@agent-native/core 0.125.0 → 0.126.0

package/corpus/templates/design/app/components/design/bridge/editor-chrome.bridge.ts

@@ -35,6 +35,7 @@ declare var __DESIGN_CANVAS_CONTENT_OFFSET_X__: number;
 declare var __DESIGN_CANVAS_CONTENT_OFFSET_Y__: number;
 declare var __RUNTIME_LAYER_SNAPSHOT_ENABLED__: boolean;
 declare var __LIVE_REFLOW_ENABLED__: boolean;
+declare var __SELECTED_LAYER_DRAG_PRIORITY__: boolean;
 
 (function () {
   // Idempotency guard: replace-document-content / srcdoc rebuilds can end up
@@ -78,6 +79,16 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
       return false;
     }
   })();
+  // Selected-layer drag priority: when on, a pointerdown inside the selection
+  // box keeps the selected element as the drag target even when an overlapping
+  // non-descendant sibling wins the hit test.
+  var selectedLayerDragPriorityEnabled = (function () {
+    try {
+      return !!__SELECTED_LAYER_DRAG_PRIORITY__;
+    } catch (_e) {
+      return false;
+    }
+  })();
   var scaleToolEnabled = false;
 
   // ── Drag-and-drop debug logging ────────────────────────────────────
@@ -2248,6 +2259,9 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
   }
 
   var selectedEl: Element | null = null;
+  // When true, selection chrome stays hidden through async reflows so a
+  // keyboard-nudge burst does not flicker; selection itself is unchanged.
+  var selectionChromeHidden = false;
   var hoveredEl: Element | null = null;
   var highlightOverlayStyle: "default" | "soft" = "default";
   type NodeHtmlPreviewSession = {
@@ -4080,7 +4094,11 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
         hideSelectionOverlay();
       }
     } else if (selectedEl) {
-      positionOverlay(selectionOverlay, selectedEl);
+      if (selectionChromeHidden) {
+        hideSelectionOverlay();
+      } else {
+        positionOverlay(selectionOverlay, selectedEl);
+      }
     } else {
       hideParentAutoLayoutOverlay();
     }
@@ -5103,9 +5121,17 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
     document.addEventListener(events.up, onUp, true);
   }
 
-  function openContextMenuAtEvent(e) {
-    stopNativeInteraction(e);
-    blurActiveTextEditor();
+  // Returns the full z-stack of selectable layers under a point (topmost
+  // first), each element index-aligned with a { key, label, info } descriptor.
+  // Overlays are briefly made pointer-transparent so elementsFromPoint sees
+  // through the editor chrome.
+  function collectLayerHitCandidates(
+    clientX: number,
+    clientY: number,
+  ): {
+    elements: Element[];
+    layerCandidates: Array<{ key: string; label: string; info: unknown }>;
+  } {
     var shieldPointerEvents = shieldOverlay.style.pointerEvents;
     var selectionPointerEvents = selectionOverlay.style.pointerEvents;
     var highlightPointerEvents = highlightOverlay.style.pointerEvents;
@@ -5113,13 +5139,13 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
     selectionOverlay.style.pointerEvents = "none";
     highlightOverlay.style.pointerEvents = "none";
     var pointTargets = document.elementsFromPoint
-      ? document.elementsFromPoint(e.clientX, e.clientY)
-      : [document.elementFromPoint(e.clientX, e.clientY)];
+      ? document.elementsFromPoint(clientX, clientY)
+      : [document.elementFromPoint(clientX, clientY)];
     shieldOverlay.style.pointerEvents = shieldPointerEvents;
     selectionOverlay.style.pointerEvents = selectionPointerEvents;
     highlightOverlay.style.pointerEvents = highlightPointerEvents;
 
-    var candidateElements: Element[] = [];
+    var elements: Element[] = [];
     var layerCandidates: Array<{
       key: string;
       label: string;
@@ -5135,11 +5161,11 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
         isOverlayElement(candidate) ||
         isLayerInteractionBlocked(candidate) ||
         isTemplateCloneElement(candidate) ||
-        candidateElements.indexOf(candidate) !== -1
+        elements.indexOf(candidate) !== -1
       ) {
         return;
       }
-      candidateElements.push(candidate);
+      elements.push(candidate);
       var candidateInfo = getElementInfo(candidate);
       var explicitLabel =
         (candidate.getAttribute &&
@@ -5162,6 +5188,39 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
         info: candidateInfo,
       });
     });
+    return { elements: elements, layerCandidates: layerCandidates };
+  }
+
+  // Given a point and the current selection, return the next layer BELOW it in
+  // the hit stack (wrapping at the bottom), or null when the selection is not
+  // in the stack or the next layer is blocked. Backs Cmd/Ctrl+click deep-select.
+  function stackCycleTarget(
+    clientX: number,
+    clientY: number,
+    currentEl: Element | null,
+  ): Element | null {
+    if (!currentEl) return null;
+    var stack = collectLayerHitCandidates(clientX, clientY);
+    var currentIdx = stack.elements.indexOf(currentEl);
+    if (currentIdx === -1) return null;
+    var keys = stack.layerCandidates.map(function (candidate) {
+      return candidate.key;
+    });
+    var nextKey = nextStackCandidate(
+      keys,
+      stack.layerCandidates[currentIdx].key,
+    );
+    if (nextKey === null) return null;
+    var nextEl = stack.elements[keys.indexOf(nextKey)];
+    return nextEl && !isLayerInteractionBlocked(nextEl) ? nextEl : null;
+  }
+
+  function openContextMenuAtEvent(e) {
+    stopNativeInteraction(e);
+    blurActiveTextEditor();
+    var collected = collectLayerHitCandidates(e.clientX, e.clientY);
+    var candidateElements = collected.elements;
+    var layerCandidates = collected.layerCandidates;
 
