@agent-native/core 0.176.1 → 0.177.0-nightly-20260828155142

package/dist/index.browser.d.ts

@@ -2,7 +2,7 @@ export * from "./config.js";
 export { addContextToAgentChat, appendAgentChatContextToMessage, clearAgentChatContext, formatAgentChatContextItemsForPrompt, listAgentChatContext, refreshAgentChatContext, removeAgentChatContextItem, sendToAgentChat, sendToAgentChatAndConfirm, setAgentChatContextItem, setContextToAgentChat, isEmbedMcpChatBridgeActive, useAgentChatContext, useAgentChatGenerating, useDevMode, useSendToAgentChat, AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES, getMcpAppHostContext, openMcpAppHostLink, requestMcpAppDisplayMode, sendMcpAppHostMessage, updateMcpAppModelContext, useMcpAppHostContext, CodeRequiredDialog, AgentNativeI18nProvider, LanguagePicker, getLocaleInitScript, localeDirection, normalizeLocaleCode, normalizeLocalePreference, normalizeLocalizationPreference, resolveLocaleFromCandidates, resolveLocaleFromPreference, useFormatters, useLocale, useT, DEFAULT_LOCALE, LOCALE_HYDRATION_GLOBAL, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, useDbSync, useFileWatcher, useSession, cn, ApiKeySettings, type AgentChatContextItem, type AgentChatContextMessage, type AgentChatContextMutationOptions, type AgentChatContextRemoveOptions, type AgentChatContextSetOptions, type AgentChatContextState, type AgentChatMessage, type AgentNativeMcpAppHostMessageType, type McpAppDisplayMode, type McpAppHostChatMessage, type McpAppHostCapabilities, type McpAppHostContext, type McpAppHostContextSnapshot, type McpAppModelContextContentPart, type McpAppModelContextUpdate, type CodeRequiredDialogProps, type AuthSession, type UseAgentChatContextResult, type AgentNativeI18nCatalog, type AgentNativeI18nProviderProps, type LocaleCode, type LocaleHydrationPayload, type LocaleMessages, type LocaleMetadata, type LocalePreference, type LocalizationPreference, } from "./client/index.js";
 export { agentChat } from "./shared/index.js";
 export { parseArgs, camelCaseArgs } from "./scripts/parse-args.js";
-export { AgentNativeWebMcpUnsupportedError, createAgentNativeWebMcpClient, createAgentNativeWebMcpRegistration, isAgentNativeWebMcpSupported, type AgentNativeWebMcpApprovalRequest, type AgentNativeWebMcpClient, type AgentNativeWebMcpClientOptions, type AgentNativeWebMcpRegistration, type AgentNativeWebMcpRegistrationOptions, type AgentNativeWebMcpTool, type AgentNativeWebMcpToolAnnotations, type AgentNativeWebMcpToolExecutionOptions, type AgentNativeWebMcpToolResult, } from "./client/webmcp.js";
+export { AgentNativeWebMcpUnsupportedError, createAgentNativeWebMcpClient, createAgentNativeWebMcpRegistration, createAgentNativeServerActionWebMcpRegistration, isAgentNativeWebMcpSupported, type AgentNativeWebMcpApprovalRequest, type AgentNativeWebMcpClient, type AgentNativeWebMcpClientOptions, type AgentNativeWebMcpRegistration, type AgentNativeWebMcpRegistrationOptions, type AgentNativeWebMcpTool, type AgentNativeWebMcpToolAnnotations, type AgentNativeWebMcpToolExecutionOptions, type AgentNativeWebMcpToolResult, } from "./client/webmcp.js";
 export { defineAction, fail, type FailOptions, ActionContractError, isActionContractError, type ActionContractErrorOptions, AgentActionStopError, isAgentActionStopError, type ActionHttpConfig, type AgentActionStopOptions, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, type ActionMcpAppConfig, type ActionMcpAppCsp, type ActionMcpAppCspBuilder, type ActionMcpAppHtmlBuilder, type ActionMcpAppPermissions, type ActionMcpAppResourceConfig, type ActionMcpAppResourceMeta, } from "./action.js";
 export { isEmailDerivedName, normalizeUserProfileName, resolveUserProfileName, USER_PROFILE_SETTING_KEY, type UserProfile, } from "./user-profile/index.js";
 export { ACTION_CHAT_UI_DATA_CHART_RENDERER, ACTION_CHAT_UI_DATA_INSIGHTS_RENDERER, ACTION_CHAT_UI_DATA_TABLE_RENDERER, ACTION_CHAT_UI_DATA_WIDGET_RENDERER, ACTION_CHAT_UI_INLINE_EXTENSION_RENDERER, ACTION_CHAT_UI_WORKSPACE_FILE_RENDERER, type ActionChatUIConfig, } from "./action-ui.js";

package/dist/index.browser.js

@@ -8,7 +8,7 @@ export { addContextToAgentChat, appendAgentChatContextToMessage, clearAgentChatC
 export { agentChat } from "./shared/index.js";
 // Pure utilities (no Node.js deps — safe for browser and SSR)
 export { parseArgs, camelCaseArgs } from "./scripts/parse-args.js";
-export { AgentNativeWebMcpUnsupportedError, createAgentNativeWebMcpClient, createAgentNativeWebMcpRegistration, isAgentNativeWebMcpSupported, } from "./client/webmcp.js";
+export { AgentNativeWebMcpUnsupportedError, createAgentNativeWebMcpClient, createAgentNativeWebMcpRegistration, createAgentNativeServerActionWebMcpRegistration, isAgentNativeWebMcpSupported, } from "./client/webmcp.js";
 // defineAction — used by template actions, no Node.js deps
 export { defineAction, fail, ActionContractError, isActionContractError, AgentActionStopError, isAgentActionStopError, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, } from "./action.js";
 export { isEmailDerivedName, normalizeUserProfileName, resolveUserProfileName, USER_PROFILE_SETTING_KEY, } from "./user-profile/index.js";

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
-    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-} | {
     error?: undefined;
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
+    error?: undefined;
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
+    ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/observability/routes.js

@@ -19,7 +19,7 @@
  *   POST   /experiments/:id/results    — compute experiment results
  *   GET    /experiments/:id/results    — get experiment results
  */
-import { defineEventHandler, getMethod, getQuery, setResponseStatus, } from "h3";
+import { defineEventHandler, getHeader, getMethod, getQuery, setResponseStatus, } from "h3";
 import { getSession } from "../server/auth.js";
 import { readBody } from "../server/h3-helpers.js";
 import { getRequestContext } from "../server/request-context.js";
@@ -164,16 +164,22 @@ export function createObservabilityHandler() {
                     ? JSON.stringify(rawValue)
                     : String(rawValue);
             const id = nanoid();
-            await insertFeedback({
+            const idempotencyKey = feedbackType === "text"
+                ? getHeader(event, "idempotency-key")?.trim() || null
+                : null;
+            const inserted = await insertFeedback({
                 id,
                 runId: body.runId ? String(body.runId) : null,
                 threadId: body.threadId ? String(body.threadId) : null,
                 messageSeq: typeof body.messageSeq === "number" ? body.messageSeq : null,
                 feedbackType,
                 value,
+                idempotencyKey,
                 userId: owner,
                 createdAt: Date.now(),
             });
+            if (!inserted)
+                return { id };
             {
                 const runId = body.runId ? String(body.runId) : null;
                 const threadId = body.threadId ? String(body.threadId) : null;

package/dist/observability/store.d.ts

@@ -34,7 +34,7 @@ export declare function getLatestTraceSummaryForThread(threadId: string, opts: {
     userId: string;
     excludeRunId: string;
 }): Promise<TraceSummary | null>;
-export declare function insertFeedback(entry: FeedbackEntry): Promise<void>;
+export declare function insertFeedback(entry: FeedbackEntry): Promise<boolean>;
 export declare function getFeedback(opts: {
     threadId?: string;
     sinceMs?: number;

