@agent-native/core 0.141.2 → 0.141.4

package/dist/server/agent-chat-plugin.js

@@ -25,6 +25,7 @@ import { isCheckpointRestorePath } from "../checkpoints/route-match.js";
 import { createDbAdminAgentTools } from "../db-admin/agent-tools.js";
 import { isTransientDatabaseError } from "../db/client.js";
 import { verifyInternalToken, extractBearerToken, } from "../integrations/internal-token.js";
+import { RECURRING_JOBS_SWEEP_PATH, RECURRING_JOBS_SWEEP_TOKEN_SUBJECT, } from "../jobs/scheduler-dispatch.js";
 import { McpClientManager, loadMcpConfig, autoDetectMcpConfig, mcpToolsToActionEntries, syncMcpActionEntries, mountMcpServersRoutes, mountMcpHubRoutes, buildMergedConfig, startMcpConfigRefresh, getHubStatus, isHubServeEnabled, } from "../mcp-client/index.js";
 import { setProgressPreListHook } from "../progress/store.js";
 import { getSkillNameFromPath } from "../resources/metadata.js";
@@ -109,7 +110,7 @@ import { _agentChatPromptSectionsForTests, buildFrameworkPrompts, buildSchemaBlo
 import { resolveA2AAgentDelegationEnabled, } from "./agent-chat/plugin-options.js";
 import { finalizeClaimedAgentChatProcessRunFailure } from "./agent-chat/process-run-failure.js";
 import { loadResourcesForPrompt, promptResourceManifestSections, resourceScopeForOwner, } from "./agent-chat/prompt-resources.js";
-import { shouldDisableRecurringJobsRuntime } from "./agent-chat/recurring-jobs-runtime.js";
+import { isNetlifyRecurringJobsRuntime, shouldDisableRecurringJobsRuntime, } from "./agent-chat/recurring-jobs-runtime.js";
 import { isLocalhost, shouldBlockInProductCodeEditingSurface, } from "./agent-chat/request-surface.js";
 import { loadRunCodeToolEntries } from "./agent-chat/run-code-tools.js";
 import { createAgentEngineScriptEntries, createAgentLoopSettingsScriptEntries, createCallAgentScriptEntry, createChatScriptEntries, createDbScriptEntries, createDocsScriptEntries, createResourceScriptEntries, } from "./agent-chat/script-entries.js";
@@ -124,6 +125,7 @@ export { createA2AEngineToolSurface };
 export { DEFAULT_DELEGATED_MAX_ITERATIONS, DEFAULT_DELEGATED_MAX_RUN_INPUT_TOKENS, DEFAULT_DELEGATED_MAX_TOOL_RESULT_CHARS, };
 export { shouldBlockInProductCodeEditingSurface };
 export { loadRunCodeToolEntries };
+export { isNetlifyRecurringJobsRuntime };
 export { shouldDisableRecurringJobsRuntime };
 export { finalizeClaimedAgentChatProcessRunFailure };
 export function resolveInteractiveAgentRunOptions(options) {
@@ -4661,7 +4663,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 }
                 return invokeAgentChatHandler(event);
             }));
-            const disableRecurringJobsRuntime = shouldDisableRecurringJobsRuntime();
+            const isBackgroundRuntime = isInBackgroundFunctionRuntime();
+            const disableRecurringJobsRuntime = isBackgroundRuntime || shouldDisableRecurringJobsRuntime();
             // ─── Recurring Jobs Scheduler ──────────────────────────────────────
             // Poll every 60 seconds for due recurring jobs and execute them.
             // Uses setInterval so it works in all deployment environments without
@@ -4696,11 +4699,47 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     appId: options?.appId,
                 };
                 runNowSchedulerDeps = schedulerDeps;
+                // Platform schedulers use the existing durable background function as
+                // the long-lived worker. Keeping the sweep behind a signed, fixed
+                // route prevents a public request from choosing an owner or job.
+                getH3App(nitroApp).use(RECURRING_JOBS_SWEEP_PATH, defineEventHandler(async (event) => {
+                    if (getMethod(event) !== "POST") {
+                        setResponseStatus(event, 405);
+                        return { error: "Method not allowed" };
+                    }
+                    const token = extractBearerToken(getHeader(event, "authorization"));
+                    if (!token ||
+                        !verifyInternalToken(RECURRING_JOBS_SWEEP_TOKEN_SUBJECT, token)) {
+                        setResponseStatus(event, 401);
+                        return { error: "Invalid or expired internal token" };
+                    }
+                    if (isNetlifyRecurringJobsRuntime() &&
+                        !isInBackgroundFunctionRuntime()) {
+                        setResponseStatus(event, 503);
+                        return {
+                            error: "Recurring-job sweep reached the synchronous server instead of the durable background worker.",
+                        };
+                    }
+                    try {
+                        await processRecurringJobs(schedulerDeps);
+                        return { ok: true };
+                    }
+                    catch (error) {
+                        console.error("[recurring-jobs] Sweep route failed:", error);
+                        setResponseStatus(event, 500);
+                        return { error: "Recurring-job sweep failed" };
+                    }
+                }));
                 if (disableRecurringJobsRuntime) {
                     if (process.env.DEBUG) {
                         console.log("[recurring-jobs] Scheduler disabled for local development");
                     }
                 }
+                else if (isNetlifyRecurringJobsRuntime()) {
+                    if (process.env.DEBUG) {
+                        console.log("[recurring-jobs] Using the durable Netlify scheduled sweep");
+                    }
+                }
                 else {
                     // Start after a 10-second delay to let the server fully initialize
                     setTimeout(() => {
@@ -4720,26 +4759,28 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // A non-Netlify self-dispatch only waits for the request to leave the
             // current invocation. Keep the durable history row as a retryable queue
             // so a frozen serverless handoff is recovered on the next sweep.
-            (() => {
-                let inFlight = false;
-                const sweep = async () => {
-                    if (inFlight)
-                        return;
-                    inFlight = true;
-                    try {
-                        const { redispatchUnclaimedAutomationRuns } = await import("../jobs/run-now.js");
-                        await redispatchUnclaimedAutomationRuns();
-                    }
-                    catch (error) {
-                        console.warn("[automations] queued-run sweep failed; retrying next tick:", error);
-                    }
-                    finally {
-                        inFlight = false;
-                    }
-                };
-                setTimeout(() => void sweep(), 15_000);
-                setInterval(() => void sweep(), 30_000);
-            })();
+            if (!isBackgroundRuntime) {
+                (() => {
+                    let inFlight = false;
+                    const sweep = async () => {
+                        if (inFlight)
+                            return;
+                        inFlight = true;
+                        try {
+                            const { redispatchUnclaimedAutomationRuns } = await import("../jobs/run-now.js");
+                            await redispatchUnclaimedAutomationRuns();
+                        }
+                        catch (error) {
+                            console.warn("[automations] queued-run sweep failed; retrying next tick:", error);
+                        }
+                        finally {
+                            inFlight = false;
+                        }
+                    };
+                    setTimeout(() => void sweep(), 15_000);
+                    setInterval(() => void sweep(), 30_000);
+                })();
+            }
             mcpInitializationPromise = initializeMcpManager().catch((err) => {
                 console.warn(`[mcp-client] deferred initialization failed: ${err?.message ?? err}`);
             });
@@ -4750,6 +4791,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // per instance; cheap (one indexed query when no active tasks are found).
             // Throttled by the same per-owner interval guard inside reconcileAgentTeamRunsForOwner.
             (() => {
+                if (isBackgroundRuntime)
+                    return;
                 // Track when this instance last ran the sweep so only one sweep fires
                 // per 2-min window even if multiple timers fire in overlapping invocations.
                 let lastSweep = 0;
@@ -4897,6 +4940,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // comment above for why this exists and the timing budget in
             // run-store.ts's `UNCLAIMED_BACKGROUND_RUN_FAST_SWEEP_MS` doc comment.
             (() => {
+                if (isBackgroundRuntime)
+                    return;
                 setTimeout(() => {
                     (async () => {
                         const { UNCLAIMED_BACKGROUND_RUN_FAST_SWEEP_MS } = await import("../agent/run-store.js");
@@ -4942,6 +4987,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // still fails loud, and it survives the fast sweep having missed a row
             // entirely (e.g. a restart landed between fast-sweep ticks).
             (() => {
+                if (isBackgroundRuntime)
+                    return;
                 let lastSweep = 0;
                 const SWEEP_INTERVAL_MS = 2 * 60 * 1000;
                 setTimeout(() => {

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/better-auth-instance.js

@@ -18,6 +18,7 @@ import { TEMPLATES } from "../cli/templates-meta.js";
 import { getDbExec, isPostgres } from "../db/client.js";
 import { getDialect, getDatabaseUrl, getDatabaseAuthToken, closePgliteClients, getPgliteClient, isPgliteUrl, loadPgliteDrizzle, pgPoolOptions, neonPoolMax, attachNeonPoolErrorLogger, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, } from "../db/client.js";
 import { ensureTableExists } from "../db/ddl-guard.js";
+import { CORE_RESET_PASSWORD_EMAIL_ID, CORE_VERIFY_SIGNUP_EMAIL_ID, } from "../email-catalog/system-emails.js";
 import { saveOAuthTokens } from "../oauth-tokens/store.js";
 import { acceptPendingInvitationsForEmail } from "../org/accept-pending.js";
 import { getAuthEmailForUserId, getRequiredAuthProviderForEmail, } from "../org/auth-policy.js";
@@ -918,7 +919,14 @@ async function createBetterAuthInstance(config) {
                     email: user.email,
                     resetUrl,
                 });
-                await sendEmail({ to: user.email, subject, html, text, appSender });
+                await sendEmail({
+                    to: user.email,
+                    subject,
+                    html,
+                    text,
+                    appSender,
+                    templateId: CORE_RESET_PASSWORD_EMAIL_ID,
+                });
             },
         },
         emailVerification: {
@@ -942,7 +950,14 @@ async function createBetterAuthInstance(config) {
                     email: user.email,
                     verifyUrl,
                 });
-                await sendEmail({ to: user.email, subject, html, text, appSender });
+                await sendEmail({
+                    to: user.email,
+                    subject,
+                    html,
+                    text,
+                    appSender,
+                    templateId: CORE_VERIFY_SIGNUP_EMAIL_ID,
+                });
             },
         },
         socialProviders,

package/dist/server/design-token-utils.d.ts

@@ -77,6 +77,11 @@ export interface UrlExtractionResult {
     googleFonts?: string[];
     ogImage?: string;
     favicon?: string;
+    stylesheetUrls?: string[];
+    stylesheetFailures?: {
+        url: string;
+        error: string;
+    }[];
 }
 export interface GitHubFetchOptions {
     token?: string | null;
@@ -145,5 +150,5 @@ export declare function extractDocumentFonts(text: string): string[];
 export declare function classifyFile(fileType: string): ContentType;
 /** Return per-type suggestions for how to use a document for design extraction. */
 export declare function suggestionsForType(contentType: ContentType, hasText: boolean): string[];
-/** Fetch and extract design tokens from a URL's HTML. */
+/** Fetch and extract design tokens from a URL's HTML and linked CSS. */
 export declare function extractDesignTokensFromUrl(rawUrl: string): Promise<UrlExtractionResult>;

package/dist/server/design-token-utils.js

@@ -663,91 +663,284 @@ export function suggestionsForType(contentType, hasText) {
 // ---------------------------------------------------------------------------
 // URL scraping helpers (import-from-url)
 // ---------------------------------------------------------------------------
-/** Fetch and extract design tokens from a URL's HTML. */
+const URL_FETCH_TIMEOUT = 10_000;
+const MAX_URL_HTML_CHARS = 1_000_000;
+const MAX_URL_STYLESHEETS = 10;
+const MAX_URL_STYLESHEET_CHARS = 256 * 1024;
+const MAX_URL_STYLESHEET_TOTAL_CHARS = 512 * 1024;
+function normalizeUrlInput(rawUrl) {
+    const trimmed = rawUrl.trim();
+    if (!trimmed)
+        throw new Error("Website URL is required");
+    const candidate = /^[a-z][a-z\d+.-]*:/i.test(trimmed)
+        ? trimmed
+        : `https://${trimmed}`;
+    return new URL(candidate).href;
+}
+function decodeHtmlAttribute(value) {
+    return value
+        .replace(/&/gi, "&")
+        .replace(/"/gi, '"')
+        .replace(/'|'/gi, "'");
+}
+function readHtmlAttribute(tag, attribute) {
+    const match = tag.match(new RegExp(`\\b${attribute}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, "i"));
+    const value = match?.[1] ?? match?.[2] ?? match?.[3];
+    return value === undefined ? undefined : decodeHtmlAttribute(value.trim());
+}
+function resolveHttpUrl(value, baseUrl) {
+    if (!value)
+        return { kind: "missing" };
+    try {
+        const parsed = new URL(value, baseUrl);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            return { kind: "missing" };
+        }
+        return { kind: "resolved", url: parsed.href };
+    }
+    catch {
+        return { kind: "invalid", value };
+    }
+}
+function readMetaContent(html, attribute, value) {
+    for (const match of html.matchAll(/<meta\b[^>]*>/gi)) {
+        const tag = match[0];
+        if (readHtmlAttribute(tag, attribute)?.toLowerCase() !== value)
+            continue;
+        const content = readHtmlAttribute(tag, "content");
+        if (content !== undefined)
+            return content;
+    }
+    return undefined;
+}
+function extractStylesheetUrls(html, baseUrl) {
+    const urls = new Set();
+    for (const match of html.matchAll(/<link\b[^>]*>/gi)) {
+        const tag = match[0];
+        const rel = readHtmlAttribute(tag, "rel");
+        if (!rel?.split(/\s+/).some((token) => token.toLowerCase() === "stylesheet")) {
+            continue;
+        }
+        const resolved = resolveHttpUrl(readHtmlAttribute(tag, "href"), baseUrl);
+        if (resolved.kind === "resolved")
+            urls.add(resolved.url);
+    }
+    return [...urls];
+}
+function extractInlineCss(html) {
+    const parts = [];
+    for (const match of html.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style>/gi)) {
+        parts.push(match[1]);
+    }
+    for (const match of html.matchAll(/<[a-z][^>]*>/gi)) {
+        const style = readHtmlAttribute(match[0], "style");
+        if (style)
+            parts.push(style);
+    }
+    return parts.join("\n");
+}
+function extractFontFaces(content) {
+    const fonts = [];
+    for (const match of content.matchAll(/@font-face\s*\{([^}]+)\}/g)) {
+        const block = match[1];
+        const familyMatch = block.match(/font-family\s*:\s*["']?([^"';]+)/);
+        const srcMatch = block.match(/src\s*:\s*([^;]+)/);
+        fonts.push({
+            family: familyMatch?.[1]?.trim(),
+            src: srcMatch?.[1]?.trim()?.slice(0, 200),
+        });
+    }
+    return fonts;
+}
+function extractGoogleFontUrls(content) {
+    return [
+        ...content.matchAll(/fonts\.googleapis\.com\/css2?\?[^"'>\s)]+/g),
+    ].map((match) => match[0]);
+}
+function addColorMatches(content, colors) {
+    for (const match of content.matchAll(/#[0-9a-fA-F]{3,8}\b/g)) {
+        colors.add(match[0]);
+    }
+    for (const match of content.matchAll(/\b(?:rgb|rgba|hsl|hsla|hwb|lab|lch|oklab|oklch|color)\([^)]*\)/gi)) {
+        colors.add(match[0]);
+    }
+}
+async function readBoundedResponseText(response, maxChars, label) {
+    const contentLength = Number.parseInt(response.headers.get("content-length") ?? "", 10);
+    if (Number.isFinite(contentLength) && contentLength > maxChars) {
+        throw new Error(`${label} exceeds the ${maxChars}-character limit`);
+    }
+    if (!response.body) {
+        const text = await response.text();
+        if (text.length > maxChars) {
+            throw new Error(`${label} exceeds the ${maxChars}-character limit`);
+        }
+        return text;
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let text = "";
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done) {
+                text += decoder.decode();
+                break;
+            }
+            text += decoder.decode(chunk.value, { stream: true });
+            if (text.length > maxChars) {
+                await reader.cancel().catch(() => undefined);
+                throw new Error(`${label} exceeds the ${maxChars}-character limit`);
+            }
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return text;
+}
+async function fetchStylesheets(pageUrl, html) {
+    const discovered = extractStylesheetUrls(html, pageUrl);
+    const fetched = [];
+    const urls = [];
+    const failures = [];
+    let totalChars = 0;
+    for (const stylesheetUrl of discovered.slice(0, MAX_URL_STYLESHEETS)) {
+        if (totalChars >= MAX_URL_STYLESHEET_TOTAL_CHARS) {
+            failures.push({
+                url: stylesheetUrl,
+                error: `Skipped because the ${MAX_URL_STYLESHEET_TOTAL_CHARS}-character stylesheet budget was reached`,
+            });
+            continue;
+        }
+        try {
+            const response = await ssrfSafeFetch(stylesheetUrl, {
+                headers: {
+                    "User-Agent": "Mozilla/5.0 (compatible; AgentNative/1.0; +https://agent-native.com)",
+                },
+                signal: AbortSignal.timeout(URL_FETCH_TIMEOUT),
+            }, { maxRedirects: 3 });
+            if (!response.ok) {
+                throw new Error(`HTTP ${response.status}`);
+            }
+            const remainingChars = MAX_URL_STYLESHEET_TOTAL_CHARS - totalChars;
+            const content = await readBoundedResponseText(response, Math.min(MAX_URL_STYLESHEET_CHARS, remainingChars), `Stylesheet ${stylesheetUrl}`);
+            totalChars += content.length;
+            fetched.push({ url: stylesheetUrl, content });
+            urls.push(stylesheetUrl);
+        }
+        catch (error) {
+            failures.push({
+                url: stylesheetUrl,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    if (discovered.length > MAX_URL_STYLESHEETS) {
+        failures.push({
+            url: pageUrl,
+            error: `Skipped ${discovered.length - MAX_URL_STYLESHEETS} stylesheet(s) after the ${MAX_URL_STYLESHEETS}-stylesheet limit`,
+        });
+    }
+    return { fetched, urls, failures };
+}
+/** Fetch and extract design tokens from a URL's HTML and linked CSS. */
 export async function extractDesignTokensFromUrl(rawUrl) {
-    const url = rawUrl.startsWith("http") ? rawUrl : `https://${rawUrl}`;
+    const url = normalizeUrlInput(rawUrl);
     validateUrl(url);
     const response = await ssrfSafeFetch(url, {
         headers: {
             "User-Agent": "Mozilla/5.0 (compatible; AgentNative/1.0; +https://agent-native.com)",
         },
-        signal: AbortSignal.timeout(10000),
-    });
-    const html = await response.text();
+        signal: AbortSignal.timeout(URL_FETCH_TIMEOUT),
+    }, { maxRedirects: 3 });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch ${url}: HTTP ${response.status}`);
+    }
+    const html = await readBoundedResponseText(response, MAX_URL_HTML_CHARS, `Website ${url}`);
+    const pageUrl = response.url || url;
     const result = { url };
     // Title
-    const titleMatch = html.match(/<title[^>]*>([^<]+)<\/title>/i);
+    const titleMatch = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
     if (titleMatch) {
         result.pageTitle = titleMatch[1].trim();
     }
-    // Meta description
-    const descMatch = html.match(/<meta[^>]*name=["']description["'][^>]*content=["']([^"']+)["']/i);
-    if (descMatch) {
-        result.metaDescription = descMatch[1];
+    const metaDescription = readMetaContent(html, "name", "description");
+    if (metaDescription !== undefined) {
+        result.metaDescription = metaDescription;
     }
-    // Meta theme-color
-    const themeColorMatch = html.match(/<meta[^>]*name=["']theme-color["'][^>]*content=["']([^"']+)["']/i);
-    if (themeColorMatch) {
-        result.themeColor = themeColorMatch[1];
+    const themeColor = readMetaContent(html, "name", "theme-color");
+    if (themeColor !== undefined) {
+        result.themeColor = themeColor;
     }
-    // CSS custom properties
-    const cssVarMatches = html.matchAll(/--([\w-]+)\s*:\s*([^;}\n]+)/g);
-    const cssVars = {};
-    for (const match of cssVarMatches) {
-        cssVars[`--${match[1]}`] = match[2].trim();
+    const inlineCss = extractInlineCss(html);
+    const pageCss = parseCss(inlineCss);
+    const stylesheetResult = await fetchStylesheets(pageUrl, html);
+    const stylesheetCssVars = {};
+    const fonts = extractFontFaces(inlineCss);
+    const googleFonts = new Set(extractGoogleFontUrls(html));
+    const colorMatches = new Set();
+    addColorMatches(html, colorMatches);
+    for (const stylesheet of stylesheetResult.fetched) {
+        const parsed = parseCss(stylesheet.content);
+        Object.assign(stylesheetCssVars, parsed.cssCustomProperties);
+        fonts.push(...extractFontFaces(stylesheet.content));
+        for (const fontUrl of extractGoogleFontUrls(stylesheet.content)) {
+            googleFonts.add(fontUrl);
+        }
+        addColorMatches(stylesheet.content, colorMatches);
     }
+    const cssVars = {
+        ...stylesheetCssVars,
+        ...(pageCss.cssCustomProperties ?? {}),
+    };
     if (Object.keys(cssVars).length > 0) {
         const entries = Object.entries(cssVars).slice(0, 50);
         result.cssCustomProperties = Object.fromEntries(entries);
     }
-    // Inline colors (hex, rgb)
-    const colorMatches = new Set();
-    const hexPattern = /#[0-9a-fA-F]{3,8}\b/g;
-    let hexMatch;
-    while ((hexMatch = hexPattern.exec(html)) !== null) {
-        colorMatches.add(hexMatch[0]);
-    }
-    const rgbPattern = /rgba?\(\s*\d+\s*,\s*\d+\s*,\s*\d+(?:\s*,\s*[\d.]+)?\s*\)/g;
-    let rgbMatch;
-    while ((rgbMatch = rgbPattern.exec(html)) !== null) {
-        colorMatches.add(rgbMatch[0]);
-    }
     if (colorMatches.size > 0) {
         result.colors = [...colorMatches].slice(0, 30);
     }
-    // @font-face
-    const fontFaceMatches = html.matchAll(/@font-face\s*\{([^}]+)\}/g);
-    const fonts = [];
-    for (const match of fontFaceMatches) {
-        const block = match[1];
-        const familyMatch = block.match(/font-family\s*:\s*["']?([^"';]+)["']?/);
-        const srcMatch = block.match(/src\s*:\s*([^;]+)/);
-        fonts.push({
-            family: familyMatch?.[1]?.trim(),
-            src: srcMatch?.[1]?.trim()?.slice(0, 200),
-        });
-    }
     if (fonts.length > 0) {
-        result.fontFaces = fonts.slice(0, 20);
-    }
-    // Google Fonts
-    const googleFontMatches = html.matchAll(/fonts\.googleapis\.com\/css2?\?[^"'>\s]+/g);
-    const googleFonts = [];
-    for (const match of googleFontMatches) {
-        googleFonts.push(match[0]);
-    }
-    if (googleFonts.length > 0) {
-        result.googleFonts = googleFonts;
+        const seenFonts = new Set();
+        result.fontFaces = fonts
+            .filter((font) => {
+            const key = `${font.family ?? ""}\u0000${font.src ?? ""}`;
+            if (seenFonts.has(key))
+                return false;
+            seenFonts.add(key);
+            return true;
+        })
+            .slice(0, 20);
+    }
+    if (googleFonts.size > 0) {
+        result.googleFonts = [...googleFonts];
     }
     // OG image
-    const ogImageMatch = html.match(/<meta[^>]*property=["']og:image["'][^>]*content=["']([^"']+)["']/i);
-    if (ogImageMatch) {
-        result.ogImage = ogImageMatch[1];
+    const ogImage = readMetaContent(html, "property", "og:image");
+    if (ogImage) {
+        const resolved = resolveHttpUrl(ogImage, pageUrl);
+        result.ogImage = resolved.kind === "resolved" ? resolved.url : ogImage;
     }
     // Favicon
-    const faviconMatch = html.match(/<link[^>]*rel=["'](?:icon|shortcut icon)["'][^>]*href=["']([^"']+)["']/i);
-    if (faviconMatch) {
-        result.favicon = faviconMatch[1];
+    for (const match of html.matchAll(/<link\b[^>]*>/gi)) {
+        const tag = match[0];
+        const rel = readHtmlAttribute(tag, "rel");
+        if (!rel?.split(/\s+/).some((token) => token.toLowerCase() === "icon")) {
+            continue;
+        }
+        const href = readHtmlAttribute(tag, "href");
+        if (href && !/^data:/i.test(href)) {
+            const resolved = resolveHttpUrl(href, pageUrl);
+            result.favicon = resolved.kind === "resolved" ? resolved.url : href;
+        }
+        break;
+    }
+    if (stylesheetResult.urls.length > 0) {
+        result.stylesheetUrls = stylesheetResult.urls;
+    }
+    if (stylesheetResult.failures.length > 0) {
+        result.stylesheetFailures = stylesheetResult.failures;
     }
     return result;
 }

package/dist/server/email.d.ts

@@ -58,6 +58,17 @@ export interface SendEmailArgs {
     references?: string;
     attachments?: EmailAttachment[];
     timeoutMs?: number;
+    /**
+     * Registered transactional email id (see `defineTransactionalEmail`), e.g.
+     * `calendar.booking-confirmed`. Tags the message at the provider so delivery
+     * and open metrics attribute to one email instead of to the whole account,
+     * and keys the row written to `email_log`. Omit for genuinely one-off sends.
+     */
+    templateId?: string;
+    /** App slug that owns the send. Defaults to the running app. */
+    app?: string;
+    /** Organization that owns the send. Defaults to the current request org. */
+    orgId?: string;
 }
 export declare function isEmailConfigured(): Promise<boolean>;
 /**