@agent-native/core 0.15.12 → 0.16.0

package/dist/extensions/store.js

@@ -1,11 +1,14 @@
 import { randomUUID } from "node:crypto";
 import { eq } from "drizzle-orm";
+import { appStatePut } from "../application-state/store.js";
 import { getDbExec, isPostgres, retryOnDdlRace } from "../db/client.js";
 import { createGetDb } from "../db/create-get-db.js";
+import { recordChange } from "../server/poll.js";
 import { accessFilter, assertAccess, resolveAccess, ForbiddenError, } from "../sharing/access.js";
 import { getRequestUserEmail, getRequestOrgId, } from "../server/request-context.js";
 import { registerShareableResource } from "../sharing/registry.js";
-import { extensions, extensionHides, extensionShares, EXTENSIONS_CREATE_SQL, EXTENSIONS_CREATE_SQL_PG, EXTENSION_SHARES_CREATE_SQL, EXTENSION_SHARES_CREATE_SQL_PG, EXTENSION_DATA_CREATE_SQL, EXTENSION_DATA_CREATE_SQL_PG, EXTENSION_DATA_ITEM_INDEX_SQL, EXTENSION_DATA_ITEM_INDEX_SQL_PG, EXTENSION_DATA_DROP_OLD_INDEX_SQL, EXTENSION_DATA_DROP_OLD_INDEX_SQL_PG, EXTENSIONS_OWNER_INDEX_SQL, EXTENSIONS_ORG_INDEX_SQL, EXTENSION_SHARES_RESOURCE_INDEX_SQL, EXTENSION_HIDES_CREATE_SQL, EXTENSION_HIDES_CREATE_SQL_PG, EXTENSION_HIDES_UNIQUE_INDEX_SQL, EXTENSION_HIDES_OWNER_INDEX_SQL, EXTENSION_CONSENTS_CREATE_SQL, EXTENSION_CONSENTS_CREATE_SQL_PG, EXTENSION_CONSENTS_VIEWER_INDEX_SQL, } from "./schema.js";
+import { extensions, extensionHides, extensionShares, EXTENSIONS_CREATE_SQL, EXTENSIONS_CREATE_SQL_PG, EXTENSION_SHARES_CREATE_SQL, EXTENSION_SHARES_CREATE_SQL_PG, EXTENSION_DATA_CREATE_SQL, EXTENSION_DATA_CREATE_SQL_PG, EXTENSION_DATA_ITEM_INDEX_SQL, EXTENSION_DATA_ITEM_INDEX_SQL_PG, EXTENSION_DATA_DROP_OLD_INDEX_SQL, EXTENSION_DATA_DROP_OLD_INDEX_SQL_PG, EXTENSIONS_OWNER_INDEX_SQL, EXTENSIONS_ORG_INDEX_SQL, EXTENSIONS_UPDATED_INDEX_SQL, EXTENSION_SHARES_RESOURCE_INDEX_SQL, EXTENSION_HIDES_CREATE_SQL, EXTENSION_HIDES_CREATE_SQL_PG, EXTENSION_HIDES_UNIQUE_INDEX_SQL, EXTENSION_HIDES_OWNER_INDEX_SQL, EXTENSION_CONSENTS_CREATE_SQL, EXTENSION_CONSENTS_CREATE_SQL_PG, EXTENSION_CONSENTS_VIEWER_INDEX_SQL, } from "./schema.js";
+import { EXTENSION_CHANGE_MARKER_KEY, extensionChangeMarkerSession, extensionChangeMarkerValue, } from "./change-marker.js";
 const getDb = createGetDb({ extensions, extensionShares, extensionHides });
 let _initPromise;
 export async function ensureExtensionsTables() {
@@ -25,6 +28,7 @@ export async function ensureExtensionsTables() {
             await retryOnDdlRace(() => client.execute(pg ? EXTENSION_DATA_ITEM_INDEX_SQL_PG : EXTENSION_DATA_ITEM_INDEX_SQL));
             await retryOnDdlRace(() => client.execute(EXTENSIONS_OWNER_INDEX_SQL));
             await retryOnDdlRace(() => client.execute(EXTENSIONS_ORG_INDEX_SQL));
+            await retryOnDdlRace(() => client.execute(EXTENSIONS_UPDATED_INDEX_SQL));
             await retryOnDdlRace(() => client.execute(EXTENSION_SHARES_RESOURCE_INDEX_SQL));
             await retryOnDdlRace(() => client.execute(pg ? EXTENSION_HIDES_CREATE_SQL_PG : EXTENSION_HIDES_CREATE_SQL));
             await retryOnDdlRace(() => client.execute(EXTENSION_HIDES_UNIQUE_INDEX_SQL));
@@ -127,6 +131,88 @@ export function registerExtensionsShareable() {
         requireOrgMemberForUserShares: true,
     });
 }
+function targetKey(target) {
+    if (target.owner)
+        return `owner:${target.owner}`;
+    if (target.orgId)
+        return `org:${target.orgId}`;
+    return null;
+}
+function addExtensionChangeTarget(targets, target) {
+    const key = targetKey(target);
+    if (key)
+        targets.set(key, target);
+}
+async function extensionChangeTargetsForRow(row) {
+    const targets = new Map();
+    addExtensionChangeTarget(targets, { owner: row.ownerEmail });
+    if (row.visibility === "org" && row.orgId) {
+        addExtensionChangeTarget(targets, { orgId: row.orgId });
+    }
+    const db = getDb();
+    const shares = (await db
+        .select({
+        principalType: extensionShares.principalType,
+        principalId: extensionShares.principalId,
+    })
+        .from(extensionShares)
+        .where(eq(extensionShares.resourceId, row.id)));
+    for (const share of shares) {
+        if (share.principalType === "user") {
+            addExtensionChangeTarget(targets, { owner: share.principalId });
+        }
+        else if (share.principalType === "org") {
+            addExtensionChangeTarget(targets, { orgId: share.principalId });
+        }
+    }
+    return Array.from(targets.values());
+}
+async function extensionChangeTargetsForId(id) {
+    const db = getDb();
+    const rows = await db.select().from(extensions).where(eq(extensions.id, id));
+    const row = rows[0];
+    return row ? extensionChangeTargetsForRow(row) : [];
+}
+export async function getExtensionChangeTargets(id) {
+    await ensureExtensionsTables();
+    return extensionChangeTargetsForId(id);
+}
+function dedupeExtensionChangeTargets(targets) {
+    const unique = new Map();
+    for (const target of targets) {
+        const key = targetKey(target);
+        if (key)
+            unique.set(key, target);
+    }
+    return Array.from(unique.values());
+}
+async function notifyExtensionChanged(targets) {
+    const uniqueTargets = dedupeExtensionChangeTargets(targets);
+    if (uniqueTargets.length === 0)
+        return;
+    for (const target of uniqueTargets) {
+        recordChange({
+            source: "extensions",
+            type: "change",
+            key: "*",
+            ...(target.owner ? { owner: target.owner } : {}),
+            ...(target.orgId ? { orgId: target.orgId } : {}),
+        });
+    }
+    await Promise.all(uniqueTargets.map(async (target) => {
+        const sessionId = extensionChangeMarkerSession(target);
+        if (!sessionId)
+            return;
+        await appStatePut(sessionId, EXTENSION_CHANGE_MARKER_KEY, extensionChangeMarkerValue(target));
+    }));
+}
+export async function notifyExtensionChangeForResource(id, beforeTargets = []) {
+    await ensureExtensionsTables();
+    await notifyExtensionChanged([
+        ...beforeTargets,
+        ...(await extensionChangeTargetsForId(id)),
+    ]);
+}
 export async function listExtensions(options = {}) {
     await ensureExtensionsTables();
     const db = getDb();
@@ -168,6 +254,7 @@ export async function createExtension(data) {
         visibility: "private",
     };
     await db.insert(extensions).values(row);
+    await notifyExtensionChanged([{ owner: row.ownerEmail }]);
     return row;
 }
 export async function updateExtension(id, data) {
@@ -181,6 +268,7 @@ export async function updateExtension(id, data) {
         throw new ForbiddenError("Extensions cannot be made public — share with specific people or your organization instead.");
     }
     const db = getDb();
+    const beforeTargets = await extensionChangeTargetsForId(id);
     const updates = {
         updatedAt: new Date().toISOString(),
     };
@@ -194,7 +282,14 @@ export async function updateExtension(id, data) {
         updates.visibility = data.visibility;
     await db.update(extensions).set(updates).where(eq(extensions.id, id));
     const rows = await db.select().from(extensions).where(eq(extensions.id, id));
-    return rows[0] ?? null;
+    const row = rows[0] ?? null;
+    if (row) {
+        await notifyExtensionChanged([
+            ...beforeTargets,
+            ...(await extensionChangeTargetsForRow(row)),
+        ]);
+    }
+    return row;
 }
 export async function updateExtensionContent(id, opts) {
     await ensureExtensionsTables();
@@ -219,20 +314,30 @@ export async function updateExtensionContent(id, opts) {
     else {
         return null;
     }
+    const beforeTargets = await extensionChangeTargetsForId(id);
     await db
         .update(extensions)
         .set({ content: newContent, updatedAt: new Date().toISOString() })
         .where(eq(extensions.id, id));
     const rows = await db.select().from(extensions).where(eq(extensions.id, id));
-    return rows[0] ?? null;
+    const row = rows[0] ?? null;
+    if (row) {
+        await notifyExtensionChanged([
+            ...beforeTargets,
+            ...(await extensionChangeTargetsForRow(row)),
+        ]);
+    }
+    return row;
 }
 export async function deleteExtension(id) {
     await ensureExtensionsTables();
     await assertAccess("extension", id, "admin");
     const db = getDb();
     const rows = await db.select().from(extensions).where(eq(extensions.id, id));
-    if (!rows[0])
+    const row = rows[0];
+    if (!row)
         return false;
+    const targets = await extensionChangeTargetsForRow(row);
     await db.delete(extensionShares).where(eq(extensionShares.resourceId, id));
     await db.delete(extensionHides).where(eq(extensionHides.extensionId, id));
     await getDbExec().execute({
@@ -242,6 +347,7 @@ export async function deleteExtension(id) {
     const { cascadeDeleteExtensionSlots } = await import("./slots/store.js");
     await cascadeDeleteExtensionSlots(id);
     await db.delete(extensions).where(eq(extensions.id, id));
+    await notifyExtensionChanged(targets);
     return true;
 }
 export async function getHiddenExtensionIdsForCurrentUser() {
@@ -269,6 +375,7 @@ export async function hideExtension(id) {
       ON CONFLICT (owner_email, tool_id) DO NOTHING`,
         args: [randomUUID(), id, userEmail, now],
     });
+    await notifyExtensionChanged([{ owner: userEmail }]);
     return true;
 }
 export async function unhideExtension(id) {
@@ -280,6 +387,7 @@ export async function unhideExtension(id) {
         sql: `DELETE FROM tool_hidden_extensions WHERE tool_id = ? AND owner_email = ?`,
         args: [id, userEmail],
     });
+    await notifyExtensionChanged([{ owner: userEmail }]);
     return true;
 }
 //# sourceMappingURL=store.js.map

package/dist/extensions/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/extensions/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EACL,UAAU,EACV,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,4BAA4B,EAC5B,6BAA6B,EAC7B,gCAAgC,EAChC,iCAAiC,EACjC,oCAAoC,EACpC,0BAA0B,EAC1B,wBAAwB,EACxB,mCAAmC,EACnC,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,aAAa,CAAC;AAErB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC;AAE3E,IAAI,YAAuC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CACtE,CAAC;YACF,MAAM,8BAA8B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACjD,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,EAAE,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,2BAA2B,CAClE,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,yBAAyB,CAC9D,CACF,CAAC;YACF,MAAM,yBAAyB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5C,MAAM,wBAAwB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,MAAM,CAAC,OAAO,CAClB,EAAE;gBACA,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,iCAAiC,CACtC,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,EAAE,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,6BAA6B,CACtE,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACvE,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC;YACrE,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC,CACpD,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,0BAA0B,CAChE,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,gCAAgC,CAAC,CACjD,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAChD,CAAC;YACF,kEAAkE;YAClE,iEAAiE;YACjE,iEAAiE;YACjE,iEAAiE;YACjE,8DAA8D;YAC9D,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,EAAE,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,6BAA6B,CACtE,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,GAAG,SAAS,CAAC;QACzB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,MAAoC,EACpC,EAAW;IAEX,MAAM,GAAG,GAAG,EAAE;QACZ,CAAC,CAAC;;;mCAG6B;QAC/B,CAAC,CAAC;;uBAEiB,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,IACE,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YAC7C,OAAO,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YACxD,OAAO,CAAC,QAAQ,CAAC,oCAAoC,CAAC,EACtD,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,MAAoC,EACpC,EAAW;IAEX,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,MAAM,CAAC,OAAO,CAClB,6DAA6D,CAC9D,CAAC;QACF,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IACE,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC;aACzB,WAAW,EAAE;aACb,QAAQ,CAAC,WAAW,CAAC,EACxB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAoC,EACpC,EAAW;IAEX,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE;QAC3C,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,MAAM,CAAC,OAAO,CACnB,kDAAkD,IAAI,IAAI,GAAG,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM;aACV,OAAO,CAAC,oCAAoC,IAAI,IAAI,GAAG,EAAE,CAAC;aAC1D,KAAK,CAAC,CAAC,GAAQ,EAAE,EAAE;YAClB,IACE,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC;iBACzB,WAAW,EAAE;iBACb,QAAQ,CAAC,WAAW,CAAC;gBAExB,MAAM,GAAG,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACtD,MAAM,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,MAAM,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;IACrE,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,MAAM,CAAC,OAAO;IAClB,oIAAoI;IACpI,uHAAuH,CACxH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,yBAAyB,CAAC;QACxB,IAAI,EAAE,WAAW;QACjB,aAAa,EAAE,UAAU;QACzB,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE,WAAW;QACxB,WAAW,EAAE,MAAM;QACnB,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,0BAA0B;QAC1B,WAAW,EAAE,KAAK;QAClB,6BAA6B,EAAE,IAAI;KACpC,CAAC,CAAC;AACL,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAiC,EAAE;IAEnC,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAmB,CAAC;IAEvE,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,SAAS,GAAG,MAAM,mCAAmC,EAAE,CAAC;IAC9D,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpD,OAAQ,MAAM,EAAE,QAAqC,IAAI,IAAI,CAAC;AAChE,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAyB;IAEzB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAiB;QACxB,EAAE;QACF,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,KAAK,IAAI,IAAI;QACpB,UAAU,EAAE,SAAS;KACtB,CAAC;IACF,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAU,EACV,IAAyB;IAEzB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjC,wDAAwD;QACxD,qEAAqE;QACrE,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,IAAI,cAAc,CACtB,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,OAAO,GAA4B;QACvC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACtD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAC3E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACtD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACxE,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAQ,IAAI,CAAC,CAAC,CAAkB,IAAI,IAAI,CAAC;AAC3C,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAU,EACV,IAAgC;IAEhC,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IAEnB,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,UAAU,GAAI,IAAI,CAAC,CAAC,CAAkB,CAAC,OAAO,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;SACjE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAQ,IAAI,CAAC,CAAC,CAAkB,IAAI,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAU;IAC9C,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE,yCAAyC;QAC9C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACzE,MAAM,2BAA2B,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC;IAGvD,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC;SACnD,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU;IAC5C,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEzD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE;;oDAE2C;QAChD,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAU;IAC9C,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEzD,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE,0EAA0E;QAC/E,IAAI,EAAE,CAAC,EAAE,EAAE,SAAS,CAAC;KACtB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { eq } from \"drizzle-orm\";\nimport { getDbExec, isPostgres, retryOnDdlRace } from \"../db/client.js\";\nimport { createGetDb } from \"../db/create-get-db.js\";\nimport {\n  accessFilter,\n  assertAccess,\n  resolveAccess,\n  ForbiddenError,\n} from \"../sharing/access.js\";\nimport {\n  getRequestUserEmail,\n  getRequestOrgId,\n} from \"../server/request-context.js\";\nimport { registerShareableResource } from \"../sharing/registry.js\";\nimport {\n  extensions,\n  extensionHides,\n  extensionShares,\n  EXTENSIONS_CREATE_SQL,\n  EXTENSIONS_CREATE_SQL_PG,\n  EXTENSION_SHARES_CREATE_SQL,\n  EXTENSION_SHARES_CREATE_SQL_PG,\n  EXTENSION_DATA_CREATE_SQL,\n  EXTENSION_DATA_CREATE_SQL_PG,\n  EXTENSION_DATA_ITEM_INDEX_SQL,\n  EXTENSION_DATA_ITEM_INDEX_SQL_PG,\n  EXTENSION_DATA_DROP_OLD_INDEX_SQL,\n  EXTENSION_DATA_DROP_OLD_INDEX_SQL_PG,\n  EXTENSIONS_OWNER_INDEX_SQL,\n  EXTENSIONS_ORG_INDEX_SQL,\n  EXTENSION_SHARES_RESOURCE_INDEX_SQL,\n  EXTENSION_HIDES_CREATE_SQL,\n  EXTENSION_HIDES_CREATE_SQL_PG,\n  EXTENSION_HIDES_UNIQUE_INDEX_SQL,\n  EXTENSION_HIDES_OWNER_INDEX_SQL,\n  EXTENSION_CONSENTS_CREATE_SQL,\n  EXTENSION_CONSENTS_CREATE_SQL_PG,\n  EXTENSION_CONSENTS_VIEWER_INDEX_SQL,\n} from \"./schema.js\";\n\nconst getDb = createGetDb({ extensions, extensionShares, extensionHides });\n\nlet _initPromise: Promise<void> | undefined;\n\nexport async function ensureExtensionsTables(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const pg = isPostgres();\n      await retryOnDdlRace(() =>\n        client.execute(pg ? EXTENSIONS_CREATE_SQL_PG : EXTENSIONS_CREATE_SQL),\n      );\n      await migrateMisnamedExtensionsTable(client, pg);\n      await retryOnDdlRace(() =>\n        client.execute(\n          pg ? EXTENSION_SHARES_CREATE_SQL_PG : EXTENSION_SHARES_CREATE_SQL,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          pg ? EXTENSION_DATA_CREATE_SQL_PG : EXTENSION_DATA_CREATE_SQL,\n        ),\n      );\n      await ensureExtensionDataItemId(client, pg);\n      await ensureExtensionDataScope(client, pg);\n      await client.execute(\n        pg\n          ? EXTENSION_DATA_DROP_OLD_INDEX_SQL_PG\n          : EXTENSION_DATA_DROP_OLD_INDEX_SQL,\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          pg ? EXTENSION_DATA_ITEM_INDEX_SQL_PG : EXTENSION_DATA_ITEM_INDEX_SQL,\n        ),\n      );\n      await retryOnDdlRace(() => client.execute(EXTENSIONS_OWNER_INDEX_SQL));\n      await retryOnDdlRace(() => client.execute(EXTENSIONS_ORG_INDEX_SQL));\n      await retryOnDdlRace(() =>\n        client.execute(EXTENSION_SHARES_RESOURCE_INDEX_SQL),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          pg ? EXTENSION_HIDES_CREATE_SQL_PG : EXTENSION_HIDES_CREATE_SQL,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(EXTENSION_HIDES_UNIQUE_INDEX_SQL),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(EXTENSION_HIDES_OWNER_INDEX_SQL),\n      );\n      // tool_consents was introduced for an audit-C1 per-viewer consent\n      // gate that we removed once we settled on intra-org trust as the\n      // baseline. The table is kept (additive — never drop) so deploys\n      // that already created it stay healthy; the runtime consent code\n      // is gone. Idempotent CREATE IF NOT EXISTS for fresh schemas.\n      await retryOnDdlRace(() =>\n        client.execute(\n          pg ? EXTENSION_CONSENTS_CREATE_SQL_PG : EXTENSION_CONSENTS_CREATE_SQL,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(EXTENSION_CONSENTS_VIEWER_INDEX_SQL),\n      );\n    })();\n  }\n\n  try {\n    await _initPromise;\n  } catch (err) {\n    _initPromise = undefined;\n    throw err;\n  }\n}\n\nasync function migrateMisnamedExtensionsTable(\n  client: ReturnType<typeof getDbExec>,\n  pg: boolean,\n): Promise<void> {\n  const sql = pg\n    ? `INSERT INTO tools (id, name, description, content, icon, created_at, updated_at, owner_email, org_id, visibility)\n       SELECT id, name, description, content, icon, created_at, updated_at, owner_email, org_id, visibility\n       FROM extensions\n       ON CONFLICT (id) DO NOTHING`\n    : `INSERT OR IGNORE INTO tools (id, name, description, content, icon, created_at, updated_at, owner_email, org_id, visibility)\n       SELECT id, name, description, content, icon, created_at, updated_at, owner_email, org_id, visibility\n       FROM extensions`;\n\n  try {\n    await client.execute(sql);\n  } catch (err: any) {\n    const message = String(err?.message ?? err).toLowerCase();\n    if (\n      message.includes(\"no such table: extensions\") ||\n      message.includes('relation \"extensions\" does not exist') ||\n      message.includes(\"relation extensions does not exist\")\n    ) {\n      return;\n    }\n    throw err;\n  }\n}\n\nasync function ensureExtensionDataItemId(\n  client: ReturnType<typeof getDbExec>,\n  pg: boolean,\n): Promise<void> {\n  if (pg) {\n    await client.execute(\n      `ALTER TABLE tool_data ADD COLUMN IF NOT EXISTS item_id TEXT`,\n    );\n    return;\n  }\n\n  // Keep this additive: legacy rows with item_id=id are still read correctly\n  // through COALESCE(item_id, id), so SQLite never needs a table rebuild here.\n  try {\n    await client.execute(`ALTER TABLE tool_data ADD COLUMN item_id TEXT`);\n  } catch (err: any) {\n    if (\n      !String(err?.message ?? err)\n        .toLowerCase()\n        .includes(\"duplicate\")\n    ) {\n      throw err;\n    }\n  }\n}\n\nasync function ensureExtensionDataScope(\n  client: ReturnType<typeof getDbExec>,\n  pg: boolean,\n): Promise<void> {\n  const addCol = (name: string, def: string) => {\n    if (pg) {\n      return client.execute(\n        `ALTER TABLE tool_data ADD COLUMN IF NOT EXISTS ${name} ${def}`,\n      );\n    }\n    return client\n      .execute(`ALTER TABLE tool_data ADD COLUMN ${name} ${def}`)\n      .catch((err: any) => {\n        if (\n          !String(err?.message ?? err)\n            .toLowerCase()\n            .includes(\"duplicate\")\n        )\n          throw err;\n      });\n  };\n  await addCol(\"scope\", \"TEXT NOT NULL DEFAULT 'user'\");\n  await addCol(\"org_id\", \"TEXT\");\n  await addCol(\"scope_key\", \"TEXT NOT NULL DEFAULT 'local@localhost'\");\n  // One-time backfill migration: replaces the dev-mode DEFAULT scope_key\n  // with each row's real owner_email. Not a per-request fallback.\n  await client.execute(\n    // guard:allow-localhost-fallback — one-time backfill migration replacing dev-mode default scope_key with the row's real owner_email\n    `UPDATE tool_data SET scope_key = owner_email WHERE scope_key = 'local@localhost' AND owner_email != 'local@localhost'`,\n  );\n}\n\nexport function registerExtensionsShareable() {\n  registerShareableResource({\n    type: \"extension\",\n    resourceTable: extensions,\n    sharesTable: extensionShares,\n    displayName: \"Extension\",\n    titleColumn: \"name\",\n    getDb: () => getDb(),\n    // Extension HTML executes inside an iframe and calls actions / SQL / the\n    // secrets-injecting proxy as the *viewer*. A public extension would let a\n    // random authenticated user run code with the viewer's credentials — and\n    // a malicious shared extension could re-share itself wider. Lock both:\n    // no public visibility, and individual user shares must already be (or\n    // be invited to) the org.\n    allowPublic: false,\n    requireOrgMemberForUserShares: true,\n  });\n}\n\nexport interface ExtensionRow {\n  id: string;\n  name: string;\n  description: string;\n  content: string;\n  icon: string | null;\n  createdAt: string;\n  updatedAt: string;\n  ownerEmail: string;\n  orgId: string | null;\n  visibility: \"private\" | \"org\" | \"public\";\n}\n\nexport interface ListExtensionsOptions {\n  includeHidden?: boolean;\n}\n\nexport async function listExtensions(\n  options: ListExtensionsOptions = {},\n): Promise<ExtensionRow[]> {\n  await ensureExtensionsTables();\n  const db = getDb();\n  const rows = (await db\n    .select()\n    .from(extensions)\n    .where(accessFilter(extensions, extensionShares))) as ExtensionRow[];\n\n  if (options.includeHidden) return rows;\n\n  const hiddenIds = await getHiddenExtensionIdsForCurrentUser();\n  if (hiddenIds.size === 0) return rows;\n  return rows.filter((row) => !hiddenIds.has(row.id));\n}\n\nexport async function getExtension(id: string): Promise<ExtensionRow | null> {\n  await ensureExtensionsTables();\n  const access = await resolveAccess(\"extension\", id);\n  return (access?.resource as ExtensionRow | undefined) ?? null;\n}\n\nexport interface CreateExtensionData {\n  name: string;\n  description?: string;\n  content?: string;\n  icon?: string;\n}\n\nexport async function createExtension(\n  data: CreateExtensionData,\n): Promise<ExtensionRow> {\n  await ensureExtensionsTables();\n  const db = getDb();\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n  const orgId = getRequestOrgId();\n  const id = randomUUID();\n  const now = new Date().toISOString();\n  const row: ExtensionRow = {\n    id,\n    name: data.name,\n    description: data.description ?? \"\",\n    content: data.content ?? \"\",\n    icon: data.icon ?? null,\n    createdAt: now,\n    updatedAt: now,\n    ownerEmail: userEmail,\n    orgId: orgId ?? null,\n    visibility: \"private\",\n  };\n  await db.insert(extensions).values(row);\n  return row;\n}\n\nexport interface UpdateExtensionData {\n  name?: string;\n  description?: string;\n  icon?: string;\n  /**\n   * Extensions cannot be public — `set-resource-visibility` and this store\n   * helper both reject `\"public\"`. The type lists it so the framework's\n   * generic share UI compiles, not because it's allowed at runtime.