package/dist/observability/store.js

@@ -95,6 +95,7 @@ export async function ensureObservabilityTables() {
           message_seq ${intType()},
           feedback_type TEXT NOT NULL,
           value TEXT NOT NULL DEFAULT '',
+          idempotency_key TEXT,
           user_id TEXT,
           created_at ${intType()} NOT NULL
         )
@@ -187,6 +188,7 @@ export async function ensureObservabilityTables() {
                 for (const table of USER_SCOPED_TABLES) {
                     await ensureColumnExists(table, "user_id", `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS user_id TEXT`);
                 }
+                await ensureColumnExists("agent_feedback", "idempotency_key", `ALTER TABLE agent_feedback ADD COLUMN IF NOT EXISTS idempotency_key TEXT`);
                 await ensureIndexExists("idx_trace_spans_run", `CREATE INDEX IF NOT EXISTS idx_trace_spans_run ON agent_trace_spans (run_id)`);
                 await ensureIndexExists("idx_trace_spans_thread", `CREATE INDEX IF NOT EXISTS idx_trace_spans_thread ON agent_trace_spans (thread_id)`);
                 await ensureIndexExists("idx_trace_spans_created", `CREATE INDEX IF NOT EXISTS idx_trace_spans_created ON agent_trace_spans (created_at)`);
@@ -198,6 +200,7 @@ export async function ensureObservabilityTables() {
                 await ensureIndexExists("idx_feedback_created", `CREATE INDEX IF NOT EXISTS idx_feedback_created ON agent_feedback (created_at)`);
                 await ensureIndexExists("idx_feedback_user", `CREATE INDEX IF NOT EXISTS idx_feedback_user ON agent_feedback (user_id, created_at)`);
                 await ensureIndexExists("idx_feedback_type_created", `CREATE INDEX IF NOT EXISTS idx_feedback_type_created ON agent_feedback (feedback_type, created_at)`);
+                await ensureIndexExists("idx_feedback_idempotency", `CREATE UNIQUE INDEX IF NOT EXISTS idx_feedback_idempotency ON agent_feedback (user_id, idempotency_key)`);
                 await ensureIndexExists("idx_satisfaction_thread", `CREATE INDEX IF NOT EXISTS idx_satisfaction_thread ON agent_satisfaction_scores (thread_id)`);
                 await ensureIndexExists("idx_satisfaction_user", `CREATE INDEX IF NOT EXISTS idx_satisfaction_user ON agent_satisfaction_scores (user_id, computed_at)`);
                 await ensureIndexExists("idx_evals_run", `CREATE INDEX IF NOT EXISTS idx_evals_run ON agent_evals (run_id)`);
@@ -241,6 +244,13 @@ export async function ensureObservabilityTables() {
                     throw err;
                 }
             }
+            try {
+                await client.execute(`ALTER TABLE agent_feedback ADD COLUMN idempotency_key TEXT`);
+            }
+            catch (err) {
+                if (!isDuplicateColumnError(err))
+                    throw err;
+            }
             // Indexes for common query patterns
             const indexes = [
                 `CREATE INDEX IF NOT EXISTS idx_trace_spans_run ON agent_trace_spans (run_id)`,
@@ -254,6 +264,7 @@ export async function ensureObservabilityTables() {
                 `CREATE INDEX IF NOT EXISTS idx_feedback_created ON agent_feedback (created_at)`,
                 `CREATE INDEX IF NOT EXISTS idx_feedback_user ON agent_feedback (user_id, created_at)`,
                 `CREATE INDEX IF NOT EXISTS idx_feedback_type_created ON agent_feedback (feedback_type, created_at)`,
+                `CREATE UNIQUE INDEX IF NOT EXISTS idx_feedback_idempotency ON agent_feedback (user_id, idempotency_key)`,
                 `CREATE INDEX IF NOT EXISTS idx_satisfaction_thread ON agent_satisfaction_scores (thread_id)`,
                 `CREATE INDEX IF NOT EXISTS idx_satisfaction_user ON agent_satisfaction_scores (user_id, computed_at)`,
                 `CREATE INDEX IF NOT EXISTS idx_evals_run ON agent_evals (run_id)`,
@@ -478,10 +489,11 @@ export async function getLatestTraceSummaryForThread(threadId, opts) {
 export async function insertFeedback(entry) {
     await ensureObservabilityTables();
     const client = getDbExec();
-    await client.execute({
+    const result = await client.execute({
         sql: `INSERT INTO agent_feedback
-      (id, run_id, thread_id, message_seq, feedback_type, value, user_id, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      (id, run_id, thread_id, message_seq, feedback_type, value, idempotency_key, user_id, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT DO NOTHING`,
         args: [
             entry.id,
             entry.runId,
@@ -489,10 +501,12 @@ export async function insertFeedback(entry) {
             entry.messageSeq,
             entry.feedbackType,
             entry.value,
+            entry.idempotencyKey,
             entry.userId,
             entry.createdAt,
         ],
     });
+    return result.rowsAffected > 0;
 }
 export async function getFeedback(opts) {
     await ensureObservabilityTables();
@@ -1019,6 +1033,7 @@ function rowToFeedback(row) {
         messageSeq: row.message_seq != null ? Number(row.message_seq) : null,
         feedbackType: row.feedback_type,
         value: String(row.value ?? ""),
+        idempotencyKey: row.idempotency_key ? String(row.idempotency_key) : null,
         userId: row.user_id ? String(row.user_id) : null,
         createdAt: Number(row.created_at),
     };

package/dist/observability/types.d.ts

@@ -54,6 +54,7 @@ export interface FeedbackEntry {
     messageSeq: number | null;
     feedbackType: FeedbackType;
     value: string;
+    idempotencyKey?: string | null;
     userId: string | null;
     createdAt: number;
 }

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/resources/handlers.d.ts

@@ -51,8 +51,8 @@ export declare function handleDeleteResource(event: any): Promise<{
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,10 +73,10 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
+    error?: undefined;
     url: string;
     provider: string;
     storageSetupRequired?: undefined;
-    error?: undefined;
 } | {
     error: string;
     storageSetupRequired: boolean;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/action-routes.d.ts

@@ -60,10 +60,5 @@ export interface MountActionRoutesOptions {
      */
     actionRouteAuth?: ActionRouteAuthAdapter;
 }
-/**
- * Mount discovered actions as HTTP endpoints.
- *
- * Only actions from `autoDiscoverActions` (template actions) are mounted.
- * Built-in actions (resource-*, chat-*, shell, etc.) are NOT passed here.
- */
 export declare function mountActionRoutes(nitroApp: any, actions: Record<string, ActionEntry>, options?: MountActionRoutesOptions): void;
+export declare function mountWebMcpActionRoutes(nitroApp: any, actions: Record<string, ActionEntry>, options?: MountActionRoutesOptions): void;

package/dist/server/action-routes.js

@@ -240,21 +240,23 @@ async function resolveRequestAuthCapability(event) {
  * Only actions from `autoDiscoverActions` (template actions) are mounted.
  * Built-in actions (resource-*, chat-*, shell, etc.) are NOT passed here.
  */
-export function mountActionRoutes(nitroApp, actions, options) {
+function mountActionRoutesInternal(nitroApp, actions, options) {
     const mounted = [];
     const app = getH3App(nitroApp);
     for (const [name, entry] of Object.entries(actions)) {
         // Skip agent-only actions
-        if (entry.http === false)
+        if (entry.http === false && !options?.includeAgentOnly)
             continue;
-        const method = entry.http?.method ?? "POST";
-        const path = entry.http?.path ?? name;
-        const routePath = `${ROUTE_PREFIX}/${path}`;
+        const http = entry.http || undefined;
+        const method = options?.forcePost ? "POST" : (http?.method ?? "POST");
+        const path = options?.forcePost ? name : (http?.path ?? name);
+        const routePath = `${options?.routePrefix ?? ROUTE_PREFIX}/${path}`;
         // These two actions authenticate with a scoped A2A bearer rather than a
         // browser session. Let that verifier see the request before the cookie
         // auth guard rejects it; the action route still fails closed on invalid
         // or missing credentials.
-        if (name === "list-feature-flags" || name === "set-feature-flag") {
+        if (!options?.caller &&
+            (name === "list-feature-flags" || name === "set-feature-flag")) {
             registerAuthPublicPaths([routePath], app);
         }
         app.use(routePath, defineEventHandler(async (event) => {
@@ -329,7 +331,7 @@ export function mountActionRoutes(nitroApp, actions, options) {
             // through, so a live same-origin session cookie can't silently execute
             // the request as the logged-in user.
             let resolvedCaller = null;
-            {
+            if (options?.allowDelegatedCaller !== false) {
                 let caller;
                 try {
                     caller = options?.actionRouteAuth?.resolveCaller
@@ -468,11 +470,12 @@ export function mountActionRoutes(nitroApp, actions, options) {
                 // userEmail / orgId mirror the request context resolved above (do
                 // NOT inject a dev identity — leave undefined when unauthenticated).
                 try {
-                    const caller = resolvedCaller
-                        ? "a2a"
-                        : isFrontendActionRequest(event)
-                            ? "frontend"
-                            : "http";
+                    const caller = options?.caller ??
+                        (resolvedCaller
+                            ? "a2a"
+                            : isFrontendActionRequest(event)
+                                ? "frontend"
+                                : "http");
                     const result = await entry.run(params, {
                         userEmail,
                         orgId: orgId ?? null,
@@ -574,11 +577,12 @@ export function mountActionRoutes(nitroApp, actions, options) {
                         method: reqMethod,
                         tags: {
                             action: name,
-                            caller: resolvedCaller
-                                ? "a2a"
-                                : isFrontendActionRequest(event)
-                                    ? "frontend"
-                                    : "http",
+                            caller: options?.caller ??
+                                (resolvedCaller
+                                    ? "a2a"
+                                    : isFrontendActionRequest(event)
+                                        ? "frontend"
+                                        : "http"),
                             status_code: String(status),
                         },
                         ...(requestId ? { extra: { request_id: requestId } } : {}),
@@ -598,3 +602,40 @@ export function mountActionRoutes(nitroApp, actions, options) {
     if (mounted.length > 0 && process.env.DEBUG)
         console.log(`[action-routes] Mounted ${mounted.length} action route(s): ${mounted.join(", ")}`);
 }
+export function mountActionRoutes(nitroApp, actions, options) {
+    mountActionRoutesInternal(nitroApp, actions, options);
+}
+export function mountWebMcpActionRoutes(nitroApp, actions, options) {
+    const eligible = Object.fromEntries(Object.entries(actions).filter(([name, entry]) => /^[A-Za-z0-9_.-]{1,128}$/.test(name) &&
+        entry.agentTool !== false &&
+        entry.needsApproval === undefined));
+    if (Object.keys(eligible).length === 0)
+        return;
+    const app = getH3App(nitroApp);
+    app.use("/_agent-native/webmcp/manifest", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "GET") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed. Use GET." };
+        }
+        if (!options?.getOwnerFromEvent) {
+            throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+        }
+        await options.getOwnerFromEvent(event);
+        setResponseHeader(event, "Cache-Control", "no-store");
+        return Object.entries(eligible).map(([name, entry]) => ({
+            name,
+            description: entry.tool.description,
+            inputSchema: entry.tool.parameters,
+            readOnly: entry.readOnly === true,
+        }));
+    }));
+    mountActionRoutesInternal(nitroApp, eligible, {
+        ...options,
+        routePrefix: "/_agent-native/webmcp/actions",
+        includeAgentOnly: true,
+        forcePost: true,
+        caller: "webmcp",
+        actionRouteAuth: undefined,
+        allowDelegatedCaller: false,
+    });
+}

package/dist/server/agent-chat-plugin.js

@@ -2128,7 +2128,7 @@ export function createAgentChatPlugin(options) {
                 // Ignore — templates without sharing still work.
             }
             if (Object.keys(httpActions).length > 0) {
-                const { mountActionRoutes } = await import("./action-routes.js");
+                const { mountActionRoutes, mountWebMcpActionRoutes } = await import("./action-routes.js");
                 if (options?.actionRoutePublicPaths?.length) {
                     registerAuthPublicPaths(options.actionRoutePublicPaths, getH3App(nitroApp));
                 }
@@ -2139,6 +2139,13 @@ export function createAgentChatPlugin(options) {
                     resolveOrgId: options?.resolveOrgId,
                     actionRouteAuth: options?.actionRouteAuth,
                 });
+                mountWebMcpActionRoutes(nitroApp, httpActions, {
+                    getOwnerFromEvent,
+                    getUserNameFromEvent,
+                    appId: options?.appId,
+                    resolveOrgId: options?.resolveOrgId,
+                    actionRouteAuth: options?.actionRouteAuth,
+                });
             }
             const preRunGitStatusByThread = new Map();
             async function recordPreRunGitStatus(threadId) {

package/dist/server/agent-engine-api-key-route.d.ts

@@ -34,10 +34,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;

package/docs/content/webmcp.mdx

@@ -1,6 +1,6 @@
 ---
 title: "WebMCP"
-description: "Expose explicit Agent-Native client actions to browser agents and consume page-local WebMCP tools from Agent-Native chat."
+description: "Automatically expose Agent-Native actions to browser agents, register explicit client actions, and consume page-local WebMCP tools from Agent-Native chat."
 search: "WebMCP browser tools modelContext registerTool getTools executeTool browser session"
 ---
 
@@ -15,24 +15,42 @@ discover them, and the browser mediates execution.
 
 The framework supports both directions:
 
-<!-- i18n-copy-ignore: oxfmt-only table alignment; no translated prose changed. -->
-
 | You want to...                                                           | Use                                                                                                      |
 | ------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------- |
-| Make selected actions in your app available to a browser agent           | `createAgentNativeWebMcpRegistration`                                                                    |
+| Make backend actions available to a browser agent                        | Automatic on authenticated pages through `AppProviders`                                                  |
+| Make page-local client actions available to a browser agent              | `createAgentNativeWebMcpRegistration`                                                                    |
 | Let Agent-Native chat discover and call WebMCP tools in the current page | `createAgentNativeWebMcpClient` plus `webmcp` on `AgentNativeEmbedded` or `AgentNativeFrame`             |
 | Connect a headless or remote agent to an app                             | [MCP Server](/docs/mcp-protocol), [External Agents](/docs/external-agents), or [A2A](/docs/a2a-protocol) |
 
 WebMCP is not a network MCP server and does not make a closed app globally
 discoverable. A consuming agent needs an open, connected browser page and the
-page must explicitly opt into the tools it exposes.
+page must expose tools to it.
 
 The browser API is experimental and may change. See the [Chrome WebMCP
 Imperative API](https://developer.chrome.com/docs/ai/webmcp/imperative-api) and
 the [WebMCP specification](https://webmachinelearning.github.io/webmcp/) for
 the current browser contract.
 
-## Produce WebMCP tools
+## Automatic backend actions
+
+On an authenticated app page, `AppProviders` automatically registers eligible
+backend actions with `document.modelContext`. The tools are derived from the
+same action registry used by the in-app agent and execute through the same
+validated, authenticated server dispatcher. This includes agent-only actions
+declared with `http: false`; WebMCP does not turn those actions into public HTTP
+APIs.
+
+An action is eligible when `agentTool` is not `false` and `needsApproval` is
+not declared. The latter is a fail-closed boundary: the server action approval
+contract belongs to the agent loop and cannot be delegated to a browser hint.
+Public paths, signed-out pages, and `sessionBypass` surfaces do not register
+backend action tools. Browsers without `document.modelContext` simply keep the
+normal app behavior.
+
+No per-app WebMCP list or new `defineAction` metadata is required. Change the
+existing action definition when its exposure should change.
+
+## Explicit page-local actions
 
 Register only the actions that should be available to a page agent. The
 framework removes the action's local `run` function from the descriptor and
@@ -181,10 +199,10 @@ remote or headless tool calls, and use A2A when another app's agent should
 receive work and reason over it. WebMCP is an opt-in browser bridge, not a
 replacement for either network protocol.
 
-The framework does not auto-register every backend action as a WebMCP tool.
-Choose a small explicit producer list, keep side effects behind approval, and
-retain normal MCP or A2A exposure for capabilities that must work without an
-open browser page.
+The framework automatically projects eligible backend actions and still lets a
+page register explicit client-only capabilities. Keep server-side approval
+actions on the agent loop, and retain normal MCP or A2A exposure for
+capabilities that must work without an open browser page.
 
 ## Compatibility and safety
 
@@ -195,7 +213,8 @@ open browser page.
 - Treat descriptions, schemas, annotations, and results as page-provided
   data. The framework validates and bounds them, but agents should still treat
   `untrustedContentHint` results as untrusted content.
-- Use `stop()` when the owning page or component unmounts so stale tools do not
-  remain available.
+- Automatic registrations are aborted when the private app shell unmounts. Use
+  `stop()` for explicit page-local registrations so stale tools do not remain
+  available.
 - Keep server MCP and A2A endpoints for remote access. WebMCP only reaches the
   tools registered in a connected browser context.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.176.1",
+  "version": "0.177.0-nightly-20260828155142",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {