@agent-native/core 0.174.0 → 0.174.1-nightly-20260825180834

package/corpus/templates/dispatch/actions/list-workspace-connections.ts

@@ -9,6 +9,7 @@ import {
   listProviderApiCatalog,
 } from "@agent-native/core/provider-api";
 import {
+  CredentialStoreUnavailableError,
   hasWorkspaceProviderOAuthCredentials,
   isGoogleWorkspaceOAuthProvider,
 } from "@agent-native/core/server";
@@ -50,7 +51,7 @@ type GrantSummary = {
   lastUsedAt?: string | null;
 };
 
-type GoogleOAuthAvailability = "configured" | "unconfigured";
+type GoogleOAuthAvailability = "configured" | "unconfigured" | "unavailable";
 
 function unique(values: string[]) {
   return Array.from(
@@ -129,10 +130,17 @@ export default defineAction({
         | WorkspaceConnectionTemplateUse
         | undefined,
     });
-    const googleOAuthAvailability: GoogleOAuthAvailability =
-      (await hasWorkspaceProviderOAuthCredentials("gmail"))
+    let googleOAuthAvailability: GoogleOAuthAvailability;
+    try {
+      googleOAuthAvailability = (await hasWorkspaceProviderOAuthCredentials(
+        "gmail",
+      ))
         ? "configured"
         : "unconfigured";
+    } catch (error) {
+      if (!(error instanceof CredentialStoreUnavailableError)) throw error;
+      googleOAuthAvailability = "unavailable";
+    }
     const googleOAuthConfigured = googleOAuthAvailability === "configured";
     const providers = catalogProviders.filter(
       (provider) =>
@@ -274,7 +282,7 @@ export default defineAction({
       availability: {
         googleOAuth: {
           status: googleOAuthAvailability,
-          retryable: false,
+          retryable: googleOAuthAvailability === "unavailable",
         },
       },
       providers: providersWithReadiness,

package/corpus/templates/dispatch/app/routes/integrations.tsx

@@ -221,6 +221,12 @@ interface WorkspaceConnectionGrantSummary {
 }
 
 interface WorkspaceConnectionsResponse {
+  availability?: {
+    googleOAuth: {
+      status: "configured" | "unconfigured" | "unavailable";
+      retryable: boolean;
+    };
+  };
   providers: WorkspaceConnectionProvider[];
   connections: WorkspaceConnection[];
   grants: WorkspaceConnectionGrant[];
@@ -2719,6 +2725,9 @@ export default function WorkspaceIntegrationsRoute() {
     EMPTY_RESPONSE) as WorkspaceConnectionsResponse;
   const providers = data.providers;
   const connections = data.connections;
+  const googleOAuthUnavailable =
+    data.availability?.googleOAuth.status === "unavailable" &&
+    data.availability.googleOAuth.retryable;
   const apps = (appsQuery.data ?? []) as WorkspaceAppSummary[];
   const groups = (groupsQuery.data ?? []) as WorkspaceUserGroup[];
   const providersById = useMemo(
@@ -3152,6 +3161,9 @@ export default function WorkspaceIntegrationsRoute() {
             }}
           />
         ) : null}
+        {googleOAuthUnavailable ? (
+          <ActionQueryError onRetry={() => void connectionsQuery.refetch()} />
+        ) : null}
         {!connectionsQuery.isError && !appsQuery.isError ? (
           <>
             {connectionsQuery.isLoading ? (

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/mcp-client/oauth-routes.d.ts

@@ -24,7 +24,17 @@ export interface McpOAuthRoutesOptions {
 }
 export declare function redirectWithStagedCookies(event: H3Event, location: string): Response;
 export declare function mountMcpOAuthRoutes(nitroApp: any, options: McpOAuthRoutesOptions): void;
-export declare function resolveMcpOAuthScope(serverUrl: URL, requestedScope: unknown): RemoteMcpScope | null;
+export declare function resolveMcpOAuthStartError(error: unknown): {
+    status: 400 | 503;
+    body: {
+        error: string;
+        errorCode?: string;
+        retryable?: boolean;
+    };
+};
+export declare function resolveMcpOAuthScope(serverUrl: URL, requestedScope: unknown, options?: {
+    allowManagedOrgReconnect?: boolean;
+}): RemoteMcpScope | null;
 export declare function stripMcpOAuthAppBasePath(path: string, basePath: string): string;
 export declare function resolveManagedMcpOAuthClient(serverUrl: URL): Promise<StoredOAuthClientInformation | undefined>;
 export declare function setMcpOAuthFlowCookie(event: H3Event, flow: McpOAuthFlow, secure: boolean): void;