     var target = candidateElements[0] || null;
     var info = null;
@@ -8227,10 +8286,9 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
   // Minimal, dependency-free port of the overview canvas's edge/center snap
   // routine (shared/canvas-math.ts computeMoveSnap) for in-iframe element
   // dragging. The bridge's pointer coordinates and getBoundingClientRect()
-  // values are already in the same iframe-local, zoom-normalized coordinate
-  // space (the host CSS-scales the whole iframe, not individual elements),
-  // so — unlike the overview canvas, which divides a screen-px threshold by
-  // its own camera zoom — no extra scale correction is needed here.
+  // values are iframe-local content px, so SNAP_THRESHOLD_PX is a screen-space
+  // base converted to content px at snap time via chromeLineScale (1/zoom) to
+  // keep the snap tolerance constant on screen at any zoom.
   var SNAP_THRESHOLD_PX = 6;
   var SNAP_CANDIDATE_CAP = 200;
 
@@ -9321,7 +9379,8 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
                 height: dragElStartHeight,
               },
               snapCandidateRects,
-              SNAP_THRESHOLD_PX,
+              // Convert the screen-space base to content px (1/zoom).
+              SNAP_THRESHOLD_PX * chromeLineScale(),
             )
           : { dx: 0, dy: 0, guideV: null, guideH: null };
       nextLeft += snapResult.dx;
@@ -9970,6 +10029,53 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
     pendingShieldDrag = null;
   }
 
+  // Decides the drag target for a pointerdown. Descendant hits keep the
+  // selected element; with preferSelected on, a point inside the selection box
+  // also keeps it over an overlapping non-descendant sibling. Falls through to
+  // hitEl when the selection is detached or zero-area. Pure and self-contained
+  // so the snap test can brace-extract and evaluate it in isolation.
+  function dragTargetForPointerDown(args) {
+    var selectedEl = args.selectedEl;
+    var hitEl = args.hitEl;
+    var hitRaw = args.hitRaw || hitEl;
+    var selectedAlive = !!args.selectedAlive;
+    if (
+      selectedEl &&
+      selectedAlive &&
+      selectedEl.contains &&
+      selectedEl.contains(hitRaw)
+    ) {
+      return selectedEl;
+    }
+    if (args.preferSelected && selectedEl && selectedAlive) {
+      var r = args.selectedRect;
+      var p = args.point;
+      if (
+        r &&
+        p &&
+        r.width > 0 &&
+        r.height > 0 &&
+        p.x >= r.left &&
+        p.x <= r.right &&
+        p.y >= r.top &&
+        p.y <= r.bottom
+      ) {
+        return selectedEl;
+      }
+    }
+    return hitEl;
+  }
+
+  // Given the hit-stack candidate keys (topmost first) and the current
+  // selection key, returns the next key below it, wrapping to the top. Returns
+  // null when the selection is not in the stack. Pure, for the snap test.
+  function nextStackCandidate(candidateKeys, currentKey) {
+    if (!candidateKeys || candidateKeys.length === 0) return null;
+    var idx = candidateKeys.indexOf(currentKey);
+    if (idx === -1) return null;
+    return candidateKeys[(idx + 1) % candidateKeys.length];
+  }
+
   function beginPotentialShieldDrag(e) {
     stopNativeInteraction(e);
     if (e.button !== 0) return;
@@ -9988,12 +10094,21 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
       beginMarqueeSelection(e);
       return;
     }
-    var dragTarget =
-      selectedEl &&
-      document.documentElement.contains(selectedEl) &&
-      selectedEl.contains(hit)
-        ? selectedEl
-        : hitTarget;
+    var selectedAlive =
+      !!selectedEl && document.documentElement.contains(selectedEl);
+    var selectedRect =
+      selectedAlive && selectedEl.getBoundingClientRect
+        ? selectedEl.getBoundingClientRect()
+        : null;
+    var dragTarget = dragTargetForPointerDown({
+      selectedEl: selectedEl,
+      selectedAlive: selectedAlive,
+      selectedRect: selectedRect,
+      hitEl: hitTarget,
+      hitRaw: hit,
+      point: { x: e.clientX, y: e.clientY },
+      preferSelected: selectedLayerDragPriorityEnabled,
+    });
     var clickTarget = hitTarget;
     if (
       !dragTarget ||
@@ -10073,7 +10188,21 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
         postCrossScreenDrag("cancel");
       }
       if (ev) stopNativeInteraction(ev);
-      selectTarget(clickTarget || dragTarget, ev);
+      // Cmd/Ctrl+click (no Shift) deep-selects the next layer below the current
+      // selection in the z-stack under the pointer, wrapping at the bottom.
+      // Runs here (not in selectElementAtEvent) because a shield click resolves
+      // selection in this onUp and then suppresses the click handler. Selected
+      // plain (no ev) so it replaces the selection rather than adding to it;
+      // Shift-click stays additive via the normal path below.
+      var cycledEl =
+        !readOnly && (e.metaKey || e.ctrlKey) && !e.shiftKey
+          ? stackCycleTarget(e.clientX, e.clientY, selectedEl)
+          : null;
+      if (cycledEl) {
+        selectTarget(cycledEl);
+      } else {
+        selectTarget(clickTarget || dragTarget, ev);
+      }
       suppressNextShieldClickBriefly();
     }
     clearPendingShieldDrag();
@@ -11599,6 +11728,17 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
       );
       return;
     }
+    if (e.data.type === "set-selection-chrome-hidden") {
+      selectionChromeHidden = !!e.data.hidden;
+      if (selectionChromeHidden) {
+        hideSelectionOverlay();
+      } else if (selectedEl) {
+        positionOverlay(selectionOverlay, selectedEl);
+        updateParentAutoLayoutOverlay(selectedEl);
+        refreshOverlays();
+      }
+      return;
+    }
     if (e.data.type === "select-element") {
       var candidates: string[] = [];
       if (Array.isArray(e.data.selectorCandidates)) {
@@ -11650,7 +11790,14 @@ declare var __LIVE_REFLOW_ENABLED__: boolean;
         hoveredSpacingHandleKey = "";
       }
       selectedEl = target;
-      positionOverlay(selectionOverlay, target);
+      // Respect a nudge-burst chrome-hide: the host re-sends select-element on
+      // every poll tick, and repeated nudges don't resend hidden:true (its ref
+      // stays set), so a replay must not re-show the overlay on its own.
+      if (selectionChromeHidden) {
+        hideSelectionOverlay();
+      } else {
+        positionOverlay(selectionOverlay, target);
+      }
       if (hoveredEl === selectedEl) highlightOverlay.style.display = "none";
       // A host-driven selection (e.g. picking a layer in the Layers panel)
       // only ever moved the overlay above — it never sent the rich

