@agent-native/core 0.153.0 → 0.153.2

package/dist/client/sharing/ShareButton.js

@@ -1,4 +1,5 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Collapsible, CollapsibleContent, CollapsibleTrigger, } from "@agent-native/toolkit/ui";
 import * as Select from "@radix-ui/react-select";
 import { IconLock, IconWorld, IconTrash, IconCheck, IconChevronDown, IconCopy, IconLoader2, IconSearch, IconSearchOff, IconShare3, IconUsersGroup, } from "@tabler/icons-react";
 import { useEffect, useId, useRef, useState, } from "react";
@@ -114,25 +115,29 @@ function SharePanel(props) {
         (Boolean(props.shareUrl) ||
             Boolean(props.shareUrlPlaceholder) ||
             Boolean(props.secondaryShareUrl));
-    const shareUrlPlacement = props.shareUrlPlacement ?? "bottom";
+    const shareUrlPlacement = props.shareUrlPlacement ?? "top";
+    const [advancedOpen, setAdvancedOpen] = useState(!showShareLinks);
+    useEffect(() => {
+        setAdvancedOpen(!showShareLinks);
+    }, [props.resourceId, showShareLinks]);
     const extraTabs = props.shareTabs?.tabs ?? [];
     const hasTabs = extraTabs.length > 0;
     const shareTabLabel = props.shareTabs?.shareLabel ?? "Share link";
     const titleText = resourceTitle
         ? `Share "${resourceTitle}"`
         : `Share ${props.resourceType}`;
-    const sharePanel = isLoading ? (_jsxs("div", { children: [!hasTabs ? (_jsx("div", { className: "mb-3 truncate text-base font-semibold", title: titleText, children: titleText })) : null, _jsx("div", { className: "mb-4 h-9 rounded-md bg-muted animate-pulse" }), _jsx("div", { className: "mb-2 text-sm font-semibold", children: peopleAccessLabel }), _jsx("div", { className: "mb-4 h-7 rounded-md bg-muted animate-pulse" }), _jsx("div", { className: "mb-2 text-sm font-semibold", children: generalAccessLabel }), _jsx("div", { className: "mb-4 h-9 rounded-md bg-muted animate-pulse" })] })) : (_jsxs("div", { children: [!hasTabs ? (_jsx("div", { className: "mb-3 truncate text-base font-semibold", title: titleText, children: titleText })) : null, showShareLinks && shareUrlPlacement === "top" ? shareLinks : null, canManage ? (_jsxs("div", { className: "mb-4 space-y-2", children: [_jsxs("div", { className: "flex items-stretch gap-2", children: [_jsx(MemberAutocomplete, { value: inviteEmail, open: suggestionsOpen, onOpenChange: setSuggestionsOpen, onValueChange: (next) => {
-                                    onInviteEmailChange(next);
-                                    if (shareError)
-                                        setShareError(null);
-                                }, onSelectMember: (member) => {
-                                    onInviteEmailChange(member.email);
-                                    setSuggestionsOpen(false);
-                                    if (shareError)
-                                        setShareError(null);
-                                }, onSubmit: handleAdd, placeholder: policy.requireOrgMemberForUserShares
-                                    ? "Add people from your organization"
-                                    : "Add people by email", suggestions: memberSuggestions, search: memberSearch }), _jsx(RoleSelect, { value: role, onChange: setRole, roleCopy: props.roleCopy, allowedRoles: props.allowedRoles }), _jsx("button", { type: "button", onClick: handleAdd, disabled: !hasInviteEmail, className: BUTTON_PRIMARY_SM, children: "Add" })] }), shareError ? (_jsx("div", { role: "alert", className: "rounded-md border border-destructive/40 bg-destructive/10 px-3 py-2 text-xs text-destructive", children: shareError })) : null, hasInviteEmail ? (_jsxs("div", { className: "flex flex-wrap items-center gap-x-3 gap-y-2 text-xs text-muted-foreground", children: [_jsxs("label", { className: "inline-flex items-center gap-2", children: [_jsx("input", { type: "checkbox", checked: notifyPeople, onChange: (e) => setNotifyPeople(e.target.checked), className: "h-4 w-4 rounded border-input accent-primary" }), "Notify people"] }), notifyPeople ? (_jsx("button", { type: "button", "aria-expanded": messageOpen, onClick: () => setMessageOpen(!messageOpen), className: "rounded-sm px-1 py-0.5 font-medium text-foreground underline decoration-border underline-offset-2 transition-colors hover:bg-accent hover:text-accent-foreground", children: messageOpen ? "Hide message" : "Add a message" })) : null] })) : null, hasInviteEmail && notifyPeople && messageOpen ? (_jsx("div", { className: "rounded-md border border-border/70 bg-muted/20 p-2.5", children: _jsx("textarea", { "aria-label": "Message", placeholder: "Add a short note (optional)", value: shareMessage, onChange: (event) => setShareMessage(event.target.value), maxLength: 500, rows: 3, className: "w-full resize-y rounded-md border border-input bg-card px-3 py-2 text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 focus:ring-offset-background" }) })) : null] })) : null, _jsx("div", { className: "mb-2 text-sm font-semibold", children: peopleAccessLabel }), _jsxs("ul", { className: "mb-4 flex flex-col gap-1 list-none p-0 m-0", children: [data?.ownerEmail ? (_jsxs("li", { className: "flex items-center gap-3 px-1 py-1.5 text-sm", children: [_jsx(Avatar, { label: displayName(data.ownerEmail, knownMembers) }), _jsx("span", { className: "flex-1 min-w-0 truncate", children: displayName(data.ownerEmail, knownMembers) }), _jsx("span", { className: "text-xs text-muted-foreground", children: "Owner" })] })) : null, shares.map((s) => (_jsxs("li", { className: cn("flex items-center gap-3 px-1 py-1.5 text-sm", inFlight.has(keyOf(s)) && "opacity-60"), children: [_jsx(Avatar, { label: principalLabel(s, knownMembers), org: s.principalType === "org" }), _jsx("span", { className: "flex-1 min-w-0 truncate", children: principalLabel(s, knownMembers) }), canManage ? (_jsx(RoleSelect, { value: s.role, onChange: (r) => handleChangeRole(s, r), disabled: inFlight.has(keyOf(s)), plain: true, roleCopy: props.roleCopy, allowedRoles: props.allowedRoles })) : (_jsx("span", { className: "text-xs text-muted-foreground", children: roleMeta(s.role, props.roleCopy).label })), canManage ? (_jsx("button", { type: "button", "aria-label": "Remove", onClick: () => handleRemove(s), disabled: inFlight.has(keyOf(s)), className: BUTTON_GHOST_ICON, children: _jsx(IconTrash, { size: 14 }) })) : null] }, keyOf(s)))), !shares.length && !data?.ownerEmail ? (_jsx("li", { className: "px-1 py-1.5 text-sm text-muted-foreground", children: "No one has access yet." })) : null] }), _jsx("div", { className: "mb-2 text-sm font-semibold", children: generalAccessLabel }), _jsxs("div", { className: "mb-4 flex items-center gap-3", children: [_jsx("span", { "aria-hidden": true, className: "inline-flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground", children: _jsx(meta.Icon, { size: 16, strokeWidth: 1.75 }) }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsx(VisibilitySelect, { value: visibility, onChange: handleVisibility, disabled: !canManage, visibilityCopy: props.visibilityCopy, allowPublic: policy.allowPublic }), _jsxs("div", { className: "mt-0.5 flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground", children: [_jsx("span", { children: meta.description }), visibility === "org" && props.hideInSearchControl ? (_jsx(AdvancedAccessPopover, { control: props.hideInSearchControl, canManage: canManage, onToggle: handleHideInSearch })) : null] })] })] }), shareError && !canManage ? (_jsx("div", { role: "alert", className: "mb-4 rounded-md border border-destructive/40 bg-destructive/10 px-3 py-2 text-xs text-destructive", children: shareError })) : null, props.accessNote ? (_jsx("div", { className: "mb-4 rounded-md border border-border bg-muted/35 p-3 text-xs text-muted-foreground", children: props.accessNote })) : null, showShareLinks && shareUrlPlacement === "bottom" ? shareLinks : null, props.shareFooterContent] }));
+    const sharePanel = isLoading ? (_jsxs("div", { children: [!hasTabs ? (_jsx("div", { className: "mb-3 truncate text-base font-semibold", title: titleText, children: titleText })) : null, _jsx("div", { className: "mb-4 h-9 rounded-md bg-muted animate-pulse" }), _jsx("div", { className: "mb-2 text-sm font-semibold", children: peopleAccessLabel }), _jsx("div", { className: "mb-4 h-7 rounded-md bg-muted animate-pulse" }), _jsx("div", { className: "mb-2 text-sm font-semibold", children: generalAccessLabel }), _jsx("div", { className: "mb-4 h-9 rounded-md bg-muted animate-pulse" })] })) : (_jsxs("div", { children: [!hasTabs ? (_jsx("div", { className: "mb-3 truncate text-base font-semibold", title: titleText, children: titleText })) : null, showShareLinks && shareUrlPlacement === "top" ? shareLinks : null, _jsxs(Collapsible, { open: advancedOpen, onOpenChange: setAdvancedOpen, className: "mb-4 overflow-hidden rounded-md border border-border", children: [_jsx(CollapsibleTrigger, { asChild: true, children: _jsxs("button", { type: "button", className: "flex min-h-10 w-full items-center justify-between gap-3 px-3 py-2 text-left text-sm font-medium transition-colors hover:bg-accent focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset", children: [_jsxs("span", { className: "flex min-w-0 items-center gap-2 truncate", children: [_jsx(IconUsersGroup, { "aria-hidden": true, size: 15, strokeWidth: 1.8, className: "shrink-0 text-muted-foreground" }), canManage ? "Manage access" : peopleAccessLabel] }), _jsx(IconChevronDown, { "aria-hidden": true, size: 16, strokeWidth: 1.8, className: cn("shrink-0 text-muted-foreground transition-transform", advancedOpen && "rotate-180") })] }) }), _jsx(CollapsibleContent, { className: "border-t border-border px-3 py-3", children: _jsxs("div", { className: "space-y-4", children: [canManage ? (_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-stretch gap-2", children: [_jsx(MemberAutocomplete, { value: inviteEmail, open: suggestionsOpen, onOpenChange: setSuggestionsOpen, onValueChange: (next) => {
+                                                        onInviteEmailChange(next);
+                                                        if (shareError)
+                                                            setShareError(null);
+                                                    }, onSelectMember: (member) => {
+                                                        onInviteEmailChange(member.email);
+                                                        setSuggestionsOpen(false);
+                                                        if (shareError)
