@agent-native/core 0.169.0 → 0.170.0

package/dist/connections/catalog.d.ts

@@ -1,6 +1,6 @@
 export type WorkspaceConnectionCapability = "search" | "import" | "messages" | "meetings" | "crm" | "code" | "docs";
 export type WorkspaceConnectionTemplateUse = "analytics" | "brain" | "calendar" | "clips" | "content" | "crm" | "design" | "dispatch" | "factory" | "forms" | "mail" | "slides";
-export type WorkspaceConnectionProviderId = "slack" | "github" | "figma" | "notion" | "gmail" | "google_drive" | "hubspot" | "salesforce" | "jira" | "sentry" | "granola" | "clips" | "generic";
+export type WorkspaceConnectionProviderId = "slack" | "github" | "figma" | "notion" | "gmail" | "google_calendar" | "google_drive" | "google_docs" | "google_sheets" | "google_slides" | "hubspot" | "salesforce" | "jira" | "sentry" | "granola" | "clips" | "generic";
 export interface WorkspaceConnectionCredentialKey {
     key: string;
     label: string;
@@ -97,35 +97,137 @@ export declare const WORKSPACE_CONNECTION_PROVIDERS: readonly [{
     readonly description: "Mailbox messages and threads for search, triage, customer context, and agent replies.";
     readonly credentialKeys: readonly [{
         readonly key: "GOOGLE_CLIENT_ID";
-        readonly label: "Google OAuth client ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
         readonly required: true;
     }, {
         readonly key: "GOOGLE_CLIENT_SECRET";
-        readonly label: "Google OAuth client secret";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
         readonly required: true;
     }];
     readonly capabilities: readonly ["search", "import", "messages"];
     readonly recommendedTemplateUses: readonly ["mail", "brain", "dispatch"];
+    readonly oauth: {
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
+    };
+}, {
+    readonly id: "google_calendar";
+    readonly label: "Google Calendar";
+    readonly description: "Calendars and events for scheduling, availability, reminders, and meeting workflows.";
+    readonly credentialKeys: readonly [{
+        readonly key: "GOOGLE_CLIENT_ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }, {
+        readonly key: "GOOGLE_CLIENT_SECRET";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }];
+    readonly capabilities: readonly ["search", "import", "meetings"];
+    readonly recommendedTemplateUses: readonly ["calendar", "brain", "dispatch", "mail"];
+    readonly oauth: {
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
+    };
 }, {
     readonly id: "google_drive";
     readonly label: "Google Drive";
     readonly description: "Drive files, Docs, Sheets, and Slides for document search and import workflows.";
     readonly credentialKeys: readonly [{
         readonly key: "GOOGLE_CLIENT_ID";
-        readonly label: "Google OAuth client ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
         readonly required: true;
     }, {
         readonly key: "GOOGLE_CLIENT_SECRET";
-        readonly label: "Google OAuth client secret";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
         readonly required: true;
     }];
     readonly capabilities: readonly ["search", "import", "docs"];
     readonly recommendedTemplateUses: readonly ["brain", "content", "slides", "dispatch", "analytics"];
     readonly oauth: {
-        readonly provider: "google";
-        readonly authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
-        readonly tokenUrl: "https://oauth2.googleapis.com/token";
-        readonly scopes: readonly ["https://www.googleapis.com/auth/drive.file"];
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
+    };
+}, {
+    readonly id: "google_docs";
+    readonly label: "Google Docs";
+    readonly description: "Google Docs files for source material, document search, and agent-assisted writing workflows.";
+    readonly credentialKeys: readonly [{
+        readonly key: "GOOGLE_CLIENT_ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }, {
+        readonly key: "GOOGLE_CLIENT_SECRET";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }];
+    readonly capabilities: readonly ["search", "import", "docs"];
+    readonly recommendedTemplateUses: readonly ["brain", "content", "slides", "dispatch"];
+    readonly oauth: {
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
+    };
+}, {
+    readonly id: "google_sheets";
+    readonly label: "Google Sheets";
+    readonly description: "Google Sheets workbooks for analysis, reporting, imports, and structured agent workflows.";
+    readonly credentialKeys: readonly [{
+        readonly key: "GOOGLE_CLIENT_ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }, {
+        readonly key: "GOOGLE_CLIENT_SECRET";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }];
+    readonly capabilities: readonly ["search", "import", "docs"];
+    readonly recommendedTemplateUses: readonly ["analytics", "brain", "content", "dispatch"];
+    readonly oauth: {
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
+    };
+}, {
+    readonly id: "google_slides";
+    readonly label: "Google Slides";
+    readonly description: "Google Slides presentations for reference imports, visual context, and presentation workflows.";
+    readonly credentialKeys: readonly [{
+        readonly key: "GOOGLE_CLIENT_ID";
+        readonly label: "Managed Google OAuth client ID";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }, {
+        readonly key: "GOOGLE_CLIENT_SECRET";
+        readonly label: "Managed Google OAuth client secret";
+        readonly description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.";
+        readonly required: true;
+    }];
+    readonly capabilities: readonly ["search", "import", "docs"];
+    readonly recommendedTemplateUses: readonly ["brain", "content", "slides", "dispatch"];
+    readonly oauth: {
+        provider: "google";
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth";
+        tokenUrl: "https://oauth2.googleapis.com/token";
+        scopes: readonly string[];
     };
 }, {
     readonly id: "hubspot";

package/dist/connections/catalog.js

@@ -1,6 +1,29 @@
 export function defineWorkspaceConnectionProvider(provider) {
     return provider;
 }
+const GOOGLE_CREDENTIAL_KEYS = [
+    {
+        key: "GOOGLE_CLIENT_ID",
+        label: "Managed Google OAuth client ID",
+        description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.",
+        required: true,
+    },
+    {
+        key: "GOOGLE_CLIENT_SECRET",
+        label: "Managed Google OAuth client secret",
+        description: "Resolved from the workspace's shared Google OAuth application. Users do not paste a key to connect a service.",
+        required: true,
+    },
+];
+const GOOGLE_OAUTH_BASE = {
+    provider: "google",
+    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+};
+function googleOAuth(scopes) {
+    return { ...GOOGLE_OAUTH_BASE, scopes };
+}
+const GOOGLE_IDENTITY_SCOPES = ["openid", "email", "profile"];
 export const WORKSPACE_CONNECTION_PROVIDERS = [
     defineWorkspaceConnectionProvider({
         id: "slack",
@@ -84,37 +107,35 @@ export const WORKSPACE_CONNECTION_PROVIDERS = [
         id: "gmail",
         label: "Gmail",
         description: "Mailbox messages and threads for search, triage, customer context, and agent replies.",
-        credentialKeys: [
-            {
-                key: "GOOGLE_CLIENT_ID",
-                label: "Google OAuth client ID",
-                required: true,
-            },
-            {
-                key: "GOOGLE_CLIENT_SECRET",
-                label: "Google OAuth client secret",
-                required: true,
-            },
-        ],
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
         capabilities: ["search", "import", "messages"],
         recommendedTemplateUses: ["mail", "brain", "dispatch"],
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/gmail.readonly",
+            "https://www.googleapis.com/auth/gmail.send",
+            "https://www.googleapis.com/auth/gmail.modify",
+            "https://www.googleapis.com/auth/gmail.settings.basic",
+        ]),
+    }),
+    defineWorkspaceConnectionProvider({
+        id: "google_calendar",
+        label: "Google Calendar",
+        description: "Calendars and events for scheduling, availability, reminders, and meeting workflows.",
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
+        capabilities: ["search", "import", "meetings"],
+        recommendedTemplateUses: ["calendar", "brain", "dispatch", "mail"],
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/calendar.readonly",
+            "https://www.googleapis.com/auth/calendar.events",
+        ]),
     }),
     defineWorkspaceConnectionProvider({
         id: "google_drive",
         label: "Google Drive",
         description: "Drive files, Docs, Sheets, and Slides for document search and import workflows.",
-        credentialKeys: [
-            {
-                key: "GOOGLE_CLIENT_ID",
-                label: "Google OAuth client ID",
-                required: true,
-            },
-            {
-                key: "GOOGLE_CLIENT_SECRET",
-                label: "Google OAuth client secret",
-                required: true,
-            },
-        ],
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
         capabilities: ["search", "import", "docs"],
         recommendedTemplateUses: [
             "brain",
@@ -123,12 +144,47 @@ export const WORKSPACE_CONNECTION_PROVIDERS = [
             "dispatch",
             "analytics",
         ],
-        oauth: {
-            provider: "google",
-            authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-            tokenUrl: "https://oauth2.googleapis.com/token",
-            scopes: ["https://www.googleapis.com/auth/drive.file"],
-        },
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/drive.file",
+            "https://www.googleapis.com/auth/drive.readonly",
+        ]),
+    }),
+    defineWorkspaceConnectionProvider({
+        id: "google_docs",
+        label: "Google Docs",
+        description: "Google Docs files for source material, document search, and agent-assisted writing workflows.",
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
+        capabilities: ["search", "import", "docs"],
+        recommendedTemplateUses: ["brain", "content", "slides", "dispatch"],
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/documents.readonly",
+        ]),
+    }),
+    defineWorkspaceConnectionProvider({
+        id: "google_sheets",
+        label: "Google Sheets",
+        description: "Google Sheets workbooks for analysis, reporting, imports, and structured agent workflows.",
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
+        capabilities: ["search", "import", "docs"],
+        recommendedTemplateUses: ["analytics", "brain", "content", "dispatch"],
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/spreadsheets.readonly",
+        ]),
+    }),
+    defineWorkspaceConnectionProvider({
+        id: "google_slides",
+        label: "Google Slides",
+        description: "Google Slides presentations for reference imports, visual context, and presentation workflows.",
+        credentialKeys: GOOGLE_CREDENTIAL_KEYS,
+        capabilities: ["search", "import", "docs"],
+        recommendedTemplateUses: ["brain", "content", "slides", "dispatch"],
+        oauth: googleOAuth([
+            ...GOOGLE_IDENTITY_SCOPES,
+            "https://www.googleapis.com/auth/presentations.readonly",
+        ]),
     }),
     defineWorkspaceConnectionProvider({
         id: "hubspot",

package/dist/db/create-get-db.js

@@ -519,6 +519,24 @@ export function createGetDb(schema) {
                     });
                     return promise[prop].bind(promise);
                 }
+                // drizzle-orm duck-types "is this an SQL entity" by reading these two
+                // properties directly off a value — synchronously, without awaiting
+                // (see `isSQLWrapper` in drizzle-orm/sql/sql.js). Because this proxy's
+                // target is a function, answering that probe with another proxy would
+                // make an un-awaited chain (e.g. a subquery chain embedded as a raw
+                // value instead of being awaited — the pattern that broke
+                // list-recordings.ts) masquerade as a resolved SQL entity. drizzle
+                // then calls `.getSQL()` on it, which duck-types as a wrapper again,
+                // forever — `RangeError: Maximum call stack size exceeded` deep
+                // inside drizzle internals instead of a message pointing at the
+                // actual bug. Fail loudly here instead, at the point of misuse.
+                if (prop === "getSQL" || prop === "shouldOmitSQLParens") {
+                    throw new Error("getDb(): accessed an unresolved query chain synchronously " +
+                        `(reading '${String(prop)}'). This chain was embedded as a raw ` +
+                        "value instead of being awaited first — e.g. a subquery passed " +
+                        "straight into another expression. Await the chain before " +
+                        "using its result.");
+                }
                 // Symbol.toStringTag, Symbol.iterator, etc. — return another proxy
                 // Property access (e.g. db.query) — record and return another proxy
                 return createLazyProxy(ready, [...chain, { prop }]);

package/dist/db/ddl-guard.d.ts

@@ -125,10 +125,6 @@ export declare function ensureColumnExists(table: string, column: string, addCol
     lockTimeout?: string;
     injectedClient?: DbExec;
 }): Promise<boolean>;
-/**
- * Convenience wrapper: ensure an INDEX exists (probe via `pgIndexExists`).
- * `createIndexSql` should be the full `CREATE INDEX IF NOT EXISTS <name> …`.
- */
 export declare function ensureIndexExists(indexName: string, createIndexSql: string, options?: {
     lockTimeout?: string;
     injectedClient?: DbExec;

package/dist/db/ddl-guard.js

@@ -391,7 +391,46 @@ export async function ensureColumnExists(table, column, addColumnSql, options =
  * Convenience wrapper: ensure an INDEX exists (probe via `pgIndexExists`).
  * `createIndexSql` should be the full `CREATE INDEX IF NOT EXISTS <name> …`.
  */
+/**
+ * Drop an index that exists under this name but is INVALID.
+ *
+ * A failed `CREATE INDEX CONCURRENTLY` leaves the index present but unusable
+ * (`indisvalid = false`). That is a trap for every repair attempt that follows:
+ * `pgIndexExists` correctly reports it missing, but `CREATE INDEX IF NOT
+ * EXISTS` sees the NAME is taken and skips, so the re-probe fails again and the
+ * release never recovers on its own. Found in production on
+ * `chat_threads_owner_lower_updated_idx` and `sync_events_created_at_id_idx`.
+ *
+ * Dropping is safe: an invalid index serves no query and cannot be repaired in
+ * place — Postgres' own guidance is to drop and rebuild it.
+ */
+async function dropInvalidIndex(indexName, client) {
+    if (!PLAIN_IDENTIFIER.test(indexName))
+        return;
+    const { rows } = await client.execute({
+        sql: `SELECT 1
+          FROM pg_class AS index_class
+          JOIN pg_namespace AS index_namespace
+            ON index_namespace.oid = index_class.relnamespace
+           AND index_namespace.nspname = 'public'
+          JOIN pg_index AS index_state
+            ON index_state.indexrelid = index_class.oid
+          WHERE index_class.relname = ?
+            AND NOT index_state.indisvalid
+          LIMIT 1`,
+        args: [indexName],
+    });
+    if (rows.length === 0)
+        return;
+    console.warn(`[db] dropping INVALID index "${indexName}" so it can be rebuilt; ` +
+        `a previous CREATE INDEX left it unusable.`);
+    await client.execute(`DROP INDEX IF EXISTS "${indexName}"`);
+    invalidateSchemaSnapshot(client);
+}
 export async function ensureIndexExists(indexName, createIndexSql, options = {}) {
+    if ((options.dialectIsPostgres ?? isPostgres()) && !schemaEnsureDisabled()) {
+        await dropInvalidIndex(indexName, options.injectedClient ?? getDbExec());
+    }
     return ensureSchemaObject({
         probe: () => pgIndexExists(indexName, options.injectedClient, options.dialectIsPostgres),
         ddl: createIndexSql,
@@ -420,6 +459,13 @@ export async function ensureIndexExistsConcurrently(indexName, createIndexSql, o
     if (initiallyExists === undefined) {
         throw new Error(`ensureIndexExistsConcurrently: could not probe required index "${indexName}"; refusing to issue DDL`);
     }
+    // This helper is what STRANDS an invalid index in the first place: an
+    // interrupted concurrent build leaves the name taken and the index unusable,
+    // and `CREATE INDEX CONCURRENTLY IF NOT EXISTS` then skips it forever. Clear
+    // it here too, or the one caller that creates the mess is the one caller that
+    // cannot recover from it — which is how `sync_events_created_at_id_idx` has
+    // stayed invalid in production.
+    await dropInvalidIndex(indexName, client);
     await client.execute(createIndexSql);
     invalidateSchemaSnapshot(client);
     const existsAfterCreate = await pgIndexExists(indexName, client, options.dialectIsPostgres);

package/dist/deploy/build.d.ts

@@ -246,6 +246,25 @@ export declare function findNonLinuxBetterSqlite3Binaries(serverDir: string): st
 export declare function bundleYjsRuntimeForServerlessOutput(serverDir: string, projectCwd: string): string[];
 /** Presets whose Node-style output needs the emitted Yjs runtime bundle. */
 export declare function shouldBundleYjsRuntimeForPreset(targetPreset: string): boolean;
+/**
+ * Replace the bundled `better-sqlite3` with a throwing stub in serverless
+ * output.
+ *
+ * The package is 27MB — a 9.1MB `sqlite3.c`, its object files, and a static
+ * archive, none of which a function can use: every consumer is gated on a
+ * `file:` or schemeless `DATABASE_URL`, and a serverless container holding a
+ * file-backed SQLite database is already broken, since the filesystem is
+ * ephemeral and each container gets its own copy.
+ *
+ * It cannot simply be deleted. Drizzle's bundled `_libs/drizzle-orm+postgres`
+ * chunk imports it at module scope, so removing the package turns every cold
+ * start into `ERR_MODULE_NOT_FOUND` — which is how this was first written, and
+ * what the SSR cold-start smoke caught. The stub keeps the specifier
+ * resolvable and moves the failure to the only place it can be acted on: a
+ * deploy that actually tries to open a file-backed database, which now throws
+ * with the reason instead of quietly serving an empty one.
+ */
+export declare function stubLocalOnlySqliteDriverForServerless(serverDir: string): number;
 export declare function assertSingleTemplateNetlifyBuildOutput(projectCwd: string): void;
 /**
  * Strip the harmful single-template catch-all rewrite that points at
@@ -254,6 +273,19 @@ export declare function assertSingleTemplateNetlifyBuildOutput(projectCwd: strin
  * Netlify platform 404s. Preserve any real redirects from `public/_redirects`.
  */
 export declare function writeSingleTemplateNetlifyRedirects(projectCwd: string): void;
+/**
+ * Whether the emitted bundle actually imports the `libsql` native addon.
+ *
+ * The `@libsql/client` node entry `require`s it; `@libsql/client/web` and
+ * `better-sqlite3` do not. Probing the emitted output is the only gate that
+ * cannot be wrong: `getDialect()` reads `DATABASE_URL` at RUNTIME, and neither
+ * the docs nor the beta deploy workflow sets it at build time, so build-time
+ * dialect is unknowable. This mirrors `findServerlessBrowserRuntimeConsumer`,
+ * which already gates the Chromium copy the same way — the asymmetry is why a
+ * 9.3MB Linux SQLite driver shipped in the docs function, a deployment that
+ * runs Postgres and can never load it.
+ */
+export declare function bundleImportsLibsqlNativeAddon(serverDir: string): boolean;
 /**
  * Nitro's file tracer can over-include optional desktop/dev packages that are
  * present in a monorepo install but cannot run in serverless. Netlify installs