@agent-native/core 0.198.2 → 0.198.3-nightly-20260930154911

package/dist/mcp/org-choice.d.ts

@@ -0,0 +1,26 @@
+import type { H3Event } from "h3";
+export interface McpOrgOption {
+    id: string;
+    name: string;
+    domain: string | null;
+}
+export interface McpOrgChoices {
+    organizations: McpOrgOption[];
+    defaultOrganizationId: string | undefined;
+}
+/**
+ * The organizations an MCP connection (OAuth consent or device approval) can
+ * be bound to, and the one to preselect. For an account with no memberships,
+ * this resolves (and may create) its domain or default org the same way any
+ * other page load would, so the connection isn't scoped to no org for its
+ * whole life.
+ *
+ * `requestedOrganizationId`: `undefined` means no explicit pick (use the
+ * caller's stored/session org), `null` means the OAuth caller explicitly
+ * asked for personal scope, and a string is an explicit org pick to resolve
+ * membership for.
+ */
+export declare function resolveMcpOrgChoices(event: H3Event, session: {
+    email: string;
+    orgId?: string | null;
+}, requestedOrganizationId?: string | null): Promise<McpOrgChoices>;

package/dist/mcp/org-choice.js

@@ -0,0 +1,36 @@
+import { getActiveOrgSettingForEvent, getOrgContext, listOrgMembershipsForEvent, } from "../org/context.js";
+/**
+ * The organizations an MCP connection (OAuth consent or device approval) can
+ * be bound to, and the one to preselect. For an account with no memberships,
+ * this resolves (and may create) its domain or default org the same way any
+ * other page load would, so the connection isn't scoped to no org for its
+ * whole life.
+ *
+ * `requestedOrganizationId`: `undefined` means no explicit pick (use the
+ * caller's stored/session org), `null` means the OAuth caller explicitly
+ * asked for personal scope, and a string is an explicit org pick to resolve
+ * membership for.
+ */
+export async function resolveMcpOrgChoices(event, session, requestedOrganizationId) {
+    const activeOrgSetting = await getActiveOrgSettingForEvent(event, session.email);
+    let memberships = await listOrgMembershipsForEvent(event, session.email, requestedOrganizationId !== undefined
+        ? requestedOrganizationId
+        : (activeOrgSetting?.orgId ?? session.orgId ?? null));
+    // A token issued with no org stays org-less for its whole life, even after
+    // the app later creates the org, so resolve an account without one to its
+    // domain or default org before offering the choice.
+    const ensuredOrgId = memberships?.length === 0 ? (await getOrgContext(event)).orgId : null;
+    if (ensuredOrgId) {
+        memberships = await listOrgMembershipsForEvent(event, session.email, ensuredOrgId);
+    }
+    const organizations = memberships?.map((membership) => ({
+        id: membership.orgId,
+        name: membership.orgName,
+        domain: membership.allowedDomain,
+    })) ??
+        (session.orgId
+            ? [{ id: session.orgId, name: "Organization", domain: null }]
+            : []);
+    const defaultOrganizationId = [activeOrgSetting?.orgId, ensuredOrgId, session.orgId].find((id) => id && organizations.some((org) => org.id === id)) ?? organizations[0]?.id;
+    return { organizations, defaultOrganizationId };
+}

package/dist/notifications/routes.d.ts

@@ -16,6 +16,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/org/handlers.d.ts

@@ -73,8 +73,8 @@ export declare const setWorkspaceAppDefaultVisibilityHandler: import("h3").Event
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     success: boolean;
     name?: undefined;
-    role?: undefined;
     id?: undefined;
+    role?: undefined;
 } | {
     success?: undefined;
     id: string;

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -78,6 +78,7 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     message?: undefined;
     id?: undefined;
     deleted?: undefined;
+    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -89,7 +90,6 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     }[];
     count: number;
     provider?: undefined;
-    found?: undefined;
     registered?: undefined;
     label?: undefined;
 } | {
@@ -114,20 +114,20 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     label?: undefined;
 } | {
     message?: undefined;
+    found?: undefined;
     count?: undefined;
     providers?: undefined;
     provider?: undefined;
-    found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
 } | {
     deleted?: undefined;
+    found?: undefined;
     count?: undefined;
     providers?: undefined;
     provider?: undefined;
-    found?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -315,6 +315,7 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         deleted?: undefined;
         id?: undefined;
         message?: undefined;
+        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -325,15 +326,14 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
-        found?: undefined;
         registered?: undefined;
         label?: undefined;
     } | {
         deleted?: undefined;
         id?: undefined;
-        count?: undefined;
         message?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
@@ -341,19 +341,19 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
     } | {
         provider?: undefined;
         deleted?: undefined;
-        count?: undefined;
         message?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
     } | {
         provider?: undefined;
-        count?: undefined;
         message?: undefined;
-        providers?: undefined;
         found?: undefined;
+        providers?: undefined;
+        count?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
@@ -361,9 +361,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
     } | {
         provider?: undefined;
         deleted?: undefined;
-        count?: undefined;
-        providers?: undefined;
         found?: undefined;
+        providers?: undefined;
+        count?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/server/action-discovery.js