+                                                            setShareError(null);
+                                                    }, onSubmit: handleAdd, placeholder: policy.requireOrgMemberForUserShares
+                                                        ? "Add people from your organization"
+                                                        : "Add people by email", suggestions: memberSuggestions, search: memberSearch }), _jsx(RoleSelect, { value: role, onChange: setRole, roleCopy: props.roleCopy, allowedRoles: props.allowedRoles }), _jsx("button", { type: "button", onClick: handleAdd, disabled: !hasInviteEmail, className: BUTTON_PRIMARY_SM, children: "Add" })] }), shareError ? (_jsx("div", { role: "alert", className: "rounded-md border border-destructive/40 bg-destructive/10 px-3 py-2 text-xs text-destructive", children: shareError })) : null, hasInviteEmail ? (_jsxs("div", { className: "flex flex-wrap items-center gap-x-3 gap-y-2 text-xs text-muted-foreground", children: [_jsxs("label", { className: "inline-flex items-center gap-2", children: [_jsx("input", { type: "checkbox", checked: notifyPeople, onChange: (e) => setNotifyPeople(e.target.checked), className: "h-4 w-4 rounded border-input accent-primary" }), "Notify people"] }), notifyPeople ? (_jsx("button", { type: "button", "aria-expanded": messageOpen, onClick: () => setMessageOpen(!messageOpen), className: "rounded-sm px-1 py-0.5 font-medium text-foreground underline decoration-border underline-offset-2 transition-colors hover:bg-accent hover:text-accent-foreground", children: messageOpen ? "Hide message" : "Add a message" })) : null] })) : null, hasInviteEmail && notifyPeople && messageOpen ? (_jsx("div", { className: "rounded-md border border-border/70 bg-muted/20 p-2.5", children: _jsx("textarea", { "aria-label": "Message", placeholder: "Add a short note (optional)", value: shareMessage, onChange: (event) => setShareMessage(event.target.value), maxLength: 500, rows: 3, className: "w-full resize-y rounded-md border border-input bg-card px-3 py-2 text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 focus:ring-offset-background" }) })) : null] })) : null, _jsxs("div", { children: [_jsx("div", { className: "mb-2 text-sm font-semibold", children: peopleAccessLabel }), _jsxs("ul", { className: "flex flex-col gap-1 list-none p-0 m-0", children: [data?.ownerEmail ? (_jsxs("li", { className: "flex items-center gap-3 px-1 py-1.5 text-sm", children: [_jsx(Avatar, { label: displayName(data.ownerEmail, knownMembers) }), _jsx("span", { className: "flex-1 min-w-0 truncate", children: displayName(data.ownerEmail, knownMembers) }), _jsx("span", { className: "text-xs text-muted-foreground", children: "Owner" })] })) : null, shares.map((s) => (_jsxs("li", { className: cn("flex items-center gap-3 px-1 py-1.5 text-sm", inFlight.has(keyOf(s)) && "opacity-60"), children: [_jsx(Avatar, { label: principalLabel(s, knownMembers), org: s.principalType === "org" }), _jsx("span", { className: "flex-1 min-w-0 truncate", children: principalLabel(s, knownMembers) }), canManage ? (_jsx(RoleSelect, { value: s.role, onChange: (r) => handleChangeRole(s, r), disabled: inFlight.has(keyOf(s)), plain: true, roleCopy: props.roleCopy, allowedRoles: props.allowedRoles })) : (_jsx("span", { className: "text-xs text-muted-foreground", children: roleMeta(s.role, props.roleCopy).label })), canManage ? (_jsx("button", { type: "button", "aria-label": "Remove", onClick: () => handleRemove(s), disabled: inFlight.has(keyOf(s)), className: BUTTON_GHOST_ICON, children: _jsx(IconTrash, { size: 14 }) })) : null] }, keyOf(s)))), !shares.length && !data?.ownerEmail ? (_jsx("li", { className: "px-1 py-1.5 text-sm text-muted-foreground", children: "No one has access yet." })) : null] })] })] }) })] }), _jsx("div", { className: "mb-2 text-sm font-semibold", children: generalAccessLabel }), _jsxs("div", { className: "mb-4 flex items-center gap-3", children: [_jsx("span", { "aria-hidden": true, className: "inline-flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground", children: _jsx(meta.Icon, { size: 16, strokeWidth: 1.75 }) }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsx(VisibilitySelect, { value: visibility, onChange: handleVisibility, disabled: !canManage, visibilityCopy: props.visibilityCopy, allowPublic: policy.allowPublic }), _jsxs("div", { className: "mt-0.5 flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground", children: [_jsx("span", { className: "sr-only", children: meta.description }), visibility === "org" && props.hideInSearchControl ? (_jsx(AdvancedAccessPopover, { control: props.hideInSearchControl, canManage: canManage, onToggle: handleHideInSearch })) : null] })] })] }), shareError && !canManage ? (_jsx("div", { role: "alert", className: "mb-4 rounded-md border border-destructive/40 bg-destructive/10 px-3 py-2 text-xs text-destructive", children: shareError })) : null, props.accessNote ? (_jsx("div", { className: "mb-4 rounded-md border border-border bg-muted/35 p-3 text-xs text-muted-foreground", children: props.accessNote })) : null, showShareLinks && shareUrlPlacement === "bottom" ? shareLinks : null, props.shareFooterContent] }));
     if (!hasTabs)
         return sharePanel;
     const tabs = [