\n   */\n  visibility?: \"private\" | \"org\" | \"public\";\n}\n\nexport async function updateExtension(\n  id: string,\n  data: UpdateExtensionData,\n): Promise<ExtensionRow | null> {\n  await ensureExtensionsTables();\n  await assertAccess(\"extension\", id, \"editor\");\n  if (data.visibility === \"public\") {\n    // Defense in depth — `registerExtensionsShareable` sets\n    // `allowPublic: false`, so `set-resource-visibility` already rejects\n    // this. Block direct callers too (HTTP `PUT /extensions/:id`, internal\n    // refactors) so the rule holds regardless of entry point.\n    throw new ForbiddenError(\n      \"Extensions cannot be made public — share with specific people or your organization instead.\",\n    );\n  }\n  const db = getDb();\n  const updates: Record<string, unknown> = {\n    updatedAt: new Date().toISOString(),\n  };\n  if (data.name !== undefined) updates.name = data.name;\n  if (data.description !== undefined) updates.description = data.description;\n  if (data.icon !== undefined) updates.icon = data.icon;\n  if (data.visibility !== undefined) updates.visibility = data.visibility;\n  await db.update(extensions).set(updates).where(eq(extensions.id, id));\n  const rows = await db.select().from(extensions).where(eq(extensions.id, id));\n  return (rows[0] as ExtensionRow) ?? null;\n}\n\nexport interface UpdateExtensionContentOpts {\n  content?: string;\n  patches?: Array<{ find: string; replace: string }>;\n}\n\nexport async function updateExtensionContent(\n  id: string,\n  opts: UpdateExtensionContentOpts,\n): Promise<ExtensionRow | null> {\n  await ensureExtensionsTables();\n  await assertAccess(\"extension\", id, \"editor\");\n  const db = getDb();\n\n  let newContent: string;\n  if (opts.content !== undefined) {\n    newContent = opts.content;\n  } else if (opts.patches) {\n    const rows = await db\n      .select()\n      .from(extensions)\n      .where(eq(extensions.id, id));\n    if (!rows[0]) return null;\n    newContent = (rows[0] as ExtensionRow).content;\n    for (const patch of opts.patches) {\n      newContent = newContent.replace(patch.find, patch.replace);\n    }\n  } else {\n    return null;\n  }\n\n  await db\n    .update(extensions)\n    .set({ content: newContent, updatedAt: new Date().toISOString() })\n    .where(eq(extensions.id, id));\n  const rows = await db.select().from(extensions).where(eq(extensions.id, id));\n  return (rows[0] as ExtensionRow) ?? null;\n}\n\nexport async function deleteExtension(id: string): Promise<boolean> {\n  await ensureExtensionsTables();\n  await assertAccess(\"extension\", id, \"admin\");\n  const db = getDb();\n  const rows = await db.select().from(extensions).where(eq(extensions.id, id));\n  if (!rows[0]) return false;\n  await db.delete(extensionShares).where(eq(extensionShares.resourceId, id));\n  await db.delete(extensionHides).where(eq(extensionHides.extensionId, id));\n  await getDbExec().execute({\n    sql: `DELETE FROM tool_data WHERE tool_id = ?`,\n    args: [id],\n  });\n  const { cascadeDeleteExtensionSlots } = await import(\"./slots/store.js\");\n  await cascadeDeleteExtensionSlots(id);\n  await db.delete(extensions).where(eq(extensions.id, id));\n  return true;\n}\n\nexport async function getHiddenExtensionIdsForCurrentUser(): Promise<\n  Set<string>\n> {\n  await ensureExtensionsTables();\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) return new Set();\n\n  const db = getDb();\n  const rows = await db\n    .select({ extensionId: extensionHides.extensionId })\n    .from(extensionHides)\n    .where(eq(extensionHides.ownerEmail, userEmail));\n  return new Set(rows.map((row) => row.extensionId));\n}\n\nexport async function hideExtension(id: string): Promise<boolean> {\n  await ensureExtensionsTables();\n  await assertAccess(\"extension\", id, \"viewer\");\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n\n  const now = new Date().toISOString();\n  await getDbExec().execute({\n    sql: `INSERT INTO tool_hidden_extensions (id, tool_id, owner_email, created_at)\n      VALUES (?, ?, ?, ?)\n      ON CONFLICT (owner_email, tool_id) DO NOTHING`,\n    args: [randomUUID(), id, userEmail, now],\n  });\n  return true;\n}\n\nexport async function unhideExtension(id: string): Promise<boolean> {\n  await ensureExtensionsTables();\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n\n  await getDbExec().execute({\n    sql: `DELETE FROM tool_hidden_extensions WHERE tool_id = ? AND owner_email = ?`,\n    args: [id, userEmail],\n  });\n  return true;\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/extensions/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EACL,UAAU,EACV,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,4BAA4B,EAC5B,6BAA6B,EAC7B,gCAAgC,EAChC,iCAAiC,EACjC,oCAAoC,EACpC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,mCAAmC,EACnC,0BAA0B,EAC1B,6BAA6B,EAC7B,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,GAE3B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC;AAE3E,IAAI,YAAuC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CACtE,CAAC;YACF,MAAM,8BAA8B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACjD,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,EAAE,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,2BAA2B,CAClE,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,yBAAyB,CAC9D,CACF,CAAC;YACF,MAAM,yBAAyB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5C,MAAM,wBAAwB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,MAAM,CAAC,OAAO,CAClB,EAAE;gBACA,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,iCAAiC,CACtC,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,EAAE,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,6BAA6B,CACtE,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACvE,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC;YACrE,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC;YACzE,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC,CACpD,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,0BAA0B,CAChE,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,gCAAgC,CAAC,CACjD,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAChD,CAAC;YACF,kEAAkE;YAClE,iEAAiE;YACjE,iEAAiE;YACjE,iEAAiE;YACjE,8DAA8D;YAC9D,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,EAAE,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,6BAA6B,CACtE,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,GAAG,SAAS,CAAC;QACzB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,MAAoC,EACpC,EAAW;IAEX,MAAM,GAAG,GAAG,EAAE;QACZ,CAAC,CAAC;;;mCAG6B;QAC/B,CAAC,CAAC;;uBAEiB,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,IACE,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YAC7C,OAAO,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YACxD,OAAO,CAAC,QAAQ,CAAC,oCAAoC,CAAC,EACtD,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,MAAoC,EACpC,EAAW;IAEX,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,MAAM,CAAC,OAAO,CAClB,6DAA6D,CAC9D,CAAC;QACF,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IACE,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC;aACzB,WAAW,EAAE;aACb,QAAQ,CAAC,WAAW,CAAC,EACxB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAoC,EACpC,EAAW;IAEX,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE;QAC3C,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,MAAM,CAAC,OAAO,CACnB,kDAAkD,IAAI,IAAI,GAAG,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM;aACV,OAAO,CAAC,oCAAoC,IAAI,IAAI,GAAG,EAAE,CAAC;aAC1D,KAAK,CAAC,CAAC,GAAQ,EAAE,EAAE;YAClB,IACE,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC;iBACzB,WAAW,EAAE;iBACb,QAAQ,CAAC,WAAW,CAAC;gBAExB,MAAM,GAAG,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACtD,MAAM,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,MAAM,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;IACrE,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,MAAM,CAAC,OAAO;IAClB,oIAAoI;IACpI,uHAAuH,CACxH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,yBAAyB,CAAC;QACxB,IAAI,EAAE,WAAW;QACjB,aAAa,EAAE,UAAU;QACzB,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE,WAAW;QACxB,WAAW,EAAE,MAAM;QACnB,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,0BAA0B;QAC1B,WAAW,EAAE,KAAK;QAClB,6BAA6B,EAAE,IAAI;KACpC,CAAC,CAAC;AACL,CAAC;AAeD,SAAS,SAAS,CAAC,MAA6B;IAC9C,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,SAAS,MAAM,CAAC,KAAK,EAAE,CAAC;IACjD,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA2C,EAC3C,MAA6B;IAE7B,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,GAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,wBAAwB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,UAAU,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC1C,wBAAwB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE;SACrB,MAAM,CAAC;QACN,aAAa,EAAE,eAAe,CAAC,aAAa;QAC5C,WAAW,EAAE,eAAe,CAAC,WAAW;KACzC,CAAC;SACD,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAG9C,CAAC;IAEH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACnC,wBAAwB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;YACzC,wBAAwB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,EAAU;IAEV,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA6B,CAAC;IAChD,OAAO,GAAG,CAAC,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAU;IAEV,MAAM,sBAAsB,EAAE,CAAC;IAC/B,OAAO,2BAA2B,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,4BAA4B,CACnC,OAAgC;IAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,OAAgC;IAEhC,MAAM,aAAa,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEvC,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,YAAY,CAAC;YACX,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,GAAG;YACR,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,WAAW,CACf,SAAS,EACT,2BAA2B,EAC3B,0BAA0B,CAAC,MAAM,CAAC,CACnC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,EAAU,EACV,gBAAyC,EAAE;IAE3C,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,sBAAsB,CAAC;QAC3B,GAAG,aAAa;QAChB,GAAG,CAAC,MAAM,2BAA2B,CAAC,EAAE,CAAC,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAiC,EAAE;IAEnC,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAmB,CAAC;IAEvE,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,SAAS,GAAG,MAAM,mCAAmC,EAAE,CAAC;IAC9D,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpD,OAAQ,MAAM,EAAE,QAAqC,IAAI,IAAI,CAAC;AAChE,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAyB;IAEzB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAiB;QACxB,EAAE;QACF,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,KAAK,IAAI,IAAI;QACpB,UAAU,EAAE,SAAS;KACtB,CAAC;IACF,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,sBAAsB,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAU,EACV,IAAyB;IAEzB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjC,wDAAwD;QACxD,qEAAqE;QACrE,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,IAAI,cAAc,CACtB,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,aAAa,GAAG,MAAM,2BAA2B,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAA4B;QACvC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACtD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAC3E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACtD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACxE,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAI,IAAI,CAAC,CAAC,CAAkB,IAAI,IAAI,CAAC;IAC9C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,sBAAsB,CAAC;YAC3B,GAAG,aAAa;YAChB,GAAG,CAAC,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAU,EACV,IAAgC;IAEhC,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IAEnB,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,UAAU,GAAI,IAAI,CAAC,CAAC,CAAkB,CAAC,OAAO,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,2BAA2B,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE;SACL,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;SACjE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAI,IAAI,CAAC,CAAC,CAAkB,IAAI,IAAI,CAAC;IAC9C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,sBAAsB,CAAC;YAC3B,GAAG,aAAa;YAChB,GAAG,CAAC,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAU;IAC9C,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA6B,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE,yCAAyC;QAC9C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACzE,MAAM,2BAA2B,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC;IAGvD,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC;SACnD,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU;IAC5C,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEzD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE;;oDAE2C;QAChD,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;IACH,MAAM,sBAAsB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAU;IAC9C,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEzD,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE,0EAA0E;QAC/E,IAAI,EAAE,CAAC,EAAE,EAAE,SAAS,CAAC;KACtB,CAAC,CAAC;IACH,MAAM,sBAAsB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { eq } from \"drizzle-orm\";\nimport { appStatePut } from \"../application-state/store.js\";\nimport { getDbExec, isPostgres, retryOnDdlRace } from \"../db/client.js\";\nimport { createGetDb } from \"../db/create-get-db.js\";\nimport { recordChange } from \"../server/poll.js\";\nimport {\n  accessFilter,\n  assertAccess,\n  resolveAccess,\n  ForbiddenError,\n} from \"../sharing/access.js\";\nimport {\n  getRequestUserEmail,\n  getRequestOrgId,\n} from \"../server/request-context.js\";\nimport { registerShareableResource } from \"../sharing/registry.js\";\nimport {\n  extensions,\n  extensionHides,\n  extensionShares,\n  EXTENSIONS_CREATE_SQL,\n  EXTENSIONS_CREATE_SQL_PG,\n  EXTENSION_SHARES_CREATE_SQL,\n  EXTENSION_SHARES_CREATE_SQL_PG,\n  EXTENSION_DATA_CREATE_SQL,\n  EXTENSION_DATA_CREATE_SQL_PG,\n  EXTENSION_DATA_ITEM_INDEX_SQL,\n  EXTENSION_DATA_ITEM_INDEX_SQL_PG,\n  EXTENSION_DATA_DROP_OLD_INDEX_SQL,\n  EXTENSION_DATA_DROP_OLD_INDEX_SQL_PG,\n  EXTENSIONS_OWNER_INDEX_SQL,\n  EXTENSIONS_ORG_INDEX_SQL,\n  EXTENSIONS_UPDATED_INDEX_SQL,\n  EXTENSION_SHARES_RESOURCE_INDEX_SQL,\n  EXTENSION_HIDES_CREATE_SQL,\n  EXTENSION_HIDES_CREATE_SQL_PG,\n  EXTENSION_HIDES_UNIQUE_INDEX_SQL,\n  EXTENSION_HIDES_OWNER_INDEX_SQL,\n  EXTENSION_CONSENTS_CREATE_SQL,\n  EXTENSION_CONSENTS_CREATE_SQL_PG,\n  EXTENSION_CONSENTS_VIEWER_INDEX_SQL,\n} from \"./schema.js\";\nimport {\n  EXTENSION_CHANGE_MARKER_KEY,\n  extensionChangeMarkerSession,\n  extensionChangeMarkerValue,\n  type ExtensionChangeTarget,\n} from \"./change-marker.js\";\n\nconst getDb = createGetDb({ extensions, extensionShares, extensionHides });\n\nlet _initPromise: Promise<void> | undefined;\n\nexport async function ensureExtensionsTables(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const pg = isPostgres();\n      await retryOnDdlRace(() =>\n        client.execute(pg ? EXTENSIONS_CREATE_SQL_PG : EXTENSIONS_CREATE_SQL),\n      );\n      await migrateMisnamedExtensionsTable(client, pg);\n      await retryOnDdlRace(() =>\n        client.execute(\n          pg ? EXTENSION_SHARES_CREATE_SQL_PG : EXTENSION_SHARES_CREATE_SQL,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          pg ? EXTENSION_DATA_CREATE_SQL_PG : EXTENSION_DATA_CREATE_SQL,\n        ),\n      );\n      await ensureExtensionDataItemId(client, pg);\n      await ensureExtensionDataScope(client, pg);\n      await client.execute(\n        pg\n          ? EXTENSION_DATA_DROP_OLD_INDEX_SQL_PG\n          : EXTENSION_DATA_DROP_OLD_INDEX_SQL,\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          pg ? EXTENSION_DATA_ITEM_INDEX_SQL_PG : EXTENSION_DATA_ITEM_INDEX_SQL,\n        ),\n      );\n      await retryOnDdlRace(() => client.execute(EXTENSIONS_OWNER_INDEX_SQL));\n      await retryOnDdlRace(() => client.execute(EXTENSIONS_ORG_INDEX_SQL));\n      await retryOnDdlRace(() => client.execute(EXTENSIONS_UPDATED_INDEX_SQL));\n      await retryOnDdlRace(() =>\n        client.execute(EXTENSION_SHARES_RESOURCE_INDEX_SQL),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          pg ? EXTENSION_HIDES_CREATE_SQL_PG : EXTENSION_HIDES_CREATE_SQL,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(EXTENSION_HIDES_UNIQUE_INDEX_SQL),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(EXTENSION_HIDES_OWNER_INDEX_SQL),\n      );\n      // tool_consents was introduced for an audit-C1 per-viewer consent\n      // gate that we removed once we settled on intra-org trust as the\n      // baseline. The table is kept (additive — never drop) so deploys\n      // that already created it stay healthy; the runtime consent code\n      // is gone. Idempotent CREATE IF NOT EXISTS for fresh schemas.\n      await retryOnDdlRace(() =>\n        client.execute(\n          pg ? EXTENSION_CONSENTS_CREATE_SQL_PG : EXTENSION_CONSENTS_CREATE_SQL,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(EXTENSION_CONSENTS_VIEWER_INDEX_SQL),\n      );\n    })();\n  }\n\n  try {\n    await _initPromise;\n  } catch (err) {\n    _initPromise = undefined;\n    throw err;\n  }\n}\n\nasync function migrateMisnamedExtensionsTable(\n  client: ReturnType<typeof getDbExec>,\n  pg: boolean,\n): Promise<void> {\n  const sql = pg\n    ? `INSERT INTO tools (id, name, description, content, icon, created_at, updated_at, owner_email, org_id, visibility)\n       SELECT id, name, description, content, icon, created_at, updated_at, owner_email, org_id, visibility\n       FROM extensions\n       ON CONFLICT (id) DO NOTHING`\n    : `INSERT OR IGNORE INTO tools (id, name, description, content, icon, created_at, updated_at, owner_email, org_id, visibility)\n       SELECT id, name, description, content, icon, created_at, updated_at, owner_email, org_id, visibility\n       FROM extensions`;\n\n  try {\n    await client.execute(sql);\n  } catch (err: any) {\n    const message = String(err?.message ?? err).toLowerCase();\n    if (\n      message.includes(\"no such table: extensions\") ||\n      message.includes('relation \"extensions\" does not exist') ||\n      message.includes(\"relation extensions does not exist\")\n    ) {\n      return;\n    }\n    throw err;\n  }\n}\n\nasync function ensureExtensionDataItemId(\n  client: ReturnType<typeof getDbExec>,\n  pg: boolean,\n): Promise<void> {\n  if (pg) {\n    await client.execute(\n      `ALTER TABLE tool_data ADD COLUMN IF NOT EXISTS item_id TEXT`,\n    );\n    return;\n  }\n\n  // Keep this additive: legacy rows with item_id=id are still read correctly\n  // through COALESCE(item_id, id), so SQLite never needs a table rebuild here.\n  try {\n    await client.execute(`ALTER TABLE tool_data ADD COLUMN item_id TEXT`);\n  } catch (err: any) {\n    if (\n      !String(err?.message ?? err)\n        .toLowerCase()\n        .includes(\"duplicate\")\n    ) {\n      throw err;\n    }\n  }\n}\n\nasync function ensureExtensionDataScope(\n  client: ReturnType<typeof getDbExec>,\n  pg: boolean,\n): Promise<void> {\n  const addCol = (name: string, def: string) => {\n    if (pg) {\n      return client.execute(\n        `ALTER TABLE tool_data ADD COLUMN IF NOT EXISTS ${name} ${def}`,\n      );\n    }\n    return client\n      .execute(`ALTER TABLE tool_data ADD COLUMN ${name} ${def}`)\n      .catch((err: any) => {\n        if (\n          !String(err?.message ?? err)\n            .toLowerCase()\n            .includes(\"duplicate\")\n        )\n          throw err;\n      });\n  };\n  await addCol(\"scope\", \"TEXT NOT NULL DEFAULT 'user'\");\n  await addCol(\"org_id\", \"TEXT\");\n  await addCol(\"scope_key\", \"TEXT NOT NULL DEFAULT 'local@localhost'\");\n  // One-time backfill migration: replaces the dev-mode DEFAULT scope_key\n  // with each row's real owner_email. Not a per-request fallback.\n  await client.execute(\n    // guard:allow-localhost-fallback — one-time backfill migration replacing dev-mode default scope_key with the row's real owner_email\n    `UPDATE tool_data SET scope_key = owner_email WHERE scope_key = 'local@localhost' AND owner_email != 'local@localhost'`,\n  );\n}\n\nexport function registerExtensionsShareable() {\n  registerShareableResource({\n    type: \"extension\",\n    resourceTable: extensions,\n    sharesTable: extensionShares,\n    displayName: \"Extension\",\n    titleColumn: \"name\",\n    getDb: () => getDb(),\n    // Extension HTML executes inside an iframe and calls actions / SQL / the\n    // secrets-injecting proxy as the *viewer*. A public extension would let a\n    // random authenticated user run code with the viewer's credentials — and\n    // a malicious shared extension could re-share itself wider. Lock both:\n    // no public visibility, and individual user shares must already be (or\n    // be invited to) the org.\n    allowPublic: false,\n    requireOrgMemberForUserShares: true,\n  });\n}\n\nexport interface ExtensionRow {\n  id: string;\n  name: string;\n  description: string;\n  content: string;\n  icon: string | null;\n  createdAt: string;\n  updatedAt: string;\n  ownerEmail: string;\n  orgId: string | null;\n  visibility: \"private\" | \"org\" | \"public\";\n}\n\nfunction targetKey(target: ExtensionChangeTarget): string | null {\n  if (target.owner) return `owner:${target.owner}`;\n  if (target.orgId) return `org:${target.orgId}`;\n  return null;\n}\n\nfunction addExtensionChangeTarget(\n  targets: Map<string, ExtensionChangeTarget>,\n  target: ExtensionChangeTarget,\n): void {\n  const key = targetKey(target);\n  if (key) targets.set(key, target);\n}\n\nasync function extensionChangeTargetsForRow(\n  row: ExtensionRow,\n): Promise<ExtensionChangeTarget[]> {\n  const targets = new Map<string, ExtensionChangeTarget>();\n  addExtensionChangeTarget(targets, { owner: row.ownerEmail });\n  if (row.visibility === \"org\" && row.orgId) {\n    addExtensionChangeTarget(targets, { orgId: row.orgId });\n  }\n\n  const db = getDb();\n  const shares = (await db\n    .select({\n      principalType: extensionShares.principalType,\n      principalId: extensionShares.principalId,\n    })\n    .from(extensionShares)\n    .where(eq(extensionShares.resourceId, row.id))) as Array<{\n    principalType: \"user\" | \"org\";\n    principalId: string;\n  }>;\n\n  for (const share of shares) {\n    if (share.principalType === \"user\") {\n      addExtensionChangeTarget(targets, { owner: share.principalId });\n    } else if (share.principalType === \"org\") {\n      addExtensionChangeTarget(targets, { orgId: share.principalId });\n    }\n  }\n\n  return Array.from(targets.values());\n}\n\nasync function extensionChangeTargetsForId(\n  id: string,\n): Promise<ExtensionChangeTarget[]> {\n  const db = getDb();\n  const rows = await db.select().from(extensions).where(eq(extensions.id, id));\n  const row = rows[0] as ExtensionRow | undefined;\n  return row ? extensionChangeTargetsForRow(row) : [];\n}\n\nexport async function getExtensionChangeTargets(\n  id: string,\n): Promise<ExtensionChangeTarget[]> {\n  await ensureExtensionsTables();\n  return extensionChangeTargetsForId(id);\n}\n\nfunction dedupeExtensionChangeTargets(\n  targets: ExtensionChangeTarget[],\n): ExtensionChangeTarget[] {\n  const unique = new Map<string, ExtensionChangeTarget>();\n  for (const target of targets) {\n    const key = targetKey(target);\n    if (key) unique.set(key, target);\n  }\n  return Array.from(unique.values());\n}\n\nasync function notifyExtensionChanged(\n  targets: ExtensionChangeTarget[],\n): Promise<void> {\n  const uniqueTargets = dedupeExtensionChangeTargets(targets);\n  if (uniqueTargets.length === 0) return;\n\n  for (const target of uniqueTargets) {\n    recordChange({\n      source: \"extensions\",\n      type: \"change\",\n      key: \"*\",\n      ...(target.owner ? { owner: target.owner } : {}),\n      ...(target.orgId ? { orgId: target.orgId } : {}),\n    });\n  }\n\n  await Promise.all(\n    uniqueTargets.map(async (target) => {\n      const sessionId = extensionChangeMarkerSession(target);\n      if (!sessionId) return;\n      await appStatePut(\n        sessionId,\n        EXTENSION_CHANGE_MARKER_KEY,\n        extensionChangeMarkerValue(target),\n      );\n    }),\n  );\n}\n\nexport async function notifyExtensionChangeForResource(\n  id: string,\n  beforeTargets: ExtensionChangeTarget[] = [],\n): Promise<void> {\n  await ensureExtensionsTables();\n  await notifyExtensionChanged([\n    ...beforeTargets,\n    ...(await extensionChangeTargetsForId(id)),\n  ]);\n}\n\nexport interface ListExtensionsOptions {\n  includeHidden?: boolean;\n}\n\nexport async function listExtensions(\n  options: ListExtensionsOptions = {},\n): Promise<ExtensionRow[]> {\n  await ensureExtensionsTables();\n  const db = getDb();\n  const rows = (await db\n    .select()\n    .from(extensions)\n    .where(accessFilter(extensions, extensionShares))) as ExtensionRow[];\n\n  if (options.includeHidden) return rows;\n\n  const hiddenIds = await getHiddenExtensionIdsForCurrentUser();\n  if (hiddenIds.size === 0) return rows;\n  return rows.filter((row) => !hiddenIds.has(row.id));\n}\n\nexport async function getExtension(id: string): Promise<ExtensionRow | null> {\n  await ensureExtensionsTables();\n  const access = await resolveAccess(\"extension\", id);\n  return (access?.resource as ExtensionRow | undefined) ?? null;\n}\n\nexport interface CreateExtensionData {\n  name: string;\n  description?: string;\n  content?: string;\n  icon?: string;\n}\n\nexport async function createExtension(\n  data: CreateExtensionData,\n): Promise<ExtensionRow> {\n  await ensureExtensionsTables();\n  const db = getDb();\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n  const orgId = getRequestOrgId();\n  const id = randomUUID();\n  const now = new Date().toISOString();\n  const row: ExtensionRow = {\n    id,\n    name: data.name,\n    description: data.description ?? \"\",\n    content: data.content ?? \"\",\n    icon: data.icon ?? null,\n    createdAt: now,\n    updatedAt: now,\n    ownerEmail: userEmail,\n    orgId: orgId ?? null,\n    visibility: \"private\",\n  };\n  await db.insert(extensions).values(row);\n  await notifyExtensionChanged([{ owner: row.ownerEmail }]);\n  return row;\n}\n\nexport interface UpdateExtensionData {\n  name?: string;\n  description?: string;\n  icon?: string;\n  /**\n   * Extensions cannot be public — `set-resource-visibility` and this store\n   * helper both reject `\"public\"`. The type lists it so the framework's\n   * generic share UI compiles, not because it's allowed at runtime.\n   */\n  visibility?: \"private\" | \"org\" | \"public\";\n}\n\nexport async function updateExtension(\n  id: string,\n  data: UpdateExtensionData,\n): Promise<ExtensionRow | null> {\n  await ensureExtensionsTables();\n  await assertAccess(\"extension\", id, \"editor\");\n  if (data.visibility === \"public\") {\n    // Defense in depth — `registerExtensionsShareable` sets\n    // `allowPublic: false`, so `set-resource-visibility` already rejects\n    // this. Block direct callers too (HTTP `PUT /extensions/:id`, internal\n    // refactors) so the rule holds regardless of entry point.\n    throw new ForbiddenError(\n      \"Extensions cannot be made public — share with specific people or your organization instead.\",\n    );\n  }\n  const db = getDb();\n  const beforeTargets = await extensionChangeTargetsForId(id);\n  const updates: Record<string, unknown> = {\n    updatedAt: new Date().toISOString(),\n  };\n  if (data.name !== undefined) updates.name = data.name;\n  if (data.description !== undefined) updates.description = data.description;\n  if (data.icon !== undefined) updates.icon = data.icon;\n  if (data.visibility !== undefined) updates.visibility = data.visibility;\n  await db.update(extensions).set(updates).where(eq(extensions.id, id));\n  const rows = await db.select().from(extensions).where(eq(extensions.id, id));\n  const row = (rows[0] as ExtensionRow) ?? null;\n  if (row) {\n    await notifyExtensionChanged([\n      ...beforeTargets,\n      ...(await extensionChangeTargetsForRow(row)),\n    ]);\n  }\n  return row;\n}\n\nexport interface UpdateExtensionContentOpts {\n  content?: string;\n  patches?: Array<{ find: string; replace: string }>;\n}\n\nexport async function updateExtensionContent(\n  id: string,\n  opts: UpdateExtensionContentOpts,\n): Promise<ExtensionRow | null> {\n  await ensureExtensionsTables();\n  await assertAccess(\"extension\", id, \"editor\");\n  const db = getDb();\n\n  let newContent: string;\n  if (opts.content !== undefined) {\n    newContent = opts.content;\n  } else if (opts.patches) {\n    const rows = await db\n      .select()\n      .from(extensions)\n      .where(eq(extensions.id, id));\n    if (!rows[0]) return null;\n    newContent = (rows[0] as ExtensionRow).content;\n    for (const patch of opts.patches) {\n      newContent = newContent.replace(patch.find, patch.replace);\n    }\n  } else {\n    return null;\n  }\n\n  const beforeTargets = await extensionChangeTargetsForId(id);\n  await db\n    .update(extensions)\n    .set({ content: newContent, updatedAt: new Date().toISOString() })\n    .where(eq(extensions.id, id));\n  const rows = await db.select().from(extensions).where(eq(extensions.id, id));\n  const row = (rows[0] as ExtensionRow) ?? null;\n  if (row) {\n    await notifyExtensionChanged([\n      ...beforeTargets,\n      ...(await extensionChangeTargetsForRow(row)),\n    ]);\n  }\n  return row;\n}\n\nexport async function deleteExtension(id: string): Promise<boolean> {\n  await ensureExtensionsTables();\n  await assertAccess(\"extension\", id, \"admin\");\n  const db = getDb();\n  const rows = await db.select().from(extensions).where(eq(extensions.id, id));\n  const row = rows[0] as ExtensionRow | undefined;\n  if (!row) return false;\n  const targets = await extensionChangeTargetsForRow(row);\n  await db.delete(extensionShares).where(eq(extensionShares.resourceId, id));\n  await db.delete(extensionHides).where(eq(extensionHides.extensionId, id));\n  await getDbExec().execute({\n    sql: `DELETE FROM tool_data WHERE tool_id = ?`,\n    args: [id],\n  });\n  const { cascadeDeleteExtensionSlots } = await import(\"./slots/store.js\");\n  await cascadeDeleteExtensionSlots(id);\n  await db.delete(extensions).where(eq(extensions.id, id));\n  await notifyExtensionChanged(targets);\n  return true;\n}\n\nexport async function getHiddenExtensionIdsForCurrentUser(): Promise<\n  Set<string>\n> {\n  await ensureExtensionsTables();\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) return new Set();\n\n  const db = getDb();\n  const rows = await db\n    .select({ extensionId: extensionHides.extensionId })\n    .from(extensionHides)\n    .where(eq(extensionHides.ownerEmail, userEmail));\n  return new Set(rows.map((row) => row.extensionId));\n}\n\nexport async function hideExtension(id: string): Promise<boolean> {\n  await ensureExtensionsTables();\n  await assertAccess(\"extension\", id, \"viewer\");\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n\n  const now = new Date().toISOString();\n  await getDbExec().execute({\n    sql: `INSERT INTO tool_hidden_extensions (id, tool_id, owner_email, created_at)\n      VALUES (?, ?, ?, ?)\n      ON CONFLICT (owner_email, tool_id) DO NOTHING`,\n    args: [randomUUID(), id, userEmail, now],\n  });\n  await notifyExtensionChanged([{ owner: userEmail }]);\n  return true;\n}\n\nexport async function unhideExtension(id: string): Promise<boolean> {\n  await ensureExtensionsTables();\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n\n  await getDbExec().execute({\n    sql: `DELETE FROM tool_hidden_extensions WHERE tool_id = ? AND owner_email = ?`,\n    args: [id, userEmail],\n  });\n  await notifyExtensionChanged([{ owner: userEmail }]);\n  return true;\n}\n"]}

package/dist/index.d.ts

@@ -2,11 +2,14 @@ export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type
 export { defineAction, AgentActionStopError, isAgentActionStopError, type ActionHttpConfig, type AgentActionStopOptions, type PublicAgentActionConfig, } from "./action.js";
 export { createDevScriptRegistry } from "./scripts/dev/index.js";
 export { createAgentChatPlugin, defaultAgentChatPlugin, type AgentChatPluginOptions, } from "./server/agent-chat-plugin.js";
+export { createAgentNativeEmbeddedPlugin, mountAgentNativeEmbedded, type AgentNativeEmbeddedPluginOptions, } from "./server/embedded.js";
 export { createServer, createSSEHandler, defineNitroPlugin, autoMountAuth, getSession, type CreateServerOptions, type SSEHandlerOptions, type AuthSession, type AuthOptions, } from "./server/index.js";
-export { sendToAgentChat, useAgentChatGenerating, useDevMode, useSendToAgentChat, CodeRequiredDialog, useDbSync, useFileWatcher, cn, ApiKeySettings, useSession, useProductionAgent, ProductionAgentPanel, type AgentChatMessage, type CodeRequiredDialogProps, type ProductionAgentMessage, type UseProductionAgentResult, type ProductionAgentPanelProps, useActionQuery, useActionMutation, } from "./client/index.js";
+export { sendToAgentChat, useAgentChatGenerating, useDevMode, useSendToAgentChat, CodeRequiredDialog, useAgentNativeEmbeddedBrowserSession, useDbSync, useFileWatcher, cn, ApiKeySettings, useSession, AgentNativeEmbedded, useProductionAgent, ProductionAgentPanel, type AgentChatMessage, type AgentNativeEmbeddedProps, type UseAgentNativeEmbeddedBrowserSessionOptions, type CodeRequiredDialogProps, type ProductionAgentMessage, type UseProductionAgentResult, type ProductionAgentPanelProps, useActionQuery, useActionMutation, } from "./client/index.js";
 export { agentChat, type AgentChatCallOptions, type AgentChatResponse, } from "./shared/index.js";
 export { AGENT_WEB_CRAWLER_CATEGORIES, AGENT_WEB_CRAWLER_USER_AGENTS, DEFAULT_AGENT_WEB_CRAWLER_POLICY, absoluteUrl, agentWebConfigFromPackageJson, buildAgentWebStaticFiles, buildBaseJsonLd, buildLlmsFullTxt, buildLlmsTxt, buildMarkdownResponseHeaders, buildPageJsonLd, buildRobotsTxt, buildSitemapXml, deriveAgentWebPublicRoutes, estimateMarkdownTokens, markdownFilePathForPage, markdownUrlForPage, normalizeAgentWebConfig, pathPatternMatches, resolveAgentWebCrawlerPolicy, type AgentWebConfig, type AgentWebCrawlerCategory, type AgentWebCrawlerDecision, type AgentWebCrawlerOverrides, type AgentWebCrawlerPolicy, type AgentWebInputConfig, type AgentWebPage, type AgentWebStaticFile, type BuildAgentWebStaticFilesOptions, type DeriveAgentWebPublicRoutesOptions, type MarkdownResponseHeadersOptions, } from "./agent-web/index.js";
 export { recordUsage, getUsageSummary, getUserUsageCents, calculateCost, usageBillingForEngine, builderCreditsFromCostCents, BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER, BUILDER_AGENT_CREDITS_PER_USD, BUILDER_CREDIT_USAGE_BILLING, USD_USAGE_BILLING, type UsageRecord, type UsageSummary, type UsageBillingMode, type UsageBillingUnit, type UsageBucket, type DailyBucket, type UsageRecentEntry, } from "./usage/store.js";
+export { deleteWorkspaceConnection, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, revokeWorkspaceConnectionGrant, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, type ListWorkspaceConnectionProviderCatalogForAppOptions, type ListWorkspaceConnectionGrantsOptions, type ListWorkspaceConnectionsOptions, type SerializedWorkspaceConnectionGrant, type SerializedWorkspaceConnection, type SummarizeWorkspaceConnectionProviderForAppOptions, type SummarizeWorkspaceConnectionProviderReadinessOptions, type UpsertWorkspaceConnectionGrantInput, type UpsertWorkspaceConnectionInput, type WorkspaceConnectionAppAccess, type WorkspaceConnectionAppAccessMode, type WorkspaceConnection, type WorkspaceConnectionCredentialRef, type WorkspaceConnectionExplicitGrantSummary, type WorkspaceConnectionForAppSummary, type WorkspaceConnectionGrant, type WorkspaceConnectionGrantAvailability, type WorkspaceConnectionGrantState, type WorkspaceConnectionProviderAppSummary, type WorkspaceConnectionProviderLike, type WorkspaceConnectionProviderCatalogForApp, type WorkspaceConnectionProviderCatalogForAppItem, type WorkspaceConnectionProviderReadiness, type WorkspaceConnectionProviderReadinessStatus, type WorkspaceConnectionPublicCredentialRef, type WorkspaceConnectionStatus, workspaceConnectionIsAvailableToApp, } from "./workspace-connections/index.js";
+export { WORKSPACE_CONNECTION_PROVIDERS, defineWorkspaceConnectionProvider, getWorkspaceConnectionProvider, isWorkspaceConnectionProviderId, listWorkspaceConnectionProviders, listWorkspaceConnectionProvidersForCapability, listWorkspaceConnectionProvidersForTemplate, workspaceConnectionProviderSupports, type ListWorkspaceConnectionProvidersOptions, type WorkspaceConnectionCapability, type WorkspaceConnectionCredentialKey, type WorkspaceConnectionProvider, type WorkspaceConnectionProviderId, type WorkspaceConnectionTemplateUse, } from "./connections/index.js";
 export { runScript, loadEnv, parseArgs, camelCaseArgs, isValidPath, isValidProjectPath, ensureDir, fail, } from "./scripts/index.js";
 export { registerRequiredSecret, listRequiredSecrets, getRequiredSecret, readAppSecret, writeAppSecret, deleteAppSecret, type RegisteredSecret, type SecretScope, type SecretKind, type SecretValidator, type SecretRef, } from "./secrets/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,EAAE,EACF,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,SAAS,EACT,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,gCAAgC,EAChC,WAAW,EACX,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,4BAA4B,EAC5B,eAAe,EACf,cAAc,EACd,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,iCAAiC,EACtC,KAAK,8BAA8B,GACpC,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,2BAA2B,EAC3B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,IAAI,GACL,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,KAAK,gCAAgC,GACtC,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oCAAoC,EACpC,SAAS,EACT,cAAc,EACd,EAAE,EACF,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,2CAA2C,EAChD,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,SAAS,EACT,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,gCAAgC,EAChC,WAAW,EACX,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,4BAA4B,EAC5B,eAAe,EACf,cAAc,EACd,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,iCAAiC,EACtC,KAAK,8BAA8B,GACpC,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,2BAA2B,EAC3B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,sBAAsB,EACtB,2BAA2B,EAC3B,4CAA4C,EAC5C,6BAA6B,EAC7B,wBAAwB,EACxB,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,0CAA0C,EAC1C,6CAA6C,EAC7C,8BAA8B,EAC9B,yBAAyB,EACzB,KAAK,mDAAmD,EACxD,KAAK,oCAAoC,EACzC,KAAK,+BAA+B,EACpC,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,KAAK,iDAAiD,EACtD,KAAK,oDAAoD,EACzD,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,uCAAuC,EAC5C,KAAK,gCAAgC,EACrC,KAAK,wBAAwB,EAC7B,KAAK,oCAAoC,EACzC,KAAK,6BAA6B,EAClC,KAAK,qCAAqC,EAC1C,KAAK,+BAA+B,EACpC,KAAK,wCAAwC,EAC7C,KAAK,4CAA4C,EACjD,KAAK,oCAAoC,EACzC,KAAK,0CAA0C,EAC/C,KAAK,sCAAsC,EAC3C,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,8BAA8B,EAC9B,+BAA+B,EAC/B,gCAAgC,EAChC,6CAA6C,EAC7C,2CAA2C,EAC3C,mCAAmC,EACnC,KAAK,uCAAuC,EAC5C,KAAK,6BAA6B,EAClC,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,IAAI,GACL,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -5,16 +5,21 @@ export { createProductionAgentHandler, DEFAULT_MODEL, } from "./agent/index.js";
 export { defineAction, AgentActionStopError, isAgentActionStopError, } from "./action.js";
 export { createDevScriptRegistry } from "./scripts/dev/index.js";
 export { createAgentChatPlugin, defaultAgentChatPlugin, } from "./server/agent-chat-plugin.js";
+export { createAgentNativeEmbeddedPlugin, mountAgentNativeEmbedded, } from "./server/embedded.js";
 // Server
 export { createServer, createSSEHandler, defineNitroPlugin, autoMountAuth, getSession, } from "./server/index.js";
 // Client
-export { sendToAgentChat, useAgentChatGenerating, useDevMode, useSendToAgentChat, CodeRequiredDialog, useDbSync, useFileWatcher, cn, ApiKeySettings, useSession, useProductionAgent, ProductionAgentPanel, useActionQuery, useActionMutation, } from "./client/index.js";
+export { sendToAgentChat, useAgentChatGenerating, useDevMode, useSendToAgentChat, CodeRequiredDialog, useAgentNativeEmbeddedBrowserSession, useDbSync, useFileWatcher, cn, ApiKeySettings, useSession, AgentNativeEmbedded, useProductionAgent, ProductionAgentPanel, useActionQuery, useActionMutation, } from "./client/index.js";
 // Shared (isomorphic)
 export { agentChat, } from "./shared/index.js";
 // Agent Web surfaces
 export { AGENT_WEB_CRAWLER_CATEGORIES, AGENT_WEB_CRAWLER_USER_AGENTS, DEFAULT_AGENT_WEB_CRAWLER_POLICY, absoluteUrl, agentWebConfigFromPackageJson, buildAgentWebStaticFiles, buildBaseJsonLd, buildLlmsFullTxt, buildLlmsTxt, buildMarkdownResponseHeaders, buildPageJsonLd, buildRobotsTxt, buildSitemapXml, deriveAgentWebPublicRoutes, estimateMarkdownTokens, markdownFilePathForPage, markdownUrlForPage, normalizeAgentWebConfig, pathPatternMatches, resolveAgentWebCrawlerPolicy, } from "./agent-web/index.js";
 // Token usage tracking
 export { recordUsage, getUsageSummary, getUserUsageCents, calculateCost, usageBillingForEngine, builderCreditsFromCostCents, BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER, BUILDER_AGENT_CREDITS_PER_USD, BUILDER_CREDIT_USAGE_BILLING, USD_USAGE_BILLING, } from "./usage/store.js";
+// Workspace-scoped third-party connection metadata
+export { deleteWorkspaceConnection, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, revokeWorkspaceConnectionGrant, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, workspaceConnectionIsAvailableToApp, } from "./workspace-connections/index.js";
+// Reusable workspace connection provider catalog
+export { WORKSPACE_CONNECTION_PROVIDERS, defineWorkspaceConnectionProvider, getWorkspaceConnectionProvider, isWorkspaceConnectionProviderId, listWorkspaceConnectionProviders, listWorkspaceConnectionProvidersForCapability, listWorkspaceConnectionProvidersForTemplate, workspaceConnectionProviderSupports, } from "./connections/index.js";
 // Scripts
 export { runScript, loadEnv, parseArgs, camelCaseArgs, isValidPath, isValidProjectPath, ensureDir, fail, } from "./scripts/index.js";
 // Secrets registry — import from "@agent-native/core/secrets" when possible

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,+CAA+C;AAE/C,0BAA0B;AAC1B,OAAO,EACL,4BAA4B,EAU5B,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,GAIvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AAEvC,SAAS;AACT,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,GAKX,MAAM,mBAAmB,CAAC;AAE3B,SAAS;AACT,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,EAAE,EACF,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EAMpB,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,sBAAsB;AACtB,OAAO,EACL,SAAS,GAGV,MAAM,mBAAmB,CAAC;AAE3B,qBAAqB;AACrB,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,gCAAgC,EAChC,WAAW,EACX,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,4BAA4B,EAC5B,eAAe,EACf,cAAc,EACd,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,GAY7B,MAAM,sBAAsB,CAAC;AAE9B,uBAAuB;AACvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,2BAA2B,EAC3B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,iBAAiB,GAQlB,MAAM,kBAAkB,CAAC;AAE1B,UAAU;AACV,OAAO,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,IAAI,GACL,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,wEAAwE;AACxE,mCAAmC;AACnC,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAMhB,MAAM,oBAAoB,CAAC","sourcesContent":["// Framework for agent-native apps.\n// Import everything from \"@agent-native/core\".\n\n// Agent (production mode)\nexport {\n  createProductionAgentHandler,\n  type ActionEntry,\n  type ScriptEntry,\n  type ProductionAgentOptions,\n  type ActionTool,\n  type ScriptTool,\n  type AgentMessage,\n  type AgentChatRequest,\n  type AgentChatEvent,\n  type AgentChatAttachment,\n  DEFAULT_MODEL,\n} from \"./agent/index.js\";\nexport {\n  defineAction,\n  AgentActionStopError,\n  isAgentActionStopError,\n  type ActionHttpConfig,\n  type AgentActionStopOptions,\n  type PublicAgentActionConfig,\n} from \"./action.js\";\nexport { createDevScriptRegistry } from \"./scripts/dev/index.js\";\nexport {\n  createAgentChatPlugin,\n  defaultAgentChatPlugin,\n  type AgentChatPluginOptions,\n} from \"./server/agent-chat-plugin.js\";\n\n// Server\nexport {\n  createServer,\n  createSSEHandler,\n  defineNitroPlugin,\n  autoMountAuth,\n  getSession,\n  type CreateServerOptions,\n  type SSEHandlerOptions,\n  type AuthSession,\n  type AuthOptions,\n} from \"./server/index.js\";\n\n// Client\nexport {\n  sendToAgentChat,\n  useAgentChatGenerating,\n  useDevMode,\n  useSendToAgentChat,\n  CodeRequiredDialog,\n  useDbSync,\n  useFileWatcher,\n  cn,\n  ApiKeySettings,\n  useSession,\n  useProductionAgent,\n  ProductionAgentPanel,\n  type AgentChatMessage,\n  type CodeRequiredDialogProps,\n  type ProductionAgentMessage,\n  type UseProductionAgentResult,\n  type ProductionAgentPanelProps,\n  useActionQuery,\n  useActionMutation,\n} from \"./client/index.js\";\n\n// Shared (isomorphic)\nexport {\n  agentChat,\n  type AgentChatCallOptions,\n  type AgentChatResponse,\n} from \"./shared/index.js\";\n\n// Agent Web surfaces\nexport {\n  AGENT_WEB_CRAWLER_CATEGORIES,\n  AGENT_WEB_CRAWLER_USER_AGENTS,\n  DEFAULT_AGENT_WEB_CRAWLER_POLICY,\n  absoluteUrl,\n  agentWebConfigFromPackageJson,\n  buildAgentWebStaticFiles,\n  buildBaseJsonLd,\n  buildLlmsFullTxt,\n  buildLlmsTxt,\n  buildMarkdownResponseHeaders,\n  buildPageJsonLd,\n  buildRobotsTxt,\n  buildSitemapXml,\n  deriveAgentWebPublicRoutes,\n  estimateMarkdownTokens,\n  markdownFilePathForPage,\n  markdownUrlForPage,\n  normalizeAgentWebConfig,\n  pathPatternMatches,\n  resolveAgentWebCrawlerPolicy,\n  type AgentWebConfig,\n  type AgentWebCrawlerCategory,\n  type AgentWebCrawlerDecision,\n  type AgentWebCrawlerOverrides,\n  type AgentWebCrawlerPolicy,\n  type AgentWebInputConfig,\n  type AgentWebPage,\n  type AgentWebStaticFile,\n  type BuildAgentWebStaticFilesOptions,\n  type DeriveAgentWebPublicRoutesOptions,\n  type MarkdownResponseHeadersOptions,\n} from \"./agent-web/index.js\";\n\n// Token usage tracking\nexport {\n  recordUsage,\n  getUsageSummary,\n  getUserUsageCents,\n  calculateCost,\n  usageBillingForEngine,\n  builderCreditsFromCostCents,\n  BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER,\n  BUILDER_AGENT_CREDITS_PER_USD,\n  BUILDER_CREDIT_USAGE_BILLING,\n  USD_USAGE_BILLING,\n  type UsageRecord,\n  type UsageSummary,\n  type UsageBillingMode,\n  type UsageBillingUnit,\n  type UsageBucket,\n  type DailyBucket,\n  type UsageRecentEntry,\n} from \"./usage/store.js\";\n\n// Scripts\nexport {\n  runScript,\n  loadEnv,\n  parseArgs,\n  camelCaseArgs,\n  isValidPath,\n  isValidProjectPath,\n  ensureDir,\n  fail,\n} from \"./scripts/index.js\";\n\n// Secrets registry — import from \"@agent-native/core/secrets\" when possible\n// (the subpath keeps the top-level entry point lean), but re-export the\n// public API here for convenience.\nexport {\n  registerRequiredSecret,\n  listRequiredSecrets,\n  getRequiredSecret,\n  readAppSecret,\n  writeAppSecret,\n  deleteAppSecret,\n  type RegisteredSecret,\n  type SecretScope,\n  type SecretKind,\n  type SecretValidator,\n  type SecretRef,\n} from \"./secrets/index.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,+CAA+C;AAE/C,0BAA0B;AAC1B,OAAO,EACL,4BAA4B,EAU5B,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,GAIvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAE9B,SAAS;AACT,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,GAKX,MAAM,mBAAmB,CAAC;AAE3B,SAAS;AACT,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oCAAoC,EACpC,SAAS,EACT,cAAc,EACd,EAAE,EACF,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EAQpB,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,sBAAsB;AACtB,OAAO,EACL,SAAS,GAGV,MAAM,mBAAmB,CAAC;AAE3B,qBAAqB;AACrB,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,gCAAgC,EAChC,WAAW,EACX,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,4BAA4B,EAC5B,eAAe,EACf,cAAc,EACd,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,GAY7B,MAAM,sBAAsB,CAAC;AAE9B,uBAAuB;AACvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,2BAA2B,EAC3B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,iBAAiB,GAQlB,MAAM,kBAAkB,CAAC;AAE1B,mDAAmD;AACnD,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,sBAAsB,EACtB,2BAA2B,EAC3B,4CAA4C,EAC5C,6BAA6B,EAC7B,wBAAwB,EACxB,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,0CAA0C,EAC1C,6CAA6C,EAC7C,8BAA8B,EAC9B,yBAAyB,EA2BzB,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAE1C,iDAAiD;AACjD,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,8BAA8B,EAC9B,+BAA+B,EAC/B,gCAAgC,EAChC,6CAA6C,EAC7C,2CAA2C,EAC3C,mCAAmC,GAOpC,MAAM,wBAAwB,CAAC;AAEhC,UAAU;AACV,OAAO,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,IAAI,GACL,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,wEAAwE;AACxE,mCAAmC;AACnC,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAMhB,MAAM,oBAAoB,CAAC","sourcesContent":["// Framework for agent-native apps.\n// Import everything from \"@agent-native/core\".\n\n// Agent (production mode)\nexport {\n  createProductionAgentHandler,\n  type ActionEntry,\n  type ScriptEntry,\n  type ProductionAgentOptions,\n  type ActionTool,\n  type ScriptTool,\n  type AgentMessage,\n  type AgentChatRequest,\n  type AgentChatEvent,\n  type AgentChatAttachment,\n  DEFAULT_MODEL,\n} from \"./agent/index.js\";\nexport {\n  defineAction,\n  AgentActionStopError,\n  isAgentActionStopError,\n  type ActionHttpConfig,\n  type AgentActionStopOptions,\n  type PublicAgentActionConfig,\n} from \"./action.js\";\nexport { createDevScriptRegistry } from \"./scripts/dev/index.js\";\nexport {\n  createAgentChatPlugin,\n  defaultAgentChatPlugin,\n  type AgentChatPluginOptions,\n} from \"./server/agent-chat-plugin.js\";\nexport {\n  createAgentNativeEmbeddedPlugin,\n  mountAgentNativeEmbedded,\n  type AgentNativeEmbeddedPluginOptions,\n} from \"./server/embedded.js\";\n\n// Server\nexport {\n  createServer,\n  createSSEHandler,\n  defineNitroPlugin,\n  autoMountAuth,\n  getSession,\n  type CreateServerOptions,\n  type SSEHandlerOptions,\n  type AuthSession,\n  type AuthOptions,\n} from \"./server/index.js\";\n\n// Client\nexport {\n  sendToAgentChat,\n  useAgentChatGenerating,\n  useDevMode,\n  useSendToAgentChat,\n  CodeRequiredDialog,\n  useAgentNativeEmbeddedBrowserSession,\n  useDbSync,\n  useFileWatcher,\n  cn,\n  ApiKeySettings,\n  useSession,\n  AgentNativeEmbedded,\n  useProductionAgent,\n  ProductionAgentPanel,\n  type AgentChatMessage,\n  type AgentNativeEmbeddedProps,\n  type UseAgentNativeEmbeddedBrowserSessionOptions,\n  type CodeRequiredDialogProps,\n  type ProductionAgentMessage,\n  type UseProductionAgentResult,\n  type ProductionAgentPanelProps,\n  useActionQuery,\n  useActionMutation,\n} from \"./client/index.js\";\n\n// Shared (isomorphic)\nexport {\n  agentChat,\n  type AgentChatCallOptions,\n  type AgentChatResponse,\n} from \"./shared/index.js\";\n\n// Agent Web surfaces\nexport {\n  AGENT_WEB_CRAWLER_CATEGORIES,\n  AGENT_WEB_CRAWLER_USER_AGENTS,\n  DEFAULT_AGENT_WEB_CRAWLER_POLICY,\n  absoluteUrl,\n  agentWebConfigFromPackageJson,\n  buildAgentWebStaticFiles,\n  buildBaseJsonLd,\n  buildLlmsFullTxt,\n  buildLlmsTxt,\n  buildMarkdownResponseHeaders,\n  buildPageJsonLd,\n  buildRobotsTxt,\n  buildSitemapXml,\n  deriveAgentWebPublicRoutes,\n  estimateMarkdownTokens,\n  markdownFilePathForPage,\n  markdownUrlForPage,\n  normalizeAgentWebConfig,\n  pathPatternMatches,\n  resolveAgentWebCrawlerPolicy,\n  type AgentWebConfig,\n  type AgentWebCrawlerCategory,\n  type AgentWebCrawlerDecision,\n  type AgentWebCrawlerOverrides,\n  type AgentWebCrawlerPolicy,\n  type AgentWebInputConfig,\n  type AgentWebPage,\n  type AgentWebStaticFile,\n  type BuildAgentWebStaticFilesOptions,\n  type DeriveAgentWebPublicRoutesOptions,\n  type MarkdownResponseHeadersOptions,\n} from \"./agent-web/index.js\";\n\n// Token usage tracking\nexport {\n  recordUsage,\n  getUsageSummary,\n  getUserUsageCents,\n  calculateCost,\n  usageBillingForEngine,\n  builderCreditsFromCostCents,\n  BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER,\n  BUILDER_AGENT_CREDITS_PER_USD,\n  BUILDER_CREDIT_USAGE_BILLING,\n  USD_USAGE_BILLING,\n  type UsageRecord,\n  type UsageSummary,\n  type UsageBillingMode,\n  type UsageBillingUnit,\n  type UsageBucket,\n  type DailyBucket,\n  type UsageRecentEntry,\n} from \"./usage/store.js\";\n\n// Workspace-scoped third-party connection metadata\nexport {\n  deleteWorkspaceConnection,\n  getWorkspaceConnectionAppAccess,\n  getWorkspaceConnection,\n  getWorkspaceConnectionGrant,\n  listWorkspaceConnectionProviderCatalogForApp,\n  listWorkspaceConnectionGrants,\n  listWorkspaceConnections,\n  revokeWorkspaceConnectionGrant,\n  serializeWorkspaceConnectionGrant,\n  serializeWorkspaceConnection,\n  summarizeWorkspaceConnectionProviderForApp,\n  summarizeWorkspaceConnectionProviderReadiness,\n  upsertWorkspaceConnectionGrant,\n  upsertWorkspaceConnection,\n  type ListWorkspaceConnectionProviderCatalogForAppOptions,\n  type ListWorkspaceConnectionGrantsOptions,\n  type ListWorkspaceConnectionsOptions,\n  type SerializedWorkspaceConnectionGrant,\n  type SerializedWorkspaceConnection,\n  type SummarizeWorkspaceConnectionProviderForAppOptions,\n  type SummarizeWorkspaceConnectionProviderReadinessOptions,\n  type UpsertWorkspaceConnectionGrantInput,\n  type UpsertWorkspaceConnectionInput,\n  type WorkspaceConnectionAppAccess,\n  type WorkspaceConnectionAppAccessMode,\n  type WorkspaceConnection,\n  type WorkspaceConnectionCredentialRef,\n  type WorkspaceConnectionExplicitGrantSummary,\n  type WorkspaceConnectionForAppSummary,\n  type WorkspaceConnectionGrant,\n  type WorkspaceConnectionGrantAvailability,\n  type WorkspaceConnectionGrantState,\n  type WorkspaceConnectionProviderAppSummary,\n  type WorkspaceConnectionProviderLike,\n  type WorkspaceConnectionProviderCatalogForApp,\n  type WorkspaceConnectionProviderCatalogForAppItem,\n  type WorkspaceConnectionProviderReadiness,\n  type WorkspaceConnectionProviderReadinessStatus,\n  type WorkspaceConnectionPublicCredentialRef,\n  type WorkspaceConnectionStatus,\n  workspaceConnectionIsAvailableToApp,\n} from \"./workspace-connections/index.js\";\n\n// Reusable workspace connection provider catalog\nexport {\n  WORKSPACE_CONNECTION_PROVIDERS,\n  defineWorkspaceConnectionProvider,\n  getWorkspaceConnectionProvider,\n  isWorkspaceConnectionProviderId,\n  listWorkspaceConnectionProviders,\n  listWorkspaceConnectionProvidersForCapability,\n  listWorkspaceConnectionProvidersForTemplate,\n  workspaceConnectionProviderSupports,\n  type ListWorkspaceConnectionProvidersOptions,\n  type WorkspaceConnectionCapability,\n  type WorkspaceConnectionCredentialKey,\n  type WorkspaceConnectionProvider,\n  type WorkspaceConnectionProviderId,\n  type WorkspaceConnectionTemplateUse,\n} from \"./connections/index.js\";\n\n// Scripts\nexport {\n  runScript,\n  loadEnv,\n  parseArgs,\n  camelCaseArgs,\n  isValidPath,\n  isValidProjectPath,\n  ensureDir,\n  fail,\n} from \"./scripts/index.js\";\n\n// Secrets registry — import from \"@agent-native/core/secrets\" when possible\n// (the subpath keeps the top-level entry point lean), but re-export the\n// public API here for convenience.\nexport {\n  registerRequiredSecret,\n  listRequiredSecrets,\n  getRequiredSecret,\n  readAppSecret,\n  writeAppSecret,\n  deleteAppSecret,\n  type RegisteredSecret,\n  type SecretScope,\n  type SecretKind,\n  type SecretValidator,\n  type SecretRef,\n} from \"./secrets/index.js\";\n"]}

package/dist/integrations/adapters/telegram.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telegram.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AAyBrB;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAuQjD"}
+{"version":3,"file":"telegram.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AAyBrB;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAwQjD"}

package/dist/integrations/adapters/telegram.js

@@ -127,6 +127,7 @@ export function telegramAdapter() {
                     chatId: chat.id,
                     chatType: chat.type,
                     messageId: message.message_id,
+                    rawText: text,
                     fromId: from?.id,
                     fromUsername: from?.username,
                 },

package/dist/integrations/adapters/telegram.js.map

@@ -1 +1 @@
-{"version":3,"file":"telegram.js","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAS/B,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAEtD,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;;;GAMG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;QAEjB,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,oBAAoB;oBAC3B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,uGAAuG;iBAC1G;gBACD;oBACE,GAAG,EAAE,yBAAyB;oBAC9B,KAAK,EAAE,yBAAyB;oBAChC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,6HAA6H;iBAChI;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,qEAAqE;YACrE,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,uCAAuC;YACvC,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACnC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBACjC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;YACD,qDAAqD;YACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,6BAA6B,EAAE,EAAE,CAAC;oBACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBAC/B,yBAAyB,GAAG,IAAI,CAAC;wBACjC,OAAO,CAAC,KAAK,CACX,+EAA+E;4BAC7E,sGAAsG,CACzG,CAAC;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAC/B,yBAAyB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,IAAI,CACV,gGAAgG,CACjG,CAAC;gBACJ,CAAC;gBACD,iEAAiE;gBACjE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1C,CAAC;YAED,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YACzE,IAAI,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAEhC,yBAAyB;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC3C,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAC1B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,wEAAwE;YACxE,mEAAmE;YACnE,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,CAAC,SAAiB,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,0BAA0B;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,6BAA6B;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YAEnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAE1B,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,EAAE,SAAS;gBACf,UAAU,EACR,IAAI,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1B,eAAe,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,MAAM,EAAE,IAAI,EAAE,EAAE;oBAChB,YAAY,EAAE,IAAI,EAAE,QAAQ;iBAC7B;gBACD,SAAS,EAAE,OAAO,CAAC,IAAI,GAAG,IAAI;aAC/B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,MAAM;4BACf,IAAI,EAAE,KAAK;4BACX,UAAU,EAAE,UAAU;yBACvB,CAAC;qBACH,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,0CAA0C;wBAC1C,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACxC,MAAM,KAAK,CAAC,+BAA+B,KAAK,cAAc,EAAE;gCAC9D,MAAM,EAAE,MAAM;gCACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gCAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oCACnB,OAAO,EAAE,MAAM;oCACf,IAAI,EAAE,KAAK;iCACZ,CAAC;6BACH,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;wBACnE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAA4B;oBACpC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,IAAI,EAAE,KAAK;iBACZ,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,SAAS,CAAC;gBAC5C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;oBACnE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,yEAAyE;YACzE,+CAA+C;YAC/C,wEAAwE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;QAC3E,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAElD,IAAI,OAA2B,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CACtE,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;wBACZ,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAClC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE;oBACP,QAAQ;oBACR,WAAW,EAAE,OAAO;iBACrB;gBACD,KAAK,EAAE,CAAC,QAAQ;oBACd,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getHeader } from \"h3\";\nimport type {\n  PlatformAdapter,\n  IncomingMessage,\n  OutgoingMessage,\n  IntegrationStatus,\n  OutboundTarget,\n} from \"../types.js\";\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { readBody } from \"../../server/h3-helpers.js\";\n\n/** Telegram's max message length */\nconst TELEGRAM_MAX_LENGTH = 4096;\n\n/**\n * One-shot warning flag — log once per process when accepting unverified\n * webhooks (M6 in the webhook security audit).\n */\nlet _telegramUnverifiedWarned = false;\n\n/**\n * Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose secret is\n * unset — otherwise an attacker can drive the agent loop with arbitrary\n * messages (C2 in the webhook security audit).\n */\nfunction shouldRefuseWhenSecretMissing(): boolean {\n  if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n  return process.env.NODE_ENV === \"production\";\n}\n\n/**\n * Create a Telegram platform adapter.\n *\n * Required env vars:\n * - TELEGRAM_BOT_TOKEN — Bot token from @BotFather\n *\n * Optional env vars:\n * - TELEGRAM_WEBHOOK_SECRET — Secret token for webhook verification\n */\nexport function telegramAdapter(): PlatformAdapter {\n  return {\n    platform: \"telegram\",\n    label: \"Telegram\",\n\n    getRequiredEnvKeys(): EnvKeyConfig[] {\n      return [\n        {\n          key: \"TELEGRAM_BOT_TOKEN\",\n          label: \"Telegram Bot Token\",\n          required: true,\n          helpText:\n            \"From @BotFather after `/newbot` — the long token Telegram gives you (looks like `123456:ABC-DEF...`).\",\n        },\n        {\n          key: \"TELEGRAM_WEBHOOK_SECRET\",\n          label: \"Telegram Webhook Secret\",\n          required: false,\n          helpText:\n            \"Optional. Any random string — Telegram will echo it on every webhook so dispatch can verify the request came from Telegram.\",\n        },\n      ];\n    },\n\n    async handleVerification(\n      event: H3Event,\n    ): Promise<{ handled: boolean; response?: unknown }> {\n      // Pre-read the raw body once and cache on the event context. h3 v2's\n      // request body stream can only be consumed once; without this, the\n      // later `parseIncomingMessage` call throws \"Body has already been read\"\n      // because something upstream (signature check, dedupe, etc.) drains it.\n      // Mirrors the Slack adapter's pattern.\n      try {\n        if (!event.context.__rawBody) {\n          const body = await readBody(event);\n          event.context.__rawBody = body;\n        }\n      } catch {\n        // If we can't pre-read, parseIncomingMessage will surface the error\n      }\n      // Telegram has no challenge; we never short-circuit.\n      return { handled: false };\n    },\n\n    async verifyWebhook(event: H3Event): Promise<boolean> {\n      const secret = process.env.TELEGRAM_WEBHOOK_SECRET;\n      if (!secret) {\n        if (shouldRefuseWhenSecretMissing()) {\n          if (!_telegramUnverifiedWarned) {\n            _telegramUnverifiedWarned = true;\n            console.error(\n              \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — refusing webhook in production. \" +\n                \"Set TELEGRAM_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n            );\n          }\n          return false;\n        }\n        if (!_telegramUnverifiedWarned) {\n          _telegramUnverifiedWarned = true;\n          console.warn(\n            \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — accepting webhook without verification (dev mode)\",\n          );\n        }\n        // Dev mode: still require the bot token to be configured at all.\n        return !!process.env.TELEGRAM_BOT_TOKEN;\n      }\n\n      const headerSecret = getHeader(event, \"x-telegram-bot-api-secret-token\");\n      if (!headerSecret) return false;\n\n      // Timing-safe comparison\n      try {\n        const crypto = await import(\"node:crypto\");\n        return crypto.timingSafeEqual(\n          Buffer.from(secret),\n          Buffer.from(headerSecret),\n        );\n      } catch {\n        return false;\n      }\n    },\n\n    async parseIncomingMessage(\n      event: H3Event,\n    ): Promise<IncomingMessage | null> {\n      // Use the pre-cached raw body if available (set by handleVerification).\n      // Falls back to readBody for paths that bypass handleVerification.\n      const body = (event.context.__rawBody as any) ?? (await readBody(event));\n      if (!body) return null;\n\n      // Handle regular messages\n      const message = body.message || body.edited_message;\n      if (!message) return null;\n\n      // Only process text messages\n      const text = message.text?.trim();\n      if (!text) return null;\n\n      // Ignore bot commands that we don't handle (e.g., /start is fine)\n      // Remove /start command prefix if present\n      const cleanText =\n        text === \"/start\"\n          ? \"Hello! I'm ready to chat.\"\n          : text.replace(/^\\/\\w+\\s*/, \"\").trim() || text;\n\n      const chat = message.chat;\n      const from = message.from;\n\n      return {\n        platform: \"telegram\",\n        externalThreadId: String(chat.id),\n        text: cleanText,\n        senderName:\n          from?.first_name + (from?.last_name ? ` ${from.last_name}` : \"\"),\n        senderId: String(from?.id),\n        platformContext: {\n          chatId: chat.id,\n          chatType: chat.type,\n          messageId: message.message_id,\n          fromId: from?.id,\n          fromUsername: from?.username,\n        },\n        timestamp: message.date * 1000,\n      };\n    },\n\n    async sendResponse(\n      message: OutgoingMessage,\n      context: IncomingMessage,\n    ): Promise<void> {\n      const token = process.env.TELEGRAM_BOT_TOKEN;\n      if (!token) {\n        console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n        return;\n      }\n\n      const chatId = context.platformContext.chatId;\n      const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n\n      for (const chunk of chunks) {\n        try {\n          const res = await fetch(\n            `https://api.telegram.org/bot${token}/sendMessage`,\n            {\n              method: \"POST\",\n              headers: { \"Content-Type\": \"application/json\" },\n              body: JSON.stringify({\n                chat_id: chatId,\n                text: chunk,\n                parse_mode: \"Markdown\",\n              }),\n            },\n          );\n          const data = (await res.json()) as {\n            ok: boolean;\n            description?: string;\n          };\n          if (!data.ok) {\n            // Retry without Markdown if parsing fails\n            if (data.description?.includes(\"parse\")) {\n              await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {\n                method: \"POST\",\n                headers: { \"Content-Type\": \"application/json\" },\n                body: JSON.stringify({\n                  chat_id: chatId,\n                  text: chunk,\n                }),\n              });\n            } else {\n              console.error(\"[telegram] sendMessage error:\", data.description);\n            }\n          }\n        } catch (err) {\n          console.error(\"[telegram] Failed to send message:\", err);\n        }\n      }\n    },\n\n    async sendMessageToTarget(\n      message: OutgoingMessage,\n      target: OutboundTarget,\n    ): Promise<void> {\n      const token = process.env.TELEGRAM_BOT_TOKEN;\n      if (!token) {\n        console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n        return;\n      }\n\n      const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n      for (const chunk of chunks) {\n        const body: Record<string, unknown> = {\n          chat_id: target.destination,\n          text: chunk,\n        };\n        if (target.threadRef) {\n          body.message_thread_id = target.threadRef;\n        }\n\n        try {\n          const res = await fetch(\n            `https://api.telegram.org/bot${token}/sendMessage`,\n            {\n              method: \"POST\",\n              headers: { \"Content-Type\": \"application/json\" },\n              body: JSON.stringify(body),\n            },\n          );\n          const data = (await res.json()) as {\n            ok: boolean;\n            description?: string;\n          };\n          if (!data.ok) {\n            throw new Error(data.description || \"sendMessage failed\");\n          }\n        } catch (err) {\n          console.error(\"[telegram] Failed to send proactive message:\", err);\n          throw err;\n        }\n      }\n    },\n\n    formatAgentResponse(text: string): OutgoingMessage {\n      // Telegram's legacy Markdown uses single asterisks for bold, not double.\n      // `[text](url)` is already supported natively.\n      // 's' flag (dotAll) so `.` matches newlines — bold text can span lines.\n      const normalized = text.replace(/\\*\\*(.+?)\\*\\*/gs, \"*$1*\");\n      return { text: normalized, platformContext: { parse_mode: \"Markdown\" } };\n    },\n\n    async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n      const hasToken = !!process.env.TELEGRAM_BOT_TOKEN;\n\n      let botName: string | undefined;\n      if (hasToken) {\n        try {\n          const res = await fetch(\n            `https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/getMe`,\n          );\n          const data = (await res.json()) as {\n            ok: boolean;\n            result?: { username?: string };\n          };\n          if (data.ok) {\n            botName = data.result?.username;\n          }\n        } catch {}\n      }\n\n      return {\n        platform: \"telegram\",\n        label: \"Telegram\",\n        enabled: false, // overridden by plugin\n        configured: hasToken,\n        details: {\n          hasToken,\n          botUsername: botName,\n        },\n        error: !hasToken\n          ? \"Set TELEGRAM_BOT_TOKEN in your environment\"\n          : undefined,\n      };\n    },\n  };\n}\n\n/** Split a message into chunks that fit within the platform's limit */\nfunction splitMessage(text: string, maxLength: number): string[] {\n  if (text.length <= maxLength) return [text];\n  const chunks: string[] = [];\n  let remaining = text;\n  while (remaining.length > 0) {\n    if (remaining.length <= maxLength) {\n      chunks.push(remaining);\n      break;\n    }\n    let splitIdx = remaining.lastIndexOf(\"\\n\", maxLength);\n    if (splitIdx <= 0) splitIdx = remaining.lastIndexOf(\" \", maxLength);\n    if (splitIdx <= 0) splitIdx = maxLength;\n    chunks.push(remaining.slice(0, splitIdx));\n    remaining = remaining.slice(splitIdx).trimStart();\n  }\n  return chunks;\n}\n"]}
+{"version":3,"file":"telegram.js","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAS/B,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAEtD,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;;;GAMG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;QAEjB,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,oBAAoB;oBAC3B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,uGAAuG;iBAC1G;gBACD;oBACE,GAAG,EAAE,yBAAyB;oBAC9B,KAAK,EAAE,yBAAyB;oBAChC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,6HAA6H;iBAChI;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,qEAAqE;YACrE,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,uCAAuC;YACvC,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACnC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBACjC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;YACD,qDAAqD;YACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,6BAA6B,EAAE,EAAE,CAAC;oBACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBAC/B,yBAAyB,GAAG,IAAI,CAAC;wBACjC,OAAO,CAAC,KAAK,CACX,+EAA+E;4BAC7E,sGAAsG,CACzG,CAAC;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAC/B,yBAAyB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,IAAI,CACV,gGAAgG,CACjG,CAAC;gBACJ,CAAC;gBACD,iEAAiE;gBACjE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1C,CAAC;YAED,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YACzE,IAAI,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAEhC,yBAAyB;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC3C,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAC1B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,wEAAwE;YACxE,mEAAmE;YACnE,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,CAAC,SAAiB,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,0BAA0B;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,6BAA6B;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YAEnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAE1B,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,EAAE,SAAS;gBACf,UAAU,EACR,IAAI,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1B,eAAe,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,IAAI,EAAE,EAAE;oBAChB,YAAY,EAAE,IAAI,EAAE,QAAQ;iBAC7B;gBACD,SAAS,EAAE,OAAO,CAAC,IAAI,GAAG,IAAI;aAC/B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,MAAM;4BACf,IAAI,EAAE,KAAK;4BACX,UAAU,EAAE,UAAU;yBACvB,CAAC;qBACH,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,0CAA0C;wBAC1C,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACxC,MAAM,KAAK,CAAC,+BAA+B,KAAK,cAAc,EAAE;gCAC9D,MAAM,EAAE,MAAM;gCACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gCAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oCACnB,OAAO,EAAE,MAAM;oCACf,IAAI,EAAE,KAAK;iCACZ,CAAC;6BACH,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;wBACnE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAA4B;oBACpC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,IAAI,EAAE,KAAK;iBACZ,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,SAAS,CAAC;gBAC5C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;oBACnE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,yEAAyE;YACzE,+CAA+C;YAC/C,wEAAwE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;QAC3E,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAElD,IAAI,OAA2B,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CACtE,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;wBACZ,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAClC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE;oBACP,QAAQ;oBACR,WAAW,EAAE,OAAO;iBACrB;gBACD,KAAK,EAAE,CAAC,QAAQ;oBACd,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getHeader } from \"h3\";\nimport type {\n  PlatformAdapter,\n  IncomingMessage,\n  OutgoingMessage,\n  IntegrationStatus,\n  OutboundTarget,\n} from \"../types.js\";\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { readBody } from \"../../server/h3-helpers.js\";\n\n/** Telegram's max message length */\nconst TELEGRAM_MAX_LENGTH = 4096;\n\n/**\n * One-shot warning flag — log once per process when accepting unverified\n * webhooks (M6 in the webhook security audit).\n */\nlet _telegramUnverifiedWarned = false;\n\n/**\n * Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose secret is\n * unset — otherwise an attacker can drive the agent loop with arbitrary\n * messages (C2 in the webhook security audit).\n */\nfunction shouldRefuseWhenSecretMissing(): boolean {\n  if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n  return process.env.NODE_ENV === \"production\";\n}\n\n/**\n * Create a Telegram platform adapter.\n *\n * Required env vars:\n * - TELEGRAM_BOT_TOKEN — Bot token from @BotFather\n *\n * Optional env vars:\n * - TELEGRAM_WEBHOOK_SECRET — Secret token for webhook verification\n */\nexport function telegramAdapter(): PlatformAdapter {\n  return {\n    platform: \"telegram\",\n    label: \"Telegram\",\n\n    getRequiredEnvKeys(): EnvKeyConfig[] {\n      return [\n        {\n          key: \"TELEGRAM_BOT_TOKEN\",\n          label: \"Telegram Bot Token\",\n          required: true,\n          helpText:\n            \"From @BotFather after `/newbot` — the long token Telegram gives you (looks like `123456:ABC-DEF...`).\",\n        },\n        {\n          key: \"TELEGRAM_WEBHOOK_SECRET\",\n          label: \"Telegram Webhook Secret\",\n          required: false,\n          helpText:\n            \"Optional. Any random string — Telegram will echo it on every webhook so dispatch can verify the request came from Telegram.\",\n        },\n      ];\n    },\n\n    async handleVerification(\n      event: H3Event,\n    ): Promise<{ handled: boolean; response?: unknown }> {\n      // Pre-read the raw body once and cache on the event context. h3 v2's\n      // request body stream can only be consumed once; without this, the\n      // later `parseIncomingMessage` call throws \"Body has already been read\"\n      // because something upstream (signature check, dedupe, etc.) drains it.\n      // Mirrors the Slack adapter's pattern.\n      try {\n        if (!event.context.__rawBody) {\n          const body = await readBody(event);\n          event.context.__rawBody = body;\n        }\n      } catch {\n        // If we can't pre-read, parseIncomingMessage will surface the error\n      }\n      // Telegram has no challenge; we never short-circuit.\n      return { handled: false };\n    },\n\n    async verifyWebhook(event: H3Event): Promise<boolean> {\n      const secret = process.env.TELEGRAM_WEBHOOK_SECRET;\n      if (!secret) {\n        if (shouldRefuseWhenSecretMissing()) {\n          if (!_telegramUnverifiedWarned) {\n            _telegramUnverifiedWarned = true;\n            console.error(\n              \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — refusing webhook in production. \" +\n                \"Set TELEGRAM_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n            );\n          }\n          return false;\n        }\n        if (!_telegramUnverifiedWarned) {\n          _telegramUnverifiedWarned = true;\n          console.warn(\n            \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — accepting webhook without verification (dev mode)\",\n          );\n        }\n        // Dev mode: still require the bot token to be configured at all.\n        return !!process.env.TELEGRAM_BOT_TOKEN;\n      }\n\n      const headerSecret = getHeader(event, \"x-telegram-bot-api-secret-token\");\n      if (!headerSecret) return false;\n\n      // Timing-safe comparison\n      try {\n        const crypto = await import(\"node:crypto\");\n        return crypto.timingSafeEqual(\n          Buffer.from(secret),\n          Buffer.from(headerSecret),\n        );\n      } catch {\n        return false;\n      }\n    },\n\n    async parseIncomingMessage(\n      event: H3Event,\n    ): Promise<IncomingMessage | null> {\n      // Use the pre-cached raw body if available (set by handleVerification).\n      // Falls back to readBody for paths that bypass handleVerification.\n      const body = (event.context.__rawBody as any) ?? (await readBody(event));\n      if (!body) return null;\n\n      // Handle regular messages\n      const message = body.message || body.edited_message;\n      if (!message) return null;\n\n      // Only process text messages\n      const text = message.text?.trim();\n      if (!text) return null;\n\n      // Ignore bot commands that we don't handle (e.g., /start is fine)\n      // Remove /start command prefix if present\n      const cleanText =\n        text === \"/start\"\n          ? \"Hello! I'm ready to chat.\"\n          : text.replace(/^\\/\\w+\\s*/, \"\").trim() || text;\n\n      const chat = message.chat;\n      const from = message.from;\n\n      return {\n        platform: \"telegram\",\n        externalThreadId: String(chat.id),\n        text: cleanText,\n        senderName:\n          from?.first_name + (from?.last_name ? ` ${from.last_name}` : \"\"),\n        senderId: String(from?.id),\n        platformContext: {\n          chatId: chat.id,\n          chatType: chat.type,\n          messageId: message.message_id,\n          rawText: text,\n          fromId: from?.id,\n          fromUsername: from?.username,\n        },\n        timestamp: message.date * 1000,\n      };\n    },\n\n    async sendResponse(\n      message: OutgoingMessage,\n      context: IncomingMessage,\n    ): Promise<void> {\n      const token = process.env.TELEGRAM_BOT_TOKEN;\n      if (!token) {\n        console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n        return;\n      }\n\n      const chatId = context.platformContext.chatId;\n      const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n\n      for (const chunk of chunks) {\n        try {\n          const res = await fetch(\n            `https://api.telegram.org/bot${token}/sendMessage`,\n            {\n              method: \"POST\",\n              headers: { \"Content-Type\": \"application/json\" },\n              body: JSON.stringify({\n                chat_id: chatId,\n                text: chunk,\n                parse_mode: \"Markdown\",\n              }),\n            },\n          );\n          const data = (await res.json()) as {\n            ok: boolean;\n            description?: string;\n          };\n          if (!data.ok) {\n            // Retry without Markdown if parsing fails\n            if (data.description?.includes(\"parse\")) {\n              await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {\n                method: \"POST\",\n                headers: { \"Content-Type\": \"application/json\" },\n                body: JSON.stringify({\n                  chat_id: chatId,\n                  text: chunk,\n                }),\n              });\n            } else {\n              console.error(\"[telegram] sendMessage error:\", data.description);\n            }\n          }\n        } catch (err) {\n          console.error(\"[telegram] Failed to send message:\", err);\n        }\n      }\n    },\n\n    async sendMessageToTarget(\n      message: OutgoingMessage,\n      target: OutboundTarget,\n    ): Promise<void> {\n      const token = process.env.TELEGRAM_BOT_TOKEN;\n      if (!token) {\n        console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n        return;\n      }\n\n      const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n      for (const chunk of chunks) {\n        const body: Record<string, unknown> = {\n          chat_id: target.destination,\n          text: chunk,\n        };\n        if (target.threadRef) {\n          body.message_thread_id = target.threadRef;\n        }\n\n        try {\n          const res = await fetch(\n            `https://api.telegram.org/bot${token}/sendMessage`,\n            {\n              method: \"POST\",\n              headers: { \"Content-Type\": \"application/json\" },\n              body: JSON.stringify(body),\n            },\n          );\n          const data = (await res.json()) as {\n            ok: boolean;\n            description?: string;\n          };\n          if (!data.ok) {\n            throw new Error(data.description || \"sendMessage failed\");\n          }\n        } catch (err) {\n          console.error(\"[telegram] Failed to send proactive message:\", err);\n          throw err;\n        }\n      }\n    },\n\n    formatAgentResponse(text: string): OutgoingMessage {\n      // Telegram's legacy Markdown uses single asterisks for bold, not double.\n      // `[text](url)` is already supported natively.\n      // 's' flag (dotAll) so `.` matches newlines — bold text can span lines.\n      const normalized = text.replace(/\\*\\*(.+?)\\*\\*/gs, \"*$1*\");\n      return { text: normalized, platformContext: { parse_mode: \"Markdown\" } };\n    },\n\n    async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n      const hasToken = !!process.env.TELEGRAM_BOT_TOKEN;\n\n      let botName: string | undefined;\n      if (hasToken) {\n        try {\n          const res = await fetch(\n            `https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/getMe`,\n          );\n          const data = (await res.json()) as {\n            ok: boolean;\n            result?: { username?: string };\n          };\n          if (data.ok) {\n            botName = data.result?.username;\n          }\n        } catch {}\n      }\n\n      return {\n        platform: \"telegram\",\n        label: \"Telegram\",\n        enabled: false, // overridden by plugin\n        configured: hasToken,\n        details: {\n          hasToken,\n          botUsername: botName,\n        },\n        error: !hasToken\n          ? \"Set TELEGRAM_BOT_TOKEN in your environment\"\n          : undefined,\n      };\n    },\n  };\n}\n\n/** Split a message into chunks that fit within the platform's limit */\nfunction splitMessage(text: string, maxLength: number): string[] {\n  if (text.length <= maxLength) return [text];\n  const chunks: string[] = [];\n  let remaining = text;\n  while (remaining.length > 0) {\n    if (remaining.length <= maxLength) {\n      chunks.push(remaining);\n      break;\n    }\n    let splitIdx = remaining.lastIndexOf(\"\\n\", maxLength);\n    if (splitIdx <= 0) splitIdx = remaining.lastIndexOf(\" \", maxLength);\n    if (splitIdx <= 0) splitIdx = maxLength;\n    chunks.push(remaining.slice(0, splitIdx));\n    remaining = remaining.slice(splitIdx).trimStart();\n  }\n  return chunks;\n}\n"]}

package/dist/integrations/index.d.ts

@@ -1,5 +1,9 @@
 export type { PlatformAdapter, IncomingMessage, OutgoingMessage, IntegrationStatus, IntegrationsPluginOptions, } from "./types.js";
-export { createIntegrationsPlugin, defaultIntegrationsPlugin, } from "./plugin.js";
+export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, } from "./plugin.js";
+export { listRemoteDevicesForOwner, revokeRemoteDeviceForOwner, unregisterRemoteDevice, } from "./remote-devices-store.js";
+export { listRemoteCommandsForOwner } from "./remote-commands-store.js";
+export { listRemotePushNotificationsForOwner, listRemotePushRegistrationsForOwner, queueRemotePushNotifications, toPublicRemotePushRegistration, unregisterRemotePushRegistrationForOwner, upsertRemotePushRegistration, } from "./remote-push-store.js";
+export type { PublicRemotePushRegistration, PublicRemoteDevice, RemoteCommand, RemoteDevice, RemotePushNotification, RemotePushRegistration, RemoteRunEvent, } from "./remote-types.js";
 export { slackAdapter } from "./adapters/slack.js";
 export { telegramAdapter } from "./adapters/telegram.js";
 export { whatsappAdapter } from "./adapters/whatsapp.js";

package/dist/integrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/integrations/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/integrations/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,4BAA4B,EAC5B,8BAA8B,EAC9B,wCAAwC,EACxC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,sBAAsB,EACtB,sBAAsB,EACtB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,2BAA2B,CAAC"}

package/dist/integrations/index.js

@@ -1,5 +1,8 @@
 // Plugin
-export { createIntegrationsPlugin, defaultIntegrationsPlugin, } from "./plugin.js";
+export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, } from "./plugin.js";
+export { listRemoteDevicesForOwner, revokeRemoteDeviceForOwner, unregisterRemoteDevice, } from "./remote-devices-store.js";
+export { listRemoteCommandsForOwner } from "./remote-commands-store.js";
+export { listRemotePushNotificationsForOwner, listRemotePushRegistrationsForOwner, queueRemotePushNotifications, toPublicRemotePushRegistration, unregisterRemotePushRegistrationForOwner, upsertRemotePushRegistration, } from "./remote-push-store.js";
 // Adapters
 export { slackAdapter } from "./adapters/slack.js";
 export { telegramAdapter } from "./adapters/telegram.js";

package/dist/integrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/integrations/index.ts"],"names":[],"mappings":"AASA,SAAS;AACT,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAErB,WAAW;AACX,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,0BAA0B;AAC1B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,SAAS;AACT,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,2BAA2B,CAAC","sourcesContent":["// Types\nexport type {\n  PlatformAdapter,\n  IncomingMessage,\n  OutgoingMessage,\n  IntegrationStatus,\n  IntegrationsPluginOptions,\n} from \"./types.js\";\n\n// Plugin\nexport {\n  createIntegrationsPlugin,\n  defaultIntegrationsPlugin,\n} from \"./plugin.js\";\n\n// Adapters\nexport { slackAdapter } from \"./adapters/slack.js\";\nexport { telegramAdapter } from \"./adapters/telegram.js\";\nexport { whatsappAdapter } from \"./adapters/whatsapp.js\";\nexport { googleDocsAdapter } from \"./adapters/google-docs.js\";\nexport { emailAdapter } from \"./adapters/email.js\";\n\n// Google Docs integration\nexport {\n  startGoogleDocsPoller,\n  stopGoogleDocsPoller,\n  handlePushNotification,\n} from \"./google-docs-poller.js\";\n\n// Stores\nexport {\n  getIntegrationConfig,\n  saveIntegrationConfig,\n  deleteIntegrationConfig,\n  listIntegrationConfigs,\n  type IntegrationConfig,\n} from \"./config-store.js\";\n\nexport {\n  getThreadMapping,\n  saveThreadMapping,\n  deleteThreadMapping,\n  listThreadMappings,\n  type ThreadMapping,\n} from \"./thread-mapping-store.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/integrations/index.ts"],"names":[],"mappings":"AASA,SAAS;AACT,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,4BAA4B,EAC5B,8BAA8B,EAC9B,wCAAwC,EACxC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAWhC,WAAW;AACX,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,0BAA0B;AAC1B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,SAAS;AACT,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,2BAA2B,CAAC","sourcesContent":["// Types\nexport type {\n  PlatformAdapter,\n  IncomingMessage,\n  OutgoingMessage,\n  IntegrationStatus,\n  IntegrationsPluginOptions,\n} from \"./types.js\";\n\n// Plugin\nexport {\n  createIntegrationsPlugin,\n  defaultIntegrationsPlugin,\n  enqueueRemoteCommand,\n} from \"./plugin.js\";\n\nexport {\n  listRemoteDevicesForOwner,\n  revokeRemoteDeviceForOwner,\n  unregisterRemoteDevice,\n} from \"./remote-devices-store.js\";\nexport { listRemoteCommandsForOwner } from \"./remote-commands-store.js\";\nexport {\n  listRemotePushNotificationsForOwner,\n  listRemotePushRegistrationsForOwner,\n  queueRemotePushNotifications,\n  toPublicRemotePushRegistration,\n  unregisterRemotePushRegistrationForOwner,\n  upsertRemotePushRegistration,\n} from \"./remote-push-store.js\";\nexport type {\n  PublicRemotePushRegistration,\n  PublicRemoteDevice,\n  RemoteCommand,\n  RemoteDevice,\n  RemotePushNotification,\n  RemotePushRegistration,\n  RemoteRunEvent,\n} from \"./remote-types.js\";\n\n// Adapters\nexport { slackAdapter } from \"./adapters/slack.js\";\nexport { telegramAdapter } from \"./adapters/telegram.js\";\nexport { whatsappAdapter } from \"./adapters/whatsapp.js\";\nexport { googleDocsAdapter } from \"./adapters/google-docs.js\";\nexport { emailAdapter } from \"./adapters/email.js\";\n\n// Google Docs integration\nexport {\n  startGoogleDocsPoller,\n  stopGoogleDocsPoller,\n  handlePushNotification,\n} from \"./google-docs-poller.js\";\n\n// Stores\nexport {\n  getIntegrationConfig,\n  saveIntegrationConfig,\n  deleteIntegrationConfig,\n  listIntegrationConfigs,\n  type IntegrationConfig,\n} from \"./config-store.js\";\n\nexport {\n  getThreadMapping,\n  saveThreadMapping,\n  deleteThreadMapping,\n  listThreadMappings,\n  type ThreadMapping,\n} from \"./thread-mapping-store.js\";\n"]}