@agent-native/core 0.169.1 → 0.171.0

package/dist/server/google-oauth.d.ts

@@ -97,6 +97,8 @@ export interface OAuthStatePayload {
     mobile?: boolean;
     addAccount?: boolean;
     app?: string;
+    /** Optional signed scope for provider-specific OAuth flows. */
+    scope?: string;
     /**
      * Same-origin path to redirect to after a successful web-flow sign-in.
      * Threaded through the (HMAC-signed) state so it survives the round trip
@@ -129,6 +131,7 @@ export interface EncodeOAuthStateOptions {
     mobile?: boolean;
     addAccount?: boolean;
     app?: string;
+    scope?: string;
     returnUrl?: string;
     flowId?: string;
     desktopVerifierHash?: string;

package/dist/server/google-oauth.js

@@ -459,6 +459,8 @@ export function encodeOAuthState(redirectUriOrOpts, owner, desktop, addAccount,
         payload.a = true;
     if (opts.app)
         payload.app = opts.app;
+    if (opts.scope)
+        payload.s = opts.scope;
     if (opts.returnUrl)
         payload.r2 = opts.returnUrl;
     if (opts.flowId)
@@ -511,6 +513,7 @@ export function decodeOAuthState(stateParam, fallbackUri) {
                 mobile: !!parsed.m,
                 addAccount: !!parsed.a,
                 app: typeof parsed.app === "string" ? parsed.app : undefined,
+                scope: typeof parsed.s === "string" ? parsed.s : undefined,
                 // Pass returnUrl through as-is — same-origin validation runs at the
                 // consumer (oauthCallbackResponse → safeReturnPath). The state is
                 // HMAC-signed, but we still validate at consumption as defence in

package/dist/server/index.d.ts

@@ -69,13 +69,13 @@ export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/
 export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, uploadFile, builderFileUploadProvider, type FileUploadInput, type FileUploadProvider, type FileUploadResult, } from "../file-upload/index.js";
 export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, slackAdapter, telegramAdapter, whatsappAdapter, discordAdapter, microsoftTeamsAdapter, emailAdapter, assertPlatformCapability, type PlatformAdapter, type IncomingMessage, type OutgoingMessage, type PlatformAdapterCapabilities, type ImmediateWebhookResponse, type IntegrationStatus, type IntegrationsPluginOptions, type IntegrationExecutionContext, BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, type BuiltInChannelId, type ChannelCapabilities, type IntegrationAvailability, type IntegrationCatalogEntry, type IntegrationCategory, type IntegrationCredentialRequirement, type IntegrationIconKey, type IntegrationSupportMaturity, } from "../integrations/index.js";
 export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, encodeOAuthState, decodeOAuthState, resolveOAuthOwner, createOAuthSession, oauthCallbackResponse, oauthErrorPage, oauthDesktopExchangePage, type OAuthStatePayload, type OAuthOwnerResult, type OAuthSessionResult, } from "./google-oauth.js";
-export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, type GenericWorkspaceOAuthProvider, type WorkspaceProviderOAuthFlow, } from "./workspace-provider-oauth.js";
-export { FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderGatewayCredentials, resolveBuilderGatewayCredentialsDetailed, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, type BuilderCredentialsDetailed, } from "./credential-provider.js";
-export { builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, collectBuilderDesignSystemGitHubFiles, createBuilderDesignSystemProxyFields, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, type BuildBuilderDesignSystemIndexFilesOptions, type BuilderDesignSystemCodeFileInput, type BuilderDesignSystemDecodeJobStatus, type BuilderDesignSystemDocsOptions, type BuilderDesignSystemDocument, type BuilderDesignSystemHydratedReference, type BuilderDesignSystemIndexFile, type BuilderDesignSystemIndexFromSourcesOptions, type BuilderDesignSystemIndexOptions, type BuilderDesignSystemIndexResult, type BuilderDesignSystemGitHubFile, type BuilderDesignSystemGitHubFileCollection, type BuilderDesignSystemGitHubSource, type BuilderDesignSystemUploadAttachment, type BuilderDesignSystemUploadSlot, type BuilderDesignSystemProxyFields, type BuilderDesignSystemProxyFieldsOptions, type BuilderDesignSystemProxyReference, type BuilderDesignSystemSourceKind, } from "./builder-design-systems.js";
+export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, hasWorkspaceProviderOAuthCredentials, isGoogleWorkspaceOAuthProvider, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, type GenericWorkspaceOAuthProvider, type WorkspaceProviderOAuthFlow, } from "./workspace-provider-oauth.js";
+export { CredentialStoreUnavailableError, FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderGatewayCredentials, resolveBuilderGatewayCredentialsDetailed, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, type BuilderCredentialsDetailed, } from "./credential-provider.js";
+export { builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, collectBuilderDesignSystemGitHubFiles, createBuilderDesignSystemProxyFields, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, type BuildBuilderDesignSystemIndexFilesOptions, type BuilderDesignSystemCodeFileInput, type BuilderDesignSystemDecodeJobStatus, type BuilderDesignSystemDocsOptions, type BuilderDesignSystemDocument, type BuilderDesignSystemHydratedReference, type BuilderDesignSystemIndexFile, type BuilderDesignSystemIndexFromSourcesOptions, type BuilderDesignSystemIndexOptions, type BuilderDesignSystemIndexResult, type BuilderDesignSystemStatus, type BuilderDesignSystemGitHubFile, type BuilderDesignSystemGitHubFileCollection, type BuilderDesignSystemGitHubSource, type BuilderDesignSystemUploadAttachment, type BuilderDesignSystemUploadSlot, type BuilderDesignSystemProxyFields, type BuilderDesignSystemProxyFieldsOptions, type BuilderDesignSystemProxyReference, type BuilderDesignSystemSourceKind, } from "./builder-design-systems.js";
 export { createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, type BuilderProjectResult, type RunBuilderAgentResult, } from "./builder-browser.js";
 export { ensureFusionContainer, sendFusionBranchMessage, pushFusionBranch, reserveFusionHostingSlug, deployFusionProject, getFusionDeploys, getFusionBranchEditorUrl, getFusionHostingUrl, type FusionBranchRef, type EnsureFusionContainerResult, type SendFusionMessageResult, } from "./fusion-app.js";
 export { sendEmail, isEmailConfigured, getEmailReadiness, getEmailProvider, type EmailAttachment, type EmailReadiness, type EmailProvider, type SendEmailArgs, } from "./email.js";
-export { defineTransactionalEmail, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, type TransactionalEmailDefinition, type RegisteredTransactionalEmail, } from "../email-catalog/registry.js";
+export { defineTransactionalEmail, defineTransactionalEmails, replaceTransactionalEmails, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, type TransactionalEmailDefinition, type RegisteredTransactionalEmail, } from "../email-catalog/registry.js";
 export { notifyActivity, runActivityNotification, resolveActivityRecipients, type ActivityDeliveryFailure, type ActivityNotificationResult, type ActivityNotificationStatus, type NotifyActivityInput, type ResolveActivityRecipientsInput, } from "./activity-notifications.js";
 export { renderEmail, emailStrong, emailLink, type RenderEmailArgs, type RenderedEmail, type EmailCta, } from "./email-template.js";
 export { getAppProductionUrl, getFirstPartyProdUrl } from "./app-url.js";

package/dist/server/index.js

@@ -74,8 +74,8 @@ export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/
 export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, uploadFile, builderFileUploadProvider, } from "../file-upload/index.js";
 export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, slackAdapter, telegramAdapter, whatsappAdapter, discordAdapter, microsoftTeamsAdapter, emailAdapter, assertPlatformCapability, BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, } from "../integrations/index.js";
 export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, encodeOAuthState, decodeOAuthState, resolveOAuthOwner, createOAuthSession, oauthCallbackResponse, oauthErrorPage, oauthDesktopExchangePage, } from "./google-oauth.js";
-export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, } from "./workspace-provider-oauth.js";
-export { FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, 
+export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, hasWorkspaceProviderOAuthCredentials, isGoogleWorkspaceOAuthProvider, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, } from "./workspace-provider-oauth.js";
+export { CredentialStoreUnavailableError, FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, 
 // Gateway lane, for the metered surfaces a deployed site can call without an
 // identity — image and video generation, realtime transcription. Falls
 // through to the identity credential first, so a consumer moves lane by
@@ -85,7 +85,7 @@ export { builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSyst
 export { createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, } from "./builder-browser.js";
 export { ensureFusionContainer, sendFusionBranchMessage, pushFusionBranch, reserveFusionHostingSlug, deployFusionProject, getFusionDeploys, getFusionBranchEditorUrl, getFusionHostingUrl, } from "./fusion-app.js";
 export { sendEmail, isEmailConfigured, getEmailReadiness, getEmailProvider, } from "./email.js";
-export { defineTransactionalEmail, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, } from "../email-catalog/registry.js";
+export { defineTransactionalEmail, defineTransactionalEmails, replaceTransactionalEmails, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, } from "../email-catalog/registry.js";
 export { notifyActivity, runActivityNotification, resolveActivityRecipients, } from "./activity-notifications.js";
 export { renderEmail, emailStrong, emailLink, } from "./email-template.js";
 export { getAppProductionUrl, getFirstPartyProdUrl } from "./app-url.js";

package/dist/server/onboarding-html.js

@@ -11,7 +11,7 @@ import { getLocaleInitScript } from "../localization/server.js";
 import { DEFAULT_LOCALE, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, localeDisplayName, } from "../localization/shared.js";
 import { NATIVE_AUTH_COPY } from "../shared/auth-copy.js";
 import { docsUrl } from "../shared/docs-url.js";
-import { BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, } from "../shared/environment-lanes.js";
+import { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, } from "../shared/environment-lanes.js";
 import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, } from "../shared/password-policy.js";
 import { signInJourneyInlineScript } from "../shared/sign-in-journey.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
@@ -1035,6 +1035,7 @@ ${localeMenuItemsHtml}
     <div class="environment-popover-title" id="environment-popover-title">You're on Agent Native Beta</div>
     <div class="environment-popover-copy">Choose where you want to continue.</div>
     <a class="environment-production-link" id="environment-production-link" href="">Switch to production</a>
+    <button type="button" class="environment-hide-badge" id="environment-hide-badge">Hide badge</button>
   </div>
 </div>`;
     const hostedSignupLegalNotice = opts.signupLegalNotice === undefined &&
@@ -1430,9 +1431,19 @@ ${marketing.description ? `      <p class="app-desc" data-marketing-field="descr
     var button = document.getElementById('environment-badge');
     var popover = document.getElementById('environment-popover');
     var productionLink = document.getElementById('environment-production-link');
-    if (!switcher || !button || !popover || !productionLink) return;
+    var hideButton = document.getElementById('environment-hide-badge');
+    if (!switcher || !button || !popover || !productionLink || !hideButton) return;
     if (window.parent !== window) return;
 
+    try {
+      var forceUrl = new URL(window.location.href);
+      if (forceUrl.searchParams.get(${JSON.stringify(BETA_FORCE_QUERY_PARAM)}) === 'true') {
+        window.sessionStorage.setItem(${JSON.stringify(BETA_FORCE_SESSION_STORAGE_KEY)}, '1');
+      }
+    } catch (error) {
+      void error;
+    }
+
     // Persist the beta opt-out before authentication replaces this cached shell.
     try {
       var optOutUrl = new URL(window.location.href);
@@ -1496,6 +1507,10 @@ ${marketing.description ? `      <p class="app-desc" data-marketing-field="descr
     document.addEventListener('keydown', function(event) {
       if (event.key === 'Escape') setOpen(false);
     });
+    hideButton.addEventListener('click', function() {
+      setOpen(false);
+      switcher.hidden = true;
+    });
   })();`;
     return `<!DOCTYPE html>
 <html lang="${DEFAULT_LOCALE}" dir="ltr">
@@ -1668,7 +1683,8 @@ ${hasMarketing
   .environment-badge:hover,
   .environment-badge[aria-expanded="true"] { background: #4a4a4a; }
   .environment-badge:focus-visible,
-  .environment-production-link:focus-visible {
+  .environment-production-link:focus-visible,
+  .environment-hide-badge:focus-visible {
     outline: 2px solid #33c4ff;
     outline-offset: 2px;
   }
@@ -1700,6 +1716,24 @@ ${hasMarketing
     text-decoration: none;
   }
   .environment-production-link:hover { background: #242424; }
+  .environment-hide-badge {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 100%;
+    min-height: 2rem;
+    margin-top: 0.5rem;
+    margin-bottom: -0.5rem;
+    padding: 0.375rem 0.75rem;
+    color: inherit;
+    opacity: 0.65;
+    border: 0;
+    background: transparent;
+    font: inherit;
+    font-size: 0.8125rem;
+    cursor: pointer;
+  }
+  .environment-hide-badge:hover { opacity: 1; }
   .card {
     width: 100%;
     max-width: 400px;

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/workspace-provider-oauth.d.ts

@@ -1,7 +1,11 @@
 import { type H3Event } from "h3";
 import { type WorkspaceConnectionProvider } from "../connections/catalog.js";
 import { type OAuthStatePayload } from "./google-oauth.js";
-export type GenericWorkspaceOAuthProvider = "figma" | "google_drive" | "github" | "hubspot" | "salesforce" | "jira" | "sentry" | "notion";
+export type GenericWorkspaceOAuthProvider = "figma" | "gmail" | "google_calendar" | "google_docs" | "google_drive" | "google_sheets" | "google_slides" | "github" | "hubspot" | "salesforce" | "jira" | "sentry" | "notion";
+export type WorkspaceProviderOAuthScope = "user" | "organization" | "app";
+export declare function isWorkspaceProviderOAuthScope(value: unknown): value is WorkspaceProviderOAuthScope;
+export declare function isGoogleWorkspaceOAuthProvider(provider: string): boolean;
+export declare function hasWorkspaceProviderOAuthCredentials(provider: GenericWorkspaceOAuthProvider): Promise<boolean>;
 export interface WorkspaceProviderOAuthFlow {
     provider: GenericWorkspaceOAuthProvider;
     flowId: string;
@@ -10,6 +14,7 @@ export interface WorkspaceProviderOAuthFlow {
     owner: string;
     orgId?: string;
     appId: string;
+    scope: WorkspaceProviderOAuthScope;
     salesforceLoginUrl?: string;
     expiresAt: number;
 }

package/dist/server/workspace-provider-oauth.js

@@ -13,7 +13,12 @@ import { decodeOAuthState, encodeOAuthState, getAppUrl, resolveOAuthRedirectUri,
 import { runWithRequestContext } from "./request-context.js";
 const SUPPORTED_PROVIDERS = new Set([
     "figma",
+    "gmail",
+    "google_calendar",
+    "google_docs",
     "google_drive",
+    "google_sheets",
+    "google_slides",
     "github",
     "hubspot",
     "salesforce",
@@ -26,7 +31,22 @@ const PROVIDER_REQUEST_TIMEOUT_MS = 10_000;
 const PROVIDER_RESPONSE_MAX_BYTES = 256 * 1024;
 const SALESFORCE_PRODUCTION_LOGIN_URL = "https://login.salesforce.com";
 const SALESFORCE_SANDBOX_LOGIN_URL = "https://test.salesforce.com";
-const WORKSPACE_OAUTH_ADMIN_ERROR = "Only organization admins or the relevant app admin can connect shared OAuth accounts.";
+const WORKSPACE_OAUTH_ADMIN_ERROR = "This shared connection requires organization or app-admin access. Personal connections can be connected by any workspace member.";
+export function isWorkspaceProviderOAuthScope(value) {
+    return value === "user" || value === "organization" || value === "app";
+}
+export function isGoogleWorkspaceOAuthProvider(provider) {
+    return (provider === "gmail" ||
+        provider === "google_calendar" ||
+        provider === "google_docs" ||
+        provider === "google_drive" ||
+        provider === "google_sheets" ||
+        provider === "google_slides");
+}
+export async function hasWorkspaceProviderOAuthCredentials(provider) {
+    const [clientId, clientSecret] = await resolveProviderClientCredentials(provider);
+    return Boolean(clientId && clientSecret);
+}
 export function workspaceProviderOAuthPath(provider, phase) {
     return `/_agent-native/connections/oauth/${provider}/${phase}`;
 }
@@ -46,7 +66,14 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
         return unauthorized(event);
     const query = getQuery(event);
     const appId = normalizeAppId(text(query.appId) ?? getAppConfig().app.workspaceId ?? "creative-context");
-    const orgContext = await requireWorkspaceProviderOAuthAdmin(event, appId);
+    const requestedScope = parseWorkspaceProviderOAuthScope(text(query.scope));
+    if (!requestedScope) {
+        setResponseStatus(event, 400);
+        return {
+            error: "OAuth connection scope must be user, organization, or app.",
+        };
+    }
+    const orgContext = await requireWorkspaceProviderOAuthAccess(event, appId, requestedScope);
     if (!orgContext) {
         return { error: WORKSPACE_OAUTH_ADMIN_ERROR };
     }
@@ -91,6 +118,7 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
             owner: session.email,
             orgId,
             app: appId,
+            scope: orgContext.oauthScope,
             returnUrl,
             flowId,
         });
@@ -102,6 +130,7 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
             owner: session.email,
             orgId,
             appId,
+            scope: orgContext.oauthScope,
             ...(salesforceLoginUrl ? { salesforceLoginUrl } : {}),
             expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
         };
@@ -134,7 +163,11 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
     if (!session?.email)
         return unauthorized(event);
     const flow = readStoredFlow(event, providerId);
-    const orgContext = await requireWorkspaceProviderOAuthAdmin(event, flow?.appId);
+    if (!flow || !isWorkspaceProviderOAuthScope(flow.scope)) {
+        setResponseStatus(event, 400);
+        return { error: "OAuth state is invalid or expired." };
+    }
+    const orgContext = await requireWorkspaceProviderOAuthAccess(event, flow.appId, flow.scope);
     if (!orgContext) {
         return { error: WORKSPACE_OAUTH_ADMIN_ERROR };
     }
@@ -204,8 +237,12 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
             await saveOAuthTokens(provider.oauth.provider, accountId, tokens, session.email);
             await setOAuthDisplayName(provider.oauth.provider, accountId, identity.label);
             const existing = existingConnections.find((connection) => connection.accountId === accountId &&
-                (orgContext.oauthScope === "organization" ||
-                    connection.allowedApps.some((allowedApp) => allowedApp.toLowerCase() === flow.appId.toLowerCase())));
+                (flow.scope === "user"
+                    ? connection.allowedUsers.some((allowedUser) => allowedUser.toLowerCase() === session.email.toLowerCase())
+                    : flow.scope === "organization"
+                        ? connection.allowedUsers.length === 0 &&
+                            (connection.allowedUserGroups?.length ?? 0) === 0
+                        : connection.allowedApps.some((allowedApp) => allowedApp.toLowerCase() === flow.appId.toLowerCase())));
             const scopes = mergeWorkspaceOAuthValues(existing?.scopes ?? [], identity.scopes ?? tokenScopes(tokens, provider.oauth.scopes));
             const connectionConfig = {
                 credentialMode: "oauth",
@@ -229,8 +266,10 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
                 accountLabel: identity.label,
                 status: "connected",
                 scopes,
-                allowedApps: existing?.allowedApps ??
-                    (orgContext.oauthScope === "app" ? [flow.appId] : []),
+                allowedApps: existing?.allowedApps ?? (flow.scope === "app" ? [flow.appId] : []),
+                allowedUsers: flow.scope === "user"
+                    ? [session.email]
+                    : (existing?.allowedUsers ?? []),
                 config: connectionConfig,
                 lastCheckedAt: new Date(),
                 lastError: null,
@@ -267,7 +306,7 @@ export function buildWorkspaceProviderAuthorizationUrl(input) {
         url.searchParams.set("audience", "api.atlassian.com");
         url.searchParams.set("prompt", "consent");
     }
-    if (input.provider.id === "google_drive") {
+    if (isGoogleWorkspaceOAuthProvider(input.provider.id)) {
         url.searchParams.set("access_type", "offline");
         url.searchParams.set("include_granted_scopes", "true");
         url.searchParams.set("prompt", "consent");
@@ -393,7 +432,7 @@ export async function exchangeWorkspaceProviderOAuthCode(input) {
         ...(input.providerId === "sentry"
             ? { client_id: input.clientId, client_secret: input.clientSecret }
             : {}),
-        ...(input.providerId === "google_drive"
+        ...(isGoogleWorkspaceOAuthProvider(input.providerId)
             ? { client_id: input.clientId, client_secret: input.clientSecret }
             : {}),
     };
@@ -566,19 +605,16 @@ async function resolveWorkspaceProviderIdentitySingle(providerId, tokens) {
             label: text(user?.email) ?? text(user?.name) ?? "Sentry account",
         };
     }
-    if (providerId === "google_drive") {
+    if (isGoogleWorkspaceOAuthProvider(providerId)) {
         const accessToken = text(tokens.access_token);
-        const { response, body } = await fetchBoundedProviderJson("https://www.googleapis.com/drive/v3/about?fields=user(displayName,emailAddress,permissionId)", { headers: { Authorization: `Bearer ${accessToken}` } }, "Google Drive");
-        const user = record(body.user);
-        const accountId = text(user?.permissionId) ?? text(user?.emailAddress);
+        const { response, body } = await fetchBoundedProviderJson("https://openidconnect.googleapis.com/v1/userinfo", { headers: { Authorization: `Bearer ${accessToken}` } }, "Google Workspace");
+        const accountId = text(body.email) ?? text(body.sub);
         if (!response.ok || !accountId) {
-            throw new Error("Google Drive OAuth response did not identify the connected account.");
+            throw new Error("Google OAuth response did not identify the connected account.");
         }
         return {
             accountId,
-            label: text(user?.emailAddress) ??
-                text(user?.displayName) ??
-                "Google Drive account",
+            label: text(body.email) ?? text(body.name) ?? "Google account",
         };
     }
     const accessToken = text(tokens.access_token);
@@ -615,6 +651,7 @@ export function isWorkspaceProviderOAuthFlowValid(input) {
         input.state.flowId === input.flow.flowId &&
         input.state.redirectUri === input.flow.redirectUri &&
         input.state.owner === input.flow.owner &&
+        input.state.scope === input.flow.scope &&
         input.sessionEmail === input.flow.owner &&
         input.state.orgId === input.flow.orgId &&
         input.sessionOrgId === input.flow.orgId &&
@@ -697,7 +734,9 @@ export function mergeWorkspaceOAuthValues(existing, incoming) {
     return [...new Set([...existing, ...incoming])];
 }
 function clientCredentialKeys(provider, field) {
-    const prefix = provider === "google_drive" ? "GOOGLE" : provider.toUpperCase();
+    const prefix = isGoogleWorkspaceOAuthProvider(provider)
+        ? "GOOGLE"
+        : provider.toUpperCase();
     const suffix = field === "id" ? "ID" : "SECRET";
     if (provider === "github") {
         const integrationPrefix = `GITHUB_INTEGRATION_CLIENT_${suffix}`;
@@ -799,6 +838,11 @@ function normalizeAppId(value) {
 function text(value) {
     return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
+function parseWorkspaceProviderOAuthScope(value) {
+    if (value === undefined)
+        return "organization";
+    return isWorkspaceProviderOAuthScope(value) ? value : null;
+}
 function scalarText(value) {
     if (typeof value === "number" && Number.isFinite(value))
         return String(value);
@@ -817,15 +861,23 @@ function unauthorized(event) {
     setResponseStatus(event, 401);
     return { error: "Authentication required" };
 }
-async function requireWorkspaceProviderOAuthAdmin(event, appId) {
+async function requireWorkspaceProviderOAuthAccess(event, appId, requestedScope = "organization") {
     const context = await getOrgContext(event).catch(() => null);
     if (!context || !context.orgId) {
         setResponseStatus(event, 403);
         return null;
     }
-    if (canConnectWorkspaceProviderOAuth(context.orgId, context.role)) {
+    if (requestedScope === "user") {
+        return { ...context, oauthScope: "user" };
+    }
+    if (requestedScope === "organization" &&
+        canConnectWorkspaceProviderOAuth(context.orgId, context.role)) {
         return { ...context, oauthScope: "organization" };
     }
+    if (requestedScope === "app" &&
+        canConnectWorkspaceProviderOAuth(context.orgId, context.role)) {
+        return { ...context, oauthScope: "app" };
+    }
     if (appId) {
         const descriptor = getRegisteredAppRoles(appId);
         if (descriptor?.roles.some((role) => role === "admin")) {

package/dist/shared/agent-sidebar-url.d.ts

@@ -1,5 +1,6 @@
 export declare const AGENT_NATIVE_OPEN_PATH = "/_agent-native/open";
 export declare const AGENT_SIDEBAR_QUERY_PARAM = "agentSidebar";
 export declare const AGENT_SIDEBAR_QUERY_VALUE_CLOSED = "closed";
+export declare const AGENT_SIDEBAR_QUERY_VALUE_OPEN = "open";
 export declare function isAgentNativeOpenDeepLink(urlOrPath: string): boolean;
 export declare function withCollapsedAgentSidebarParam(urlOrPath: string): string;

package/dist/shared/agent-sidebar-url.js

@@ -1,6 +1,7 @@
 export const AGENT_NATIVE_OPEN_PATH = "/_agent-native/open";
 export const AGENT_SIDEBAR_QUERY_PARAM = "agentSidebar";
 export const AGENT_SIDEBAR_QUERY_VALUE_CLOSED = "closed";
+export const AGENT_SIDEBAR_QUERY_VALUE_OPEN = "open";
 const RELATIVE_URL_BASE = "http://agent-native.invalid";
 function hasUrlScheme(urlOrPath) {
     return /^[a-z][a-z0-9+.-]*:/i.test(urlOrPath);

package/dist/shared/environment-lanes.d.ts

@@ -1,6 +1,8 @@
 export declare const BETA_OPT_OUT_QUERY_PARAM = "agentNativeBetaOptOut";
 export declare const BETA_OPT_OUT_DURATION_MS: number;
 export declare const BETA_OPT_OUT_STORAGE_KEY = "agent-native:beta-opt-out-until";
+export declare const BETA_FORCE_QUERY_PARAM = "force";
+export declare const BETA_FORCE_SESSION_STORAGE_KEY = "agent-native:force-production";
 export declare const ENVIRONMENT_BETA_HOSTS: {
     readonly "agent-workspace.builder.io": "beta.agent-workspace.builder.io";
     readonly "analytics.agent-native.com": "beta.analytics.agent-native.com";

package/dist/shared/environment-lanes.js

@@ -1,6 +1,8 @@
 export const BETA_OPT_OUT_QUERY_PARAM = "agentNativeBetaOptOut";
-export const BETA_OPT_OUT_DURATION_MS = 24 * 60 * 60 * 1000;
+export const BETA_OPT_OUT_DURATION_MS = 8 * 60 * 60 * 1000;
 export const BETA_OPT_OUT_STORAGE_KEY = "agent-native:beta-opt-out-until";
+export const BETA_FORCE_QUERY_PARAM = "force";
+export const BETA_FORCE_SESSION_STORAGE_KEY = "agent-native:force-production";
 export const ENVIRONMENT_BETA_HOSTS = {
     "agent-workspace.builder.io": "beta.agent-workspace.builder.io",
     "analytics.agent-native.com": "beta.analytics.agent-native.com",

package/dist/shared/index.d.ts

@@ -6,13 +6,15 @@ export { truncate } from "./truncate.js";
 export { isHumanReadableDocumentTitle, normalizeDocumentTitle, } from "./document-title.js";
 export { injectDocumentMarkup } from "./html-document.js";
 export { withBuilderUtmTrackingParams } from "./builder-link-tracking.js";
+export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, resolveEnvironmentTargets, type EnvironmentBadgeTargets, } from "./environment-lanes.js";
 export { SSR_HTML_CONTENT_TYPE, SSR_QUERY_CACHE_KEY_HEADER, type SsrHtmlContentTypeOptions, withSsrHtmlContentType, } from "./cache-control.js";
+export { SURFACE_HIDDEN_FLAG, SURFACE_VISIBILITY_EVENT, addSurfaceVisibilityListener, buildSurfaceVisibilityScript, isHostSurfaceHidden, isSurfaceHidden, } from "./surface-visibility.js";
 export { AGENT_NATIVE_DOCS_ORIGIN, docsUrl, type DocsUrlOptions, } from "./docs-url.js";
 export { buildRuntimeConfigPrompt, formatRuntimeConfigReport, getRuntimeConfigReport, parseRuntimeConfigReport, runtimeConfigRequirementsFromSearchParams, type RuntimeConfigEnvironment, type RuntimeConfigIssue, type RuntimeConfigIssueCode, type RuntimeConfigIssueSeverity, type RuntimeConfigPhase, type RuntimeConfigReport, type RuntimeConfigRequirements, } from "./runtime-config.js";
 export { llmConnectionTrackingProperties, normalizeLlmConnection, type LlmConnectionStatus, } from "./llm-connection.js";
 export { DISPATCH_WORKSPACE_ROOT_REDIRECTS, RESERVED_WORKSPACE_APP_IDS, assertValidWorkspaceAppId, getWorkspaceAppIdValidationError, isValidWorkspaceAppIdFormat, normalizeWorkspaceAppId, } from "./workspace-app-id.js";
 export { DEFAULT_WORKSPACE_APP_AUDIENCE, WORKSPACE_APP_AUDIENCES, normalizeWorkspaceAppAudience, normalizeWorkspaceAppPathList, workspaceAppAudienceFromEnv, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromEnv, workspaceAppRouteAccessFromPackageJson, type WorkspaceAppRouteAccess, type WorkspaceAppRouteAccessFromConfig, type WorkspaceAppAudience, } from "./workspace-app-audience.js";
-export { AGENT_NATIVE_OPEN_PATH, AGENT_SIDEBAR_QUERY_PARAM, AGENT_SIDEBAR_QUERY_VALUE_CLOSED, isAgentNativeOpenDeepLink, withCollapsedAgentSidebarParam, } from "./agent-sidebar-url.js";
+export { AGENT_NATIVE_OPEN_PATH, AGENT_SIDEBAR_QUERY_PARAM, AGENT_SIDEBAR_QUERY_VALUE_CLOSED, AGENT_SIDEBAR_QUERY_VALUE_OPEN, isAgentNativeOpenDeepLink, withCollapsedAgentSidebarParam, } from "./agent-sidebar-url.js";
 export { buildChatFirstAppCreationPrompt, titleFromChatFirstAppPrompt, type ChatFirstAppCreationPromptInput, type ChatFirstAppCreationResource, type ChatFirstAppCreationVaultAccessMode, } from "./chat-first-app-creation.js";
 export { NATIVE_AUTH_COPY, resolveNativeAuthCopy, type NativeAuthCopy, } from "./auth-copy.js";
 export { createPollEngine, type PollEngineOptions, type PollEngineHandle, } from "./poll-engine.js";

package/dist/shared/index.js

@@ -6,13 +6,15 @@ export { truncate } from "./truncate.js";
 export { isHumanReadableDocumentTitle, normalizeDocumentTitle, } from "./document-title.js";
 export { injectDocumentMarkup } from "./html-document.js";
 export { withBuilderUtmTrackingParams } from "./builder-link-tracking.js";
+export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, resolveEnvironmentTargets, } from "./environment-lanes.js";
 export { SSR_HTML_CONTENT_TYPE, SSR_QUERY_CACHE_KEY_HEADER, withSsrHtmlContentType, } from "./cache-control.js";
+export { SURFACE_HIDDEN_FLAG, SURFACE_VISIBILITY_EVENT, addSurfaceVisibilityListener, buildSurfaceVisibilityScript, isHostSurfaceHidden, isSurfaceHidden, } from "./surface-visibility.js";
 export { AGENT_NATIVE_DOCS_ORIGIN, docsUrl, } from "./docs-url.js";
 export { buildRuntimeConfigPrompt, formatRuntimeConfigReport, getRuntimeConfigReport, parseRuntimeConfigReport, runtimeConfigRequirementsFromSearchParams, } from "./runtime-config.js";
 export { llmConnectionTrackingProperties, normalizeLlmConnection, } from "./llm-connection.js";
 export { DISPATCH_WORKSPACE_ROOT_REDIRECTS, RESERVED_WORKSPACE_APP_IDS, assertValidWorkspaceAppId, getWorkspaceAppIdValidationError, isValidWorkspaceAppIdFormat, normalizeWorkspaceAppId, } from "./workspace-app-id.js";
 export { DEFAULT_WORKSPACE_APP_AUDIENCE, WORKSPACE_APP_AUDIENCES, normalizeWorkspaceAppAudience, normalizeWorkspaceAppPathList, workspaceAppAudienceFromEnv, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromEnv, workspaceAppRouteAccessFromPackageJson, } from "./workspace-app-audience.js";
-export { AGENT_NATIVE_OPEN_PATH, AGENT_SIDEBAR_QUERY_PARAM, AGENT_SIDEBAR_QUERY_VALUE_CLOSED, isAgentNativeOpenDeepLink, withCollapsedAgentSidebarParam, } from "./agent-sidebar-url.js";
+export { AGENT_NATIVE_OPEN_PATH, AGENT_SIDEBAR_QUERY_PARAM, AGENT_SIDEBAR_QUERY_VALUE_CLOSED, AGENT_SIDEBAR_QUERY_VALUE_OPEN, isAgentNativeOpenDeepLink, withCollapsedAgentSidebarParam, } from "./agent-sidebar-url.js";
 export { buildChatFirstAppCreationPrompt, titleFromChatFirstAppPrompt, } from "./chat-first-app-creation.js";
 export { NATIVE_AUTH_COPY, resolveNativeAuthCopy, } from "./auth-copy.js";
 export { createPollEngine, } from "./poll-engine.js";

package/dist/shared/surface-visibility.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Host-declared surface visibility.
+ *
+ * An Electron `<webview>` guest never reports itself hidden: hiding the element
+ * or any ancestor leaves `document.visibilityState === "visible"` and never
+ * fires `visibilitychange`, so every visibility-based pause in this package is
+ * inert inside the desktop shell. A backgrounded app tab there keeps polling at
+ * its full foreground cadence and holds its event stream open for as long as
+ * the shell is running. The host therefore has to say so explicitly, and this
+ * flag is what background work must consult instead of the document alone.
+ */
+export declare const SURFACE_HIDDEN_FLAG = "__agentNativeSurfaceHidden";
+/** Dispatched on `window` whenever the host flips the flag. */
+export declare const SURFACE_VISIBILITY_EVENT = "agentnative:surfacevisibilitychange";
+/** Whether an embedding host has declared this surface off screen. */
+export declare function isHostSurfaceHidden(): boolean;
+/**
+ * Whether this surface is off screen by either signal. A host that has stashed
+ * the surface entirely is a stronger statement than a backgrounded browser tab,
+ * so callers that keep working while merely backgrounded should still stop on
+ * `isHostSurfaceHidden()`.
+ */
+export declare function isSurfaceHidden(): boolean;
+/** Subscribe to both visibility signals. Returns an unsubscribe function. */
+export declare function addSurfaceVisibilityListener(handler: () => void): () => void;
+/**
+ * Script a host embedder evaluates inside the guest to declare whether the
+ * surface it is hosting is on screen. Kept here so the flag name, the event
+ * name, and the write that sets them cannot drift apart across packages.
+ */
+export declare function buildSurfaceVisibilityScript(hidden: boolean): string;

package/dist/shared/surface-visibility.js

@@ -0,0 +1,57 @@
+/**
+ * Host-declared surface visibility.
+ *
+ * An Electron `<webview>` guest never reports itself hidden: hiding the element
+ * or any ancestor leaves `document.visibilityState === "visible"` and never
+ * fires `visibilitychange`, so every visibility-based pause in this package is
+ * inert inside the desktop shell. A backgrounded app tab there keeps polling at
+ * its full foreground cadence and holds its event stream open for as long as
+ * the shell is running. The host therefore has to say so explicitly, and this
+ * flag is what background work must consult instead of the document alone.
+ */
+export const SURFACE_HIDDEN_FLAG = "__agentNativeSurfaceHidden";
+/** Dispatched on `window` whenever the host flips the flag. */
+export const SURFACE_VISIBILITY_EVENT = "agentnative:surfacevisibilitychange";
+/** Whether an embedding host has declared this surface off screen. */
+export function isHostSurfaceHidden() {
+    if (typeof window === "undefined")
+        return false;
+    return (window[SURFACE_HIDDEN_FLAG] === true);
+}
+/**
+ * Whether this surface is off screen by either signal. A host that has stashed
+ * the surface entirely is a stronger statement than a backgrounded browser tab,
+ * so callers that keep working while merely backgrounded should still stop on
+ * `isHostSurfaceHidden()`.
+ */
+export function isSurfaceHidden() {
+    if (isHostSurfaceHidden())
+        return true;
+    return (typeof document !== "undefined" && document.visibilityState === "hidden");
+}
+/** Subscribe to both visibility signals. Returns an unsubscribe function. */
+export function addSurfaceVisibilityListener(handler) {
+    if (typeof document === "undefined" || typeof window === "undefined") {
+        return () => { };
+    }
+    document.addEventListener("visibilitychange", handler);
+    window.addEventListener(SURFACE_VISIBILITY_EVENT, handler);
+    return () => {
+        document.removeEventListener("visibilitychange", handler);
+        window.removeEventListener(SURFACE_VISIBILITY_EVENT, handler);
+    };
+}
+/**
+ * Script a host embedder evaluates inside the guest to declare whether the
+ * surface it is hosting is on screen. Kept here so the flag name, the event
+ * name, and the write that sets them cannot drift apart across packages.
+ */
+export function buildSurfaceVisibilityScript(hidden) {
+    return `(() => {
+  const next = ${hidden ? "true" : "false"};
+  if (window[${JSON.stringify(SURFACE_HIDDEN_FLAG)}] === next) return next;
+  window[${JSON.stringify(SURFACE_HIDDEN_FLAG)}] = next;
+  window.dispatchEvent(new Event(${JSON.stringify(SURFACE_VISIBILITY_EVENT)}));
+  return next;
+})()`;
+}

package/dist/templates/chat/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/dist/templates/chat/app/routes.ts

@@ -1,4 +1,6 @@
 import { type RouteConfig } from "@react-router/dev/routes";
 import { flatRoutes } from "@react-router/fs-routes";
 
-export default flatRoutes() satisfies RouteConfig;
+export default flatRoutes({
+  ignoredRouteFiles: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+}) satisfies RouteConfig;

package/dist/templates/chat/vitest.config.ts

@@ -11,4 +11,12 @@ export default defineConfig({
       "@shared": path.resolve(__dirname, "./shared"),
     },
   },
+  test: {
+    exclude: [
+      "**/node_modules/**",
+      "**/.git/**",
+      "**/dist/**",
+      "**/.react-router/**",
+    ],
+  },
 });