package/dist/mcp-client/oauth-routes.js

@@ -3,7 +3,7 @@ import { deleteCookie, defineEventHandler, getChunkedCookie, getCookie, getMetho
 import { getOrgContext } from "../org/context.js";
 import { decryptSecretValue, encryptSecretValue } from "../secrets/crypto.js";
 import { getSession, safeReturnPath } from "../server/auth.js";
-import { resolveSecret } from "../server/credential-provider.js";
+import { CredentialStoreUnavailableError, resolveSecretPair, } from "../server/credential-provider.js";
 import { getH3App } from "../server/framework-request-handler.js";
 import { getAppBasePath, getAppUrl, resolveOAuthRedirectUri, } from "../server/google-oauth.js";
 import { runWithRequestContext } from "../server/request-context.js";
@@ -16,17 +16,25 @@ const FLOW_COOKIE_MAX_CHUNKS = 8;
 const CHUNKED_COOKIE_PREFIX = "__chunked__";
 const MANAGED_MCP_OAUTH_CLIENTS = [
     {
-        serverOrigin: "https://mcp.hubspot.com",
-        clientIdKeys: [
-            "HUBSPOT_MCP_CLIENT_ID",
-            "HUBSPOT_INTEGRATION_CLIENT_ID",
-            "HUBSPOT_CLIENT_ID",
+        serverOrigins: ["https://mcp.hubspot.com"],
+        credentialPairs: [
+            ["HUBSPOT_MCP_CLIENT_ID", "HUBSPOT_MCP_CLIENT_SECRET"],
+            ["HUBSPOT_INTEGRATION_CLIENT_ID", "HUBSPOT_INTEGRATION_CLIENT_SECRET"],
+            ["HUBSPOT_CLIENT_ID", "HUBSPOT_CLIENT_SECRET"],
         ],
-        clientSecretKeys: [
-            "HUBSPOT_MCP_CLIENT_SECRET",
-            "HUBSPOT_INTEGRATION_CLIENT_SECRET",
-            "HUBSPOT_CLIENT_SECRET",
+    },
+    {
+        serverOrigins: [
+            "https://gmailmcp.googleapis.com",
+            "https://drivemcp.googleapis.com",
+            "https://docsmcp.googleapis.com",
+            "https://sheetsmcp.googleapis.com",
+            "https://slidesmcp.googleapis.com",
+            "https://calendarmcp.googleapis.com",
+            "https://chatmcp.googleapis.com",
+            "https://people.googleapis.com",
         ],
+        credentialPairs: [["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]],
     },
 ];
 export function redirectWithStagedCookies(event, location) {
@@ -111,7 +119,9 @@ async function handleMcpOAuthStart(event) {
         setResponseStatus(event, 400);
         return { error: "MCP server name is invalid." };
     }
-    const requestedScope = resolveMcpOAuthScope(urlCheck.url, query.scope);
+    const requestedScope = resolveMcpOAuthScope(urlCheck.url, query.scope, {
+        allowManagedOrgReconnect: reconnectScope === "org" && Boolean(reconnectServer),
+    });
     if (!requestedScope) {
         setResponseStatus(event, 400);
         return {
@@ -165,7 +175,7 @@ async function handleMcpOAuthStart(event) {
         if (!started) {
             setResponseStatus(event, 400);
             return {
-                error: "HubSpot personal MCP connect is not configured for this workspace. A workspace owner must register the HubSpot MCP Auth App once; after that, any workspace member can connect a personal account.",
+                error: "Managed MCP OAuth is not configured for this workspace. A workspace owner must register the OAuth client once; after that, any workspace member can connect a personal account.",
             };
         }
         const flow = {
@@ -190,18 +200,37 @@ async function handleMcpOAuthStart(event) {
         setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith("https://"));
         return redirectWithStagedCookies(event, started.authorizationUrl.href);
     }
-    catch {
-        setResponseStatus(event, 400);
+    catch (error) {
+        const failure = resolveMcpOAuthStartError(error);
+        setResponseStatus(event, failure.status);
+        return failure.body;
+    }
+}
+export function resolveMcpOAuthStartError(error) {
+    if (error instanceof CredentialStoreUnavailableError) {
         return {
-            error: "This MCP server could not start OAuth. It may not support standard MCP OAuth discovery or dynamic client registration.",
+            status: 503,
+            body: {
+                error: error.message,
+                errorCode: error.errorCode,
+                retryable: error.retryable,
+            },
         };
     }
+    return {
+        status: 400,
+        body: {
+            error: "This MCP server could not start OAuth. It may not support standard MCP OAuth discovery or dynamic client registration.",
+        },
+    };
 }
 function isManagedMcpOAuthServer(serverUrl) {
-    return MANAGED_MCP_OAUTH_CLIENTS.some((client) => client.serverOrigin === serverUrl.origin);
+    return MANAGED_MCP_OAUTH_CLIENTS.some((client) => client.serverOrigins.includes(serverUrl.origin));
 }
-export function resolveMcpOAuthScope(serverUrl, requestedScope) {
-    if (isManagedMcpOAuthServer(serverUrl) && requestedScope === "org") {
+export function resolveMcpOAuthScope(serverUrl, requestedScope, options) {
+    if (isManagedMcpOAuthServer(serverUrl) &&
+        requestedScope === "org" &&
+        !options?.allowManagedOrgReconnect) {
         return null;
     }
     return requestedScope === "org" ? "org" : "user";
@@ -220,15 +249,13 @@ export function stripMcpOAuthAppBasePath(path, basePath) {
         : path;
 }
 export async function resolveManagedMcpOAuthClient(serverUrl) {
-    const client = MANAGED_MCP_OAUTH_CLIENTS.find((candidate) => candidate.serverOrigin === serverUrl.origin);
+    const client = MANAGED_MCP_OAUTH_CLIENTS.find((candidate) => candidate.serverOrigins.includes(serverUrl.origin));
     if (!client)
         return undefined;
-    for (let index = 0; index < client.clientIdKeys.length; index += 1) {
-        const [clientId, clientSecret] = await Promise.all([
-            resolveSecret(client.clientIdKeys[index]),
-            resolveSecret(client.clientSecretKeys[index]),
-        ]);
-        if (clientId && clientSecret) {
+    for (const [clientIdKey, clientSecretKey] of client.credentialPairs) {
+        const credentials = await resolveSecretPair([clientIdKey, clientSecretKey]);
+        if (credentials) {
+            const [clientId, clientSecret] = credentials;
             return {
                 client_id: clientId,
                 client_secret: clientSecret,

package/dist/observability/routes.d.ts

@@ -62,6 +62,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/server/credential-provider.d.ts

@@ -401,6 +401,11 @@ export declare function prefetchSecrets(keys: readonly string[]): Promise<void>;
  * Resolving several keys in one request? Call `prefetchSecrets` first.
  */
 export declare function resolveSecret(key: string): Promise<string | null>;
+/**
+ * Resolve two related secrets from one scope/source. A complete lower-
+ * precedence pair wins over mixing a partial override with another source.
+ */
+export declare function resolveSecretPair(keys: readonly [string, string]): Promise<[string, string] | null>;
 /**
  * `resolveSecret` without the throw: reports whether the miss is definitive
  * (`lookupFailed: false` — no such row anywhere the caller can reach) or just

package/dist/server/credential-provider.js

@@ -1235,6 +1235,90 @@ export async function resolveSecret(key) {
     assertCredentialStoreReadable(resolved);
     return null;
 }
+/**
+ * Resolve two related secrets from one scope/source. A complete lower-
+ * precedence pair wins over mixing a partial override with another source.
+ */
+export async function resolveSecretPair(keys) {
+    const [firstKey, secondKey] = keys;
+    const readPair = async (scope, scopeId) => {
+        const { readAppSecrets } = await import("../secrets/storage.js");
+        const secrets = await readAppSecrets({ keys, scope, scopeId });
+        const first = secrets.get(firstKey)?.value;
+        const second = secrets.get(secondKey)?.value;
+        return first && second ? [first, second] : null;
+    };
+    const readEnvironmentPair = () => {
+        if (!canUseDeployCredentialFallbackForRequest(firstKey) ||
+            !canUseDeployCredentialFallbackForRequest(secondKey)) {
+            return null;
+        }
+        const first = process.env[firstKey];
+        const second = process.env[secondKey];
+        return first && second ? [first, second] : null;
+    };
+    const email = getRequestUserEmail();
+    if (!email)
+        return readEnvironmentPair();
+    let lookupFailed = false;
+    let cause;
+    try {
+        let pair = await readPair("user", email);
+        if (pair)
+            return pair;
+        let orgId = getRequestOrgId();
+        if (!orgId) {
+            const resolved = await resolveOrgIdForRequestEmail(email);
+            cause = resolved.cause;
+            lookupFailed = cause !== undefined;
+            orgId = resolved.orgId;
+        }
+        if (lookupFailed) {
+            const environmentPair = readEnvironmentPair();
+            if (environmentPair)
+                return environmentPair;
+            assertCredentialStoreReadable({ lookupFailed, cause });
+            return null;
+        }
+        if (orgId) {
+            pair = await readPair("org", orgId);
+            if (pair)
+                return pair;
+            pair = await readPair("workspace", orgId);
+            if (pair)
+                return pair;
+        }
+        pair = await readPair("workspace", `solo:${email}`);
+        if (pair)
+            return pair;
+        const vaultOrgId = process.env.AGENT_VAULT_ORG_ID?.trim();
+        if (vaultOrgId && vaultOrgId !== orgId) {
+            const access = await Promise.all(keys.map((key) => canReadDesignatedVaultFallback(vaultOrgId, key)));
+            const unavailable = access.find((result) => result.status === "unavailable");
+            if (unavailable?.status === "unavailable") {
+                lookupFailed = true;
+                cause = unavailable.cause;
+            }
+            else if (access.every((result) => result.status === "allowed")) {
+                pair = await readPair("org", vaultOrgId);
+                if (pair)
+                    return pair;
+                pair = await readPair("workspace", vaultOrgId);
+                if (pair)
+                    return pair;
+            }
+        }
+    }
+    catch (error) {
+        lookupFailed = true;
+        cause = error;
+    }
+    const environmentPair = readEnvironmentPair();
+    if (environmentPair)
+        return environmentPair;
+    assertCredentialStoreReadable({ lookupFailed, cause });
+    return null;
+}
 /**
  * `resolveSecret` without the throw: reports whether the miss is definitive
  * (`lookupFailed: false` — no such row anywhere the caller can reach) or just

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.174.0",
+  "version": "0.174.1-nightly-20260825180834",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {