@agent-native/core 0.174.1-nightly-20260825193745 → 0.174.1

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;

package/dist/mcp-client/oauth-client.d.ts

@@ -8,6 +8,7 @@
  */
 import { type AuthorizationServerMetadata, type OAuthClientInformationContext, type OAuthClientMetadata, type OAuthClientProvider, type OAuthDiscoveryState, OAuthProtectedResourceMetadata, type StoredOAuthClientInformation, type StoredOAuthTokens, OAuthTokens } from "@modelcontextprotocol/client";
 import { type OAuthCredential, type OAuthCredentialState, type OAuthRevocationResult } from "../oauth-tokens/lifecycle.js";
+export declare function isGoogleWorkspaceMcpServer(value: string | URL): boolean;
 export type McpOAuthDiscoveryState = OAuthDiscoveryState;
 export interface McpOAuthCredentialBundle extends OAuthCredential {
     serverUrl: string;

package/dist/mcp-client/oauth-client.js

@@ -6,13 +6,69 @@
  * protocol details; this module owns the framework-specific encrypted storage
  * and refresh boundary.
  */
+import crypto from "node:crypto";
 import { auth, refreshAuthorization, validateAuthorizationResponseIssuer, } from "@modelcontextprotocol/client";
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import { readOAuthCredentialState, resolveOAuthCredentialAccess, markOAuthReconnectRequired, revokeOAuthCredential, saveOAuthCredential, } from "../oauth-tokens/lifecycle.js";
 import { validateRemoteUrl } from "./remote-url.js";
 const TOKEN_EXPIRY_SKEW_MS = 60_000;
 const MAX_OAUTH_REDIRECTS = 5;
+const MAX_OAUTH_RESPONSE_BYTES = 256 * 1024;
 const MCP_OAUTH_PRIVATE_ORIGINS_ENV = "AGENT_NATIVE_MCP_OAUTH_PRIVATE_ORIGINS";
+const GOOGLE_MCP_ISSUER = "https://accounts.google.com";
+const GOOGLE_MCP_AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+const GOOGLE_MCP_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const GOOGLE_MCP_SCOPES_BY_ORIGIN = {
+    "https://workspacemcp.googleapis.com": [
+        "https://www.googleapis.com/auth/gmail.readonly",
+        "https://www.googleapis.com/auth/drive.readonly",
+        "https://www.googleapis.com/auth/calendar.readonly",
+        "https://www.googleapis.com/auth/chat.messages.readonly",
+    ],
+    "https://gmailmcp.googleapis.com": [
+        "https://www.googleapis.com/auth/gmail.readonly",
+        "https://www.googleapis.com/auth/gmail.compose",
+    ],
+    "https://drivemcp.googleapis.com": [
+        "https://www.googleapis.com/auth/drive.readonly",
+        "https://www.googleapis.com/auth/drive.file",
+    ],
+    "https://docsmcp.googleapis.com": [
+        "https://www.googleapis.com/auth/drive.readonly",
+        "https://www.googleapis.com/auth/drive.file",
+        "https://www.googleapis.com/auth/documents.readonly",
+        "https://www.googleapis.com/auth/documents",
+    ],
+    "https://sheetsmcp.googleapis.com": [
+        "https://www.googleapis.com/auth/drive.readonly",
+        "https://www.googleapis.com/auth/drive.file",
+        "https://www.googleapis.com/auth/spreadsheets.readonly",
+        "https://www.googleapis.com/auth/spreadsheets",
+    ],
+    "https://slidesmcp.googleapis.com": [
+        "https://www.googleapis.com/auth/drive.readonly",
+        "https://www.googleapis.com/auth/drive.file",
+        "https://www.googleapis.com/auth/presentations.readonly",
+        "https://www.googleapis.com/auth/presentations",
+    ],
+    "https://calendarmcp.googleapis.com": [
+        "https://www.googleapis.com/auth/calendar.calendarlist.readonly",
+        "https://www.googleapis.com/auth/calendar.events.freebusy",
+        "https://www.googleapis.com/auth/calendar.events.readonly",
+    ],
+    "https://chatmcp.googleapis.com": [
+        "https://www.googleapis.com/auth/chat.spaces.readonly",
+        "https://www.googleapis.com/auth/chat.memberships.readonly",
+        "https://www.googleapis.com/auth/chat.messages.readonly",
+        "https://www.googleapis.com/auth/chat.messages.create",
+        "https://www.googleapis.com/auth/chat.users.readstate.readonly",
+    ],
+    "https://people.googleapis.com": [
+        "https://www.googleapis.com/auth/directory.readonly",
+        "https://www.googleapis.com/auth/userinfo.profile",
+        "https://www.googleapis.com/auth/contacts.readonly",
+    ],
+};
 function checkedRemoteUrl(value, label) {
     const result = validateRemoteUrl(String(value));
     if (!result.ok || !result.url) {
@@ -23,6 +79,142 @@ function checkedRemoteUrl(value, label) {
 function canonicalServerUrl(value) {
     return checkedRemoteUrl(value, "server").toString();
 }
+function googleMcpScopes(serverUrl) {
+    try {
+        return GOOGLE_MCP_SCOPES_BY_ORIGIN[new URL(serverUrl).origin];
+    }
+    catch {
+        // coercion-ok: an invalid URL is absent from the managed-server allowlist.
+        return undefined;
+    }
+}
+export function isGoogleWorkspaceMcpServer(value) {
+    return Boolean(googleMcpScopes(typeof value === "string" ? value : value.toString()));
+}
+function googleMcpDiscoveryState(serverUrl, scopes) {
+    return {
+        authorizationServerUrl: GOOGLE_MCP_ISSUER,
+        authorizationServerMetadata: {
+            issuer: GOOGLE_MCP_ISSUER,
+            authorization_endpoint: GOOGLE_MCP_AUTHORIZATION_ENDPOINT,
+            token_endpoint: GOOGLE_MCP_TOKEN_ENDPOINT,
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code", "refresh_token"],
+            token_endpoint_auth_methods_supported: ["client_secret_post"],
+            code_challenge_methods_supported: ["S256"],
+        },
+        resourceMetadata: {
+            resource: serverUrl,
+            authorization_servers: [GOOGLE_MCP_ISSUER],
+            bearer_methods_supported: ["header"],
+            scopes_supported: [...scopes],
+        },
+    };
+}
+function googleMcpClientInformation(value) {
+    const clientId = value?.client_id;
+    const clientSecret = value?.client_secret;
+    if (!clientId || !clientSecret) {
+        throw new Error("Google Workspace MCP OAuth client credentials are not configured.");
+    }
+    if (value.issuer && value.issuer !== GOOGLE_MCP_ISSUER) {
+        throw new Error("Google Workspace MCP OAuth issuer is invalid.");
+    }
+    return {
+        ...value,
+        client_id: clientId,
+        client_secret: clientSecret,
+        issuer: GOOGLE_MCP_ISSUER,
+    };
+}
+function startGoogleMcpOAuthAuthorization(options, scopes) {
+    const clientInformation = googleMcpClientInformation(options.clientInformation);
+    const codeVerifier = options.codeVerifier ?? crypto.randomBytes(48).toString("base64url");
+    const codeChallenge = crypto
+        .createHash("sha256")
+        .update(codeVerifier)
+        .digest("base64url");
+    const authorizationUrl = new URL(GOOGLE_MCP_AUTHORIZATION_ENDPOINT);
+    authorizationUrl.searchParams.set("client_id", clientInformation.client_id);
+    authorizationUrl.searchParams.set("redirect_uri", options.redirectUrl);
+    authorizationUrl.searchParams.set("response_type", "code");
+    authorizationUrl.searchParams.set("scope", scopes.join(" "));
+    authorizationUrl.searchParams.set("state", options.state);
+    authorizationUrl.searchParams.set("access_type", "offline");
+    authorizationUrl.searchParams.set("prompt", "consent");
+    authorizationUrl.searchParams.set("code_challenge", codeChallenge);
+    authorizationUrl.searchParams.set("code_challenge_method", "S256");
+    return {
+        authorizationUrl: checkedRemoteUrl(authorizationUrl, "authorization redirect"),
+        codeVerifier,
+        state: options.state,
+        clientInformation,
+        discoveryState: googleMcpDiscoveryState(options.serverUrl, scopes),
+    };
+}
+async function readOAuthResponseJson(response) {
+    const text = await response.text();
+    if (Buffer.byteLength(text) > MAX_OAUTH_RESPONSE_BYTES) {
+        throw new Error("MCP OAuth response exceeded the size limit.");
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("MCP OAuth response was not an object.");
+        }
+        return parsed;
+    }
+    catch {
+        throw new Error("MCP OAuth response was not valid JSON.");
+    }
+}
+async function finishGoogleMcpOAuthAuthorization(options, scopes) {
+    const clientInformation = googleMcpClientInformation(options.clientInformation);
+    if (!options.codeVerifier) {
+        throw new Error("Google Workspace MCP OAuth code verifier is missing.");
+    }
+    const response = await guardedOAuthFetch()(GOOGLE_MCP_TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            code: options.authorizationCode,
+            client_id: clientInformation.client_id,
+            client_secret: clientInformation.client_secret,
+            redirect_uri: options.redirectUrl,
+            grant_type: "authorization_code",
+            code_verifier: options.codeVerifier,
+        }),
+    });
+    const body = await readOAuthResponseJson(response);
+    const accessToken = typeof body.access_token === "string" ? body.access_token : undefined;
+    const tokenType = typeof body.token_type === "string" ? body.token_type : undefined;
+    if (!response.ok || !accessToken || !tokenType) {
+        throw new Error("Google Workspace MCP OAuth token exchange failed.");
+    }
+    const expiresIn = Number(body.expires_in);
+    const tokens = {
+        access_token: accessToken,
+        token_type: tokenType,
+        ...(Number.isFinite(expiresIn) && expiresIn > 0
+            ? { expires_in: expiresIn }
+            : {}),
+        ...(typeof body.refresh_token === "string"
+            ? { refresh_token: body.refresh_token }
+            : {}),
+        ...(typeof body.scope === "string" ? { scope: body.scope } : {}),
+        ...(typeof body.id_token === "string" ? { id_token: body.id_token } : {}),
+        issuer: GOOGLE_MCP_ISSUER,
+    };
+    return {
+        credentials: {
+            serverUrl: options.serverUrl,
+            clientInformation,
+            discoveryState: googleMcpDiscoveryState(options.serverUrl, scopes),
+            tokens,
+            tokenExpiresAt: tokenExpiresAt(tokens),
+        },
+    };
+}
 /**
  * RFC 8707 resource identifiers are exact strings. WHATWG `URL` origin-only
  * values stringify with a trailing slash (`https://api.builder.io/` vs
@@ -111,7 +303,7 @@ function guardedOAuthFetch() {
                 nextHeaders.delete("cookie");
                 nextHeaders.delete("proxy-authorization");
                 if ((response.status === 307 || response.status === 308) &&
-                    currentInit.body != null) {
+                    currentInit.body !== null) {
                     throw new Error("MCP OAuth redirect cannot forward a request body across origins.");
                 }
             }
@@ -307,7 +499,11 @@ export class McpOAuthClientProvider {
     }
 }
 export async function startMcpOAuthAuthorization(options) {
-    checkedRemoteUrl(options.serverUrl, "server");
+    const serverUrl = checkedRemoteUrl(options.serverUrl, "server");
+    const googleScopes = googleMcpScopes(serverUrl.toString());
+    if (googleScopes) {
+        return startGoogleMcpOAuthAuthorization({ ...options, serverUrl: serverUrl.toString() }, googleScopes);
+    }
     const provider = new McpOAuthClientProvider(options);
     const result = await auth(provider, {
         serverUrl: options.serverUrl,
@@ -333,7 +529,11 @@ export async function startMcpOAuthAuthorization(options) {
     };
 }
 export async function finishMcpOAuthAuthorization(options) {
-    checkedRemoteUrl(options.serverUrl, "server");
+    const serverUrl = checkedRemoteUrl(options.serverUrl, "server");
+    const googleScopes = googleMcpScopes(serverUrl.toString());
+    if (googleScopes) {
+        return finishGoogleMcpOAuthAuthorization({ ...options, serverUrl: serverUrl.toString() }, googleScopes);
+    }
     const provider = new McpOAuthClientProvider(options);
     const result = await auth(provider, {
         serverUrl: options.serverUrl,

package/dist/mcp-client/oauth-routes.js

@@ -36,6 +36,10 @@ const MANAGED_MCP_OAUTH_CLIENTS = [
         ],
         credentialPairs: [["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]],
     },
+    {
+        serverOrigins: ["https://workspacemcp.googleapis.com"],
+        credentialPairs: [["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]],
+    },
 ];
 export function redirectWithStagedCookies(event, location) {
     const headers = new Headers({

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
+    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,9 +59,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -34,10 +34,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.174.1-nightly-20260825193745",
+  "version": "0.174.1",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -429,8 +429,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.32",
     "zod": "^4.3.6",
-    "@agent-native/recap-cli": "0.5.11",
-    "@agent-native/toolkit": "^0.16.14"
+    "@agent-native/recap-cli": "0.5.12",
+    "@agent-native/toolkit": "^0.16.15"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",