@agent-native/core 0.169.1 → 0.170.0

package/dist/deploy/function-bundle.js

@@ -87,3 +87,340 @@ function copyTree(src, dest, placeFile, ancestorRealPaths = new Set()) {
         }
     }
 }
+/** Nitro's SSR page/asset route entries. Only the `/*` server function uses these. */
+const SSR_ENTRY_FILES = [
+    "_...page_.get.mjs",
+    "_...page_.head.mjs",
+    "_...asset_.get.mjs",
+];
+// Rolldown emits `import(`./x.mjs`)` with BACKTICKS; a quote-only pattern
+// under-reports the graph by tens of MB and would delete reachable chunks.
+const SPECIFIER = /(?:from|import|require)\s*\(?\s*(["'`])([^"'`]*)\1/g;
+// `import(`${pkg}/server`)` is a BARE specifier and can never name a local
+// chunk. Only a specifier that is relative BEFORE the interpolation is
+// genuinely unresolvable, and that is when we must not guess.
+const RELATIVE_INTERPOLATED = /import\s*\(\s*`\s*[./][^`]*\$\{/;
+/**
+ * Every file reachable from `main.mjs`, treating `removed` as already deleted.
+ * Returns null when the graph cannot be resolved statically, so the caller
+ * prunes nothing rather than deleting a chunk something still imports.
+ */
+function reachableFiles(dir, removed) {
+    const seen = new Set();
+    const visit = (file) => {
+        if (seen.has(file))
+            return true;
+        seen.add(file);
+        let src;
+        try {
+            src = fs.readFileSync(file, "utf-8");
+        }
+        catch {
+            return true;
+        }
+        if (RELATIVE_INTERPOLATED.test(src))
+            return false;
+        SPECIFIER.lastIndex = 0;
+        for (let m; (m = SPECIFIER.exec(src));) {
+            const spec = m[2];
+            if (!spec.startsWith("."))
+                continue;
+            const base = path.resolve(path.dirname(file), spec);
+            const hit = [
+                base,
+                `${base}.mjs`,
+                `${base}.js`,
+                path.join(base, "index.mjs"),
+            ].find((c) => fs.existsSync(c) && fs.statSync(c).isFile());
+            // Docs prose inside the bundle contains path-shaped strings that are not
+            // imports; a specifier resolving to nothing is not an edge.
+            if (!hit)
+                continue;
+            if (removed.has(path.relative(dir, hit)))
+                continue;
+            if (!visit(hit))
+                return false;
+        }
+        return true;
+    };
+    return visit(path.join(dir, "main.mjs")) ? seen : null;
+}
+/**
+ * Drop the SSR page/asset island from a clone that can never route to it.
+ *
+ * The background and integration-recovery entries overwrite `url.pathname`
+ * unconditionally before delegating to `main.mjs`, so those clones cannot reach
+ * the page or asset handlers — yet each shipped a full copy of that island, and
+ * Netlify zips and uploads every function separately. Deleting from the clone is
+ * safe under hard links: only an in-place WRITE would reach the source bundle.
+ */
+export function pruneSsrIslandFromRewritingClone(dest, entryText) {
+    if (!/^\s*url\.pathname\s*=/m.test(entryText)) {
+        throw new Error("[deploy] SSR prune requires a clone entry that rewrites url.pathname unconditionally");
+    }
+    const full = reachableFiles(dest, new Set());
+    const lean = reachableFiles(dest, new Set(SSR_ENTRY_FILES));
+    if (!full || !lean) {
+        console.warn("[deploy] SSR prune skipped: unresolvable relative dynamic import in the clone.");
+        return 0;
+    }
+    let bytes = 0;
+    for (const file of full) {
+        if (lean.has(file))
+            continue;
+        try {
+            bytes += fs.statSync(file).size;
+            fs.rmSync(file, { force: true });
+        }
+        catch {
+            // coercion-ok: a file already gone is the goal state, and its bytes were
+            // read before the unlink, so the reported total stays honest.
+        }
+    }
+    for (const name of SSR_ENTRY_FILES) {
+        fs.rmSync(path.join(dest, name), { force: true });
+    }
+    return bytes;
+}
+/**
+ * Read a package's manifest, or null when it has none. Shared with build.ts's
+ * copyRuntimePackageTree, which is why this lives here rather than there:
+ * build.ts already imports from this file, and the reverse import would be
+ * circular.
+ */
+export function readPackageManifest(packageDir) {
+    const packageJsonPath = path.join(packageDir, "package.json");
+    if (!fs.existsSync(packageJsonPath))
+        return null;
+    const manifest = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+        return null;
+    }
+    return manifest;
+}
+/**
+ * Every installed package name directly under `nodeModulesDir`, scoped packages
+ * expanded to `@scope/name`.
+ *
+ * Dot-prefixed entries are npm/pnpm bookkeeping, not packages — `.bin` holds
+ * executable links and has no manifest, so treating it as a package makes the
+ * closure walk throw on a perfectly normal bundle.
+ */
+function listTopLevelPackageNames(nodeModulesDir) {
+    if (!fs.existsSync(nodeModulesDir))
+        return [];
+    const names = [];
