@agent-native/core 0.113.0 → 0.114.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (1638) hide show
  1. package/agent-native.eject.json +164 -0
  2. package/corpus/README.md +3 -3
  3. package/corpus/core/CHANGELOG.md +20 -0
  4. package/corpus/core/README.md +61 -174
  5. package/corpus/core/agent-native.eject.json +164 -0
  6. package/corpus/core/docs/content/agent-native-toolkit.mdx +38 -0
  7. package/corpus/core/docs/content/package-lifecycle.mdx +54 -4
  8. package/corpus/core/package.json +15 -2
  9. package/corpus/core/src/cli/eject.ts +1594 -0
  10. package/corpus/core/src/cli/index.ts +16 -0
  11. package/corpus/core/src/client/build-compatibility.ts +77 -0
  12. package/corpus/core/src/client/index.ts +4 -0
  13. package/corpus/core/src/client/resources/McpConnectionSuggestion.tsx +8 -2
  14. package/corpus/core/src/client/resources/McpIntegrationDialog.tsx +7 -2
  15. package/corpus/core/src/client/resources/ResourcesPanel.tsx +17 -3
  16. package/corpus/core/src/client/resources/index.ts +19 -0
  17. package/corpus/core/src/client/resources/mcp-integration-catalog.ts +9 -1
  18. package/corpus/core/src/client/resources/runtime.ts +1 -0
  19. package/corpus/core/src/client/route-chunk-recovery/index.ts +1 -0
  20. package/corpus/core/src/client/setup-connections/catalog.ts +6 -0
  21. package/corpus/core/src/client/setup-connections/index.ts +1 -0
  22. package/corpus/core/src/client/setup-connections/runtime.ts +1 -0
  23. package/corpus/core/src/client/use-action.ts +32 -1
  24. package/corpus/core/src/connections/catalog.ts +41 -24
  25. package/corpus/core/src/connections/index.ts +1 -0
  26. package/corpus/core/src/connections/runtime.ts +1 -0
  27. package/corpus/core/src/deploy/build.ts +4 -1
  28. package/corpus/core/src/eject/provider-api-definitions.ts +193 -0
  29. package/corpus/core/src/eject/remote-mcp-presets.ts +137 -0
  30. package/corpus/core/src/eject/setup-readiness-ui.tsx +29 -0
  31. package/corpus/core/src/eject/workspace-connections.ts +92 -0
  32. package/corpus/core/src/index.ts +1 -0
  33. package/corpus/core/src/integrations/adapter-overrides.ts +12 -0
  34. package/corpus/core/src/integrations/eject/messaging-adapters.ts +85 -0
  35. package/corpus/core/src/integrations/index.ts +5 -1
  36. package/corpus/core/src/integrations/plugin.ts +34 -12
  37. package/corpus/core/src/integrations/runtime.ts +1 -0
  38. package/corpus/core/src/integrations/types.ts +3 -1
  39. package/corpus/core/src/org/context.ts +56 -30
  40. package/corpus/core/src/package-lifecycle/eject-manifest.ts +345 -0
  41. package/corpus/core/src/package-lifecycle/index.ts +1 -0
  42. package/corpus/core/src/provider-api/index.ts +46 -12
  43. package/corpus/core/src/provider-api/runtime.ts +1 -0
  44. package/corpus/core/src/server/action-routes.ts +52 -2
  45. package/corpus/core/src/server/auth-plugin.ts +9 -4
  46. package/corpus/core/src/server/better-auth-instance.ts +5 -1
  47. package/corpus/core/src/setup-connections/index.ts +1 -0
  48. package/corpus/core/src/shared/mcp-embed-headers.ts +1 -1
  49. package/corpus/core/src/shared/merge-by-id.ts +14 -0
  50. package/corpus/core/src/templates/default/.agents/skills/agent-native-docs/SKILL.md +15 -13
  51. package/corpus/core/src/templates/default/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  52. package/corpus/core/src/templates/default/.agents/skills/self-modifying-code/SKILL.md +9 -6
  53. package/corpus/core/src/templates/default/AGENTS.md +6 -5
  54. package/corpus/core/src/templates/headless/.agents/skills/agent-native-docs/SKILL.md +15 -13
  55. package/corpus/core/src/templates/headless/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  56. package/corpus/core/src/templates/headless/AGENTS.md +5 -4
  57. package/corpus/core/src/templates/workspace-core/.agents/skills/agent-native-docs/SKILL.md +15 -13
  58. package/corpus/core/src/templates/workspace-core/.agents/skills/agent-native-toolkit/SKILL.md +3 -2
  59. package/corpus/core/src/templates/workspace-core/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  60. package/corpus/core/src/templates/workspace-core/.agents/skills/self-modifying-code/SKILL.md +9 -6
  61. package/corpus/core/src/templates/workspace-core/AGENTS.md +4 -4
  62. package/corpus/core/src/templates/workspace-root/AGENTS.md +4 -4
  63. package/corpus/core/src/vite/client.ts +42 -2
  64. package/corpus/templates/analytics/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  65. package/corpus/templates/analytics/.agents/skills/self-modifying-code/SKILL.md +9 -6
  66. package/corpus/templates/assets/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  67. package/corpus/templates/assets/.agents/skills/self-modifying-code/SKILL.md +9 -6
  68. package/corpus/templates/brain/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  69. package/corpus/templates/brain/.agents/skills/self-modifying-code/SKILL.md +9 -6
  70. package/corpus/templates/brain/actions/remediate-legacy-capture-audiences.ts +167 -0
  71. package/corpus/templates/brain/app/lib/brain-chat-readiness.ts +6 -0
  72. package/corpus/templates/brain/app/routes/_index.tsx +8 -0
  73. package/corpus/templates/brain/app/routes.ts +1 -0
  74. package/corpus/templates/brain/changelog/2026-07-19-ask-starts-immediately-when-builder-s-managed-ai-connection-.md +6 -0
  75. package/corpus/templates/brain/changelog/2026-07-19-slack-and-granola-backfills-now-process-captures-concurrentl.md +6 -0
  76. package/corpus/templates/brain/changelog/2026-07-19-source-review-settings-now-control-knowledge-approval.md +6 -0
  77. package/corpus/templates/brain/changelog/2026-07-19-the-manage-agent-page-now-opens-correctly-from-brain-navigat.md +6 -0
  78. package/corpus/templates/brain/server/db/schema.ts +3 -0
  79. package/corpus/templates/brain/server/lib/brain.ts +41 -2
  80. package/corpus/templates/brain/server/lib/connectors.ts +379 -113
  81. package/corpus/templates/brain/server/lib/meeting-audience.ts +38 -0
  82. package/corpus/templates/brain/server/plugins/db.ts +10 -0
  83. package/corpus/templates/brain/server/routes/api/_agent-native/brain/ingest.post.ts +6 -4
  84. package/corpus/templates/calendar/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  85. package/corpus/templates/calendar/.agents/skills/self-modifying-code/SKILL.md +9 -6
  86. package/corpus/templates/chat/.agents/skills/agent-native-docs/SKILL.md +15 -13
  87. package/corpus/templates/chat/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  88. package/corpus/templates/chat/.agents/skills/self-modifying-code/SKILL.md +9 -6
  89. package/corpus/templates/chat/AGENTS.md +3 -2
  90. package/corpus/templates/clips/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  91. package/corpus/templates/clips/.agents/skills/self-modifying-code/SKILL.md +9 -6
  92. package/corpus/templates/content/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  93. package/corpus/templates/content/.agents/skills/self-modifying-code/SKILL.md +9 -6
  94. package/corpus/templates/content/AGENTS.md +2 -0
  95. package/corpus/templates/content/actions/_content-database-personal-view.ts +49 -5
  96. package/corpus/templates/content/actions/_content-document-access.ts +21 -0
  97. package/corpus/templates/content/actions/_content-favorites.ts +91 -0
  98. package/corpus/templates/content/actions/_content-files.ts +79 -23
  99. package/corpus/templates/content/actions/_content-sidebar-state.ts +24 -0
  100. package/corpus/templates/content/actions/_content-space-access.ts +15 -17
  101. package/corpus/templates/content/actions/_content-space-catalog-guards.ts +20 -0
  102. package/corpus/templates/content/actions/_content-spaces.ts +364 -167
  103. package/corpus/templates/content/actions/_database-source-utils.ts +8 -0
  104. package/corpus/templates/content/actions/_database-utils.ts +249 -15
  105. package/corpus/templates/content/actions/_delete-content-space.ts +84 -0
  106. package/corpus/templates/content/actions/_files-system-properties.ts +499 -0
  107. package/corpus/templates/content/actions/_local-file-documents.ts +0 -1
  108. package/corpus/templates/content/actions/_property-utils.ts +18 -9
  109. package/corpus/templates/content/actions/bind-content-database-source-field.ts +3 -0
  110. package/corpus/templates/content/actions/configure-document-property.ts +3 -0
  111. package/corpus/templates/content/actions/create-content-database.ts +2 -2
  112. package/corpus/templates/content/actions/create-content-space.ts +34 -0
  113. package/corpus/templates/content/actions/create-document.ts +4 -1
  114. package/corpus/templates/content/actions/delete-content-space.ts +19 -0
  115. package/corpus/templates/content/actions/delete-database-items.ts +28 -1
  116. package/corpus/templates/content/actions/delete-document-property.ts +3 -0
  117. package/corpus/templates/content/actions/delete-document.ts +39 -2
  118. package/corpus/templates/content/actions/duplicate-database-item.ts +6 -0
  119. package/corpus/templates/content/actions/duplicate-database-items.ts +6 -0
  120. package/corpus/templates/content/actions/duplicate-document-property.ts +3 -0
  121. package/corpus/templates/content/actions/get-content-database.ts +11 -2
  122. package/corpus/templates/content/actions/get-content-sidebar-state.ts +23 -0
  123. package/corpus/templates/content/actions/get-document.ts +32 -7
  124. package/corpus/templates/content/actions/import-content-source.ts +33 -1
  125. package/corpus/templates/content/actions/list-content-spaces.ts +34 -2
  126. package/corpus/templates/content/actions/list-documents.ts +39 -7
  127. package/corpus/templates/content/actions/reorder-document-property.ts +9 -0
  128. package/corpus/templates/content/actions/set-document-property.ts +41 -23
  129. package/corpus/templates/content/actions/share-local-file-document.ts +15 -0
  130. package/corpus/templates/content/actions/submit-content-database-form.ts +7 -0
  131. package/corpus/templates/content/actions/sync-local-folder-source.ts +14 -0
  132. package/corpus/templates/content/actions/update-content-database-view.ts +1 -0
  133. package/corpus/templates/content/actions/update-content-sidebar-state.ts +27 -0
  134. package/corpus/templates/content/actions/update-document.ts +158 -66
  135. package/corpus/templates/content/app/components/EmptyState.tsx +4 -57
  136. package/corpus/templates/content/app/components/editor/CommentsSidebar.tsx +8 -1
  137. package/corpus/templates/content/app/components/editor/DocumentEditor.tsx +519 -178
  138. package/corpus/templates/content/app/components/editor/DocumentInfoPanel.tsx +39 -0
  139. package/corpus/templates/content/app/components/editor/DocumentProperties.tsx +1 -1
  140. package/corpus/templates/content/app/components/editor/DocumentToolbar.tsx +266 -7
  141. package/corpus/templates/content/app/components/editor/database/DatabaseView.tsx +430 -152
  142. package/corpus/templates/content/app/components/editor/database/sidebar.tsx +467 -66
  143. package/corpus/templates/content/app/components/editor/database/view-config.ts +9 -3
  144. package/corpus/templates/content/app/components/sidebar/DocumentSidebar.tsx +720 -196
  145. package/corpus/templates/content/app/components/sidebar/DocumentTreeItem.tsx +173 -1
  146. package/corpus/templates/content/app/components/sidebar/document-sidebar-sections.ts +1 -1
  147. package/corpus/templates/content/app/components/sidebar/select-content-space.ts +91 -16
  148. package/corpus/templates/content/app/entry.client.tsx +5 -1
  149. package/corpus/templates/content/app/hooks/use-content-database.ts +84 -3
  150. package/corpus/templates/content/app/hooks/use-content-spaces.ts +60 -2
  151. package/corpus/templates/content/app/hooks/use-create-page.ts +30 -0
  152. package/corpus/templates/content/app/hooks/use-documents.ts +270 -19
  153. package/corpus/templates/content/app/i18n-data.ts +243 -20
  154. package/corpus/templates/content/app/lib/local-folder-picker-safety.ts +54 -0
  155. package/corpus/templates/content/app/lib/local-folder-picker-support.ts +18 -0
  156. package/corpus/templates/content/app/routes/_app.favorites.tsx +30 -0
  157. package/corpus/templates/content/app/routes/_app.local-files.tsx +18 -6
  158. package/corpus/templates/content/changelog/2026-07-17-workspace-files-now-stay-in-a-loading-state-until-automatic-.md +6 -0
  159. package/corpus/templates/content/changelog/2026-07-17-workspace-switching-now-opens-the-selected-files-database-pr.md +6 -0
  160. package/corpus/templates/content/changelog/2026-07-17-workspaces-now-expand-above-their-own-files-list-without-dup.md +6 -0
  161. package/corpus/templates/content/changelog/2026-07-18-create-named-workspaces-each-with-its-own-private-files-data.md +6 -0
  162. package/corpus/templates/content/changelog/2026-07-18-favorites-align-with-workspace-and-file-rows-in-the-sidebar.md +6 -0
  163. package/corpus/templates/content/changelog/2026-07-18-local-folder-selection-no-longer-invokes-the-unsafe-native-p.md +6 -0
  164. package/corpus/templates/content/changelog/2026-07-18-made-content-workspaces-independently-expandable-restored-or.md +6 -0
  165. package/corpus/templates/content/changelog/2026-07-18-page-details-now-live-in-a-shared-info-and-comments-rail-dat.md +6 -0
  166. package/corpus/templates/content/changelog/2026-07-18-workspace-database-views-now-control-sidebar-workspace-navig.md +6 -0
  167. package/corpus/templates/content/changelog/2026-07-18-workspace-navigation-now-aligns-favorites-with-workspace-pag.md +6 -0
  168. package/corpus/templates/content/changelog/2026-07-19-favorites-now-open-as-a-table-and-compact-breadcrumbs-make-w.md +6 -0
  169. package/corpus/templates/content/changelog/2026-07-19-files-databases-now-start-unfiltered-sidebar-rows-exactly-fo.md +6 -0
  170. package/corpus/templates/content/changelog/2026-07-19-sidebar-page-trees-now-open-only-when-expanded-remember-thei.md +6 -0
  171. package/corpus/templates/content/changelog/2026-07-19-workspace-file-databases-now-use-the-workspace-name-open-as-.md +6 -0
  172. package/corpus/templates/content/changelog/2026-07-19-workspace-navigation-now-stays-stable-on-hover-uses-folder-i.md +6 -0
  173. package/corpus/templates/content/changelog/2026-07-19-workspace-rows-now-use-folder-icons-and-deleting-a-user-crea.md +6 -0
  174. package/corpus/templates/content/changelog/2026-07-19-workspaces-can-be-created-without-leaving-the-workspaces-dat.md +6 -0
  175. package/corpus/templates/content/e2e/global-setup.ts +3 -2
  176. package/corpus/templates/content/parity/matrix.md +28 -28
  177. package/corpus/templates/content/parity/matrix.ts +8 -2
  178. package/corpus/templates/content/server/db/index.ts +1 -0
  179. package/corpus/templates/content/server/db/schema.ts +10 -0
  180. package/corpus/templates/content/server/lib/documents.ts +12 -7
  181. package/corpus/templates/content/server/plugins/db.ts +17 -0
  182. package/corpus/templates/content/shared/api.ts +9 -0
  183. package/corpus/templates/content/shared/database-form.ts +11 -2
  184. package/corpus/templates/content/vite.config.ts +1 -0
  185. package/corpus/templates/design/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  186. package/corpus/templates/design/.agents/skills/self-modifying-code/SKILL.md +9 -6
  187. package/corpus/templates/dispatch/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  188. package/corpus/templates/dispatch/.agents/skills/self-modifying-code/SKILL.md +9 -6
  189. package/corpus/templates/forms/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  190. package/corpus/templates/forms/.agents/skills/self-modifying-code/SKILL.md +9 -6
  191. package/corpus/templates/macros/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  192. package/corpus/templates/mail/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  193. package/corpus/templates/mail/.agents/skills/self-modifying-code/SKILL.md +9 -6
  194. package/corpus/templates/plan/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  195. package/corpus/templates/plan/.agents/skills/self-modifying-code/SKILL.md +9 -6
  196. package/corpus/templates/slides/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  197. package/corpus/templates/slides/.agents/skills/self-modifying-code/SKILL.md +9 -6
  198. package/corpus/templates/tasks/.agents/skills/agent-native-docs/SKILL.md +15 -13
  199. package/corpus/templates/tasks/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  200. package/corpus/templates/tasks/.agents/skills/self-modifying-code/SKILL.md +9 -6
  201. package/corpus/toolkit/CHANGELOG.md +6 -0
  202. package/corpus/toolkit/agent-native.eject.json +411 -0
  203. package/corpus/toolkit/package.json +5 -2
  204. package/dist/cli/eject.d.ts +21 -0
  205. package/dist/cli/eject.d.ts.map +1 -0
  206. package/dist/cli/eject.js +1145 -0
  207. package/dist/cli/eject.js.map +1 -0
  208. package/dist/cli/index.js +15 -0
  209. package/dist/cli/index.js.map +1 -1
  210. package/dist/client/build-compatibility.d.ts +11 -0
  211. package/dist/client/build-compatibility.d.ts.map +1 -0
  212. package/dist/client/build-compatibility.js +56 -0
  213. package/dist/client/build-compatibility.js.map +1 -0
  214. package/dist/client/index.d.ts +1 -1
  215. package/dist/client/index.d.ts.map +1 -1
  216. package/dist/client/index.js +1 -1
  217. package/dist/client/index.js.map +1 -1
  218. package/dist/client/resources/McpConnectionSuggestion.d.ts +4 -3
  219. package/dist/client/resources/McpConnectionSuggestion.d.ts.map +1 -1
  220. package/dist/client/resources/McpConnectionSuggestion.js +3 -3
  221. package/dist/client/resources/McpConnectionSuggestion.js.map +1 -1
  222. package/dist/client/resources/McpIntegrationDialog.d.ts +4 -3
  223. package/dist/client/resources/McpIntegrationDialog.d.ts.map +1 -1
  224. package/dist/client/resources/McpIntegrationDialog.js +2 -2
  225. package/dist/client/resources/McpIntegrationDialog.js.map +1 -1
  226. package/dist/client/resources/ResourcesPanel.d.ts +4 -1
  227. package/dist/client/resources/ResourcesPanel.d.ts.map +1 -1
  228. package/dist/client/resources/ResourcesPanel.js +9 -7
  229. package/dist/client/resources/ResourcesPanel.js.map +1 -1
  230. package/dist/client/resources/index.d.ts +3 -0
  231. package/dist/client/resources/index.d.ts.map +1 -1
  232. package/dist/client/resources/index.js +3 -0
  233. package/dist/client/resources/index.js.map +1 -1
  234. package/dist/client/resources/mcp-integration-catalog.d.ts +2 -1
  235. package/dist/client/resources/mcp-integration-catalog.d.ts.map +1 -1
  236. package/dist/client/resources/mcp-integration-catalog.js +6 -2
  237. package/dist/client/resources/mcp-integration-catalog.js.map +1 -1
  238. package/dist/client/resources/runtime.d.ts +2 -0
  239. package/dist/client/resources/runtime.d.ts.map +1 -0
  240. package/dist/client/resources/runtime.js +2 -0
  241. package/dist/client/resources/runtime.js.map +1 -0
  242. package/dist/client/route-chunk-recovery/index.d.ts +1 -0
  243. package/dist/client/route-chunk-recovery/index.d.ts.map +1 -1
  244. package/dist/client/route-chunk-recovery/index.js +1 -0
  245. package/dist/client/route-chunk-recovery/index.js.map +1 -1
  246. package/dist/client/setup-connections/catalog.d.ts +2 -0
  247. package/dist/client/setup-connections/catalog.d.ts.map +1 -0
  248. package/dist/client/setup-connections/catalog.js +7 -0
  249. package/dist/client/setup-connections/catalog.js.map +1 -0
  250. package/dist/client/setup-connections/index.d.ts +1 -0
  251. package/dist/client/setup-connections/index.d.ts.map +1 -1
  252. package/dist/client/setup-connections/index.js +1 -0
  253. package/dist/client/setup-connections/index.js.map +1 -1
  254. package/dist/client/setup-connections/runtime.d.ts +2 -0
  255. package/dist/client/setup-connections/runtime.d.ts.map +1 -0
  256. package/dist/client/setup-connections/runtime.js +2 -0
  257. package/dist/client/setup-connections/runtime.js.map +1 -0
  258. package/dist/client/use-action.d.ts.map +1 -1
  259. package/dist/client/use-action.js +19 -1
  260. package/dist/client/use-action.js.map +1 -1
  261. package/dist/collab/awareness.d.ts +2 -2
  262. package/dist/collab/awareness.d.ts.map +1 -1
  263. package/dist/collab/struct-routes.d.ts +1 -1
  264. package/dist/connections/catalog.d.ts +5 -3
  265. package/dist/connections/catalog.d.ts.map +1 -1
  266. package/dist/connections/catalog.js +16 -8
  267. package/dist/connections/catalog.js.map +1 -1
  268. package/dist/connections/index.d.ts +1 -1
  269. package/dist/connections/index.d.ts.map +1 -1
  270. package/dist/connections/index.js +1 -1
  271. package/dist/connections/index.js.map +1 -1
  272. package/dist/connections/runtime.d.ts +2 -0
  273. package/dist/connections/runtime.d.ts.map +1 -0
  274. package/dist/connections/runtime.js +2 -0
  275. package/dist/connections/runtime.js.map +1 -0
  276. package/dist/deploy/build.js +2 -1
  277. package/dist/deploy/build.js.map +1 -1
  278. package/dist/eject/provider-api-definitions.d.ts +34 -0
  279. package/dist/eject/provider-api-definitions.d.ts.map +1 -0
  280. package/dist/eject/provider-api-definitions.js +88 -0
  281. package/dist/eject/provider-api-definitions.js.map +1 -0
  282. package/dist/eject/remote-mcp-presets.d.ts +17 -0
  283. package/dist/eject/remote-mcp-presets.d.ts.map +1 -0
  284. package/dist/eject/remote-mcp-presets.js +81 -0
  285. package/dist/eject/remote-mcp-presets.js.map +1 -0
  286. package/dist/eject/setup-readiness-ui.d.ts +7 -0
  287. package/dist/eject/setup-readiness-ui.d.ts.map +1 -0
  288. package/dist/eject/setup-readiness-ui.js +13 -0
  289. package/dist/eject/setup-readiness-ui.js.map +1 -0
  290. package/dist/eject/workspace-connections.d.ts +11 -0
  291. package/dist/eject/workspace-connections.d.ts.map +1 -0
  292. package/dist/eject/workspace-connections.js +47 -0
  293. package/dist/eject/workspace-connections.js.map +1 -0
  294. package/dist/file-upload/actions/upload-image.d.ts +1 -1
  295. package/dist/index.d.ts +1 -1
  296. package/dist/index.d.ts.map +1 -1
  297. package/dist/index.js +1 -1
  298. package/dist/index.js.map +1 -1
  299. package/dist/integrations/adapter-overrides.d.ts +3 -0
  300. package/dist/integrations/adapter-overrides.d.ts.map +1 -0
  301. package/dist/integrations/adapter-overrides.js +7 -0
  302. package/dist/integrations/adapter-overrides.js.map +1 -0
  303. package/dist/integrations/eject/messaging-adapters.d.ts +12 -0
  304. package/dist/integrations/eject/messaging-adapters.d.ts.map +1 -0
  305. package/dist/integrations/eject/messaging-adapters.js +49 -0
  306. package/dist/integrations/eject/messaging-adapters.js.map +1 -0
  307. package/dist/integrations/index.d.ts +3 -2
  308. package/dist/integrations/index.d.ts.map +1 -1
  309. package/dist/integrations/index.js +2 -1
  310. package/dist/integrations/index.js.map +1 -1
  311. package/dist/integrations/plugin.d.ts +32 -1
  312. package/dist/integrations/plugin.d.ts.map +1 -1
  313. package/dist/integrations/plugin.js +19 -12
  314. package/dist/integrations/plugin.js.map +1 -1
  315. package/dist/integrations/runtime.d.ts +2 -0
  316. package/dist/integrations/runtime.d.ts.map +1 -0
  317. package/dist/integrations/runtime.js +2 -0
  318. package/dist/integrations/runtime.js.map +1 -0
  319. package/dist/integrations/types.d.ts +3 -1
  320. package/dist/integrations/types.d.ts.map +1 -1
  321. package/dist/integrations/types.js.map +1 -1
  322. package/dist/notifications/routes.d.ts +2 -2
  323. package/dist/observability/routes.d.ts +5 -5
  324. package/dist/org/context.d.ts +4 -2
  325. package/dist/org/context.d.ts.map +1 -1
  326. package/dist/org/context.js +44 -22
  327. package/dist/org/context.js.map +1 -1
  328. package/dist/package-lifecycle/eject-manifest.d.ts +43 -0
  329. package/dist/package-lifecycle/eject-manifest.d.ts.map +1 -0
  330. package/dist/package-lifecycle/eject-manifest.js +219 -0
  331. package/dist/package-lifecycle/eject-manifest.js.map +1 -0
  332. package/dist/package-lifecycle/index.d.ts +1 -0
  333. package/dist/package-lifecycle/index.d.ts.map +1 -1
  334. package/dist/package-lifecycle/index.js +1 -0
  335. package/dist/package-lifecycle/index.js.map +1 -1
  336. package/dist/provider-api/actions/custom-provider-registration.d.ts +11 -11
  337. package/dist/provider-api/actions/provider-api.d.ts +11 -11
  338. package/dist/provider-api/index.d.ts +6 -2
  339. package/dist/provider-api/index.d.ts.map +1 -1
  340. package/dist/provider-api/index.js +25 -12
  341. package/dist/provider-api/index.js.map +1 -1
  342. package/dist/provider-api/runtime.d.ts +2 -0
  343. package/dist/provider-api/runtime.d.ts.map +1 -0
  344. package/dist/provider-api/runtime.js +2 -0
  345. package/dist/provider-api/runtime.js.map +1 -0
  346. package/dist/resources/handlers.d.ts +1 -1
  347. package/dist/server/action-routes.d.ts.map +1 -1
  348. package/dist/server/action-routes.js +32 -2
  349. package/dist/server/action-routes.js.map +1 -1
  350. package/dist/server/auth-plugin.d.ts.map +1 -1
  351. package/dist/server/auth-plugin.js +9 -5
  352. package/dist/server/auth-plugin.js.map +1 -1
  353. package/dist/server/better-auth-instance.d.ts.map +1 -1
  354. package/dist/server/better-auth-instance.js +4 -1
  355. package/dist/server/better-auth-instance.js.map +1 -1
  356. package/dist/setup-connections/index.d.ts +1 -1
  357. package/dist/setup-connections/index.d.ts.map +1 -1
  358. package/dist/setup-connections/index.js +1 -1
  359. package/dist/setup-connections/index.js.map +1 -1
  360. package/dist/shared/mcp-embed-headers.d.ts +1 -1
  361. package/dist/shared/mcp-embed-headers.d.ts.map +1 -1
  362. package/dist/shared/mcp-embed-headers.js +1 -1
  363. package/dist/shared/mcp-embed-headers.js.map +1 -1
  364. package/dist/shared/merge-by-id.d.ts +5 -0
  365. package/dist/shared/merge-by-id.d.ts.map +1 -0
  366. package/dist/shared/merge-by-id.js +7 -0
  367. package/dist/shared/merge-by-id.js.map +1 -0
  368. package/dist/templates/chat/.agents/skills/agent-native-docs/SKILL.md +15 -13
  369. package/dist/templates/chat/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  370. package/dist/templates/chat/.agents/skills/self-modifying-code/SKILL.md +9 -6
  371. package/dist/templates/chat/AGENTS.md +3 -2
  372. package/dist/templates/default/.agents/skills/agent-native-docs/SKILL.md +15 -13
  373. package/dist/templates/default/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  374. package/dist/templates/default/.agents/skills/self-modifying-code/SKILL.md +9 -6
  375. package/dist/templates/default/AGENTS.md +6 -5
  376. package/dist/templates/headless/.agents/skills/agent-native-docs/SKILL.md +15 -13
  377. package/dist/templates/headless/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  378. package/dist/templates/headless/AGENTS.md +5 -4
  379. package/dist/templates/workspace-core/.agents/skills/agent-native-docs/SKILL.md +15 -13
  380. package/dist/templates/workspace-core/.agents/skills/agent-native-toolkit/SKILL.md +3 -2
  381. package/dist/templates/workspace-core/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  382. package/dist/templates/workspace-core/.agents/skills/self-modifying-code/SKILL.md +9 -6
  383. package/dist/templates/workspace-core/AGENTS.md +4 -4
  384. package/dist/templates/workspace-root/AGENTS.md +4 -4
  385. package/dist/vite/client.d.ts +6 -0
  386. package/dist/vite/client.d.ts.map +1 -1
  387. package/dist/vite/client.js +30 -2
  388. package/dist/vite/client.js.map +1 -1
  389. package/docs/content/agent-native-toolkit.mdx +38 -0
  390. package/docs/content/package-lifecycle.mdx +54 -4
  391. package/package.json +15 -2
  392. package/src/a2a/agent-card.ts +83 -0
  393. package/src/a2a/artifact-response.ts +1648 -0
  394. package/src/a2a/auth-policy.ts +66 -0
  395. package/src/a2a/caller-auth.ts +102 -0
  396. package/src/a2a/client.ts +876 -0
  397. package/src/a2a/correlation.ts +50 -0
  398. package/src/a2a/handlers.ts +1285 -0
  399. package/src/a2a/index.ts +50 -0
  400. package/src/a2a/invoke.ts +348 -0
  401. package/src/a2a/response-text.ts +53 -0
  402. package/src/a2a/server.ts +586 -0
  403. package/src/a2a/task-store.ts +917 -0
  404. package/src/a2a/types.ts +221 -0
  405. package/src/a2a-claims.ts +52 -0
  406. package/src/action-change-marker.ts +74 -0
  407. package/src/action-ui.ts +38 -0
  408. package/src/action.ts +1406 -0
  409. package/src/adapters/cli/index.ts +6 -0
  410. package/src/adapters/cli/registry.ts +73 -0
  411. package/src/adapters/cli/shell-adapter.ts +92 -0
  412. package/src/adapters/cli/types.ts +27 -0
  413. package/src/agent/action-continuation-guidance.ts +38 -0
  414. package/src/agent/app-model-defaults.ts +201 -0
  415. package/src/agent/context-xray/actions/context-evict.ts +56 -0
  416. package/src/agent/context-xray/actions/context-manifest-get.ts +75 -0
  417. package/src/agent/context-xray/actions/context-pin.ts +56 -0
  418. package/src/agent/context-xray/actions/context-preview-get.ts +134 -0
  419. package/src/agent/context-xray/actions/context-report.ts +75 -0
  420. package/src/agent/context-xray/actions/context-restore.ts +51 -0
  421. package/src/agent/context-xray/actions/errors.ts +40 -0
  422. package/src/agent/context-xray/apply-directives.ts +137 -0
  423. package/src/agent/context-xray/directives-store.ts +178 -0
  424. package/src/agent/context-xray/identity.ts +37 -0
  425. package/src/agent/context-xray/manifest.ts +284 -0
  426. package/src/agent/context-xray/migrations.ts +32 -0
  427. package/src/agent/context-xray/plugin.ts +23 -0
  428. package/src/agent/context-xray/schema.ts +17 -0
  429. package/src/agent/context-xray/segments.ts +194 -0
  430. package/src/agent/context-xray/tokenize.ts +93 -0
  431. package/src/agent/default-model.ts +5 -0
  432. package/src/agent/durable-background.ts +547 -0
  433. package/src/agent/engine/ai-sdk-engine.ts +565 -0
  434. package/src/agent/engine/anthropic-engine.ts +320 -0
  435. package/src/agent/engine/builder-engine.ts +1110 -0
  436. package/src/agent/engine/builder-gateway-headers.ts +44 -0
  437. package/src/agent/engine/builtin.ts +122 -0
  438. package/src/agent/engine/context-directives-transform.ts +73 -0
  439. package/src/agent/engine/continuation-dispatch-retry.ts +168 -0
  440. package/src/agent/engine/credential-errors.ts +69 -0
  441. package/src/agent/engine/index.ts +54 -0
  442. package/src/agent/engine/openai-compatible-endpoint.ts +25 -0
  443. package/src/agent/engine/output-tokens.ts +181 -0
  444. package/src/agent/engine/provider-env-vars.ts +69 -0
  445. package/src/agent/engine/registry.ts +853 -0
  446. package/src/agent/engine/tool-call-journal-seed.ts +85 -0
  447. package/src/agent/engine/translate-ai-sdk.ts +407 -0
  448. package/src/agent/engine/translate-anthropic.ts +611 -0
  449. package/src/agent/engine/types.ts +310 -0
  450. package/src/agent/harness/acp-adapter.ts +893 -0
  451. package/src/agent/harness/acp-builtin.ts +70 -0
  452. package/src/agent/harness/ai-sdk-adapter.ts +509 -0
  453. package/src/agent/harness/background.ts +365 -0
  454. package/src/agent/harness/builtin.ts +50 -0
  455. package/src/agent/harness/index.ts +86 -0
  456. package/src/agent/harness/lifecycle.ts +498 -0
  457. package/src/agent/harness/registry.ts +97 -0
  458. package/src/agent/harness/runner.ts +182 -0
  459. package/src/agent/harness/store.ts +466 -0
  460. package/src/agent/harness/translate.ts +130 -0
  461. package/src/agent/harness/types.ts +129 -0
  462. package/src/agent/index.ts +32 -0
  463. package/src/agent/loop-settings.ts +186 -0
  464. package/src/agent/model-config.ts +363 -0
  465. package/src/agent/observational-memory/compactor.ts +78 -0
  466. package/src/agent/observational-memory/config.ts +78 -0
  467. package/src/agent/observational-memory/index.ts +79 -0
  468. package/src/agent/observational-memory/internal-run.ts +89 -0
  469. package/src/agent/observational-memory/message-text.ts +49 -0
  470. package/src/agent/observational-memory/migrations.ts +44 -0
  471. package/src/agent/observational-memory/observer.ts +128 -0
  472. package/src/agent/observational-memory/plugin.ts +35 -0
  473. package/src/agent/observational-memory/prompts.ts +53 -0
  474. package/src/agent/observational-memory/read.ts +131 -0
  475. package/src/agent/observational-memory/reflector.ts +119 -0
  476. package/src/agent/observational-memory/schema.ts +48 -0
  477. package/src/agent/observational-memory/store.ts +275 -0
  478. package/src/agent/observational-memory/types.ts +65 -0
  479. package/src/agent/processors.ts +209 -0
  480. package/src/agent/production-agent.ts +8254 -0
  481. package/src/agent/run-loop-with-resume.ts +394 -0
  482. package/src/agent/run-manager.ts +1825 -0
  483. package/src/agent/run-ownership.ts +75 -0
  484. package/src/agent/run-store.ts +2601 -0
  485. package/src/agent/runtime-context.ts +169 -0
  486. package/src/agent/thread-data-builder.ts +1584 -0
  487. package/src/agent/tool-call-journal.ts +368 -0
  488. package/src/agent/tool-error-redaction.ts +52 -0
  489. package/src/agent/tool-result-images.ts +178 -0
  490. package/src/agent/tool-search.ts +376 -0
  491. package/src/agent/types.ts +372 -0
  492. package/src/agent-native/index.ts +198 -0
  493. package/src/agent-web/config.ts +253 -0
  494. package/src/agent-web/generator.ts +382 -0
  495. package/src/agent-web/index.ts +36 -0
  496. package/src/appearance/actions/change-appearance.ts +35 -0
  497. package/src/application-state/emitter.ts +81 -0
  498. package/src/application-state/handlers.ts +121 -0
  499. package/src/application-state/index.ts +44 -0
  500. package/src/application-state/script-helpers.ts +155 -0
  501. package/src/application-state/store.ts +274 -0
  502. package/src/assets/branding/agent-native.icon/Assets/background.svg +3 -0
  503. package/src/assets/branding/agent-native.icon/Assets/foreground.svg +12 -0
  504. package/src/assets/branding/agent-native.icon/icon.json +49 -0
  505. package/src/assets/branding/favicon.png +0 -0
  506. package/src/assets/branding/favicon.svg +1 -0
  507. package/src/assets/branding/icon-on-dark.svg +10 -0
  508. package/src/assets/branding/icon-on-light.svg +10 -0
  509. package/src/assets/branding/mac-app-icon.svg +1 -0
  510. package/src/assets/branding/slack-bot/agent-native-1024.png +0 -0
  511. package/src/assets/branding/slack-bot/agent-native-512.png +0 -0
  512. package/src/assets/branding/tray-icon.svg +6 -0
  513. package/src/assets/branding/wordmark-on-dark.svg +21 -0
  514. package/src/assets/branding/wordmark-on-light.svg +21 -0
  515. package/src/assets/fonts/LICENSE_LIBERATION +96 -0
  516. package/src/assets/fonts/LICENSE_NOTO_NASKH_ARABIC +93 -0
  517. package/src/assets/fonts/LiberationSans-Bold.ttf +0 -0
  518. package/src/assets/fonts/LiberationSans-Regular.ttf +0 -0
  519. package/src/assets/fonts/NotoNaskhArabic-Variable.ttf +0 -0
  520. package/src/audit/actions/export-audit-events.ts +162 -0
  521. package/src/audit/actions/get-audit-event.ts +24 -0
  522. package/src/audit/actions/list-audit-events.ts +66 -0
  523. package/src/audit/cleanup-job.ts +100 -0
  524. package/src/audit/config.ts +90 -0
  525. package/src/audit/index.ts +43 -0
  526. package/src/audit/record.ts +180 -0
  527. package/src/audit/redact.ts +109 -0
  528. package/src/audit/store.ts +346 -0
  529. package/src/audit/types.ts +141 -0
  530. package/src/automation/index.ts +802 -0
  531. package/src/brand-kit/brand-signals.ts +124 -0
  532. package/src/brand-kit/fig/index.ts +64 -0
  533. package/src/brand-kit/index.ts +72 -0
  534. package/src/brand-kit/types.ts +113 -0
  535. package/src/browser-sessions/actions.ts +302 -0
  536. package/src/browser-sessions/routes.ts +234 -0
  537. package/src/browser-sessions/store.ts +679 -0
  538. package/src/browser-sessions/types.ts +84 -0
  539. package/src/changelog/parse.ts +328 -0
  540. package/src/chat-threads/emitter.ts +22 -0
  541. package/src/chat-threads/schema.ts +43 -0
  542. package/src/chat-threads/store.ts +1311 -0
  543. package/src/checkpoints/index.ts +15 -0
  544. package/src/checkpoints/service.ts +142 -0
  545. package/src/checkpoints/store.ts +153 -0
  546. package/src/cli/add.ts +425 -0
  547. package/src/cli/agent.ts +424 -0
  548. package/src/cli/agents.ts +122 -0
  549. package/src/cli/app-skill.ts +1455 -0
  550. package/src/cli/atomic-json-file.ts +324 -0
  551. package/src/cli/audit-agent-web.ts +324 -0
  552. package/src/cli/changelog.ts +199 -0
  553. package/src/cli/claude-code-participant.ts +515 -0
  554. package/src/cli/code-agent-commands.ts +270 -0
  555. package/src/cli/code-agent-connector.ts +1109 -0
  556. package/src/cli/code-agent-executor.ts +1970 -0
  557. package/src/cli/code-agent-output-smoother.ts +140 -0
  558. package/src/cli/code-agent-runs.concurrent-worker.ts +33 -0
  559. package/src/cli/code-agent-runs.ts +548 -0
  560. package/src/cli/code.ts +1805 -0
  561. package/src/cli/codex-cli-participant.ts +496 -0
  562. package/src/cli/connect.ts +2714 -0
  563. package/src/cli/content-local.ts +442 -0
  564. package/src/cli/context-xray-local.ts +2193 -0
  565. package/src/cli/create-workspace.ts +30 -0
  566. package/src/cli/create.ts +2247 -0
  567. package/src/cli/deploy-build.ts +50 -0
  568. package/src/cli/design-connect.ts +3187 -0
  569. package/src/cli/doctor.ts +472 -0
  570. package/src/cli/eject.ts +1594 -0
  571. package/src/cli/eval.ts +134 -0
  572. package/src/cli/gateway-helpers.ts +70 -0
  573. package/src/cli/index.ts +1217 -0
  574. package/src/cli/info.ts +105 -0
  575. package/src/cli/invoke.ts +288 -0
  576. package/src/cli/mcp-config-writers.ts +857 -0
  577. package/src/cli/mcp.ts +594 -0
  578. package/src/cli/migrate.ts +1813 -0
  579. package/src/cli/migration-codemod.ts +646 -0
  580. package/src/cli/multi-frontier-runs.ts +1952 -0
  581. package/src/cli/package-lifecycle.ts +823 -0
  582. package/src/cli/plan-blocks.ts +143 -0
  583. package/src/cli/plan-local.ts +3189 -0
  584. package/src/cli/plan-publish-store.ts +138 -0
  585. package/src/cli/pr-visual-recap-workflow.ts +2 -0
  586. package/src/cli/recap.ts +5 -0
  587. package/src/cli/setup-agents.ts +120 -0
  588. package/src/cli/skills-content/assets-skill.ts +83 -0
  589. package/src/cli/skills-content/canvas.ts +153 -0
  590. package/src/cli/skills-content/connection.ts +52 -0
  591. package/src/cli/skills-content/content-skill.ts +120 -0
  592. package/src/cli/skills-content/design-exploration-skill.ts +118 -0
  593. package/src/cli/skills-content/design-visual-edit-skill.ts +228 -0
  594. package/src/cli/skills-content/document-quality.ts +196 -0
  595. package/src/cli/skills-content/exemplar.ts +69 -0
  596. package/src/cli/skills-content/help.ts +77 -0
  597. package/src/cli/skills-content/index.ts +22 -0
  598. package/src/cli/skills-content/local-files.ts +100 -0
  599. package/src/cli/skills-content/plan-setup-auth.ts +80 -0
  600. package/src/cli/skills-content/visual-plan-skill.ts +493 -0
  601. package/src/cli/skills-content/visual-recap-skill.ts +553 -0
  602. package/src/cli/skills-content/visualize-repo-skill.ts +93 -0
  603. package/src/cli/skills-content/wireframe.ts +349 -0
  604. package/src/cli/skills.ts +4340 -0
  605. package/src/cli/sync-builder-starter-manifest.ts +631 -0
  606. package/src/cli/telemetry.ts +136 -0
  607. package/src/cli/templates-meta.ts +269 -0
  608. package/src/cli/upgrade.ts +956 -0
  609. package/src/cli/visualize-repo.ts +715 -0
  610. package/src/cli/workspace-dev.ts +1486 -0
  611. package/src/cli/workspacify.ts +258 -0
  612. package/src/client/AgentAskPopover.tsx +89 -0
  613. package/src/client/AgentChatHome.tsx +66 -0
  614. package/src/client/AgentNative.tsx +161 -0
  615. package/src/client/AgentNativeEmbedded.tsx +288 -0
  616. package/src/client/AgentNativeFrame.tsx +151 -0
  617. package/src/client/AgentPanel.tsx +3437 -0
  618. package/src/client/AgentTaskCard.tsx +273 -0
  619. package/src/client/AppearancePicker.tsx +79 -0
  620. package/src/client/AssistantChat.tsx +5793 -0
  621. package/src/client/ClientOnly.tsx +22 -0
  622. package/src/client/CommandMenu.tsx +726 -0
  623. package/src/client/ConnectBuilderCard.tsx +390 -0
  624. package/src/client/DefaultSpinner.tsx +47 -0
  625. package/src/client/ErrorBoundary.tsx +359 -0
  626. package/src/client/ErrorReportActions.tsx +69 -0
  627. package/src/client/FeedbackButton.tsx +553 -0
  628. package/src/client/HighlightedCodeBlock.tsx +173 -0
  629. package/src/client/IframeEmbed.tsx +151 -0
  630. package/src/client/KeepTabOpenNotice.tsx +181 -0
  631. package/src/client/MultiTabAssistantChat.tsx +2576 -0
  632. package/src/client/NewWorkspaceAppFlow.tsx +525 -0
  633. package/src/client/PoweredByBadge.tsx +284 -0
  634. package/src/client/RunStuckBanner.tsx +431 -0
  635. package/src/client/StarfieldBackground.tsx +466 -0
  636. package/src/client/Turnstile.tsx +125 -0
  637. package/src/client/active-run-state.ts +139 -0
  638. package/src/client/agent-chat/index.ts +279 -0
  639. package/src/client/agent-chat-adapter.ts +3692 -0
  640. package/src/client/agent-chat.ts +1233 -0
  641. package/src/client/agent-engine-key.ts +122 -0
  642. package/src/client/agent-page/AgentContextTab.tsx +487 -0
  643. package/src/client/agent-page/AgentEmptyState.tsx +44 -0
  644. package/src/client/agent-page/AgentJobsTab.tsx +441 -0
  645. package/src/client/agent-page/AgentTabFrame.tsx +39 -0
  646. package/src/client/agent-page/AgentTabsPage.tsx +1096 -0
  647. package/src/client/agent-page/types.ts +18 -0
  648. package/src/client/agent-page/use-jobs.ts +150 -0
  649. package/src/client/agent-sidebar-state.ts +166 -0
  650. package/src/client/analytics/index.ts +40 -0
  651. package/src/client/analytics-session.ts +70 -0
  652. package/src/client/analytics.ts +1757 -0
  653. package/src/client/api-path.ts +124 -0
  654. package/src/client/app-providers.tsx +230 -0
  655. package/src/client/appearance.ts +130 -0
  656. package/src/client/application-state.ts +154 -0
  657. package/src/client/assistant-ui-recovery.tsx +205 -0
  658. package/src/client/automation/index.ts +4 -0
  659. package/src/client/automation.ts +22 -0
  660. package/src/client/blocks/AiEditableField.tsx +30 -0
  661. package/src/client/blocks/BlockView.tsx +145 -0
  662. package/src/client/blocks/RegistryBlockDataProvider.tsx +121 -0
  663. package/src/client/blocks/SchemaBlockEditor.tsx +457 -0
  664. package/src/client/blocks/agent.ts +95 -0
  665. package/src/client/blocks/code-block-direction.ts +21 -0
  666. package/src/client/blocks/index.ts +308 -0
  667. package/src/client/blocks/library/AnnotatedCodeBlock.tsx +710 -0
  668. package/src/client/blocks/library/ApiEndpointBlock.tsx +1120 -0
  669. package/src/client/blocks/library/DataModelBlock.tsx +775 -0
  670. package/src/client/blocks/library/DiffBlock.tsx +1854 -0
  671. package/src/client/blocks/library/FileTreeBlock.tsx +868 -0
  672. package/src/client/blocks/library/HighlightedCode.tsx +260 -0
  673. package/src/client/blocks/library/JsonExplorerBlock.tsx +608 -0
  674. package/src/client/blocks/library/MermaidBlock.tsx +362 -0
  675. package/src/client/blocks/library/OpenApiSpecBlock.tsx +998 -0
  676. package/src/client/blocks/library/annotated-code.config.ts +101 -0
  677. package/src/client/blocks/library/annotation-rail.tsx +1020 -0
  678. package/src/client/blocks/library/api-endpoint.config.ts +207 -0
  679. package/src/client/blocks/library/block-copy.ts +399 -0
  680. package/src/client/blocks/library/callout.config.ts +57 -0
  681. package/src/client/blocks/library/callout.tsx +149 -0
  682. package/src/client/blocks/library/checklist.config.ts +56 -0
  683. package/src/client/blocks/library/checklist.tsx +208 -0
  684. package/src/client/blocks/library/code-filename-label.tsx +59 -0
  685. package/src/client/blocks/library/code-highlight.tsx +178 -0
  686. package/src/client/blocks/library/code-tabs.config.ts +70 -0
  687. package/src/client/blocks/library/code-tabs.tsx +606 -0
  688. package/src/client/blocks/library/code.config.ts +69 -0
  689. package/src/client/blocks/library/code.tsx +440 -0
  690. package/src/client/blocks/library/columns.config.ts +85 -0
  691. package/src/client/blocks/library/columns.tsx +334 -0
  692. package/src/client/blocks/library/data-model.config.ts +152 -0
  693. package/src/client/blocks/library/dev-doc-ui.tsx +191 -0
  694. package/src/client/blocks/library/diagram.config.ts +222 -0
  695. package/src/client/blocks/library/diagram.tsx +958 -0
  696. package/src/client/blocks/library/diff.config.ts +115 -0
  697. package/src/client/blocks/library/file-tree.config.ts +92 -0
  698. package/src/client/blocks/library/html.config.ts +79 -0
  699. package/src/client/blocks/library/html.tsx +258 -0
  700. package/src/client/blocks/library/json-explorer.config.ts +74 -0
  701. package/src/client/blocks/library/mermaid.config.ts +49 -0
  702. package/src/client/blocks/library/narrow-container.tsx +37 -0
  703. package/src/client/blocks/library/openapi-spec.config.ts +66 -0
  704. package/src/client/blocks/library/question-form.config.ts +127 -0
  705. package/src/client/blocks/library/question-form.tsx +944 -0
  706. package/src/client/blocks/library/sanitize-html.ts +343 -0
  707. package/src/client/blocks/library/server-specs.ts +338 -0
  708. package/src/client/blocks/library/specs.tsx +308 -0
  709. package/src/client/blocks/library/table.config.ts +61 -0
  710. package/src/client/blocks/library/table.tsx +449 -0
  711. package/src/client/blocks/library/tabs.config.ts +96 -0
  712. package/src/client/blocks/library/tabs.tsx +665 -0
  713. package/src/client/blocks/library/wireframe-icons.ts +210 -0
  714. package/src/client/blocks/library/wireframe-kit.tsx +1850 -0
  715. package/src/client/blocks/library/wireframe.config.ts +539 -0
  716. package/src/client/blocks/library/wireframe.tsx +535 -0
  717. package/src/client/blocks/mdx.ts +364 -0
  718. package/src/client/blocks/provider.tsx +51 -0
  719. package/src/client/blocks/registry.ts +83 -0
  720. package/src/client/blocks/schema-form/introspect.ts +201 -0
  721. package/src/client/blocks/server.ts +170 -0
  722. package/src/client/blocks/types.ts +415 -0
  723. package/src/client/browser-session-bridge.ts +548 -0
  724. package/src/client/browser-tab-id.ts +36 -0
  725. package/src/client/build-compatibility.ts +77 -0
  726. package/src/client/builder-frame.ts +194 -0
  727. package/src/client/builder-mark.tsx +21 -0
  728. package/src/client/changelog/Changelog.tsx +333 -0
  729. package/src/client/changelog/index.ts +1 -0
  730. package/src/client/chat/ChatHistoryList.tsx +7 -0
  731. package/src/client/chat/attachment-adapters.ts +426 -0
  732. package/src/client/chat/connectors.ts +1579 -0
  733. package/src/client/chat/index.ts +160 -0
  734. package/src/client/chat/markdown-renderer.tsx +693 -0
  735. package/src/client/chat/message-components.tsx +1326 -0
  736. package/src/client/chat/repo-helpers.ts +281 -0
  737. package/src/client/chat/run-recovery.tsx +994 -0
  738. package/src/client/chat/runtime.ts +1810 -0
  739. package/src/client/chat/tool-call-display.tsx +1270 -0
  740. package/src/client/chat/tool-render-registry.tsx +144 -0
  741. package/src/client/chat/use-agent-chat-lifecycle-tracking.ts +74 -0
  742. package/src/client/chat/use-reconnect-reader-owner.ts +28 -0
  743. package/src/client/chat/widgets/DataChartRenderer.tsx +242 -0
  744. package/src/client/chat/widgets/DataChartWidget.tsx +51 -0
  745. package/src/client/chat/widgets/DataInsightsWidget.tsx +59 -0
  746. package/src/client/chat/widgets/DataTableWidget.tsx +240 -0
  747. package/src/client/chat/widgets/InlineExtensionWidget.tsx +60 -0
  748. package/src/client/chat/widgets/builtin-tool-renderers.tsx +213 -0
  749. package/src/client/chat/widgets/data-widget-types.ts +1 -0
  750. package/src/client/chat/widgets/inline-extension-result.ts +86 -0
  751. package/src/client/chat-model-groups.ts +171 -0
  752. package/src/client/chat-thread-url.ts +11 -0
  753. package/src/client/chat-view-transition.ts +213 -0
  754. package/src/client/client-action.ts +21 -0
  755. package/src/client/client-bootstrap.ts +7 -0
  756. package/src/client/client-surface.ts +41 -0
  757. package/src/client/clipboard.ts +89 -0
  758. package/src/client/code-agent-chat-adapter.ts +537 -0
  759. package/src/client/collab/index.ts +60 -0
  760. package/src/client/command-navigation/index.ts +15 -0
  761. package/src/client/comments-review/index.ts +1 -0
  762. package/src/client/components/AgentPresenceChip.tsx +4 -0
  763. package/src/client/components/ApiKeySettings.tsx +309 -0
  764. package/src/client/components/CodeAgentIndicator.tsx +59 -0
  765. package/src/client/components/CodeRequiredDialog.tsx +470 -0
  766. package/src/client/components/LiveCursorOverlay.tsx +5 -0
  767. package/src/client/components/MissingKeyCard.tsx +61 -0
  768. package/src/client/components/PresenceBar.tsx +4 -0
  769. package/src/client/components/RecentEditHighlights.tsx +4 -0
  770. package/src/client/components/RemoteSelectionRings.tsx +5 -0
  771. package/src/client/components/icons/AgentNativeIcon.tsx +46 -0
  772. package/src/client/components/ui/dialog.tsx +1 -0
  773. package/src/client/components/ui/dropdown-menu.tsx +1 -0
  774. package/src/client/components/ui/hover-card.tsx +1 -0
  775. package/src/client/components/ui/message-scroller.tsx +131 -0
  776. package/src/client/components/ui/popover.tsx +1 -0
  777. package/src/client/components/ui/sheet.tsx +1 -0
  778. package/src/client/components/ui/tooltip.tsx +1 -0
  779. package/src/client/composer/index.ts +11 -0
  780. package/src/client/composer/runtime-adapters.tsx +123 -0
  781. package/src/client/composer/use-mention-search.ts +7 -0
  782. package/src/client/composer/wired-components.tsx +53 -0
  783. package/src/client/context-xray/ContextMeter.tsx +124 -0
  784. package/src/client/context-xray/ContextSegmentRow.tsx +27 -0
  785. package/src/client/context-xray/ContextTreemap.tsx +24 -0
  786. package/src/client/context-xray/ContextXRayPanel.tsx +59 -0
  787. package/src/client/context-xray/SegmentProvenancePopover.tsx +18 -0
  788. package/src/client/context-xray/format.ts +27 -0
  789. package/src/client/conversation/AgentConversation.tsx +555 -0
  790. package/src/client/conversation/code-agent-transcript.ts +283 -0
  791. package/src/client/conversation/index.ts +22 -0
  792. package/src/client/conversation/types.ts +85 -0
  793. package/src/client/conversation/use-near-bottom-autoscroll.ts +278 -0
  794. package/src/client/create-query-client.ts +86 -0
  795. package/src/client/db-admin/DataGrid.tsx +551 -0
  796. package/src/client/db-admin/DbAdminPage.tsx +218 -0
  797. package/src/client/db-admin/DevDatabaseLink.tsx +16 -0
  798. package/src/client/db-admin/EditableCell.tsx +451 -0
  799. package/src/client/db-admin/FilterBar.tsx +203 -0
  800. package/src/client/db-admin/ResultsGrid.tsx +114 -0
  801. package/src/client/db-admin/RowSidePanel.tsx +337 -0
  802. package/src/client/db-admin/SqlEditor.tsx +840 -0
  803. package/src/client/db-admin/TableBrowser.tsx +212 -0
  804. package/src/client/db-admin/TableEditor.tsx +760 -0
  805. package/src/client/db-admin/cell-format.ts +246 -0
  806. package/src/client/db-admin/changeset.ts +296 -0
  807. package/src/client/db-admin/export-utils.ts +78 -0
  808. package/src/client/db-admin/index.ts +33 -0
  809. package/src/client/db-admin/sql-storage.ts +134 -0
  810. package/src/client/db-admin/storage.ts +68 -0
  811. package/src/client/db-admin/useAgentSync.ts +226 -0
  812. package/src/client/db-admin/useDbAdmin.ts +294 -0
  813. package/src/client/dev-overlay/DevOverlay.tsx +576 -0
  814. package/src/client/dev-overlay/builtins.ts +40 -0
  815. package/src/client/dev-overlay/index.ts +23 -0
  816. package/src/client/dev-overlay/registry.ts +67 -0
  817. package/src/client/dev-overlay/types.ts +64 -0
  818. package/src/client/dev-overlay/use-dev-option.ts +78 -0
  819. package/src/client/dev-overlay/use-dev-overlay-shortcut.ts +31 -0
  820. package/src/client/dynamic-suggestions.ts +455 -0
  821. package/src/client/embed-auth.ts +544 -0
  822. package/src/client/embed.ts +54 -0
  823. package/src/client/error-capture.ts +690 -0
  824. package/src/client/error-format.ts +211 -0
  825. package/src/client/error-reporting.ts +100 -0
  826. package/src/client/extensions/AgentNativeExtensionFrame.e2e-host.tsx +136 -0
  827. package/src/client/extensions/AgentNativeExtensionFrame.tsx +708 -0
  828. package/src/client/extensions/EmbeddedExtension.tsx +604 -0
  829. package/src/client/extensions/ExtensionEditor.tsx +450 -0
  830. package/src/client/extensions/ExtensionQueryErrorState.tsx +47 -0
  831. package/src/client/extensions/ExtensionSlot.tsx +345 -0
  832. package/src/client/extensions/ExtensionViewer.tsx +1502 -0
  833. package/src/client/extensions/ExtensionViewerPage.tsx +32 -0
  834. package/src/client/extensions/ExtensionsListPage.tsx +432 -0
  835. package/src/client/extensions/ExtensionsSidebarSection.tsx +1259 -0
  836. package/src/client/extensions/InlineExtensionFrame.tsx +660 -0
  837. package/src/client/extensions/agent-native-extension-runtime.ts +495 -0
  838. package/src/client/extensions/delete-extension.ts +76 -0
  839. package/src/client/extensions/extension-load-error.ts +26 -0
  840. package/src/client/extensions/extension-order.ts +49 -0
  841. package/src/client/extensions/extension-popularity.ts +61 -0
  842. package/src/client/extensions/iframe-bridge.ts +377 -0
  843. package/src/client/extensions/index.ts +84 -0
  844. package/src/client/extensions/portable-extension.ts +712 -0
  845. package/src/client/feature-flags/FeatureFlagsPanel.tsx +519 -0
  846. package/src/client/feature-flags/helpers.ts +77 -0
  847. package/src/client/feature-flags/index.ts +13 -0
  848. package/src/client/feature-flags/types.ts +29 -0
  849. package/src/client/feature-flags/use-feature-flag.ts +26 -0
  850. package/src/client/feedback-context.ts +90 -0
  851. package/src/client/frame-protocol.ts +168 -0
  852. package/src/client/frame.ts +329 -0
  853. package/src/client/guided-questions.tsx +1152 -0
  854. package/src/client/history/VersionHistoryPanel.tsx +175 -0
  855. package/src/client/history/index.ts +21 -0
  856. package/src/client/history/use-history.ts +114 -0
  857. package/src/client/hooks/index.ts +46 -0
  858. package/src/client/host/index.ts +170 -0
  859. package/src/client/host-bridge.ts +1272 -0
  860. package/src/client/host-tools.ts +190 -0
  861. package/src/client/i18n.tsx +798 -0
  862. package/src/client/index.ts +370 -0
  863. package/src/client/integrations/IntegrationCard.tsx +186 -0
  864. package/src/client/integrations/IntegrationsPanel.tsx +633 -0
  865. package/src/client/integrations/api.ts +295 -0
  866. package/src/client/integrations/index.ts +29 -0
  867. package/src/client/integrations/useIntegrationStatus.ts +52 -0
  868. package/src/client/mcp-app-host.ts +720 -0
  869. package/src/client/mcp-apps/McpAppRenderer.tsx +760 -0
  870. package/src/client/navigation/index.ts +54 -0
  871. package/src/client/notifications/NotificationsBell.tsx +383 -0
  872. package/src/client/notifications/index.ts +1 -0
  873. package/src/client/observability/ObservabilityDashboard.tsx +890 -0
  874. package/src/client/observability/ThumbsFeedback.tsx +160 -0
  875. package/src/client/observability/index.ts +20 -0
  876. package/src/client/observability/useObservability.ts +266 -0
  877. package/src/client/onboarding/OnboardingBanner.tsx +73 -0
  878. package/src/client/onboarding/OnboardingPanel.tsx +1036 -0
  879. package/src/client/onboarding/SetupButton.tsx +64 -0
  880. package/src/client/onboarding/index.ts +25 -0
  881. package/src/client/onboarding/use-onboarding.ts +164 -0
  882. package/src/client/onboarding/use-preview-mode.ts +40 -0
  883. package/src/client/org/InvitationBanner.tsx +148 -0
  884. package/src/client/org/OrgSwitcher.tsx +754 -0
  885. package/src/client/org/RequireActiveOrg.tsx +337 -0
  886. package/src/client/org/TeamPage.tsx +1432 -0
  887. package/src/client/org/hooks.ts +359 -0
  888. package/src/client/org/index.ts +70 -0
  889. package/src/client/org/workspace-app-links.ts +367 -0
  890. package/src/client/org-team/index.ts +1 -0
  891. package/src/client/progress/RunsTray.tsx +680 -0
  892. package/src/client/progress/index.ts +1 -0
  893. package/src/client/require-session.tsx +142 -0
  894. package/src/client/resources/BuiltinCapabilityDetail.tsx +258 -0
  895. package/src/client/resources/McpConnectionSuggestion.tsx +276 -0
  896. package/src/client/resources/McpIntegrationDialog.tsx +808 -0
  897. package/src/client/resources/McpServerDetail.tsx +230 -0
  898. package/src/client/resources/ResourceEditor.tsx +872 -0
  899. package/src/client/resources/ResourceTree.tsx +860 -0
  900. package/src/client/resources/ResourcesPanel.tsx +1960 -0
  901. package/src/client/resources/index.ts +25 -0
  902. package/src/client/resources/mcp-integration-catalog.ts +771 -0
  903. package/src/client/resources/mcp-integration-logos.ts +108 -0
  904. package/src/client/resources/runtime.ts +1 -0
  905. package/src/client/resources/use-builtin-capabilities.ts +113 -0
  906. package/src/client/resources/use-mcp-servers.ts +217 -0
  907. package/src/client/resources/use-resources.ts +402 -0
  908. package/src/client/review/ReviewCommentComposer.tsx +123 -0
  909. package/src/client/review/ReviewStatusBadge.tsx +39 -0
  910. package/src/client/review/ReviewThreadPanel.tsx +625 -0
  911. package/src/client/review/index.ts +38 -0
  912. package/src/client/review/use-review.ts +186 -0
  913. package/src/client/route-chunk-recovery/index.ts +2 -0
  914. package/src/client/route-chunk-recovery.ts +331 -0
  915. package/src/client/route-state.ts +455 -0
  916. package/src/client/route-warmup.tsx +543 -0
  917. package/src/client/session-replay-iframe.e2e-host.tsx +100 -0
  918. package/src/client/session-replay.ts +3417 -0
  919. package/src/client/settings/AgentsSection.tsx +441 -0
  920. package/src/client/settings/AutomationsSection.tsx +516 -0
  921. package/src/client/settings/BackgroundAgentSection.tsx +189 -0
  922. package/src/client/settings/BrowserSection.tsx +110 -0
  923. package/src/client/settings/DemoModeSection.tsx +48 -0
  924. package/src/client/settings/SecretsSection.tsx +875 -0
  925. package/src/client/settings/SettingsPanel.tsx +3162 -0
  926. package/src/client/settings/SettingsSection.tsx +283 -0
  927. package/src/client/settings/SettingsTabsPage.tsx +592 -0
  928. package/src/client/settings/UsageSection.tsx +401 -0
  929. package/src/client/settings/VoiceTranscriptionSection.tsx +960 -0
  930. package/src/client/settings/agent-settings-search.ts +220 -0
  931. package/src/client/settings/index.ts +27 -0
  932. package/src/client/settings/useBuilderStatus.ts +1055 -0
  933. package/src/client/setup-connections/BuilderConnectCard.tsx +89 -0
  934. package/src/client/setup-connections/ProviderReadinessBadge.tsx +73 -0
  935. package/src/client/setup-connections/SetupConnectionsPage.tsx +94 -0
  936. package/src/client/setup-connections/catalog.ts +6 -0
  937. package/src/client/setup-connections/index.ts +47 -0
  938. package/src/client/setup-connections/runtime.ts +1 -0
  939. package/src/client/sharing/ShareButton.tsx +1748 -0
  940. package/src/client/sharing/ShareDialog.tsx +846 -0
  941. package/src/client/sharing/VisibilityBadge.tsx +4 -0
  942. package/src/client/sharing/index.ts +2 -0
  943. package/src/client/sse-event-processor.ts +2002 -0
  944. package/src/client/terminal/AgentTerminal.tsx +488 -0
  945. package/src/client/terminal/index.ts +7 -0
  946. package/src/client/theme.ts +27 -0
  947. package/src/client/tombstone/agent-presence-chip.ts +17 -0
  948. package/src/client/tombstone/editor.ts +265 -0
  949. package/src/client/tombstone/live-cursor-overlay.ts +21 -0
  950. package/src/client/tombstone/presence-bar.ts +17 -0
  951. package/src/client/tombstone/recent-edit-highlights.ts +17 -0
  952. package/src/client/tombstone/remote-selection-rings.ts +21 -0
  953. package/src/client/tombstone/rich-markdown-editor.ts +265 -0
  954. package/src/client/tombstone/ui-dialog.ts +49 -0
  955. package/src/client/tombstone/ui-dropdown-menu.ts +69 -0
  956. package/src/client/tombstone/ui-hover-card.ts +21 -0
  957. package/src/client/tombstone/ui-popover.ts +25 -0
  958. package/src/client/tombstone/ui-sheet.ts +49 -0
  959. package/src/client/tombstone/ui-tooltip.ts +29 -0
  960. package/src/client/tombstone/visual-style-controls.ts +61 -0
  961. package/src/client/tool-cells/BashCell.tsx +164 -0
  962. package/src/client/tool-cells/EditCell.tsx +303 -0
  963. package/src/client/tool-cells/FilesChangedSummary.tsx +208 -0
  964. package/src/client/tool-cells/WriteCell.tsx +145 -0
  965. package/src/client/tool-cells/index.ts +7 -0
  966. package/src/client/tool-display.ts +41 -0
  967. package/src/client/track.ts +57 -0
  968. package/src/client/transcription/BuilderTranscriptionCta.tsx +120 -0
  969. package/src/client/transcription/use-live-transcription.ts +292 -0
  970. package/src/client/ui/index.ts +55 -0
  971. package/src/client/uploads/index.ts +6 -0
  972. package/src/client/uploads/upload-editor-image.ts +79 -0
  973. package/src/client/uploads/use-upload-resource.ts +24 -0
  974. package/src/client/url-scrub.ts +51 -0
  975. package/src/client/use-action.ts +797 -0
  976. package/src/client/use-agent-chat-context.ts +63 -0
  977. package/src/client/use-agent-chat-home-handoff.ts +207 -0
  978. package/src/client/use-agent-chat.ts +53 -0
  979. package/src/client/use-agent-engine-configured.ts +211 -0
  980. package/src/client/use-avatar.ts +127 -0
  981. package/src/client/use-change-version.ts +150 -0
  982. package/src/client/use-chat-models.ts +252 -0
  983. package/src/client/use-chat-threads.ts +1262 -0
  984. package/src/client/use-db-sync.ts +1112 -0
  985. package/src/client/use-demo-mode-status.ts +30 -0
  986. package/src/client/use-dev-mode.ts +177 -0
  987. package/src/client/use-external-value.ts +40 -0
  988. package/src/client/use-pausing-interval.ts +65 -0
  989. package/src/client/use-pinch-zoom.ts +202 -0
  990. package/src/client/use-run-stuck-detection.ts +427 -0
  991. package/src/client/use-send-to-agent-chat.ts +85 -0
  992. package/src/client/use-session.ts +114 -0
  993. package/src/client/utils.ts +7 -0
  994. package/src/client/visual-style-controls.tsx +1 -0
  995. package/src/client/vite-dev-recovery-script.ts +226 -0
  996. package/src/client/voice-provider-status.ts +44 -0
  997. package/src/client/widgets/index.ts +41 -0
  998. package/src/code-agents/background-controller.ts +398 -0
  999. package/src/code-agents/background-run.ts +156 -0
  1000. package/src/code-agents/index.ts +95 -0
  1001. package/src/code-agents/prompt-attachments.ts +39 -0
  1002. package/src/code-agents/transcript-normalizer.ts +750 -0
  1003. package/src/code-agents/transcript-order.ts +73 -0
  1004. package/src/coding-tools/index.ts +742 -0
  1005. package/src/coding-tools/run-code.ts +1662 -0
  1006. package/src/coding-tools/sandbox/adapter.ts +82 -0
  1007. package/src/coding-tools/sandbox/background.ts +406 -0
  1008. package/src/coding-tools/sandbox/executions-store.ts +517 -0
  1009. package/src/coding-tools/sandbox/index.ts +132 -0
  1010. package/src/coding-tools/sandbox/local-child-process-adapter.ts +217 -0
  1011. package/src/collab/agent-identity.ts +5 -0
  1012. package/src/collab/agent-presence.ts +341 -0
  1013. package/src/collab/awareness-store.ts +196 -0
  1014. package/src/collab/awareness.ts +317 -0
  1015. package/src/collab/client-struct.ts +366 -0
  1016. package/src/collab/client.ts +1205 -0
  1017. package/src/collab/emitter.ts +31 -0
  1018. package/src/collab/follow-mode.ts +107 -0
  1019. package/src/collab/index.ts +151 -0
  1020. package/src/collab/json-to-yjs.ts +504 -0
  1021. package/src/collab/presence.ts +207 -0
  1022. package/src/collab/recent-edits.ts +215 -0
  1023. package/src/collab/routes.ts +191 -0
  1024. package/src/collab/storage.ts +228 -0
  1025. package/src/collab/struct-routes.ts +133 -0
  1026. package/src/collab/text-to-yjs.ts +79 -0
  1027. package/src/collab/undo.ts +432 -0
  1028. package/src/collab/xml-ops.ts +68 -0
  1029. package/src/collab/ydoc-manager.ts +544 -0
  1030. package/src/command-navigation/actions.ts +100 -0
  1031. package/src/command-navigation/index.ts +12 -0
  1032. package/src/comments-review/index.ts +1 -0
  1033. package/src/connections/catalog.ts +451 -0
  1034. package/src/connections/index.ts +48 -0
  1035. package/src/connections/reader.ts +911 -0
  1036. package/src/connections/runtime.ts +1 -0
  1037. package/src/credentials/index.ts +187 -0
  1038. package/src/data-programs/actions.ts +335 -0
  1039. package/src/data-programs/contract.ts +284 -0
  1040. package/src/data-programs/execute.ts +693 -0
  1041. package/src/data-programs/index.ts +72 -0
  1042. package/src/data-programs/schema.ts +148 -0
  1043. package/src/data-programs/store.ts +755 -0
  1044. package/src/data-widgets/index.ts +376 -0
  1045. package/src/db/client.ts +1627 -0
  1046. package/src/db/create-get-db.ts +579 -0
  1047. package/src/db/ddl-guard.ts +302 -0
  1048. package/src/db/drizzle-config.ts +190 -0
  1049. package/src/db/ensure-additive-columns.ts +430 -0
  1050. package/src/db/index.ts +57 -0
  1051. package/src/db/migrations.ts +691 -0
  1052. package/src/db/request-telemetry.ts +154 -0
  1053. package/src/db/runtime-diagnostics.ts +331 -0
  1054. package/src/db/schema.ts +121 -0
  1055. package/src/db/widen-columns.ts +75 -0
  1056. package/src/db-admin/agent-tools.ts +202 -0
  1057. package/src/db-admin/index.ts +26 -0
  1058. package/src/db-admin/operations.ts +803 -0
  1059. package/src/db-admin/routes.ts +174 -0
  1060. package/src/db-admin/types.ts +110 -0
  1061. package/src/demo/browser-state.ts +47 -0
  1062. package/src/demo/fetch-interceptor.ts +175 -0
  1063. package/src/demo/redact.ts +575 -0
  1064. package/src/deploy/build.ts +3938 -0
  1065. package/src/deploy/immutable-assets.ts +65 -0
  1066. package/src/deploy/route-discovery.ts +458 -0
  1067. package/src/deploy/workspace-core.ts +282 -0
  1068. package/src/deploy/workspace-deploy.ts +1488 -0
  1069. package/src/eject/provider-api-definitions.ts +193 -0
  1070. package/src/eject/remote-mcp-presets.ts +137 -0
  1071. package/src/eject/setup-readiness-ui.tsx +29 -0
  1072. package/src/eject/workspace-connections.ts +92 -0
  1073. package/src/embedding/agent.ts +159 -0
  1074. package/src/embedding/bridge.ts +297 -0
  1075. package/src/embedding/index.ts +43 -0
  1076. package/src/embedding/protocol.ts +185 -0
  1077. package/src/embedding/react.tsx +319 -0
  1078. package/src/embeddings/index.ts +233 -0
  1079. package/src/eval/agent-runner.ts +210 -0
  1080. package/src/eval/define-eval.ts +55 -0
  1081. package/src/eval/index.ts +49 -0
  1082. package/src/eval/report.ts +75 -0
  1083. package/src/eval/runner.ts +369 -0
  1084. package/src/eval/scorer.ts +244 -0
  1085. package/src/eval/types.ts +188 -0
  1086. package/src/event-bus/bus.ts +140 -0
  1087. package/src/event-bus/index.ts +3 -0
  1088. package/src/event-bus/registry.ts +79 -0
  1089. package/src/event-bus/types.ts +29 -0
  1090. package/src/extensions/actions.ts +1636 -0
  1091. package/src/extensions/change-marker.ts +54 -0
  1092. package/src/extensions/content-patch.ts +468 -0
  1093. package/src/extensions/fetch-tool.ts +461 -0
  1094. package/src/extensions/html-shell.ts +803 -0
  1095. package/src/extensions/local.ts +462 -0
  1096. package/src/extensions/path.ts +40 -0
  1097. package/src/extensions/proxy-security.ts +171 -0
  1098. package/src/extensions/routes.ts +1080 -0
  1099. package/src/extensions/schema.ts +269 -0
  1100. package/src/extensions/session-replay-iframe.ts +131 -0
  1101. package/src/extensions/slots/routes.ts +126 -0
  1102. package/src/extensions/slots/schema.ts +87 -0
  1103. package/src/extensions/slots/store.ts +450 -0
  1104. package/src/extensions/store.ts +1347 -0
  1105. package/src/extensions/theme.ts +114 -0
  1106. package/src/extensions/url-safety.ts +316 -0
  1107. package/src/extensions/web-content.ts +663 -0
  1108. package/src/extensions/web-search-tool.ts +437 -0
  1109. package/src/feature-flags/a2a-action-route.ts +56 -0
  1110. package/src/feature-flags/actions/get-feature-flags.ts +24 -0
  1111. package/src/feature-flags/actions/list-feature-flags.ts +69 -0
  1112. package/src/feature-flags/actions/set-feature-flag.ts +89 -0
  1113. package/src/feature-flags/index.ts +21 -0
  1114. package/src/feature-flags/permissions.ts +53 -0
  1115. package/src/feature-flags/plugin.ts +44 -0
  1116. package/src/feature-flags/registry.ts +96 -0
  1117. package/src/feature-flags/store.ts +176 -0
  1118. package/src/file-upload/actions/upload-image.ts +213 -0
  1119. package/src/file-upload/builder.ts +431 -0
  1120. package/src/file-upload/index.ts +24 -0
  1121. package/src/file-upload/pre-upload-attachments.ts +305 -0
  1122. package/src/file-upload/registry.ts +125 -0
  1123. package/src/file-upload/types.ts +89 -0
  1124. package/src/guards/db-tool-scoping.ts +129 -0
  1125. package/src/guards/index.ts +23 -0
  1126. package/src/guards/no-drizzle-push.ts +116 -0
  1127. package/src/guards/no-env-credentials.ts +229 -0
  1128. package/src/guards/no-env-mutation.ts +114 -0
  1129. package/src/guards/no-localhost-fallback.ts +124 -0
  1130. package/src/guards/no-unscoped-credentials.ts +227 -0
  1131. package/src/guards/no-unscoped-queries.ts +834 -0
  1132. package/src/guards/scan-utils.ts +105 -0
  1133. package/src/guards/types.ts +30 -0
  1134. package/src/history/actions/create-resource-version.ts +92 -0
  1135. package/src/history/actions/get-resource-version.ts +60 -0
  1136. package/src/history/actions/list-resource-history.ts +53 -0
  1137. package/src/history/actions/list-resource-versions.ts +43 -0
  1138. package/src/history/actions/restore-resource-version.ts +96 -0
  1139. package/src/history/index.ts +26 -0
  1140. package/src/history/registry.ts +111 -0
  1141. package/src/history/store.ts +379 -0
  1142. package/src/history/types.ts +69 -0
  1143. package/src/index.browser.ts +155 -0
  1144. package/src/index.ts +408 -0
  1145. package/src/ingestion/docx.ts +158 -0
  1146. package/src/ingestion/figma-node-to-html.ts +1860 -0
  1147. package/src/ingestion/figma.ts +548 -0
  1148. package/src/ingestion/index.ts +107 -0
  1149. package/src/ingestion/media.ts +264 -0
  1150. package/src/ingestion/notion.ts +121 -0
  1151. package/src/ingestion/office.ts +213 -0
  1152. package/src/ingestion/orchestration.ts +160 -0
  1153. package/src/ingestion/pptx.ts +331 -0
  1154. package/src/ingestion/selection.ts +81 -0
  1155. package/src/ingestion/website.ts +151 -0
  1156. package/src/integrations/a2a-continuation-marker.ts +2 -0
  1157. package/src/integrations/a2a-continuation-processor.ts +888 -0
  1158. package/src/integrations/a2a-continuations-store.ts +643 -0
  1159. package/src/integrations/adapter-overrides.ts +12 -0
  1160. package/src/integrations/adapters/discord.ts +364 -0
  1161. package/src/integrations/adapters/email.ts +1164 -0
  1162. package/src/integrations/adapters/google-docs.ts +371 -0
  1163. package/src/integrations/adapters/index.ts +29 -0
  1164. package/src/integrations/adapters/microsoft-teams.ts +413 -0
  1165. package/src/integrations/adapters/slack.ts +1914 -0
  1166. package/src/integrations/adapters/telegram.ts +386 -0
  1167. package/src/integrations/adapters/whatsapp.ts +358 -0
  1168. package/src/integrations/awaiting-input-store.ts +130 -0
  1169. package/src/integrations/catalog.ts +571 -0
  1170. package/src/integrations/computer-supervision-store.ts +423 -0
  1171. package/src/integrations/computer-supervision.ts +213 -0
  1172. package/src/integrations/config-store.ts +131 -0
  1173. package/src/integrations/controls-store.ts +187 -0
  1174. package/src/integrations/eject/messaging-adapters.ts +85 -0
  1175. package/src/integrations/google-docs-poller.ts +671 -0
  1176. package/src/integrations/identity-links-store.ts +210 -0
  1177. package/src/integrations/identity.ts +196 -0
  1178. package/src/integrations/index.ts +220 -0
  1179. package/src/integrations/installations-store.ts +677 -0
  1180. package/src/integrations/integration-memory.ts +187 -0
  1181. package/src/integrations/internal-token.ts +106 -0
  1182. package/src/integrations/pending-tasks-retry-job.ts +286 -0
  1183. package/src/integrations/pending-tasks-store.ts +468 -0
  1184. package/src/integrations/plugin.ts +3048 -0
  1185. package/src/integrations/remote-commands-store.ts +690 -0
  1186. package/src/integrations/remote-devices-store.ts +492 -0
  1187. package/src/integrations/remote-json-safety.ts +127 -0
  1188. package/src/integrations/remote-push-delivery-job.ts +48 -0
  1189. package/src/integrations/remote-push-delivery.ts +370 -0
  1190. package/src/integrations/remote-push-store.ts +664 -0
  1191. package/src/integrations/remote-retry-job.ts +55 -0
  1192. package/src/integrations/remote-run-events-store.ts +222 -0
  1193. package/src/integrations/remote-types.ts +186 -0
  1194. package/src/integrations/runtime.ts +1 -0
  1195. package/src/integrations/scope-store.ts +498 -0
  1196. package/src/integrations/slack-manifest.ts +78 -0
  1197. package/src/integrations/slack-oauth.ts +344 -0
  1198. package/src/integrations/task-queue-stats.ts +144 -0
  1199. package/src/integrations/thread-mapping-store.ts +134 -0
  1200. package/src/integrations/types.ts +485 -0
  1201. package/src/integrations/usage-budget-store.ts +906 -0
  1202. package/src/integrations/webhook-delivery.ts +55 -0
  1203. package/src/integrations/webhook-handler.ts +1939 -0
  1204. package/src/jobs/actions/list-recurring-jobs.ts +105 -0
  1205. package/src/jobs/actions/manage-recurring-job.ts +85 -0
  1206. package/src/jobs/cron.ts +126 -0
  1207. package/src/jobs/index.ts +9 -0
  1208. package/src/jobs/scheduler.ts +703 -0
  1209. package/src/jobs/tools.ts +367 -0
  1210. package/src/local-artifacts/index.ts +1372 -0
  1211. package/src/localization/actions/get-localization-preference.ts +24 -0
  1212. package/src/localization/actions/set-localization-preference.ts +32 -0
  1213. package/src/localization/default-messages.ts +1009 -0
  1214. package/src/localization/index.ts +2 -0
  1215. package/src/localization/server.ts +131 -0
  1216. package/src/localization/shared.ts +208 -0
  1217. package/src/mcp/actions/call-mcp-tool.ts +19 -0
  1218. package/src/mcp/actions/create-org-service-token.ts +87 -0
  1219. package/src/mcp/actions/list-mcp-tools.ts +18 -0
  1220. package/src/mcp/actions/list-org-service-tokens.ts +44 -0
  1221. package/src/mcp/actions/revoke-org-service-token.ts +30 -0
  1222. package/src/mcp/actions/service-token-access.ts +121 -0
  1223. package/src/mcp/ask-app-inline-tasks.ts +125 -0
  1224. package/src/mcp/build-server.ts +2356 -0
  1225. package/src/mcp/builtin-tools.ts +1506 -0
  1226. package/src/mcp/connect-route.ts +1460 -0
  1227. package/src/mcp/connect-store.ts +680 -0
  1228. package/src/mcp/embed-app.ts +2051 -0
  1229. package/src/mcp/embed-route.ts +84 -0
  1230. package/src/mcp/external-agent-policy.ts +18 -0
  1231. package/src/mcp/index.ts +47 -0
  1232. package/src/mcp/oauth-route.ts +1016 -0
  1233. package/src/mcp/oauth-store.ts +581 -0
  1234. package/src/mcp/oauth-token.ts +227 -0
  1235. package/src/mcp/org-directory.ts +343 -0
  1236. package/src/mcp/route-paths.ts +34 -0
  1237. package/src/mcp/screen-memory-stdio.ts +290 -0
  1238. package/src/mcp/server.ts +507 -0
  1239. package/src/mcp/stdio.ts +328 -0
  1240. package/src/mcp/workspace-resolve.ts +261 -0
  1241. package/src/mcp-client/app-api.ts +136 -0
  1242. package/src/mcp-client/app-result.ts +64 -0
  1243. package/src/mcp-client/builtin-capabilities.ts +146 -0
  1244. package/src/mcp-client/builtin-store.ts +93 -0
  1245. package/src/mcp-client/config.ts +281 -0
  1246. package/src/mcp-client/errors.ts +54 -0
  1247. package/src/mcp-client/hub-client.ts +172 -0
  1248. package/src/mcp-client/hub-routes.ts +198 -0
  1249. package/src/mcp-client/index.ts +504 -0
  1250. package/src/mcp-client/manager.ts +968 -0
  1251. package/src/mcp-client/oauth-client.ts +462 -0
  1252. package/src/mcp-client/oauth-routes.ts +307 -0
  1253. package/src/mcp-client/remote-store.ts +674 -0
  1254. package/src/mcp-client/remote-url.ts +97 -0
  1255. package/src/mcp-client/routes.ts +1093 -0
  1256. package/src/mcp-client/screen-memory-local.ts +461 -0
  1257. package/src/mcp-client/tool-policy.ts +182 -0
  1258. package/src/mcp-client/visibility.ts +56 -0
  1259. package/src/mcp-client/workspace-servers.ts +379 -0
  1260. package/src/navigation/index.ts +170 -0
  1261. package/src/notifications/actions.ts +151 -0
  1262. package/src/notifications/channels.ts +410 -0
  1263. package/src/notifications/index.ts +22 -0
  1264. package/src/notifications/registry.ts +216 -0
  1265. package/src/notifications/routes.ts +106 -0
  1266. package/src/notifications/store.ts +236 -0
  1267. package/src/notifications/types.ts +52 -0
  1268. package/src/oauth-tokens/google-refresh.ts +175 -0
  1269. package/src/oauth-tokens/index.ts +15 -0
  1270. package/src/oauth-tokens/store.ts +384 -0
  1271. package/src/observability/cleanup-job.ts +124 -0
  1272. package/src/observability/evals.ts +507 -0
  1273. package/src/observability/experiments.ts +359 -0
  1274. package/src/observability/feedback.ts +332 -0
  1275. package/src/observability/hosted-model-experiment.ts +118 -0
  1276. package/src/observability/index.ts +62 -0
  1277. package/src/observability/plugin.ts +31 -0
  1278. package/src/observability/routes.ts +431 -0
  1279. package/src/observability/sentiment.ts +261 -0
  1280. package/src/observability/store.ts +1347 -0
  1281. package/src/observability/traces.ts +789 -0
  1282. package/src/observability/tracing.ts +157 -0
  1283. package/src/observability/tracking-identity.ts +55 -0
  1284. package/src/observability/types.ts +211 -0
  1285. package/src/onboarding/default-steps.ts +428 -0
  1286. package/src/onboarding/index.ts +22 -0
  1287. package/src/onboarding/plugin.ts +262 -0
  1288. package/src/onboarding/registry.ts +47 -0
  1289. package/src/onboarding/types.ts +96 -0
  1290. package/src/org/accept-pending.ts +98 -0
  1291. package/src/org/auto-join-domain.ts +113 -0
  1292. package/src/org/context.ts +640 -0
  1293. package/src/org/free-email-providers.ts +124 -0
  1294. package/src/org/handlers.ts +1153 -0
  1295. package/src/org/index.ts +63 -0
  1296. package/src/org/migrations.ts +105 -0
  1297. package/src/org/permissions.ts +30 -0
  1298. package/src/org/plugin.ts +255 -0
  1299. package/src/org/schema.ts +28 -0
  1300. package/src/org/types.ts +57 -0
  1301. package/src/org-team/index.ts +1 -0
  1302. package/src/package-lifecycle/deprecated-imports.ts +179 -0
  1303. package/src/package-lifecycle/eject-manifest.ts +345 -0
  1304. package/src/package-lifecycle/index.ts +7 -0
  1305. package/src/package-lifecycle/manifest.ts +120 -0
  1306. package/src/package-lifecycle/migration-manifest.ts +159 -0
  1307. package/src/package-lifecycle/migration-message.ts +6 -0
  1308. package/src/package-lifecycle/tombstone.ts +58 -0
  1309. package/src/package-lifecycle/upgrade-error.ts +37 -0
  1310. package/src/private-blob/index.ts +18 -0
  1311. package/src/private-blob/registry.ts +242 -0
  1312. package/src/private-blob/types.ts +55 -0
  1313. package/src/progress/actions.ts +179 -0
  1314. package/src/progress/index.ts +16 -0
  1315. package/src/progress/registry.ts +127 -0
  1316. package/src/progress/routes.ts +89 -0
  1317. package/src/progress/store.ts +353 -0
  1318. package/src/progress/types.ts +59 -0
  1319. package/src/provider-api/actions/custom-provider-registration.ts +197 -0
  1320. package/src/provider-api/actions/delete-staged-dataset.ts +5 -0
  1321. package/src/provider-api/actions/github-repo-files.ts +266 -0
  1322. package/src/provider-api/actions/list-staged-datasets.ts +5 -0
  1323. package/src/provider-api/actions/provider-api-audit.ts +88 -0
  1324. package/src/provider-api/actions/provider-api.ts +460 -0
  1325. package/src/provider-api/actions/query-staged-dataset.ts +5 -0
  1326. package/src/provider-api/actions/staged-datasets.ts +359 -0
  1327. package/src/provider-api/corpus-jobs-store.ts +522 -0
  1328. package/src/provider-api/corpus-jobs.ts +1817 -0
  1329. package/src/provider-api/custom-registry.ts +456 -0
  1330. package/src/provider-api/github-repo.ts +675 -0
  1331. package/src/provider-api/gong.ts +108 -0
  1332. package/src/provider-api/index.ts +5444 -0
  1333. package/src/provider-api/quota-governor.ts +562 -0
  1334. package/src/provider-api/runtime.ts +1 -0
  1335. package/src/provider-api/staged-datasets-aggregate.ts +304 -0
  1336. package/src/provider-api/staged-datasets-store.ts +441 -0
  1337. package/src/provider-api/staging.ts +483 -0
  1338. package/src/resources/agents.ts +65 -0
  1339. package/src/resources/emitter.ts +54 -0
  1340. package/src/resources/handlers.ts +728 -0
  1341. package/src/resources/index.ts +4 -0
  1342. package/src/resources/metadata.ts +252 -0
  1343. package/src/resources/script-helpers.ts +160 -0
  1344. package/src/resources/store.ts +1618 -0
  1345. package/src/review/actions/consume-review-feedback.ts +48 -0
  1346. package/src/review/actions/create-review-comment.ts +108 -0
  1347. package/src/review/actions/delete-review-comment.ts +67 -0
  1348. package/src/review/actions/get-review-feedback.ts +49 -0
  1349. package/src/review/actions/list-review-comments.ts +87 -0
  1350. package/src/review/actions/reply-review-comment.ts +118 -0
  1351. package/src/review/actions/resolve-review-thread.ts +94 -0
  1352. package/src/review/actions/send-review-thread-to-agent.ts +62 -0
  1353. package/src/review/actions/set-review-status.ts +58 -0
  1354. package/src/review/identity.ts +101 -0
  1355. package/src/review/index.ts +45 -0
  1356. package/src/review/mentions.ts +44 -0
  1357. package/src/review/registry.ts +111 -0
  1358. package/src/review/store.ts +997 -0
  1359. package/src/review/types.ts +101 -0
  1360. package/src/router/index.ts +24 -0
  1361. package/src/scripts/agent-engines/list-agent-engines.ts +130 -0
  1362. package/src/scripts/agent-engines/manage-agent-engine.ts +197 -0
  1363. package/src/scripts/agent-engines/set-agent-engine.ts +84 -0
  1364. package/src/scripts/agent-engines/test-agent-engine.ts +174 -0
  1365. package/src/scripts/call-agent.ts +792 -0
  1366. package/src/scripts/chat/index.ts +8 -0
  1367. package/src/scripts/chat/open-chat.ts +56 -0
  1368. package/src/scripts/chat/search-chats.ts +121 -0
  1369. package/src/scripts/core-scripts.ts +22 -0
  1370. package/src/scripts/db/check-scoping.ts +212 -0
  1371. package/src/scripts/db/exec.ts +791 -0
  1372. package/src/scripts/db/index.ts +19 -0
  1373. package/src/scripts/db/migrate-encrypt-credentials.ts +223 -0
  1374. package/src/scripts/db/migrate-encrypt-oauth-tokens.ts +213 -0
  1375. package/src/scripts/db/migrate-user-api-keys.ts +257 -0
  1376. package/src/scripts/db/patch.ts +820 -0
  1377. package/src/scripts/db/query.ts +299 -0
  1378. package/src/scripts/db/reset-dev-owner.ts +285 -0
  1379. package/src/scripts/db/safety.ts +286 -0
  1380. package/src/scripts/db/schema.ts +364 -0
  1381. package/src/scripts/db/scoping.ts +341 -0
  1382. package/src/scripts/db/sqlite-client.ts +78 -0
  1383. package/src/scripts/db/tool-mode.ts +23 -0
  1384. package/src/scripts/db/tool-schemas.ts +31 -0
  1385. package/src/scripts/db/wipe-leaked-builder-keys.ts +201 -0
  1386. package/src/scripts/dev/index.ts +296 -0
  1387. package/src/scripts/dev/list-files.ts +119 -0
  1388. package/src/scripts/dev/read-file.ts +77 -0
  1389. package/src/scripts/dev/search-files.ts +151 -0
  1390. package/src/scripts/dev/shell.ts +111 -0
  1391. package/src/scripts/dev/write-file.ts +56 -0
  1392. package/src/scripts/dev-session.ts +96 -0
  1393. package/src/scripts/docs/index.ts +8 -0
  1394. package/src/scripts/docs/search.ts +274 -0
  1395. package/src/scripts/docs/source-search.ts +363 -0
  1396. package/src/scripts/index.ts +15 -0
  1397. package/src/scripts/manage-agent-loop-settings.ts +84 -0
  1398. package/src/scripts/parse-args.ts +46 -0
  1399. package/src/scripts/resources/delete-memory.ts +67 -0
  1400. package/src/scripts/resources/delete.ts +69 -0
  1401. package/src/scripts/resources/effective.ts +71 -0
  1402. package/src/scripts/resources/index.ts +18 -0
  1403. package/src/scripts/resources/list.ts +103 -0
  1404. package/src/scripts/resources/migrate-learnings.ts +40 -0
  1405. package/src/scripts/resources/read.ts +107 -0
  1406. package/src/scripts/resources/save-memory.ts +99 -0
  1407. package/src/scripts/resources/write.ts +158 -0
  1408. package/src/scripts/runner.ts +339 -0
  1409. package/src/scripts/utils.ts +130 -0
  1410. package/src/search/index.ts +413 -0
  1411. package/src/search-utils/index.ts +112 -0
  1412. package/src/secrets/crypto.ts +228 -0
  1413. package/src/secrets/index.ts +65 -0
  1414. package/src/secrets/onboarding.ts +101 -0
  1415. package/src/secrets/register-framework-secrets.ts +228 -0
  1416. package/src/secrets/register.ts +129 -0
  1417. package/src/secrets/routes.ts +697 -0
  1418. package/src/secrets/schema.ts +52 -0
  1419. package/src/secrets/storage.ts +561 -0
  1420. package/src/secrets/substitution.ts +305 -0
  1421. package/src/server/__snapshots__/agent-chat-plugin.surface.spec.ts.snap +150 -0
  1422. package/src/server/action-change.ts +66 -0
  1423. package/src/server/action-discovery.ts +774 -0
  1424. package/src/server/action-routes.ts +658 -0
  1425. package/src/server/agent-access.ts +72 -0
  1426. package/src/server/agent-chat/action-filters-a2a.ts +339 -0
  1427. package/src/server/agent-chat/browser-team-tools.ts +510 -0
  1428. package/src/server/agent-chat/context-tools.ts +599 -0
  1429. package/src/server/agent-chat/framework-prompts.ts +467 -0
  1430. package/src/server/agent-chat/lazy-fs.ts +11 -0
  1431. package/src/server/agent-chat/mcp-glue.ts +91 -0
  1432. package/src/server/agent-chat/plugin-options.ts +379 -0
  1433. package/src/server/agent-chat/process-run-failure.ts +62 -0
  1434. package/src/server/agent-chat/prompt-resources.ts +1004 -0
  1435. package/src/server/agent-chat/recurring-jobs-runtime.ts +80 -0
  1436. package/src/server/agent-chat/request-surface.ts +71 -0
  1437. package/src/server/agent-chat/run-code-tools.ts +67 -0
  1438. package/src/server/agent-chat/script-entries.ts +796 -0
  1439. package/src/server/agent-chat/shared-thread.ts +301 -0
  1440. package/src/server/agent-chat/skill-frontmatter.ts +41 -0
  1441. package/src/server/agent-chat-plugin.ts +5930 -0
  1442. package/src/server/agent-discovery.ts +706 -0
  1443. package/src/server/agent-engine-api-key-route.ts +236 -0
  1444. package/src/server/agent-run-context.ts +204 -0
  1445. package/src/server/agent-teams-run-queue.ts +344 -0
  1446. package/src/server/agent-teams.ts +2257 -0
  1447. package/src/server/agents-bundle.ts +464 -0
  1448. package/src/server/analytics.ts +105 -0
  1449. package/src/server/app-base-path.ts +79 -0
  1450. package/src/server/app-name.ts +53 -0
  1451. package/src/server/app-url.ts +184 -0
  1452. package/src/server/attachment-actions.ts +276 -0
  1453. package/src/server/attribution.ts +214 -0
  1454. package/src/server/auth-marketing.ts +260 -0
  1455. package/src/server/auth-plugin.ts +32 -0
  1456. package/src/server/auth.ts +3803 -0
  1457. package/src/server/better-auth-instance.ts +1201 -0
  1458. package/src/server/builder-browser.ts +1701 -0
  1459. package/src/server/builder-design-systems.ts +668 -0
  1460. package/src/server/builder-space.ts +176 -0
  1461. package/src/server/captcha.ts +63 -0
  1462. package/src/server/capture-error.ts +64 -0
  1463. package/src/server/cli-capture.ts +141 -0
  1464. package/src/server/collab-plugin.ts +391 -0
  1465. package/src/server/complete-text.ts +231 -0
  1466. package/src/server/cookie-namespace.ts +159 -0
  1467. package/src/server/core-routes-plugin.ts +4122 -0
  1468. package/src/server/cors-origins.ts +60 -0
  1469. package/src/server/create-server.ts +268 -0
  1470. package/src/server/credential-provider.ts +1202 -0
  1471. package/src/server/csrf.ts +229 -0
  1472. package/src/server/date-utils.ts +42 -0
  1473. package/src/server/deep-link.ts +119 -0
  1474. package/src/server/derived-secret.ts +32 -0
  1475. package/src/server/design-token-utils.ts +1032 -0
  1476. package/src/server/desktop-sso.ts +83 -0
  1477. package/src/server/edge.ts +69 -0
  1478. package/src/server/email-actions.ts +218 -0
  1479. package/src/server/email-template.ts +192 -0
  1480. package/src/server/email-templates.ts +148 -0
  1481. package/src/server/email.ts +219 -0
  1482. package/src/server/embed-route.ts +283 -0
  1483. package/src/server/embed-session.ts +805 -0
  1484. package/src/server/embedded.ts +252 -0
  1485. package/src/server/entry-server.tsx +154 -0
  1486. package/src/server/framework-request-handler.ts +848 -0
  1487. package/src/server/fusion-app.ts +447 -0
  1488. package/src/server/google-auth-mode.ts +34 -0
  1489. package/src/server/google-auth-plugin.ts +496 -0
  1490. package/src/server/google-oauth-credentials.ts +128 -0
  1491. package/src/server/google-oauth.ts +972 -0
  1492. package/src/server/google-realtime-session.ts +182 -0
  1493. package/src/server/h3-helpers.ts +174 -0
  1494. package/src/server/http-response-telemetry.ts +396 -0
  1495. package/src/server/identity-sso-store.ts +304 -0
  1496. package/src/server/identity-sso.ts +514 -0
  1497. package/src/server/index.ts +593 -0
  1498. package/src/server/missing-key.ts +36 -0
  1499. package/src/server/oauth-helpers.ts +44 -0
  1500. package/src/server/oauth-public-origin.ts +44 -0
  1501. package/src/server/oauth-return-url.ts +120 -0
  1502. package/src/server/og-fonts-data.ts +15 -0
  1503. package/src/server/og-fonts.ts +75 -0
  1504. package/src/server/onboarding-html.ts +4040 -0
  1505. package/src/server/open-route.ts +311 -0
  1506. package/src/server/org-admin.ts +28 -0
  1507. package/src/server/poll-events.ts +88 -0
  1508. package/src/server/poll.ts +1224 -0
  1509. package/src/server/prompts/framework-core-compact.ts +107 -0
  1510. package/src/server/prompts/framework-core.ts +143 -0
  1511. package/src/server/prompts/index.ts +16 -0
  1512. package/src/server/prompts/model-overlays.ts +54 -0
  1513. package/src/server/prompts/shared-rules.ts +104 -0
  1514. package/src/server/realtime-voice.ts +967 -0
  1515. package/src/server/recap-image-route.ts +242 -0
  1516. package/src/server/recap-image-store.ts +185 -0
  1517. package/src/server/request-context.ts +416 -0
  1518. package/src/server/request-origin.ts +67 -0
  1519. package/src/server/resources-plugin.ts +119 -0
  1520. package/src/server/schema-prompt.ts +429 -0
  1521. package/src/server/scoped-key-storage.ts +223 -0
  1522. package/src/server/security-headers.ts +170 -0
  1523. package/src/server/self-dispatch.ts +224 -0
  1524. package/src/server/sentry-config.ts +73 -0
  1525. package/src/server/sentry-plugin.ts +138 -0
  1526. package/src/server/sentry.ts +444 -0
  1527. package/src/server/short-lived-token.ts +170 -0
  1528. package/src/server/social-og-image.ts +454 -0
  1529. package/src/server/sse.ts +102 -0
  1530. package/src/server/ssr-handler.ts +466 -0
  1531. package/src/server/transcribe-voice.ts +1076 -0
  1532. package/src/server/voice-providers-status.ts +118 -0
  1533. package/src/server/workspace-oauth.ts +31 -0
  1534. package/src/server/workspace-provider-oauth.ts +970 -0
  1535. package/src/session-replay-iframe-protocol.ts +58 -0
  1536. package/src/settings/handlers.ts +44 -0
  1537. package/src/settings/index.ts +34 -0
  1538. package/src/settings/org-settings.ts +83 -0
  1539. package/src/settings/script-helpers.ts +24 -0
  1540. package/src/settings/store.ts +247 -0
  1541. package/src/settings/user-settings.ts +47 -0
  1542. package/src/setup-connections/index.ts +90 -0
  1543. package/src/setup-connections/onboarding.ts +47 -0
  1544. package/src/shared/agent-access.ts +112 -0
  1545. package/src/shared/agent-chat.ts +124 -0
  1546. package/src/shared/agent-env.ts +46 -0
  1547. package/src/shared/agent-readable-resource.ts +111 -0
  1548. package/src/shared/agent-sidebar-url.ts +39 -0
  1549. package/src/shared/cache-control.ts +25 -0
  1550. package/src/shared/cloudflare-globals.d.ts +34 -0
  1551. package/src/shared/context-xray.ts +172 -0
  1552. package/src/shared/embed-auth.ts +6 -0
  1553. package/src/shared/index.ts +83 -0
  1554. package/src/shared/llm-connection.ts +42 -0
  1555. package/src/shared/markdown-block-split.ts +129 -0
  1556. package/src/shared/mcp-connect-content.ts +130 -0
  1557. package/src/shared/mcp-embed-headers.ts +175 -0
  1558. package/src/shared/mcp-integration-config.ts +101 -0
  1559. package/src/shared/merge-by-id.ts +14 -0
  1560. package/src/shared/oauth-state.ts +39 -0
  1561. package/src/shared/reasoning-effort.ts +228 -0
  1562. package/src/shared/route-warmup-config.ts +128 -0
  1563. package/src/shared/runtime.ts +31 -0
  1564. package/src/shared/social-meta.ts +82 -0
  1565. package/src/shared/streaming-text-smoothing.ts +184 -0
  1566. package/src/shared/truncate.ts +13 -0
  1567. package/src/shared/workspace-app-audience.ts +177 -0
  1568. package/src/shared/workspace-app-id.ts +54 -0
  1569. package/src/sharing/access.ts +585 -0
  1570. package/src/sharing/actions/create-agent-resource-link.ts +91 -0
  1571. package/src/sharing/actions/extension-change.ts +22 -0
  1572. package/src/sharing/actions/list-resource-shares.ts +93 -0
  1573. package/src/sharing/actions/set-resource-visibility.ts +91 -0
  1574. package/src/sharing/actions/share-resource.ts +322 -0
  1575. package/src/sharing/actions/unshare-resource.ts +72 -0
  1576. package/src/sharing/index.ts +35 -0
  1577. package/src/sharing/registry.ts +201 -0
  1578. package/src/sharing/schema.ts +99 -0
  1579. package/src/styles/agent-conversation.css +766 -0
  1580. package/src/styles/agent-native.css +938 -0
  1581. package/src/styles/blocks.css +1717 -0
  1582. package/src/styles/chat-history-list.css +1 -0
  1583. package/src/styles/rich-markdown-editor.css +1 -0
  1584. package/src/tailwind.preset.ts +140 -0
  1585. package/src/templates/chat/.agents/skills/agent-native-docs/SKILL.md +15 -13
  1586. package/src/templates/chat/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  1587. package/src/templates/chat/.agents/skills/self-modifying-code/SKILL.md +9 -6
  1588. package/src/templates/chat/AGENTS.md +3 -2
  1589. package/src/templates/default/.agents/skills/agent-native-docs/SKILL.md +15 -13
  1590. package/src/templates/default/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  1591. package/src/templates/default/.agents/skills/self-modifying-code/SKILL.md +9 -6
  1592. package/src/templates/default/AGENTS.md +6 -5
  1593. package/src/templates/headless/.agents/skills/agent-native-docs/SKILL.md +15 -13
  1594. package/src/templates/headless/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  1595. package/src/templates/headless/AGENTS.md +5 -4
  1596. package/src/templates/workspace-core/.agents/skills/agent-native-docs/SKILL.md +15 -13
  1597. package/src/templates/workspace-core/.agents/skills/agent-native-toolkit/SKILL.md +3 -2
  1598. package/src/templates/workspace-core/.agents/skills/customizing-agent-native/SKILL.md +63 -20
  1599. package/src/templates/workspace-core/.agents/skills/self-modifying-code/SKILL.md +9 -6
  1600. package/src/templates/workspace-core/AGENTS.md +4 -4
  1601. package/src/templates/workspace-root/AGENTS.md +4 -4
  1602. package/src/terminal/cli-registry.ts +57 -0
  1603. package/src/terminal/index.ts +22 -0
  1604. package/src/terminal/pty-server.ts +389 -0
  1605. package/src/terminal/terminal-plugin.ts +265 -0
  1606. package/src/testing.ts +23 -0
  1607. package/src/tracking/index.ts +10 -0
  1608. package/src/tracking/providers.ts +422 -0
  1609. package/src/tracking/registry.ts +102 -0
  1610. package/src/tracking/route.ts +108 -0
  1611. package/src/tracking/types.ts +16 -0
  1612. package/src/transcription/builder-transcription.ts +118 -0
  1613. package/src/triggers/actions/list-automations.ts +99 -0
  1614. package/src/triggers/actions/manage-automation.ts +78 -0
  1615. package/src/triggers/actions.ts +333 -0
  1616. package/src/triggers/condition-evaluator.ts +163 -0
  1617. package/src/triggers/dispatcher.ts +536 -0
  1618. package/src/triggers/index.ts +13 -0
  1619. package/src/triggers/routes.ts +322 -0
  1620. package/src/triggers/types.ts +42 -0
  1621. package/src/types/pglite.d.ts +26 -0
  1622. package/src/usage/store.ts +698 -0
  1623. package/src/vite/action-types-plugin.ts +481 -0
  1624. package/src/vite/agent-web-plugin.ts +78 -0
  1625. package/src/vite/agents-bundle-plugin.ts +185 -0
  1626. package/src/vite/client.ts +3056 -0
  1627. package/src/vite/index.ts +21 -0
  1628. package/src/voice/index.ts +18 -0
  1629. package/src/voice/voice-cleanup-prompt.ts +38 -0
  1630. package/src/voice/voice-context.ts +217 -0
  1631. package/src/voice/voice-replacements.ts +75 -0
  1632. package/src/workspace-connections/credentials.ts +603 -0
  1633. package/src/workspace-connections/index.ts +72 -0
  1634. package/src/workspace-connections/lifecycle.ts +43 -0
  1635. package/src/workspace-connections/store.ts +1943 -0
  1636. package/src/workspace-files/index.ts +18 -0
  1637. package/src/workspace-files/store.ts +339 -0
  1638. package/src/workspace-files/tool.ts +266 -0
package/src/server/google-oauth.ts ADDED
@@ -0,0 +1,972 @@
1
+ /**
2
+ * Shared Google OAuth utilities for all templates.
3
+ *
4
+ * Handles platform detection (desktop/mobile), state encoding,
5
+ * session token creation, and deep-link responses — the logic
6
+ * that was previously copy-pasted across every template's
7
+ * google-auth.ts handler.
8
+ */
9
+
10
+ import crypto from "node:crypto";
11
+
12
+ import {
13
+ getHeader,
14
+ getQuery,
15
+ setResponseStatus,
16
+ setResponseHeader,
17
+ type H3Event,
18
+ } from "h3";
19
+
20
+ import { getAppBasePathFromViteEnv } from "./app-base-path.js";
21
+ import { getAppName } from "./app-name.js";
22
+ import { signupAttributionFromCookieHeader } from "./attribution.js";
23
+ import {
24
+ addSession,
25
+ getSession,
26
+ getSessionMaxAge,
27
+ hasLegacySessionForEmail,
28
+ setFrameworkSessionCookie,
29
+ } from "./auth.js";
30
+ import {
31
+ hasBetterAuthUserEmail,
32
+ trackSignupEvent,
33
+ } from "./better-auth-instance.js";
34
+ import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
35
+ import { writeDesktopSso } from "./desktop-sso.js";
36
+ import { appendSessionToOAuthReturnUrl } from "./oauth-return-url.js";
37
+ import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
38
+
39
+ // ─── Platform Detection ─────────────────────────────────────────────────────
40
+
41
+ /** Return an HTML response with the correct Content-Type.
42
+ * Uses a web-standard Response to ensure the header survives
43
+ * Nitro dev mode's mock-node-response pipeline. */
44
+ function htmlResponse(html: string, status = 200): Response {
45
+ return new Response(html, {
46
+ status,
47
+ headers: { "Content-Type": "text/html; charset=utf-8" },
48
+ });
49
+ }
50
+
51
+ /** Shared markup for OAuth success "close this tab" pages. Renders a green
52
+ * check icon above the message, with a little breathing room between the
53
+ * headline and secondary line. Used by every template that goes through the
54
+ * shared Google OAuth flow. */
55
+ function oauthDebugFlowId(flowId?: string): string | undefined {
56
+ return flowId ? flowId.slice(-10) : undefined;
57
+ }
58
+
59
+ function oauthSuccessCloseTabHtml(
60
+ headline: string,
61
+ footnote: string,
62
+ debugFlowId?: string,
63
+ ): string {
64
+ const debug = debugFlowId
65
+ ? `<p style="font-size:11px;color:#555;margin:12px 0 0 0">Debug flow: ${escapeHtml(debugFlowId)}</p>`
66
+ : "";
67
+ return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connected</title></head><body style="background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column"><svg width="44" height="44" viewBox="0 0 24 24" fill="none" stroke="#22c55e" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="margin-bottom:14px" aria-hidden="true"><circle cx="12" cy="12" r="10"/><path d="M9 12l2 2l4 -4"/></svg><p style="font-size:16px;margin:0 0 12px 0">${headline}</p><p style="font-size:13px;color:#888;margin:0">${footnote}</p>${debug}<script>console.info("[agent-native][google-oauth] success page loaded",{flow:${JSON.stringify(debugFlowId || null)}});setTimeout(function(){try{window.close()}catch(e){}},250)</script></body></html>`;
68
+ }
69
+
70
+ /**
71
+ * HTML escape — minimal but covers the cases that matter when interpolating
72
+ * user-controlled values into our OAuth callback HTML. Mirrors the helper in
73
+ * email-template.ts; kept inline here to avoid a circular import.
74
+ */
75
+ function escapeHtml(s: string): string {
76
+ return String(s ?? "")
77
+ .replace(/&/g, "&amp;")
78
+ .replace(/</g, "&lt;")
79
+ .replace(/>/g, "&gt;")
80
+ .replace(/"/g, "&quot;")
81
+ .replace(/'/g, "&#39;");
82
+ }
83
+
84
+ /**
85
+ * Detect requests from the Agent Native desktop app specifically.
86
+ *
87
+ * The desktop app appends `AgentNativeDesktop/<version>` to its user-agent
88
+ * (see `packages/desktop-app/src/main/index.ts`). We check for that marker
89
+ * rather than matching generic `Electron`, which would also match other
90
+ * Electron-based webviews like Builder.io's Fusion, Slack desktop, Discord,
91
+ * etc. Falsely treating those as "the desktop app" sends users to the
92
+ * `agentnative://oauth-complete` deep-link success page after Google sign-in,
93
+ * where the protocol handler can't fire and the "Open Agent Native" button
94
+ * does nothing.
95
+ *
96
+ * Kept exported as `isElectron` for backwards compatibility with consumers.
97
+ */
98
+ export function isElectron(event: H3Event): boolean {
99
+ return /AgentNativeDesktop/i.test(getHeader(event, "user-agent") || "");
100
+ }
101
+
102
+ /** Detect requests from a mobile browser (iOS/Android). */
103
+ export function isMobile(event: H3Event): boolean {
104
+ return /iPhone|iPad|iPod|Android/i.test(getHeader(event, "user-agent") || "");
105
+ }
106
+
107
+ /**
108
+ * Build the static allowlist of origins we trust for `getOrigin`. Reads
109
+ * deployment-known public URLs. Each entry is normalised to
110
+ * `${proto}://${host}` (no path). Duplicates collapse, invalid entries are
111
+ * dropped silently.
112
+ */
113
+ const EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS = [
114
+ "WORKSPACE_OAUTH_ORIGIN",
115
+ "VITE_WORKSPACE_OAUTH_ORIGIN",
116
+ "APP_URL",
117
+ "VITE_APP_URL",
118
+ "BETTER_AUTH_URL",
119
+ "VITE_BETTER_AUTH_URL",
120
+ "URL",
121
+ "DEPLOY_URL",
122
+ ] as const;
123
+
124
+ const WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS = [
125
+ "WORKSPACE_GATEWAY_URL",
126
+ "VITE_WORKSPACE_GATEWAY_URL",
127
+ ] as const;
128
+
129
+ function normalizeOrigin(raw: string | undefined): string | undefined {
130
+ if (!raw) return undefined;
131
+ try {
132
+ const u = new URL(raw);
133
+ return `${u.protocol}//${u.host}`;
134
+ } catch {
135
+ return undefined;
136
+ }
137
+ }
138
+
139
+ function addNormalizedOrigin(
140
+ out: Set<string>,
141
+ raw: string | undefined,
142
+ options: { allowLoopback: boolean },
143
+ ): void {
144
+ const origin = normalizeOrigin(raw);
145
+ if (!origin) return;
146
+ if (!options.allowLoopback && isLoopbackOrigin(origin)) return;
147
+ out.add(origin);
148
+ }
149
+
150
+ function firstOriginFromEnv(
151
+ keys: readonly string[],
152
+ options: { allowLoopback: boolean },
153
+ ): string | undefined {
154
+ for (const key of keys) {
155
+ const origin = normalizeOrigin(process.env[key]);
156
+ if (!origin) continue;
157
+ if (!options.allowLoopback && isLoopbackOrigin(origin)) continue;
158
+ return origin;
159
+ }
160
+ return undefined;
161
+ }
162
+
163
+ function getConfiguredOriginAllowlist(): Set<string> {
164
+ const out = new Set<string>();
165
+ for (const key of EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS) {
166
+ addNormalizedOrigin(out, process.env[key], { allowLoopback: true });
167
+ }
168
+ for (const key of WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS) {
169
+ addNormalizedOrigin(out, process.env[key], { allowLoopback: false });
170
+ }
171
+ return out;
172
+ }
173
+
174
+ /** Return whether a candidate is one of this deployment's configured origins. */
175
+ export function isConfiguredAppOrigin(value: string | undefined): boolean {
176
+ const origin = normalizeOrigin(value);
177
+ return !!origin && getConfiguredOriginAllowlist().has(origin);
178
+ }
179
+
180
+ function getWorkspaceCallbackOrigin(): string | undefined {
181
+ const publicAuthOrigin = firstOriginFromEnv(EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS, {
182
+ allowLoopback: true,
183
+ });
184
+ if (publicAuthOrigin) return publicAuthOrigin;
185
+
186
+ return firstOriginFromEnv(WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS, {
187
+ allowLoopback: false,
188
+ });
189
+ }
190
+
191
+ function isLoopbackHost(host: string | undefined): boolean {
192
+ if (!host) return false;
193
+ try {
194
+ const parsed = new URL(`http://${host}`);
195
+ return (
196
+ parsed.hostname === "localhost" ||
197
+ parsed.hostname === "127.0.0.1" ||
198
+ parsed.hostname === "::1" ||
199
+ parsed.hostname === "[::1]"
200
+ );
201
+ } catch {
202
+ return false;
203
+ }
204
+ }
205
+
206
+ function isLoopbackOrigin(origin: string | undefined): boolean {
207
+ if (!origin) return false;
208
+ try {
209
+ return isLoopbackHost(new URL(origin).host);
210
+ } catch {
211
+ return false;
212
+ }
213
+ }
214
+
215
+ function isBuilderPreviewHost(host: string | undefined): boolean {
216
+ if (!host) return false;
217
+ try {
218
+ const parsed = new URL(`http://${host}`);
219
+ const hostname = parsed.hostname.toLowerCase();
220
+ return (
221
+ hostname === "builderio.xyz" ||
222
+ hostname.endsWith(".builderio.xyz") ||
223
+ hostname === "builderio.dev" ||
224
+ hostname.endsWith(".builderio.dev") ||
225
+ hostname === "builder.codes" ||
226
+ hostname.endsWith(".builder.codes") ||
227
+ hostname === "builder.io" ||
228
+ hostname.endsWith(".builder.io") ||
229
+ hostname === "builder.my" ||
230
+ hostname.endsWith(".builder.my")
231
+ );
232
+ } catch {
233
+ return false;
234
+ }
235
+ }
236
+
237
+ /**
238
+ * Get the origin from forwarded headers or Host.
239
+ *
240
+ * Defends against Host-header injection: in production we require the resolved
241
+ * origin to match `APP_URL` / `BETTER_AUTH_URL` / `WORKSPACE_GATEWAY_URL`,
242
+ * falling back to those values when inbound headers are missing or don't match.
243
+ * In dev we accept inbound `Host` so localhost / ngrok / preview hosts keep
244
+ * working without configuration, except workspace OAuth requests from loopback
245
+ * or Builder preview hosts use the configured gateway origin when one exists.
246
+ * The protocol defaults to `https` in production (so a TLS-terminating proxy
247
+ * that drops `x-forwarded-proto` doesn't downgrade us to plain HTTP).
248
+ */
249
+ export function getOrigin(event: H3Event): string {
250
+ const headerHost =
251
+ getHeader(event, "x-forwarded-host") || getHeader(event, "host");
252
+ const isProd = process.env.NODE_ENV === "production";
253
+ const headerProto =
254
+ getHeader(event, "x-forwarded-proto") || (isProd ? "https" : "http");
255
+ const workspaceCallbackOrigin = isWorkspaceOAuthCallbackRelayEnabled()
256
+ ? getWorkspaceCallbackOrigin()
257
+ : undefined;
258
+
259
+ if (
260
+ workspaceCallbackOrigin &&
261
+ (isLoopbackHost(headerHost) || isBuilderPreviewHost(headerHost))
262
+ ) {
263
+ return workspaceCallbackOrigin;
264
+ }
265
+
266
+ if (isProd) {
267
+ const allow = getConfiguredOriginAllowlist();
268
+ // If the deploy declares its public URL, prefer it over inbound headers.
269
+ if (allow.size > 0) {
270
+ const inbound = headerHost ? `${headerProto}://${headerHost}` : "";
271
+ if (inbound && allow.has(inbound)) return inbound;
272
+ // Inbound didn't match — fall back to the first configured origin.
273
+ return [...allow][0];
274
+ }
275
+ // No allowlist configured: still default to https, but accept the
276
+ // inbound Host (best we can do without a configured base URL).
277
+ return `${headerProto}://${headerHost ?? ""}`;
278
+ }
279
+
280
+ return `${headerProto}://${headerHost ?? "localhost"}`;
281
+ }
282
+
283
+ /** App mount prefix, if the template is served under APP_BASE_PATH. */
284
+ export function getAppBasePath(): string {
285
+ // Vite statically replaces VITE_* values in the server bundle during the
286
+ // build, but Netlify/Nitro does not necessarily expose those build vars at
287
+ // runtime. Keep auth and OAuth path matching aligned with the SSR handler by
288
+ // falling back to import.meta.env (including BASE_URL).
289
+ return getAppBasePathFromViteEnv();
290
+ }
291
+
292
+ /** Build an absolute same-origin URL that preserves APP_BASE_PATH. */
293
+ export function getAppUrl(event: H3Event, path = "/"): string {
294
+ const cleanPath = path.startsWith("/") ? path : `/${path}`;
295
+ return `${getOrigin(event)}${getAppBasePath()}${cleanPath}`;
296
+ }
297
+
298
+ function isFrameworkOAuthCallbackPath(pathname: string): boolean {
299
+ return (
300
+ pathname.startsWith("/_agent-native/") &&
301
+ (pathname.endsWith("/callback") || pathname.includes("/callback/"))
302
+ );
303
+ }
304
+
305
+ function getOriginalRequestPath(event: H3Event): string {
306
+ const mountedPathname = (event as any).context?._mountedPathname;
307
+ if (typeof mountedPathname === "string" && mountedPathname) {
308
+ return mountedPathname;
309
+ }
310
+
311
+ const urlPathname = (event as any).url?.pathname;
312
+ if (typeof urlPathname === "string" && urlPathname) return urlPathname;
313
+
314
+ const nodeUrl = event.node?.req?.url;
315
+ if (typeof nodeUrl === "string" && nodeUrl) {
316
+ const queryStart = nodeUrl.indexOf("?");
317
+ return queryStart >= 0 ? nodeUrl.slice(0, queryStart) : nodeUrl;
318
+ }
319
+
320
+ const eventPath = (event as any).path;
321
+ if (typeof eventPath === "string" && eventPath) {
322
+ const queryStart = eventPath.indexOf("?");
323
+ return queryStart >= 0 ? eventPath.slice(0, queryStart) : eventPath;
324
+ }
325
+
326
+ return "/";
327
+ }
328
+
329
+ function isRequestUnderAppBasePath(event: H3Event): boolean {
330
+ const basePath = getAppBasePath();
331
+ if (!basePath) return false;
332
+ const requestPath = getOriginalRequestPath(event);
333
+ return (
334
+ requestPath === `${basePath}/_agent-native` ||
335
+ requestPath.startsWith(`${basePath}/_agent-native/`)
336
+ );
337
+ }
338
+
339
+ function getDefaultOAuthRedirectUrl(event: H3Event, path: string): string {
340
+ const cleanPath = path.startsWith("/") ? path : `/${path}`;
341
+ if (
342
+ isWorkspaceOAuthCallbackRelayEnabled() &&
343
+ isFrameworkOAuthCallbackPath(cleanPath)
344
+ ) {
345
+ return `${getOrigin(event)}${cleanPath}`;
346
+ }
347
+ const basePath = isRequestUnderAppBasePath(event) ? getAppBasePath() : "";
348
+ return `${getOrigin(event)}${basePath}${cleanPath}`;
349
+ }
350
+
351
+ // ─── redirect_uri Allowlist ──────────────────────────────────────────────────
352
+
353
+ /**
354
+ * Validate a user-supplied `redirect_uri` for OAuth flows.
355
+ *
356
+ * Defends against authorization-code interception (RFC 6819 §4.4.1.7):
357
+ * even though the upstream provider (Google/Atlassian/Zoom) refuses
358
+ * unregistered redirect URIs, prefix-style registrations and side
359
+ * registrations on the same host let a malicious caller swap in an
360
+ * attacker-controlled URI that the provider still accepts. We reject any
361
+ * candidate that isn't on this server's own origin AND under the
362
+ * framework's `/_agent-native/` namespace. Returns the validated URI on
363
+ * success, or `undefined` on rejection — callers must treat `undefined`
364
+ * as a 400.
365
+ *
366
+ * The intentional shape is exact-prefix:
367
+ * - Origin must equal `getOrigin(event)` — no Host-header injection
368
+ * reusing somebody else's registered redirect URI.
369
+ * - Path must start with `${appBasePath}/_agent-native/` so we never
370
+ * hand auth codes to a public marketing or open-redirect endpoint
371
+ * on the same registered host.
372
+ *
373
+ * For desktop / native flows that need ephemeral `http://127.0.0.1:<port>`
374
+ * loopback URIs, callers should validate those at the template level
375
+ * with a dedicated allowlist — this helper rejects them by design.
376
+ */
377
+ export function isAllowedOAuthRedirectUri(
378
+ candidate: string,
379
+ event: H3Event,
380
+ ): boolean {
381
+ if (typeof candidate !== "string" || candidate.length === 0) return false;
382
+ let url: URL;
383
+ try {
384
+ url = new URL(candidate);
385
+ } catch {
386
+ return false;
387
+ }
388
+ // Must be same origin as our server.
389
+ const expectedOrigin = getOrigin(event);
390
+ let expectedUrl: URL;
391
+ try {
392
+ expectedUrl = new URL(expectedOrigin);
393
+ } catch {
394
+ return false;
395
+ }
396
+ if (url.protocol !== expectedUrl.protocol) return false;
397
+ if (url.host !== expectedUrl.host) return false;
398
+ // Must live under the framework's namespace. Workspace deploys can route
399
+ // root /_agent-native/* to Dispatch even when Dispatch itself is mounted at
400
+ // /dispatch, but app-prefixed requests should not be able to swap their
401
+ // callback to that root namespace.
402
+ const basePath = getAppBasePath();
403
+ const allowedPrefixes =
404
+ basePath && isRequestUnderAppBasePath(event)
405
+ ? [
406
+ `${basePath}/_agent-native/`,
407
+ ...(isWorkspaceOAuthCallbackRelayEnabled() &&
408
+ isFrameworkOAuthCallbackPath(url.pathname)
409
+ ? ["/_agent-native/"]
410
+ : []),
411
+ ]
412
+ : ["/_agent-native/"];
413
+ if (!allowedPrefixes.some((prefix) => url.pathname.startsWith(prefix))) {
414
+ return false;
415
+ }
416
+ return true;
417
+ }
418
+
419
+ /**
420
+ * Resolve the `redirect_uri` for an outbound OAuth `auth-url` request.
421
+ *
422
+ * Reads `?redirect_uri=` from the query and validates it via
423
+ * `isAllowedOAuthRedirectUri`. Returns:
424
+ * - the validated URI when supplied and allowed, OR
425
+ * - the framework default when no override was supplied, OR
426
+ * - `null` when an override was supplied but rejected — callers must
427
+ * respond with 400 in that case.
428
+ *
429
+ * Templates that need a non-default redirect path can pass it via
430
+ * `defaultPath` (e.g. `"/_agent-native/google/desktop-callback"` for
431
+ * desktop flows).
432
+ */
433
+ export function resolveOAuthRedirectUri(
434
+ event: H3Event,
435
+ defaultPath = "/_agent-native/google/callback",
436
+ ): string | null {
437
+ const supplied = getQuery(event).redirect_uri;
438
+ if (typeof supplied === "string" && supplied.length > 0) {
439
+ return isAllowedOAuthRedirectUri(supplied, event) ? supplied : null;
440
+ }
441
+ return getDefaultOAuthRedirectUrl(event, defaultPath);
442
+ }
443
+
444
+ // ─── OAuth State ─────────────────────────────────────────────────────────────
445
+
446
+ export interface OAuthStatePayload {
447
+ redirectUri: string;
448
+ owner?: string;
449
+ orgId?: string;
450
+ desktop?: boolean;
451
+ addAccount?: boolean;
452
+ app?: string;
453
+ /**
454
+ * Same-origin path to redirect to after a successful web-flow sign-in.
455
+ * Threaded through the (HMAC-signed) state so it survives the round trip
456
+ * to Google. Validated again on decode via safeReturnPath as defence in
457
+ * depth. Has no effect on desktop / mobile / add-account flows, which
458
+ * use their own deep-link / close-tab handling.
459
+ */
460
+ returnUrl?: string;
461
+ flowId?: string;
462
+ signupAttribution?: Record<string, string | undefined>;
463
+ }
464
+
465
+ /**
466
+ * Ephemeral in-memory state-signing key for development. Generated lazily
467
+ * on first read so dev sessions don't depend on filesystem writability or
468
+ * env-var configuration. Sessions reset on each restart, which is fine
469
+ * for dev — no real users / production data are involved.
470
+ */
471
+ let _devStateSigningKey: string | undefined;
472
+
473
+ /**
474
+ * Derive a server-only signing key for HMAC verification of OAuth state.
475
+ *
476
+ * Uses a dedicated secret — never an OAuth client secret. Reusing a
477
+ * client_secret (which is shared with Google / GitHub / Atlassian) as our
478
+ * own HMAC key conflates two trust domains: rotating the client secret
479
+ * silently invalidates every in-flight OAuth state, and any leak of the
480
+ * client secret also lets an attacker forge our state envelopes.
481
+ *
482
+ * Resolution order:
483
+ * 1. OAUTH_STATE_SECRET (preferred — dedicated to this purpose)
484
+ * 2. BETTER_AUTH_SECRET (already used by Better Auth as a server secret)
485
+ * 3. Hosted workspace deploys derive a per-purpose key from A2A_SECRET
486
+ * 4. In dev only, an ephemeral random key (per-process)
487
+ *
488
+ * In production, throws if no usable server secret is set.
489
+ */
490
+ function getStateSigningKey(): string {
491
+ const secret =
492
+ process.env.OAUTH_STATE_SECRET ||
493
+ process.env.BETTER_AUTH_SECRET ||
494
+ getWorkspaceA2ADerivedSecret("oauth-state");
495
+ if (secret) return secret;
496
+
497
+ const isProd = process.env.NODE_ENV === "production";
498
+ if (isProd) {
499
+ throw new Error(
500
+ "OAuth state signing requires a server secret. " +
501
+ "Set OAUTH_STATE_SECRET, BETTER_AUTH_SECRET, or A2A_SECRET in production workspace deploys.",
502
+ );
503
+ }
504
+
505
+ if (!_devStateSigningKey) {
506
+ _devStateSigningKey = crypto.randomBytes(32).toString("hex");
507
+ }
508
+ return _devStateSigningKey;
509
+ }
510
+
511
+ /**
512
+ * Options for the named-argument form of {@link encodeOAuthState}.
513
+ * Prefer this form — the positional overload is easy to misuse (the mail
514
+ * and calendar templates historically passed `flowId` in the `returnUrl`
515
+ * slot, smuggling state into a defence-in-depth path).
516
+ */
517
+ export interface EncodeOAuthStateOptions {
518
+ redirectUri: string;
519
+ owner?: string;
520
+ orgId?: string;
521
+ desktop?: boolean;
522
+ addAccount?: boolean;
523
+ app?: string;
524
+ returnUrl?: string;
525
+ flowId?: string;
526
+ signupAttribution?: Record<string, string | undefined>;
527
+ }
528
+
529
+ function sanitizeStateAttribution(
530
+ value: unknown,
531
+ ): Record<string, string | undefined> | undefined {
532
+ if (!value || typeof value !== "object" || Array.isArray(value)) {
533
+ return undefined;
534
+ }
535
+ const out: Record<string, string | undefined> = {};
536
+ for (const [key, raw] of Object.entries(value)) {
537
+ if (typeof raw === "string") out[key] = raw;
538
+ }
539
+ return Object.keys(out).length > 0 ? out : undefined;
540
+ }
541
+
542
+ /**
543
+ * Encode OAuth state into a signed base64url string.
544
+ * The state is HMAC-signed so the callback can verify it wasn't forged,
545
+ * preventing CSRF attacks on the OAuth flow.
546
+ *
547
+ * Two call shapes are supported:
548
+ * - Recommended: pass an options object — clear, mismatch-proof.
549
+ * `encodeOAuthState({ redirectUri, owner, desktop, ... })`
550
+ * - Legacy positional form (kept working for backward compatibility):
551
+ * `encodeOAuthState(redirectUri, owner, desktop, addAccount, app, returnUrl, flowId)`.
552
+ * Callers should migrate to the options form — see the audit on
553
+ * templates/mail and templates/calendar where the positional shape
554
+ * led to `flowId` being smuggled in via the `returnUrl` slot.
555
+ */
556
+ export function encodeOAuthState(opts: EncodeOAuthStateOptions): string;
557
+ export function encodeOAuthState(
558
+ redirectUri: string,
559
+ owner?: string,
560
+ desktop?: boolean,
561
+ addAccount?: boolean,
562
+ app?: string,
563
+ returnUrl?: string,
564
+ flowId?: string,
565
+ ): string;
566
+ export function encodeOAuthState(
567
+ redirectUriOrOpts: string | EncodeOAuthStateOptions,
568
+ owner?: string,
569
+ desktop?: boolean,
570
+ addAccount?: boolean,
571
+ app?: string,
572
+ returnUrl?: string,
573
+ flowId?: string,
574
+ ): string {
575
+ const opts: EncodeOAuthStateOptions =
576
+ typeof redirectUriOrOpts === "string"
577
+ ? {
578
+ redirectUri: redirectUriOrOpts,
579
+ owner,
580
+ desktop,
581
+ addAccount,
582
+ app,
583
+ returnUrl,
584
+ flowId,
585
+ }
586
+ : redirectUriOrOpts;
587
+
588
+ const nonce = crypto.randomBytes(8).toString("hex");
589
+ const payload: Record<string, unknown> = {
590
+ n: nonce,
591
+ r: opts.redirectUri,
592
+ };
593
+ if (opts.owner) payload.o = opts.owner;
594
+ if (opts.orgId) payload.g = opts.orgId;
595
+ if (opts.desktop) payload.d = true;
596
+ if (opts.addAccount) payload.a = true;
597
+ if (opts.app) payload.app = opts.app;
598
+ if (opts.returnUrl) payload.r2 = opts.returnUrl;
599
+ if (opts.flowId) payload.f = opts.flowId;
600
+ if (opts.signupAttribution) payload.ft = opts.signupAttribution;
601
+ const data = Buffer.from(JSON.stringify(payload)).toString("base64url");
602
+ const sig = crypto
603
+ .createHmac("sha256", getStateSigningKey())
604
+ .update(data)
605
+ .digest("base64url");
606
+ return `${data}.${sig}`;
607
+ }
608
+
609
+ /**
610
+ * Decode and verify OAuth state from the callback's state query parameter.
611
+ * Rejects forged or tampered state by checking the HMAC signature.
612
+ * Falls back to the provided URI if decoding or verification fails.
613
+ */
614
+ export function decodeOAuthState(
615
+ stateParam: string | undefined,
616
+ fallbackUri: string,
617
+ ): OAuthStatePayload {
618
+ if (stateParam) {
619
+ try {
620
+ const dotIdx = stateParam.lastIndexOf(".");
621
+ if (dotIdx === -1) return { redirectUri: fallbackUri };
622
+
623
+ const data = stateParam.slice(0, dotIdx);
624
+ const sig = stateParam.slice(dotIdx + 1);
625
+ const expected = crypto
626
+ .createHmac("sha256", getStateSigningKey())
627
+ .update(data)
628
+ .digest("base64url");
629
+
630
+ if (
631
+ sig.length !== expected.length ||
632
+ !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
633
+ ) {
634
+ return { redirectUri: fallbackUri };
635
+ }
636
+
637
+ const parsed = JSON.parse(Buffer.from(data, "base64url").toString());
638
+ return {
639
+ redirectUri: parsed.r || fallbackUri,
640
+ owner: parsed.o || undefined,
641
+ orgId: typeof parsed.g === "string" ? parsed.g : undefined,
642
+ desktop: !!parsed.d,
643
+ addAccount: !!parsed.a,
644
+ app: typeof parsed.app === "string" ? parsed.app : undefined,
645
+ // Pass returnUrl through as-is — same-origin validation runs at the
646
+ // consumer (oauthCallbackResponse → safeReturnPath). The state is
647
+ // HMAC-signed, but we still validate at consumption as defence in
648
+ // depth in case the signing key ever leaks.
649
+ returnUrl: typeof parsed.r2 === "string" ? parsed.r2 : undefined,
650
+ flowId: parsed.f || undefined,
651
+ signupAttribution: sanitizeStateAttribution(parsed.ft),
652
+ };
653
+ } catch {}
654
+ }
655
+ return { redirectUri: fallbackUri };
656
+ }
657
+
658
+ // ─── Session Creation ────────────────────────────────────────────────────────
659
+
660
+ export interface OAuthOwnerResult {
661
+ owner: string | undefined;
662
+ hasProductionSession: boolean;
663
+ }
664
+
665
+ /**
666
+ * Determine the token owner from the current session and OAuth state.
667
+ * Call this BEFORE exchangeCode to get the owner parameter.
668
+ */
669
+ export async function resolveOAuthOwner(
670
+ event: H3Event,
671
+ stateOwner?: string,
672
+ ): Promise<OAuthOwnerResult> {
673
+ const existingSession = await getSession(event);
674
+ const hasProductionSession = !!existingSession?.email;
675
+ const owner = hasProductionSession
676
+ ? existingSession!.email
677
+ : stateOwner || undefined;
678
+
679
+ return { owner, hasProductionSession };
680
+ }
681
+
682
+ export interface OAuthSessionResult {
683
+ sessionToken: string | undefined;
684
+ }
685
+
686
+ /**
687
+ * Create a session token after a successful OAuth exchange.
688
+ *
689
+ * Desktop and mobile apps have separate cookie jars from the system
690
+ * browser, so they always get a fresh session token (even if the browser
691
+ * already has one). The token is then passed via deep link so the native
692
+ * app can inject it.
693
+ */
694
+ export async function createOAuthSession(
695
+ event: H3Event,
696
+ email: string,
697
+ opts: {
698
+ hasProductionSession: boolean;
699
+ desktop?: boolean;
700
+ trackSignup?: {
701
+ authProvider: string;
702
+ authUserId?: string;
703
+ name?: string | null;
704
+ attribution?: Record<string, string | undefined>;
705
+ };
706
+ },
707
+ ): Promise<OAuthSessionResult> {
708
+ const mobile = isMobile(event);
709
+ const needsDeepLink = opts.desktop || mobile;
710
+ const maxAge = getSessionMaxAge();
711
+
712
+ let sessionToken: string | undefined;
713
+ let shouldTrackSignup = false;
714
+ if (!opts.hasProductionSession || needsDeepLink) {
715
+ if (opts.trackSignup && !opts.hasProductionSession) {
716
+ const [hasLegacySession, hasBetterAuthUser] = await Promise.all([
717
+ hasLegacySessionForEmail(email).catch(() => true),
718
+ hasBetterAuthUserEmail(email).catch(() => true),
719
+ ]);
720
+ shouldTrackSignup = !hasLegacySession && !hasBetterAuthUser;
721
+ }
722
+
723
+ sessionToken = crypto.randomBytes(32).toString("hex");
724
+ await addSession(sessionToken, email);
725
+ setFrameworkSessionCookie(event, sessionToken);
726
+ if (shouldTrackSignup && opts.trackSignup) {
727
+ const attribution =
728
+ opts.trackSignup.attribution ??
729
+ signupAttributionFromCookieHeader(getHeader(event, "cookie") ?? null);
730
+ await trackSignupEvent({
731
+ authProvider: opts.trackSignup.authProvider,
732
+ authUserId: opts.trackSignup.authUserId,
733
+ email,
734
+ name: opts.trackSignup.name,
735
+ attribution,
736
+ });
737
+ }
738
+ // Desktop SSO: record this session in the home-dir broker file so
739
+ // sibling templates (each with its own database) can resolve the
740
+ // same token without a DB row of their own. Only the PRIMARY
741
+ // sign-in writes the broker — if a production session already
742
+ // exists, this is an add-account flow (connecting a secondary
743
+ // Google account for scraping) and must never switch the active
744
+ // user across sibling templates.
745
+ if (opts.desktop && !opts.hasProductionSession) {
746
+ await writeDesktopSso({
747
+ email,
748
+ token: sessionToken,
749
+ expiresAt: Date.now() + maxAge * 1000,
750
+ });
751
+ }
752
+ }
753
+
754
+ return { sessionToken };
755
+ }
756
+
757
+ // ─── Callback Responses ──────────────────────────────────────────────────────
758
+
759
+ /**
760
+ * Return the appropriate response after a successful OAuth callback.
761
+ *
762
+ * Handles mobile deep links, desktop deep links, add-account close-tab
763
+ * pages, and plain web redirects — so templates don't have to.
764
+ */
765
+ export function oauthCallbackResponse(
766
+ event: H3Event,
767
+ email: string,
768
+ opts: {
769
+ sessionToken?: string;
770
+ desktop?: boolean;
771
+ addAccount?: boolean;
772
+ /**
773
+ * Same-origin path to return the viewer to after a successful web
774
+ * sign-in. Validated via safeReturnPath; falls back to "/" for any
775
+ * shape that escapes same-origin. Has no effect on desktop / mobile
776
+ * / add-account flows — those use their own deep-link handling.
777
+ */
778
+ returnUrl?: string;
779
+ flowId?: string;
780
+ appName?: string;
781
+ },
782
+ ): Response | string | unknown | Promise<Response | string | unknown> {
783
+ const mobile = isMobile(event);
784
+ const query = getQuery(event);
785
+ const callbackState =
786
+ typeof query.state === "string" && query.state.length > 0
787
+ ? query.state
788
+ : undefined;
789
+
790
+ // Mobile: deep link back to the native app. `isMobile` is UA-only, so this
791
+ // also fires for a plain mobile web browser with no app to handle the deep
792
+ // link — there it no-ops, so the fallback must return to the post-login URL,
793
+ // not the app root (else signed-out visitors land on the homepage).
794
+ if (mobile) {
795
+ const deepLink = buildOAuthCompleteDeepLink(
796
+ opts.sessionToken,
797
+ callbackState,
798
+ );
799
+ const webFallback = appendSessionToOAuthReturnUrl(
800
+ opts.returnUrl,
801
+ opts.sessionToken,
802
+ );
803
+ return htmlResponse(
804
+ `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>Connected</title></head><body style="background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><p>Connected! Returning to app…</p><script>window.location.href=${JSON.stringify(deepLink)};setTimeout(function(){window.location.href=${JSON.stringify(webFallback)}},1500)</script></body></html>`,
805
+ );
806
+ }
807
+
808
+ // Desktop add-account: close-tab page (must come before general desktop check
809
+ // to ensure no deep link fires and the existing session is never switched).
810
+ if (opts.desktop && opts.addAccount) {
811
+ const safeEmail = email ? escapeHtml(email) : "";
812
+ const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));
813
+ const msg = safeEmail ? `Connected ${safeEmail}!` : "Connected!";
814
+ return htmlResponse(
815
+ oauthSuccessCloseTabHtml(
816
+ msg,
817
+ `You can close this tab and return to ${safeAppName}.`,
818
+ oauthDebugFlowId(opts.flowId),
819
+ ),
820
+ );
821
+ }
822
+
823
+ // Electron desktop exchange flow: mail/calendar still pass a flow id so the
824
+ // renderer can poll as a fallback, but the main handoff should use the
825
+ // protocol deep link so the popup returns focus to the desktop app.
826
+ if (opts.desktop && opts.flowId && isElectron(event) && opts.sessionToken) {
827
+ return desktopSuccessPage(event, email, opts.sessionToken, callbackState);
828
+ }
829
+
830
+ // Desktop exchange flow (non-Electron tray app): the tray app polls the
831
+ // desktop-exchange endpoint for the token — no deep link needed.
832
+ if (opts.desktop && opts.flowId) {
833
+ const safeEmail = email ? escapeHtml(email) : "";
834
+ const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));
835
+ const msg = safeEmail ? `Signed in as ${safeEmail}!` : "Signed in!";
836
+ return htmlResponse(
837
+ oauthSuccessCloseTabHtml(
838
+ msg,
839
+ `You can close this tab and return to ${safeAppName}.`,
840
+ oauthDebugFlowId(opts.flowId),
841
+ ),
842
+ );
843
+ }
844
+
845
+ // Desktop login: deep link back to Electron app — only when the callback
846
+ // request actually carries the AgentNativeDesktop UA marker. Without this
847
+ // check, any client whose OAuth state was minted with `desktop=true` (e.g.
848
+ // a stale link, or an upstream that wrongly set `?desktop=1`) would land
849
+ // on the `agentnative://` page where the deep link can't fire and the
850
+ // "Open Agent Native" button does nothing — surfaces inside Builder.io's
851
+ // Fusion webview hit this exact dead-end. Fall through to the web flow
852
+ // for non-Agent-Native-Desktop clients so they get a real redirect.
853
+ if (opts.desktop && isElectron(event)) {
854
+ return desktopSuccessPage(event, email, opts.sessionToken, callbackState);
855
+ }
856
+
857
+ // Add-account web flow: close-tab page. The email is rendered into the
858
+ // page via DOM `textContent` (safe), but we still JSON-stringify so a
859
+ // payload containing `</script>` can't break out of the script tag —
860
+ // and explicitly assert it's a string so a callbacks like `null` or
861
+ // an object won't end up serialised into the page.
862
+ if (opts.addAccount) {
863
+ const safeEmail = JSON.stringify(typeof email === "string" ? email : "");
864
+ return htmlResponse(`<!DOCTYPE html><html><body><script>
865
+ window.close();
866
+ var p = document.createElement('p');
867
+ p.style.cssText = 'font-family:system-ui;text-align:center;margin-top:40vh';
868
+ p.textContent = 'Connected ' + ${safeEmail} + '! You can close this tab.';
869
+ document.body.appendChild(p);
870
+ </script></body></html>`);
871
+ }
872
+
873
+ // Web: redirect to the requested return target. Path-only returns stay
874
+ // same-origin; Builder desktop workspace returns may point back to the
875
+ // local loopback gateway and carry the short-lived `_session` bridge so
876
+ // the local app can promote the newly created hosted OAuth session.
877
+ const location = appendSessionToOAuthReturnUrl(
878
+ opts.returnUrl,
879
+ opts.sessionToken,
880
+ );
881
+ setResponseStatus(event, 302);
882
+ setResponseHeader(event, "Location", location);
883
+ setResponseHeader(event, "Referrer-Policy", "no-referrer");
884
+ // Return a real 302 so the browser lands on the clean return URL instead of
885
+ // lingering on the provider callback URL with its `code`/`state` query
886
+ // params. But h3 hands a non-2xx web `Response` straight back WITHOUT merging
887
+ // the `Set-Cookie` staged earlier in the callback (the framework session
888
+ // cookie), so mirror those staged cookies onto the redirect Response —
889
+ // otherwise the sign-in succeeds but the browser arrives back logged out.
890
+ const headers = new Headers({
891
+ Location: location,
892
+ "Referrer-Policy": "no-referrer",
893
+ });
894
+ for (const cookie of event.res?.headers?.getSetCookie?.() ?? []) {
895
+ headers.append("set-cookie", cookie);
896
+ }
897
+ return new Response(null, { status: 302, headers });
898
+ }
899
+
900
+ /** HTML error page for OAuth failures. The message is HTML-escaped — most
901
+ * callers pass `error.message` from a token-exchange or userinfo failure,
902
+ * which can echo upstream provider strings (and historically attacker-
903
+ * controlled query params via the `error_description` field). */
904
+ export function oauthErrorPage(message: string): Response {
905
+ const safe = escapeHtml(message);
906
+ return htmlResponse(
907
+ `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connection failed</title></head><body style="background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;text-align:center"><svg width="44" height="44" viewBox="0 0 24 24" fill="none" stroke="#ef4444" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="margin-bottom:14px" aria-hidden="true"><circle cx="12" cy="12" r="10"/><path d="M15 9l-6 6"/><path d="M9 9l6 6"/></svg><p style="font-size:16px;margin:0 0 12px 0;color:#ddd">${safe}</p><p style="font-size:13px;color:#888;margin:0"><a href="/" style="color:#888;text-decoration:underline;text-underline-offset:3px">Back to login</a></p></body></html>`,
908
+ 400,
909
+ );
910
+ }
911
+
912
+ export function oauthDesktopExchangePage(
913
+ message = "Returning to the app...",
914
+ ): Response {
915
+ const safe = escapeHtml(message);
916
+ return htmlResponse(
917
+ `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Returning</title></head><body style="background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><p style="font-size:14px">${safe}</p><script>window.close()</script></body></html>`,
918
+ );
919
+ }
920
+
921
+ // ─── Internal ────────────────────────────────────────────────────────────────
922
+
923
+ function resolveOAuthAppName(explicit?: string): string {
924
+ const raw = explicit || getAppName() || "Agent Native";
925
+ if (!/^[a-z0-9_-]+$/.test(raw)) return raw;
926
+ return raw
927
+ .split(/[-_]+/)
928
+ .filter(Boolean)
929
+ .map((word) => word[0].toUpperCase() + word.slice(1))
930
+ .join(" ");
931
+ }
932
+
933
+ function buildOAuthCompleteDeepLink(
934
+ sessionToken?: string,
935
+ state?: string,
936
+ ): string {
937
+ const params = new URLSearchParams();
938
+ if (sessionToken) params.set("token", sessionToken);
939
+ if (state) params.set("state", state);
940
+ const suffix = params.toString();
941
+ return suffix
942
+ ? `agentnative://oauth-complete?${suffix}`
943
+ : "agentnative://oauth-complete";
944
+ }
945
+
946
+ function desktopSuccessPage(
947
+ _event: H3Event,
948
+ email?: string,
949
+ sessionToken?: string,
950
+ state?: string,
951
+ ): Response {
952
+ const safeEmail = email ? escapeHtml(email) : "";
953
+ const msg = safeEmail ? `Connected ${safeEmail}!` : "Connected!";
954
+ if (sessionToken) {
955
+ const deepLink = buildOAuthCompleteDeepLink(sessionToken, state);
956
+ const deepLinkJson = JSON.stringify(deepLink);
957
+ // Defence in depth: if this page somehow gets served to a UA that isn't
958
+ // the Agent Native desktop app (server gate bypassed, stale link, etc.),
959
+ // skip the `agentnative://` deep link entirely and bounce to the app
960
+ // root. The deep link silently fails outside the desktop app and the
961
+ // "Open Agent Native" button is a dead end in a generic browser/webview.
962
+ return htmlResponse(
963
+ `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connected</title><style>@keyframes spin{to{transform:rotate(360deg)}}@keyframes fadeIn{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}.spinner{width:28px;height:28px;border:2px solid #333;border-top-color:#fff;border-radius:50%;animation:spin .8s linear infinite}.fallback{display:none;flex-direction:column;align-items:center;gap:8px;animation:fadeIn .2s ease-out}.fallback.show{display:flex}</style></head><body style="background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:16px"><p style="font-size:16px;margin:0">${msg}</p><div id="loading" class="spinner"></div><div id="fallback" class="fallback"><a href=${deepLinkJson} style="display:inline-block;padding:10px 24px;background:#fff;color:#000;border-radius:8px;text-decoration:none;font-size:14px;font-weight:500">Open Agent Native</a><p style="font-size:12px;color:#666;margin:0">If the app didn\u2019t open automatically, click the button above.</p></div><script>(function(){var ua=(navigator.userAgent||"");if(ua.indexOf("AgentNativeDesktop")===-1){window.location.replace("/");return}window.location.href=${deepLinkJson};setTimeout(function(){document.getElementById("loading").style.display="none";document.getElementById("fallback").classList.add("show")},3000)})()</script></body></html>`,
964
+ );
965
+ }
966
+ return htmlResponse(
967
+ oauthSuccessCloseTabHtml(
968
+ msg,
969
+ "You can close this tab and return to Agent Native.",
970
+ ),
971
+ );
972
+ }