@agent-native/core 0.169.1 → 0.170.0

package/dist/server/core-routes-plugin.js

@@ -222,6 +222,33 @@ async function resolveAgentEngineStatusIdentity(event) {
         return { userEmail, orgId: undefined };
     }
 }
+/**
+ * A Builder grant is shared by everyone in the caller's org, so establishing,
+ * overwriting, or revoking one requires org owner/admin authority. Returns the
+ * authorized org id and a denial message (null when allowed). The org id is
+ * captured at connect start so the grant is stored under the org that was
+ * authorized, not one re-resolved after the OAuth round trip. Fails closed: an
+ * unreadable owner/admin role is denied.
+ */
+async function resolveBuilderOrgMutation(event) {
+    let orgId = null;
+    let role = null;
+    try {
+        const orgCtx = await getOrgContext(event);
+        orgId = orgCtx.orgId ?? null;
+        role = orgCtx.role ?? null;
+    }
+    catch {
+        // coercion-ok: org is missing, it will fail closed
+    }
+    if (role !== "owner" && role !== "admin") {
+        return {
+            orgId,
+            deny: "Only an organization owner or admin can change the shared Builder connection.",
+        };
+    }
+    return { orgId, deny: null };
+}
 export function getFrameworkEnvKeys() {
     return [
         { key: "ENABLE_BUILDER", label: "Enable Builder.io features" },
@@ -927,6 +954,43 @@ export function ensureS3FileUploadProvider() {
     }
     registerFileUploadProvider(s3FileUploadProvider);
 }
+/**
+ * Resolves the classic Builder key-pair status for a request that already
+ * has Builder MCP OAuth custody (the connection-status handler's `configured`
+ * is already `true` by the time this runs — OAuth alone proves the chat
+ * gateway). Exported so the connection-status route's OAuth-custody branch is
+ * unit-testable without standing up the full plugin.
+ */
+export async function resolveOAuthCustodyBuilderKeyStatus(dependencies = {
+    resolveCredentialsDetailed: async () => {
+        const { resolveBuilderCredentialsDetailed } = await import("./credential-provider.js");
+        return resolveBuilderCredentialsDetailed();
+    },
+}) {
+    try {
+        const creds = await dependencies.resolveCredentialsDetailed();
+        return {
+            privateKeyConfigured: !!creds.privateKey,
+            publicKeyConfigured: !!creds.publicKey,
+            orgName: typeof creds.orgName === "string" && creds.orgName
+                ? creds.orgName
+                : "Builder OAuth",
+            keyLookupFailed: creds.lookupFailed,
+        };
+    }
+    catch {
+        // OAuth already proves the chat gateway, so a thrown key-pair lookup
+        // here must not abort the response — but it is unreadable, not
+        // confirmed-absent, so keyLookupFailed has to say so (see the field doc
+        // above) instead of silently landing on the same `false`s as a real miss.
+        return {
+            privateKeyConfigured: false,
+            publicKeyConfigured: false,
+            orgName: "Builder OAuth",
+            keyLookupFailed: true,
+        };
+    }
+}
 export function createCoreRoutesPlugin(options = {}) {
     return async (nitroApp) => {
         markDefaultPluginProvided(nitroApp, "core-routes");
@@ -1143,7 +1207,12 @@ export function createCoreRoutesPlugin(options = {}) {
             }
             for (const provider of [
                 "figma",
+                "gmail",
+                "google_calendar",
+                "google_docs",
                 "google_drive",
+                "google_sheets",
+                "google_slides",
                 "github",
                 "hubspot",
                 "salesforce",
@@ -1562,29 +1631,15 @@ export function createCoreRoutesPlugin(options = {}) {
                             }
                         }
                         if (oauthAccess) {
-                            let privateKeyConfigured = false;
-                            let publicKeyConfigured = false;
-                            let orgName = "Builder OAuth";
-                            try {
-                                const { resolveBuilderCredentials } = await import("./credential-provider.js");
-                                const creds = await resolveBuilderCredentials();
-                                privateKeyConfigured = !!creds.privateKey;
-                                publicKeyConfigured = !!creds.publicKey;
-                                if (typeof creds.orgName === "string" && creds.orgName) {
-                                    orgName = creds.orgName;
-                                }
-                            }
-                            catch {
-                                // coercion-ok: OAuth already proves the chat gateway; missing
-                                // key flags only hide code-change send until secrets are readable.
-                            }
+                            const keyStatus = await resolveOAuthCustodyBuilderKeyStatus();
                             return withConnectToken({
                                 ...requestStatus,
                                 configured: true,
                                 credentialSource: "user",
-                                privateKeyConfigured,
-                                publicKeyConfigured,
-                                orgName,
+                                privateKeyConfigured: keyStatus.privateKeyConfigured,
+                                publicKeyConfigured: keyStatus.publicKeyConfigured,
+                                keyLookupFailed: keyStatus.keyLookupFailed,
+                                orgName: keyStatus.orgName,
                                 spaces: [],
                             });
                         }
@@ -1870,6 +1925,21 @@ export function createCoreRoutesPlugin(options = {}) {
                         parentOrigin: getBuilderBrowserOriginForEvent(event),
                     });
                 }
+                const { orgId: connectOrgId, deny: orgConnectDenied } = await resolveBuilderOrgMutation(event);
+                if (orgConnectDenied) {
+                    await trackBuilderLifecycle(event, "builder connect failed", ownerEmail, {
+                        ...builderConnectTrackingProperties(connectTracking),
+                        reason: "org_authorization_required",
+                        stage: "connect",
+                    });
+                    setResponseStatus(event, 403);
+                    setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+                    return createBuilderBrowserCallbackErrorPage(orgConnectDenied, {
+                        title: "Not allowed to connect Builder for this organization",
+                        body: "Ask an organization owner or admin to connect Builder.",
+                        parentOrigin: getBuilderBrowserOriginForEvent(event),
+                    });
+                }
                 const state = createBuilderConnectState();
                 // The standard OAuth client discovers Builder's protected-resource
                 // metadata, dynamically registers, and creates its S256 verifier.
@@ -1886,7 +1956,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     authorizationUrl = started.authorizationUrl;
                     await putSetting(`builder-connect-pending:${state}`, {
                         ownerEmail,
-                        orgId: null,
+                        orgId: connectOrgId,
                         role: null,
                         encryptedOAuthFlow: encryptSecretValue(JSON.stringify(oauthFlow)),
                         redirectUri: callbackUrl,
@@ -2242,6 +2312,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     const oauthFlow = JSON.parse(decryptSecretValue(encryptedOAuthFlow));
                     await finishBuilderOAuthAuthorization({
                         ownerEmail,
+                        orgId: typeof consumed.orgId === "string" ? consumed.orgId : undefined,
                         code,
                         iss,
                         pending: oauthFlow,
@@ -2283,6 +2354,15 @@ export function createCoreRoutesPlugin(options = {}) {
                 }
                 try {
                     const hadOAuth = await hasBuilderOAuthSession(session.email);
+                    // Revoking an org-scoped grant takes the connection offline for
+                    // every member, so require org owner/admin before doing so.
+                    if (hadOAuth) {
+                        const { deny } = await resolveBuilderOrgMutation(event);
+                        if (deny) {
+                            setResponseStatus(event, 403);
+                            return { error: deny };
+                        }
+                    }
                     const oauthResult = hadOAuth
                         ? await deleteBuilderOAuthSession(session.email)
                         : { localDeleted: false, remoteRevoked: false };

package/dist/server/default-plugins.d.ts

@@ -0,0 +1,18 @@
+import type { DefaultPluginSlot } from "../app-config/plugins.js";
+/**
+ * Which default plugin slots this deployment refuses, from `plugins.disabled`.
+ *
+ * Read on every call rather than captured once: `getAppConfig()` already caches
+ * the parse and drops that cache when the environment layer changes, and the
+ * auto-mount decision runs before some apps have called `defineAppConfig()`, so
+ * a module-level snapshot would freeze an empty list for the process.
+ */
+export declare function getDisabledDefaultPlugins(): readonly DefaultPluginSlot[];
+/**
+ * Whether the framework should withhold its default implementation of `slot`.
+ *
+ * Only the framework's own defaults are gated. An app that ships
+ * `server/plugins/<slot>.ts` mounted its plugin deliberately, and this switch
+ * does not reach in and unmount it.
+ */
+export declare function isDefaultPluginDisabled(slot: string): boolean;

package/dist/server/default-plugins.js

@@ -0,0 +1,22 @@
+import { getAppConfig } from "../app-config/index.js";
+/**
+ * Which default plugin slots this deployment refuses, from `plugins.disabled`.
+ *
+ * Read on every call rather than captured once: `getAppConfig()` already caches
+ * the parse and drops that cache when the environment layer changes, and the
+ * auto-mount decision runs before some apps have called `defineAppConfig()`, so
+ * a module-level snapshot would freeze an empty list for the process.
+ */
+export function getDisabledDefaultPlugins() {
+    return getAppConfig().plugins.disabled;
+}
+/**
+ * Whether the framework should withhold its default implementation of `slot`.
+ *
+ * Only the framework's own defaults are gated. An app that ships
+ * `server/plugins/<slot>.ts` mounted its plugin deliberately, and this switch
+ * does not reach in and unmount it.
+ */
+export function isDefaultPluginDisabled(slot) {
+    return getDisabledDefaultPlugins().includes(slot);
+}

package/dist/server/edge.d.ts

@@ -1,4 +1,5 @@
 export { createAuthPlugin, defaultAuthPlugin } from "./auth-plugin.js";
+export { getDisabledDefaultPlugins, isDefaultPluginDisabled, } from "./default-plugins.js";
 export { BETTER_AUTH_MIGRATIONS, runBetterAuthMigrations, } from "./better-auth-migrations.js";
 export { runFrameworkReleaseMigrations } from "./release-migrations.js";
 export { createAgentChatPlugin, defaultAgentChatPlugin, refreshGlobalMcpManager, type AgentChatPluginOptions, } from "./agent-chat-plugin.js";

package/dist/server/edge.js

@@ -1,4 +1,5 @@
 export { createAuthPlugin, defaultAuthPlugin } from "./auth-plugin.js";
+export { getDisabledDefaultPlugins, isDefaultPluginDisabled, } from "./default-plugins.js";
 export { BETTER_AUTH_MIGRATIONS, runBetterAuthMigrations, } from "./better-auth-migrations.js";
 export { runFrameworkReleaseMigrations } from "./release-migrations.js";
 export { createAgentChatPlugin, defaultAgentChatPlugin, refreshGlobalMcpManager, } from "./agent-chat-plugin.js";

package/dist/server/framework-request-handler.js

@@ -1,10 +1,12 @@
 import { setResponseHeader, setResponseStatus } from "h3";
+import { AppConfigurationError } from "../app-config/index.js";
 import { getMissingDefaultPlugins } from "../deploy/route-discovery.js";
 import { MCP_PUBLIC_ROUTE_PREFIX } from "../mcp/route-paths.js";
 import { SIGN_IN_ENTRY_PATH, SIGN_IN_LEGACY_ENTRY_PATH, } from "../shared/sign-in-journey.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { captureError } from "./capture-error.js";
 import { createCsrfMiddleware } from "./csrf.js";
+import { getDisabledDefaultPlugins } from "./default-plugins.js";
 import { installHttpResponseTelemetryHooks, recordFrameworkReadyWait, } from "./http-response-telemetry.js";
 import { hasRequestContext, markRequestBoundaryInstalled, runWithRequestContext, } from "./request-context.js";
 const BOOTSTRAPPED = new WeakSet();
@@ -127,13 +129,28 @@ export function getH3App(nitroApp) {
     nitroApp[APP_SHIM_KEY] = shim;
     if (!BOOTSTRAPPED.has(nitroApp)) {
         BOOTSTRAPPED.add(nitroApp);
-        nitroApp[BOOTSTRAP_PROMISE_KEY] = bootstrapDefaultPlugins(nitroApp).catch((err) => {
+        // Parse now, decide later. An unknown slot name in `plugins.disabled` is
+        // an invalid deployment, not a plugin that failed to start, and the catch
+        // below would turn it into an app with every default route missing — so
+        // the value has to be read where it can still throw synchronously. The
+        // mount set is read again inside bootstrap: auto-mount can start before a
+        // server plugin has called `defineAppConfig()`, and this early read only
+        // sees the environment layer.
+        getDisabledDefaultPlugins();
+        const bootstrap = bootstrapDefaultPlugins(nitroApp).catch((err) => {
             console.warn("[agent-native] Failed to auto-mount default plugins:", err.message);
             captureError(err, {
                 route: "default-plugin-bootstrap",
                 tags: { phase: "default-plugin-bootstrap" },
             });
+            if (err instanceof AppConfigurationError)
+                throw err;
         });
+        // The readiness gate is what observes this rejection, and it only runs on
+        // a request. Without a handler attached now, Node exits on the unhandled
+        // rejection before anything can report the configuration error.
+        bootstrap.catch(() => { });
+        nitroApp[BOOTSTRAP_PROMISE_KEY] = bootstrap;
         // Readiness gate: Nitro v3 doesn't await async plugins, so routes
         // registered inside an async plugin may not exist when the first
         // request arrives. These middleware entries hold framework routes
@@ -688,9 +705,12 @@ async function bootstrapDefaultPlugins(nitroApp) {
         const cwd = process.cwd();
         const discoveredMissing = await getMissingDefaultPlugins(cwd);
         const provided = nitroApp[PROVIDED_PLUGIN_STEMS_KEY];
-        const missing = provided
+        const undiscovered = provided
             ? discoveredMissing.filter((stem) => !provided.has(stem))
             : discoveredMissing;
+        const disabled = getDisabledDefaultPlugins();
+        const missing = undiscovered.filter((stem) => !disabled.includes(stem));
+        const refused = undiscovered.filter((stem) => disabled.includes(stem));
         if (missing.length === 0)
             return;
         // Lazy import to avoid circular dependency at module load time
@@ -760,7 +780,10 @@ async function bootstrapDefaultPlugins(nitroApp) {
             // runtime without fs). Silently fall through to framework defaults.
         }
         if (process.env.DEBUG)
-            console.log(`[agent-native] Auto-mounting ${missing.length} default plugin(s): ${missing.join(", ")}`);
+            console.log(`[agent-native] Auto-mounting ${missing.length} default plugin(s): ${missing.join(", ")}` +
+                (refused.length > 0
+                    ? ` (refused by plugins.disabled: ${refused.join(", ")})`
+                    : ""));
         for (const stem of missing) {
             // Prefer workspace-core impl over framework default when both exist.
             const impl = workspaceImpls[stem] ?? frameworkImpls[stem];
@@ -774,6 +797,11 @@ async function bootstrapDefaultPlugins(nitroApp) {
                         route: "default-plugin-bootstrap",
                         tags: { phase: "default-plugin-bootstrap", plugin: stem },
                     });
+                    // A plugin that cannot start is optional; a plugin the deployment
+                    // configured wrongly is not. Skipping it leaves the operator with
+                    // routes that 404 and a deployment that reported success.
+                    if (e instanceof AppConfigurationError)
+                        throw e;
                 }
             }
         }

package/dist/server/google-oauth.d.ts

@@ -97,6 +97,8 @@ export interface OAuthStatePayload {
     mobile?: boolean;
     addAccount?: boolean;
     app?: string;
+    /** Optional signed scope for provider-specific OAuth flows. */
+    scope?: string;
     /**
      * Same-origin path to redirect to after a successful web-flow sign-in.
      * Threaded through the (HMAC-signed) state so it survives the round trip
@@ -129,6 +131,7 @@ export interface EncodeOAuthStateOptions {
     mobile?: boolean;
     addAccount?: boolean;
     app?: string;
+    scope?: string;
     returnUrl?: string;
     flowId?: string;
     desktopVerifierHash?: string;

package/dist/server/google-oauth.js

@@ -459,6 +459,8 @@ export function encodeOAuthState(redirectUriOrOpts, owner, desktop, addAccount,
         payload.a = true;
     if (opts.app)
         payload.app = opts.app;
+    if (opts.scope)
+        payload.s = opts.scope;
     if (opts.returnUrl)
         payload.r2 = opts.returnUrl;
     if (opts.flowId)
@@ -511,6 +513,7 @@ export function decodeOAuthState(stateParam, fallbackUri) {
                 mobile: !!parsed.m,
                 addAccount: !!parsed.a,
                 app: typeof parsed.app === "string" ? parsed.app : undefined,
+                scope: typeof parsed.s === "string" ? parsed.s : undefined,
                 // Pass returnUrl through as-is — same-origin validation runs at the
                 // consumer (oauthCallbackResponse → safeReturnPath). The state is
                 // HMAC-signed, but we still validate at consumption as defence in

package/dist/server/index.d.ts

@@ -69,13 +69,13 @@ export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/
 export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, uploadFile, builderFileUploadProvider, type FileUploadInput, type FileUploadProvider, type FileUploadResult, } from "../file-upload/index.js";
 export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, slackAdapter, telegramAdapter, whatsappAdapter, discordAdapter, microsoftTeamsAdapter, emailAdapter, assertPlatformCapability, type PlatformAdapter, type IncomingMessage, type OutgoingMessage, type PlatformAdapterCapabilities, type ImmediateWebhookResponse, type IntegrationStatus, type IntegrationsPluginOptions, type IntegrationExecutionContext, BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, type BuiltInChannelId, type ChannelCapabilities, type IntegrationAvailability, type IntegrationCatalogEntry, type IntegrationCategory, type IntegrationCredentialRequirement, type IntegrationIconKey, type IntegrationSupportMaturity, } from "../integrations/index.js";
 export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, encodeOAuthState, decodeOAuthState, resolveOAuthOwner, createOAuthSession, oauthCallbackResponse, oauthErrorPage, oauthDesktopExchangePage, type OAuthStatePayload, type OAuthOwnerResult, type OAuthSessionResult, } from "./google-oauth.js";
-export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, type GenericWorkspaceOAuthProvider, type WorkspaceProviderOAuthFlow, } from "./workspace-provider-oauth.js";
-export { FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderGatewayCredentials, resolveBuilderGatewayCredentialsDetailed, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, type BuilderCredentialsDetailed, } from "./credential-provider.js";
-export { builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, collectBuilderDesignSystemGitHubFiles, createBuilderDesignSystemProxyFields, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, type BuildBuilderDesignSystemIndexFilesOptions, type BuilderDesignSystemCodeFileInput, type BuilderDesignSystemDecodeJobStatus, type BuilderDesignSystemDocsOptions, type BuilderDesignSystemDocument, type BuilderDesignSystemHydratedReference, type BuilderDesignSystemIndexFile, type BuilderDesignSystemIndexFromSourcesOptions, type BuilderDesignSystemIndexOptions, type BuilderDesignSystemIndexResult, type BuilderDesignSystemGitHubFile, type BuilderDesignSystemGitHubFileCollection, type BuilderDesignSystemGitHubSource, type BuilderDesignSystemUploadAttachment, type BuilderDesignSystemUploadSlot, type BuilderDesignSystemProxyFields, type BuilderDesignSystemProxyFieldsOptions, type BuilderDesignSystemProxyReference, type BuilderDesignSystemSourceKind, } from "./builder-design-systems.js";
+export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, hasWorkspaceProviderOAuthCredentials, isGoogleWorkspaceOAuthProvider, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, type GenericWorkspaceOAuthProvider, type WorkspaceProviderOAuthFlow, } from "./workspace-provider-oauth.js";
+export { CredentialStoreUnavailableError, FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderGatewayCredentials, resolveBuilderGatewayCredentialsDetailed, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, type BuilderCredentialsDetailed, } from "./credential-provider.js";
+export { builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, collectBuilderDesignSystemGitHubFiles, createBuilderDesignSystemProxyFields, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, type BuildBuilderDesignSystemIndexFilesOptions, type BuilderDesignSystemCodeFileInput, type BuilderDesignSystemDecodeJobStatus, type BuilderDesignSystemDocsOptions, type BuilderDesignSystemDocument, type BuilderDesignSystemHydratedReference, type BuilderDesignSystemIndexFile, type BuilderDesignSystemIndexFromSourcesOptions, type BuilderDesignSystemIndexOptions, type BuilderDesignSystemIndexResult, type BuilderDesignSystemStatus, type BuilderDesignSystemGitHubFile, type BuilderDesignSystemGitHubFileCollection, type BuilderDesignSystemGitHubSource, type BuilderDesignSystemUploadAttachment, type BuilderDesignSystemUploadSlot, type BuilderDesignSystemProxyFields, type BuilderDesignSystemProxyFieldsOptions, type BuilderDesignSystemProxyReference, type BuilderDesignSystemSourceKind, } from "./builder-design-systems.js";
 export { createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, type BuilderProjectResult, type RunBuilderAgentResult, } from "./builder-browser.js";
 export { ensureFusionContainer, sendFusionBranchMessage, pushFusionBranch, reserveFusionHostingSlug, deployFusionProject, getFusionDeploys, getFusionBranchEditorUrl, getFusionHostingUrl, type FusionBranchRef, type EnsureFusionContainerResult, type SendFusionMessageResult, } from "./fusion-app.js";
 export { sendEmail, isEmailConfigured, getEmailReadiness, getEmailProvider, type EmailAttachment, type EmailReadiness, type EmailProvider, type SendEmailArgs, } from "./email.js";
-export { defineTransactionalEmail, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, type TransactionalEmailDefinition, type RegisteredTransactionalEmail, } from "../email-catalog/registry.js";
+export { defineTransactionalEmail, defineTransactionalEmails, replaceTransactionalEmails, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, type TransactionalEmailDefinition, type RegisteredTransactionalEmail, } from "../email-catalog/registry.js";
 export { notifyActivity, runActivityNotification, resolveActivityRecipients, type ActivityDeliveryFailure, type ActivityNotificationResult, type ActivityNotificationStatus, type NotifyActivityInput, type ResolveActivityRecipientsInput, } from "./activity-notifications.js";
 export { renderEmail, emailStrong, emailLink, type RenderEmailArgs, type RenderedEmail, type EmailCta, } from "./email-template.js";
 export { getAppProductionUrl, getFirstPartyProdUrl } from "./app-url.js";

package/dist/server/index.js

@@ -74,8 +74,8 @@ export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/
 export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, uploadFile, builderFileUploadProvider, } from "../file-upload/index.js";
 export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, slackAdapter, telegramAdapter, whatsappAdapter, discordAdapter, microsoftTeamsAdapter, emailAdapter, assertPlatformCapability, BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, } from "../integrations/index.js";
 export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, encodeOAuthState, decodeOAuthState, resolveOAuthOwner, createOAuthSession, oauthCallbackResponse, oauthErrorPage, oauthDesktopExchangePage, } from "./google-oauth.js";
-export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, } from "./workspace-provider-oauth.js";
-export { FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, 
+export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, hasWorkspaceProviderOAuthCredentials, isGoogleWorkspaceOAuthProvider, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, } from "./workspace-provider-oauth.js";
+export { CredentialStoreUnavailableError, FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, 
 // Gateway lane, for the metered surfaces a deployed site can call without an
 // identity — image and video generation, realtime transcription. Falls
 // through to the identity credential first, so a consumer moves lane by
@@ -85,7 +85,7 @@ export { builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSyst
 export { createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, } from "./builder-browser.js";
 export { ensureFusionContainer, sendFusionBranchMessage, pushFusionBranch, reserveFusionHostingSlug, deployFusionProject, getFusionDeploys, getFusionBranchEditorUrl, getFusionHostingUrl, } from "./fusion-app.js";
 export { sendEmail, isEmailConfigured, getEmailReadiness, getEmailProvider, } from "./email.js";
-export { defineTransactionalEmail, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, } from "../email-catalog/registry.js";
+export { defineTransactionalEmail, defineTransactionalEmails, replaceTransactionalEmails, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, } from "../email-catalog/registry.js";
 export { notifyActivity, runActivityNotification, resolveActivityRecipients, } from "./activity-notifications.js";
 export { renderEmail, emailStrong, emailLink, } from "./email-template.js";
 export { getAppProductionUrl, getFirstPartyProdUrl } from "./app-url.js";

package/dist/server/onboarding-html.js

@@ -11,7 +11,7 @@ import { getLocaleInitScript } from "../localization/server.js";
 import { DEFAULT_LOCALE, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, localeDisplayName, } from "../localization/shared.js";
 import { NATIVE_AUTH_COPY } from "../shared/auth-copy.js";
 import { docsUrl } from "../shared/docs-url.js";
-import { BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, } from "../shared/environment-lanes.js";
+import { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, } from "../shared/environment-lanes.js";
 import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, } from "../shared/password-policy.js";
 import { signInJourneyInlineScript } from "../shared/sign-in-journey.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
@@ -1035,6 +1035,7 @@ ${localeMenuItemsHtml}
     <div class="environment-popover-title" id="environment-popover-title">You're on Agent Native Beta</div>
     <div class="environment-popover-copy">Choose where you want to continue.</div>
     <a class="environment-production-link" id="environment-production-link" href="">Switch to production</a>
+    <button type="button" class="environment-hide-badge" id="environment-hide-badge">Hide badge</button>
   </div>
 </div>`;
     const hostedSignupLegalNotice = opts.signupLegalNotice === undefined &&
@@ -1430,9 +1431,19 @@ ${marketing.description ? `      <p class="app-desc" data-marketing-field="descr
     var button = document.getElementById('environment-badge');
     var popover = document.getElementById('environment-popover');
     var productionLink = document.getElementById('environment-production-link');
-    if (!switcher || !button || !popover || !productionLink) return;
+    var hideButton = document.getElementById('environment-hide-badge');
+    if (!switcher || !button || !popover || !productionLink || !hideButton) return;
     if (window.parent !== window) return;
 
+    try {
+      var forceUrl = new URL(window.location.href);
+      if (forceUrl.searchParams.get(${JSON.stringify(BETA_FORCE_QUERY_PARAM)}) === 'true') {
+        window.sessionStorage.setItem(${JSON.stringify(BETA_FORCE_SESSION_STORAGE_KEY)}, '1');
+      }
+    } catch (error) {
+      void error;
+    }
+
     // Persist the beta opt-out before authentication replaces this cached shell.
     try {
       var optOutUrl = new URL(window.location.href);
@@ -1496,6 +1507,10 @@ ${marketing.description ? `      <p class="app-desc" data-marketing-field="descr
     document.addEventListener('keydown', function(event) {
       if (event.key === 'Escape') setOpen(false);
     });
+    hideButton.addEventListener('click', function() {
+      setOpen(false);
+      switcher.hidden = true;
+    });
   })();`;
     return `<!DOCTYPE html>
 <html lang="${DEFAULT_LOCALE}" dir="ltr">
@@ -1668,7 +1683,8 @@ ${hasMarketing
   .environment-badge:hover,
   .environment-badge[aria-expanded="true"] { background: #4a4a4a; }
   .environment-badge:focus-visible,
-  .environment-production-link:focus-visible {
+  .environment-production-link:focus-visible,
+  .environment-hide-badge:focus-visible {
     outline: 2px solid #33c4ff;
     outline-offset: 2px;
   }
@@ -1700,6 +1716,24 @@ ${hasMarketing
     text-decoration: none;
   }
   .environment-production-link:hover { background: #242424; }
+  .environment-hide-badge {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 100%;
+    min-height: 2rem;
+    margin-top: 0.5rem;
+    margin-bottom: -0.5rem;
+    padding: 0.375rem 0.75rem;
+    color: inherit;
+    opacity: 0.65;
+    border: 0;
+    background: transparent;
+    font: inherit;
+    font-size: 0.8125rem;
+    cursor: pointer;
+  }
+  .environment-hide-badge:hover { opacity: 1; }
   .card {
     width: 100%;
     max-width: 400px;

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;

package/dist/server/workspace-provider-oauth.d.ts

@@ -1,7 +1,11 @@
 import { type H3Event } from "h3";
 import { type WorkspaceConnectionProvider } from "../connections/catalog.js";
 import { type OAuthStatePayload } from "./google-oauth.js";
-export type GenericWorkspaceOAuthProvider = "figma" | "google_drive" | "github" | "hubspot" | "salesforce" | "jira" | "sentry" | "notion";
+export type GenericWorkspaceOAuthProvider = "figma" | "gmail" | "google_calendar" | "google_docs" | "google_drive" | "google_sheets" | "google_slides" | "github" | "hubspot" | "salesforce" | "jira" | "sentry" | "notion";
+export type WorkspaceProviderOAuthScope = "user" | "organization" | "app";
+export declare function isWorkspaceProviderOAuthScope(value: unknown): value is WorkspaceProviderOAuthScope;
+export declare function isGoogleWorkspaceOAuthProvider(provider: string): boolean;
+export declare function hasWorkspaceProviderOAuthCredentials(provider: GenericWorkspaceOAuthProvider): Promise<boolean>;
 export interface WorkspaceProviderOAuthFlow {
     provider: GenericWorkspaceOAuthProvider;
     flowId: string;
@@ -10,6 +14,7 @@ export interface WorkspaceProviderOAuthFlow {
     owner: string;
     orgId?: string;
     appId: string;
+    scope: WorkspaceProviderOAuthScope;
     salesforceLoginUrl?: string;
     expiresAt: number;
 }