+    for (const entry of fs.readdirSync(nodeModulesDir, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        if (entry.name.startsWith("."))
+            continue;
+        if (!entry.name.startsWith("@")) {
+            names.push(entry.name);
+            continue;
+        }
+        const scopeDir = path.join(nodeModulesDir, entry.name);
+        for (const scoped of fs.readdirSync(scopeDir, { withFileTypes: true })) {
+            if (scoped.isDirectory())
+                names.push(`${entry.name}/${scoped.name}`);
+        }
+    }
+    return names;
+}
+/**
+ * Every package name reachable from `roots` by walking the given manifest
+ * fields — the same edge copyRuntimePackageTree (build.ts) follows to build the
+ * browser runtime tree in the first place, so a package that tree copied in is
+ * exactly a package this walk can find again.
+ *
+ * The two callers want deliberately different widths. "What might be dead"
+ * walks `dependencies` only, so a dev/optional/peer listing cannot pull an
+ * unrelated package into the browser's closure. "What must live" also walks
+ * `optionalDependencies`: an installed optional dependency is one a surviving
+ * package may still require at runtime, and deleting it is unrecoverable
+ * whereas keeping it costs bytes. Err narrow when deciding what to delete and
+ * wide when deciding what to spare.
+ *
+ * A dependency name with no directory here was never installed — the same
+ * BARE_RUNTIME_ONLY_PACKAGES / SERVERLESS_FUNCTION_PACKAGE_DENYLIST exclusions
+ * upstream leave real, expected gaps in a package's own "dependencies" field,
+ * and a gap is not a resolution failure. A directory that DOES exist without a
+ * readable package.json is one: the closure can no longer be trusted, so that
+ * throws instead of guessing which way is safe.
+ */
+function reachablePackageNames(nodeModulesDir, roots, fields = ["dependencies"]) {
+    const seen = new Set();
+    const visit = (packageName) => {
+        if (seen.has(packageName))
+            return;
+        seen.add(packageName);
+        const packageDir = path.join(nodeModulesDir, ...packageName.split("/"));
+        if (!fs.existsSync(packageDir))
+            return;
+        const manifest = readPackageManifest(packageDir);
+        if (!manifest) {
+            throw new Error(`[deploy] ${packageDir} has no readable package.json; cannot compute the runtime dependency closure it belongs to.`);
+        }
+        for (const field of fields) {
+            const dependencies = manifest[field];
+            if (!dependencies || typeof dependencies !== "object")
+                continue;
+            for (const dependencyName of Object.keys(dependencies)) {
+                visit(dependencyName);
+            }
+        }
+    };
+    for (const root of roots)
+        visit(root);
+    return seen;
+}
+/**
+ * Drop a now-empty `@scope` directory. Never remove a scope that still holds a
+ * package: an unrelated `@sparticuz/*` some other dependency needs lives in the
+ * same scope as the browser runtime, and the closure walk cannot protect what a
+ * scope-wide delete takes.
+ */
+function removeScopeIfEmpty(nodeModulesDir, packageDir) {
+    const scopeDir = path.dirname(packageDir);
+    if (scopeDir === nodeModulesDir)
+        return;
+    if (fs.readdirSync(scopeDir).length > 0)
+        return;
+    fs.rmSync(scopeDir, { recursive: true, force: true });
+}
+/**
+ * The browser runtime copied into serverless functions, by exact package name.
+ *
+ * Exact names, never the `@sparticuz` scope: another dependency can install an
+ * unrelated package into the same scope, and a scope-wide delete takes it with
+ * no way for the closure walk to prove it is still needed. build.ts imports
+ * this rather than declaring its own copy, so the list that is copied in and
+ * the list that is pruned out cannot drift apart.
+ */
+export const SERVERLESS_BROWSER_RUNTIME_PACKAGES = [
+    // chromium-min, not chromium: the full package embeds a 66MB browser in every
+    // emitted function, paid on every cold start to serve a fallback most requests
+    // never take. The min package is 46KB and fetches the same pinned pack on
+    // first launch. See chromiumPackUrl() in creative-context's rendered-page.
+    // guard:allow-serverless-function-payload — -66.4MB per function, replaces "@sparticuz/chromium"
+    "@sparticuz/chromium-min",
+    "playwright-core",
+];
+/**
+ * Any path whose handler can reach an agent turn, directly or transitively.
+ * `_process-run` is the obvious one, but the integration sweep and the
+ * recurring-jobs sweep both resume tasks that run a full agent turn with the
+ * app's whole tool surface, so a path-shape check alone is not enough.
+ */
+const AGENT_CAPABLE_PATH = /_process-run|_process-task|\/integrations\/|recurring-jobs/;
+function dirSize(dir) {
+    let total = 0;
+    const stack = [dir];
+    while (stack.length > 0) {
+        const cur = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(cur, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const full = path.join(cur, entry.name);
+            if (entry.isDirectory())
+                stack.push(full);
+            else {
+                try {
+                    total += fs.statSync(full).size;
+                }
+                catch {
+                    // coercion-ok: an unreadable entry contributes no measurable bytes and
+                    // must not abort a size report.
+                }
+            }
+        }
+    }
+    return total;
+}
+/**
+ * Drop the serverless browser runtime — and everything installed only because
+ * the runtime needed it — from a clone that can never run an agent turn.
+ *
+ * Playwright and @sparticuz/chromium are reached only through NON-LITERAL
+ * dynamic imports in creative-context's rendered-page connector, so no static
+ * walk can prove them dead. The caller asserts it instead, and this refuses the
+ * prune when the entry rewrites to a route that could reach an agent — a
+ * scheduled report sweep can drop the runtime, an agent worker cannot.
+ *
+ * Deleting just the two known directories used to leave their whole
+ * dependency closure behind — packages like tar-fs and pump that exist in
+ * `node_modules` for no other reason than @sparticuz/chromium-min or
+ * playwright-core needing them. Those are orphaned the instant the runtime is
+ * gone, so this walks the closure and removes it too, keeping only what a
+ * still-present, unrelated package also depends on.
+ */
+export function pruneBrowserRuntimeFromNonAgentClone(dest, entryText) {
+    if (!/^\s*url\.pathname\s*=/m.test(entryText)) {
+        throw new Error("[deploy] browser-runtime prune requires a clone entry that rewrites url.pathname unconditionally");
+    }
+    if (AGENT_CAPABLE_PATH.test(entryText)) {
+        throw new Error("[deploy] refusing to prune the browser runtime from a clone whose entry names an agent-capable route");
+    }
+    const nodeModulesDir = path.join(dest, "node_modules");
+    const browserRoots = SERVERLESS_BROWSER_RUNTIME_PACKAGES.filter((name) => fs.existsSync(path.join(nodeModulesDir, ...name.split("/"))));
+    let bytes = 0;
+    if (browserRoots.length > 0) {
+        // Everything reachable from the runtime being deleted — e.g.
+        // @sparticuz/chromium-min's tar-fs, and everything tar-fs needs. A member
+        // of this set is dead UNLESS some other, unrelated top-level package also
+        // depends on it — `stillNeeded` proves that by walking every package that
+        // ISN'T itself downstream of the runtime, so it can never trivially
+        // "prove itself" reachable.
+        const browserClosure = reachablePackageNames(nodeModulesDir, browserRoots);
+        // The function's own manifest is a liveness root too. Its dependencies are
+        // what the emitted bundle traced directly, so a package that is BOTH in the
+        // browser closure and imported by the surviving server has no other package
+        // vouching for it and would be deleted out from under a live import. The
+        // browser roots are excluded — they are declared there as well, and keeping
+        // them would make the whole closure look alive.
+        const ownManifest = readPackageManifest(dest);
+        const ownDependencies = ["dependencies", "optionalDependencies"]
+            .flatMap((field) => Object.keys(ownManifest?.[field] ?? {}))
+            .filter((name) => !browserRoots.includes(name));
+        const otherRoots = [
+            ...listTopLevelPackageNames(nodeModulesDir).filter((name) => !browserClosure.has(name)),
+            ...ownDependencies,
+        ];
+        const stillNeeded = reachablePackageNames(nodeModulesDir, otherRoots, [
+            "dependencies",
+            "optionalDependencies",
+        ]);
+        for (const packageName of browserClosure) {
+            // The roots are deleted below, after their closure.
+            if (browserRoots.includes(packageName))
+                continue;
+            if (stillNeeded.has(packageName))
+                continue;
+            const packageDir = path.join(nodeModulesDir, ...packageName.split("/"));
+            if (!fs.existsSync(packageDir))
+                continue;
+            bytes += dirSize(packageDir);
+            fs.rmSync(packageDir, { recursive: true, force: true });
+            removeScopeIfEmpty(nodeModulesDir, packageDir);
+        }
+    }
+    // Delete the roots themselves by package name, never by scope directory: an
+    // unrelated @sparticuz/* package that some other dependency still needs would
+    // otherwise go with the scope, and `stillNeeded` has no way to protect it.
+    // The scope is removed afterwards only once nothing is left in it.
+    for (const name of browserRoots) {
+        const dir = path.join(nodeModulesDir, ...name.split("/"));
+        if (!fs.existsSync(dir))
+            continue;
+        bytes += dirSize(dir);
+        // Hard links: deleting the clone's link never touches the source bundle.
+        fs.rmSync(dir, { recursive: true, force: true });
+        removeScopeIfEmpty(nodeModulesDir, dir);
+    }
+    return bytes;
+}

package/dist/deploy/workspace-deploy.js

@@ -24,7 +24,7 @@ import { findWorkspaceRoot } from "../scripts/utils.js";
 import { DEFAULT_WORKSPACE_APP_AUDIENCE, normalizeWorkspaceAppAudience, normalizeWorkspaceAppPathList, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromPackageJson, } from "../shared/workspace-app-audience.js";
 import { DISPATCH_WORKSPACE_ROOT_REDIRECTS } from "../shared/workspace-app-id.js";
 import { assertEmittedBackgroundFunctionOnDisk, isRecurringJobsDeployEnabled, } from "./build.js";
-import { cloneServerBundleForFunction } from "./function-bundle.js";
+import { cloneServerBundleForFunction, pruneSsrIslandFromRewritingClone, } from "./function-bundle.js";
 import { collectImmutableAssetPaths, IMMUTABLE_ASSET_CACHE_HEADERS, } from "./immutable-assets.js";
 const NETLIFY_WORKSPACE_STATIC_DIR = "_workspace_static";
 const DEFAULT_HOSTED_FEEDBACK_URL = "https://forms.agent-native.com/f/agent-native-feedback/_16ewV";
@@ -753,6 +753,15 @@ export const config = {
     // is the function entrypoint, mirroring patchNetlifyFunctionEntry.
     fs.rmSync(path.join(dest, "server.mjs"), { force: true });
     fs.writeFileSync(path.join(dest, `${backgroundName}.mjs`), server);
+    {
+        // The clone rewrites url.pathname unconditionally, so it can never
+        // route to the SSR page/asset handlers it inherited. Netlify zips and
+        // uploads every function separately, so that island is paid for twice.
+        const freed = pruneSsrIslandFromRewritingClone(dest, server);
+        if (freed > 0) {
+            console.log(`[deploy] Pruned ${(freed / 1024 / 1024).toFixed(1)}MB of unroutable SSR modules from ${path.basename(dest)}.`);
+        }
+    }
     assertEmittedBackgroundFunctionOnDisk(dest, backgroundName);
     console.log(`[workspace-deploy] Emitted durable-background function "${backgroundName}" ` +
         `for app "${app}" with config { background:true } and NO custom path — ` +
@@ -848,6 +857,15 @@ export const config = {
 };
 `;
     fs.writeFileSync(path.join(dest, `${functionName}.mjs`), entry);
+    {
+        // The clone rewrites url.pathname unconditionally, so it can never route to
+        // the SSR page/asset handlers it inherited. Netlify zips and uploads every
+        // function separately, so that island is paid for on every deploy.
+        const freed = pruneSsrIslandFromRewritingClone(dest, entry);
+        if (freed > 0) {
+            console.log(`[deploy] Pruned ${(freed / 1024 / 1024).toFixed(1)}MB of unroutable SSR modules from ${path.basename(dest)}.`);
+        }
+    }
 }
 function patchNetlifyFunctionEntry(functionDir, app, workspaceApps, staticDir) {
     const serverPath = path.join(functionDir, "server.mjs");

package/dist/eject/workspace-connections.js

@@ -6,7 +6,11 @@ export const WORKSPACE_CONNECTION_PROVIDERS = [
     "figma",
     "notion",
     "gmail",
+    "google_calendar",
     "google_drive",
+    "google_docs",
+    "google_sheets",
+    "google_slides",
     "hubspot",
     "salesforce",
     "jira",

package/dist/email-catalog/registry.d.ts

@@ -65,6 +65,10 @@ export type RegisteredTransactionalEmail = TransactionalEmailDefinition & {
  * export it and reuse `id` when sending.
  */
 export declare function defineTransactionalEmail(definition: TransactionalEmailDefinition): RegisteredTransactionalEmail;
+/** Register a catalog as one atomic operation, allowing safe HMR refreshes. */
+export declare function defineTransactionalEmails(definitions: readonly TransactionalEmailDefinition[]): RegisteredTransactionalEmail[];
+/** Replace one app-owned catalog snapshot after validating the full replacement. */
+export declare function replaceTransactionalEmails(ownerApp: string, idPrefix: string, definitions: readonly TransactionalEmailDefinition[]): RegisteredTransactionalEmail[];
 /** Every registered email, sorted by app then name. */
 export declare function listTransactionalEmails(): RegisteredTransactionalEmail[];
 export declare function getTransactionalEmail(id: string): RegisteredTransactionalEmail | undefined;

package/dist/email-catalog/registry.js

@@ -23,27 +23,93 @@
  */
 import { getAppSlug } from "../server/app-name.js";
 const registry = new Map();
-/** Source definitions, so re-registering the same one is a no-op rather than a clash. */
-const sources = new Map();
+function resolveDefinition(definition) {
+    return {
+        ...definition,
+        app: definition.app ?? getAppSlug() ?? "unknown",
+    };
+}
+function assertCanRegister(resolved, existing) {
+    if (existing &&
+        (existing.app !== resolved.app ||
+            existing.name !== resolved.name ||
+            existing.trigger !== resolved.trigger ||
+            existing.recipient !== resolved.recipient ||
+            existing.recipientLabel !== resolved.recipientLabel ||
+            existing.sender !== resolved.sender ||
+            existing.senderLabel !== resolved.senderLabel)) {
+        // Two emails sharing an id would silently merge their metrics and make the
+        // catalog claim one exists when the other actually sent.
+        throw new Error(`Duplicate transactional email id "${resolved.id}". Ids must be unique across the app.`);
+    }
+}
 /**
  * Register a transactional email. Returns the definition so the call site can
  * export it and reuse `id` when sending.
  */
 export function defineTransactionalEmail(definition) {
-    const existing = sources.get(definition.id);
-    if (existing && existing !== definition) {
-        // Two emails sharing an id would silently merge their metrics and make the
-        // catalog claim one exists when the other actually sent.
-        throw new Error(`Duplicate transactional email id "${definition.id}". Ids must be unique across the app.`);
-    }
-    const resolved = {
-        ...definition,
-        app: definition.app ?? getAppSlug() ?? "unknown",
-    };
+    const resolved = resolveDefinition(definition);
+    // HMR recreates preview functions, so stable catalog metadata is the collision boundary.
+    assertCanRegister(resolved, registry.get(resolved.id));
     registry.set(definition.id, resolved);
-    sources.set(definition.id, definition);
     return resolved;
 }
+function resolveDefinitions(definitions) {
+    const resolved = definitions.map(resolveDefinition);
+    const seen = new Set();
+    for (const definition of resolved) {
+        if (seen.has(definition.id)) {
+            throw new Error(`Duplicate transactional email id "${definition.id}". Ids must be unique across the app.`);
+        }
+        seen.add(definition.id);
+    }
+    return resolved;
+}
+function validateDefinitions(definitions) {
+    const resolved = resolveDefinitions(definitions);
+    for (const definition of resolved) {
+        assertCanRegister(definition, registry.get(definition.id));
+    }
+    return resolved;
+}
+function commitDefinitions(definitions) {
+    for (const definition of definitions) {
+        registry.set(definition.id, definition);
+    }
+    return [...definitions];
+}
+/** Register a catalog as one atomic operation, allowing safe HMR refreshes. */
+export function defineTransactionalEmails(definitions) {
+    return commitDefinitions(validateDefinitions(definitions));
+}
+/** Replace one app-owned catalog snapshot after validating the full replacement. */
+export function replaceTransactionalEmails(ownerApp, idPrefix, definitions) {
+    const runtimeApp = getAppSlug();
+    if (!ownerApp || ownerApp.includes(".") || idPrefix !== `${ownerApp}.`) {
+        throw new Error("Transactional email replacement requires an owner app and its exact namespace prefix.");
+    }
+    const resolved = resolveDefinitions(definitions);
+    if (resolved.some(({ id, app }) => app !== ownerApp || !id.startsWith(idPrefix))) {
+        throw new Error(`Transactional email replacement must contain only ${ownerApp} email definitions in the "${idPrefix}" scope.`);
+    }
+    for (const [id, existing] of registry) {
+        if (id.startsWith(idPrefix) && existing.app !== ownerApp) {
+            throw new Error(`Transactional email replacement cannot modify "${id}" owned by "${existing.app}".`);
+        }
+    }
+    const hasExplicitOwner = resolved.length > 0 && resolved.every(({ app }) => app === ownerApp);
+    if ((runtimeApp && runtimeApp !== ownerApp) ||
+        (!runtimeApp && !hasExplicitOwner)) {
+        throw new Error("Transactional email replacement requires a recognized runtime owner or a non-empty snapshot with explicit owner metadata.");
+    }
+    const nextIds = new Set(resolved.map(({ id }) => id));
+    for (const id of registry.keys()) {
+        if (id.startsWith(idPrefix) && !nextIds.has(id)) {
+            registry.delete(id);
+        }
+    }
+    return commitDefinitions(resolved);
+}
 /** Every registered email, sorted by app then name. */
 export function listTransactionalEmails() {
     return [...registry.values()].sort((a, b) => a.app.localeCompare(b.app) || a.name.localeCompare(b.name));
@@ -66,5 +132,4 @@ export function renderTransactionalEmailPreview(id) {
 /** Test seam — drops all registrations. */
 export function resetTransactionalEmailRegistry() {
     registry.clear();
-    sources.clear();
 }

package/dist/extensions/content-patch.js

@@ -46,10 +46,22 @@ async function applyExtensionContentUpdateUnchecked(currentContent, opts) {
 }
 export async function formatExtensionHtml(content) {
     try {
-        const prettier = await import("prettier");
-        const formatted = await prettier.format(content, {
+        // prettier's main entry `import()`s all 13 parser plugins, so a bundler
+        // inlines ~3.5MB of flow/typescript/yaml/markdown parsers just to format
+        // HTML. Load the standalone core plus only the plugins the HTML printer
+        // reaches, which still formats embedded <style> (postcss) and <script>
+        // (babel + estree).
+        const [{ format }, ...plugins] = await Promise.all([
+            import("prettier/standalone"),
+            import("prettier/plugins/html"),
+            import("prettier/plugins/postcss"),
+            import("prettier/plugins/babel"),
+            import("prettier/plugins/estree"),
+        ]);
+        const formatted = await format(content, {
             parser: "html",
             htmlWhitespaceSensitivity: "ignore",
+            plugins,
         });
         return typeof formatted === "string" ? formatted : content;
     }

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;

package/dist/integrations/plugin.d.ts

@@ -31,6 +31,16 @@ export declare const BUILT_IN_INTEGRATION_ADAPTER_FACTORIES: readonly [{
 }];
 export declare const BUILT_IN_INTEGRATION_ADAPTER_IDS: readonly ("discord" | "email" | "google-docs" | "microsoft-teams" | "slack" | "telegram" | "whatsapp")[];
 export declare function createBuiltInIntegrationAdapters(): PlatformAdapter[];
+/**
+ * Narrow the adapter set to `integrations.platforms`, when a deployment
+ * declares one.
+ *
+ * A configured name that matches no adapter throws instead of being ignored:
+ * the whole point of the allow-list is that the operator knows which platforms
+ * are live, and silently mounting a set nobody named — or mounting nothing
+ * because of a typo — is the failure this switch is supposed to prevent.
+ */
+export declare function applyConfiguredPlatformAllowList(adapters: PlatformAdapter[]): PlatformAdapter[];
 type RemoteCodeCommandEnvelope = {
     kind?: unknown;
     ownerEmail?: unknown;