@agent-native/core 0.175.1 → 0.175.2-nightly-20260826165737

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,6 +159,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -174,7 +175,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,6 +190,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -199,7 +200,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,6 +216,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -234,7 +235,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,6 +250,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -263,7 +264,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/notifications/routes.d.ts

@@ -16,18 +16,18 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error?: undefined;
     ok?: undefined;
 } | {
+    count?: undefined;
     updated: number;
     error?: undefined;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error: string;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error?: undefined;
     ok: boolean;
-    count?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -76,8 +76,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     }>>;
 }, z.core.$strip>>, {
     id?: undefined;
+    provider?: undefined;
     deleted?: undefined;
-    found?: undefined;
+    message?: undefined;
     providers: {
         id: string;
         label: string;
@@ -88,46 +89,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    provider?: undefined;
+    found?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    id?: undefined;
     count?: undefined;
+    id?: undefined;
     deleted?: undefined;
+    message?: undefined;
     providers?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
     count?: undefined;
+    provider?: undefined;
     deleted?: undefined;
+    message?: undefined;
     providers?: undefined;
-    provider?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
     count?: undefined;
-    found?: undefined;
-    providers?: undefined;
     provider?: undefined;
+    message?: undefined;
+    providers?: undefined;
+    found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
     count?: undefined;
+    provider?: undefined;
     deleted?: undefined;
-    found?: undefined;
     providers?: undefined;
-    provider?: undefined;
+    found?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,11 +311,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        message?: undefined;
-        id?: undefined;
-        provider?: undefined;
         deleted?: undefined;
-        found?: undefined;
+        id?: undefined;
         providers: {
             id: string;
             label: string;
@@ -326,44 +323,47 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
+        provider?: undefined;
+        found?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        id?: undefined;
+    } | {
         deleted?: undefined;
+        id?: undefined;
         providers?: undefined;
         count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        provider?: undefined;
+    } | {
         deleted?: undefined;
         providers?: undefined;
         count?: undefined;
+        provider?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        provider?: undefined;
-        found?: undefined;
+    } | {
         providers?: undefined;
         count?: undefined;
+        provider?: undefined;
+        found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        provider?: undefined;
         deleted?: undefined;
-        found?: undefined;
         providers?: undefined;
         count?: undefined;
+        provider?: undefined;
+        found?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -34,10 +34,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/builder-browser.d.ts

@@ -54,9 +54,10 @@ export declare function isBuilderConnectCallbackUrlAllowed(candidate: string, ev
  * `getAppBasePath()` + `BUILDER_CALLBACK_PATH`. Intentionally ignores any
  * `?redirect_uri=` query override — connect always returns to this app's own
  * callback. Validated with `isBuilderConnectCallbackUrlAllowed` (Railway-safe,
- * no fixed domain allowlist).
+ * no fixed domain allowlist). When state is provided, bind it into the exact
+ * registered callback URI because Builder can omit top-level OAuth state.
  */
-export declare function resolveBuilderConnectCallbackUrl(event: H3Event): string | null;
+export declare function resolveBuilderConnectCallbackUrl(event: H3Event, state?: string): string | null;
 export declare function isSafeBuilderRelayTargetOrigin(value: string): boolean;
 export declare function isTrustedBuilderRelayTargetOrigin(value: string): boolean;
 /**
@@ -109,21 +110,22 @@ export declare function verifyBuilderRelayRequest(input: {
     body: BuilderRelayRequestBody;
 } | null;
 /**
- * Query-param name carrying the signed CSRF state on the connect→callback
- * round-trip. Prefixed with `_an_` to avoid collisions if Builder ever
- * adds standard OAuth `state` support to cli-auth. Builder preserves
- * the path/query of `redirect_url` verbatim when redirecting back, so
- * we embed `_an_state=…` inside the redirect_url query string at
- * connect time and read it back on the callback.
+ * Query-param name carrying the signed CSRF state on the legacy
+ * connect→callback round-trip. Prefixed with `_an_` to avoid collisions if
+ * Builder ever adds standard OAuth `state` support to cli-auth.
  */
 export declare const BUILDER_STATE_PARAM = "_an_state";
 export declare const BUILDER_CONNECT_PARAM = "_an_connect";
+export declare const BUILDER_CONNECT_STATE_COOKIE = "an_builder_connect_state";
 export declare const BUILDER_CONNECT_OWNER_COOKIE = "an_builder_connect_owner";
 export declare const BUILDER_SIGNUP_SOURCE_PARAM = "signupSource";
 export declare const BUILDER_AGENT_NATIVE_FLOW_PARAM = "agentNativeFlow";
 export declare const BUILDER_AGENT_NATIVE_CONNECT_SOURCE_PARAM = "agentNativeConnectSource";
 export declare const BUILDER_AGENT_NATIVE_APP_PARAM = "agentNativeApp";
 export declare const BUILDER_AGENT_NATIVE_TEMPLATE_PARAM = "agentNativeTemplate";
+export declare function appendBuilderConnectStateCookie(value: string | null | undefined, state: string): string;
+export declare function removeBuilderConnectStateCookie(value: string | null | undefined, state: string): string;
+export declare function resolveBuilderConnectCallbackState(queryState: string | null, cookieState: string | null | undefined): string | null;
 export interface BuilderConnectTrackingParams {
     signupSource?: string;
     agentNativeFlow?: string;
@@ -240,11 +242,9 @@ export declare function resolveIsBuilderBranchingEnabled(): Promise<boolean>;
 export declare const BUILDER_OPENER_PARAM = "_an_opener";
 /**
  * Build the Builder cli-auth URL for the connect popup. When a signed
- * `state` token is supplied it is embedded inside the `redirect_url`
- * query string so it survives Builder's redirect verbatim — Builder
- * preserves the redirect_url's existing query when appending p-key /
- * api-key / etc., so we don't depend on Builder echoing a top-level
- * `state` parameter (it doesn't).
+ * `state` token is supplied it is embedded inside the `redirect_url` query
+ * string. The connect route also stores it in an HttpOnly cookie because
+ * Builder may strip the callback query while appending its response params.
  *
  * Status responses can surface this URL directly; the legacy
  * `/_agent-native/builder/connect` trampoline still calls this helper for

package/dist/server/builder-browser.js

@@ -109,15 +109,17 @@ export function isBuilderConnectCallbackUrlAllowed(candidate, event) {
  * `getAppBasePath()` + `BUILDER_CALLBACK_PATH`. Intentionally ignores any
  * `?redirect_uri=` query override — connect always returns to this app's own
  * callback. Validated with `isBuilderConnectCallbackUrlAllowed` (Railway-safe,
- * no fixed domain allowlist).
+ * no fixed domain allowlist). When state is provided, bind it into the exact
+ * registered callback URI because Builder can omit top-level OAuth state.
  */
-export function resolveBuilderConnectCallbackUrl(event) {
-    const withBase = `${getOrigin(event)}${getAppBasePath()}${BUILDER_CALLBACK_PATH}`;
+export function resolveBuilderConnectCallbackUrl(event, state) {
+    const stateSuffix = state ? `?state=${encodeURIComponent(state)}` : "";
+    const withBase = `${getOrigin(event)}${getAppBasePath()}${BUILDER_CALLBACK_PATH}${stateSuffix}`;
     if (isBuilderConnectCallbackUrlAllowed(withBase, event))
         return withBase;
     // Match google-oauth default-redirect behavior when the request is not under
     // APP_BASE_PATH: fall back to the root `/_agent-native/...` callback.
-    const root = `${getOrigin(event)}${BUILDER_CALLBACK_PATH}`;
+    const root = `${getOrigin(event)}${BUILDER_CALLBACK_PATH}${stateSuffix}`;
     if (root !== withBase && isBuilderConnectCallbackUrlAllowed(root, event)) {
         return root;
     }
@@ -404,21 +406,52 @@ function escapeHtml(value) {
     });
 }
 /**
- * Query-param name carrying the signed CSRF state on the connect→callback
- * round-trip. Prefixed with `_an_` to avoid collisions if Builder ever
- * adds standard OAuth `state` support to cli-auth. Builder preserves
- * the path/query of `redirect_url` verbatim when redirecting back, so
- * we embed `_an_state=…` inside the redirect_url query string at
- * connect time and read it back on the callback.
+ * Query-param name carrying the signed CSRF state on the legacy
+ * connect→callback round-trip. Prefixed with `_an_` to avoid collisions if
+ * Builder ever adds standard OAuth `state` support to cli-auth.
  */
 export const BUILDER_STATE_PARAM = "_an_state";
 export const BUILDER_CONNECT_PARAM = "_an_connect";
+export const BUILDER_CONNECT_STATE_COOKIE = "an_builder_connect_state";
 export const BUILDER_CONNECT_OWNER_COOKIE = "an_builder_connect_owner";
 export const BUILDER_SIGNUP_SOURCE_PARAM = "signupSource";
 export const BUILDER_AGENT_NATIVE_FLOW_PARAM = "agentNativeFlow";
 export const BUILDER_AGENT_NATIVE_CONNECT_SOURCE_PARAM = "agentNativeConnectSource";
 export const BUILDER_AGENT_NATIVE_APP_PARAM = "agentNativeApp";
 export const BUILDER_AGENT_NATIVE_TEMPLATE_PARAM = "agentNativeTemplate";
+const BUILDER_CONNECT_STATE_COOKIE_MAX_ENTRIES = 4;
+function parseBuilderConnectStateCookie(value) {
+    if (!value)
+        return [];
+    const states = value.split(",");
+    if (states.length > BUILDER_CONNECT_STATE_COOKIE_MAX_ENTRIES ||
+        states.some((state) => !isSignedBuilderConnectState(state))) {
+        return null;
+    }
+    return [...new Set(states)];
+}
+export function appendBuilderConnectStateCookie(value, state) {
+    const states = parseBuilderConnectStateCookie(value) ?? [];
+    return [...states.filter((candidate) => candidate !== state), state]
+        .slice(-BUILDER_CONNECT_STATE_COOKIE_MAX_ENTRIES)
+        .join(",");
+}
+export function removeBuilderConnectStateCookie(value, state) {
+    return (parseBuilderConnectStateCookie(value) ?? [])
+        .filter((candidate) => candidate !== state)
+        .join(",");
+}
+export function resolveBuilderConnectCallbackState(queryState, cookieState) {
+    const cookieStates = parseBuilderConnectStateCookie(cookieState);
+    if (cookieState && !cookieStates)
+        return null;
+    if (queryState !== null) {
+        if (cookieStates?.length && !cookieStates.includes(queryState))
+            return null;
+        return queryState;
+    }
+    return cookieStates?.length === 1 ? cookieStates[0] : null;
+}
 const BUILDER_STATE_TTL_MS = 10 * 60 * 1000;
 const BUILDER_SIGNUP_SOURCE = "agent-native";
 function cleanTrackingParam(value) {
@@ -764,11 +797,9 @@ function isBuilderOpenerOriginSafe(value) {
 }
 /**
  * Build the Builder cli-auth URL for the connect popup. When a signed
- * `state` token is supplied it is embedded inside the `redirect_url`
- * query string so it survives Builder's redirect verbatim — Builder
- * preserves the redirect_url's existing query when appending p-key /
- * api-key / etc., so we don't depend on Builder echoing a top-level
- * `state` parameter (it doesn't).
+ * `state` token is supplied it is embedded inside the `redirect_url` query
+ * string. The connect route also stores it in an HttpOnly cookie because
+ * Builder may strip the callback query while appending its response params.
  *
  * Status responses can surface this URL directly; the legacy
  * `/_agent-native/builder/connect` trampoline still calls this helper for

package/dist/server/builder-oauth.d.ts

@@ -1,3 +1,4 @@
+import { type McpOAuthCredentialBundle } from "../mcp-client/oauth-client.js";
 export declare const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
 export declare const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
 export declare const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
@@ -26,6 +27,17 @@ export declare function startBuilderOAuthAuthorization(input: {
     authorizationUrl: string;
     pending: BuilderOAuthPendingFlow;
 }>;
+export declare function exchangeBuilderOAuthAuthorization(input: {
+    ownerEmail: string;
+    code: string;
+    iss?: string;
+    pending: BuilderOAuthPendingFlow;
+}): Promise<McpOAuthCredentialBundle>;
+export declare function saveBuilderOAuthCredentials(input: {
+    ownerEmail: string;
+    orgId?: string;
+    credentials: McpOAuthCredentialBundle;
+}): Promise<void>;
 export declare function finishBuilderOAuthAuthorization(input: {
     ownerEmail: string;
     orgId?: string;

package/dist/server/builder-oauth.js

@@ -133,7 +133,7 @@ export async function startBuilderOAuthAuthorization(input) {
         },
     };
 }
-export async function finishBuilderOAuthAuthorization(input) {
+export async function exchangeBuilderOAuthAuthorization(input) {
     validateMcpOAuthCallbackIssuer(input.pending.discoveryState, input.iss);
     const result = await finishMcpOAuthAuthorization({
         serverUrl: BUILDER_OAUTH_RESOURCE,
@@ -148,11 +148,22 @@ export async function finishBuilderOAuthAuthorization(input) {
     if (!isBuilderCredential(result.credentials)) {
         throw new Error("Builder OAuth exchange returned credentials for another resource");
     }
+    return withRecordedScopes(result.credentials);
+}
+export async function saveBuilderOAuthCredentials(input) {
     await saveMcpOAuthCredentials({
         ...(input.orgId
             ? orgOwnerOptions(input.orgId)
             : await ownerOptions(input.ownerEmail)),
-        credentials: withRecordedScopes(result.credentials),
+        credentials: input.credentials,
+    });
+}
+export async function finishBuilderOAuthAuthorization(input) {
+    const credentials = await exchangeBuilderOAuthAuthorization(input);
+    await saveBuilderOAuthCredentials({
+        ownerEmail: input.ownerEmail,
+        orgId: input.orgId,
+        credentials,
     });
 }
 export async function markBuilderOAuthReconnectRequired(ownerEmail) {