@agent-native/core 0.118.0 → 0.119.0

package/dist/mcp-client/oauth-routes.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { deleteCookie, defineEventHandler, getCookie, getMethod, getQuery, setCookie, setResponseStatus, } from "h3";
+import { deleteCookie, defineEventHandler, getChunkedCookie, getCookie, getMethod, getQuery, setChunkedCookie, setResponseStatus, } from "h3";
 import { getOrgContext } from "../org/context.js";
 import { decryptSecretValue, encryptSecretValue } from "../secrets/crypto.js";
 import { getSession, safeReturnPath } from "../server/auth.js";
@@ -10,6 +10,9 @@ import { finishMcpOAuthAuthorization, startMcpOAuthAuthorization, } from "./oaut
 import { addOAuthRemoteServer, normalizeServerName, validateRemoteUrl, } from "./remote-store.js";
 const FLOW_COOKIE = "an_mcp_oauth_flow";
 const FLOW_TTL_SECONDS = 10 * 60;
+const FLOW_COOKIE_CHUNK_SIZE = 2_800;
+const FLOW_COOKIE_MAX_CHUNKS = 8;
+const CHUNKED_COOKIE_PREFIX = "__chunked__";
 export function redirectWithStagedCookies(event, location) {
     const headers = new Headers({
         Location: location,
@@ -119,13 +122,7 @@ async function handleMcpOAuthStart(event) {
             ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),
             expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
         };
-        setCookie(event, FLOW_COOKIE, encryptSecretValue(JSON.stringify(flow)), {
-            httpOnly: true,
-            secure: redirectUri.startsWith("https://"),
-            sameSite: "lax",
-            path: "/",
-            maxAge: FLOW_TTL_SECONDS,
-        });
+        setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith("https://"));
         return redirectWithStagedCookies(event, started.authorizationUrl.href);
     }
     catch {
@@ -143,8 +140,8 @@ async function handleMcpOAuthCallback(event, options) {
     const code = text(query.code);
     const state = text(query.state);
     const providerError = text(query.error);
-    const flow = readFlow(event);
-    deleteCookie(event, FLOW_COOKIE, { path: "/" });
+    const flow = readMcpOAuthFlowCookie(event);
+    clearMcpOAuthFlowCookies(event);
     if (providerError || !code || !state) {
         setResponseStatus(event, 400);
         return { error: "MCP OAuth authorization was not completed." };
@@ -191,8 +188,34 @@ async function handleMcpOAuthCallback(event, options) {
         return { error: "MCP OAuth authorization could not be completed." };
     }
 }
-function readFlow(event) {
-    const encrypted = getCookie(event, FLOW_COOKIE);
+export function setMcpOAuthFlowCookie(event, flow, secure) {
+    const encrypted = encryptSecretValue(JSON.stringify(flow));
+    const chunkCount = Math.ceil(encrypted.length / FLOW_COOKIE_CHUNK_SIZE);
+    if (chunkCount > FLOW_COOKIE_MAX_CHUNKS) {
+        throw new Error("MCP OAuth flow state exceeds the cookie size limit.");
+    }
+    setChunkedCookie(event, FLOW_COOKIE, encrypted, {
+        httpOnly: true,
+        secure,
+        sameSite: "lax",
+        path: "/",
+        maxAge: FLOW_TTL_SECONDS,
+        chunkMaxLength: FLOW_COOKIE_CHUNK_SIZE,
+    });
+}
+export function readMcpOAuthFlowCookie(event) {
+    const primaryCookie = getCookie(event, FLOW_COOKIE);
+    if (!primaryCookie)
+        return null;
+    if (primaryCookie.startsWith(CHUNKED_COOKIE_PREFIX)) {
+        const rawCount = primaryCookie.slice(CHUNKED_COOKIE_PREFIX.length);
+        if (!/^\d+$/.test(rawCount))
+            return null;
+        const chunkCount = Number(rawCount);
+        if (chunkCount < 2 || chunkCount > FLOW_COOKIE_MAX_CHUNKS)
+            return null;
+    }
+    const encrypted = getChunkedCookie(event, FLOW_COOKIE);
     if (!encrypted)
         return null;
     try {
@@ -203,6 +226,12 @@ function readFlow(event) {
         return null;
     }
 }
+export function clearMcpOAuthFlowCookies(event) {
+    deleteCookie(event, FLOW_COOKIE, { path: "/" });
+    for (let index = 1; index <= FLOW_COOKIE_MAX_CHUNKS; index += 1) {
+        deleteCookie(event, `${FLOW_COOKIE}.${index}`, { path: "/" });
+    }
+}
 export function isValidMcpOAuthFlow(flow, email, orgId, state) {
     const scopeMatches = flow.scope === "user"
         ? flow.scopeId === email && !flow.orgId

package/dist/mcp-client/oauth-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-routes.js","sourceRoot":"","sources":["../../src/mcp-client/oauth-routes.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC;AAuBjC,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,QAAQ,EAAE,QAAQ;QAClB,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAa,EACb,OAA8B;IAE9B,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,gCAAgC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAC9D,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,kCAAkC,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;aACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC/C,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YAClD,OAAO,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAc;IAEd,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,gCAAgC,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GACP,cAAc,KAAK,KAAK;QACtB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,KAAK,GAAmB,cAAc,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,KAAK,KAAK,KAAK,IAAI,cAAc,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QACpE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,2DAA2D;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5D,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,OAAO;gBACZ,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,2DAA2D;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,uBAAuB,CACzC,KAAK,EACL,2CAA2C,CAC5C,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,EAC5D,GAAG,EAAE,CACH,0BAA0B,CAAC;YACzB,SAAS,EAAE,QAAQ,CAAC,GAAI,CAAC,QAAQ,EAAE;YACnC,WAAW,EAAE,WAAW;YACxB,KAAK;SACN,CAAC,CACL,CAAC;QACF,MAAM,IAAI,GAAiB;YACzB,IAAI;YACJ,GAAG,EAAE,QAAQ,CAAC,GAAI,CAAC,QAAQ,EAAE;YAC7B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,KAAK;YACL,OAAO;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,GAAG,CAAC,OAAO,CAAC,cAAc;gBACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,KAAK;SACjD,CAAC;QACF,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE;YACtE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;YAC1C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QACH,OAAO,yBAAyB,CAAC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,wHAAwH;SAC3H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAAc,EACd,OAA8B;IAE9B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,IAAI,aAAa,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GACP,IAAI,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IACE,CAAC,IAAI;QACL,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,KAAK,CAAC,EACzE,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,oEAAoE;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,EAC5D,GAAG,EAAE,CACH,2BAA2B,CAAC;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI;SACxB,CAAC,CACL,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;YAClE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,UAAU,GACd,IAAI,CAAC,SAAS;YACd,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,yBAAyB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAiB,CAAC;QACzE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,KAAa,EACb,KAAyB,EACzB,KAAa;IAEb,MAAM,YAAY,GAChB,IAAI,CAAC,KAAK,KAAK,MAAM;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK;QACvC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;IAC7E,OAAO,CACL,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,YAAY;QACZ,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QACpC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AAC9C,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport type { OAuthClientInformationMixed } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  deleteCookie,\n  defineEventHandler,\n  getCookie,\n  getMethod,\n  getQuery,\n  setCookie,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport { getOrgContext } from \"../org/context.js\";\nimport { decryptSecretValue, encryptSecretValue } from \"../secrets/crypto.js\";\nimport { getSession, safeReturnPath } from \"../server/auth.js\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { getAppUrl, resolveOAuthRedirectUri } from \"../server/google-oauth.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport {\n  finishMcpOAuthAuthorization,\n  startMcpOAuthAuthorization,\n  type McpOAuthDiscoveryState,\n} from \"./oauth-client.js\";\nimport {\n  addOAuthRemoteServer,\n  normalizeServerName,\n  validateRemoteUrl,\n  type RemoteMcpScope,\n} from \"./remote-store.js\";\n\nconst FLOW_COOKIE = \"an_mcp_oauth_flow\";\nconst FLOW_TTL_SECONDS = 10 * 60;\n\nexport interface McpOAuthFlow {\n  name: string;\n  url: string;\n  description?: string;\n  scope: RemoteMcpScope;\n  scopeId: string;\n  owner: string;\n  orgId?: string;\n  redirectUri: string;\n  state: string;\n  codeVerifier: string;\n  clientInformation: OAuthClientInformationMixed;\n  discoveryState?: McpOAuthDiscoveryState;\n  returnUrl?: string;\n  expiresAt: number;\n}\n\nexport interface McpOAuthRoutesOptions {\n  reconfigure: () => Promise<void>;\n}\n\nexport function redirectWithStagedCookies(\n  event: H3Event,\n  location: string,\n): Response {\n  const headers = new Headers({\n    Location: location,\n    \"Cache-Control\": \"no-store\",\n  });\n  for (const cookie of event.res?.headers?.getSetCookie?.() ?? []) {\n    headers.append(\"set-cookie\", cookie);\n  }\n  return new Response(null, { status: 302, headers });\n}\n\nexport function mountMcpOAuthRoutes(\n  nitroApp: any,\n  options: McpOAuthRoutesOptions,\n): void {\n  const mountedApps: WeakSet<object> = ((\n    globalThis as any\n  ).__agentNativeMcpOAuthMountedApps ??= new WeakSet<object>());\n  if (mountedApps.has(nitroApp)) return;\n  mountedApps.add(nitroApp);\n\n  getH3App(nitroApp).use(\n    \"/_agent-native/mcp/servers/oauth\",\n    defineEventHandler(async (event: H3Event) => {\n      const method = getMethod(event);\n      const pathname = (event.url?.pathname || \"\")\n        .replace(/^\\/+/, \"\")\n        .replace(/\\/+$/, \"\");\n      const parts = pathname ? pathname.split(\"/\") : [];\n      if (method !== \"GET\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n      if (parts.length === 1 && parts[0] === \"start\") {\n        return handleMcpOAuthStart(event);\n      }\n      if (parts.length === 1 && parts[0] === \"callback\") {\n        return handleMcpOAuthCallback(event, options);\n      }\n      setResponseStatus(event, 404);\n      return { error: \"Not found\" };\n    }),\n  );\n}\n\nasync function handleMcpOAuthStart(\n  event: H3Event,\n): Promise<Response | Record<string, unknown>> {\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n\n  const query = getQuery(event);\n  const rawUrl = text(query.url);\n  const rawName = text(query.name);\n  const returnUrl = text(query.return);\n  if (!rawUrl || !rawName) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth requires a server name and URL.\" };\n  }\n  const urlCheck = validateRemoteUrl(rawUrl);\n  if (!urlCheck.ok) {\n    setResponseStatus(event, 400);\n    return { error: urlCheck.error ?? \"MCP server URL is not allowed.\" };\n  }\n  const name = normalizeServerName(rawName);\n  if (!name) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP server name is invalid.\" };\n  }\n\n  const requestedScope = query.scope === \"org\" ? \"org\" : \"user\";\n  const requestedOrgId = text(query.orgId);\n  const org =\n    requestedScope === \"org\"\n      ? await getOrgContext(event).catch(() => null)\n      : null;\n  const scope: RemoteMcpScope = requestedScope;\n  const scopeId = scope === \"user\" ? session.email : (org?.orgId ?? \"\");\n  if (scope === \"org\" && requestedOrgId && requestedOrgId !== scopeId) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"The selected organization is not the active organization.\",\n    };\n  }\n  if (scope === \"org\" && (!scopeId || !isOrgAdmin(org?.role))) {\n    setResponseStatus(event, scopeId ? 403 : 400);\n    return {\n      error: scopeId\n        ? \"Only organization owners and admins can connect an org MCP server.\"\n        : \"Join an organization before connecting an org MCP server.\",\n    };\n  }\n\n  const redirectUri = resolveOAuthRedirectUri(\n    event,\n    \"/_agent-native/mcp/servers/oauth/callback\",\n  );\n  if (!redirectUri) {\n    setResponseStatus(event, 400);\n    return { error: \"Invalid MCP OAuth redirect URI.\" };\n  }\n\n  const state = crypto.randomUUID();\n  const safeReturnUrl = returnUrl ? safeReturnPath(returnUrl) : undefined;\n  try {\n    const started = await runWithRequestContext(\n      { userEmail: session.email, orgId: org?.orgId ?? undefined },\n      () =>\n        startMcpOAuthAuthorization({\n          serverUrl: urlCheck.url!.toString(),\n          redirectUrl: redirectUri,\n          state,\n        }),\n    );\n    const flow: McpOAuthFlow = {\n      name,\n      url: urlCheck.url!.toString(),\n      description: text(query.description),\n      scope,\n      scopeId,\n      owner: session.email,\n      ...(org?.orgId ? { orgId: org.orgId } : {}),\n      redirectUri,\n      state: started.state,\n      codeVerifier: started.codeVerifier,\n      clientInformation: started.clientInformation,\n      ...(started.discoveryState\n        ? { discoveryState: started.discoveryState }\n        : {}),\n      ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),\n      expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,\n    };\n    setCookie(event, FLOW_COOKIE, encryptSecretValue(JSON.stringify(flow)), {\n      httpOnly: true,\n      secure: redirectUri.startsWith(\"https://\"),\n      sameSite: \"lax\",\n      path: \"/\",\n      maxAge: FLOW_TTL_SECONDS,\n    });\n    return redirectWithStagedCookies(event, started.authorizationUrl.href);\n  } catch {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"This MCP server could not start OAuth. It may not support standard MCP OAuth discovery or dynamic client registration.\",\n    };\n  }\n}\n\nasync function handleMcpOAuthCallback(\n  event: H3Event,\n  options: McpOAuthRoutesOptions,\n): Promise<Response | Record<string, unknown>> {\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n\n  const query = getQuery(event);\n  const code = text(query.code);\n  const state = text(query.state);\n  const providerError = text(query.error);\n  const flow = readFlow(event);\n  deleteCookie(event, FLOW_COOKIE, { path: \"/\" });\n  if (providerError || !code || !state) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth authorization was not completed.\" };\n  }\n  const org =\n    flow?.scope === \"org\" ? await getOrgContext(event).catch(() => null) : null;\n  if (\n    !flow ||\n    !isValidMcpOAuthFlow(flow, session.email, org?.orgId ?? undefined, state)\n  ) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth state is invalid or expired.\" };\n  }\n  if (flow.scope === \"org\" && !isOrgAdmin(org?.role)) {\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"Only organization owners and admins can connect an org MCP server.\",\n    };\n  }\n\n  try {\n    const finished = await runWithRequestContext(\n      { userEmail: session.email, orgId: org?.orgId ?? undefined },\n      () =>\n        finishMcpOAuthAuthorization({\n          serverUrl: flow.url,\n          redirectUrl: flow.redirectUri,\n          state: flow.state,\n          clientInformation: flow.clientInformation,\n          codeVerifier: flow.codeVerifier,\n          discoveryState: flow.discoveryState,\n          authorizationCode: code,\n        }),\n    );\n    const result = await addOAuthRemoteServer(flow.scope, flow.scopeId, {\n      name: flow.name,\n      url: flow.url,\n      description: flow.description,\n      credentials: finished.credentials,\n    });\n    if (!result.ok) {\n      setResponseStatus(event, 400);\n      return { error: result.error };\n    }\n    await options.reconfigure();\n    const returnPath =\n      flow.returnUrl ??\n      `/settings/connections?connected=mcp-${encodeURIComponent(flow.name)}`;\n    return redirectWithStagedCookies(event, getAppUrl(event, returnPath));\n  } catch {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth authorization could not be completed.\" };\n  }\n}\n\nfunction readFlow(event: H3Event): McpOAuthFlow | null {\n  const encrypted = getCookie(event, FLOW_COOKIE);\n  if (!encrypted) return null;\n  try {\n    const parsed = JSON.parse(decryptSecretValue(encrypted)) as McpOAuthFlow;\n    return parsed && typeof parsed === \"object\" ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function isValidMcpOAuthFlow(\n  flow: McpOAuthFlow,\n  email: string,\n  orgId: string | undefined,\n  state: string,\n): boolean {\n  const scopeMatches =\n    flow.scope === \"user\"\n      ? flow.scopeId === email && !flow.orgId\n      : flow.scope === \"org\" && flow.scopeId === orgId && flow.orgId === orgId;\n  return (\n    flow.expiresAt >= Date.now() &&\n    flow.owner === email &&\n    flow.state === state &&\n    scopeMatches &&\n    typeof flow.scopeId === \"string\" &&\n    typeof flow.redirectUri === \"string\" &&\n    flow.redirectUri.includes(\"/_agent-native/mcp/servers/oauth/callback\")\n  );\n}\n\nfunction isOrgAdmin(role: unknown): boolean {\n  return role === \"owner\" || role === \"admin\";\n}\n\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction unauthorized(event: H3Event) {\n  setResponseStatus(event, 401);\n  return { error: \"Authentication required\" };\n}\n"]}
+{"version":3,"file":"oauth-routes.js","sourceRoot":"","sources":["../../src/mcp-client/oauth-routes.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC;AACjC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAuB5C,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,QAAQ,EAAE,QAAQ;QAClB,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAa,EACb,OAA8B;IAE9B,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,gCAAgC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAC9D,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,kCAAkC,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;aACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC/C,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YAClD,OAAO,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAc;IAEd,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,gCAAgC,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GACP,cAAc,KAAK,KAAK;QACtB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,KAAK,GAAmB,cAAc,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,KAAK,KAAK,KAAK,IAAI,cAAc,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QACpE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,2DAA2D;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5D,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,OAAO;gBACZ,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,2DAA2D;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,uBAAuB,CACzC,KAAK,EACL,2CAA2C,CAC5C,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,EAC5D,GAAG,EAAE,CACH,0BAA0B,CAAC;YACzB,SAAS,EAAE,QAAQ,CAAC,GAAI,CAAC,QAAQ,EAAE;YACnC,WAAW,EAAE,WAAW;YACxB,KAAK;SACN,CAAC,CACL,CAAC;QACF,MAAM,IAAI,GAAiB;YACzB,IAAI;YACJ,GAAG,EAAE,QAAQ,CAAC,GAAI,CAAC,QAAQ,EAAE;YAC7B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,KAAK;YACL,OAAO;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,GAAG,CAAC,OAAO,CAAC,cAAc;gBACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,KAAK;SACjD,CAAC;QACF,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACvE,OAAO,yBAAyB,CAAC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,wHAAwH;SAC3H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAAc,EACd,OAA8B;IAE9B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC3C,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,aAAa,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GACP,IAAI,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IACE,CAAC,IAAI;QACL,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,KAAK,CAAC,EACzE,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,oEAAoE;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,SAAS,EAAE,EAC5D,GAAG,EAAE,CACH,2BAA2B,CAAC;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,iBAAiB,EAAE,IAAI;SACxB,CAAC,CACL,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;YAClE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,UAAU,GACd,IAAI,CAAC,SAAS;YACd,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,yBAAyB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,IAAkB,EAClB,MAAe;IAEf,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC;IACxE,IAAI,UAAU,GAAG,sBAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE;QAC9C,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,gBAAgB;QACxB,cAAc,EAAE,sBAAsB;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,sBAAsB;YAAE,OAAO,IAAI,CAAC;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAiB,CAAC;QACzE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,sBAAsB,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAChE,YAAY,CAAC,KAAK,EAAE,GAAG,WAAW,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,KAAa,EACb,KAAyB,EACzB,KAAa;IAEb,MAAM,YAAY,GAChB,IAAI,CAAC,KAAK,KAAK,MAAM;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK;QACvC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;IAC7E,OAAO,CACL,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,YAAY;QACZ,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QACpC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AAC9C,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport type { OAuthClientInformationMixed } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  deleteCookie,\n  defineEventHandler,\n  getChunkedCookie,\n  getCookie,\n  getMethod,\n  getQuery,\n  setChunkedCookie,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport { getOrgContext } from \"../org/context.js\";\nimport { decryptSecretValue, encryptSecretValue } from \"../secrets/crypto.js\";\nimport { getSession, safeReturnPath } from \"../server/auth.js\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { getAppUrl, resolveOAuthRedirectUri } from \"../server/google-oauth.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport {\n  finishMcpOAuthAuthorization,\n  startMcpOAuthAuthorization,\n  type McpOAuthDiscoveryState,\n} from \"./oauth-client.js\";\nimport {\n  addOAuthRemoteServer,\n  normalizeServerName,\n  validateRemoteUrl,\n  type RemoteMcpScope,\n} from \"./remote-store.js\";\n\nconst FLOW_COOKIE = \"an_mcp_oauth_flow\";\nconst FLOW_TTL_SECONDS = 10 * 60;\nconst FLOW_COOKIE_CHUNK_SIZE = 2_800;\nconst FLOW_COOKIE_MAX_CHUNKS = 8;\nconst CHUNKED_COOKIE_PREFIX = \"__chunked__\";\n\nexport interface McpOAuthFlow {\n  name: string;\n  url: string;\n  description?: string;\n  scope: RemoteMcpScope;\n  scopeId: string;\n  owner: string;\n  orgId?: string;\n  redirectUri: string;\n  state: string;\n  codeVerifier: string;\n  clientInformation: OAuthClientInformationMixed;\n  discoveryState?: McpOAuthDiscoveryState;\n  returnUrl?: string;\n  expiresAt: number;\n}\n\nexport interface McpOAuthRoutesOptions {\n  reconfigure: () => Promise<void>;\n}\n\nexport function redirectWithStagedCookies(\n  event: H3Event,\n  location: string,\n): Response {\n  const headers = new Headers({\n    Location: location,\n    \"Cache-Control\": \"no-store\",\n  });\n  for (const cookie of event.res?.headers?.getSetCookie?.() ?? []) {\n    headers.append(\"set-cookie\", cookie);\n  }\n  return new Response(null, { status: 302, headers });\n}\n\nexport function mountMcpOAuthRoutes(\n  nitroApp: any,\n  options: McpOAuthRoutesOptions,\n): void {\n  const mountedApps: WeakSet<object> = ((\n    globalThis as any\n  ).__agentNativeMcpOAuthMountedApps ??= new WeakSet<object>());\n  if (mountedApps.has(nitroApp)) return;\n  mountedApps.add(nitroApp);\n\n  getH3App(nitroApp).use(\n    \"/_agent-native/mcp/servers/oauth\",\n    defineEventHandler(async (event: H3Event) => {\n      const method = getMethod(event);\n      const pathname = (event.url?.pathname || \"\")\n        .replace(/^\\/+/, \"\")\n        .replace(/\\/+$/, \"\");\n      const parts = pathname ? pathname.split(\"/\") : [];\n      if (method !== \"GET\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n      if (parts.length === 1 && parts[0] === \"start\") {\n        return handleMcpOAuthStart(event);\n      }\n      if (parts.length === 1 && parts[0] === \"callback\") {\n        return handleMcpOAuthCallback(event, options);\n      }\n      setResponseStatus(event, 404);\n      return { error: \"Not found\" };\n    }),\n  );\n}\n\nasync function handleMcpOAuthStart(\n  event: H3Event,\n): Promise<Response | Record<string, unknown>> {\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n\n  const query = getQuery(event);\n  const rawUrl = text(query.url);\n  const rawName = text(query.name);\n  const returnUrl = text(query.return);\n  if (!rawUrl || !rawName) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth requires a server name and URL.\" };\n  }\n  const urlCheck = validateRemoteUrl(rawUrl);\n  if (!urlCheck.ok) {\n    setResponseStatus(event, 400);\n    return { error: urlCheck.error ?? \"MCP server URL is not allowed.\" };\n  }\n  const name = normalizeServerName(rawName);\n  if (!name) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP server name is invalid.\" };\n  }\n\n  const requestedScope = query.scope === \"org\" ? \"org\" : \"user\";\n  const requestedOrgId = text(query.orgId);\n  const org =\n    requestedScope === \"org\"\n      ? await getOrgContext(event).catch(() => null)\n      : null;\n  const scope: RemoteMcpScope = requestedScope;\n  const scopeId = scope === \"user\" ? session.email : (org?.orgId ?? \"\");\n  if (scope === \"org\" && requestedOrgId && requestedOrgId !== scopeId) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"The selected organization is not the active organization.\",\n    };\n  }\n  if (scope === \"org\" && (!scopeId || !isOrgAdmin(org?.role))) {\n    setResponseStatus(event, scopeId ? 403 : 400);\n    return {\n      error: scopeId\n        ? \"Only organization owners and admins can connect an org MCP server.\"\n        : \"Join an organization before connecting an org MCP server.\",\n    };\n  }\n\n  const redirectUri = resolveOAuthRedirectUri(\n    event,\n    \"/_agent-native/mcp/servers/oauth/callback\",\n  );\n  if (!redirectUri) {\n    setResponseStatus(event, 400);\n    return { error: \"Invalid MCP OAuth redirect URI.\" };\n  }\n\n  const state = crypto.randomUUID();\n  const safeReturnUrl = returnUrl ? safeReturnPath(returnUrl) : undefined;\n  try {\n    const started = await runWithRequestContext(\n      { userEmail: session.email, orgId: org?.orgId ?? undefined },\n      () =>\n        startMcpOAuthAuthorization({\n          serverUrl: urlCheck.url!.toString(),\n          redirectUrl: redirectUri,\n          state,\n        }),\n    );\n    const flow: McpOAuthFlow = {\n      name,\n      url: urlCheck.url!.toString(),\n      description: text(query.description),\n      scope,\n      scopeId,\n      owner: session.email,\n      ...(org?.orgId ? { orgId: org.orgId } : {}),\n      redirectUri,\n      state: started.state,\n      codeVerifier: started.codeVerifier,\n      clientInformation: started.clientInformation,\n      ...(started.discoveryState\n        ? { discoveryState: started.discoveryState }\n        : {}),\n      ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),\n      expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,\n    };\n    setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith(\"https://\"));\n    return redirectWithStagedCookies(event, started.authorizationUrl.href);\n  } catch {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"This MCP server could not start OAuth. It may not support standard MCP OAuth discovery or dynamic client registration.\",\n    };\n  }\n}\n\nasync function handleMcpOAuthCallback(\n  event: H3Event,\n  options: McpOAuthRoutesOptions,\n): Promise<Response | Record<string, unknown>> {\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return unauthorized(event);\n\n  const query = getQuery(event);\n  const code = text(query.code);\n  const state = text(query.state);\n  const providerError = text(query.error);\n  const flow = readMcpOAuthFlowCookie(event);\n  clearMcpOAuthFlowCookies(event);\n  if (providerError || !code || !state) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth authorization was not completed.\" };\n  }\n  const org =\n    flow?.scope === \"org\" ? await getOrgContext(event).catch(() => null) : null;\n  if (\n    !flow ||\n    !isValidMcpOAuthFlow(flow, session.email, org?.orgId ?? undefined, state)\n  ) {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth state is invalid or expired.\" };\n  }\n  if (flow.scope === \"org\" && !isOrgAdmin(org?.role)) {\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"Only organization owners and admins can connect an org MCP server.\",\n    };\n  }\n\n  try {\n    const finished = await runWithRequestContext(\n      { userEmail: session.email, orgId: org?.orgId ?? undefined },\n      () =>\n        finishMcpOAuthAuthorization({\n          serverUrl: flow.url,\n          redirectUrl: flow.redirectUri,\n          state: flow.state,\n          clientInformation: flow.clientInformation,\n          codeVerifier: flow.codeVerifier,\n          discoveryState: flow.discoveryState,\n          authorizationCode: code,\n        }),\n    );\n    const result = await addOAuthRemoteServer(flow.scope, flow.scopeId, {\n      name: flow.name,\n      url: flow.url,\n      description: flow.description,\n      credentials: finished.credentials,\n    });\n    if (!result.ok) {\n      setResponseStatus(event, 400);\n      return { error: result.error };\n    }\n    await options.reconfigure();\n    const returnPath =\n      flow.returnUrl ??\n      `/settings/connections?connected=mcp-${encodeURIComponent(flow.name)}`;\n    return redirectWithStagedCookies(event, getAppUrl(event, returnPath));\n  } catch {\n    setResponseStatus(event, 400);\n    return { error: \"MCP OAuth authorization could not be completed.\" };\n  }\n}\n\nexport function setMcpOAuthFlowCookie(\n  event: H3Event,\n  flow: McpOAuthFlow,\n  secure: boolean,\n): void {\n  const encrypted = encryptSecretValue(JSON.stringify(flow));\n  const chunkCount = Math.ceil(encrypted.length / FLOW_COOKIE_CHUNK_SIZE);\n  if (chunkCount > FLOW_COOKIE_MAX_CHUNKS) {\n    throw new Error(\"MCP OAuth flow state exceeds the cookie size limit.\");\n  }\n  setChunkedCookie(event, FLOW_COOKIE, encrypted, {\n    httpOnly: true,\n    secure,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: FLOW_TTL_SECONDS,\n    chunkMaxLength: FLOW_COOKIE_CHUNK_SIZE,\n  });\n}\n\nexport function readMcpOAuthFlowCookie(event: H3Event): McpOAuthFlow | null {\n  const primaryCookie = getCookie(event, FLOW_COOKIE);\n  if (!primaryCookie) return null;\n  if (primaryCookie.startsWith(CHUNKED_COOKIE_PREFIX)) {\n    const rawCount = primaryCookie.slice(CHUNKED_COOKIE_PREFIX.length);\n    if (!/^\\d+$/.test(rawCount)) return null;\n    const chunkCount = Number(rawCount);\n    if (chunkCount < 2 || chunkCount > FLOW_COOKIE_MAX_CHUNKS) return null;\n  }\n  const encrypted = getChunkedCookie(event, FLOW_COOKIE);\n  if (!encrypted) return null;\n  try {\n    const parsed = JSON.parse(decryptSecretValue(encrypted)) as McpOAuthFlow;\n    return parsed && typeof parsed === \"object\" ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function clearMcpOAuthFlowCookies(event: H3Event): void {\n  deleteCookie(event, FLOW_COOKIE, { path: \"/\" });\n  for (let index = 1; index <= FLOW_COOKIE_MAX_CHUNKS; index += 1) {\n    deleteCookie(event, `${FLOW_COOKIE}.${index}`, { path: \"/\" });\n  }\n}\n\nexport function isValidMcpOAuthFlow(\n  flow: McpOAuthFlow,\n  email: string,\n  orgId: string | undefined,\n  state: string,\n): boolean {\n  const scopeMatches =\n    flow.scope === \"user\"\n      ? flow.scopeId === email && !flow.orgId\n      : flow.scope === \"org\" && flow.scopeId === orgId && flow.orgId === orgId;\n  return (\n    flow.expiresAt >= Date.now() &&\n    flow.owner === email &&\n    flow.state === state &&\n    scopeMatches &&\n    typeof flow.scopeId === \"string\" &&\n    typeof flow.redirectUri === \"string\" &&\n    flow.redirectUri.includes(\"/_agent-native/mcp/servers/oauth/callback\")\n  );\n}\n\nfunction isOrgAdmin(role: unknown): boolean {\n  return role === \"owner\" || role === \"admin\";\n}\n\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction unauthorized(event: H3Event) {\n  setResponseStatus(event, 401);\n  return { error: \"Authentication required\" };\n}\n"]}

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
+    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,10 +59,10 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,8 +75,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    id?: undefined;
     deleted?: undefined;
+    id?: undefined;
+    provider?: undefined;
+    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -87,16 +89,14 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    provider?: undefined;
-    found?: undefined;
     registered?: undefined;
     label?: undefined;
     message?: undefined;
 } | {
-    id?: undefined;
     deleted?: undefined;
-    providers?: undefined;
     count?: undefined;
+    id?: undefined;
+    providers?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
@@ -104,19 +104,19 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     message?: undefined;
 } | {
     deleted?: undefined;
-    providers?: undefined;
     count?: undefined;
     provider?: undefined;
+    providers?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
     message?: undefined;
 } | {
-    providers?: undefined;
     count?: undefined;
     provider?: undefined;
     found?: undefined;
+    providers?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
@@ -124,10 +124,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     message?: undefined;
 } | {
     deleted?: undefined;
-    providers?: undefined;
     count?: undefined;
     provider?: undefined;
     found?: undefined;
+    providers?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -309,9 +309,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        message?: undefined;
         id?: undefined;
-        deleted?: undefined;
+        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -323,45 +322,46 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         }[];
         count: number;
         provider?: undefined;
-        found?: undefined;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
+    } | {
         id?: undefined;
-        deleted?: undefined;
         count?: undefined;
         providers?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        deleted?: undefined;
+    } | {
         count?: undefined;
         providers?: undefined;
         provider?: undefined;
         found: boolean;
         id: string;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
+    } | {
+        found?: undefined;
         count?: undefined;
         providers?: undefined;
         provider?: undefined;
-        found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        deleted?: undefined;
+        found?: undefined;
         count?: undefined;
         providers?: undefined;
         provider?: undefined;
-        found?: undefined;
+        deleted?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/scripts/agent-engines/list-agent-engines.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-agent-engines.d.ts","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAcH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,eAAO,MAAM,IAAI,EAAE,UAQlB,CAAC;AAEF,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkG5E"}
+{"version":3,"file":"list-agent-engines.d.ts","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAcH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGvD,eAAO,MAAM,IAAI,EAAE,UAQlB,CAAC;AAEF,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmF5E"}

package/dist/scripts/agent-engines/list-agent-engines.js

@@ -4,8 +4,6 @@
 import { getAgentAppModelDefaultForCurrentRequest } from "../../agent/app-model-defaults.js";
 import { DEFAULT_MODEL } from "../../agent/default-model.js";
 import { listAgentEngines, registerBuiltinEngines, detectEngineFromEnv, detectEngineFromUserSecrets, getAgentEngineEntry, isAgentEnginePackageInstalled, isStoredEngineUsableForRequest, normalizeModelForEngine, } from "../../agent/engine/index.js";
-import { resolveHostedDefaultModelExperiment } from "../../observability/hosted-model-experiment.js";
-import { getRequestUserEmail } from "../../server/request-context.js";
 import { getSetting } from "../../settings/index.js";
 export const tool = {
     description: 'List all available AI agent engines (Anthropic, OpenAI, Gemini, Groq, etc.) and the currently selected engine. Use this to check what engines are available before calling manage-agent-engine with action="set".',
@@ -64,15 +62,6 @@ export async function run(args = {}) {
     const currentModel = currentEntry && !envUnavailable
         ? normalizeModelForEngine(currentEntry, currentModelCandidate ?? currentEntry.defaultModel)
         : (currentModelCandidate ?? DEFAULT_MODEL);
-    const hostedExperiment = currentEntry
-        ? resolveHostedDefaultModelExperiment({
-            userId: getRequestUserEmail(),
-            engineName: currentEntry.name,
-            isDefaultModelSelection: currentModelCandidate == null,
-            supportedModels: currentEntry.supportedModels,
-        })
-        : null;
-    const effectiveCurrentModel = hostedExperiment?.model ?? currentModel;
     const result = {
         engines: engines.map((e) => ({
             name: e.name,
@@ -89,13 +78,7 @@ export async function run(args = {}) {
             ? null
             : {
                 engine: currentEngineName,
-                model: effectiveCurrentModel,
-                ...(hostedExperiment
-                    ? {
-                        modelSelectionSource: "experiment",
-                        experimentAssignments: [hostedExperiment.assignment],
-                    }
-                    : {}),
+                model: currentModel,
             },
     };
     return JSON.stringify(result, null, 2);

package/dist/scripts/agent-engines/list-agent-engines.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-agent-engines.js","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,CAAC,MAAM,IAAI,GAAe;IAC9B,WAAW,EACT,mNAAmN;IACrN,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAI,GAA2B,EAAE;IACzD,sBAAsB,EAAE,CAAC;IAEzB,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,cAAc;QAC5B,CAAC,CAAE,cAAsD;QACzD,CAAC,CAAC,IAAI,CAAC;IAET,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,WAAW,GACf,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,YAAY,GAChB,CAAC,CAAC,WAAW;QACb,CAAC,MAAM,8BAA8B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,eAAe,GACnB,OAAO,UAAU,EAAE,MAAM,KAAK,QAAQ;QACpC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GACpB,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,eAAe;QACjB,CAAC,MAAM,8BAA8B,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY;QACvC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GACb,CAAC,CAAC,QAAQ;QACV,CAAC,MAAM,8BAA8B,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC;IAChD,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAC;IAC9C,MAAM,gBAAgB,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1D,MAAM,YAAY,GAAG,cAAc;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,gBAAgB;YACjB,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACxC,gBAAgB;YAChB,eAAe;YACf,SAAS,CAAC,CAAC;IACf,MAAM,qBAAqB,GACzB,gBAAgB,IAAI,YAAY,EAAE,IAAI,KAAK,UAAU,EAAE,MAAM;QAC3D,CAAC,CAAC,UAAU,EAAE,KAAK;QACnB,CAAC,CAAC,YAAY,IAAI,YAAY,EAAE,IAAI,KAAK,OAAO,EAAE,MAAM;YACtD,CAAC,CAAC,OAAO,EAAE,KAAK;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,iBAAiB,GAAG,YAAY,EAAE,IAAI,IAAI,WAAW,CAAC;IAC5D,MAAM,YAAY,GAChB,YAAY,IAAI,CAAC,cAAc;QAC7B,CAAC,CAAC,uBAAuB,CACrB,YAAY,EACZ,qBAAqB,IAAI,YAAY,CAAC,YAAY,CACnD;QACH,CAAC,CAAC,CAAC,qBAAqB,IAAI,aAAa,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,YAAY;QACnC,CAAC,CAAC,mCAAmC,CAAC;YAClC,MAAM,EAAE,mBAAmB,EAAE;YAC7B,UAAU,EAAE,YAAY,CAAC,IAAI;YAC7B,uBAAuB,EAAE,qBAAqB,IAAI,IAAI;YACtD,eAAe,EAAE,YAAY,CAAC,eAAe;SAC9C,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,qBAAqB,GAAG,gBAAgB,EAAE,KAAK,IAAI,YAAY,CAAC;IACtE,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,EAAE,cAAc;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,MAAM,EAAE,iBAAiB;gBACzB,KAAK,EAAE,qBAAqB;gBAC5B,GAAG,CAAC,gBAAgB;oBAClB,CAAC,CAAC;wBACE,oBAAoB,EAAE,YAAY;wBAClC,qBAAqB,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC;qBACrD;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;KACN,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC","sourcesContent":["/**\n * list-agent-engines — returns the registered engine registry and current selection.\n */\n\nimport { getAgentAppModelDefaultForCurrentRequest } from \"../../agent/app-model-defaults.js\";\nimport { DEFAULT_MODEL } from \"../../agent/default-model.js\";\nimport {\n  listAgentEngines,\n  registerBuiltinEngines,\n  detectEngineFromEnv,\n  detectEngineFromUserSecrets,\n  getAgentEngineEntry,\n  isAgentEnginePackageInstalled,\n  isStoredEngineUsableForRequest,\n  normalizeModelForEngine,\n} from \"../../agent/engine/index.js\";\nimport type { ActionTool } from \"../../agent/types.js\";\nimport { resolveHostedDefaultModelExperiment } from \"../../observability/hosted-model-experiment.js\";\nimport { getRequestUserEmail } from \"../../server/request-context.js\";\nimport { getSetting } from \"../../settings/index.js\";\n\nexport const tool: ActionTool = {\n  description:\n    'List all available AI agent engines (Anthropic, OpenAI, Gemini, Groq, etc.) and the currently selected engine. Use this to check what engines are available before calling manage-agent-engine with action=\"set\".',\n  parameters: {\n    type: \"object\",\n    properties: {},\n    required: [],\n  },\n};\n\nexport async function run(args: Record<string, string> = {}): Promise<string> {\n  registerBuiltinEngines();\n\n  const engines = listAgentEngines();\n  const currentSetting = await getSetting(\"agent-engine\");\n  const current = currentSetting\n    ? (currentSetting as { engine?: string; model?: string })\n    : null;\n\n  // Same priority chain resolveEngine uses after explicit request options:\n  // AGENT_ENGINE → app default → stored (if usable) → user/Builder app_secrets\n  // → env → anthropic. Gating stored/app defaults on the request-aware helper\n  // keeps the picker in step with the runtime.\n  const storedEntry =\n    typeof current?.engine === \"string\"\n      ? getAgentEngineEntry(current.engine)\n      : undefined;\n  const storedUsable =\n    !!storedEntry &&\n    (await isStoredEngineUsableForRequest(current, storedEntry));\n  const appDefault = await getAgentAppModelDefaultForCurrentRequest(args.appId);\n  const appDefaultEntry =\n    typeof appDefault?.engine === \"string\"\n      ? getAgentEngineEntry(appDefault.engine)\n      : undefined;\n  const appDefaultUsable =\n    !!appDefault &&\n    !!appDefaultEntry &&\n    (await isStoredEngineUsableForRequest(appDefault, appDefaultEntry));\n  const detectedFromUser = await detectEngineFromUserSecrets();\n  const envEntry = process.env.AGENT_ENGINE\n    ? getAgentEngineEntry(process.env.AGENT_ENGINE)\n    : undefined;\n  const envUsable =\n    !!envEntry &&\n    (await isStoredEngineUsableForRequest({ engine: envEntry.name }, envEntry));\n  const envUnavailable = !!envEntry && !envUsable;\n  const detectedFromEnv = detectEngineFromEnv();\n  const envSelectedEntry = envUsable ? envEntry : undefined;\n\n  const currentEntry = envUnavailable\n    ? undefined\n    : (envSelectedEntry ??\n      (appDefaultUsable ? appDefaultEntry : undefined) ??\n      (storedUsable ? storedEntry : undefined) ??\n      detectedFromUser ??\n      detectedFromEnv ??\n      undefined);\n  const currentModelCandidate =\n    appDefaultUsable && currentEntry?.name === appDefault?.engine\n      ? appDefault?.model\n      : storedUsable && currentEntry?.name === current?.engine\n        ? current?.model\n        : undefined;\n  const currentEngineName = currentEntry?.name ?? \"anthropic\";\n  const currentModel =\n    currentEntry && !envUnavailable\n      ? normalizeModelForEngine(\n          currentEntry,\n          currentModelCandidate ?? currentEntry.defaultModel,\n        )\n      : (currentModelCandidate ?? DEFAULT_MODEL);\n  const hostedExperiment = currentEntry\n    ? resolveHostedDefaultModelExperiment({\n        userId: getRequestUserEmail(),\n        engineName: currentEntry.name,\n        isDefaultModelSelection: currentModelCandidate == null,\n        supportedModels: currentEntry.supportedModels,\n      })\n    : null;\n  const effectiveCurrentModel = hostedExperiment?.model ?? currentModel;\n  const result = {\n    engines: engines.map((e) => ({\n      name: e.name,\n      label: e.label,\n      description: e.description,\n      defaultModel: e.defaultModel,\n      supportedModels: e.supportedModels,\n      capabilities: e.capabilities,\n      requiredEnvVars: e.requiredEnvVars,\n      installPackage: e.installPackage,\n      packageInstalled: isAgentEnginePackageInstalled(e),\n    })),\n    current: envUnavailable\n      ? null\n      : {\n          engine: currentEngineName,\n          model: effectiveCurrentModel,\n          ...(hostedExperiment\n            ? {\n                modelSelectionSource: \"experiment\",\n                experimentAssignments: [hostedExperiment.assignment],\n              }\n            : {}),\n        },\n  };\n\n  return JSON.stringify(result, null, 2);\n}\n"]}
+{"version":3,"file":"list-agent-engines.js","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,CAAC,MAAM,IAAI,GAAe;IAC9B,WAAW,EACT,mNAAmN;IACrN,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAI,GAA2B,EAAE;IACzD,sBAAsB,EAAE,CAAC;IAEzB,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,cAAc;QAC5B,CAAC,CAAE,cAAsD;QACzD,CAAC,CAAC,IAAI,CAAC;IAET,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,WAAW,GACf,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,YAAY,GAChB,CAAC,CAAC,WAAW;QACb,CAAC,MAAM,8BAA8B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,eAAe,GACnB,OAAO,UAAU,EAAE,MAAM,KAAK,QAAQ;QACpC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GACpB,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,eAAe;QACjB,CAAC,MAAM,8BAA8B,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY;QACvC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GACb,CAAC,CAAC,QAAQ;QACV,CAAC,MAAM,8BAA8B,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC;IAChD,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAC;IAC9C,MAAM,gBAAgB,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1D,MAAM,YAAY,GAAG,cAAc;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,gBAAgB;YACjB,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACxC,gBAAgB;YAChB,eAAe;YACf,SAAS,CAAC,CAAC;IACf,MAAM,qBAAqB,GACzB,gBAAgB,IAAI,YAAY,EAAE,IAAI,KAAK,UAAU,EAAE,MAAM;QAC3D,CAAC,CAAC,UAAU,EAAE,KAAK;QACnB,CAAC,CAAC,YAAY,IAAI,YAAY,EAAE,IAAI,KAAK,OAAO,EAAE,MAAM;YACtD,CAAC,CAAC,OAAO,EAAE,KAAK;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,iBAAiB,GAAG,YAAY,EAAE,IAAI,IAAI,WAAW,CAAC;IAC5D,MAAM,YAAY,GAChB,YAAY,IAAI,CAAC,cAAc;QAC7B,CAAC,CAAC,uBAAuB,CACrB,YAAY,EACZ,qBAAqB,IAAI,YAAY,CAAC,YAAY,CACnD;QACH,CAAC,CAAC,CAAC,qBAAqB,IAAI,aAAa,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,EAAE,cAAc;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,MAAM,EAAE,iBAAiB;gBACzB,KAAK,EAAE,YAAY;aACpB;KACN,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC","sourcesContent":["/**\n * list-agent-engines — returns the registered engine registry and current selection.\n */\n\nimport { getAgentAppModelDefaultForCurrentRequest } from \"../../agent/app-model-defaults.js\";\nimport { DEFAULT_MODEL } from \"../../agent/default-model.js\";\nimport {\n  listAgentEngines,\n  registerBuiltinEngines,\n  detectEngineFromEnv,\n  detectEngineFromUserSecrets,\n  getAgentEngineEntry,\n  isAgentEnginePackageInstalled,\n  isStoredEngineUsableForRequest,\n  normalizeModelForEngine,\n} from \"../../agent/engine/index.js\";\nimport type { ActionTool } from \"../../agent/types.js\";\nimport { getSetting } from \"../../settings/index.js\";\n\nexport const tool: ActionTool = {\n  description:\n    'List all available AI agent engines (Anthropic, OpenAI, Gemini, Groq, etc.) and the currently selected engine. Use this to check what engines are available before calling manage-agent-engine with action=\"set\".',\n  parameters: {\n    type: \"object\",\n    properties: {},\n    required: [],\n  },\n};\n\nexport async function run(args: Record<string, string> = {}): Promise<string> {\n  registerBuiltinEngines();\n\n  const engines = listAgentEngines();\n  const currentSetting = await getSetting(\"agent-engine\");\n  const current = currentSetting\n    ? (currentSetting as { engine?: string; model?: string })\n    : null;\n\n  // Same priority chain resolveEngine uses after explicit request options:\n  // AGENT_ENGINE → app default → stored (if usable) → user/Builder app_secrets\n  // → env → anthropic. Gating stored/app defaults on the request-aware helper\n  // keeps the picker in step with the runtime.\n  const storedEntry =\n    typeof current?.engine === \"string\"\n      ? getAgentEngineEntry(current.engine)\n      : undefined;\n  const storedUsable =\n    !!storedEntry &&\n    (await isStoredEngineUsableForRequest(current, storedEntry));\n  const appDefault = await getAgentAppModelDefaultForCurrentRequest(args.appId);\n  const appDefaultEntry =\n    typeof appDefault?.engine === \"string\"\n      ? getAgentEngineEntry(appDefault.engine)\n      : undefined;\n  const appDefaultUsable =\n    !!appDefault &&\n    !!appDefaultEntry &&\n    (await isStoredEngineUsableForRequest(appDefault, appDefaultEntry));\n  const detectedFromUser = await detectEngineFromUserSecrets();\n  const envEntry = process.env.AGENT_ENGINE\n    ? getAgentEngineEntry(process.env.AGENT_ENGINE)\n    : undefined;\n  const envUsable =\n    !!envEntry &&\n    (await isStoredEngineUsableForRequest({ engine: envEntry.name }, envEntry));\n  const envUnavailable = !!envEntry && !envUsable;\n  const detectedFromEnv = detectEngineFromEnv();\n  const envSelectedEntry = envUsable ? envEntry : undefined;\n\n  const currentEntry = envUnavailable\n    ? undefined\n    : (envSelectedEntry ??\n      (appDefaultUsable ? appDefaultEntry : undefined) ??\n      (storedUsable ? storedEntry : undefined) ??\n      detectedFromUser ??\n      detectedFromEnv ??\n      undefined);\n  const currentModelCandidate =\n    appDefaultUsable && currentEntry?.name === appDefault?.engine\n      ? appDefault?.model\n      : storedUsable && currentEntry?.name === current?.engine\n        ? current?.model\n        : undefined;\n  const currentEngineName = currentEntry?.name ?? \"anthropic\";\n  const currentModel =\n    currentEntry && !envUnavailable\n      ? normalizeModelForEngine(\n          currentEntry,\n          currentModelCandidate ?? currentEntry.defaultModel,\n        )\n      : (currentModelCandidate ?? DEFAULT_MODEL);\n  const result = {\n    engines: engines.map((e) => ({\n      name: e.name,\n      label: e.label,\n      description: e.description,\n      defaultModel: e.defaultModel,\n      supportedModels: e.supportedModels,\n      capabilities: e.capabilities,\n      requiredEnvVars: e.requiredEnvVars,\n      installPackage: e.installPackage,\n      packageInstalled: isAgentEnginePackageInstalled(e),\n    })),\n    current: envUnavailable\n      ? null\n      : {\n          engine: currentEngineName,\n          model: currentModel,\n        },\n  };\n\n  return JSON.stringify(result, null, 2);\n}\n"]}

package/dist/scripts/call-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call-agent.d.ts","sourceRoot":"","sources":["../../src/scripts/call-agent.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAuJpD,eAAO,MAAM,IAAI,EAAE,UAsDlB,CAAC;AAEF,wBAAsB,GAAG,CACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,gBAAgB,EAC1B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAuXjB;AA+ND,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASzE"}
+{"version":3,"file":"call-agent.d.ts","sourceRoot":"","sources":["../../src/scripts/call-agent.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAuJpD,eAAO,MAAM,IAAI,EAAE,UAsDlB,CAAC;AAEF,wBAAsB,GAAG,CACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,gBAAgB,EAC1B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAiajB;AA+ND,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASzE"}

package/dist/scripts/call-agent.js

@@ -1,4 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
+import { parseA2AAgentActivityPart } from "../a2a/activity.js";
 import { A2ATaskTimeoutError, callAgent, shouldPreferGlobalA2ASecret, signA2AToken, } from "../a2a/client.js";
 import { invokeAgentAction } from "../a2a/invoke.js";
 import { formatLlmCredentialErrorMessage, isLlmCredentialError, } from "../agent/engine/credential-errors.js";
@@ -194,16 +195,37 @@ export async function run(args, context, selfAppId) {
         ? buildMessageIdempotencyKey(context?.turnId, agent.url, message)
         : undefined;
     if (action) {
+        const agentCallId = randomUUID();
+        const startedAt = Date.now();
         if (context?.send) {
-            context.send({ type: "agent_call", agent: agent.name, status: "start" });
+            context.send({
+                type: "agent_call",
+                agent: agent.name,
+                status: "start",
+                agentCallId,
+            });
         }
         try {
             const output = await invokeReadOnlyAppAction(agent, action, input, buildDelegationCorrelation(context, selfAppId, randomUUID()));
+            if (context?.send && output) {
+                context.send({
+                    type: "agent_call_text",
+                    agent: agent.name,
+                    text: output,
+                    agentCallId,
+                });
+            }
             return output;
         }
         finally {
             if (context?.send) {
-                context.send({ type: "agent_call", agent: agent.name, status: "done" });
+                context.send({
+                    type: "agent_call",
+                    agent: agent.name,
+                    status: "done",
+                    agentCallId,
+                    durationMs: Date.now() - startedAt,
+                });
             }
         }
     }
@@ -272,6 +294,7 @@ export async function run(args, context, selfAppId) {
             }
             let responseText = "";
             let lastSentLength = 0;
+            const agentCallId = randomUUID();
             const existingContinuationText = taskId
                 ? null
                 : await formatExistingIntegrationContinuationIfRetry(agent, message);
@@ -281,6 +304,7 @@ export async function run(args, context, selfAppId) {
                 type: "agent_call",
                 agent: agent.name,
                 status: "start",
+                agentCallId,
             });
             const emitNewText = (newText) => {
                 if (newText.length > lastSentLength) {
@@ -288,6 +312,7 @@ export async function run(args, context, selfAppId) {
                         type: "agent_call_text",
                         agent: agent.name,
                         text: newText.slice(lastSentLength),
+                        agentCallId,
                     });
                     lastSentLength = newText.length;
                 }
@@ -302,9 +327,10 @@ export async function run(args, context, selfAppId) {
             // time we get to the sync fallback, Lambda is dead and the second fetch
             // errors out as "fetch failed". Async+poll has its own short fetches
             // with their own budgets, so it works reliably across hosts. The
-            // trade-off is we lose progressive in-UI text streaming for cross-app
-            // A2A calls, but the receiving agent's full response still surfaces via
-            // the tool_result event below.
+            // trade-off is that cross-app activity arrives at the poll cadence rather
+            // than token-by-token. Agent Native peers attach their current reasoning,
+            // tool status, and response preview to each task checkpoint, and the
+            // receiver's full response still surfaces below.
             //
             // That trade-off has a second-order cost: callAgent()'s poll (see
             // A2AClient.sendAndWait in a2a/client.ts) can legitimately run for
@@ -357,8 +383,22 @@ export async function run(args, context, selfAppId) {
             ]);
             const callStartedAt = Date.now();
             let lastProgressEmitAt = callStartedAt;
+            let lastActivitySequence = -1;
             const onRemotePollUpdate = (task) => {
                 const state = task?.status?.state;
+                const parts = task.status?.message?.parts;
+                const snapshot = Array.isArray(parts)
+                    ? parts.map(parseA2AAgentActivityPart).find((value) => value !== null)
+                    : undefined;
+                if (snapshot && snapshot.sequence > lastActivitySequence) {
+                    lastActivitySequence = snapshot.sequence;
+                    context.send({
+                        type: "agent_call_activity",
+                        agent: agent.name,
+                        agentCallId,
+                        snapshot,
+                    });
+                }
                 if (!state || !ACTIVELY_WORKING_STATES.has(state))
                     return;
                 const now = Date.now();
@@ -371,6 +411,7 @@ export async function run(args, context, selfAppId) {
                     agent: agent.name,
                     state,
                     elapsedSeconds: Math.round((now - callStartedAt) / 1000),
+                    agentCallId,
                     ...(detail ? { detail } : {}),
                 });
             };
@@ -448,6 +489,8 @@ export async function run(args, context, selfAppId) {
                 type: "agent_call",
                 agent: agent.name,
                 status: "done",
+                agentCallId,
+                durationMs: Date.now() - callStartedAt,
             });
             return responseText || "(empty response)";
         }
@@ -586,7 +629,7 @@ async function enqueueIntegrationContinuationIfPossible(taskId, agent, message,
 const MAX_PROGRESS_DETAIL_CHARS = 200;
 function extractRemoteProgressDetail(task) {
     const parts = task.status?.message?.parts;
-    if (!parts)
+    if (!Array.isArray(parts))
         return undefined;
     const text = parts
         .filter((p) => p.type === "text")