package/dist/collab/routes.d.ts

@@ -41,9 +41,9 @@ export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import
  * Body: { text: string, fieldName?: string, requestSource?: string }
  */
 export declare const postCollabText: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    text?: undefined;
     ok?: undefined;
     error: string;
+    text?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,12 +17,12 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
+    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
 }>;
 export default _default;
 //# sourceMappingURL=upload-image.d.ts.map

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,9 +311,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        message?: undefined;
-        id?: undefined;
         deleted?: undefined;
+        id?: undefined;
         found?: undefined;
         providers: {
             id: string;
@@ -328,28 +327,28 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         provider?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
+    } | {
+        deleted?: undefined;
         count?: undefined;
         id?: undefined;
-        deleted?: undefined;
         providers?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        count?: undefined;
+    } | {
         deleted?: undefined;
+        count?: undefined;
         providers?: undefined;
         provider?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
+    } | {
         count?: undefined;
         found?: undefined;
         providers?: undefined;
@@ -358,9 +357,10 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        count?: undefined;
         deleted?: undefined;
+        count?: undefined;
         found?: undefined;
         providers?: undefined;
         provider?: undefined;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — re-run the validator against the
  * current stored value without changing anything. Useful for the "Test" button.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,12 +95,12 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/server/email-template.d.ts

@@ -31,6 +31,12 @@ export interface RenderEmailArgs {
     paragraphs: string[];
     /** Primary call-to-action rendered as a real button. */
     cta?: EmailCta;
+    /**
+     * Optional trusted HTML injected above the CTA — e.g. a template-owned video
+     * thumbnail with a play badge. Injected verbatim, so only pass markup built
+     * by app/template code (never raw user input), and escape any dynamic values.
+     */
+    heroHtml?: string;
     /** Small muted text under the CTA (e.g. expiry note). */
     footer?: string;
     /** Optional app name shown beside the framework logo. */

package/dist/server/email-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-template.d.ts","sourceRoot":"","sources":["../../src/server/email-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,eAAO,MAAM,kCAAkC,sBAAsB,CAAC;AAEtE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wDAAwD;IACxD,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAsCD,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,aAAa,CA2GhE;AAeD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D"}
+{"version":3,"file":"email-template.d.ts","sourceRoot":"","sources":["../../src/server/email-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,eAAO,MAAM,kCAAkC,sBAAsB,CAAC;AAEtE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wDAAwD;IACxD,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAsCD,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,aAAa,CAkHhE;AAeD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D"}

package/dist/server/email-template.js

@@ -65,6 +65,11 @@ export function renderEmail(args) {
     const ctaBg = brand ?? "#fafafa";
     const ctaFg = brand ? "#ffffff" : "#0a0a0c";
     const linkColor = brand ?? "#a1a1aa";
+    // Trusted markup supplied by the caller (template code, not user input),
+    // injected as-is so a template can own app-specific previews (e.g. a video
+    // thumbnail with a play badge). Callers are responsible for escaping any
+    // dynamic values they interpolate.
+    const heroHtml = args.heroHtml ?? "";
     const paragraphsHtml = args.paragraphs
         .map((p) => `<p style="margin:0 0 16px 0; font-size:16px; line-height:1.6; color:#d4d4d8;">${p}</p>`)
         .join("");
@@ -124,6 +129,7 @@ export function renderEmail(args) {
                   ${escapeHtml(args.heading)}
                 </h1>
                 ${paragraphsHtml}
+                ${heroHtml}
                 ${ctaHtml}
                 ${footerHtml}
               </td>

package/dist/server/email-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-template.js","sourceRoot":"","sources":["../../src/server/email-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,mBAAmB,CAAC;AAsCtE,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,IAAI,cAAc,CAAC;IAC3E,MAAM,OAAO,GACX,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;QAClC,OAAO,kCAAkC,EAAE,CAAC;IAE9C,wEAAwE;IACxE,kCAAkC;IAClC,MAAM,KAAK,GAAG,KAAK,IAAI,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,IAAI,SAAS,CAAC;IAErC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU;SACnC,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,iFAAiF,CAAC,MAAM,CAC3F;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG;QACtB,CAAC,CAAC;;;sDAGgD,KAAK;uBACpC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gMACiJ,KAAK;gBACrL,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;;;;;KAKrC;QACD,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;QAC5B,CAAC,CAAC,iFAAiF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAChH,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,eAAe,GAAG;;;;kCAIQ,UAAU,CAAC,OAAO,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC;+HAC2C,UAAU,CAAC,SAAS,CAAC;;;yBAG3H,CAAC;IAExB,MAAM,IAAI,GAAG;;;;;;;aAOF,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;;;;;mBAKlB,SAAS;;;;;QAKpB,UAAU,CAAC,SAAS,CAAC;;;;;;;;kBAQX,eAAe;;oBAEb,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;;kBAE1B,cAAc;kBACd,OAAO;kBACP,UAAU;;;;;;;;QAQpB,CAAC;IAEP,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACrD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC;SACL,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,mDAAmD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,GAAW;IAClD,OAAO,YAAY,UAAU,CAAC,GAAG,CAAC,uDAAuD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;AACnH,CAAC","sourcesContent":["/**\n * Reusable dark-themed HTML email template.\n *\n * Email clients have limited CSS support, so everything is inlined and layout\n * uses tables for Outlook compatibility. The design mirrors the app's dark UI:\n * near-black card on neutral background, Inter typography with safe fallbacks.\n *\n * Default is monochrome (white CTA on dark). Pass `brandColor` to tint the\n * CTA button and inline links — Clips, for example, passes its purple.\n *\n * Usage:\n *   const { html, text } = renderEmail({\n *     preheader: \"…\",\n *     heading: \"You're invited to join Acme\",\n *     paragraphs: [\"Alice invited you to join…\"],\n *     cta: { label: \"Accept invite\", url: \"https://…\" },\n *     footer: \"If you weren't expecting this, ignore this email.\",\n *   });\n */\n\nimport { getAppName } from \"./app-name.js\";\n\nexport const AGENT_NATIVE_EMAIL_LOGO_CONTENT_ID = \"agent-native-logo\";\n\nexport interface EmailCta {\n  label: string;\n  url: string;\n}\n\nexport interface RenderEmailArgs {\n  /** Short preview text shown by email clients next to the subject. */\n  preheader?: string;\n  /** Large headline at the top of the card. */\n  heading: string;\n  /** Body paragraphs rendered after the heading. Plain strings — escaped. */\n  paragraphs: string[];\n  /** Primary call-to-action rendered as a real button. */\n  cta?: EmailCta;\n  /** Small muted text under the CTA (e.g. expiry note). */\n  footer?: string;\n  /** Optional app name shown beside the framework logo. */\n  brandName?: string;\n  /**\n   * Optional absolute `https://` logo URL shown in the brand header. When a\n   * valid URL is provided it replaces the default embedded Agent Native logo;\n   * anything else (missing, relative, non-https) falls back to that logo.\n   */\n  brandLogoUrl?: string;\n  /**\n   * Optional brand hex color for the CTA button and inline links. Defaults to\n   * a monochrome near-white button with dark text.\n   */\n  brandColor?: string;\n}\n\nexport interface RenderedEmail {\n  html: string;\n  text: string;\n}\n\nfunction escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\nfunction escapeAttr(s: string): string {\n  return escapeHtml(s);\n}\n\n/**\n * Only accept a strict `#rrggbb` hex color for `brandColor`. Anything else\n * could inject CSS into the inline `style` attribute (`red; background:url(…)`).\n */\nfunction sanitizeHexColor(input: string | undefined): string | undefined {\n  if (!input) return undefined;\n  return /^#[0-9a-fA-F]{6}$/.test(input) ? input : undefined;\n}\n\n/**\n * Only accept an absolute `https://` URL for the brand logo. Email clients drop\n * relative and mixed-content images, and an unvalidated string in `src` is an\n * injection surface — so anything else falls back to the embedded logo.\n */\nfunction sanitizeLogoUrl(input: string | undefined): string | undefined {\n  if (!input) return undefined;\n  try {\n    return new URL(input).protocol === \"https:\" ? input : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport function renderEmail(args: RenderEmailArgs): RenderedEmail {\n  const preheader = args.preheader || \"\";\n  const brand = sanitizeHexColor(args.brandColor);\n  const brandName = args.brandName?.trim() || getAppName() || \"Agent Native\";\n  const logoSrc =\n    sanitizeLogoUrl(args.brandLogoUrl) ??\n    `cid:${AGENT_NATIVE_EMAIL_LOGO_CONTENT_ID}`;\n\n  // Monochrome default: near-white button with dark text. Brand override:\n  // colored button with white text.\n  const ctaBg = brand ?? \"#fafafa\";\n  const ctaFg = brand ? \"#ffffff\" : \"#0a0a0c\";\n  const linkColor = brand ?? \"#a1a1aa\";\n\n  const paragraphsHtml = args.paragraphs\n    .map(\n      (p) =>\n        `<p style=\"margin:0 0 16px 0; font-size:16px; line-height:1.6; color:#d4d4d8;\">${p}</p>`,\n    )\n    .join(\"\");\n\n  const ctaHtml = args.cta\n    ? `\n      <table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" style=\"margin:24px 0 0 0;\">\n        <tr>\n          <td style=\"border-radius:10px; background:${ctaBg};\">\n            <a href=\"${escapeAttr(args.cta.url)}\"\n               style=\"display:inline-block; padding:14px 26px; font-family:'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; font-size:15px; font-weight:600; color:${ctaFg}; text-decoration:none; border-radius:10px;\">\n              ${escapeHtml(args.cta.label)}\n            </a>\n          </td>\n        </tr>\n      </table>\n    `\n    : \"\";\n\n  const footerHtml = args.footer\n    ? `<p style=\"margin:28px 0 0 0; font-size:13px; line-height:1.5; color:#71717a;\">${escapeHtml(args.footer)}</p>`\n    : \"\";\n\n  const brandHeaderHtml = `\n                <table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\" style=\"margin:0 0 28px 0; padding:0 0 24px 0; border-bottom:1px solid #27272a;\">\n                  <tr>\n                    <td align=\"center\">\n                      <img src=\"${escapeAttr(logoSrc)}\" alt=\"${escapeAttr(brandName)}\" width=\"28\" height=\"28\" style=\"display:inline-block; vertical-align:middle; width:28px; height:28px; margin:0 8px 0 0; border:0;\" />\n                      <span style=\"font-size:18px; line-height:28px; font-weight:600; color:#fafafa; vertical-align:middle;\">${escapeHtml(brandName)}</span>\n                    </td>\n                  </tr>\n                </table>`;\n\n  const html = `<!DOCTYPE html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <meta name=\"color-scheme\" content=\"dark light\" />\n    <meta name=\"supported-color-schemes\" content=\"dark light\" />\n    <title>${escapeHtml(args.heading)}</title>\n    <style>\n      @media (prefers-color-scheme: light) {\n        .bg-outer { background-color: #0a0a0c !important; }\n      }\n      a { color: ${linkColor}; }\n    </style>\n  </head>\n  <body style=\"margin:0; padding:0; background-color:#0a0a0c; font-family:'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; -webkit-font-smoothing:antialiased;\">\n    <div style=\"display:none; max-height:0; overflow:hidden; opacity:0; color:transparent;\">\n      ${escapeHtml(preheader)}\n    </div>\n    <table role=\"presentation\" class=\"bg-outer\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\" style=\"background-color:#0a0a0c; padding:40px 16px;\">\n      <tr>\n        <td align=\"center\">\n          <table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\" style=\"max-width:560px;\">\n            <tr>\n              <td style=\"background-color:#141417; border:1px solid #27272a; border-radius:16px; padding:36px 36px 32px 36px;\">\n                ${brandHeaderHtml}\n                <h1 style=\"margin:0 0 20px 0; font-size:24px; line-height:1.3; font-weight:600; color:#fafafa; letter-spacing:-0.02em;\">\n                  ${escapeHtml(args.heading)}\n                </h1>\n                ${paragraphsHtml}\n                ${ctaHtml}\n                ${footerHtml}\n              </td>\n            </tr>\n          </table>\n        </td>\n      </tr>\n    </table>\n  </body>\n</html>`;\n\n  const textLines: string[] = [];\n  textLines.push(args.heading);\n  textLines.push(\"\");\n  for (const p of args.paragraphs) {\n    textLines.push(stripTags(p));\n    textLines.push(\"\");\n  }\n  if (args.cta) {\n    textLines.push(`${args.cta.label}: ${args.cta.url}`);\n    textLines.push(\"\");\n  }\n  if (args.footer) {\n    textLines.push(args.footer);\n  }\n\n  return { html, text: textLines.join(\"\\n\").trim() };\n}\n\nfunction stripTags(s: string): string {\n  return s\n    .replace(/<br\\s*\\/?>/gi, \"\\n\")\n    .replace(/<[^>]+>/g, \"\")\n    .replace(/&nbsp;/g, \" \")\n    .replace(/&amp;/g, \"&\")\n    .replace(/&lt;/g, \"<\")\n    .replace(/&gt;/g, \">\")\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\")\n    .trim();\n}\n\n/**\n * Build an inline `<strong>` tag with consistent styling for use inside\n * paragraph strings passed to `renderEmail`. Escapes the content.\n */\nexport function emailStrong(text: string): string {\n  return `<strong style=\"color:#fafafa; font-weight:600;\">${escapeHtml(text)}</strong>`;\n}\n\n/**\n * Build a labelled inline link for paragraph strings passed to `renderEmail`.\n * Use this instead of rendering raw URLs in the visible email body.\n */\nexport function emailLink(label: string, url: string): string {\n  return `<a href=\"${escapeAttr(url)}\" style=\"color:#a1a1aa; text-decoration:underline;\">${escapeHtml(label)}</a>`;\n}\n"]}
+{"version":3,"file":"email-template.js","sourceRoot":"","sources":["../../src/server/email-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,CAAC,MAAM,kCAAkC,GAAG,mBAAmB,CAAC;AA4CtE,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,IAAI,cAAc,CAAC;IAC3E,MAAM,OAAO,GACX,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;QAClC,OAAO,kCAAkC,EAAE,CAAC;IAE9C,wEAAwE;IACxE,kCAAkC;IAClC,MAAM,KAAK,GAAG,KAAK,IAAI,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,IAAI,SAAS,CAAC;IAErC,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAErC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU;SACnC,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,iFAAiF,CAAC,MAAM,CAC3F;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG;QACtB,CAAC,CAAC;;;sDAGgD,KAAK;uBACpC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gMACiJ,KAAK;gBACrL,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;;;;;KAKrC;QACD,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;QAC5B,CAAC,CAAC,iFAAiF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAChH,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,eAAe,GAAG;;;;kCAIQ,UAAU,CAAC,OAAO,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC;+HAC2C,UAAU,CAAC,SAAS,CAAC;;;yBAG3H,CAAC;IAExB,MAAM,IAAI,GAAG;;;;;;;aAOF,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;;;;;mBAKlB,SAAS;;;;;QAKpB,UAAU,CAAC,SAAS,CAAC;;;;;;;;kBAQX,eAAe;;oBAEb,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;;kBAE1B,cAAc;kBACd,QAAQ;kBACR,OAAO;kBACP,UAAU;;;;;;;;QAQpB,CAAC;IAEP,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACrD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC;SACL,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,mDAAmD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,GAAW;IAClD,OAAO,YAAY,UAAU,CAAC,GAAG,CAAC,uDAAuD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;AACnH,CAAC","sourcesContent":["/**\n * Reusable dark-themed HTML email template.\n *\n * Email clients have limited CSS support, so everything is inlined and layout\n * uses tables for Outlook compatibility. The design mirrors the app's dark UI:\n * near-black card on neutral background, Inter typography with safe fallbacks.\n *\n * Default is monochrome (white CTA on dark). Pass `brandColor` to tint the\n * CTA button and inline links — Clips, for example, passes its purple.\n *\n * Usage:\n *   const { html, text } = renderEmail({\n *     preheader: \"…\",\n *     heading: \"You're invited to join Acme\",\n *     paragraphs: [\"Alice invited you to join…\"],\n *     cta: { label: \"Accept invite\", url: \"https://…\" },\n *     footer: \"If you weren't expecting this, ignore this email.\",\n *   });\n */\n\nimport { getAppName } from \"./app-name.js\";\n\nexport const AGENT_NATIVE_EMAIL_LOGO_CONTENT_ID = \"agent-native-logo\";\n\nexport interface EmailCta {\n  label: string;\n  url: string;\n}\n\nexport interface RenderEmailArgs {\n  /** Short preview text shown by email clients next to the subject. */\n  preheader?: string;\n  /** Large headline at the top of the card. */\n  heading: string;\n  /** Body paragraphs rendered after the heading. Plain strings — escaped. */\n  paragraphs: string[];\n  /** Primary call-to-action rendered as a real button. */\n  cta?: EmailCta;\n  /**\n   * Optional trusted HTML injected above the CTA — e.g. a template-owned video\n   * thumbnail with a play badge. Injected verbatim, so only pass markup built\n   * by app/template code (never raw user input), and escape any dynamic values.\n   */\n  heroHtml?: string;\n  /** Small muted text under the CTA (e.g. expiry note). */\n  footer?: string;\n  /** Optional app name shown beside the framework logo. */\n  brandName?: string;\n  /**\n   * Optional absolute `https://` logo URL shown in the brand header. When a\n   * valid URL is provided it replaces the default embedded Agent Native logo;\n   * anything else (missing, relative, non-https) falls back to that logo.\n   */\n  brandLogoUrl?: string;\n  /**\n   * Optional brand hex color for the CTA button and inline links. Defaults to\n   * a monochrome near-white button with dark text.\n   */\n  brandColor?: string;\n}\n\nexport interface RenderedEmail {\n  html: string;\n  text: string;\n}\n\nfunction escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\nfunction escapeAttr(s: string): string {\n  return escapeHtml(s);\n}\n\n/**\n * Only accept a strict `#rrggbb` hex color for `brandColor`. Anything else\n * could inject CSS into the inline `style` attribute (`red; background:url(…)`).\n */\nfunction sanitizeHexColor(input: string | undefined): string | undefined {\n  if (!input) return undefined;\n  return /^#[0-9a-fA-F]{6}$/.test(input) ? input : undefined;\n}\n\n/**\n * Only accept an absolute `https://` URL for the brand logo. Email clients drop\n * relative and mixed-content images, and an unvalidated string in `src` is an\n * injection surface — so anything else falls back to the embedded logo.\n */\nfunction sanitizeLogoUrl(input: string | undefined): string | undefined {\n  if (!input) return undefined;\n  try {\n    return new URL(input).protocol === \"https:\" ? input : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport function renderEmail(args: RenderEmailArgs): RenderedEmail {\n  const preheader = args.preheader || \"\";\n  const brand = sanitizeHexColor(args.brandColor);\n  const brandName = args.brandName?.trim() || getAppName() || \"Agent Native\";\n  const logoSrc =\n    sanitizeLogoUrl(args.brandLogoUrl) ??