@agent-native/core 0.15.11 → 0.15.12

package/dist/vite/agent-web-plugin.d.ts

@@ -0,0 +1,17 @@
+import type { Plugin } from "vite";
+import { type AgentWebInputConfig, type AgentWebPage } from "../agent-web/index.js";
+export interface AgentWebVitePluginOptions {
+    siteName: string;
+    siteUrl: string;
+    description?: string;
+    pages: AgentWebPage[] | (() => AgentWebPage[]);
+    agentWeb?: AgentWebInputConfig | boolean;
+    outputDirs?: string[];
+    organization?: {
+        name: string;
+        url?: string;
+        sameAs?: string[];
+    };
+}
+export declare function createAgentWebVitePlugin(options: AgentWebVitePluginOptions): Plugin;
+//# sourceMappingURL=agent-web-plugin.d.ts.map

package/dist/vite/agent-web-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-web-plugin.d.ts","sourceRoot":"","sources":["../../src/vite/agent-web-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;CACH;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,MAAM,CAiDR"}

package/dist/vite/agent-web-plugin.js

@@ -0,0 +1,48 @@
+import fs from "fs";
+import path from "path";
+import { buildAgentWebStaticFiles, normalizeAgentWebConfig, } from "../agent-web/index.js";
+export function createAgentWebVitePlugin(options) {
+    let rootDir = process.cwd();
+    return {
+        name: "agent-web-surfaces",
+        apply: "build",
+        configResolved(config) {
+            rootDir = config.root;
+        },
+        closeBundle() {
+            const pages = typeof options.pages === "function" ? options.pages() : options.pages;
+            const config = normalizeAgentWebConfig(options.agentWeb ?? {}, {
+                hasPublicRoutes: pages.length > 0,
+            });
+            if (!config.discoverable)
+                return;
+            const files = buildAgentWebStaticFiles({
+                siteName: options.siteName,
+                siteUrl: options.siteUrl,
+                description: options.description,
+                pages,
+                config,
+                organization: options.organization,
+            });
+            const outputDirs = options.outputDirs ?? [
+                "public",
+                "dist",
+                "dist/client",
+                "dist/server/public",
+                "build/client",
+            ];
+            for (const dir of outputDirs) {
+                const outDir = path.resolve(rootDir, dir);
+                if (!fs.existsSync(outDir))
+                    continue;
+                for (const file of files) {
+                    const outPath = path.resolve(outDir, file.path);
+                    fs.mkdirSync(path.dirname(outPath), { recursive: true });
+                    fs.writeFileSync(outPath, file.content);
+                }
+            }
+            this.info(`[agent-web] Generated ${files.length} files for ${pages.length} public routes`);
+        },
+    };
+}
+//# sourceMappingURL=agent-web-plugin.js.map

package/dist/vite/agent-web-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-web-plugin.js","sourceRoot":"","sources":["../../src/vite/agent-web-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GAGxB,MAAM,uBAAuB,CAAC;AAgB/B,MAAM,UAAU,wBAAwB,CACtC,OAAkC;IAElC,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE5B,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,OAAO;QACd,cAAc,CAAC,MAAM;YACnB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,WAAW;YACT,MAAM,KAAK,GACT,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE;gBAC7D,eAAe,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,YAAY;gBAAE,OAAO;YAEjC,MAAM,KAAK,GAAG,wBAAwB,CAAC;gBACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK;gBACL,MAAM;gBACN,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI;gBACvC,QAAQ;gBACR,MAAM;gBACN,aAAa;gBACb,oBAAoB;gBACpB,cAAc;aACf,CAAC;YAEF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,IAAI,CAAC,IAAI,CACP,yBAAyB,KAAK,CAAC,MAAM,cAAc,KAAK,CAAC,MAAM,gBAAgB,CAChF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import fs from \"fs\";\nimport path from \"path\";\nimport type { Plugin } from \"vite\";\nimport {\n  buildAgentWebStaticFiles,\n  normalizeAgentWebConfig,\n  type AgentWebInputConfig,\n  type AgentWebPage,\n} from \"../agent-web/index.js\";\n\nexport interface AgentWebVitePluginOptions {\n  siteName: string;\n  siteUrl: string;\n  description?: string;\n  pages: AgentWebPage[] | (() => AgentWebPage[]);\n  agentWeb?: AgentWebInputConfig | boolean;\n  outputDirs?: string[];\n  organization?: {\n    name: string;\n    url?: string;\n    sameAs?: string[];\n  };\n}\n\nexport function createAgentWebVitePlugin(\n  options: AgentWebVitePluginOptions,\n): Plugin {\n  let rootDir = process.cwd();\n\n  return {\n    name: \"agent-web-surfaces\",\n    apply: \"build\",\n    configResolved(config) {\n      rootDir = config.root;\n    },\n    closeBundle() {\n      const pages =\n        typeof options.pages === \"function\" ? options.pages() : options.pages;\n      const config = normalizeAgentWebConfig(options.agentWeb ?? {}, {\n        hasPublicRoutes: pages.length > 0,\n      });\n      if (!config.discoverable) return;\n\n      const files = buildAgentWebStaticFiles({\n        siteName: options.siteName,\n        siteUrl: options.siteUrl,\n        description: options.description,\n        pages,\n        config,\n        organization: options.organization,\n      });\n\n      const outputDirs = options.outputDirs ?? [\n        \"public\",\n        \"dist\",\n        \"dist/client\",\n        \"dist/server/public\",\n        \"build/client\",\n      ];\n\n      for (const dir of outputDirs) {\n        const outDir = path.resolve(rootDir, dir);\n        if (!fs.existsSync(outDir)) continue;\n        for (const file of files) {\n          const outPath = path.resolve(outDir, file.path);\n          fs.mkdirSync(path.dirname(outPath), { recursive: true });\n          fs.writeFileSync(outPath, file.content);\n        }\n      }\n\n      this.info(\n        `[agent-web] Generated ${files.length} files for ${pages.length} public routes`,\n      );\n    },\n  };\n}\n"]}

package/dist/vite/index.d.ts

@@ -1,4 +1,5 @@
 export { defineConfig, type ClientConfigOptions, type NitroOptions, } from "./client.js";
 export { actionTypesPlugin, generateActionRegistryForProject, } from "./action-types-plugin.js";
 export { agentsBundlePlugin } from "./agents-bundle-plugin.js";
+export { createAgentWebVitePlugin, type AgentWebVitePluginOptions, } from "./agent-web-plugin.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/vite/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,uBAAuB,CAAC"}

package/dist/vite/index.js

@@ -1,4 +1,5 @@
 export { defineConfig, } from "./client.js";
 export { actionTypesPlugin, generateActionRegistryForProject, } from "./action-types-plugin.js";
 export { agentsBundlePlugin } from "./agents-bundle-plugin.js";
+export { createAgentWebVitePlugin, } from "./agent-web-plugin.js";
 //# sourceMappingURL=index.js.map

package/dist/vite/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC","sourcesContent":["export {\n  defineConfig,\n  type ClientConfigOptions,\n  type NitroOptions,\n} from \"./client.js\";\nexport {\n  actionTypesPlugin,\n  generateActionRegistryForProject,\n} from \"./action-types-plugin.js\";\nexport { agentsBundlePlugin } from \"./agents-bundle-plugin.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,wBAAwB,GAEzB,MAAM,uBAAuB,CAAC","sourcesContent":["export {\n  defineConfig,\n  type ClientConfigOptions,\n  type NitroOptions,\n} from \"./client.js\";\nexport {\n  actionTypesPlugin,\n  generateActionRegistryForProject,\n} from \"./action-types-plugin.js\";\nexport { agentsBundlePlugin } from \"./agents-bundle-plugin.js\";\nexport {\n  createAgentWebVitePlugin,\n  type AgentWebVitePluginOptions,\n} from \"./agent-web-plugin.js\";\n"]}

package/docs/content/agent-web-surfaces.md

@@ -0,0 +1,143 @@
+---
+title: "Agent Web Surfaces"
+description: "Make public routes crawlable, readable, citable, and optionally callable by agents."
+---
+
+# Agent Web Surfaces
+
+Agent Web surfaces make public Agent-Native routes easy for agents to crawl, read, cite, and eventually call. The goal is not to make every app endpoint public. The goal is to publish a clean public surface for pages that are already public, while keeping private data and tool access behind explicit controls.
+
+The docs site is the reference implementation. It publishes:
+
+- `/robots.txt` with a crawler policy that allows retrieval but disallows training by default.
+- `/sitemap.xml` with absolute canonical URLs and `lastmod` when the source file exposes it.
+- `/llms.txt` and `/llms-full.txt` for agent-friendly content discovery.
+- Markdown mirrors such as `/docs/getting-started.md`.
+- `Accept: text/markdown` responses for public docs pages after a production build.
+- JSON-LD for base organization, website, and page metadata.
+
+## Configuration
+
+Add `agentWeb` under the existing workspace app config. The public route list is still derived from the app's route access settings; `agentWeb` controls how that public surface is represented to agents.
+
+```json
+{
+  "agent-native": {
+    "workspaceApp": {
+      "audience": "public",
+      "protectedPaths": ["/admin/*"],
+      "agentWeb": {
+        "discoverable": true,
+        "markdownTwins": true,
+        "llmsTxt": true,
+        "jsonLd": true,
+        "publicAgentCard": true,
+        "publicMcp": false,
+        "crawlerPolicy": "discoverable-no-training",
+        "crawlers": {
+          "training": "disallow",
+          "search": "allow",
+          "userTriggered": "allow",
+          "codingAgents": "allow",
+          "autonomousAgents": "allow"
+        }
+      }
+    }
+  }
+}
+```
+
+For most apps, leave the defaults alone. If an app has any public route, `discoverable` defaults on. The default crawler policy is "discoverable, not trainable": search, user-triggered retrieval, coding agents, and autonomous browsing agents are allowed; training crawlers are disallowed.
+
+## Route Source Of Truth
+
+Agent Web discovery follows the route access model:
+
+- Public apps expose every route except `protectedPaths`.
+- Internal apps expose only `publicPaths`.
+- Public share and form pages can be readable by agents.
+- Submitted private data, authenticated dashboards, and user/org state are never included just because a nearby page is public.
+
+This keeps mixed apps natural. A forms app can expose a public form page and keep submissions private. A content app can expose published posts and keep the editor private. A docs site can expose everything except admin tools.
+
+## Public Pages Are Not Public Tools
+
+Public page access and public tool access are separate. A route being public only means agents can read that route as HTML, Markdown, sitemap entries, llms entries, and structured data.
+
+To expose an action through a public agent protocol later, the action must opt in:
+
+```ts
+export default defineAction({
+  description: "Search published docs",
+  readOnly: true,
+  publicAgent: {
+    expose: true,
+    readOnly: true,
+    requiresAuth: false,
+    isConsequential: false,
+    title: "Search published docs",
+  },
+  run: async (args) => {
+    // ...
+  },
+});
+```
+
+`agentWeb.publicMcp` stays `false` by default. When public MCP is enabled, the server should expose only actions with `publicAgent.expose === true`, and should still exclude consequential or write actions unless the action and auth policy explicitly allow them.
+
+## Build-Time Files
+
+Framework utilities in `@agent-native/core/agent-web` generate the common files from one page list:
+
+```ts
+import {
+  buildAgentWebStaticFiles,
+  normalizeAgentWebConfig,
+} from "@agent-native/core/agent-web";
+
+const config = normalizeAgentWebConfig(
+  { crawlerPolicy: "discoverable-no-training" },
+  { hasPublicRoutes: true },
+);
+
+const files = buildAgentWebStaticFiles({
+  siteName: "My Agent-Native App",
+  siteUrl: "https://example.com",
+  description: "Public docs for my app.",
+  config,
+  pages: [
+    {
+      path: "/docs",
+      title: "Docs",
+      description: "Start here.",
+      markdown: "# Docs\n\nStart here.\n",
+      markdownPath: "/docs/getting-started.md",
+      lastmod: new Date(),
+    },
+  ],
+});
+```
+
+Vite apps can use `createAgentWebVitePlugin` from `@agent-native/core/vite` to write those files into `public`, `dist`, `dist/client`, `dist/server/public`, or `build/client` during production builds.
+
+## Audit A Site
+
+Use the CLI audit against a deployed site or a local production server:
+
+```bash
+agent-native audit-agent-web --url https://www.agent-native.com
+```
+
+The audit checks for:
+
+- SSR-visible HTML.
+- Canonical URLs.
+- JSON-LD.
+- `robots.txt` policy and absolute sitemap URL.
+- Absolute sitemap entries.
+- `/llms.txt` and `/llms-full.txt`.
+- Markdown mirrors.
+- `Accept: text/markdown`.
+- No accidental 401/403 blocks for common agent retrieval user agents.
+
+The audit exits non-zero if a required public surface is missing.

package/docs/content/migration-workbench.md

@@ -0,0 +1,110 @@
+---
+title: "Migration Workbench"
+description: "Use a local agent-native Workbench to migrate existing apps into agent-native with assessment, approval, generated output, and verification."
+---
+
+# Migration Workbench
+
+Migration Workbench is a local agent-native app for moving existing applications into the agent-native framework. It is designed for migrations where an agent can do useful work, but every important step should be auditable and verified.
+
+The product promise is: **let the agent run, but prove it**.
+
+V1 focuses on **Next.js to standalone agent-native**. Builder.io Publish and AEM exits are designed into the adapter interfaces, but are intended as follow-on enterprise adapters rather than the first shipped path.
+
+## How It Works
+
+Run:
+
+```bash
+agent-native migrate ./my-next-app --out ../migrated-app
+```
+
+The command scaffolds the hidden `migration` template and writes a seed file with the source and output paths. The Workbench UI then guides the run:
+
+1. **Discover** reads the source project and creates `01-assessment.md`.
+2. **Plan** creates recipe tasks and writes `02-plan.md` plus `03-tasks.md`.
+3. **Approve** unlocks generated output writes.
+4. **Sweep** runs migration tasks against the generated output project.
+5. **Verify** runs deterministic checks and writes `04-report.md`.
+
+The source project is read-only. Generated output is written to a separate `outputRoot`.
+
+## Agent-Native Mapping
+
+The V1 recipes are named after the framework contracts they enforce:
+
+| Source pattern              | Agent-native target                                               |
+| --------------------------- | ----------------------------------------------------------------- |
+| API routes / server actions | `actions/`, except uploads, webhooks, OAuth, and streaming routes |
+| app-owned data              | Drizzle SQL tables plus actions                                   |
+| direct LLM calls            | agent chat delegation                                             |
+| important client state      | `application_state` navigation and selection                      |
+| UI mutations                | optimistic action mutations                                       |
+| shared resources            | ownership, sharing, and access helpers                            |
+| public pages                | server rendering                                                  |
+| logged-in workflows         | persistent client app shell                                       |
+
+This is the difference between porting React code and actually migrating to agent-native.
+
+## Adapter Model
+
+`@agent-native/migrate` exposes a reusable engine:
+
+- `SourceAdapter` detects and inventories existing projects.
+- `TargetAdapter` scaffolds and verifies output.
+- `MigrationRecipe` turns IR graph inventory into tasks.
+- `Verifier` returns structured migration evidence.
+
+The intermediate representation is split into four graphs:
+
+- `SiteGraph`: routes, redirects, public/private classification, metadata.
+- `ComponentGraph`: reusable UI components and design tokens.
+- `ContentGraph`: CMS models, static content, and assets.
+- `BehaviorGraph`: API endpoints, data stores, auth, jobs, client state, and LLM calls.
+
+## Builder.io And AEM
+
+Builder.io is a target decision, not a source assumption. Builder Publish should be used for marketing, docs, landing, and content surfaces. Transactional SaaS state, dashboards, app-owned data, and workflows stay in agent-native SQL/actions.
+
+AEM support should be implemented as a source adapter family:
+
+- `crawl`: URLs, sitemap, screenshots, SEO, redirects.
+- `api`: AEM GraphQL Content Fragments and DAM metadata.
+- `package`: Vault/JCR package parsing.
+- `code`: HTL components, dialogs, templates, and policies.
+- `enterprise`: combines available modes and emits confidence/gap reports.
+
+AEM output is two-pipeline: content extraction into Builder or SQL, plus frontend regeneration and component mapping into agent-native UI.
+
+## Verification
+
+The default verifier path is deterministic:
+
+- output file smoke checks
+- route inventory parity artifacts
+- agent-native conformance checks
+- future Playwright smoke tests
+- future visual, a11y, Lighthouse, SEO, and redirect checks
+
+AI browser tools can help generate or repair flows, but deterministic Playwright-style checks should remain the truth oracle.
+
+## Package Exports
+
+Use the engine directly when building adapters or custom migration workflows:
+
+```ts
+import {
+  createMigrationRun,
+  discoverMigration,
+  planMigration,
+  nextjsSourceAdapter,
+  agentNativeTargetAdapter,
+} from "@agent-native/migrate";
+```
+
+Subpath exports are available for first-party V1 adapters:
+
+```ts
+import { nextjsSourceAdapter } from "@agent-native/migrate/source-nextjs";
+import { agentNativeTargetAdapter } from "@agent-native/migrate/target-agent-native";
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.15.11",
+  "version": "0.15.12",
   "type": "module",
   "description": "Framework for agent-native application development — where AI agents and UI share state via files",
   "license": "MIT",
@@ -31,6 +31,7 @@
     "./server/agent-discovery": "./dist/server/agent-discovery.js",
     "./server/request-context": "./dist/server/request-context.js",
     "./server/design-token-utils": "./dist/server/design-token-utils.js",
+    "./agent-web": "./dist/agent-web/index.js",
     "./db": "./dist/db/index.js",
     "./db/schema": "./dist/db/schema.js",
     "./db/drizzle-config": "./dist/db/drizzle-config.js",

package/dist/client/dev-mode.d.ts

@@ -1,14 +0,0 @@
-/**
- * Client-side mirror of the framework's dev-mode bypass identity.
- *
- * Mirrors `DEV_MODE_USER_EMAIL` from `packages/core/src/server/auth.ts`
- * (the source of truth) so that React components and other client code
- * can compare against it without importing from server-only modules.
- *
- * Use this when a client component needs to show / hide UI that is only
- * meaningful when the user is running in local/dev mode (e.g. the
- * "Migrate local data" prompt, the dev-only sign-in card, or hiding the
- * org switcher when there is no real account yet).
- */
-export declare const DEV_MODE_USER_EMAIL = "local@localhost";
-//# sourceMappingURL=dev-mode.d.ts.map

package/dist/client/dev-mode.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev-mode.d.ts","sourceRoot":"","sources":["../../src/client/dev-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC"}

package/dist/client/dev-mode.js

@@ -1,14 +0,0 @@
-/**
- * Client-side mirror of the framework's dev-mode bypass identity.
- *
- * Mirrors `DEV_MODE_USER_EMAIL` from `packages/core/src/server/auth.ts`
- * (the source of truth) so that React components and other client code
- * can compare against it without importing from server-only modules.
- *
- * Use this when a client component needs to show / hide UI that is only
- * meaningful when the user is running in local/dev mode (e.g. the
- * "Migrate local data" prompt, the dev-only sign-in card, or hiding the
- * org switcher when there is no real account yet).
- */
-export const DEV_MODE_USER_EMAIL = "local@localhost"; // guard:allow-localhost-fallback — client-side mirror of the framework dev-mode identity defined in server/auth.ts; not a session-pooling fallback
-//# sourceMappingURL=dev-mode.js.map

package/dist/client/dev-mode.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev-mode.js","sourceRoot":"","sources":["../../src/client/dev-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,CAAC,mJAAmJ","sourcesContent":["/**\n * Client-side mirror of the framework's dev-mode bypass identity.\n *\n * Mirrors `DEV_MODE_USER_EMAIL` from `packages/core/src/server/auth.ts`\n * (the source of truth) so that React components and other client code\n * can compare against it without importing from server-only modules.\n *\n * Use this when a client component needs to show / hide UI that is only\n * meaningful when the user is running in local/dev mode (e.g. the\n * \"Migrate local data\" prompt, the dev-only sign-in card, or hiding the\n * org switcher when there is no real account yet).\n */\nexport const DEV_MODE_USER_EMAIL = \"local@localhost\"; // guard:allow-localhost-fallback — client-side mirror of the framework dev-mode identity defined in server/auth.ts; not a session-pooling fallback\n"]}

package/dist/client/extensions/EmbeddedTool.d.ts

@@ -1,20 +0,0 @@
-export interface EmbeddedToolProps {
-    toolId: string;
-    /** Slot identifier passed via the iframe URL so the tool runtime knows it's
-     * embedded and enables auto-resize. */
-    slotId: string;
-    /** Object pushed into the tool as `window.slotContext`. Re-posted whenever
-     * the host re-renders with a new context. */
-    context?: Record<string, unknown> | null;
-    /** Optional className applied to the iframe container. */
-    className?: string;
-    /** Initial iframe height before content reports a real height. */
-    initialHeight?: number;
-}
-/**
- * Renders a tool inline as a small auto-sized iframe — for use inside an
- * `<ExtensionSlot>`. Different from `<ToolViewer>` (which is full-page with a
- * toolbar): no header, sized to content, receives a `slotContext`.
- */
-export declare function EmbeddedTool({ toolId, slotId, context, className, initialHeight, }: EmbeddedToolProps): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=EmbeddedTool.d.ts.map

package/dist/client/extensions/EmbeddedTool.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"EmbeddedTool.d.ts","sourceRoot":"","sources":["../../../src/client/extensions/EmbeddedTool.tsx"],"names":[],"mappings":"AA8BA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf;2CACuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf;iDAC6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACN,MAAM,EACN,OAAO,EACP,SAAS,EACT,aAAkB,GACnB,EAAE,iBAAiB,2CA6LnB"}

package/dist/client/extensions/EmbeddedTool.js

@@ -1,199 +0,0 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { agentNativePath } from "../api-path.js";
-import { useEffect, useMemo, useRef, useState } from "react";
-import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { useNavigate } from "react-router";
-import { IconDots, IconExternalLink, IconLayoutSidebarRightCollapse, IconTrash, } from "@tabler/icons-react";
-import { Popover, PopoverContent, PopoverTrigger, } from "../components/ui/popover.js";
-import { isAllowedToolPath, sanitizeToolRequestOptions, checkBridgePolicy, } from "./iframe-bridge.js";
-/**
- * Renders a tool inline as a small auto-sized iframe — for use inside an
- * `<ExtensionSlot>`. Different from `<ToolViewer>` (which is full-page with a
- * toolbar): no header, sized to content, receives a `slotContext`.
- */
-export function EmbeddedTool({ toolId, slotId, context, className, initialHeight = 80, }) {
-    const iframeRef = useRef(null);
-    const [height, setHeight] = useState(initialHeight);
-    const [isDark, setIsDark] = useState(false);
-    // (audit H4) Mirror ToolViewer's role-aware gating; deny-by-default until
-    // the iframe's render binding announcement arrives.
-    const bridgeContextRef = useRef({
-        role: "viewer",
-        isAuthor: false,
-    });
-    useEffect(() => {
-        setIsDark(document.documentElement.classList.contains("dark"));
-        const observer = new MutationObserver(() => {
-            setIsDark(document.documentElement.classList.contains("dark"));
-        });
-        observer.observe(document.documentElement, {
-            attributes: true,
-            attributeFilter: ["class"],
-        });
-        return () => observer.disconnect();
-    }, []);
-    const { data: tool } = useQuery({
-        queryKey: ["tool", toolId],
-        queryFn: async () => {
-            const res = await fetch(agentNativePath(`/_agent-native/tools/${toolId}`));
-            if (!res.ok)
-                throw new Error("Failed to fetch tool");
-            return res.json();
-        },
-    });
-    const iframeSrc = useMemo(() => {
-        const v = encodeURIComponent(tool?.updatedAt ?? "");
-        return agentNativePath(`/_agent-native/tools/${toolId}/render?slot=${encodeURIComponent(slotId)}&dark=${isDark}&v=${v}`);
-    }, [toolId, slotId, isDark, tool?.updatedAt]);
-    // Forward slot context whenever it changes. The iframe's own load handler
-    // posts the initial value once it's ready; this effect handles updates.
-    const contextJson = JSON.stringify(context ?? {});
-    useEffect(() => {
-        const win = iframeRef.current?.contentWindow;
-        if (!win)
-            return;
-        win.postMessage({ type: "agent-native-slot-context", context: context ?? {} }, "*");
-    }, [contextJson]);
-    // Bridge tool requests + height reports.
-    useEffect(() => {
-        const handleMessage = async (event) => {
-            if (event.source !== iframeRef.current?.contentWindow)
-                return;
-            const message = event.data;
-            if (!message || typeof message !== "object")
-                return;
-            if (message.type === "agent-native-tool-binding") {
-                const binding = message.binding ?? {};
-                const role = binding.role === "owner" ||
-                    binding.role === "admin" ||
-                    binding.role === "editor" ||
-                    binding.role === "viewer"
-                    ? binding.role
-                    : "viewer";
-                bridgeContextRef.current = {
-                    role,
-                    isAuthor: !!binding.isAuthor,
-                };
-                return;
-            }
-            if (message.type === "agent-native-tool-resize") {
-                const h = Number(message.height);
-                if (Number.isFinite(h) && h > 0) {
-                    setHeight(Math.ceil(h));
-                }
-                return;
-            }
-            if (message.type !== "agent-native-tool-request")
-                return;
-            const requestId = String(message.requestId ?? "");
-            const path = String(message.path ?? "");
-            const respond = (payload) => {
-                iframeRef.current?.contentWindow?.postMessage({ type: "agent-native-tool-response", requestId, ...payload }, "*");
-            };
-            if (!requestId || !isAllowedToolPath(path, toolId)) {
-                respond({ error: "Tool request path is not allowed" });
-                return;
-            }
-            try {
-                const options = sanitizeToolRequestOptions(message.options);
-                // (audit H4) Role-aware gating: viewer-shared tools can read but not
-                // write. The bridge policy is decided here in the parent before the
-                // request leaves; the server enforces a second layer.
-                const policy = checkBridgePolicy(path, options.method ?? "GET", bridgeContextRef.current);
-                if (!policy.ok) {
-                    respond({
-                        response: {
-                            ok: false,
-                            status: 403,
-                            statusText: "Forbidden",
-                            body: { error: policy.error },
-                        },
-                    });
-                    return;
-                }
-                // (audit H5) Same tool-bridge tagging as <ToolViewer>. action-routes
-                // uses these headers to enforce per-action `toolCallable` opt-in.
-                const finalHeaders = new Headers(options.headers ?? undefined);
-                finalHeaders.set("X-Agent-Native-Tool-Bridge", "1");
-                finalHeaders.set("X-Agent-Native-Tool-Id", toolId);
-                const res = await fetch(agentNativePath(path), {
-                    ...options,
-                    headers: finalHeaders,
-                    credentials: "same-origin",
-                });
-                const text = await res.text();
-                let body = text;
-                if (text) {
-                    try {
-                        body = JSON.parse(text);
-                    }
-                    catch {
-                        body = text;
-                    }
-                }
-                respond({
-                    response: {
-                        ok: res.ok,
-                        status: res.status,
-                        statusText: res.statusText,
-                        body,
-                    },
-                });
-            }
-            catch (err) {
-                respond({ error: err?.message ?? "Tool host request failed" });
-            }
-        };
-        window.addEventListener("message", handleMessage);
-        return () => window.removeEventListener("message", handleMessage);
-    }, [toolId]);
-    if (!tool) {
-        return (_jsx("div", { className: className, style: { height: initialHeight }, "aria-busy": "true" }));
-    }
-    return (_jsxs("div", { className: `relative group/embedded-tool ${className ?? ""}`, children: [_jsx("iframe", { ref: iframeRef, src: iframeSrc, title: tool.name, sandbox: "allow-scripts allow-forms", style: { width: "100%", border: 0, height, display: "block" }, onLoad: () => {
-                    iframeRef.current?.contentWindow?.postMessage({ type: "agent-native-slot-context", context: context ?? {} }, "*");
-                } }, `${toolId}-${tool.updatedAt ?? ""}`), _jsx(EmbeddedToolMenu, { toolId: toolId, slotId: slotId, toolName: tool.name })] }));
-}
-function EmbeddedToolMenu({ toolId, slotId, toolName, }) {
-    const [open, setOpen] = useState(false);
-    const [confirmingDelete, setConfirmingDelete] = useState(false);
-    const queryClient = useQueryClient();
-    const navigate = useNavigate();
-    const closeMenu = () => {
-        setOpen(false);
-        setConfirmingDelete(false);
-    };
-    const removeFromSlot = async () => {
-        closeMenu();
-        queryClient.setQueryData(["slot-installs", slotId], (old) => (old ?? []).filter((i) => i.toolId !== toolId));
-        try {
-            await fetch(agentNativePath(`/_agent-native/slots/${encodeURIComponent(slotId)}/install/${encodeURIComponent(toolId)}`), { method: "DELETE" });
-        }
-        finally {
-            queryClient.invalidateQueries({ queryKey: ["slot-installs", slotId] });
-        }
-    };
-    const deleteTool = async () => {
-        closeMenu();
-        queryClient.setQueryData(["slot-installs", slotId], (old) => (old ?? []).filter((i) => i.toolId !== toolId));
-        try {
-            await fetch(agentNativePath(`/_agent-native/tools/${toolId}`), {
-                method: "DELETE",
-            });
-        }
-        finally {
-            queryClient.invalidateQueries({ queryKey: ["slot-installs", slotId] });
-            queryClient.invalidateQueries({ queryKey: ["tool", toolId] });
-            queryClient.invalidateQueries({ queryKey: ["tools"] });
-        }
-    };
-    return (_jsxs(Popover, { open: open, onOpenChange: (o) => {
-            setOpen(o);
-            if (!o)
-                setConfirmingDelete(false);
-        }, children: [_jsx(PopoverTrigger, { asChild: true, children: _jsx("button", { type: "button", className: "absolute top-1 right-1 flex h-6 w-6 items-center justify-center rounded-md bg-background/60 text-muted-foreground/60 opacity-0 hover:bg-accent hover:text-foreground hover:opacity-100 group-hover/embedded-tool:opacity-100 cursor-pointer transition-opacity", title: `${toolName} options`, "aria-label": `${toolName} options`, children: _jsx(IconDots, { className: "h-3.5 w-3.5" }) }) }), _jsx(PopoverContent, { align: "end", sideOffset: 4, className: "w-56 p-1", children: !confirmingDelete ? (_jsxs("div", { className: "flex flex-col", children: [_jsxs("button", { type: "button", onClick: () => {
-                                closeMenu();
-                                navigate(`/tools/${toolId}`);
-                            }, className: "flex items-center gap-2 rounded-sm px-2 py-1.5 text-[12px] hover:bg-accent cursor-pointer text-left", children: [_jsx(IconExternalLink, { className: "h-3.5 w-3.5" }), _jsx("span", { children: "Open full view" })] }), _jsxs("button", { type: "button", onClick: removeFromSlot, className: "flex items-center gap-2 rounded-sm px-2 py-1.5 text-[12px] hover:bg-accent cursor-pointer text-left", children: [_jsx(IconLayoutSidebarRightCollapse, { className: "h-3.5 w-3.5" }), _jsx("span", { children: "Remove from this widget area" })] }), _jsx("div", { className: "my-1 h-px bg-border/40" }), _jsxs("button", { type: "button", onClick: () => setConfirmingDelete(true), className: "flex items-center gap-2 rounded-sm px-2 py-1.5 text-[12px] text-destructive hover:bg-destructive/10 cursor-pointer text-left", children: [_jsx(IconTrash, { className: "h-3.5 w-3.5" }), _jsx("span", { children: "Delete tool\u2026" })] })] })) : (_jsxs("div", { className: "flex flex-col gap-2 p-2", children: [_jsxs("p", { className: "text-[12px]", children: ["Delete ", _jsx("span", { className: "font-medium", children: toolName }), "? This removes the tool everywhere, for everyone it's shared with."] }), _jsxs("div", { className: "flex justify-end gap-1", children: [_jsx("button", { type: "button", onClick: () => setConfirmingDelete(false), className: "rounded-md px-2 py-1 text-[12px] hover:bg-accent cursor-pointer", children: "Cancel" }), _jsx("button", { type: "button", onClick: deleteTool, className: "rounded-md bg-destructive px-2 py-1 text-[12px] text-destructive-foreground hover:bg-destructive/90 cursor-pointer", children: "Delete" })] })] })) })] }));
-}
-//# sourceMappingURL=EmbeddedTool.js.map