package/dist/client/sharing/ShareDialog.d.ts

@@ -1,4 +1,4 @@
-import type { ReactNode } from "react";
+import { type ReactNode } from "react";
 export interface ShareDialogProps {
     open: boolean;
     onClose: () => void;

package/dist/client/sharing/ShareDialog.js

@@ -1,6 +1,8 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { ActionButton, Avatar as DesignSystemAvatar, Dialog as DesignSystemDialog, IconButton, Picker, Status, TextArea, TextField, } from "@agent-native/toolkit/design-system";
-import { IconCheck, IconCode, IconCopy, IconLink, IconLock, IconMail, IconTrash, IconUsersGroup, IconWorld, } from "@tabler/icons-react";
+import { Collapsible, CollapsibleContent, CollapsibleTrigger, } from "@agent-native/toolkit/ui";
+import { IconCheck, IconCode, IconCopy, IconChevronDown, IconLink, IconLock, IconMail, IconTrash, IconUsersGroup, IconWorld, } from "@tabler/icons-react";
+import { useState } from "react";
 import { cn } from "../utils.js";
 import { useShareDialogController, } from "./useShareDialogController.js";
 const BUTTON_BASE = "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors active:!scale-100 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0";
@@ -35,7 +37,9 @@ export function ShareDialog({ open, onClose, resourceType, resourceId, resourceT
     });
     if (!open)
         return null;
-    return (_jsxs(DesignSystemDialog, { open: controller.open, onOpenChange: controller.onOpenChange, title: _jsx("span", { className: "truncate !text-base !leading-normal !tracking-normal !text-inherit", title: controller.title, children: controller.title }), closeLabel: controller.labels.close, size: "large", className: "!top-4 !z-[2010] !block !max-h-none !w-[calc(100vw-2rem)] !max-w-lg !translate-y-0 !gap-0 !overflow-visible !rounded-xl !border-border !bg-popover !p-0 !text-popover-foreground !shadow-2xl sm:!top-1/2 sm:!-translate-y-1/2", "aria-label": controller.title, children: [_jsx("div", { className: "px-5 pt-0 pb-3", children: controller.ownerLabel ? (_jsx("div", { className: "truncate text-xs text-muted-foreground", children: controller.ownerLabel })) : null }), controller.tabsEnabled ? (_jsx("div", { role: "tablist", "aria-label": controller.labels.shareOptions, className: "mx-5 mt-1 flex gap-1 border-b border-border", children: controller.tabs.map((tab) => {
+    return (_jsxs(DesignSystemDialog, { open: controller.open, onOpenChange: controller.onOpenChange, title: _jsx("span", { className: cn(controller.tabsEnabled
+                ? "sr-only"
+                : "truncate !text-base !leading-normal !tracking-normal !text-inherit"), title: controller.title, children: controller.title }), closeLabel: controller.labels.close, size: "large", className: "!top-4 !z-[2010] !block !max-h-none !w-[calc(100vw-2rem)] !max-w-lg !translate-y-0 !gap-0 !overflow-visible !rounded-xl !border-border !bg-popover !p-0 !text-popover-foreground !shadow-2xl sm:!top-1/2 sm:!-translate-y-1/2", "aria-label": controller.title, children: [!controller.tabsEnabled && controller.ownerLabel ? (_jsx("div", { className: "px-5 pt-0 pb-3", children: _jsx("div", { className: "truncate text-xs text-muted-foreground", children: controller.ownerLabel }) })) : null, controller.tabsEnabled ? (_jsx("div", { role: "tablist", "aria-label": controller.labels.shareOptions, className: "mx-5 mt-1 flex gap-1 border-b border-border", children: controller.tabs.map((tab) => {
                     const Icon = TAB_ICONS[tab.value];
                     return (_jsx(TabTrigger, { active: controller.activeTab === tab.value, onClick: () => controller.setActiveTab(tab.value), icon: _jsx(Icon, { size: 14, strokeWidth: 1.75 }), label: tab.label }, tab.value));
                 }) })) : null, _jsxs("div", { className: "px-5 py-4", children: [controller.tabsEnabled && controller.activeTab === "link" ? (_jsx(LinkTab, { controller: controller, extras: linkTabExtras })) : null, !controller.tabsEnabled || controller.activeTab === "invite" ? (_jsx(InviteTab, { controller: controller, showVisibility: !controller.tabsEnabled })) : null, controller.tabsEnabled && controller.activeTab === "embed"
@@ -49,18 +53,19 @@ function TabTrigger({ active, onClick, icon, label, }) {
 }
 function LinkTab({ controller, extras, }) {
     const Icon = VIS_ICONS[controller.visibility.value];
-    return (_jsxs("div", { className: "space-y-4", children: [_jsxs("div", { children: [_jsx("div", { className: "mb-2 text-sm font-semibold", children: controller.labels.generalAccess }), _jsxs("div", { className: "flex items-center gap-3", children: [_jsx("span", { "aria-hidden": true, className: "inline-flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground", children: _jsx(Icon, { size: 16, strokeWidth: 1.75 }) }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsx(VisibilitySelect, { controller: controller }), _jsx("div", { className: "mt-0.5 text-xs text-muted-foreground", children: controller.visibility.description })] })] })] }), _jsx(CopyField, { field: "share-link", label: controller.labels.shareLink, value: controller.shareUrl, controller: controller }), extras] }));
+    return (_jsxs("div", { className: "space-y-3", children: [_jsx(CopyField, { field: "share-link", label: controller.labels.shareLink, value: controller.shareUrl, controller: controller }), _jsxs("div", { children: [_jsx("div", { className: "mb-2 text-xs font-medium text-muted-foreground", children: controller.labels.generalAccess }), _jsxs("div", { className: "flex items-center gap-3", children: [_jsx("span", { "aria-hidden": true, className: "inline-flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground", children: _jsx(Icon, { size: 16, strokeWidth: 1.75 }) }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsx(VisibilitySelect, { controller: controller }), _jsx("div", { className: "sr-only text-xs text-muted-foreground", children: controller.visibility.description })] })] })] }), extras] }));
 }
 function InviteTab({ controller, showVisibility, }) {
     const Icon = VIS_ICONS[controller.visibility.value];
-    return (_jsxs("div", { className: "space-y-4", children: [controller.canManage ? (_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-stretch gap-2", children: [_jsx("input", { type: "email", placeholder: controller.labels.addPeopleByEmail, value: controller.invite.email, onChange: (event) => controller.invite.setEmail(event.currentTarget.value), onKeyDown: (event) => {
-                                    if (event.key === "Enter")
-                                        controller.invite.submit();
-                                }, autoComplete: "off", className: "flex-1 min-w-0 h-9 rounded-md border border-input bg-background px-3 text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 focus:ring-offset-background" }), _jsx(RoleSelect, { controller: controller })] }), controller.invite.showNotifyPeople ? (_jsxs("div", { className: "flex flex-wrap items-center gap-x-3 gap-y-2 text-xs text-muted-foreground", children: [_jsxs("label", { className: "inline-flex items-center gap-2", children: [_jsx("input", { type: "checkbox", checked: controller.invite.notifyPeople, onChange: (event) => controller.invite.setNotifyPeople(event.currentTarget.checked), className: "h-4 w-4 rounded border-input accent-primary" }), controller.labels.notifyPeople] }), controller.invite.notifyPeople ? (_jsx(ActionButton, { type: "button", emphasis: "ghost", "aria-expanded": controller.invite.messageOpen, onPress: () => controller.invite.setMessageOpen(!controller.invite.messageOpen), className: "!h-auto !rounded-sm !px-1 !py-0.5 text-xs font-medium !text-foreground underline decoration-border underline-offset-2 hover:!bg-accent hover:!text-accent-foreground active:!scale-100", children: controller.invite.messageOpen
-                                    ? controller.labels.hideMessage
-                                    : controller.labels.addMessage })) : null] })) : null, controller.invite.showNotifyPeople &&
-                        controller.invite.notifyPeople &&
-                        controller.invite.messageOpen ? (_jsx(TextArea, { "aria-label": controller.labels.addMessage, placeholder: controller.labels.messagePlaceholder, value: controller.invite.message, onChange: (value) => controller.invite.setMessage(value), maxLength: 500, rows: 3, className: "min-h-20 resize-y text-sm" })) : null] })) : null, _jsxs("div", { children: [_jsx("div", { className: "mb-2 text-sm font-semibold", children: controller.labels.peopleWithAccess }), _jsxs("ul", { className: "flex flex-col gap-1 list-none p-0 m-0", children: [controller.people.map((person) => (_jsx(PersonRow, { person: person, canManage: controller.canManage, removeLabel: controller.labels.remove, onRemove: controller.removeShare }, person.key))), !controller.people.length ? (_jsx("li", { className: "px-1 py-1.5 text-sm text-muted-foreground", children: controller.labels.noAccess })) : null] })] }), showVisibility ? (_jsxs("div", { children: [_jsx("div", { className: "mb-2 text-sm font-semibold", children: controller.labels.generalAccess }), _jsxs("div", { className: "flex items-center gap-3", children: [_jsx("span", { "aria-hidden": true, className: "inline-flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground", children: _jsx(Icon, { size: 16, strokeWidth: 1.75 }) }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsx(VisibilitySelect, { controller: controller }), _jsx("div", { className: "mt-0.5 text-xs text-muted-foreground", children: controller.visibility.description })] })] })] })) : null] }));
+    const [advancedOpen, setAdvancedOpen] = useState(false);
+    return (_jsxs("div", { className: "space-y-3", children: [_jsxs(Collapsible, { open: advancedOpen, onOpenChange: setAdvancedOpen, className: "overflow-hidden rounded-md border border-border", children: [_jsx(CollapsibleTrigger, { asChild: true, children: _jsxs("button", { type: "button", className: "flex min-h-10 w-full items-center justify-between gap-3 px-3 py-2 text-left text-sm font-medium transition-colors hover:bg-accent focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset", children: [_jsx("span", { className: "truncate", children: controller.labels.peopleWithAccess }), _jsx(IconChevronDown, { "aria-hidden": true, size: 16, strokeWidth: 1.8, className: cn("shrink-0 text-muted-foreground transition-transform", advancedOpen && "rotate-180") })] }) }), _jsx(CollapsibleContent, { className: "border-t border-border px-3 py-3", children: _jsxs("div", { className: "space-y-4", children: [controller.canManage ? (_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-stretch gap-2", children: [_jsx("input", { type: "email", placeholder: controller.labels.addPeopleByEmail, value: controller.invite.email, onChange: (event) => controller.invite.setEmail(event.currentTarget.value), onKeyDown: (event) => {
+                                                        if (event.key === "Enter")
+                                                            controller.invite.submit();
+                                                    }, autoComplete: "off", className: "h-9 min-w-0 flex-1 rounded-md border border-input bg-background px-3 text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 focus:ring-offset-background" }), _jsx(RoleSelect, { controller: controller })] }), controller.invite.showNotifyPeople ? (_jsxs("div", { className: "flex flex-wrap items-center gap-x-3 gap-y-2 text-xs text-muted-foreground", children: [_jsxs("label", { className: "inline-flex items-center gap-2", children: [_jsx("input", { type: "checkbox", checked: controller.invite.notifyPeople, onChange: (event) => controller.invite.setNotifyPeople(event.currentTarget.checked), className: "h-4 w-4 rounded border-input accent-primary" }), controller.labels.notifyPeople] }), controller.invite.notifyPeople ? (_jsx(ActionButton, { type: "button", emphasis: "ghost", "aria-expanded": controller.invite.messageOpen, onPress: () => controller.invite.setMessageOpen(!controller.invite.messageOpen), className: "!h-auto !rounded-sm !px-1 !py-0.5 text-xs font-medium !text-foreground underline decoration-border underline-offset-2 hover:!bg-accent hover:!text-accent-foreground active:!scale-100", children: controller.invite.messageOpen
+                                                        ? controller.labels.hideMessage
+                                                        : controller.labels.addMessage })) : null] })) : null, controller.invite.showNotifyPeople &&
+                                            controller.invite.notifyPeople &&
+                                            controller.invite.messageOpen ? (_jsx(TextArea, { "aria-label": controller.labels.addMessage, placeholder: controller.labels.messagePlaceholder, value: controller.invite.message, onChange: (value) => controller.invite.setMessage(value), maxLength: 500, rows: 3, className: "min-h-20 resize-y text-sm" })) : null] })) : null, _jsxs("div", { children: [_jsx("div", { className: "mb-2 text-sm font-semibold", children: controller.labels.peopleWithAccess }), _jsxs("ul", { className: "m-0 flex list-none flex-col gap-1 p-0", children: [controller.people.map((person) => (_jsx(PersonRow, { person: person, canManage: controller.canManage, removeLabel: controller.labels.remove, onRemove: controller.removeShare }, person.key))), !controller.people.length ? (_jsx("li", { className: "px-1 py-1.5 text-sm text-muted-foreground", children: controller.labels.noAccess })) : null] })] })] }) })] }), showVisibility ? (_jsxs("div", { children: [_jsx("div", { className: "mb-2 text-sm font-semibold", children: controller.labels.generalAccess }), _jsxs("div", { className: "flex items-center gap-3", children: [_jsx("span", { "aria-hidden": true, className: "inline-flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-muted text-muted-foreground", children: _jsx(Icon, { size: 16, strokeWidth: 1.75 }) }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsx(VisibilitySelect, { controller: controller }), _jsx("div", { className: "sr-only text-xs text-muted-foreground", children: controller.visibility.description })] })] })] })) : null] }));
 }
 function PersonRow({ person, canManage, removeLabel, onRemove, }) {
     return (_jsxs("li", { className: "flex items-center gap-3 px-1 py-1.5 text-sm", children: [_jsx(DesignSystemAvatar, { name: person.label, fallback: person.principalType === "org" ? (_jsx(IconUsersGroup, { size: 14, strokeWidth: 1.75 })) : (person.avatarText), size: "compact", className: "inline-flex h-7 w-7 shrink-0 text-[11px] font-semibold" }), _jsx("span", { className: "flex-1 min-w-0 truncate", children: person.label }), _jsx(Status, { tone: "neutral", size: "compact", className: "border-0 bg-transparent px-0 text-xs text-muted-foreground", children: person.roleLabel }), canManage && person.share ? (_jsx(IconButton, { intent: "danger", emphasis: "ghost", size: "compact", icon: _jsx(IconTrash, { size: 14 }), label: removeLabel, "aria-label": removeLabel, onPress: () => onRemove(person.share), className: cn(BUTTON_GHOST_ICON, "[&_svg]:!size-auto") })) : null] }));

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/auth.js

@@ -56,9 +56,9 @@ import { isValidWorkspaceAppIdFormat } from "../shared/workspace-app-id.js";
 import { injectAnalyticsIntoHtml } from "./analytics.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { getAppProductionUrl } from "./app-url.js";
-import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
+import { readAnalyticsAnonymousId, readFirstTouchAttribution, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getAuthLoginMode } from "./auth-login-mode.js";
-import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
+import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getAuthSecret, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
 import { BUILDER_CONNECT_OWNER_COOKIE, BUILDER_CONNECT_PARAM, BUILDER_RELAY_PATH, BUILDER_RELAY_STATE_PARAM, BUILDER_STATE_PARAM, verifyBuilderCallbackStateAndGetOwner, verifyBuilderConnectTokenAndGetOwner, verifyBuilderPreviewRelayStateForCallback, } from "./builder-browser.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
@@ -67,6 +67,7 @@ import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, getOrigin, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthDesktopExchangePage, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
 import { isCanonicalAgentNativeAppRequest, isDesktopSsoCanaryUserAgent, isIdentitySsoEnabled, } from "./identity-sso-store.js";
 import { ensureCanonicalUserForLegacySession } from "./legacy-auth-migration.js";
+import { encodeMagicLinkSignupAttribution, MAGIC_LINK_ATTRIBUTION_PARAM, } from "./magic-link-attribution.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
 import { captureAuthError } from "./sentry.js";
@@ -3333,12 +3334,25 @@ async function mountBetterAuthRoutes(app, options) {
                 callbackPath = withDesktopMagicLinkFlow(callbackPath, desktopFlow);
             }
             const callbackURL = betterAuthCallbackURL(callbackPath, true, event);
-            const newUserCallbackPath = `${getAppBasePath()}/_agent-native/auth/magic-link/new-user?return=${encodeURIComponent(callbackPath)}`;
+            const cookieHeader = getHeader(event, "cookie") ?? null;
+            const signupAttribution = signupAttributionFromCookieHeader(cookieHeader);
+            const signupAnonymousId = readAnalyticsAnonymousId(cookieHeader);
+            const hasSignupAttribution = !!readFirstTouchAttribution(cookieHeader) || !!signupAnonymousId;
+            const attributionToken = hasSignupAttribution
+                ? encodeMagicLinkSignupAttribution({
+                    attribution: signupAttribution,
+                    anonymousId: signupAnonymousId,
+                }, getAuthSecret())
+                : undefined;
+            const newUserCallbackUrl = new URL(`${getAppBasePath()}/_agent-native/auth/magic-link/new-user?return=${encodeURIComponent(callbackPath)}`, getOrigin(event));
+            if (attributionToken) {
+                newUserCallbackUrl.searchParams.set(MAGIC_LINK_ATTRIBUTION_PARAM, attributionToken);
+            }
             await auth.api.signInMagicLink({
                 body: {
                     email,
                     callbackURL,
-                    newUserCallbackURL: betterAuthCallbackURL(newUserCallbackPath, true, event),
+                    newUserCallbackURL: betterAuthCallbackURL(`${newUserCallbackUrl.pathname}${newUserCallbackUrl.search}`, true, event),
                 },
                 headers: event.headers,
             });

package/dist/server/better-auth-instance.js

@@ -32,6 +32,7 @@ import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 import { renderMagicLinkEmail, renderResetPasswordEmail, renderVerifySignupEmail, } from "./email-templates.js";
 import { getEmailReadiness, sendEmail } from "./email.js";
 import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
+import { readMagicLinkSignupAttribution } from "./magic-link-attribution.js";
 export { getAuthLoginMode, resolveAuthLoginMode, resolveAuthLoginModeFromReadiness, } from "./auth-login-mode.js";
 async function flushSignupTracking() {
     try {
@@ -982,8 +983,14 @@ async function createBetterAuthInstance(config) {
                             const cookieHeader = context?.headers?.get("cookie") ??
                                 context?.request?.headers?.get("cookie") ??
                                 null;
+                            const magicLinkAttribution = context?.request?.url?.includes("newUserCallbackURL")
+                                ? readMagicLinkSignupAttribution(context.request.url, getAuthSecret())
+                                : undefined;
                             attribution = signupAttributionFromCookieHeader(cookieHeader);
-                            anonymousId = readAnalyticsAnonymousId(cookieHeader);
+                            attribution = magicLinkAttribution?.attribution ?? attribution;
+                            anonymousId =
+                                magicLinkAttribution?.anonymousId ??
+                                    readAnalyticsAnonymousId(cookieHeader);
                         }
                         catch (err) {
                             console.error("[auth] failed to derive signup attribution", err);

package/dist/server/magic-link-attribution.d.ts

@@ -0,0 +1,21 @@
+/** Query parameter carried by Better Auth's new-user callback URL. */
+export declare const MAGIC_LINK_ATTRIBUTION_PARAM = "signup_attribution";
+export interface MagicLinkSignupAttribution {
+    attribution?: Record<string, string>;
+    anonymousId?: string;
+}
+/**
+ * Sign the attribution captured when a magic link is requested. The token is
+ * analytics context only; it never authorizes the user or changes the return
+ * URL. The Better Auth secret keeps the callback from accepting forged data.
+ */
+export declare function encodeMagicLinkSignupAttribution(value: MagicLinkSignupAttribution, secret: string, now?: number): string | undefined;
+/** Verify and decode a token previously produced by
+ * {@link encodeMagicLinkSignupAttribution}. */
+export declare function decodeMagicLinkSignupAttribution(token: string | null | undefined, secret: string, now?: number): MagicLinkSignupAttribution | null | undefined;
+/**
+ * Read the signed handoff from Better Auth's magic-link verification request.
+ * Better Auth copies `newUserCallbackURL` into the verification URL, so this
+ * remains available even when the link is opened on another device.
+ */
+export declare function readMagicLinkSignupAttribution(requestUrl: string | undefined, secret: string, now?: number): MagicLinkSignupAttribution | null | undefined;

package/dist/server/magic-link-attribution.js

@@ -0,0 +1,115 @@
+import crypto from "node:crypto";
+import { normalizeAnalyticsAnonymousId } from "../shared/analytics-anonymous-id.js";
+/** Query parameter carried by Better Auth's new-user callback URL. */
+export const MAGIC_LINK_ATTRIBUTION_PARAM = "signup_attribution";
+/** Better Auth's magic-link token is valid for five minutes; keep this handoff
+ * slightly longer so clock skew does not discard a still-valid link. */
+const MAGIC_LINK_ATTRIBUTION_TTL_SECONDS = 10 * 60;
+const MAX_ATTRIBUTION_FIELDS = 32;
+const MAX_ATTRIBUTION_VALUE_LENGTH = 200;
+function sanitizeAttribution(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    const out = {};
+    for (const [key, raw] of Object.entries(value).slice(0, MAX_ATTRIBUTION_FIELDS)) {
+        if (!/^[a-z][a-z0-9_]{0,63}$/.test(key) ||
+            typeof raw !== "string" ||
+            raw.length === 0) {
+            continue;
+        }
+        out[key] = raw.slice(0, MAX_ATTRIBUTION_VALUE_LENGTH);
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function encodePayload(payload) {
+    return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+/**
+ * Sign the attribution captured when a magic link is requested. The token is
+ * analytics context only; it never authorizes the user or changes the return
+ * URL. The Better Auth secret keeps the callback from accepting forged data.
+ */
+export function encodeMagicLinkSignupAttribution(value, secret, now = Date.now()) {
+    if (!secret)
+        return undefined;
+    const attribution = sanitizeAttribution(value.attribution);
+    const anonymousId = normalizeAnalyticsAnonymousId(value.anonymousId);
+    if (!attribution && !anonymousId)
+        return undefined;
+    const payload = {
+        exp: Math.floor(now / 1000) + MAGIC_LINK_ATTRIBUTION_TTL_SECONDS,
+        ...(attribution ? { attribution } : {}),
+        ...(anonymousId ? { anonymousId } : {}),
+    };
+    const data = encodePayload(payload);
+    const signature = crypto
+        .createHmac("sha256", secret)
+        .update(data)
+        .digest("base64url");
+    return `${data}.${signature}`;
+}
+/** Verify and decode a token previously produced by
+ * {@link encodeMagicLinkSignupAttribution}. */
+export function decodeMagicLinkSignupAttribution(token, secret, now = Date.now()) {
+    if (token === null || token === undefined)
+        return undefined;
+    if (!token || !secret)
+        return null;
+    try {
+        const dotIndex = token.lastIndexOf(".");
+        if (dotIndex <= 0 || dotIndex === token.length - 1)
+            return null;
+        const data = token.slice(0, dotIndex);
+        const signature = token.slice(dotIndex + 1);
+        const expected = crypto
+            .createHmac("sha256", secret)
+            .update(data)
+            .digest("base64url");
+        if (signature.length !== expected.length ||
+            !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
+            return null;
+        }
+        const payload = JSON.parse(Buffer.from(data, "base64url").toString("utf8"));
+        if (typeof payload.exp !== "number" ||
+            payload.exp < Math.floor(now / 1000)) {
+            return null;
+        }
+        const attribution = sanitizeAttribution(payload.attribution);
+        const anonymousId = normalizeAnalyticsAnonymousId(payload.anonymousId);
+        if (!attribution && !anonymousId)
+            return undefined;
+        return {
+            ...(attribution ? { attribution } : {}),
+            ...(anonymousId ? { anonymousId } : {}),
+        };
+    }
+    catch {
+        // coercion-ok: malformed signed input is distinct from absent context.
+        return null;
+    }
+}
+/**
+ * Read the signed handoff from Better Auth's magic-link verification request.
+ * Better Auth copies `newUserCallbackURL` into the verification URL, so this
+ * remains available even when the link is opened on another device.
+ */
+export function readMagicLinkSignupAttribution(requestUrl, secret, now = Date.now()) {
+    if (!requestUrl)
+        return undefined;
+    try {
+        const verificationUrl = new URL(requestUrl, "http://localhost");
+        if (!verificationUrl.pathname.endsWith("/magic-link/verify")) {
+            return undefined;
+        }
+        const callback = verificationUrl.searchParams.get("newUserCallbackURL");
+        if (!callback)
+            return undefined;
+        const callbackUrl = new URL(callback, verificationUrl.origin);
+        return decodeMagicLinkSignupAttribution(callbackUrl.searchParams.get(MAGIC_LINK_ATTRIBUTION_PARAM), secret, now);
+    }
+    catch {
+        // coercion-ok: malformed request input is distinct from absent context.
+        return null;
+    }
+}

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.153.0",
+  "version": "0.153.2",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {