@agent-native/core 0.157.3 → 0.157.5

package/dist/client/theme.d.ts

@@ -1,3 +1,24 @@
 export type ThemePreference = "light" | "dark" | "system";
+export type ResolvedTheme = "light" | "dark";
+export declare const EMBEDDED_THEME_UPDATE_MESSAGE = "agent-native-theme-update";
+export declare const EMBEDDED_THEME_CHANGE_EVENT = "agent-native:theme-change";
+export interface EmbeddedThemeUpdate {
+    type: typeof EMBEDDED_THEME_UPDATE_MESSAGE;
+    theme?: ResolvedTheme;
+    isDark?: boolean;
+    vars?: Record<string, string>;
+}
+export interface NormalizedEmbeddedThemeUpdate {
+    theme: ResolvedTheme;
+    vars?: Record<string, string>;
+}
+/**
+ * Accepts both the current `theme` field and the legacy `isDark` field used by
+ * extension iframes. Unknown messages and untrusted CSS variable names fail
+ * closed so a cross-window event cannot become an arbitrary style sink.
+ */
+export declare function parseEmbeddedThemeUpdate(value: unknown): NormalizedEmbeddedThemeUpdate | null;
+export declare function buildEmbeddedThemeUpdate(theme: ResolvedTheme, vars?: Record<string, string>): EmbeddedThemeUpdate;
+export declare function applyEmbeddedThemeUpdate(root: HTMLElement, update: NormalizedEmbeddedThemeUpdate): void;
 export declare function getThemeInitScript(defaultTheme?: ThemePreference, enableSystem?: boolean): string;
 export declare const themeInitScript: string;

package/dist/client/theme.js

@@ -1,4 +1,64 @@
+import { THEME_VAR_NAMES } from "../extensions/theme.js";
 import { getViteDevRecoveryScript, shouldInlineViteDevRecoveryScript, } from "./vite-dev-recovery-script.js";
+export const EMBEDDED_THEME_UPDATE_MESSAGE = "agent-native-theme-update";
+export const EMBEDDED_THEME_CHANGE_EVENT = "agent-native:theme-change";
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function readThemeVars(value) {
+    if (!isRecord(value))
+        return undefined;
+    const vars = {};
+    for (const [name, rawValue] of Object.entries(value)) {
+        if (!THEME_VAR_NAMES.some((candidate) => candidate === name))
+            continue;
+        if (typeof rawValue === "string")
+            vars[name] = rawValue;
+    }
+    return Object.keys(vars).length > 0 ? vars : undefined;
+}
+/**
+ * Accepts both the current `theme` field and the legacy `isDark` field used by
+ * extension iframes. Unknown messages and untrusted CSS variable names fail
+ * closed so a cross-window event cannot become an arbitrary style sink.
+ */
+export function parseEmbeddedThemeUpdate(value) {
+    if (!isRecord(value))
+        return null;
+    if (value.type !== EMBEDDED_THEME_UPDATE_MESSAGE &&
+        value.type !== EMBEDDED_THEME_CHANGE_EVENT) {
+        return null;
+    }
+    const theme = value.theme === "light" || value.theme === "dark"
+        ? value.theme
+        : typeof value.isDark === "boolean"
+            ? value.isDark
+                ? "dark"
+                : "light"
+            : null;
+    if (!theme)
+        return null;
+    const vars = readThemeVars(value.vars);
+    return vars ? { theme, vars } : { theme };
+}
+export function buildEmbeddedThemeUpdate(theme, vars) {
+    return {
+        type: EMBEDDED_THEME_UPDATE_MESSAGE,
+        theme,
+        isDark: theme === "dark",
+        ...(vars ? { vars } : {}),
+    };
+}
+export function applyEmbeddedThemeUpdate(root, update) {
+    const isDark = update.theme === "dark";
+    root.classList.toggle("dark", isDark);
+    root.classList.toggle("light", !isDark);
+    root.setAttribute("data-theme", update.theme);
+    root.style.colorScheme = update.theme;
+    for (const [name, value] of Object.entries(update.vars ?? {})) {
+        root.style.setProperty(name, value);
+    }
+}
 function normalizeDefaultTheme(theme) {
     if (theme === "light" || theme === "dark" || theme === "system") {
         return theme;

package/dist/client/ui/index.d.ts

@@ -13,7 +13,7 @@ export { ClientOnly } from "../ClientOnly.js";
 export { DefaultSpinner } from "../DefaultSpinner.js";
 export { RuntimeConfigNotice } from "../RuntimeConfigNotice.js";
 export { RouteTransitionIndicator, ROUTE_TRANSITION_INDICATOR_DELAY_MS, } from "../RouteTransitionIndicator.js";
-export { getThemeInitScript, themeInitScript, type ThemePreference, } from "../theme.js";
+export { applyEmbeddedThemeUpdate, buildEmbeddedThemeUpdate, EMBEDDED_THEME_CHANGE_EVENT, EMBEDDED_THEME_UPDATE_MESSAGE, getThemeInitScript, parseEmbeddedThemeUpdate, themeInitScript, type EmbeddedThemeUpdate, type NormalizedEmbeddedThemeUpdate, type ResolvedTheme, type ThemePreference, } from "../theme.js";
 export { APPEARANCE_PRESETS, applyAppearance, getStoredAppearance, useAppearance, useAppearanceSync, type AppearancePresetId, } from "../appearance.js";
 export { AppearancePicker, type AppearancePickerProps, } from "../AppearancePicker.js";
 export { AgentNativeIcon } from "../components/icons/AgentNativeIcon.js";

package/dist/client/ui/index.js

@@ -13,7 +13,7 @@ export { ClientOnly } from "../ClientOnly.js";
 export { DefaultSpinner } from "../DefaultSpinner.js";
 export { RuntimeConfigNotice } from "../RuntimeConfigNotice.js";
 export { RouteTransitionIndicator, ROUTE_TRANSITION_INDICATOR_DELAY_MS, } from "../RouteTransitionIndicator.js";
-export { getThemeInitScript, themeInitScript, } from "../theme.js";
+export { applyEmbeddedThemeUpdate, buildEmbeddedThemeUpdate, EMBEDDED_THEME_CHANGE_EVENT, EMBEDDED_THEME_UPDATE_MESSAGE, getThemeInitScript, parseEmbeddedThemeUpdate, themeInitScript, } from "../theme.js";
 export { APPEARANCE_PRESETS, applyAppearance, getStoredAppearance, useAppearance, useAppearanceSync, } from "../appearance.js";
 export { AppearancePicker, } from "../AppearancePicker.js";
 export { AgentNativeIcon } from "../components/icons/AgentNativeIcon.js";

package/dist/client/use-session.js

@@ -1,6 +1,7 @@
 import { useCallback, useEffect, useState } from "react";
 import { setSentryUser, trackSessionStatus } from "./analytics.js";
 import { fetchAuthSessionStatus, invalidateClientStatusRequest, } from "./client-status-requests.js";
+import { getFrameOrigin, getFramePostMessageTargetOrigin } from "./frame.js";
 const SESSION_CACHE_TTL_MS = 30_000;
 const SESSION_RETRY_DELAY_MS = 1_000;
 const SESSION_MAX_ATTEMPTS = 4;
@@ -34,6 +35,27 @@ function publishSessionIdentity(session) {
     }
     trackSessionStatus(Boolean(session));
 }
+function notifyParentAuthState(status) {
+    if (typeof window === "undefined" || window.parent === window)
+        return;
+    // The frame-origin handshake validates the direct parent before this state
+    // crosses the frame boundary. Opaque sandbox frames still require "*".
+    if (!getFrameOrigin())
+        return;
+    const targetOrigin = getFramePostMessageTargetOrigin();
+    if (!targetOrigin)
+        return;
+    try {
+        window.parent.postMessage({
+            type: "agentNative.authState",
+            data: { status },
+        }, targetOrigin);
+        // coercion-ok: Posting auth state is best-effort when an embedded host is being detached.
+    }
+    catch {
+        // A host may revoke the frame while the session request is settling.
+    }
+}
 function invalidateSessionCache() {
     sessionGeneration += 1;
     cachedSession = undefined;
@@ -165,6 +187,7 @@ export function useSession() {
             setSession(resolved);
             setError(null);
             setStatus(resolved ? "authenticated" : "unauthenticated");
+            notifyParentAuthState(resolved ? "authenticated" : "unauthenticated");
         };
         void resolveSession();
         return () => {

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/dashboard-storage/schema.d.ts

@@ -524,7 +524,7 @@ export declare function createDashboardStorageSchema(options?: DashboardStorageS
                 data: string;
                 driverParam: string;
                 notNull: true;
-                hasDefault: false;
+                hasDefault: true;
                 isPrimaryKey: false;
                 isAutoincrement: false;
                 hasRuntimeDefault: false;

package/dist/data-programs/schema.d.ts

@@ -471,7 +471,7 @@ export declare const dataProgramShares: import("drizzle-orm/sqlite-core").SQLite
             data: string;
             driverParam: string;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;

package/dist/extensions/schema.d.ts

@@ -376,7 +376,7 @@ export declare const extensionShares: import("drizzle-orm/sqlite-core").SQLiteTa
             data: string;
             driverParam: string;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;

package/dist/localization/core-messages/ar-SA.js

@@ -438,6 +438,12 @@ const messages = {
     "share.advancedDescription": "تحكّم في كيفية ظهور وصول المؤسسة في نتائج البحث.",
     "share.copied": "تم النسخ",
     "share.copy": "نسخ",
+    "share.shareWithAgents": "مشاركة مع الوكلاء",
+    "share.agentContext": "رابط سياق الوكيل",
+    "share.agentContextDescription": "سياق للقراءة فقط لوكيل خارجي.",
+    "share.preparingAgentLink": "جارٍ إعداد رابط الوكيل...",
+    "share.agentLinkUnavailable": "تعذر إنشاء رابط الوكيل.",
+    "share.retryAgentLink": "إعادة المحاولة",
     "share.editor": "محرر",
     "share.editorDescription": "يمكنه التعديل",
     "share.generalAccess": "الوصول العام",

package/dist/localization/core-messages/de-DE.js

@@ -473,6 +473,12 @@ const messages = {
     "share.advancedDescription": "Lege fest, wie der Organisationszugriff in der Suche angezeigt wird.",
     "share.copied": "Kopiert",
     "share.copy": "Kopieren",
+    "share.shareWithAgents": "Mit Agenten teilen",
+    "share.agentContext": "Agenten-Kontextlink",
+    "share.agentContextDescription": "Schreibgeschützter Kontext für einen externen Agenten.",
+    "share.preparingAgentLink": "Agentenlink wird vorbereitet...",
+    "share.agentLinkUnavailable": "Der Agentenlink konnte nicht erstellt werden.",
+    "share.retryAgentLink": "Erneut versuchen",
     "share.editor": "Editor",
     "share.editorDescription": "Kann bearbeiten",
     "share.generalAccess": "Allgemeiner Zugriff",

package/dist/localization/core-messages/en-US.d.ts

@@ -422,6 +422,12 @@ declare const messages: {
     readonly "share.advancedDescription": "Control how organization access appears in search.";
     readonly "share.copied": "Copied";
     readonly "share.copy": "Copy";
+    readonly "share.shareWithAgents": "Share with agents";
+    readonly "share.agentContext": "Agent context link";
+    readonly "share.agentContextDescription": "Read-only context for an external agent.";
+    readonly "share.preparingAgentLink": "Preparing agent link...";
+    readonly "share.agentLinkUnavailable": "Couldn't create the agent link.";
+    readonly "share.retryAgentLink": "Retry";
     readonly "share.editor": "Editor";
     readonly "share.editorDescription": "Can edit";
     readonly "share.generalAccess": "General access";

package/dist/localization/core-messages/en-US.js

@@ -422,6 +422,12 @@ const messages = {
     "share.advancedDescription": "Control how organization access appears in search.",
     "share.copied": "Copied",
     "share.copy": "Copy",
+    "share.shareWithAgents": "Share with agents",
+    "share.agentContext": "Agent context link",
+    "share.agentContextDescription": "Read-only context for an external agent.",
+    "share.preparingAgentLink": "Preparing agent link...",
+    "share.agentLinkUnavailable": "Couldn't create the agent link.",
+    "share.retryAgentLink": "Retry",
     "share.editor": "Editor",
     "share.editorDescription": "Can edit",
     "share.generalAccess": "General access",

package/dist/localization/core-messages/es-ES.js

@@ -480,6 +480,12 @@ const messages = {
     "share.advancedDescription": "Controla cómo aparece el acceso de la organización en la búsqueda.",
     "share.copied": "Copiado",
     "share.copy": "Copiar",
+    "share.shareWithAgents": "Compartir con agentes",
+    "share.agentContext": "Enlace de contexto del agente",
+    "share.agentContextDescription": "Contexto de solo lectura para un agente externo.",
+    "share.preparingAgentLink": "Preparando el enlace del agente...",
+    "share.agentLinkUnavailable": "No se pudo crear el enlace del agente.",
+    "share.retryAgentLink": "Reintentar",
     "share.editor": "Editor",
     "share.editorDescription": "Puede editar",
     "share.generalAccess": "Acceso general",

package/dist/localization/core-messages/fr-FR.js

@@ -480,6 +480,12 @@ const messages = {
     "share.advancedDescription": "Contrôlez la façon dont l’accès à l’organisation apparaît dans la recherche.",
     "share.copied": "Copié",
     "share.copy": "Copier",
+    "share.shareWithAgents": "Partager avec des agents",
+    "share.agentContext": "Lien de contexte de l'agent",
+    "share.agentContextDescription": "Contexte en lecture seule pour un agent externe.",
+    "share.preparingAgentLink": "Préparation du lien de l'agent...",
+    "share.agentLinkUnavailable": "Impossible de créer le lien de l'agent.",
+    "share.retryAgentLink": "Réessayer",
     "share.editor": "Éditeur",
     "share.editorDescription": "Peut modifier",
     "share.generalAccess": "Accès général",

package/dist/localization/core-messages/hi-IN.js

@@ -422,6 +422,12 @@ const messages = {
     "share.advancedDescription": "नियंत्रित करें कि संगठन का एक्सेस खोज में कैसे दिखाई दे।",
     "share.copied": "कॉपी किया गया",
     "share.copy": "कॉपी करें",
+    "share.shareWithAgents": "एजेंट्स के साथ साझा करें",
+    "share.agentContext": "एजेंट संदर्भ लिंक",
+    "share.agentContextDescription": "बाहरी एजेंट के लिए केवल-पठन संदर्भ।",
+    "share.preparingAgentLink": "एजेंट लिंक तैयार हो रहा है...",
+    "share.agentLinkUnavailable": "एजेंट लिंक नहीं बनाया जा सका।",
+    "share.retryAgentLink": "पुनः प्रयास करें",
     "share.editor": "संपादक",
     "share.editorDescription": "संपादित कर सकता है",
     "share.generalAccess": "सामान्य एक्सेस",

package/dist/localization/core-messages/ja-JP.js

@@ -418,6 +418,12 @@ const messages = {
     "share.advancedDescription": "組織のアクセス権を検索結果に表示する方法を設定します。",
     "share.copied": "コピーしました",
     "share.copy": "コピー",
+    "share.shareWithAgents": "エージェントと共有",
+    "share.agentContext": "エージェントコンテキストリンク",
+    "share.agentContextDescription": "外部エージェント用の読み取り専用コンテキスト。",
+    "share.preparingAgentLink": "エージェントリンクを準備中...",
+    "share.agentLinkUnavailable": "エージェントリンクを作成できませんでした。",
+    "share.retryAgentLink": "再試行",
     "share.editor": "編集者",
     "share.editorDescription": "編集可能",
     "share.generalAccess": "一般的なアクセス",

package/dist/localization/core-messages/ko-KR.js

@@ -418,6 +418,12 @@ const messages = {
     "share.advancedDescription": "조직 접근 권한이 검색 결과에 표시되는 방식을 제어합니다.",
     "share.copied": "복사됨",
     "share.copy": "복사",
+    "share.shareWithAgents": "에이전트와 공유",
+    "share.agentContext": "에이전트 컨텍스트 링크",
+    "share.agentContextDescription": "외부 에이전트를 위한 읽기 전용 컨텍스트입니다.",
+    "share.preparingAgentLink": "에이전트 링크 준비 중...",
+    "share.agentLinkUnavailable": "에이전트 링크를 만들 수 없습니다.",
+    "share.retryAgentLink": "다시 시도",
     "share.editor": "편집자",
     "share.editorDescription": "편집 가능",
     "share.generalAccess": "일반 접근 권한",

package/dist/localization/core-messages/pt-BR.js

@@ -480,6 +480,12 @@ const messages = {
     "share.advancedDescription": "Controle como o acesso à organização aparece na pesquisa.",
     "share.copied": "Copiado",
     "share.copy": "Copiar",
+    "share.shareWithAgents": "Compartilhar com agentes",
+    "share.agentContext": "Link de contexto do agente",
+    "share.agentContextDescription": "Contexto somente leitura para um agente externo.",
+    "share.preparingAgentLink": "Preparando link do agente...",
+    "share.agentLinkUnavailable": "Não foi possível criar o link do agente.",
+    "share.retryAgentLink": "Tentar novamente",
     "share.editor": "Editor",
     "share.editorDescription": "Pode editar",
     "share.generalAccess": "Acesso geral",

package/dist/localization/core-messages/zh-CN.js

@@ -418,6 +418,12 @@ const messages = {
     "share.advancedDescription": "控制组织访问权限在搜索结果中的显示方式。",
     "share.copied": "已复制",
     "share.copy": "复制",
+    "share.shareWithAgents": "与代理共享",
+    "share.agentContext": "代理上下文链接",
+    "share.agentContextDescription": "供外部代理使用的只读上下文。",
+    "share.preparingAgentLink": "正在准备代理链接...",
+    "share.agentLinkUnavailable": "无法创建代理链接。",
+    "share.retryAgentLink": "重试",
     "share.editor": "编辑者",
     "share.editorDescription": "可以编辑",
     "share.generalAccess": "常规访问权限",

package/dist/localization/core-messages/zh-TW.js

@@ -418,6 +418,12 @@ const messages = {
     "share.advancedDescription": "控制組織存取權在搜尋結果中的顯示方式。",
     "share.copied": "已複製",
     "share.copy": "複製",
+    "share.shareWithAgents": "與代理分享",
+    "share.agentContext": "代理上下文連結",
+    "share.agentContextDescription": "供外部代理使用的唯讀上下文。",
+    "share.preparingAgentLink": "正在準備代理連結...",
+    "share.agentLinkUnavailable": "無法建立代理連結。",
+    "share.retryAgentLink": "重試",
     "share.editor": "編輯者",
     "share.editorDescription": "可以編輯",
     "share.generalAccess": "一般存取權",

package/dist/localization/core-messages.d.ts

@@ -424,6 +424,12 @@ export declare const englishAgentChatMessages: {
     readonly "share.advancedDescription": "Control how organization access appears in search.";
     readonly "share.copied": "Copied";
     readonly "share.copy": "Copy";
+    readonly "share.shareWithAgents": "Share with agents";
+    readonly "share.agentContext": "Agent context link";
+    readonly "share.agentContextDescription": "Read-only context for an external agent.";
+    readonly "share.preparingAgentLink": "Preparing agent link...";
+    readonly "share.agentLinkUnavailable": "Couldn't create the agent link.";
+    readonly "share.retryAgentLink": "Retry";
     readonly "share.editor": "Editor";
     readonly "share.editorDescription": "Can edit";
     readonly "share.generalAccess": "General access";

package/dist/localization/default-messages.d.ts

@@ -693,6 +693,7 @@ declare const messages: {
         embedUrl: string;
         embedCode: string;
         copy: string;
+        copied: string;
         role: string;
         private: string;
         privateDescription: string;

package/dist/localization/default-messages.js

@@ -699,6 +699,7 @@ const messages = {
         embedUrl: "Embed URL",
         embedCode: "Embed code",
         copy: "Copy",
+        copied: "Copied",
         role: "Role",
         private: "Private",
         privateDescription: "Only people with access can view",

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
-    error?: undefined;
     count: number;
     updated?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated: number;
+    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,8 +26,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,9 +75,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    deleted?: undefined;
     id?: undefined;
-    provider?: undefined;
+    message?: undefined;
+    deleted?: undefined;
     providers: {
         id: string;
         label: string;
@@ -88,45 +88,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
+    provider?: undefined;
     found?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
     id?: undefined;
-    providers?: undefined;
+    message?: undefined;
     count?: undefined;
+    deleted?: undefined;
+    providers?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
+    count?: undefined;
     deleted?: undefined;
-    provider?: undefined;
     providers?: undefined;
-    count?: undefined;
+    provider?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
-    providers?: undefined;
+    message?: undefined;
     count?: undefined;
+    providers?: undefined;
+    provider?: undefined;
     found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    count?: undefined;
     deleted?: undefined;
-    provider?: undefined;
     providers?: undefined;
-    count?: undefined;
+    provider?: undefined;
     found?: undefined;
     registered: boolean;
     id: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,9 +311,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        id?: undefined;
-        message?: undefined;
         deleted?: undefined;
+        id?: undefined;
+        provider?: undefined;
         providers: {
             id: string;
             label: string;
@@ -324,45 +324,45 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
-        provider?: undefined;
         found?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
-        id?: undefined;
         message?: undefined;
-        count?: undefined;
+    } | {
         deleted?: undefined;
+        id?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        count?: undefined;
+    } | {
         deleted?: undefined;
-        providers?: undefined;
         provider?: undefined;
+        providers?: undefined;
+        count?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        count?: undefined;
-        providers?: undefined;
+    } | {
         provider?: undefined;
+        providers?: undefined;
+        count?: undefined;
         found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        count?: undefined;
         deleted?: undefined;
-        providers?: undefined;
         provider?: undefined;
+        providers?: undefined;
+        count?: undefined;
         found?: undefined;
         registered: boolean;
         id: string;

package/dist/server/auth.js

@@ -65,7 +65,7 @@ import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js
 import { readDesktopSso, writeDesktopSso, clearDesktopSso, } from "./desktop-sso.js";
 import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, getOrigin, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthDesktopExchangePage, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
-import { isCanonicalAgentNativeAppRequest, isDesktopSsoCanaryUserAgent, isIdentitySsoEnabled, } from "./identity-sso-store.js";
+import { isCanonicalAgentNativeAppRequest, isCanonicalIdentitySsoClientRequest, isDesktopSsoCanaryUserAgent, isIdentitySsoExplicitlyEnabled, } from "./identity-sso-store.js";
 import { ensureCanonicalUserForLegacySession } from "./legacy-auth-migration.js";
 import { encodeMagicLinkSignupAttribution, MAGIC_LINK_ATTRIBUTION_PARAM, } from "./magic-link-attribution.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
@@ -1709,15 +1709,18 @@ function createAuthGuardFn() {
         // 401-for-/_agent-native/*: they resolve / mint the browser session
         // themselves and verify a signature-bound, single-use, CSRF-stated
         // hub token — not a cookie. The handler fails closed with 404 unless
-        // direct web SSO is configured or this is the packaged SSO Canary on a
-        // canonical app origin. Keeping the bypass exact lets that request-scoped
-        // decision happen without exposing any other identity subpath.
+        // direct web SSO is configured or the request is from an exact canonical
+        // hosted app origin. Keeping the bypass exact avoids exposing any other
+        // identity subpath.
         const isIdentitySsoEntryPath = p === "/_agent-native/identity/login" ||
             p === "/_agent-native/identity/callback";
         const isDesktopCanaryIdentityRequest = isDesktopSsoCanaryUserAgent(getHeader(event, "user-agent")) &&
             isCanonicalAgentNativeAppRequest(getHeader(event, "host"), getHeader(event, "x-forwarded-proto"));
+        const isCanonicalHostedIdentityRequest = isCanonicalIdentitySsoClientRequest(getHeader(event, "host"), getHeader(event, "x-forwarded-proto"));
         if (isIdentitySsoEntryPath &&
-            (isIdentitySsoEnabled() || isDesktopCanaryIdentityRequest)) {
+            (isIdentitySsoExplicitlyEnabled() ||
+                isDesktopCanaryIdentityRequest ||
+                isCanonicalHostedIdentityRequest)) {
             return;
         }
         // Internal processor endpoint for the A2A async-mode fanout. Mirrors the