\n    `cid:${AGENT_NATIVE_EMAIL_LOGO_CONTENT_ID}`;\n\n  // Monochrome default: near-white button with dark text. Brand override:\n  // colored button with white text.\n  const ctaBg = brand ?? \"#fafafa\";\n  const ctaFg = brand ? \"#ffffff\" : \"#0a0a0c\";\n  const linkColor = brand ?? \"#a1a1aa\";\n\n  // Trusted markup supplied by the caller (template code, not user input),\n  // injected as-is so a template can own app-specific previews (e.g. a video\n  // thumbnail with a play badge). Callers are responsible for escaping any\n  // dynamic values they interpolate.\n  const heroHtml = args.heroHtml ?? \"\";\n\n  const paragraphsHtml = args.paragraphs\n    .map(\n      (p) =>\n        `<p style=\"margin:0 0 16px 0; font-size:16px; line-height:1.6; color:#d4d4d8;\">${p}</p>`,\n    )\n    .join(\"\");\n\n  const ctaHtml = args.cta\n    ? `\n      <table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" style=\"margin:24px 0 0 0;\">\n        <tr>\n          <td style=\"border-radius:10px; background:${ctaBg};\">\n            <a href=\"${escapeAttr(args.cta.url)}\"\n               style=\"display:inline-block; padding:14px 26px; font-family:'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; font-size:15px; font-weight:600; color:${ctaFg}; text-decoration:none; border-radius:10px;\">\n              ${escapeHtml(args.cta.label)}\n            </a>\n          </td>\n        </tr>\n      </table>\n    `\n    : \"\";\n\n  const footerHtml = args.footer\n    ? `<p style=\"margin:28px 0 0 0; font-size:13px; line-height:1.5; color:#71717a;\">${escapeHtml(args.footer)}</p>`\n    : \"\";\n\n  const brandHeaderHtml = `\n                <table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\" style=\"margin:0 0 28px 0; padding:0 0 24px 0; border-bottom:1px solid #27272a;\">\n                  <tr>\n                    <td align=\"center\">\n                      <img src=\"${escapeAttr(logoSrc)}\" alt=\"${escapeAttr(brandName)}\" width=\"28\" height=\"28\" style=\"display:inline-block; vertical-align:middle; width:28px; height:28px; margin:0 8px 0 0; border:0;\" />\n                      <span style=\"font-size:18px; line-height:28px; font-weight:600; color:#fafafa; vertical-align:middle;\">${escapeHtml(brandName)}</span>\n                    </td>\n                  </tr>\n                </table>`;\n\n  const html = `<!DOCTYPE html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <meta name=\"color-scheme\" content=\"dark light\" />\n    <meta name=\"supported-color-schemes\" content=\"dark light\" />\n    <title>${escapeHtml(args.heading)}</title>\n    <style>\n      @media (prefers-color-scheme: light) {\n        .bg-outer { background-color: #0a0a0c !important; }\n      }\n      a { color: ${linkColor}; }\n    </style>\n  </head>\n  <body style=\"margin:0; padding:0; background-color:#0a0a0c; font-family:'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; -webkit-font-smoothing:antialiased;\">\n    <div style=\"display:none; max-height:0; overflow:hidden; opacity:0; color:transparent;\">\n      ${escapeHtml(preheader)}\n    </div>\n    <table role=\"presentation\" class=\"bg-outer\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\" style=\"background-color:#0a0a0c; padding:40px 16px;\">\n      <tr>\n        <td align=\"center\">\n          <table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\" style=\"max-width:560px;\">\n            <tr>\n              <td style=\"background-color:#141417; border:1px solid #27272a; border-radius:16px; padding:36px 36px 32px 36px;\">\n                ${brandHeaderHtml}\n                <h1 style=\"margin:0 0 20px 0; font-size:24px; line-height:1.3; font-weight:600; color:#fafafa; letter-spacing:-0.02em;\">\n                  ${escapeHtml(args.heading)}\n                </h1>\n                ${paragraphsHtml}\n                ${heroHtml}\n                ${ctaHtml}\n                ${footerHtml}\n              </td>\n            </tr>\n          </table>\n        </td>\n      </tr>\n    </table>\n  </body>\n</html>`;\n\n  const textLines: string[] = [];\n  textLines.push(args.heading);\n  textLines.push(\"\");\n  for (const p of args.paragraphs) {\n    textLines.push(stripTags(p));\n    textLines.push(\"\");\n  }\n  if (args.cta) {\n    textLines.push(`${args.cta.label}: ${args.cta.url}`);\n    textLines.push(\"\");\n  }\n  if (args.footer) {\n    textLines.push(args.footer);\n  }\n\n  return { html, text: textLines.join(\"\\n\").trim() };\n}\n\nfunction stripTags(s: string): string {\n  return s\n    .replace(/<br\\s*\\/?>/gi, \"\\n\")\n    .replace(/<[^>]+>/g, \"\")\n    .replace(/&nbsp;/g, \" \")\n    .replace(/&amp;/g, \"&\")\n    .replace(/&lt;/g, \"<\")\n    .replace(/&gt;/g, \">\")\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\")\n    .trim();\n}\n\n/**\n * Build an inline `<strong>` tag with consistent styling for use inside\n * paragraph strings passed to `renderEmail`. Escapes the content.\n */\nexport function emailStrong(text: string): string {\n  return `<strong style=\"color:#fafafa; font-weight:600;\">${escapeHtml(text)}</strong>`;\n}\n\n/**\n * Build a labelled inline link for paragraph strings passed to `renderEmail`.\n * Use this instead of rendering raw URLs in the visible email body.\n */\nexport function emailLink(label: string, url: string): string {\n  return `<a href=\"${escapeAttr(url)}\" style=\"color:#a1a1aa; text-decoration:underline;\">${escapeHtml(label)}</a>`;\n}\n"]}

package/dist/server/email.d.ts

@@ -23,6 +23,13 @@ export interface SendEmailArgs {
     html: string;
     text?: string;
     from?: string;
+    /**
+     * Display-name-only override. Keeps the configured (domain-verified) sending
+     * address and just changes the name shown to the recipient, e.g.
+     * "Alice via Clips". Ignored when `from` is set. Prefer this over `from` for
+     * per-user senders: putting a user's own address in `From` breaks SPF/DKIM.
+     */
+    fromName?: string;
     cc?: string | string[];
     replyTo?: string;
     inReplyTo?: string;

package/dist/server/email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/server/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA+DD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE1D;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAE/D;AA0ID,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBlE"}
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/server/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA+DD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE1D;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAE/D;AA8JD,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBlE"}

package/dist/server/email.js

@@ -61,10 +61,13 @@ export async function isEmailConfigured() {
 export async function getEmailProvider() {
     return (await resolveEmailTransport()).provider;
 }
-function getFromAddress(config, override) {
-    const explicit = override || config.from;
-    if (explicit)
-        return explicit;
+function getFromAddress(config, override, fromName) {
+    if (override)
+        return override;
+    const base = config.from ?? defaultFromAddress(config);
+    return fromName ? withDisplayName(base, fromName) : base;
+}
+function defaultFromAddress(config) {
     // Resend lets unverified accounts send from its sandbox domain; SendGrid
     // does not, so falling back there would cause silent 403s at runtime.
     if (config.provider === "sendgrid") {
@@ -72,11 +75,26 @@ function getFromAddress(config, override) {
     }
     return "Agent Native <onboarding@resend.dev>";
 }
+/**
+ * Swap the display name while keeping the verified address. The name is
+ * sanitized and quoted because it lands in a header: CR/LF would allow header
+ * injection, and quotes/angle brackets would break address parsing.
+ */
+function withDisplayName(from, name) {
+    const safe = name
+        .replace(/[\r\n"<>\\]/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+    if (!safe)
+        return from;
+    const address = from.match(/<([^>]+)>/)?.[1]?.trim() ?? from.trim();
+    return `"${safe}" <${address}>`;
+}
 async function sendEmailWithSignal(args, signal) {
     const config = await resolveEmailTransport();
     signal?.throwIfAborted();
     const provider = config.provider;
-    const from = getFromAddress(config, args.from);
+    const from = getFromAddress(config, args.from, args.fromName);
     const attachments = resolveAttachments(args);
     if (provider === "resend") {
         const payload = {
@@ -213,9 +231,16 @@ export async function sendEmail(args) {
 function parseSendGridFrom(from) {
     const m = from.match(/^\s*(.*?)\s*<(.+)>\s*$/);
     if (m && m[2])
-        return { name: m[1] || undefined, email: m[2] };
+        return { name: unquoteDisplayName(m[1]), email: m[2] };
     return { email: from.trim() };
 }
+function unquoteDisplayName(name) {
+    const trimmed = name.trim();
+    const unquoted = trimmed.startsWith('"') && trimmed.endsWith('"')
+        ? trimmed.slice(1, -1).replace(/\\(.)/g, "$1")
+        : trimmed;
+    return unquoted || undefined;
+}
 function stripHtml(html) {
     return html
         .replace(/<br\s*\/?>/gi, "\n")