedulerAPI as K, type LocalizedString as L, type ModelInfo as M, type NetworkAPI as N, type SchedulerJobRequest as O, type PanelDefinition as P, type SchedulerSchedule as Q, type UserProfile as R, type SchedulerFirePayload as S, type ToolResult as T, type UserAPI as U, type VoiceSessionOptions as V, type ChatAPI as W, type ChatInstructionMessage as X, type ConversationPresentation as Y, type AttachmentsAPI as Z, type AttachmentContent as _, type ChatOptions as a, type MarkdownProps as a$, type ConnectedAccount as a0, type AccountAccessToken as a1, type LogAPI as a2, type BackgroundWorkersAPI as a3, type BackgroundTaskConfig as a4, type BackgroundTaskCallback as a5, type BackgroundTaskContext as a6, type BackgroundTaskHealth as a7, type BackgroundRestartPolicy as a8, type Query as a9, type ClockProps as aA, type ParagraphProps as aB, type ButtonProps as aC, type TextInputProps as aD, type PasswordInputProps as aE, type NumberInputProps as aF, type TextAreaProps as aG, type DateTimeInputProps as aH, type SelectProps as aI, type IconPickerProps as aJ, type VerticalStackProps as aK, type HorizontalStackProps as aL, type GridProps as aM, type DividerProps as aN, type IconProps as aO, type IconButtonType as aP, type IconButtonProps as aQ, type PanelAction as aR, type PanelProps as aS, type ToggleProps as aT, type CollapsibleProps as aU, type FrameVariant as aV, type FrameProps as aW, type ListProps as aX, type PillVariant as aY, type PillProps as aZ, type CheckboxProps as a_, type QueryOptions as aa, type StorageAPI as ab, type SecretsAPI as ac, type StorageCollectionConfig as ad, type StorageContributions as ae, type AIProvider as af, type ModelCapabilities as ag, type ChatImage as ah, type ChatFile as ai, type ToolCall as aj, type VoiceTransportRequest as ak, type Tool as al, type ToolAttachment as am, type Action as an, type ExtensionModule as ao, type AllowedCSSProperty as ap, type ExtensionComponentStyle as aq, type ExtensionComponentData as ar, type ExtensionComponentIterator as as, type ExtensionComponentChildren as at, type ExtensionActionCall as au, type ExtensionActionRef as av, type ExtensionDataSource as aw, type ExtensionPanelDefinition as ax, type HeaderProps as ay, type LabelProps as az, type StreamEvent as b, type TextPreviewProps as b0, type ModalProps as b1, type ConditionalGroupProps as b2, type WeatherCondition as b3, type WeatherWind as b4, type WeatherNowProps as b5, type WeatherForecastStep as b6, type WeatherForecastProps as b7, type ChartKind as b8, type ChartSeries as b9, type ChartProps as ba, type StatTrend as bb, type StatTileProps as bc, type ProgressShape as bd, type ProgressColor as be, type ProgressBarProps as bf, type KeyValueRow as bg, type KeyValueListProps as bh, type TimelineVariant as bi, type TimelineEntry as bj, type TimelineProps as bk, type NoteVariant as bl, type NoteProps as bm, type CalendarEventStatus as bn, type CalendarEventProps as bo, type ExecutionContext as bp, type VoiceSessionDescriptor as c, type ToolSettingsViewDefinition as d, type ToolSettingsView as e, type ToolSettingsListView as f, type ToolSettingsListMapping as g, type ToolSettingsComponentView as h, type ToolSettingsActionDataSource as i, type StatusCardDefinition as j, type PanelView as k, type PanelComponentView as l, type PanelActionDataSource as m, type PanelUnknownView as n, type ProviderDefinition as o, type ProviderConfigView as p, type PromptContribution as q, resolveLocalizedString as r, type PromptSection as s, type ToolDefinition as t, type ToolConfirmationConfig as u, type CommandDefinition as v, type AccountProvider as w, type AccountContribution as x, type ExtensionContext as y, type SettingsAPI as z };

package/dist/{types.tools-R0xGhiBa.d.ts → types.tools-DcFBsfRV.d.ts}

@@ -789,6 +789,8 @@ interface ExtensionContributions {
     commands?: CommandDefinition[];
     /** Prompt contributions for the system prompt */
     prompts?: PromptContribution[];
+    /** External accounts the extension works through, signed in once in Stina's settings */
+    accounts?: AccountContribution[];
     /** Storage collection declarations */
     storage?: {
         collections: {
@@ -799,6 +801,45 @@ interface ExtensionContributions {
         };
     };
 }
+/**
+ * An external account provider the host can sign in to on the user's behalf.
+ *
+ * Only Microsoft for now, and only through Microsoft Graph: mail and calendar
+ * then share one sign-in and one token, instead of an IMAP token and a Graph
+ * token that an admin has to approve separately.
+ */
+type AccountProvider = 'microsoft';
+/**
+ * What an extension needs from an account the user connects to Stina.
+ *
+ * Stina asks the provider for every scope that the enabled extensions declare,
+ * all at once, so that the user - and, at work, their administrator - approves
+ * one request instead of one per extension. Declaring a scope here is therefore
+ * also what makes it show up in that request, and in the list of what is asked
+ * for in the settings.
+ *
+ * @example
+ * ```json
+ * "accounts": [
+ *   {
+ *     "provider": "microsoft",
+ *     "scopes": ["Calendars.ReadWrite"],
+ *     "reason": { "en": "Read and book events in your calendar", "sv": "Läsa och boka i din kalender" }
+ *   }
+ * ]
+ * ```
+ */
+interface AccountContribution {
+    provider: AccountProvider;
+    /**
+     * Microsoft Graph delegated permissions, by name: `Mail.Read`,
+     * `Calendars.ReadWrite`. The host adds `offline_access` and `User.Read`
+     * itself, so they are not declared here.
+     */
+    scopes: string[];
+    /** Why the extension needs them, shown next to the scopes in the settings. */
+    reason?: LocalizedString;
+}
 /**
  * Tool settings view definition (UI schema)
  */
@@ -1770,6 +1811,69 @@ interface ExecutionContext {
      * so in its manifest and check before reaching for them.
      */
     readonly attachments?: AttachmentsAPI;
+    /**
+     * The external accounts this user has connected to Stina.
+     *
+     * Present only for an extension holding `accounts.use`, and only on a request
+     * that knows whose it is - an account belongs to somebody, like an attachment.
+     */
+    readonly accounts?: ConnectedAccountsAPI;
+}
+/**
+ * Working through an account the user signed in to in Stina's settings.
+ *
+ * The user connects a Microsoft account once, and every extension that declares
+ * Microsoft under `contributes.accounts` can use it. The extension never sees the
+ * refresh token; it asks for an access token when it needs one and gets a fresh
+ * one back, refreshed by the host when the old one has run out.
+ *
+ * One thing the host cannot narrow: Microsoft issues a Graph token carrying every
+ * permission the user has granted Stina, not only the ones this extension
+ * declared. The declaration decides whether an extension gets a token at all,
+ * and what the user is asked to approve - not what the token can do.
+ */
+interface ConnectedAccountsAPI {
+    /**
+     * The accounts this user has connected for a provider, newest first.
+     *
+     * An empty list is the normal answer for a user who has not connected one yet:
+     * the extension should point them at Stina's settings rather than start a
+     * sign-in of its own.
+     */
+    list(provider: 'microsoft'): Promise<ConnectedAccount[]>;
+    /**
+     * An access token for one of those accounts, for the scopes this extension
+     * declared.
+     *
+     * Rejects when the account is gone, when the user has not granted every
+     * declared scope yet, or when the provider has revoked the sign-in. The
+     * message says which, in words the user can act on - it is fine to show it.
+     */
+    getAccessToken(accountId: string): Promise<AccountAccessToken>;
+}
+/** An account the user has connected, as an extension sees it. */
+interface ConnectedAccount {
+    /** Stable id, to store alongside whatever the extension keeps for this account. */
+    id: string;
+    provider: 'microsoft';
+    /** The address the user signs in with. */
+    email: string;
+    displayName?: string;
+    /**
+     * Whether the user has granted every scope this extension declared. False when
+     * the extension was installed after the account was connected, and the user has
+     * yet to reconnect it in the settings.
+     */
+    hasRequiredScopes: boolean;
+    /** Set when the provider has refused the stored sign-in and it has to be redone. */
+    needsReconnect: boolean;
+}
+/** An access token, and when it stops working. */
+interface AccountAccessToken {
+    /** Bearer token for Microsoft Graph. */
+    token: string;
+    /** ISO timestamp. Ask again after this; the host refreshes. */
+    expiresAt: string;
 }
 /**
  * Reading a file that is already in a conversation.
@@ -2507,4 +2611,4 @@ interface ActionResult {
     error?: string;
 }
 
-export { type BackgroundTaskConfig as $, type ActionResult as A, type ActionsAPI as B, type ChatMessage as C, type Disposable as D, type ExtensionContributions as E, type EventsAPI as F, type GetModelsOptions as G, type HugeIconName as H, type SchedulerAPI as I, type SchedulerJobRequest as J, type SchedulerSchedule as K, type LocalizedString as L, type ModelInfo as M, type NetworkAPI as N, type UserProfile as O, type PanelDefinition as P, type ChatAPI as Q, type ChatInstructionMessage as R, type SchedulerFirePayload as S, type ToolResult as T, type UserAPI as U, type VoiceSessionOptions as V, type ConversationPresentation as W, type AttachmentsAPI as X, type AttachmentContent as Y, type LogAPI as Z, type BackgroundWorkersAPI as _, type ChatOptions as a, type WeatherWind as a$, type BackgroundTaskCallback as a0, type BackgroundTaskContext as a1, type BackgroundTaskHealth as a2, type BackgroundRestartPolicy as a3, type Query as a4, type QueryOptions as a5, type StorageAPI as a6, type SecretsAPI as a7, type StorageCollectionConfig as a8, type StorageContributions as a9, type NumberInputProps as aA, type TextAreaProps as aB, type DateTimeInputProps as aC, type SelectProps as aD, type IconPickerProps as aE, type VerticalStackProps as aF, type HorizontalStackProps as aG, type GridProps as aH, type DividerProps as aI, type IconProps as aJ, type IconButtonType as aK, type IconButtonProps as aL, type PanelAction as aM, type PanelProps as aN, type ToggleProps as aO, type CollapsibleProps as aP, type FrameVariant as aQ, type FrameProps as aR, type ListProps as aS, type PillVariant as aT, type PillProps as aU, type CheckboxProps as aV, type MarkdownProps as aW, type TextPreviewProps as aX, type ModalProps as aY, type ConditionalGroupProps as aZ, type WeatherCondition as a_, type AIProvider as aa, type ModelCapabilities as ab, type ChatImage as ac, type ChatFile as ad, type ToolCall as ae, type VoiceTransportRequest as af, type Tool as ag, type ToolAttachment as ah, type Action as ai, type ExtensionModule as aj, type AllowedCSSProperty as ak, type ExtensionComponentStyle as al, type ExtensionComponentData as am, type ExtensionComponentIterator as an, type ExtensionComponentChildren as ao, type ExtensionActionCall as ap, type ExtensionActionRef as aq, type ExtensionDataSource as ar, type ExtensionPanelDefinition as as, type HeaderProps as at, type LabelProps as au, type ClockProps as av, type ParagraphProps as aw, type ButtonProps as ax, type TextInputProps as ay, type PasswordInputProps as az, type StreamEvent as b, type WeatherNowProps as b0, type WeatherForecastStep as b1, type WeatherForecastProps as b2, type ChartKind as b3, type ChartSeries as b4, type ChartProps as b5, type StatTrend as b6, type StatTileProps as b7, type ProgressShape as b8, type ProgressColor as b9, type ProgressBarProps as ba, type KeyValueRow as bb, type KeyValueListProps as bc, type TimelineVariant as bd, type TimelineEntry as be, type TimelineProps as bf, type NoteVariant as bg, type NoteProps as bh, type CalendarEventStatus as bi, type CalendarEventProps as bj, type ExecutionContext as bk, type VoiceSessionDescriptor as c, type ToolSettingsViewDefinition as d, type ToolSettingsView as e, type ToolSettingsListView as f, type ToolSettingsListMapping as g, type ToolSettingsComponentView as h, type ToolSettingsActionDataSource as i, type StatusCardDefinition as j, type PanelView as k, type PanelComponentView as l, type PanelActionDataSource as m, type PanelUnknownView as n, type ProviderDefinition as o, type ProviderConfigView as p, type PromptContribution as q, resolveLocalizedString as r, type PromptSection as s, type ToolDefinition as t, type ToolConfirmationConfig as u, type CommandDefinition as v, type ExtensionContext as w, type SettingsAPI as x, type ProvidersAPI as y, type ToolsAPI as z };
+export { type ConnectedAccountsAPI as $, type ActionResult as A, type ProvidersAPI as B, type ChatMessage as C, type Disposable as D, type ExtensionContributions as E, type ToolsAPI as F, type GetModelsOptions as G, type HugeIconName as H, type ActionsAPI as I, type EventsAPI as J, type SchedulerAPI as K, type LocalizedString as L, type ModelInfo as M, type NetworkAPI as N, type SchedulerJobRequest as O, type PanelDefinition as P, type SchedulerSchedule as Q, type UserProfile as R, type SchedulerFirePayload as S, type ToolResult as T, type UserAPI as U, type VoiceSessionOptions as V, type ChatAPI as W, type ChatInstructionMessage as X, type ConversationPresentation as Y, type AttachmentsAPI as Z, type AttachmentContent as _, type ChatOptions as a, type MarkdownProps as a$, type ConnectedAccount as a0, type AccountAccessToken as a1, type LogAPI as a2, type BackgroundWorkersAPI as a3, type BackgroundTaskConfig as a4, type BackgroundTaskCallback as a5, type BackgroundTaskContext as a6, type BackgroundTaskHealth as a7, type BackgroundRestartPolicy as a8, type Query as a9, type ClockProps as aA, type ParagraphProps as aB, type ButtonProps as aC, type TextInputProps as aD, type PasswordInputProps as aE, type NumberInputProps as aF, type TextAreaProps as aG, type DateTimeInputProps as aH, type SelectProps as aI, type IconPickerProps as aJ, type VerticalStackProps as aK, type HorizontalStackProps as aL, type GridProps as aM, type DividerProps as aN, type IconProps as aO, type IconButtonType as aP, type IconButtonProps as aQ, type PanelAction as aR, type PanelProps as aS, type ToggleProps as aT, type CollapsibleProps as aU, type FrameVariant as aV, type FrameProps as aW, type ListProps as aX, type PillVariant as aY, type PillProps as aZ, type CheckboxProps as a_, type QueryOptions as aa, type StorageAPI as ab, type SecretsAPI as ac, type StorageCollectionConfig as ad, type StorageContributions as ae, type AIProvider as af, type ModelCapabilities as ag, type ChatImage as ah, type ChatFile as ai, type ToolCall as aj, type VoiceTransportRequest as ak, type Tool as al, type ToolAttachment as am, type Action as an, type ExtensionModule as ao, type AllowedCSSProperty as ap, type ExtensionComponentStyle as aq, type ExtensionComponentData as ar, type ExtensionComponentIterator as as, type ExtensionComponentChildren as at, type ExtensionActionCall as au, type ExtensionActionRef as av, type ExtensionDataSource as aw, type ExtensionPanelDefinition as ax, type HeaderProps as ay, type LabelProps as az, type StreamEvent as b, type TextPreviewProps as b0, type ModalProps as b1, type ConditionalGroupProps as b2, type WeatherCondition as b3, type WeatherWind as b4, type WeatherNowProps as b5, type WeatherForecastStep as b6, type WeatherForecastProps as b7, type ChartKind as b8, type ChartSeries as b9, type ChartProps as ba, type StatTrend as bb, type StatTileProps as bc, type ProgressShape as bd, type ProgressColor as be, type ProgressBarProps as bf, type KeyValueRow as bg, type KeyValueListProps as bh, type TimelineVariant as bi, type TimelineEntry as bj, type TimelineProps as bk, type NoteVariant as bl, type NoteProps as bm, type CalendarEventStatus as bn, type CalendarEventProps as bo, type ExecutionContext as bp, type VoiceSessionDescriptor as c, type ToolSettingsViewDefinition as d, type ToolSettingsView as e, type ToolSettingsListView as f, type ToolSettingsListMapping as g, type ToolSettingsComponentView as h, type ToolSettingsActionDataSource as i, type StatusCardDefinition as j, type PanelView as k, type PanelComponentView as l, type PanelActionDataSource as m, type PanelUnknownView as n, type ProviderDefinition as o, type ProviderConfigView as p, type PromptContribution as q, resolveLocalizedString as r, type PromptSection as s, type ToolDefinition as t, type ToolConfirmationConfig as u, type CommandDefinition as v, type AccountProvider as w, type AccountContribution as x, type ExtensionContext as y, type SettingsAPI as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stina/extension-api",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "private": false,
   "repository": {
     "type": "git",

package/schema/extension-manifest.schema.json

@@ -111,6 +111,7 @@
                   "chat.history.read",
                   "chat.current.read",
                   "attachments.read",
+                  "accounts.use",
                   "chat.message.write",
                   "provider.register",
                   "tools.register",
@@ -853,6 +854,44 @@
               ],
               "additionalProperties": false,
               "description": "Storage collection declarations"
+            },
+            "accounts": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "provider": {
+                    "type": "string",
+                    "enum": [
+                      "microsoft"
+                    ],
+                    "description": "External account provider"
+                  },
+                  "scopes": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z]+(\\.[A-Za-z]+)+$",
+                      "errorMessage": {
+                        "pattern": "Must be a Microsoft Graph permission name, such as \"Mail.Read\""
+                      }
+                    },
+                    "minItems": 1,
+                    "description": "Microsoft Graph delegated permissions"
+                  },
+                  "reason": {
+                    "$ref": "#/definitions/ExtensionManifest/properties/contributes/properties/tools/items/properties/confirmationPrompt",
+                    "description": "Why the extension needs them"
+                  }
+                },
+                "required": [
+                  "provider",
+                  "scopes"
+                ],
+                "additionalProperties": false,
+                "description": "An external account the extension works through"
+              },
+              "description": "External accounts the extension works through, signed in once in Stina's settings"
             }
           },
           "additionalProperties": false,

package/src/background.test.ts

@@ -318,6 +318,39 @@ describe('WorkerBackgroundTaskManager', () => {
       expect(receivedContext!.signal).toBeDefined()
       expect(receivedContext!.reportHealth).toBeDefined()
       expect(receivedContext!.log).toBeDefined()
+      // Not granted in this setup, so a task cannot reach for an account.
+      expect(receivedContext!.accounts).toBeUndefined()
+    })
+
+    it('hands a task the accounts of the user it runs for, when the extension may use them', async () => {
+      const accountsApi = { list: vi.fn(), getAccessToken: vi.fn() }
+      const createUserAccountsAPI = vi.fn(() => accountsApi)
+      const withAccounts = new WorkerBackgroundTaskManager({
+        extensionId: 'test-extension',
+        extensionVersion: '1.0.0',
+        storagePath: '/fake/path',
+        sendTaskRegistered,
+        sendTaskStatus,
+        sendHealthReport,
+        createLogAPI,
+        createStorageAPI,
+        createUserStorageAPI,
+        createSecretsAPI,
+        createUserSecretsAPI,
+        createUserAccountsAPI,
+      })
+
+      let receivedContext: BackgroundTaskContext | null = null
+      await withAccounts.start(
+        { id: 'task-2', name: 'Mail watch', userId: 'user-7', restartPolicy: { type: 'never' } },
+        vi.fn(async (context) => {
+          receivedContext = context
+        })
+      )
+      await withAccounts.handleStart('task-2')
+
+      expect(createUserAccountsAPI).toHaveBeenCalledWith('user-7')
+      expect(receivedContext!.accounts).toBe(accountsApi)
     })
   })
 

package/src/background.ts

@@ -14,6 +14,7 @@ import type {
   LogAPI,
   StorageAPI,
   SecretsAPI,
+  ConnectedAccountsAPI,
 } from './types.js'
 
 // ============================================================================
@@ -66,6 +67,11 @@ export interface WorkerBackgroundTaskManagerOptions {
   createSecretsAPI: () => SecretsAPI
   /** Create user-scoped secrets API */
   createUserSecretsAPI: (userId: string) => SecretsAPI
+  /**
+   * Create the connected accounts API for a user. Absent unless the extension
+   * holds `accounts.use`, which leaves `accounts` off the task's context.
+   */
+  createUserAccountsAPI?: (userId: string) => ConnectedAccountsAPI
 }
 
 // ============================================================================
@@ -235,6 +241,9 @@ export class WorkerBackgroundTaskManager {
       userStorage,
       secrets,
       userSecrets,
+      ...(config.userId && this.options.createUserAccountsAPI
+        ? { accounts: this.options.createUserAccountsAPI(config.userId) }
+        : {}),
       signal,
       reportHealth: (status: string) => {
         const timestamp = new Date().toISOString()

package/src/index.ts

@@ -36,6 +36,8 @@ export type {
   ToolDefinition,
   ToolConfirmationConfig,
   CommandDefinition,
+  AccountProvider,
+  AccountContribution,
 
   // Permissions
   Permission,
@@ -65,6 +67,9 @@ export type {
   ConversationPresentation,
   AttachmentsAPI,
   AttachmentContent,
+  ConnectedAccountsAPI,
+  ConnectedAccount,
+  AccountAccessToken,
   LogAPI,
 
   // Background workers

package/src/messages.ts

@@ -266,6 +266,9 @@ export type RequestMethod =
   | 'tools.execute'
   // Attachments
   | 'attachments.read'
+  // Connected accounts
+  | 'accounts.list'
+  | 'accounts.getAccessToken'
 
 export interface ProviderRegisteredMessage {
   type: 'provider-registered'

package/src/runtime/accountsApi.ts

@@ -0,0 +1,26 @@
+/**
+ * Worker-side connected accounts API.
+ */
+
+import type { AccountAccessToken, ConnectedAccount, ConnectedAccountsAPI } from '../types.js'
+import type { RequestMessage } from '../messages.js'
+
+type SendRequest = <T>(method: RequestMessage['method'], payload: unknown) => Promise<T>
+
+/**
+ * Build the accounts API for one user.
+ *
+ * The user id is bound here, from the request that is being served, and not
+ * taken from the extension's own arguments: an extension cannot reach another
+ * user's account by passing a different id, because there is no id to pass.
+ */
+export function buildUserAccountsAPI(sendRequest: SendRequest, userId: string): ConnectedAccountsAPI {
+  return {
+    async list(provider: 'microsoft'): Promise<ConnectedAccount[]> {
+      return sendRequest<ConnectedAccount[]>('accounts.list', { provider, userId })
+    },
+    async getAccessToken(accountId: string): Promise<AccountAccessToken> {
+      return sendRequest<AccountAccessToken>('accounts.getAccessToken', { accountId, userId })
+    },
+  }
+}

package/src/runtime/executionContext.test.ts

@@ -15,7 +15,7 @@ const extensionContext = {
  */
 describe('createExecutionContext', () => {
   it('leaves attachments out without the permission', () => {
-    const context = createExecutionContext(vi.fn(), extensionContext, 'user-1', false)
+    const context = createExecutionContext(vi.fn(), extensionContext, 'user-1', [])
 
     expect(context.attachments).toBeUndefined()
   })
@@ -23,7 +23,7 @@ describe('createExecutionContext', () => {
   it('leaves attachments out without a user, whatever the permission says', () => {
     // An attachment belongs to somebody. A request that cannot say whose work it is
     // doing has no business reading one.
-    const context = createExecutionContext(vi.fn(), extensionContext, undefined, true)
+    const context = createExecutionContext(vi.fn(), extensionContext, undefined, ['attachments.read'])
 
     expect(context.attachments).toBeUndefined()
   })
@@ -36,7 +36,7 @@ describe('createExecutionContext', () => {
       byteSize: 4,
     })
 
-    const context = createExecutionContext(sendRequest, extensionContext, 'user-1', true)
+    const context = createExecutionContext(sendRequest, extensionContext, 'user-1', ['attachments.read'])
     const content = await context.attachments!.read('att-7')
 
     // The user id is the runtime's to supply, not the tool's: it comes from the
@@ -53,7 +53,7 @@ describe('createExecutionContext', () => {
       vi.fn().mockResolvedValue(null),
       extensionContext,
       'user-1',
-      true
+      ['attachments.read']
     )
 
     expect(await context.attachments!.read('gone')).toBeNull()
@@ -68,4 +68,46 @@ describe('createExecutionContext', () => {
     expect(context.secrets).toBeDefined()
     expect(context.userSecrets).toBeDefined()
   })
+
+  describe('connected accounts', () => {
+    it('leaves them out without the permission', () => {
+      const context = createExecutionContext(vi.fn(), extensionContext, 'user-1', ['attachments.read'])
+
+      expect(context.accounts).toBeUndefined()
+    })
+
+    it('leaves them out without a user, whatever the permission says', () => {
+      const context = createExecutionContext(vi.fn(), extensionContext, undefined, ['accounts.use'])
+
+      expect(context.accounts).toBeUndefined()
+    })
+
+    it('asks for the user the request belongs to, not one the extension names', async () => {
+      const sendRequest = vi
+        .fn()
+        .mockResolvedValueOnce([{ id: 'ms-1', provider: 'microsoft', email: 'a@b.se' }])
+        .mockResolvedValueOnce({ token: 'tok', expiresAt: '2026-09-16T12:00:00.000Z' })
+
+      const context = createExecutionContext(sendRequest, extensionContext, 'user-1', ['accounts.use'])
+      await context.accounts!.list('microsoft')
+      const token = await context.accounts!.getAccessToken('ms-1')
+
+      expect(sendRequest).toHaveBeenNthCalledWith(1, 'accounts.list', {
+        provider: 'microsoft',
+        userId: 'user-1',
+      })
+      expect(sendRequest).toHaveBeenNthCalledWith(2, 'accounts.getAccessToken', {
+        accountId: 'ms-1',
+        userId: 'user-1',
+      })
+      expect(token.token).toBe('tok')
+    })
+
+    it('leaves attachments alone when only accounts were granted', () => {
+      const context = createExecutionContext(vi.fn(), extensionContext, 'user-1', ['accounts.use'])
+
+      expect(context.accounts).toBeDefined()
+      expect(context.attachments).toBeUndefined()
+    })
+  })
 })

package/src/runtime/executionContext.ts

@@ -6,6 +6,7 @@ import type { AttachmentContent, ExecutionContext, ExtensionContext } from '../t
 import type { RequestMessage } from '../messages.js'
 import { buildExtensionStorageAPI, buildUserStorageAPI } from './storageApi.js'
 import { buildExtensionSecretsAPI, buildUserSecretsAPI } from './secretsApi.js'
+import { buildUserAccountsAPI } from './accountsApi.js'
 
 type SendRequest = <T>(method: RequestMessage['method'], payload: unknown) => Promise<T>
 
@@ -18,12 +19,15 @@ export function createExecutionContext(
   extensionContext: ExtensionContext,
   userId?: string,
   /**
-   * Whether the extension declared `attachments.read`. Checked here rather than in
-   * the host alone so a tool can see whether the capability is there at all, the
-   * way it can for storage — the host refuses it regardless.
+   * What the extension was granted. The permission-gated APIs are left out here
+   * rather than only refused by the host, so a tool can see whether a capability
+   * is there at all, the way it can for storage — the host refuses them regardless.
    */
-  canReadAttachments = false
+  granted: readonly string[] = []
 ): ExecutionContext {
+  const canReadAttachments = granted.includes('attachments.read')
+  const canUseAccounts = granted.includes('accounts.use')
+
   return {
     userId,
     extension: {
@@ -53,5 +57,7 @@ export function createExecutionContext(
           },
         }
       : {}),
+    // Scoped to a user for the same reason: a connected account is somebody's.
+    ...(canUseAccounts && userId ? { accounts: buildUserAccountsAPI(sendRequest, userId) } : {}),
   }
 }

package/src/runtime/index.ts

@@ -6,3 +6,4 @@
 export { buildExtensionStorageAPI, buildUserStorageAPI } from './storageApi.js'
 export { buildExtensionSecretsAPI, buildUserSecretsAPI } from './secretsApi.js'
 export { createExecutionContext } from './executionContext.js'
+export { buildUserAccountsAPI } from './accountsApi.js'