@agent-native/core 0.152.0 → 0.153.0

package/dist/usage/metrics-store.js

@@ -0,0 +1,386 @@
+import { getDbExec } from "../db/client.js";
+import { ForbiddenError } from "../sharing/access.js";
+import { builderCreditsFromCostCents, usageBillingForEngine, } from "./store.js";
+const DAY_MS = 86_400_000;
+function numberField(row, key) {
+    return Number(row[key] ?? 0) || 0;
+}
+function stringField(row, key) {
+    return String(row[key] ?? "");
+}
+function nullableStringField(row, key) {
+    const value = row[key];
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed || null;
+}
+function normalizeEmail(value) {
+    const email = value.trim().toLowerCase();
+    if (!email)
+        throw new Error("Usage metrics require an authenticated user.");
+    return email;
+}
+export function normalizeUsageAppKey(value) {
+    const normalized = value
+        .trim()
+        .toLowerCase()
+        .replace(/^agent-native-/, "");
+    return normalized || "unattributed";
+}
+function appKeys(value) {
+    const raw = value.trim().toLowerCase();
+    const normalized = normalizeUsageAppKey(value);
+    return [...new Set([raw, normalized, `agent-native-${normalized}`])].filter(Boolean);
+}
+export function usageAppScope(app) {
+    const keys = appKeys(app);
+    return {
+        where: `LOWER(COALESCE(app, '')) IN (${keys.map(() => "?").join(", ")})`,
+        args: keys,
+    };
+}
+async function listOrgMembers(orgId) {
+    const result = await getDbExec().execute({
+        sql: `SELECT email, role FROM org_members WHERE org_id = ? ORDER BY LOWER(email) ASC`,
+        args: [orgId],
+    });
+    return result.rows
+        .map((row) => ({
+        email: stringField(row, "email").trim(),
+        role: stringField(row, "role").trim() || null,
+    }))
+        .filter((member) => member.email);
+}
+async function getOrgRole(orgId, ownerEmail) {
+    if (!orgId)
+        return null;
+    const result = await getDbExec().execute({
+        sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,
+        args: [orgId, ownerEmail],
+    });
+    const role = result.rows[0]?.role;
+    return typeof role === "string" ? role : null;
+}
+async function resolveScope(input, scope, requestedUserEmail) {
+    const viewerEmail = normalizeEmail(input.ownerEmail);
+    const orgId = input.orgId?.trim() || null;
+    const role = await getOrgRole(orgId, viewerEmail);
+    const canViewWorkspace = Boolean(orgId && (role === "owner" || role === "admin"));
+    if (scope === "workspace" && !canViewWorkspace) {
+        throw new ForbiddenError("Only organization owners and admins can view workspace usage metrics.");
+    }
+    const members = orgId
+        ? await listOrgMembers(orgId)
+        : [{ email: viewerEmail, role }];
+    const availableMembers = members.length > 0 ? members : [{ email: viewerEmail, role }];
+    const requested = requestedUserEmail?.trim().toLowerCase() || null;
+    const selectedUserEmail = scope === "me"
+        ? viewerEmail
+        : requested
+            ? (availableMembers.find((member) => member.email.toLowerCase() === requested)?.email ?? null)
+            : null;
+    if (scope === "workspace" && requested && !selectedUserEmail) {
+        throw new ForbiddenError("The selected user is not available in this workspace.");
+    }
+    const selectedEmails = selectedUserEmail
+        ? [selectedUserEmail]
+        : availableMembers.map((member) => member.email);
+    if (selectedEmails.length === 0) {
+        throw new Error("The usage scope has no available users.");
+    }
+    const placeholders = selectedEmails.map(() => "?").join(", ");
+    const orgScope = orgId
+        ? { where: "org_id = ?", args: [orgId] }
+        : { where: "", args: [] };
+    return {
+        ownerScope: {
+            where: [orgScope.where, `LOWER(owner_email) IN (${placeholders})`]
+                .filter(Boolean)
+                .join(" AND "),
+            args: [
+                ...orgScope.args,
+                ...selectedEmails.map((email) => email.toLowerCase()),
+            ],
+        },
+        selectedUserEmail,
+        members: availableMembers,
+        access: {
+            viewerEmail,
+            orgId,
+            role,
+            canViewWorkspace,
+            totalUsers: availableMembers.length,
+        },
+    };
+}
+function buildUsageCost(row) {
+    return numberField(row, "cost_x100") / 100;
+}
+function bucketFromRow(row) {
+    const key = stringField(row, "k");
+    return {
+        key,
+        label: key || "Unattributed",
+        costCents: buildUsageCost(row),
+        calls: numberField(row, "calls"),
+        inputTokens: numberField(row, "input_tokens"),
+        outputTokens: numberField(row, "output_tokens"),
+        cacheReadTokens: numberField(row, "cache_read_tokens"),
+        cacheWriteTokens: numberField(row, "cache_write_tokens"),
+        activeUsers: numberField(row, "active_users"),
+        lastActiveAt: row.last_active_at == null ? null : numberField(row, "last_active_at"),
+    };
+}
+async function usageBuckets(columnExpression, scope, appScope, sinceMs, limit) {
+    const result = await getDbExec().execute({
+        sql: `SELECT ${columnExpression} AS k,
+        COALESCE(SUM(cost_cents_x100), 0) AS cost_x100,
+        COUNT(*) AS calls,
+        COALESCE(SUM(input_tokens), 0) AS input_tokens,
+        COALESCE(SUM(output_tokens), 0) AS output_tokens,
+        COALESCE(SUM(cache_read_tokens), 0) AS cache_read_tokens,
+        COALESCE(SUM(cache_write_tokens), 0) AS cache_write_tokens,
+        COUNT(DISTINCT owner_email) AS active_users,
+        MAX(created_at) AS last_active_at
+      FROM token_usage
+      WHERE ${appScope.where} AND ${scope.where} AND created_at >= ?
+      GROUP BY ${columnExpression}
+      ORDER BY cost_x100 DESC
+      LIMIT ?`,
+        args: [...appScope.args, ...scope.args, sinceMs, limit],
+    });
+    return result.rows.map(bucketFromRow);
+}
+function parseJson(value) {
+    if (typeof value !== "string" || !value.trim())
+        return null;
+    try {
+        const parsed = JSON.parse(value);
+        return parsed && typeof parsed === "object"
+            ? parsed
+            : null;
+    }
+    catch {
+        // coercion-ok: malformed persisted metadata is absent from optional prompt enrichment.
+        return null;
+    }
+}
+function promptText(value) {
+    if (typeof value === "string")
+        return value.trim();
+    if (!Array.isArray(value))
+        return "";
+    return value
+        .map((part) => {
+        if (!part || typeof part !== "object")
+            return "";
+        const record = part;
+        return record.type === "text" && typeof record.text === "string"
+            ? record.text.trim()
+            : "";
+    })
+        .filter(Boolean)
+        .join("\n")
+        .trim();
+}
+function firstUserPrompt(threadData) {
+    const parsed = parseJson(threadData);
+    const messages = parsed?.messages;
+    if (!Array.isArray(messages))
+        return null;
+    for (const entry of messages) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const record = entry;
+        const message = record.message && typeof record.message === "object"
+            ? record.message
+            : record;
+        const role = typeof message.role === "string" ? message.role : "";
+        if (role !== "user" && role !== "human")
+            continue;
+        const text = promptText(message.content);
+        if (text)
+            return text.length > 360 ? `${text.slice(0, 359).trimEnd()}…` : text;
+    }
+    return null;
+}
+async function hydrateRecentPrompts(rows) {
+    const threadIds = [
+        ...new Set(rows
+            .map((row) => nullableStringField(row, "thread_id"))
+            .filter((value) => Boolean(value))),
+    ];
+    const threads = new Map();
+    let threadQueryUnavailable = false;
+    if (threadIds.length > 0) {
+        try {
+            const result = await getDbExec().execute({
+                sql: `SELECT id, preview, thread_data FROM chat_threads WHERE id IN (${threadIds.map(() => "?").join(", ")})`,
+                args: threadIds,
+            });
+            for (const row of result.rows) {
+                const id = typeof row.id === "string" ? row.id : "";
+                if (id)
+                    threads.set(id, row);
+            }
+        }
+        catch {
+            threadQueryUnavailable = true;
+        }
+    }
+    return rows.map((row) => {
+        const threadId = nullableStringField(row, "thread_id");
+        const thread = threadId ? threads.get(threadId) : undefined;
+        const prompt = thread ? firstUserPrompt(thread.thread_data) : null;
+        const preview = typeof thread?.preview === "string" ? thread.preview.trim() : "";
+        return {
+            id: numberField(row, "id"),
+            createdAt: numberField(row, "created_at"),
+            ownerEmail: stringField(row, "owner_email"),
+            app: stringField(row, "app") || "unattributed",
+            label: stringField(row, "label") || "chat",
+            model: stringField(row, "model") || "unknown",
+            inputTokens: numberField(row, "input_tokens"),
+            outputTokens: numberField(row, "output_tokens"),
+            cacheReadTokens: numberField(row, "cache_read_tokens"),
+            cacheWriteTokens: numberField(row, "cache_write_tokens"),
+            costCents: numberField(row, "cost_cents_x100") / 100,
+            prompt: prompt ?? (preview ? preview.slice(0, 359).trimEnd() : null),
+            promptSource: prompt
+                ? "thread"
+                : preview
+                    ? "thread-preview"
+                    : threadQueryUnavailable && threadId
+                        ? "unavailable"
+                        : "not-captured",
+            threadId,
+        };
+    });
+}
+async function detectUsageEngineName() {
+    try {
+        const { getSetting } = await import("../settings/store.js");
+        const stored = (await getSetting("agent-engine"));
+        if (typeof stored?.engine === "string" && stored.engine.trim()) {
+            return stored.engine;
+        }
+    }
+    catch {
+        // coercion-ok: engine settings are optional; raw usage rows remain authoritative.
+        // The metrics action can still render USD estimates when engine settings
+        // are unavailable; the underlying usage rows remain authoritative.
+    }
+    return process.env.AGENT_ENGINE ?? null;
+}
+export async function listAppUsageMetrics(input, accessInput) {
+    const scope = input.scope === "workspace" ? "workspace" : "me";
+    const sinceDays = Math.max(1, Math.min(365, input.sinceDays ?? 30));
+    const now = Date.now();
+    const sinceMs = now - sinceDays * DAY_MS;
+    const app = accessInput.app.trim() || "this app";
+    const appKey = normalizeUsageAppKey(app);
+    const appScope = usageAppScope(app);
+    const resolved = await resolveScope(accessInput, scope, input.userEmail);
+    const baseArgs = [...appScope.args, ...resolved.ownerScope.args, sinceMs];
+    const [totalsResult, byLabel, byModel, dailyResult, recentResult] = await Promise.all([
+        getDbExec().execute({
+            sql: `SELECT
+            COALESCE(SUM(cost_cents_x100), 0) AS cost_x100,
+            COUNT(*) AS calls,
+            COALESCE(SUM(input_tokens), 0) AS input_tokens,
+            COALESCE(SUM(output_tokens), 0) AS output_tokens,
+            COALESCE(SUM(cache_read_tokens), 0) AS cache_read_tokens,
+            COALESCE(SUM(cache_write_tokens), 0) AS cache_write_tokens,
+            COUNT(DISTINCT owner_email) AS active_users
+          FROM token_usage
+          WHERE ${appScope.where} AND ${resolved.ownerScope.where} AND created_at >= ?`,
+            args: baseArgs,
+        }),
+        usageBuckets("COALESCE(NULLIF(label, ''), 'chat')", resolved.ownerScope, appScope, sinceMs, 6),
+        usageBuckets("COALESCE(NULLIF(model, ''), 'unknown')", resolved.ownerScope, appScope, sinceMs, 4),
+        getDbExec().execute({
+            sql: `SELECT created_at, cost_cents_x100, input_tokens, output_tokens,
+            cache_read_tokens, cache_write_tokens FROM token_usage
+          WHERE ${appScope.where} AND ${resolved.ownerScope.where} AND created_at >= ?
+          ORDER BY created_at ASC`,
+            args: baseArgs,
+        }),
+        getDbExec().execute({
+            sql: `SELECT id, created_at, owner_email, app, label, model,
+            input_tokens, output_tokens, cache_read_tokens, cache_write_tokens,
+            cost_cents_x100, thread_id
+          FROM token_usage
+          WHERE ${appScope.where} AND ${resolved.ownerScope.where} AND created_at >= ?
+          ORDER BY created_at DESC
+          LIMIT 12`,
+            args: baseArgs,
+        }),
+    ]);
+    const totals = (totalsResult.rows[0] ?? {});
+    const dayMap = new Map();
+    for (const row of dailyResult.rows) {
+        const date = new Date(numberField(row, "created_at"))
+            .toISOString()
+            .slice(0, 10);
+        const current = dayMap.get(date) ?? { costX100: 0, calls: 0, tokens: 0 };
+        current.costX100 += numberField(row, "cost_cents_x100");
+        current.calls += 1;
+        current.tokens +=
+            numberField(row, "input_tokens") +
+                numberField(row, "output_tokens") +
+                numberField(row, "cache_read_tokens") +
+                numberField(row, "cache_write_tokens");
+        dayMap.set(date, current);
+    }
+    const daily = [...dayMap.entries()]
+        .map(([date, value]) => ({
+        date,
+        costCents: value.costX100 / 100,
+        calls: value.calls,
+        tokens: value.tokens,
+    }))
+        .sort((a, b) => a.date.localeCompare(b.date));
+    const today = new Date(now).toISOString().slice(0, 10);
+    const currentDay = daily.find((row) => row.date === today) ?? {
+        date: today,
+        costCents: 0,
+        calls: 0,
+        tokens: 0,
+    };
+    const billing = usageBillingForEngine(await detectUsageEngineName());
+    const recent = await hydrateRecentPrompts(recentResult.rows);
+    return {
+        billing,
+        app,
+        appKey,
+        viewScope: scope,
+        selectedUserEmail: resolved.selectedUserEmail,
+        availableUsers: resolved.members
+            .map(({ email, role }) => ({ email, role }))
+            .sort((a, b) => a.email.localeCompare(b.email)),
+        sinceMs,
+        sinceDays,
+        generatedAt: now,
+        access: resolved.access,
+        totals: {
+            costCents: buildUsageCost(totals),
+            calls: numberField(totals, "calls"),
+            inputTokens: numberField(totals, "input_tokens"),
+            outputTokens: numberField(totals, "output_tokens"),
+            cacheReadTokens: numberField(totals, "cache_read_tokens"),
+            cacheWriteTokens: numberField(totals, "cache_write_tokens"),
+            activeUsers: numberField(totals, "active_users"),
+        },
+        currentDay: {
+            costCents: currentDay.costCents,
+            credits: builderCreditsFromCostCents(currentDay.costCents),
+            calls: currentDay.calls,
+            tokens: currentDay.tokens,
+        },
+        byLabel,
+        byModel,
+        daily,
+        recent,
+    };
+}

package/dist/usage/store.js

@@ -313,6 +313,16 @@ export async function recordUsage(recordOrOwner, inputTokens, outputTokens, mode
             Date.now(),
         ],
     });
+    // Alert delivery is deliberately detached from the usage write. A provider
+    // or email outage must not make a successful model call fail, and the alert
+    // evaluator serializes its own work so the hot path stays one insert.
+    void import("./alerts-store.js")
+        .then(({ enqueueUsageAlertEvaluation }) => {
+        return enqueueUsageAlertEvaluation(record);
+    })
+        .catch((error) => {
+        console.error("[usage-alerts] could not enqueue evaluation:", error);
+    });
 }
 /** Total cost (in cents) charged against a user, across all time. */
 export async function getUserUsageCents(ownerEmail) {

package/dist/vite/action-types-plugin.js

@@ -73,6 +73,22 @@ const CORE_SHARING_ACTIONS = [
         name: "upload-image",
         specifier: "@agent-native/core/file-upload/actions/upload-image",
     },
+    {
+        name: "list-workspace-user-groups",
+        specifier: "@agent-native/core/workspace-connections/actions/list-workspace-user-groups",
+    },
+    {
+        name: "upsert-workspace-user-group",
+        specifier: "@agent-native/core/workspace-connections/actions/upsert-workspace-user-group",
+    },
+    {
+        name: "bulk-update-workspace-user-groups",
+        specifier: "@agent-native/core/workspace-connections/actions/bulk-update-workspace-user-groups",
+    },
+    {
+        name: "delete-workspace-user-group",
+        specifier: "@agent-native/core/workspace-connections/actions/delete-workspace-user-group",
+    },
     {
         name: "context-manifest-get",
         specifier: "@agent-native/core/agent/context-xray/actions/context-manifest-get",
@@ -101,6 +117,18 @@ const CORE_SHARING_ACTIONS = [
         name: "set-localization-preference",
         specifier: "@agent-native/core/localization/actions/set-localization-preference",
     },
+    {
+        name: "get-usage-alerts",
+        specifier: "@agent-native/core/usage/actions/get-usage-alerts",
+    },
+    {
+        name: "manage-usage-alert",
+        specifier: "@agent-native/core/usage/actions/manage-usage-alert",
+    },
+    {
+        name: "get-usage-metrics",
+        specifier: "@agent-native/core/usage/actions/get-usage-metrics",
+    },
     {
         name: "create-resource-version",
         specifier: "@agent-native/core/history/actions/create-resource-version",

package/dist/vite/agent-native-config-loader.d.ts

@@ -4,6 +4,12 @@ export declare const AGENT_NATIVE_CONFIG_FILE_CANDIDATES: readonly ["agent-nativ
 export declare function createAgentNativeConfigContext(command: AgentNativeConfigContext["command"] | undefined, mode: string): AgentNativeConfigContext;
 export declare function readAgentNativeJsonConfig(cwd: string): AgentNativeConfig;
 export declare function loadAgentNativeConfigFile(cwd: string): Promise<AgentNativeConfigInput | undefined>;
+/**
+ * Load the optional config owned by the workspace root. App-local config is
+ * loaded separately so each app can override the shared policy without a
+ * generated copy of the file.
+ */
+export declare function loadWorkspaceAgentNativeConfigFile(cwd: string): Promise<AgentNativeConfigInput | undefined>;
 export declare function loadResolvedAgentNativeConfig(cwd: string, context: AgentNativeConfigContext, options?: {
     loadProjectConfig?: boolean;
     projectConfig?: AgentNativeConfigInput;

package/dist/vite/agent-native-config-loader.js

@@ -32,7 +32,31 @@ export function readAgentNativeJsonConfig(cwd) {
     return normalizeAgentNativeConfig(parsed, configPath);
 }
 export async function loadAgentNativeConfigFile(cwd) {
-    const configPath = AGENT_NATIVE_CONFIG_FILE_CANDIDATES.map((filename) => path.join(cwd, filename)).find((candidate) => fs.existsSync(candidate));
+    const configPath = findConfigPath(cwd);
+    if (!configPath)
+        return undefined;
+    try {
+        const module = (await import(pathToFileURL(configPath).href));
+        const config = module.default ?? module.agentNativeConfig;
+        if (typeof config !== "object" && typeof config !== "function") {
+            throw new Error("the default export must be an object or function");
+        }
+        return config;
+    }
+    catch (error) {
+        throw new Error(`Could not load ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * Load the optional config owned by the workspace root. App-local config is
+ * loaded separately so each app can override the shared policy without a
+ * generated copy of the file.
+ */
+export async function loadWorkspaceAgentNativeConfigFile(cwd) {
+    const workspaceRoot = findWorkspaceRoot(cwd);
+    if (!workspaceRoot || workspaceRoot === path.resolve(cwd))
+        return undefined;
+    const configPath = findConfigPath(workspaceRoot);
     if (!configPath)
         return undefined;
     try {
@@ -48,9 +72,37 @@ export async function loadAgentNativeConfigFile(cwd) {
     }
 }
 export async function loadResolvedAgentNativeConfig(cwd, context, options = {}) {
+    const workspaceConfig = options.loadProjectConfig === false
+        ? undefined
+        : await loadWorkspaceAgentNativeConfigFile(cwd);
     const projectConfig = options.projectConfig ??
         (options.loadProjectConfig === false
             ? undefined
             : await loadAgentNativeConfigFile(cwd));
-    return resolveAgentNativeConfig(mergeAgentNativeConfigs(readAgentNativeJsonConfig(cwd), projectConfig ? resolveAgentNativeConfig(projectConfig, context) : {}), context);
+    return resolveAgentNativeConfig(mergeAgentNativeConfigs(mergeAgentNativeConfigs(workspaceConfig
+        ? resolveAgentNativeConfig(workspaceConfig, context)
+        : {}, readAgentNativeJsonConfig(cwd)), projectConfig ? resolveAgentNativeConfig(projectConfig, context) : {}), context);
+}
+function findConfigPath(cwd) {
+    return AGENT_NATIVE_CONFIG_FILE_CANDIDATES.map((filename) => path.join(cwd, filename)).find((candidate) => fs.existsSync(candidate));
+}
+function findWorkspaceRoot(cwd) {
+    let current = path.resolve(cwd);
+    while (true) {
+        const packagePath = path.join(current, "package.json");
+        if (fs.existsSync(packagePath)) {
+            try {
+                const packageJson = JSON.parse(fs.readFileSync(packagePath, "utf8"));
+                if (packageJson["agent-native"]?.workspaceCore)
+                    return current;
+            }
+            catch (error) {
+                throw new Error(`Could not read workspace manifest ${packagePath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+            }
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
 }

package/dist/vite/client.js

@@ -17,7 +17,7 @@ import { normalizeMcpIntegrationsConfig, } from "../shared/mcp-integration-confi
 import { normalizeAgentNativeRouteWarmupConfig, } from "../shared/route-warmup-config.js";
 import { formatRuntimeConfigReport, getRuntimeConfigReport, } from "../shared/runtime-config.js";
 import { actionTypesPlugin } from "./action-types-plugin.js";
-import { createAgentNativeConfigContext, loadAgentNativeConfigFile, readAgentNativeJsonConfig, } from "./agent-native-config-loader.js";
+import { createAgentNativeConfigContext, loadAgentNativeConfigFile, loadWorkspaceAgentNativeConfigFile, readAgentNativeJsonConfig, } from "./agent-native-config-loader.js";
 import { agentsBundlePlugin } from "./agents-bundle-plugin.js";
 const require = createRequire(import.meta.url);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -927,6 +927,7 @@ const CORE_CLIENT_SUBPATHS = [
     "@agent-native/core/client/notifications",
     "@agent-native/core/client/progress",
     "@agent-native/core/client/transcription/use-live-transcription",
+    "@agent-native/core/workspace-connections/credential-key-aliases",
     "@agent-native/core/voice",
 ];
 const NODE_SSR_NATIVE_EXTERNALS = ["better-sqlite3", "bindings"];
@@ -1236,6 +1237,7 @@ function getCoreSourceAliases(cwd) {
         "@agent-native/core/resources": path.join(coreSrc, "resources/index.ts"),
         "@agent-native/core/oauth-tokens": path.join(coreSrc, "oauth-tokens/index.ts"),
         "@agent-native/core/workspace-connections": path.join(coreSrc, "workspace-connections/index.ts"),
+        "@agent-native/core/workspace-connections/credential-key-aliases": path.join(coreSrc, "workspace-connections/credential-key-aliases.ts"),
         "@agent-native/core/provider-api": path.join(coreSrc, "provider-api/index.ts"),
         "@agent-native/core/a2a": path.join(coreSrc, "a2a/index.ts"),
         "@agent-native/core/router": path.join(coreSrc, "router/index.ts"),
@@ -2966,10 +2968,14 @@ function createAgentNativeConfigPlugin(options) {
         name: "agent-native-config",
         enforce: "pre",
         async config(config, env) {
-            const projectConfig = options.agentNativeConfig === undefined
-                ? await loadAgentNativeConfigFile(process.cwd())
-                : undefined;
-            return createAgentNativeConfig(options, env.command, config, env.mode, projectConfig);
+            const context = createAgentNativeConfigContext(env.command, env.mode);
+            const workspaceConfig = await loadWorkspaceAgentNativeConfigFile(process.cwd());
+            const projectConfig = options.agentNativeConfig ??
+                (await loadAgentNativeConfigFile(process.cwd()));
+            const resolvedConfig = mergeAgentNativeConfigs(workspaceConfig
+                ? resolveAgentNativeConfig(workspaceConfig, context)
+                : {}, projectConfig ? resolveAgentNativeConfig(projectConfig, context) : {});
+            return createAgentNativeConfig(options, env.command, config, env.mode, resolvedConfig);
         },
     };
 }

package/dist/workspace-connections/actions/bulk-update-workspace-user-groups.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    groupId: string;
+    memberEmails: string[];
+    operation: "add" | "remove";
+}, import("../groups.js").WorkspaceUserGroup>;
+export default _default;

package/dist/workspace-connections/actions/bulk-update-workspace-user-groups.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { assertWorkspaceUserGroupManager, updateWorkspaceUserGroupMembers, } from "../groups.js";
+export default defineAction({
+    description: "Add or remove multiple workspace members from one reusable user group. Only workspace owners and admins can change group membership.",
+    schema: z.object({
+        groupId: z.string().min(1).describe("User group ID to update."),
+        memberEmails: z
+            .array(z.string().email())
+            .min(1)
+            .max(100)
+            .describe("Workspace member email addresses to change."),
+        operation: z.enum(["add", "remove"]).describe("Membership operation."),
+    }),
+    run: async (args, ctx) => {
+        await assertWorkspaceUserGroupManager(ctx?.orgId, ctx?.userEmail);
+        return updateWorkspaceUserGroupMembers({
+            id: args.groupId,
+            memberEmails: args.memberEmails,
+            operation: args.operation,
+            orgId: ctx?.orgId,
+        });
+    },
+});

package/dist/workspace-connections/actions/delete-workspace-user-group.d.ts

@@ -0,0 +1,7 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    id: string;
+}, {
+    id: string;
+    deleted: true;
+}>;
+export default _default;

package/dist/workspace-connections/actions/delete-workspace-user-group.js

@@ -0,0 +1,29 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { assertWorkspaceUserGroupManager, deleteWorkspaceUserGroup, listWorkspaceUserGroupsForOrg, } from "../groups.js";
+import { listWorkspaceConnections } from "../store.js";
+export default defineAction({
+    description: "Delete a reusable workspace user group after it is removed from shared connections. Only workspace owners and admins can delete groups.",
+    schema: z.object({
+        id: z.string().min(1).describe("User group ID to delete."),
+    }),
+    run: async ({ id }, ctx) => {
+        await assertWorkspaceUserGroupManager(ctx?.orgId, ctx?.userEmail);
+        const orgId = ctx?.orgId ?? "";
+        const group = (await listWorkspaceUserGroupsForOrg(orgId, [id]))[0];
+        if (!group)
+            throw new Error(`User group "${id}" was not found.`);
+        const connections = await listWorkspaceConnections({
+            includeDisabled: true,
+        });
+        const references = connections.filter((connection) => connection.orgId === orgId &&
+            (connection.allowedUserGroups ?? []).includes(group.id));
+        if (references.length > 0) {
+            throw new Error(`Remove "${group.name}" from ${references.length === 1 ? "its connection" : `${references.length} connections`} before deleting the group.`);
+        }
+        const deleted = await deleteWorkspaceUserGroup(id, orgId);
+        if (!deleted)
+            throw new Error(`User group "${id}" was not found.`);
+        return { id, deleted };
+    },
+});

package/dist/workspace-connections/actions/list-workspace-user-groups.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("../../action.js").ActionDefinition<Record<string, never>, import("../groups.js").WorkspaceUserGroup[]>;
+export default _default;

package/dist/workspace-connections/actions/list-workspace-user-groups.js

@@ -0,0 +1,13 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { assertWorkspaceUserGroupManager, listWorkspaceUserGroupsForOrg, } from "../groups.js";
+export default defineAction({
+    description: "List reusable workspace user groups. Group management is restricted to workspace owners and admins.",
+    schema: z.object({}),
+    http: { method: "GET" },
+    readOnly: true,
+    run: async (_args, ctx) => {
+        await assertWorkspaceUserGroupManager(ctx?.orgId, ctx?.userEmail);
+        return listWorkspaceUserGroupsForOrg(ctx?.orgId ?? "");
+    },
+});

package/dist/workspace-connections/actions/upsert-workspace-user-group.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    id?: string;
+    name: string;
+    memberEmails?: string[];
+}, import("../groups.js").WorkspaceUserGroup>;
+export default _default;