@agent-native/core 0.168.5 → 0.168.6

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 8492
+- template files: 8496

package/corpus/templates/slides/app/components/editor/PromptDialog.tsx

@@ -14,7 +14,10 @@ import { useState, useEffect, useCallback, useRef } from "react";
 import { createPortal } from "react-dom";
 import { toast } from "sonner";
 
-import { MAX_REFERENCE_FILE_BYTES } from "../../../shared/upload-types";
+import {
+  MAX_REFERENCE_FILE_BYTES,
+  MAX_REFERENCE_FILES,
+} from "../../../shared/upload-types";
 import { Button } from "../ui/button";
 import { Input } from "../ui/input";
 import { GoogleDocImportHint } from "./GoogleDocImportHint";
@@ -29,39 +32,159 @@ export interface UploadedFile {
   size: number;
 }
 
-export async function uploadPromptFiles(
-  files: File[],
-): Promise<UploadedFile[]> {
-  if (files.length === 0) return [];
+// Netlify functions cap request bodies well under what a real PPTX/PDF
+// needs, so any file above this size streams through the chunked upload
+// endpoints (sub-4 MB slices, reassembled server-side) instead of one
+// multipart POST.
+const CHUNK_UPLOAD_THRESHOLD_BYTES = 4 * 1024 * 1024;
+const CHUNK_SIZE_BYTES = 4 * 1024 * 1024;
+
+async function readUploadJson(response: Response): Promise<unknown> {
+  try {
+    return await response.json();
+  } catch (error) {
+    throw new Error(`Upload returned invalid JSON (${response.status})`, {
+      cause: error,
+    });
+  }
+}
+
+function extractErrorMessage(data: unknown): string | null {
+  if (
+    data &&
+    typeof data === "object" &&
+    "error" in data &&
+    typeof (data as { error: unknown }).error === "string" &&
+    (data as { error: string }).error.trim()
+  ) {
+    return (data as { error: string }).error;
+  }
+  return null;
+}
+
+async function uploadFilesMultipart(files: File[]): Promise<UploadedFile[]> {
   const formData = new FormData();
   files.forEach((file) => formData.append("files", file));
-  ensureEmbedAuthFetchInterceptor();
   const response = await fetch(`${appBasePath()}/api/uploads`, {
     method: "POST",
     body: formData,
     credentials: "include",
   });
+  const data = await readUploadJson(response);
   if (!response.ok) {
-    let message = "Upload failed";
-    try {
-      const data: unknown = await response.json();
-      if (
-        data &&
-        typeof data === "object" &&
-        "error" in data &&
-        typeof data.error === "string" &&
-        data.error.trim()
-      ) {
-        message = data.error;
-      }
-    } catch (error) {
-      const uploadError = new Error(`Upload failed (${response.status})`);
-      (uploadError as Error & { cause?: unknown }).cause = error;
-      throw uploadError;
+    throw new Error(
+      extractErrorMessage(data) || `Upload failed (${response.status})`,
+    );
+  }
+  if (!Array.isArray(data)) {
+    throw new Error("Upload failed: invalid response");
+  }
+  return data as UploadedFile[];
+}
+
+async function uploadFileChunked(file: File): Promise<UploadedFile> {
+  const startResponse = await fetch(
+    `${appBasePath()}/api/uploads-chunked/start`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      credentials: "include",
+      body: JSON.stringify({
+        filename: file.name,
+        mimetype: file.type || "application/octet-stream",
+        declaredSize: file.size,
+      }),
+    },
+  );
+  const startData = await readUploadJson(startResponse);
+  if (!startResponse.ok) {
+    throw new Error(
+      extractErrorMessage(startData) ||
+        `Upload failed (${startResponse.status})`,
+    );
+  }
+  if (
+    startData &&
+    typeof startData === "object" &&
+    (startData as { uploadMode?: unknown }).uploadMode === "multipart"
+  ) {
+    const [uploaded] = await uploadFilesMultipart([file]);
+    if (!uploaded) throw new Error("Upload failed: no file returned");
+    return uploaded;
+  }
+  const sessionId =
+    startData && typeof startData === "object"
+      ? (startData as { sessionId?: unknown }).sessionId
+      : undefined;
+  if (typeof sessionId !== "string" || !sessionId) {
+    throw new Error("Upload failed: session ID missing");
+  }
+
+  const totalChunks = Math.max(1, Math.ceil(file.size / CHUNK_SIZE_BYTES));
+  for (let index = 0; index < totalChunks; index++) {
+    const start = index * CHUNK_SIZE_BYTES;
+    const end = Math.min(start + CHUNK_SIZE_BYTES, file.size);
+    const isFinal = index === totalChunks - 1;
+    const chunkResponse = await fetch(
+      `${appBasePath()}/api/uploads-chunked/${sessionId}/chunk?index=${index}&isFinal=${
+        isFinal ? "1" : "0"
+      }`,
+      {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/octet-stream" },
+        body: file.slice(start, end),
+      },
+    );
+    const chunkData = await readUploadJson(chunkResponse);
+    if (!chunkResponse.ok) {
+      throw new Error(
+        extractErrorMessage(chunkData) ||
+          `Upload failed (${chunkResponse.status})`,
+      );
+    }
+    if (isFinal) {
+      const result = Array.isArray(chunkData)
+        ? (chunkData[0] as UploadedFile)
+        : undefined;
+      if (!result) throw new Error("Upload failed: no file returned");
+      return result;
     }
-    throw new Error(message);
   }
-  return (await response.json()) as UploadedFile[];
+  throw new Error("Upload failed: no final chunk response");
+}
+
+export async function uploadPromptFiles(
+  files: File[],
+): Promise<UploadedFile[]> {
+  if (files.length === 0) return [];
+  if (files.length > MAX_REFERENCE_FILES) {
+    throw new Error(`Too many files (max ${MAX_REFERENCE_FILES})`);
+  }
+  ensureEmbedAuthFetchInterceptor();
+  const smallIndices = files.flatMap((file, index) =>
+    file.size <= CHUNK_UPLOAD_THRESHOLD_BYTES ? [index] : [],
+  );
+  const largeIndices = files.flatMap((file, index) =>
+    file.size > CHUNK_UPLOAD_THRESHOLD_BYTES ? [index] : [],
+  );
+  const [smallUploads, largeUploads] = await Promise.all([
+    smallIndices.length > 0
+      ? uploadFilesMultipart(smallIndices.map((index) => files[index]))
+      : [],
+    Promise.all(largeIndices.map((index) => uploadFileChunked(files[index]))),
+  ]);
+  if (smallUploads.length !== smallIndices.length) {
+    throw new Error("Upload failed: response file count did not match request");
+  }
+  const uploads = new Array<UploadedFile>(files.length);
+  smallIndices.forEach((fileIndex, resultIndex) => {
+    uploads[fileIndex] = smallUploads[resultIndex];
+  });
+  largeIndices.forEach((fileIndex, resultIndex) => {
+    uploads[fileIndex] = largeUploads[resultIndex];
+  });
+  return uploads;
 }
 
 /**

package/corpus/templates/slides/server/handlers/uploads-chunked.ts

@@ -0,0 +1,317 @@
+import {
+  deletePrivateBlob,
+  putPrivateBlob,
+  readPrivateBlob,
+} from "@agent-native/core/private-blob";
+import {
+  defineEventHandler,
+  getHeader,
+  getQuery,
+  getRouterParam,
+  readBody,
+  readRawBody,
+  setResponseStatus,
+} from "h3";
+import { nanoid } from "nanoid";
+
+import {
+  createChunkedUploadSession,
+  deleteChunkedUploadSession,
+  getChunkedUploadSession,
+  listChunkedUploadSessions,
+  type ChunkedUploadSession,
+} from "../lib/chunked-upload-session.js";
+import { isHostedSlidesRuntime } from "../lib/tenant-files.js";
+import {
+  resolveSlidesRequestAuth,
+  withSlidesRequestContext,
+} from "./request-auth-context.js";
+import { maxReferenceFileBytes, saveUploadedReferenceFile } from "./uploads.js";
+
+const MAX_CHUNK_BYTES = 4 * 1024 * 1024;
+const MAX_CHUNKS = 128;
+const SESSION_TTL_MS = 60 * 60 * 1000;
+
+interface StartBody {
+  filename?: unknown;
+  mimetype?: unknown;
+  declaredSize?: unknown;
+}
+
+async function deleteChunk(handle: ChunkedUploadSession["chunks"][string]) {
+  return (await deletePrivateBlob(handle)).deleted;
+}
+
+async function cleanupChunks(session: ChunkedUploadSession): Promise<boolean> {
+  const results = await Promise.all(
+    Object.values(session.chunks).map(deleteChunk),
+  );
+  return results.every(Boolean);
+}
+
+async function discardSession(
+  sessionId: string,
+  session: ChunkedUploadSession,
+): Promise<boolean> {
+  const cleaned = await cleanupChunks(session);
+  if (cleaned) await deleteChunkedUploadSession(sessionId);
+  return cleaned;
+}
+
+async function reapExpiredChunkedUploads(): Promise<void> {
+  const now = Date.now();
+  const sessions = await listChunkedUploadSessions();
+  await Promise.all(
+    sessions.map(async ({ sessionId, session }) => {
+      const expiresAt = Date.parse(session.expiresAt);
+      if (Number.isFinite(expiresAt) && expiresAt > now) return;
+      try {
+        const cleaned = await discardSession(sessionId, session);
+        if (!cleaned) {
+          console.warn("[slides-upload] expired session cleanup incomplete", {
+            sessionId,
+          });
+        }
+      } catch (error) {
+        console.warn("[slides-upload] expired session cleanup failed", {
+          sessionId,
+          error: error instanceof Error ? error.message : String(error),
+        });
+      }
+    }),
+  );
+}
+
+async function cleanupCommittedSession(
+  sessionId: string,
+  session: ChunkedUploadSession,
+): Promise<void> {
+  try {
+    const cleaned = await discardSession(sessionId, session);
+    if (!cleaned) {
+      console.warn("[slides-upload] committed session cleanup incomplete", {
+        sessionId,
+      });
+    }
+  } catch (error) {
+    console.warn("[slides-upload] committed session cleanup failed", {
+      sessionId,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}
+
+export const startChunkedUpload = defineEventHandler(async (event) => {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const authContext = auth.context;
+  if (!authContext.email) {
+    setResponseStatus(event, 401);
+    return { error: "Unauthorized" };
+  }
+
+  return withSlidesRequestContext(
+    event,
+    async () => {
+      if (!isHostedSlidesRuntime()) {
+        return { uploadMode: "multipart" as const };
+      }
+      await reapExpiredChunkedUploads();
+      const body = (await readBody(event).catch(
+        () => null,
+      )) as StartBody | null;
+      const filename =
+        typeof body?.filename === "string" ? body.filename.trim() : "";
+      const mimetype =
+        typeof body?.mimetype === "string" && body.mimetype.trim()
+          ? body.mimetype.trim()
+          : "application/octet-stream";
+      const declaredSize = Number(body?.declaredSize);
+      if (!filename) {
+        setResponseStatus(event, 400);
+        return { error: "filename is required" };
+      }
+      if (!Number.isSafeInteger(declaredSize) || declaredSize <= 0) {
+        setResponseStatus(event, 400);
+        return { error: "declaredSize must be a positive integer" };
+      }
+      const limit = maxReferenceFileBytes(filename);
+      if (declaredSize > limit) {
+        setResponseStatus(event, 413);
+        return {
+          error: `File too large (max ${Math.round(limit / 1024 / 1024)} MB)`,
+        };
+      }
+
+      const sessionId = nanoid();
+      const now = Date.now();
+      await createChunkedUploadSession(sessionId, {
+        filename,
+        mimeType: mimetype,
+        declaredSize,
+        chunks: {},
+        chunkSizes: {},
+        createdAt: new Date(now).toISOString(),
+        expiresAt: new Date(now + SESSION_TTL_MS).toISOString(),
+      });
+      return { sessionId, maxChunkBytes: MAX_CHUNK_BYTES };
+    },
+    authContext,
+  );
+});
+
+export const uploadChunkedChunk = defineEventHandler(async (event) => {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const authContext = auth.context;
+  const email = authContext.email;
+  if (!email) {
+    setResponseStatus(event, 401);
+    return { error: "Unauthorized" };
+  }
+
+  return withSlidesRequestContext(
+    event,
+    async ({ orgId }) => {
+      const sessionId = getRouterParam(event, "sessionId");
+      if (!sessionId) {
+        setResponseStatus(event, 400);
+        return { error: "Missing sessionId" };
+      }
+      const session = await getChunkedUploadSession(sessionId);
+      if (!session) {
+        setResponseStatus(event, 404);
+        return { error: "Upload session not found or expired" };
+      }
+      if (Date.parse(session.expiresAt) <= Date.now()) {
+        await discardSession(sessionId, session);
+        setResponseStatus(event, 410);
+        return { error: "Upload session expired" };
+      }
+
+      const query = getQuery(event);
+      const index = Number(query.index ?? 0);
+      const isFinal = query.isFinal === "1" || query.isFinal === "true";
+      if (!Number.isInteger(index) || index < 0 || index >= MAX_CHUNKS) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid chunk index" };
+      }
+
+      const contentLengthHeader = getHeader(event, "content-length");
+      if (!contentLengthHeader || !/^\d+$/.test(contentLengthHeader)) {
+        setResponseStatus(event, 411);
+        return { error: "Valid Content-Length header required" };
+      }
+      const contentLength = Number(contentLengthHeader);
+      if (contentLength <= 0) {
+        setResponseStatus(event, 400);
+        return { error: "Empty chunk body" };
+      }
+      if (contentLength > MAX_CHUNK_BYTES) {
+        setResponseStatus(event, 413);
+        return { error: "Chunk too large" };
+      }
+
+      const chunkKey = String(index);
+      const previousSize = session.chunkSizes[chunkKey] ?? 0;
+      const receivedBefore = Object.values(session.chunkSizes).reduce(
+        (total, size) => total + size,
+        0,
+      );
+      const nextSize = receivedBefore - previousSize + contentLength;
+      const fileLimit = maxReferenceFileBytes(session.filename);
+      if (nextSize > session.declaredSize || nextSize > fileLimit) {
+        await discardSession(sessionId, session);
+        setResponseStatus(event, 413);
+        return { error: "Uploaded bytes exceed the declared file size" };
+      }
+
+      const raw = await readRawBody(event, false);
+      const bytes = raw ?? new Uint8Array(0);
+      if (bytes.byteLength !== contentLength) {
+        setResponseStatus(event, 400);
+        return { error: "Chunk size does not match Content-Length" };
+      }
+
+      const previousHandle = session.chunks[chunkKey];
+      if (previousHandle && !(await deleteChunk(previousHandle))) {
+        setResponseStatus(event, 503);
+        return { error: "Could not replace the previously uploaded chunk" };
+      }
+
+      const handle = await putPrivateBlob({
+        data: bytes,
+        filename: `${sessionId}-${index}`,
+        mimeType: "application/octet-stream",
+        ownerEmail: email,
+      });
+      if (!handle) {
+        setResponseStatus(event, 503);
+        return { error: "Upload storage is not available" };
+      }
+      session.chunks[chunkKey] = handle;
+      session.chunkSizes[chunkKey] = bytes.byteLength;
+      await createChunkedUploadSession(sessionId, session);
+
+      if (!isFinal) return { ok: true };
+
+      const orderedIndices = Object.keys(session.chunks)
+        .map(Number)
+        .sort((a, b) => a - b);
+      const missing = orderedIndices.some((value, i) => value !== i);
+      const receivedSize = Object.values(session.chunkSizes).reduce(
+        (total, size) => total + size,
+        0,
+      );
+      if (
+        missing ||
+        orderedIndices.length === 0 ||
+        receivedSize !== session.declaredSize
+      ) {
+        await discardSession(sessionId, session);
+        setResponseStatus(event, 400);
+        return { error: "Upload is incomplete or has an invalid size" };
+      }
+
+      let result;
+      try {
+        const parts = await Promise.all(
+          orderedIndices.map(async (chunkIndex) => {
+            const chunkHandle = session.chunks[String(chunkIndex)];
+            const read = await readPrivateBlob(chunkHandle);
+            return Buffer.from(read.data);
+          }),
+        );
+        const combined = Buffer.concat(parts);
+        if (combined.byteLength !== session.declaredSize) {
+          throw new Error("Assembled upload size does not match declaredSize");
+        }
+        result = await saveUploadedReferenceFile({
+          email,
+          orgId,
+          originalName: session.filename,
+          data: combined,
+          type: session.mimeType,
+        });
+      } catch (err) {
+        await discardSession(sessionId, session);
+        const statusCode =
+          typeof (err as { statusCode?: unknown })?.statusCode === "number"
+            ? (err as { statusCode: number }).statusCode
+            : 400;
+        setResponseStatus(event, statusCode);
+        return { error: err instanceof Error ? err.message : "Invalid upload" };
+      }
+
+      await cleanupCommittedSession(sessionId, session);
+      return [result];
+    },
+    authContext,
+  );
+});

package/corpus/templates/slides/server/handlers/uploads.ts

@@ -11,6 +11,7 @@ import { nanoid } from "nanoid";
 import {
   MAX_FIG_REFERENCE_FILE_BYTES,
   MAX_REFERENCE_FILE_BYTES,
+  MAX_REFERENCE_FILES,
   SLIDES_REFERENCE_FILE_ERROR_LABEL,
   isSlidesReferenceFileExtension,
 } from "../../shared/upload-types.js";
@@ -237,11 +238,9 @@ export const uploadFiles = defineEventHandler(async (event) => {
         return { error: "No files uploaded" };
       }
 
-      const MAX_FILES = 20;
-
-      if (fileParts.length > MAX_FILES) {
+      if (fileParts.length > MAX_REFERENCE_FILES) {
         setResponseStatus(event, 413);
-        return { error: `Too many files (max ${MAX_FILES})` };
+        return { error: `Too many files (max ${MAX_REFERENCE_FILES})` };
       }
 
       const oversized = fileParts.find(

package/corpus/templates/slides/server/lib/chunked-upload-session.ts

@@ -0,0 +1,54 @@
+import {
+  deleteAppState,
+  listAppState,
+  readAppState,
+  writeAppState,
+} from "@agent-native/core/application-state";
+import type { PrivateBlobHandle } from "@agent-native/core/private-blob";
+
+export interface ChunkedUploadSession {
+  filename: string;
+  mimeType: string;
+  declaredSize: number;
+  chunks: Record<string, PrivateBlobHandle>;
+  chunkSizes: Record<string, number>;
+  createdAt: string;
+  expiresAt: string;
+}
+
+const PREFIX = "slides-upload-chunks-";
+const key = (sessionId: string) => `${PREFIX}${sessionId}`;
+
+export async function createChunkedUploadSession(
+  sessionId: string,
+  session: ChunkedUploadSession,
+): Promise<void> {
+  await writeAppState(
+    key(sessionId),
+    session as unknown as Record<string, unknown>,
+  );
+}
+
+export async function getChunkedUploadSession(
+  sessionId: string,
+): Promise<ChunkedUploadSession | null> {
+  const raw = await readAppState(key(sessionId));
+  if (!raw || typeof raw !== "object") return null;
+  return raw as unknown as ChunkedUploadSession;
+}
+
+export async function listChunkedUploadSessions(): Promise<
+  Array<{ sessionId: string; session: ChunkedUploadSession }>
+> {
+  const entries = await listAppState(PREFIX);
+  return entries.map(({ key: entryKey, value }) => ({
+    sessionId: entryKey.slice(PREFIX.length),
+    session: value as unknown as ChunkedUploadSession,
+  }));
+}
+
+export async function deleteChunkedUploadSession(
+  sessionId: string,
+): Promise<void> {
+  await deleteAppState(key(sessionId));
+}

package/corpus/templates/slides/server/routes/api/uploads-chunked/[sessionId]/chunk.post.ts

@@ -0,0 +1 @@
+export { uploadChunkedChunk as default } from "../../../../handlers/uploads-chunked";

package/corpus/templates/slides/server/routes/api/uploads-chunked/start.post.ts

@@ -0,0 +1 @@
+export { startChunkedUpload as default } from "../../../handlers/uploads-chunked";

package/corpus/templates/slides/shared/upload-types.ts

@@ -25,6 +25,7 @@ export const SLIDES_REFERENCE_FILE_LABEL =
 export const SLIDES_REFERENCE_FILE_ERROR_LABEL =
   "pptx, docx, pdf, fig, text, Markdown, JSON, CSV, and images including SVG";
 
+export const MAX_REFERENCE_FILES = 20;
 export const MAX_REFERENCE_FILE_BYTES = 50 * 1024 * 1024;
 export const MAX_FIG_REFERENCE_FILE_BYTES = 200 * 1024 * 1024;
 

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/builder.js

@@ -199,6 +199,30 @@ export const builderFileUploadProvider = {
         console.log(`[builder-upload] done: ${json.url}`);
         return { url: json.url, id: json.id, provider: "builder" };
     },
+    delete: async ({ url }) => {
+        const assetUrl = new URL(url);
+        if (assetUrl.hostname !== "cdn.builder.io")
+            return false;
+        assetUrl.search = "";
+        assetUrl.hash = "";
+        const { resolveBuilderCredentials } = await import("../server/credential-provider.js");
+        const credentials = await resolveBuilderCredentials();
+        if (!credentials.privateKey || !credentials.publicKey)
+            return false;
+        const deleteUrl = new URL("/api/v1/assets/by-url", "https://cdn.builder.io");
+        deleteUrl.searchParams.set("url", assetUrl.toString());
+        deleteUrl.searchParams.set("apiKey", credentials.publicKey);
+        const response = await fetchWithTimeout(deleteUrl.toString(), {
+            method: "DELETE",
+            headers: { Authorization: `Bearer ${credentials.privateKey}` },
+        });
+        if (response.ok)
+            return true;
+        if (response.status === 404)
+            return false;
+        await assertOk(response, "Builder.io asset delete failed");
+        return false;
+    },
     resumable: {
         async startSession(filename, mimeType, maxBytes) {
             const { resolveBuilderPrivateKey } = await import("../server/credential-provider.js");

package/dist/file-upload/index.d.ts

@@ -1,4 +1,4 @@
-export type { FileUploadInput, FileUploadProvider, FileUploadResult, ResumableUploadSession, ResumableChunkResult, } from "./types.js";
-export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, uploadFile, } from "./registry.js";
+export type { FileUploadDeleteInput, FileUploadInput, FileUploadProvider, FileUploadResult, ResumableUploadSession, ResumableChunkResult, } from "./types.js";
+export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, deleteUploadedFile, uploadFile, } from "./registry.js";
 export { builderFileUploadProvider } from "./builder.js";
 export { preUploadImageAttachments, preUploadAttachments, isFileUploadProviderConfigured, type PreUploadAttachmentsResult, type PreUploadedImageAttachment, type PreUploadedFileAttachment, } from "./pre-upload-attachments.js";

package/dist/file-upload/index.js

@@ -1,3 +1,3 @@
-export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, uploadFile, } from "./registry.js";
+export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, deleteUploadedFile, uploadFile, } from "./registry.js";
 export { builderFileUploadProvider } from "./builder.js";
 export { preUploadImageAttachments, preUploadAttachments, isFileUploadProviderConfigured, } from "./pre-upload-attachments.js";

package/dist/file-upload/registry.d.ts

@@ -1,4 +1,4 @@
-import type { FileUploadInput, FileUploadProvider, FileUploadResult } from "./types.js";
+import type { FileUploadDeleteInput, FileUploadInput, FileUploadProvider, FileUploadResult } from "./types.js";
 /**
  * Register a file upload provider. Call from a server plugin or app
  * bootstrap. Idempotent per id — later calls with the same id replace.
@@ -19,4 +19,5 @@ export declare function getActiveFileUploadProviderForRequest(): Promise<FileUpl
  * configured. `null` is an explicit storage-setup state: callers must not
  * turn the input into a base64 SQL fallback.
  */
+export declare function deleteUploadedFile(providerId: string, input: FileUploadDeleteInput): Promise<boolean>;
 export declare function uploadFile(input: FileUploadInput): Promise<FileUploadResult | null>;

package/dist/file-upload/registry.js

@@ -59,6 +59,14 @@ export async function getActiveFileUploadProviderForRequest() {
  * configured. `null` is an explicit storage-setup state: callers must not
  * turn the input into a base64 SQL fallback.
  */
+export async function deleteUploadedFile(providerId, input) {
+    const provider = providerId === builderFileUploadProvider.id
+        ? builderFileUploadProvider
+        : providers.get(providerId);
+    if (!provider?.delete)
+        return false;
+    return provider.delete(input);
+}
 export async function uploadFile(input) {
     const provider = await getActiveFileUploadProviderForRequest();
     // User-registered providers (S3, etc.) may be configured by sync runtime

package/dist/file-upload/s3.js

@@ -146,6 +146,56 @@ async function putObject(config, key, data, contentType) {
     }
     return `${config.publicBaseUrl}/${key.split("/").map(encodePathSegment).join("/")}`;
 }
+async function deleteObject(config, key) {
+    const now = new Date();
+    const amzDate = now
+        .toISOString()
+        .replace(/[:-]|\.\d{3}/g, "")
+        .slice(0, 15) + "Z";
+    const dateStamp = amzDate.slice(0, 8);
+    const credentialScope = `${dateStamp}/${config.region}/s3/aws4_request`;
+    const host = new URL(config.endpoint).host;
+    const canonicalUri = objectPath(config, key);
+    const payloadHash = await sha256(new Uint8Array(0));
+    const headers = {
+        host,
+        "x-amz-content-sha256": payloadHash,
+        "x-amz-date": amzDate,
+    };
+    const signedHeaderKeys = Object.keys(headers).sort();
+    const signedHeaders = signedHeaderKeys.join(";");
+    const canonicalHeaders = signedHeaderKeys
+        .map((header) => `${header}:${headers[header]}`)
+        .join("\n") + "\n";
+    const canonicalRequest = [
+        "DELETE",
+        canonicalUri,
+        "",
+        canonicalHeaders,
+        signedHeaders,
+        payloadHash,
+    ].join("\n");
+    const requestHash = await sha256(new TextEncoder().encode(canonicalRequest));
+    const stringToSign = [
+        "AWS4-HMAC-SHA256",
+        amzDate,
+        credentialScope,
+        requestHash,
+    ].join("\n");
+    const signature = toHex(await hmac(await signingKey(config.secretAccessKey, dateStamp, config.region), stringToSign));
+    const authorization = `AWS4-HMAC-SHA256 Credential=${config.accessKeyId}/${credentialScope}, ` +
+        `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+    const response = await fetch(`${config.endpoint}${canonicalUri}`, {
+        method: "DELETE",
+        headers: { ...headers, Authorization: authorization },
+    });
+    if (response.ok)
+        return true;
+    if (response.status === 404)
+        return false;
+    const detail = await response.text();
+    throw new Error(`S3 DeleteObject failed (${response.status}): ${detail || response.statusText}`);
+}
 function safeFilename(filename) {
     const basename = filename?.split(/[\\/]/).pop()?.trim() || "attachment";
     return (basename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 160) || "attachment");
@@ -163,6 +213,14 @@ export const s3FileUploadProvider = {
         const key = `uploads/${Date.now()}-${Math.random().toString(36).slice(2, 10)}-${safeFilename(filename)}`;
         const bytes = data instanceof Uint8Array ? data : new Uint8Array(data);
         const url = await putObject(config, key, bytes, mimeType || "application/octet-stream");
-        return { url, provider: "s3" };
+        return { url, id: key, provider: "s3" };
+    },
+    delete: async ({ id }) => {
+        if (!id)
+            return false;
+        const config = await readRequestConfig();
+        if (!config)
+            return false;
+        return deleteObject(config, id);
     },
 };

package/dist/file-upload/types.d.ts

@@ -28,6 +28,10 @@ export interface FileUploadResult {
     /** The provider that handled the upload. */
     provider: string;
 }
+export interface FileUploadDeleteInput {
+    url: string;
+    id?: string;
+}
 /** Opaque session handle returned by {@link FileUploadProvider.resumable.startSession}.
  * `sessionId` is provider-specific (GCS Location URI, S3 UploadId, etc.).
  * `meta` holds any provider state needed for subsequent relay and complete calls. */
@@ -56,6 +60,8 @@ export interface FileUploadProvider {
     isConfiguredForRequest?: () => Promise<boolean>;
     /** Upload a file and return a URL. Throw on failure. */
     upload: (input: FileUploadInput) => Promise<FileUploadResult>;
+    /** Delete a previously uploaded file when the provider supports it. */
+    delete?: (input: FileUploadDeleteInput) => Promise<boolean>;
     /**
      * Optional resumable/streaming upload capability.
      * When present, create-recording will initialise a session and stream chunks

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
-    error?: undefined;
     count: number;
     updated?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated: number;
+    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,8 +26,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/private-blob/registry.d.ts

@@ -3,11 +3,6 @@ export declare function registerPrivateBlobProvider(provider: PrivateBlobProvide
 export declare function unregisterPrivateBlobProvider(id: string): void;
 export declare function listPrivateBlobProviders(): PrivateBlobProvider[];
 export declare function getActivePrivateBlobProvider(): PrivateBlobProvider | null;
-/**
- * @deprecated Use `defineAppConfig({ privateBlob: { publicUploadFallback } })`
- * instead. This writes the same value into the deprecated layer of the config
- * ladder, so an explicit `defineAppConfig` call now wins over it.
- */
 export declare function setPrivateBlobPublicUploadFallbackEnabled(enabled: boolean): void;
 export declare function putPrivateBlob(input: PrivateBlobPutInput): Promise<PrivateBlobHandle | null>;
 export declare function readPrivateBlob(handle: PrivateBlobHandle): Promise<PrivateBlobReadResult>;

package/dist/private-blob/registry.js

@@ -1,12 +1,14 @@
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { getAppConfig } from "../app-config/index.js";
-import { setAppConfigLayer } from "../app-config/store.js";
-import { uploadFile } from "../file-upload/index.js";
+import { deleteUploadedFile, uploadFile } from "../file-upload/index.js";
 import { decryptSecretValue, encryptSecretValue, getSecretEncryptionKey, } from "../secrets/crypto.js";
 const PUBLIC_UPLOAD_HANDLE_PREFIX = "public-upload:v1:";
 const PUBLIC_UPLOAD_READ_RETRY_DELAYS_MS = [100, 250, 500];
 const globals = globalThis;
 const providers = (globals.__agentNativePrivateBlobProviders ??= new Map());
+const publicUploadFallbackRef = (globals.__agentNativePrivateBlobPublicUploadFallback ??= {
+    enabled: true,
+});
 function toBytes(data) {
     return data instanceof Uint8Array ? data : new Uint8Array(data);
 }
@@ -170,13 +172,16 @@ export function listPrivateBlobProviders() {
     return [...providers.values()];
 }
 export function getActivePrivateBlobProvider() {
-    const selected = getAppConfig().privateBlob.provider;
-    if (selected) {
-        const provider = providers.get(selected);
-        if (!provider) {
-            throw new Error(`Private blob provider "${selected}" is selected in app config but no provider with that id is registered`);
+    const selectedId = getAppConfig().privateBlob.provider;
+    if (selectedId) {
+        const selected = providers.get(selectedId);
+        if (!selected) {
+            throw new Error(`Private blob config selects '${selectedId}', but no provider with that id is registered`);
         }
-        return provider;
+        if (!selected.isConfigured()) {
+            throw new Error(`Private blob provider '${selectedId}' is selected but not configured`);
+        }
+        return selected;
     }
     for (const provider of providers.values()) {
         if (provider.isConfigured())
@@ -184,20 +189,15 @@ export function getActivePrivateBlobProvider() {
     }
     return null;
 }
-/**
- * @deprecated Use `defineAppConfig({ privateBlob: { publicUploadFallback } })`
- * instead. This writes the same value into the deprecated layer of the config
- * ladder, so an explicit `defineAppConfig` call now wins over it.
- */
 export function setPrivateBlobPublicUploadFallbackEnabled(enabled) {
-    setAppConfigLayer("legacy", {
-        privateBlob: { publicUploadFallback: enabled },
-    });
+    publicUploadFallbackRef.enabled = enabled;
 }
 export async function putPrivateBlob(input) {
     const provider = getActivePrivateBlobProvider();
     if (provider)
         return provider.put(input);
+    if (!publicUploadFallbackRef.enabled)
+        return null;
     if (!getAppConfig().privateBlob.publicUploadFallback)
         return null;
     return putViaEncryptedPublicUpload(input);
@@ -216,10 +216,17 @@ export async function deletePrivateBlob(handle) {
     if (provider)
         return provider.delete(handle);
     if (isPublicUploadFallbackHandle(handle)) {
+        const descriptor = decodePublicUploadDescriptor(handle.id);
+        const deleted = await deleteUploadedFile(descriptor.uploadProvider, {
+            url: descriptor.url,
+            id: descriptor.uploadId,
+        });
         return {
-            deleted: false,
+            deleted,
             provider: handle.provider,
-            reason: "delete is not supported by the encrypted public-upload fallback provider",
+            ...(deleted
+                ? {}
+                : { reason: "backing upload provider could not delete the asset" }),
         };
     }
     throw new Error(`No private blob provider registered for ${handle.provider}`);

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/resources/handlers.d.ts

@@ -51,8 +51,8 @@ export declare function handleDeleteResource(event: any): Promise<{
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,10 +73,10 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
-    error?: undefined;
     url: string;
     provider: string;
     storageSetupRequired?: undefined;
+    error?: undefined;
 } | {
     error: string;
     storageSetupRequired: boolean;

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.168.5",
+  "version": "0.168.6",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {