@agent-native/core 0.145.5 → 0.145.6

package/dist/db/ddl-guard.js

@@ -71,7 +71,16 @@ async function loadSchemaSnapshot(client) {
     try {
         const [columnRows, indexRows] = await Promise.all([
             client.execute(`SELECT table_name, column_name FROM information_schema.columns WHERE table_schema = 'public'`),
-            client.execute(`SELECT indexname FROM pg_indexes WHERE schemaname = 'public'`),
+            client.execute(`SELECT indexes.indexname
+         FROM pg_indexes AS indexes
+         JOIN pg_class AS index_class ON index_class.relname = indexes.indexname
+         JOIN pg_namespace AS index_namespace
+           ON index_namespace.oid = index_class.relnamespace
+          AND index_namespace.nspname = indexes.schemaname
+         JOIN pg_index AS index_state ON index_state.indexrelid = index_class.oid
+         WHERE indexes.schemaname = 'public'
+           AND index_state.indisvalid
+           AND index_state.indisready`),
         ]);
         // An EMPTY result is a valid snapshot (a fresh database really has nothing
         // in `public`). A result whose rows lack the columns we asked for is not —
@@ -233,8 +242,8 @@ export async function pgColumnExists(table, column, injectedClient) {
     }
 }
 /**
- * True when running against Postgres AND an index with the given name already
- * exists in the `public` schema. Returns `false` on SQLite, for invalid
+ * True when running against Postgres AND a valid, ready index with the given
+ * name already exists in the `public` schema. Returns `false` on SQLite, for invalid
  * identifiers, and `undefined` when `pg_indexes` is unreadable.
  *
  * `CREATE INDEX` (without CONCURRENTLY) takes a `SHARE` lock that blocks
@@ -255,8 +264,20 @@ export async function pgIndexExists(indexName, injectedClient, dialectIsPostgres
         return cached;
     try {
         const { rows } = await client.execute({
-            sql: `SELECT 1 FROM pg_indexes
-            WHERE schemaname = 'public' AND indexname = ? LIMIT 1`,
+            sql: `SELECT 1
+            FROM pg_indexes AS indexes
+            JOIN pg_class AS index_class
+              ON index_class.relname = indexes.indexname
+            JOIN pg_namespace AS index_namespace
+              ON index_namespace.oid = index_class.relnamespace
+             AND index_namespace.nspname = indexes.schemaname
+            JOIN pg_index AS index_state
+              ON index_state.indexrelid = index_class.oid
+            WHERE indexes.schemaname = 'public'
+              AND indexes.indexname = ?
+              AND index_state.indisvalid
+              AND index_state.indisready
+            LIMIT 1`,
             args: [indexName],
         });
         return rows.length > 0;
@@ -370,6 +391,33 @@ export async function ensureIndexExists(indexName, createIndexSql, options = {})
         dialectIsPostgres: options.dialectIsPostgres,
     });
 }
+/**
+ * Ensure an additive Postgres index with `CREATE INDEX CONCURRENTLY`.
+ *
+ * This is deliberately separate from `ensureIndexExists`: the normal helper
+ * wraps DDL in a transaction so it can scope `lock_timeout`, but PostgreSQL
+ * forbids `CREATE INDEX CONCURRENTLY` inside a transaction. The caller must
+ * supply the concurrent form of the statement; direct execution keeps the
+ * build outside a transaction and avoids blocking writes on a large table.
+ */
+export async function ensureIndexExistsConcurrently(indexName, createIndexSql, options = {}) {
+    if (!(options.dialectIsPostgres ?? isPostgres()))
+        return false;
+    const client = options.injectedClient ?? getDbExec();
+    const initiallyExists = await pgIndexExists(indexName, client, options.dialectIsPostgres);
+    if (initiallyExists === true)
+        return false;
+    if (initiallyExists === undefined) {
+        throw new Error(`ensureIndexExistsConcurrently: could not probe required index "${indexName}"; refusing to issue DDL`);
+    }
+    await client.execute(createIndexSql);
+    invalidateSchemaSnapshot(client);
+    const existsAfterCreate = await pgIndexExists(indexName, client, options.dialectIsPostgres);
+    if (existsAfterCreate !== true) {
+        throw new Error(`ensureIndexExistsConcurrently: index "${indexName}" is still missing after CREATE INDEX CONCURRENTLY`);
+    }
+    return true;
+}
 /** True when an error looks like a Postgres `lock_timeout` (SQLSTATE 55P03). */
 export function isLockTimeoutError(err) {
     const anyErr = err;

package/dist/jobs/scheduler.js

@@ -70,6 +70,13 @@ export async function processRecurringJobs(deps) {
     subscribeToJobsResourceEvents();
     // Skip if we recently confirmed there are no job resources to run.
     const nowMs = Date.now();
+    // Write a global heartbeat before the resource scan. A slow or failed scan
+    // must not make a healthy worker look idle until the finally block runs.
+    await recordSchedulerHealthForScopes({
+        appId: deps.appId,
+        orgIds: [],
+        checkedAt: nowMs,
+    });
     if (_hasJobsCache === false &&
         nowMs - _lastJobsCheck < JOBS_CHECK_INTERVAL_MS) {
         await recordSchedulerHealthForScopes({

package/dist/localization/default-messages.d.ts

@@ -428,6 +428,8 @@ declare const messages: {
         newTerminal: string;
         panelOptions: string;
         collapseSidebar: string;
+        widenChat: string;
+        returnChatToLayout: string;
         expandSidebar: string;
         hideChats: string;
         allChats: string;
@@ -852,6 +854,10 @@ declare const messages: {
         noMembers: string;
         memberCount_one: string;
         memberCount_other: string;
+        memberPagination: string;
+        previousMemberPage: string;
+        nextMemberPage: string;
+        memberPageStatus: string;
         youAreRole: string;
         changeRole: string;
         removeMember: string;
@@ -1194,5 +1200,16 @@ declare const messages: {
         statusTitle: string;
         goHome: string;
     };
+    runtimeConfig: {
+        issue_one: string;
+        issue_other: string;
+        errorTitle: string;
+        warningTitle: string;
+        showDetails: string;
+        hideDetails: string;
+        copyPrompt: string;
+        copied: string;
+        copyFailed: string;
+    };
 };
 export default messages;

package/dist/localization/default-messages.js

@@ -434,6 +434,8 @@ const messages = {
         newTerminal: "New terminal",
         panelOptions: "Agent panel options",
         collapseSidebar: "Collapse sidebar",
+        widenChat: "Widen chat to 75%",
+        returnChatToLayout: "Return chat to layout",
         expandSidebar: "Expand sidebar",
         hideChats: "Hide chats",
         allChats: "All chats",
@@ -858,6 +860,10 @@ const messages = {
         noMembers: "No members yet.",
         memberCount_one: "{{count}} member",
         memberCount_other: "{{count}} members",
+        memberPagination: "Member list pagination",
+        previousMemberPage: "Go to previous member page",
+        nextMemberPage: "Go to next member page",
+        memberPageStatus: "Page {{page}} of {{totalPages}}",
         youAreRole: "You are {{role}}",
         changeRole: "Change role",
         removeMember: "Remove member",
@@ -1200,5 +1206,16 @@ const messages = {
         statusTitle: "{{status}} Error",
         goHome: "Go home",
     },
+    runtimeConfig: {
+        issue_one: "{{count}} issue",
+        issue_other: "{{count}} issues",
+        errorTitle: "Configuration error",
+        warningTitle: "Configuration warning",
+        showDetails: "Show details",
+        hideDetails: "Hide details",
+        copyPrompt: "Copy prompt",
+        copied: "Copied",
+        copyFailed: "Copy failed",
+    },
 };
 export default messages;

package/dist/mcp/oauth-client-metadata.js

@@ -176,11 +176,15 @@ function validateClientMetadataDocument(clientId, value) {
     // support). The token endpoint independently honors only
     // "authorization_code"/"refresh_token" no matter what this list says.
     const grantTypes = parseStringArray(document.grant_types);
+    // Metadata documents may advertise extension grants that this server does
+    // not implement. The authorization request still selects the supported
+    // authorization-code flow, so rejecting an extra grant here only prevents
+    // otherwise compatible clients such as Claude from connecting.
     if ((document.grant_types !== undefined &&
         (!Array.isArray(document.grant_types) ||
             grantTypes.length !== document.grant_types.length)) ||
         grantTypes.length > 10) {
-        throw new Error("Client metadata document grant_types are unsupported");
+        throw new Error("Client metadata document grant_types are invalid");
     }
     const responseTypes = parseStringArray(document.response_types);
     if ((document.response_types !== undefined &&

package/dist/mcp/oauth-route.d.ts

@@ -3,7 +3,8 @@
  *
  * These routes let MCP hosts such as Claude Code and ChatGPT authenticate
  * through their native remote-MCP OAuth flow instead of pasting bearer tokens.
- * The issued access tokens are audience-bound to `/mcp`, carry
+ * The issued access tokens are audience-bound to the public `/mcp` route or
+ * its legacy alias, carry
  * the same user/org identity as the existing connect flow, and are mediated by
  * `verifyAuth` before any MCP tool/resource request runs.
  */
@@ -13,7 +14,7 @@ export interface McpOAuthRouteOptions {
     appName?: string;
 }
 export declare function getMcpOAuthIssuer(event: H3Event): string | undefined;
-export declare function getMcpOAuthResource(event: H3Event): string | undefined;
+export declare function getMcpOAuthResource(event: H3Event, routePath?: string): string | undefined;
 /**
  * All plausible MCP OAuth resource audiences for the given request, deduped.
  *
@@ -24,8 +25,8 @@ export declare function getMcpOAuthResource(event: H3Event): string | undefined;
  * accepts either without issuing a 401.
  */
 export declare function getMcpOAuthAudiences(event: H3Event): string[];
-export declare function getMcpOAuthProtectedResourceMetadataUrl(event: H3Event): string | undefined;
-export declare function buildMcpOAuthChallenge(event: H3Event): string;
+export declare function getMcpOAuthProtectedResourceMetadataUrl(event: H3Event, routePath?: string): string | undefined;
+export declare function buildMcpOAuthChallenge(event: H3Event, routePath?: string): string;
 export declare function handleMcpOAuthProtectedResourceMetadata(event: H3Event): Response;
 export declare function handleMcpOAuthAuthorizationServerMetadata(event: H3Event): Response;
 export declare function handleMcpOAuth(event: H3Event, subpath: string, options?: McpOAuthRouteOptions): Promise<Response>;

package/dist/mcp/oauth-route.js

@@ -3,7 +3,8 @@
  *
  * These routes let MCP hosts such as Claude Code and ChatGPT authenticate
  * through their native remote-MCP OAuth flow instead of pasting bearer tokens.
- * The issued access tokens are audience-bound to `/mcp`, carry
+ * The issued access tokens are audience-bound to the public `/mcp` route or
+ * its legacy alias, carry
  * the same user/org identity as the existing connect flow, and are mediated by
  * `verifyAuth` before any MCP tool/resource request runs.
  */
@@ -16,7 +17,7 @@ import { readBody } from "../server/h3-helpers.js";
 import { applicationTypeForRedirectUris, isAllowedOAuthRedirectUri, isUrlBasedOAuthClientId, matchesRegisteredRedirectUri, resolveOAuthClientMetadataDocument, } from "./oauth-client-metadata.js";
 import { createOAuthCode, createOAuthRefreshToken, consumeOAuthCode, generateOpaqueToken, getOAuthClient, getOAuthCode, getOAuthRefreshToken, registerOAuthClient, touchOAuthRefreshToken, } from "./oauth-store.js";
 import { MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS, MCP_OAUTH_SCOPES, normalizeOAuthScope, signMcpOAuthAccessToken, } from "./oauth-token.js";
-import { MCP_PUBLIC_ROUTE_PREFIX, MCP_ROUTE_PREFIXES } from "./route-paths.js";
+import { MCP_LEGACY_ROUTE_PREFIX, MCP_PUBLIC_ROUTE_PREFIX, MCP_ROUTE_PREFIXES, } from "./route-paths.js";
 const MCP_OAUTH_RESOURCE_SCOPES = MCP_OAUTH_SCOPES.filter((scope) => scope !== "offline_access");
 const MCP_OAUTH_RESOURCE_SCOPE = MCP_OAUTH_RESOURCE_SCOPES.join(" ");
 function json(body, status = 200) {
@@ -136,11 +137,16 @@ export function getMcpOAuthIssuer(event) {
         return undefined;
     return appendConfiguredBasePath(baseUrl);
 }
-export function getMcpOAuthResource(event) {
+function normalizeMcpResourcePath(routePath) {
+    return routePath === MCP_LEGACY_ROUTE_PREFIX
+        ? MCP_LEGACY_ROUTE_PREFIX
+        : MCP_PUBLIC_ROUTE_PREFIX;
+}
+export function getMcpOAuthResource(event, routePath = MCP_PUBLIC_ROUTE_PREFIX) {
     const issuer = getMcpOAuthIssuer(event);
     if (!issuer)
         return undefined;
-    return `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}`;
+    return `${issuer}${normalizeMcpResourcePath(routePath)}`;
 }
 function mcpResourcesForIssuer(issuer) {
     return [
@@ -182,14 +188,21 @@ export function getMcpOAuthAudiences(event) {
     }
     return out;
 }
-export function getMcpOAuthProtectedResourceMetadataUrl(event) {
+export function getMcpOAuthProtectedResourceMetadataUrl(event, routePath = MCP_PUBLIC_ROUTE_PREFIX) {
     const issuer = getMcpOAuthIssuer(event);
     if (!issuer)
         return undefined;
-    return `${issuer}/.well-known/oauth-protected-resource`;
+    const metadataUrl = new URL(`${issuer}/.well-known/oauth-protected-resource`);
+    // The public and legacy endpoints share one host-level metadata route. Keep
+    // the legacy resource identity in the challenge so OAuth clients that verify
+    // an exact resource URL can authenticate old MCP configurations.
+    if (normalizeMcpResourcePath(routePath) === MCP_LEGACY_ROUTE_PREFIX) {
+        metadataUrl.searchParams.set("resource", MCP_LEGACY_ROUTE_PREFIX);
+    }
+    return metadataUrl.toString();
 }
-export function buildMcpOAuthChallenge(event) {
-    const metadata = getMcpOAuthProtectedResourceMetadataUrl(event);
+export function buildMcpOAuthChallenge(event, routePath = MCP_PUBLIC_ROUTE_PREFIX) {
+    const metadata = getMcpOAuthProtectedResourceMetadataUrl(event, routePath);
     const scope = MCP_OAUTH_RESOURCE_SCOPE;
     return metadata
         ? `Bearer resource_metadata="${metadata}", scope="${scope}"`
@@ -215,7 +228,10 @@ export function handleMcpOAuthProtectedResourceMetadata(event) {
     if (getMethod(event) !== "GET") {
         return oauthError("invalid_request", "Method not allowed", 405);
     }
-    const resource = getMcpOAuthResource(event);
+    const requestedResourcePath = getQuery(event).resource;
+    const resource = getMcpOAuthResource(event, requestedResourcePath === MCP_LEGACY_ROUTE_PREFIX
+        ? MCP_LEGACY_ROUTE_PREFIX
+        : MCP_PUBLIC_ROUTE_PREFIX);
     const issuer = getMcpOAuthIssuer(event);
     if (!resource || !issuer) {
         return oauthError("server_error", "Unable to derive MCP resource", 500);

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,7 +159,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -175,6 +174,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,7 +190,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -200,6 +199,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,7 +216,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -235,6 +234,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,7 +250,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -264,6 +263,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/mcp/server.d.ts

@@ -20,7 +20,7 @@ export type { MCPConfig, MCPCallerIdentity, MCPRequestMeta };
  *     h3 mount falls through to the next handler.
  *   - a Web `Response` or an auth-error object otherwise.
  */
-export declare function handleMcpRequest(event: H3Event, config: MCPConfig): Promise<Response | string | {
+export declare function handleMcpRequest(event: H3Event, config: MCPConfig, routePath?: string): Promise<Response | string | {
     error: string;
 } | Record<string, unknown> | undefined>;
 /**

package/dist/mcp/server.js

@@ -117,10 +117,10 @@ function buildWebRequest(event, method) {
  * the authorize/metadata URL. Keeping the legacy `error: "Unauthorized"` field
  * means existing clients that only check that field still work.
  */
-function buildUnauthorizedBody(event) {
+function buildUnauthorizedBody(event, routePath = MCP_PUBLIC_ROUTE_PREFIX) {
     const issuer = getMcpOAuthIssuer(event);
-    const mcpUrl = getMcpOAuthResource(event);
-    const resourceMetadataUrl = getMcpOAuthProtectedResourceMetadataUrl(event);
+    const mcpUrl = getMcpOAuthResource(event, routePath);
+    const resourceMetadataUrl = getMcpOAuthProtectedResourceMetadataUrl(event, routePath);
     const command = issuer
         ? `npx -y @agent-native/core@latest reconnect ${issuer}`
         : undefined;
@@ -170,7 +170,7 @@ function buildUnauthorizedBody(event) {
  *     h3 mount falls through to the next handler.
  *   - a Web `Response` or an auth-error object otherwise.
  */
-export async function handleMcpRequest(event, config) {
+export async function handleMcpRequest(event, config, routePath = MCP_PUBLIC_ROUTE_PREFIX) {
     const pathname = event.url?.pathname || "/";
     const subpath = pathname.replace(/^\/+/, "").replace(/\/+$/, "");
     if (subpath) {
@@ -207,8 +207,8 @@ export async function handleMcpRequest(event, config) {
     });
     if (!authResult.authed) {
         setResponseStatus(event, 401);
-        setResponseHeader(event, "WWW-Authenticate", buildMcpOAuthChallenge(event));
-        return buildUnauthorizedBody(event);
+        setResponseHeader(event, "WWW-Authenticate", buildMcpOAuthChallenge(event, routePath));
+        return buildUnauthorizedBody(event, routePath);
     }
     // Read POST bodies through h3 exactly once. `createMcpHandler` accepts the
     // parsed value, so neither its modern classifier nor its legacy fallback
@@ -267,11 +267,10 @@ export function mountMCP(nitroApp, config, routePrefix = "/_agent-native") {
     const routePaths = routePrefix === "/_agent-native"
         ? [...MCP_ROUTE_PREFIXES]
         : [joinMcpRoute(routePrefix, "/mcp")];
-    const handler = defineEventHandler(async (event) => {
-        return handleMcpRequest(event, config);
-    });
     for (const routePath of routePaths) {
-        getH3App(nitroApp).use(routePath, handler);
+        getH3App(nitroApp).use(routePath, defineEventHandler(async (event) => {
+            return handleMcpRequest(event, config, routePath);
+        }));
     }
     if (process.env.DEBUG)
         console.log(`[mcp] Mounted MCP server at ${routePaths.join(" and ")} (${Object.keys(config.actions).length} tools${config.askAgent ? " + ask-agent" : ""})`);

package/dist/notifications/routes.d.ts

@@ -13,13 +13,13 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated: number;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated?: undefined;
@@ -28,6 +28,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/org/handlers.d.ts

@@ -38,6 +38,7 @@ export declare const listMembersHandler: import("h3").EventHandlerWithFetch<impo
         role: OrgRole;
         joinedAt: number;
     }[];
+    totalCount: number;
     hasMore: boolean;
     nextOffset: number;
 }>>;

package/dist/org/handlers.js

@@ -172,8 +172,9 @@ export const createOrgHandler = defineEventHandler(async (event) => {
 /** GET /_agent-native/org/members — list org members */
 export const listMembersHandler = defineEventHandler(async (event) => {
     const ctx = await getOrgContext(event);
-    if (!ctx.orgId)
-        return { members: [], hasMore: false, nextOffset: null };
+    if (!ctx.orgId) {
+        return { members: [], totalCount: 0, hasMore: false, nextOffset: null };
+    }
     const url = getRequestURL(event);
     const search = (url.searchParams.get("search") ??
         url.searchParams.get("q") ??
@@ -191,22 +192,35 @@ export const listMembersHandler = defineEventHandler(async (event) => {
         : 0;
     const e = await exec();
     const args = [ctx.orgId];
+    const countArgs = [ctx.orgId];
     let sql = `SELECT email, role, joined_at AS "joinedAt" FROM org_members WHERE org_id = ?`;
+    let countSql = `SELECT COUNT(*) AS "totalCount" FROM org_members WHERE org_id = ?`;
     if (search) {
         sql += ` AND LOWER(email) LIKE ? ESCAPE '!'`;
         args.push(`%${escapeLike(search)}%`);
+        countSql += ` AND LOWER(email) LIKE ? ESCAPE '!'`;
+        countArgs.push(`%${escapeLike(search)}%`);
     }
     sql += ` ORDER BY LOWER(email) ASC`;
     if (limit !== null) {
         sql += ` LIMIT ? OFFSET ?`;
         args.push(limit + 1, offset);
     }
+    const totalCountResult = limit === null
+        ? undefined
+        : await e.execute({ sql: countSql, args: countArgs });
     const { rows } = await e.execute({
         sql,
         args,
     });
     const pageRows = limit !== null ? rows.slice(0, limit) : rows;
     const hasMore = limit !== null && rows.length > limit;
+    const totalCount = totalCountResult === undefined
+        ? pageRows.length
+        : Number(totalCountResult.rows[0]?.totalCount);
+    if (!Number.isSafeInteger(totalCount) || totalCount < 0) {
+        throw new Error("Organization member count was not returned");
+    }
     const members = pageRows.map((r) => ({
         email: String(r.email),
         role: String(r.role),
@@ -214,6 +228,7 @@ export const listMembersHandler = defineEventHandler(async (event) => {
     }));
     return {
         members,
+        totalCount,
         hasMore,
         nextOffset: hasMore ? offset + members.length : null,
     };

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,8 +75,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
+    id?: undefined;
     deleted?: undefined;
-    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -88,18 +88,18 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     }[];
     count: number;
     provider?: undefined;
+    found?: undefined;
     registered?: undefined;
-    id?: undefined;
     label?: undefined;
     message?: undefined;
 } | {
+    id?: undefined;
     deleted?: undefined;
     providers?: undefined;
     count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
-    id?: undefined;
     label?: undefined;
     message?: undefined;
 } | {
@@ -113,10 +113,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     label?: undefined;
     message?: undefined;
 } | {
-    found?: undefined;
     providers?: undefined;
     count?: undefined;
     provider?: undefined;
+    found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
@@ -124,10 +124,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     message?: undefined;
 } | {
     deleted?: undefined;
-    found?: undefined;
     providers?: undefined;
     count?: undefined;
     provider?: undefined;
+    found?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -314,7 +314,6 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         id?: undefined;
         provider?: undefined;
         deleted?: undefined;
-        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -325,13 +324,14 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
+        found?: undefined;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
         id?: undefined;
-        deleted?: undefined;
         count?: undefined;
+        deleted?: undefined;
         providers?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
@@ -339,9 +339,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
+        count?: undefined;
         provider?: undefined;
         deleted?: undefined;
-        count?: undefined;
         providers?: undefined;
         found: boolean;
         id: string;
@@ -349,21 +349,21 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        provider?: undefined;
-        found?: undefined;
         count?: undefined;
+        provider?: undefined;
         providers?: undefined;
+        found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
+        count?: undefined;
         provider?: undefined;
         deleted?: undefined;
-        found?: undefined;
-        count?: undefined;
         providers?: undefined;
+        found?: undefined;
         registered: boolean;
         id: string;
         label: string;