@agent-native/core 0.101.6 → 0.101.10

package/dist/server/agent-chat/action-filters-a2a.js

@@ -62,6 +62,7 @@ export function assembleA2AFinalResponse(events, toolResults, options = {}) {
     const finalText = appendA2AArtifactLinks(responseText, [...toolResults], {
         baseUrl: options.baseUrl ?? resolveArtifactBaseUrl(options.event),
         includeReferencedArtifacts: true,
+        includePersistedArtifactMarker: true,
     });
     if (terminalError && !finalText.trim()) {
         throw new Error(formatA2ATerminalError(terminalError));

package/dist/server/agent-chat/action-filters-a2a.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-filters-a2a.js","sourceRoot":"","sources":["../../../src/server/agent-chat/action-filters-a2a.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EACL,sBAAsB,GAGvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,uCAAuC,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EACL,wBAAwB,EACxB,kCAAkC,GAEnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAExF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,UAAU,qBAAqB,CACnC,OAAoC;IAEpC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CACvE,CAAC;AACJ,CAAC;AAED;;;;2DAI2D;AAC3D,MAAM,UAAU,gBAAgB,CAC9B,OAAoC;IAEpC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAoC;IAEpC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC;QACjC,OAAO,CACL,MAAM,EAAE,MAAM,KAAK,IAAI;YACvB,MAAM,CAAC,QAAQ,KAAK,IAAI;YACxB,MAAM,CAAC,YAAY,KAAK,IAAI;YAC5B,MAAM,CAAC,eAAe,KAAK,IAAI,CAChC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAoC;IAOpC,OAAO,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC1D,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAsB;IAEtB,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC;QAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI;YAAE,OAAO,yBAAyB,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiC,EACjC,WAA4C,EAC5C,OAAO,GAAiD,EAAE;IAE1D,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,uCAAuC,CAAC,MAAM,EAAE;QACnE,qBAAqB,EAAE,CAAC,aAAa;KACtC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE;QACvE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC;QACjE,0BAA0B,EAAE,IAAI;KACjC,CAAC,CAAC;IACH,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAiC;IAEjC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACrC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnC,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,mCAAmC,KAAK,CAAC,MAAM,IAAI;gBAC1D,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,WAAW,EAAE,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAiD;IAEjD,MAAM,KAAK,GAAG;QACZ,KAAK,CAAC,KAAK,IAAI,iDAAiD;QAChE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;KACjD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAID,SAAS,qBAAqB,CAC5B,UAA6C,EAC7C,aAGC,EACD,cAAiD,EACjD,MAA0B;IAE1B,OAAO,MAAM,CACX;QACE,GAAG,UAAU;QACb,qEAAqE;QACrE,iEAAiE;QACjE,qEAAqE;QACrE,oEAAoE;QACpE,wEAAwE;QACxE,eAAe,EACb,UAAU,CAAC,eAAe;YAC1B,8BAA8B,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,eAAe,EACb,UAAU,CAAC,eAAe;YAC1B,kCAAkC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QACjE,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;KACrD,EACD,aAAa,CAAC,gBAAgB,EAC9B,cAAc,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA6C,EAC7C,aAGC,EACD,cAAiD,EACjD,MAAM,GAAuB,iCAAiC;IAE9D,OAAO,qBAAqB,CAC1B,UAAU,EACV,aAAa,EACb,cAAc,EACd,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA6C,EAC7C,aAGC,EACD,cAAiD,EACjD,MAAM,GAAuB,iCAAiC;IAE9D,OAAO,qBAAqB,CAC1B,UAAU,EACV,aAAa,EACb,cAAc,EACd,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,cAA4B,EAC5B,gBAA2B;IAE3B,OAAO;QACL,KAAK,EAAE,wBAAwB,CAAC,cAAc,EAAE,gBAAgB,CAAC;QACjE,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,eAA4C,EAC5C,UAAqB;IAErB,OAAO,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACpD,CAAC","sourcesContent":["import { getHeader } from \"h3\";\n\nimport {\n  appendA2AArtifactLinks,\n  type A2AArtifactResponseOptions,\n  type A2AToolResultSummary,\n} from \"../../a2a/artifact-response.js\";\nimport { collectFinalResponseTextFromAgentEvents } from \"../../a2a/response-text.js\";\nimport { resolveMainChatMaxOutputTokens } from \"../../agent/engine/output-tokens.js\";\nimport type { EngineTool } from \"../../agent/engine/types.js\";\nimport {\n  filterInitialEngineTools,\n  resolveAgentRequestReasoningEffort,\n  type ActionEntry,\n} from \"../../agent/production-agent.js\";\nimport { runAgentLoopDirectWithSoftTimeout } from \"../../agent/run-loop-with-resume.js\";\nimport type { AgentChatEvent } from \"../../agent/types.js\";\nimport { withConfiguredAppBasePath } from \"../app-base-path.js\";\nimport type { AgentChatPluginOptions } from \"./plugin-options.js\";\n\n// ---------------------------------------------------------------------------\n// Action-visibility filters (read-only / agent-exposed / public-agent-safe)\n// and the A2A (agent-to-agent) final-response assembly + delegated-run\n// helpers that share those filters.\n// ---------------------------------------------------------------------------\n\nexport function filterReadOnlyActions(\n  actions: Record<string, ActionEntry>,\n): Record<string, ActionEntry> {\n  return Object.fromEntries(\n    Object.entries(actions).filter(([, entry]) => entry.readOnly === true),\n  );\n}\n\n/** Drop actions that opted out of agent exposure via `agentTool: false`. They\n *  remain callable from the frontend / HTTP (mounted separately from this\n *  agent tool surface — see `httpActions`) but never appear in any agent tool\n *  list (in-app assistant, MCP, A2A, job/trigger runners) or actions prompt.\n *  Default-allow: only an explicit `false` is excluded. */\nexport function filterAgentTools(\n  actions: Record<string, ActionEntry>,\n): Record<string, ActionEntry> {\n  return Object.fromEntries(\n    Object.entries(actions).filter(([, entry]) => entry.agentTool !== false),\n  );\n}\n\nexport function filterPublicAgentActions(\n  actions: Record<string, ActionEntry>,\n): Record<string, ActionEntry> {\n  return Object.fromEntries(\n    Object.entries(actions).filter(([, entry]) => {\n      const config = entry.publicAgent;\n      return (\n        config?.expose === true &&\n        config.readOnly === true &&\n        config.requiresAuth !== true &&\n        config.isConsequential !== true\n      );\n    }),\n  );\n}\n\nexport function buildPublicAgentA2ASkills(\n  actions: Record<string, ActionEntry>,\n): Array<{\n  id: string;\n  name: string;\n  description: string;\n  publicAgent: ActionEntry[\"publicAgent\"];\n}> {\n  return Object.entries(filterPublicAgentActions(actions)).map(\n    ([name, entry]) => ({\n      id: name,\n      name,\n      description: entry.tool.description,\n      publicAgent: entry.publicAgent,\n    }),\n  );\n}\n\nexport function resolveArtifactBaseUrl(\n  event: any | undefined,\n): string | undefined {\n  const fromEnv =\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    process.env.BETTER_AUTH_URL;\n  if (fromEnv) return withConfiguredAppBasePath(String(fromEnv));\n\n  try {\n    const proto = getHeader(event, \"x-forwarded-proto\") || \"https\";\n    const host = getHeader(event, \"host\");\n    if (host) return withConfiguredAppBasePath(`${proto}://${host}`);\n  } catch {}\n\n  return undefined;\n}\n\nexport function assembleA2AFinalResponse(\n  events: readonly AgentChatEvent[],\n  toolResults: readonly A2AToolResultSummary[],\n  options: A2AArtifactResponseOptions & { event?: any } = {},\n): { responseText: string; finalText: string } {\n  const terminalError = getA2ATerminalErrorEvent(events);\n  const responseText = collectFinalResponseTextFromAgentEvents(events, {\n    fallbackToPreToolText: !terminalError,\n  });\n  const finalText = appendA2AArtifactLinks(responseText, [...toolResults], {\n    baseUrl: options.baseUrl ?? resolveArtifactBaseUrl(options.event),\n    includeReferencedArtifacts: true,\n  });\n  if (terminalError && !finalText.trim()) {\n    throw new Error(formatA2ATerminalError(terminalError));\n  }\n  return { responseText, finalText };\n}\n\nfunction getA2ATerminalErrorEvent(\n  events: readonly AgentChatEvent[],\n): Extract<AgentChatEvent, { type: \"error\" }> | null {\n  for (let i = events.length - 1; i >= 0; i--) {\n    const event = events[i];\n    if (event.type === \"clear\") continue;\n    if (event.type === \"done\") return null;\n    if (event.type === \"error\") return event;\n    if (event.type === \"auto_continue\") {\n      return {\n        type: \"error\",\n        error: `Agent stopped before finishing (${event.reason}).`,\n        errorCode: event.reason,\n        recoverable: true,\n      };\n    }\n  }\n  return null;\n}\n\nfunction formatA2ATerminalError(\n  event: Extract<AgentChatEvent, { type: \"error\" }>,\n): string {\n  const parts = [\n    event.error || \"Agent failed before producing a final response.\",\n    event.errorCode ? `code: ${event.errorCode}` : \"\",\n    event.details ? `details: ${event.details}` : \"\",\n  ].filter(Boolean);\n  return parts.join(\"\\n\");\n}\n\ntype A2AAgentLoopRunner = typeof runAgentLoopDirectWithSoftTimeout;\n\nfunction runDelegatedAgentLoop(\n  runOptions: Parameters<A2AAgentLoopRunner>[0],\n  pluginOptions: Pick<\n    AgentChatPluginOptions,\n    \"finalResponseGuard\" | \"runSoftTimeoutMs\"\n  >,\n  timeoutOptions: Parameters<A2AAgentLoopRunner>[2],\n  runner: A2AAgentLoopRunner,\n) {\n  return runner(\n    {\n      ...runOptions,\n      // Delegated runs resolve their own model and do not pass through the\n      // interactive request handler's output-token setup. Use the same\n      // model-aware headroom here so reasoning models (notably GPT-5.x) do\n      // not spend the small internal default entirely on reasoning before\n      // emitting a tool call or answer. Preserve explicit test/caller values.\n      maxOutputTokens:\n        runOptions.maxOutputTokens ??\n        resolveMainChatMaxOutputTokens(runOptions.model),\n      reasoningEffort:\n        runOptions.reasoningEffort ??\n        resolveAgentRequestReasoningEffort({ model: runOptions.model }),\n      finalResponseGuard: pluginOptions.finalResponseGuard,\n    },\n    pluginOptions.runSoftTimeoutMs,\n    timeoutOptions,\n  );\n}\n\n/**\n * Run an A2A-delegated agent turn with the same final-response guard used by\n * the app's interactive chat surface.\n *\n * Keeping this in one helper prevents delegated calls from silently bypassing\n * template guarantees such as Analytics' requirement to query real data\n * before presenting metrics or exhaustive provider conclusions.\n */\nexport function runA2AAgentLoop(\n  runOptions: Parameters<A2AAgentLoopRunner>[0],\n  pluginOptions: Pick<\n    AgentChatPluginOptions,\n    \"finalResponseGuard\" | \"runSoftTimeoutMs\"\n  >,\n  timeoutOptions: Parameters<A2AAgentLoopRunner>[2],\n  runner: A2AAgentLoopRunner = runAgentLoopDirectWithSoftTimeout,\n) {\n  return runDelegatedAgentLoop(\n    runOptions,\n    pluginOptions,\n    timeoutOptions,\n    runner,\n  );\n}\n\n/**\n * Run the MCP-local ask_app turn with the same app-level response guard as\n * A2A. Keeping this seam shared prevents hosted MCP callers from bypassing\n * template guarantees when the request cannot use the self-A2A route.\n */\nexport function runMCPAgentLoop(\n  runOptions: Parameters<A2AAgentLoopRunner>[0],\n  pluginOptions: Pick<\n    AgentChatPluginOptions,\n    \"finalResponseGuard\" | \"runSoftTimeoutMs\"\n  >,\n  timeoutOptions: Parameters<A2AAgentLoopRunner>[2],\n  runner: A2AAgentLoopRunner = runAgentLoopDirectWithSoftTimeout,\n) {\n  return runDelegatedAgentLoop(\n    runOptions,\n    pluginOptions,\n    timeoutOptions,\n    runner,\n  );\n}\n\n/**\n * Keep delegated A2A turns on the same compact initial tool surface as\n * interactive chat. `tool-search` remains in the initial set, while the\n * complete registry is supplied separately so the run loop can load a matched\n * schema after a tool-search result.\n */\nexport function createA2AEngineToolSurface(\n  availableTools: EngineTool[],\n  initialToolNames?: string[],\n): { tools: EngineTool[]; availableTools: EngineTool[] } {\n  return {\n    tools: filterInitialEngineTools(availableTools, initialToolNames),\n    availableTools,\n  };\n}\n\nexport function resolveInitialToolNames(\n  templateActions: Record<string, ActionEntry>,\n  configured?: string[],\n): string[] {\n  return configured ?? Object.keys(templateActions);\n}\n"]}
+{"version":3,"file":"action-filters-a2a.js","sourceRoot":"","sources":["../../../src/server/agent-chat/action-filters-a2a.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EACL,sBAAsB,GAGvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,uCAAuC,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EACL,wBAAwB,EACxB,kCAAkC,GAEnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAExF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,UAAU,qBAAqB,CACnC,OAAoC;IAEpC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CACvE,CAAC;AACJ,CAAC;AAED;;;;2DAI2D;AAC3D,MAAM,UAAU,gBAAgB,CAC9B,OAAoC;IAEpC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAoC;IAEpC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC;QACjC,OAAO,CACL,MAAM,EAAE,MAAM,KAAK,IAAI;YACvB,MAAM,CAAC,QAAQ,KAAK,IAAI;YACxB,MAAM,CAAC,YAAY,KAAK,IAAI;YAC5B,MAAM,CAAC,eAAe,KAAK,IAAI,CAChC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAoC;IAOpC,OAAO,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC1D,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAsB;IAEtB,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC;QAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI;YAAE,OAAO,yBAAyB,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiC,EACjC,WAA4C,EAC5C,OAAO,GAAiD,EAAE;IAE1D,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,uCAAuC,CAAC,MAAM,EAAE;QACnE,qBAAqB,EAAE,CAAC,aAAa;KACtC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE;QACvE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC;QACjE,0BAA0B,EAAE,IAAI;QAChC,8BAA8B,EAAE,IAAI;KACrC,CAAC,CAAC;IACH,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAiC;IAEjC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACrC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnC,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,mCAAmC,KAAK,CAAC,MAAM,IAAI;gBAC1D,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,WAAW,EAAE,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAiD;IAEjD,MAAM,KAAK,GAAG;QACZ,KAAK,CAAC,KAAK,IAAI,iDAAiD;QAChE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;KACjD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAID,SAAS,qBAAqB,CAC5B,UAA6C,EAC7C,aAGC,EACD,cAAiD,EACjD,MAA0B;IAE1B,OAAO,MAAM,CACX;QACE,GAAG,UAAU;QACb,qEAAqE;QACrE,iEAAiE;QACjE,qEAAqE;QACrE,oEAAoE;QACpE,wEAAwE;QACxE,eAAe,EACb,UAAU,CAAC,eAAe;YAC1B,8BAA8B,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,eAAe,EACb,UAAU,CAAC,eAAe;YAC1B,kCAAkC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QACjE,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;KACrD,EACD,aAAa,CAAC,gBAAgB,EAC9B,cAAc,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA6C,EAC7C,aAGC,EACD,cAAiD,EACjD,MAAM,GAAuB,iCAAiC;IAE9D,OAAO,qBAAqB,CAC1B,UAAU,EACV,aAAa,EACb,cAAc,EACd,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA6C,EAC7C,aAGC,EACD,cAAiD,EACjD,MAAM,GAAuB,iCAAiC;IAE9D,OAAO,qBAAqB,CAC1B,UAAU,EACV,aAAa,EACb,cAAc,EACd,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,cAA4B,EAC5B,gBAA2B;IAE3B,OAAO;QACL,KAAK,EAAE,wBAAwB,CAAC,cAAc,EAAE,gBAAgB,CAAC;QACjE,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,eAA4C,EAC5C,UAAqB;IAErB,OAAO,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACpD,CAAC","sourcesContent":["import { getHeader } from \"h3\";\n\nimport {\n  appendA2AArtifactLinks,\n  type A2AArtifactResponseOptions,\n  type A2AToolResultSummary,\n} from \"../../a2a/artifact-response.js\";\nimport { collectFinalResponseTextFromAgentEvents } from \"../../a2a/response-text.js\";\nimport { resolveMainChatMaxOutputTokens } from \"../../agent/engine/output-tokens.js\";\nimport type { EngineTool } from \"../../agent/engine/types.js\";\nimport {\n  filterInitialEngineTools,\n  resolveAgentRequestReasoningEffort,\n  type ActionEntry,\n} from \"../../agent/production-agent.js\";\nimport { runAgentLoopDirectWithSoftTimeout } from \"../../agent/run-loop-with-resume.js\";\nimport type { AgentChatEvent } from \"../../agent/types.js\";\nimport { withConfiguredAppBasePath } from \"../app-base-path.js\";\nimport type { AgentChatPluginOptions } from \"./plugin-options.js\";\n\n// ---------------------------------------------------------------------------\n// Action-visibility filters (read-only / agent-exposed / public-agent-safe)\n// and the A2A (agent-to-agent) final-response assembly + delegated-run\n// helpers that share those filters.\n// ---------------------------------------------------------------------------\n\nexport function filterReadOnlyActions(\n  actions: Record<string, ActionEntry>,\n): Record<string, ActionEntry> {\n  return Object.fromEntries(\n    Object.entries(actions).filter(([, entry]) => entry.readOnly === true),\n  );\n}\n\n/** Drop actions that opted out of agent exposure via `agentTool: false`. They\n *  remain callable from the frontend / HTTP (mounted separately from this\n *  agent tool surface — see `httpActions`) but never appear in any agent tool\n *  list (in-app assistant, MCP, A2A, job/trigger runners) or actions prompt.\n *  Default-allow: only an explicit `false` is excluded. */\nexport function filterAgentTools(\n  actions: Record<string, ActionEntry>,\n): Record<string, ActionEntry> {\n  return Object.fromEntries(\n    Object.entries(actions).filter(([, entry]) => entry.agentTool !== false),\n  );\n}\n\nexport function filterPublicAgentActions(\n  actions: Record<string, ActionEntry>,\n): Record<string, ActionEntry> {\n  return Object.fromEntries(\n    Object.entries(actions).filter(([, entry]) => {\n      const config = entry.publicAgent;\n      return (\n        config?.expose === true &&\n        config.readOnly === true &&\n        config.requiresAuth !== true &&\n        config.isConsequential !== true\n      );\n    }),\n  );\n}\n\nexport function buildPublicAgentA2ASkills(\n  actions: Record<string, ActionEntry>,\n): Array<{\n  id: string;\n  name: string;\n  description: string;\n  publicAgent: ActionEntry[\"publicAgent\"];\n}> {\n  return Object.entries(filterPublicAgentActions(actions)).map(\n    ([name, entry]) => ({\n      id: name,\n      name,\n      description: entry.tool.description,\n      publicAgent: entry.publicAgent,\n    }),\n  );\n}\n\nexport function resolveArtifactBaseUrl(\n  event: any | undefined,\n): string | undefined {\n  const fromEnv =\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    process.env.BETTER_AUTH_URL;\n  if (fromEnv) return withConfiguredAppBasePath(String(fromEnv));\n\n  try {\n    const proto = getHeader(event, \"x-forwarded-proto\") || \"https\";\n    const host = getHeader(event, \"host\");\n    if (host) return withConfiguredAppBasePath(`${proto}://${host}`);\n  } catch {}\n\n  return undefined;\n}\n\nexport function assembleA2AFinalResponse(\n  events: readonly AgentChatEvent[],\n  toolResults: readonly A2AToolResultSummary[],\n  options: A2AArtifactResponseOptions & { event?: any } = {},\n): { responseText: string; finalText: string } {\n  const terminalError = getA2ATerminalErrorEvent(events);\n  const responseText = collectFinalResponseTextFromAgentEvents(events, {\n    fallbackToPreToolText: !terminalError,\n  });\n  const finalText = appendA2AArtifactLinks(responseText, [...toolResults], {\n    baseUrl: options.baseUrl ?? resolveArtifactBaseUrl(options.event),\n    includeReferencedArtifacts: true,\n    includePersistedArtifactMarker: true,\n  });\n  if (terminalError && !finalText.trim()) {\n    throw new Error(formatA2ATerminalError(terminalError));\n  }\n  return { responseText, finalText };\n}\n\nfunction getA2ATerminalErrorEvent(\n  events: readonly AgentChatEvent[],\n): Extract<AgentChatEvent, { type: \"error\" }> | null {\n  for (let i = events.length - 1; i >= 0; i--) {\n    const event = events[i];\n    if (event.type === \"clear\") continue;\n    if (event.type === \"done\") return null;\n    if (event.type === \"error\") return event;\n    if (event.type === \"auto_continue\") {\n      return {\n        type: \"error\",\n        error: `Agent stopped before finishing (${event.reason}).`,\n        errorCode: event.reason,\n        recoverable: true,\n      };\n    }\n  }\n  return null;\n}\n\nfunction formatA2ATerminalError(\n  event: Extract<AgentChatEvent, { type: \"error\" }>,\n): string {\n  const parts = [\n    event.error || \"Agent failed before producing a final response.\",\n    event.errorCode ? `code: ${event.errorCode}` : \"\",\n    event.details ? `details: ${event.details}` : \"\",\n  ].filter(Boolean);\n  return parts.join(\"\\n\");\n}\n\ntype A2AAgentLoopRunner = typeof runAgentLoopDirectWithSoftTimeout;\n\nfunction runDelegatedAgentLoop(\n  runOptions: Parameters<A2AAgentLoopRunner>[0],\n  pluginOptions: Pick<\n    AgentChatPluginOptions,\n    \"finalResponseGuard\" | \"runSoftTimeoutMs\"\n  >,\n  timeoutOptions: Parameters<A2AAgentLoopRunner>[2],\n  runner: A2AAgentLoopRunner,\n) {\n  return runner(\n    {\n      ...runOptions,\n      // Delegated runs resolve their own model and do not pass through the\n      // interactive request handler's output-token setup. Use the same\n      // model-aware headroom here so reasoning models (notably GPT-5.x) do\n      // not spend the small internal default entirely on reasoning before\n      // emitting a tool call or answer. Preserve explicit test/caller values.\n      maxOutputTokens:\n        runOptions.maxOutputTokens ??\n        resolveMainChatMaxOutputTokens(runOptions.model),\n      reasoningEffort:\n        runOptions.reasoningEffort ??\n        resolveAgentRequestReasoningEffort({ model: runOptions.model }),\n      finalResponseGuard: pluginOptions.finalResponseGuard,\n    },\n    pluginOptions.runSoftTimeoutMs,\n    timeoutOptions,\n  );\n}\n\n/**\n * Run an A2A-delegated agent turn with the same final-response guard used by\n * the app's interactive chat surface.\n *\n * Keeping this in one helper prevents delegated calls from silently bypassing\n * template guarantees such as Analytics' requirement to query real data\n * before presenting metrics or exhaustive provider conclusions.\n */\nexport function runA2AAgentLoop(\n  runOptions: Parameters<A2AAgentLoopRunner>[0],\n  pluginOptions: Pick<\n    AgentChatPluginOptions,\n    \"finalResponseGuard\" | \"runSoftTimeoutMs\"\n  >,\n  timeoutOptions: Parameters<A2AAgentLoopRunner>[2],\n  runner: A2AAgentLoopRunner = runAgentLoopDirectWithSoftTimeout,\n) {\n  return runDelegatedAgentLoop(\n    runOptions,\n    pluginOptions,\n    timeoutOptions,\n    runner,\n  );\n}\n\n/**\n * Run the MCP-local ask_app turn with the same app-level response guard as\n * A2A. Keeping this seam shared prevents hosted MCP callers from bypassing\n * template guarantees when the request cannot use the self-A2A route.\n */\nexport function runMCPAgentLoop(\n  runOptions: Parameters<A2AAgentLoopRunner>[0],\n  pluginOptions: Pick<\n    AgentChatPluginOptions,\n    \"finalResponseGuard\" | \"runSoftTimeoutMs\"\n  >,\n  timeoutOptions: Parameters<A2AAgentLoopRunner>[2],\n  runner: A2AAgentLoopRunner = runAgentLoopDirectWithSoftTimeout,\n) {\n  return runDelegatedAgentLoop(\n    runOptions,\n    pluginOptions,\n    timeoutOptions,\n    runner,\n  );\n}\n\n/**\n * Keep delegated A2A turns on the same compact initial tool surface as\n * interactive chat. `tool-search` remains in the initial set, while the\n * complete registry is supplied separately so the run loop can load a matched\n * schema after a tool-search result.\n */\nexport function createA2AEngineToolSurface(\n  availableTools: EngineTool[],\n  initialToolNames?: string[],\n): { tools: EngineTool[]; availableTools: EngineTool[] } {\n  return {\n    tools: filterInitialEngineTools(availableTools, initialToolNames),\n    availableTools,\n  };\n}\n\nexport function resolveInitialToolNames(\n  templateActions: Record<string, ActionEntry>,\n  configured?: string[],\n): string[] {\n  return configured ?? Object.keys(templateActions);\n}\n"]}

package/dist/server/auth.d.ts

@@ -245,6 +245,7 @@ export declare function setDesktopExchangeError(flowId: string, error: DesktopEx
  * enforce auth on page routes and API routes — not just framework routes.
  */
 export declare function runAuthGuard(event: H3Event): Promise<Response | object | string | void>;
+export declare function shouldBypassAuthForBuilderConnect(event: H3Event, p: string): boolean;
 /**
  * Get the current auth session for a request.
  *

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAclC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAsChE,KAAK,KAAK,GAAG,SAAS,CAAC;AA2BvB,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAI7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAkBlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAoB5D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mNAAmN;IACnN,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC/D;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAoCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAEpD;AAED,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,yBAAyB,QACQ,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAGvD;AAmCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAExE;AAgCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIjE;AAkGD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAgBrE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQzD;AA4TD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7D;AA8ED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB3E;AAkHD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAqBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,QAWd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,2BAA2B,QAOnC;AAmGD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAo2BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAY5E;AA4ID,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAS7E;AAmpCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAqKlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAMzE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAclC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAsChE,KAAK,KAAK,GAAG,SAAS,CAAC;AA2BvB,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAI7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAqBlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAoB5D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mNAAmN;IACnN,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC/D;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAoCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAEpD;AAED,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,yBAAyB,QACQ,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAGvD;AAmCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAExE;AAgCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIjE;AAkGD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAgBrE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQzD;AA4TD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7D;AA8ED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB3E;AAkHD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAqBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,QAWd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,2BAA2B,QAOnC;AAmGD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAiKD,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,EACd,CAAC,EAAE,MAAM,GACR,OAAO,CAoDT;AAiqBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAY5E;AA4ID,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAS7E;AAmpCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAqKlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAMzE"}

package/dist/server/auth.js

@@ -51,7 +51,7 @@ import { normalizeWorkspaceAppAudience, workspaceAppAudienceFromEnv, workspaceAp
 import { isValidWorkspaceAppIdFormat } from "../shared/workspace-app-id.js";
 import { signupAttributionFromCookieHeader } from "./attribution.js";
 import { getBetterAuth, getBetterAuthSync } from "./better-auth-instance.js";
-import { BUILDER_CONNECT_OWNER_COOKIE, BUILDER_CONNECT_PARAM, BUILDER_STATE_PARAM, verifyBuilderCallbackStateAndGetOwner, verifyBuilderConnectTokenAndGetOwner, } from "./builder-browser.js";
+import { BUILDER_CONNECT_OWNER_COOKIE, BUILDER_CONNECT_PARAM, BUILDER_RELAY_PATH, BUILDER_RELAY_STATE_PARAM, BUILDER_STATE_PARAM, verifyBuilderCallbackStateAndGetOwner, verifyBuilderConnectTokenAndGetOwner, verifyBuilderPreviewRelayStateForCallback, } from "./builder-browser.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
 import { readDesktopSso, writeDesktopSso, clearDesktopSso, } from "./desktop-sso.js";
@@ -1082,7 +1082,12 @@ function verifiedBuilderConnectOwnerFromUrl(url) {
     const token = new URLSearchParams(url.slice(queryStart + 1)).get(BUILDER_CONNECT_PARAM);
     return verifyBuilderConnectTokenAndGetOwner(token);
 }
-function shouldBypassAuthForBuilderConnect(event, p) {
+export function shouldBypassAuthForBuilderConnect(event, p) {
+    // The preview-safe second hop is authenticated by its timestamped HMAC and
+    // one-shot pending row. It cannot carry a browser session from the corporate
+    // callback deployment, so let the route perform that stronger check itself.
+    if (p === BUILDER_RELAY_PATH)
+        return true;
     if (p === "/_agent-native/builder/connect") {
         const url = event.node?.req?.url ?? event.path ?? "/";
         return Boolean(verifiedBuilderConnectOwnerFromUrl(url));
@@ -1093,6 +1098,18 @@ function shouldBypassAuthForBuilderConnect(event, p) {
         const state = queryStart >= 0
             ? new URLSearchParams(url.slice(queryStart + 1)).get(BUILDER_STATE_PARAM)
             : null;
+        const relayState = queryStart >= 0
+            ? new URLSearchParams(url.slice(queryStart + 1)).get(BUILDER_RELAY_STATE_PARAM)
+            : null;
+        if (relayState) {
+            try {
+                if (verifyBuilderPreviewRelayStateForCallback(relayState))
+                    return true;
+            }
+            catch {
+                // Dedicated relay secret missing: let the auth guard fail closed.
+            }
+        }
         // The signed `_an_state` authenticates this specific Builder callback
         // flow back to our app. A stale localhost session cookie can otherwise
         // make the global guard reject the callback before the handler gets to