@@ -633,6 +633,11 @@ export async function mergeCoreSharingActions(registry) {
             "get-usage-metrics",
             () => import("../usage/actions/get-usage-metrics.js"),
         ],
+        [
+            "get-usage-insights",
+            () => import("../usage/actions/get-usage-insights.js"),
+        ],
+        ["get-usage-run", () => import("../usage/actions/get-usage-run.js")],
         [
             "get-builder-credit-usage",
             () => import("../usage/actions/get-builder-credit-usage.js"),

package/dist/server/agent-engine-default-model-route.d.ts

@@ -8,17 +8,17 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  * resolveEngine's credential detection.
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     scope?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     error: any;
     scope?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     scope: "org" | "user";
+    error?: undefined;
 }>>;
 export interface DefaultModelSelectionRequest {
     engine: string;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,9 +1,9 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     models?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     models: string[];
-    error?: undefined;
 }>>;

package/dist/server/core-routes-plugin.d.ts

@@ -581,8 +581,8 @@ export declare function createPublicRemoteAgentsHandler(discover?: PublicAgentDi
     error: string;
     agents?: undefined;
 } | {
-    agents: Omit<import("./agent-discovery.js").DiscoveredAgent, "auth" | "kind">[];
     error?: undefined;
+    agents: Omit<import("./agent-discovery.js").DiscoveredAgent, "auth" | "kind">[];
 }>>;
 export declare function getBuilderConnectErrorDisposition(error: unknown, connectAttemptId: string | null): "correlated" | "legacy" | null;
 export declare function getBuilderConnectErrorKey(ownerEmail: string, connectAttemptId?: string | null): string;

package/dist/server/credential-provider.js

@@ -126,6 +126,8 @@ const APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([
     "NOTION_CLIENT_ID",
     "NOTION_CLIENT_SECRET",
     "SLACK_BOT_TOKEN",
+    // Signs events from the deployed Slack app, not the integration owner's identity.
+    "SLACK_SIGNING_SECRET",
     "RESEND_API_KEY",
     "SENDGRID_API_KEY",
 ]);
@@ -1509,6 +1511,9 @@ export async function resolveSecretDetailed(key, options = {}) {
             lookupFailed = true;
             cause = err;
         }
+        if (lookupFailed && !isTrustedSelfHostedRuntime()) {
+            return { value: null, lookupFailed: true, cause };
+        }
         const envFallback = (isBuilderCredentialKey(key)
             ? canUseBuilderDeployCredentialFallbackForRequest()
             : canUseDeployCredentialFallbackForRequest(key))

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/usage/actions/get-usage-insights.d.ts

@@ -0,0 +1,7 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    sinceDays?: unknown;
+    scope?: "me" | "workspace";
+    userEmail?: string;
+    appId?: string;
+}, import("../insights-store.js").UsageInsights>;
+export default _default;

package/dist/usage/actions/get-usage-insights.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { getUsageInsights } from "../insights-store.js";
+import { resolveUsageAppKey } from "../store.js";
+export default defineAction({
+    description: "Get the Usage page's performance breakdown for an app: spend split by cache reads, cache writes, fresh input and output, savings versus no prompt caching, and recent prompts with per-run LLM calls, tool calls, tool lookups and cache misses.",
+    http: { method: "GET" },
+    schema: z.object({
+        sinceDays: z.coerce.number().int().min(1).max(365).default(30),
+        scope: z.enum(["me", "workspace"]).default("me"),
+        userEmail: z.string().trim().min(1).optional(),
+        appId: z.string().trim().max(200).optional(),
+    }),
+    run: async ({ sinceDays, scope, userEmail, appId }, ctx) => {
+        if (!ctx?.userEmail)
+            throw new Error("Not authenticated.");
+        return getUsageInsights({ sinceDays, scope, userEmail }, {
+            ownerEmail: ctx.userEmail,
+            orgId: ctx.orgId,
+            app: resolveUsageAppKey(appId),
+        });
+    },
+});

package/dist/usage/actions/get-usage-run.d.ts

@@ -0,0 +1,7 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    runId: string;
+    scope?: "me" | "workspace";
+    userEmail?: string;
+    appId?: string;
+}, import("../insights-store.js").UsageRunDetail>;
+export default _default;

package/dist/usage/actions/get-usage-run.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { getUsageRun } from "../insights-store.js";
+import { resolveUsageAppKey } from "../store.js";
+export default defineAction({
+    description: "Get one prompt's step-by-step cost breakdown for the Usage page: every LLM call with tokens, cache hit and cost, every tool call with status, cache misses with their likely cause, and automated eval scores.",
+    http: { method: "GET" },
+    schema: z.object({
+        runId: z.string().trim().min(1).max(200),
+        scope: z.enum(["me", "workspace"]).default("me"),
+        userEmail: z.string().trim().min(1).optional(),
+        appId: z.string().trim().max(200).optional(),
+    }),
+    run: async ({ runId, scope, userEmail, appId }, ctx) => {
+        if (!ctx?.userEmail)
+            throw new Error("Not authenticated.");
+        return getUsageRun({ runId, scope, userEmail }, {
+            ownerEmail: ctx.userEmail,
+            orgId: ctx.orgId,
+            app: resolveUsageAppKey(appId),
+        });
+    },
+});

package/dist/usage/insights-store.d.ts

@@ -0,0 +1,127 @@
+import { type UsageMetricsAccessInput, type UsageMetricsScope } from "./metrics-store.js";
+/** Run insights are always read for one app, never across all apps. */
+type RunAccessInput = UsageMetricsAccessInput & {
+    app: string;
+};
+/** Spend split by how the provider billed each token, in cents. */
+export interface UsageCostBreakdown {
+    cacheReadCents: number;
+    cacheWriteCents: number;
+    uncachedInputCents: number;
+    outputCents: number;
+    /** Recorded spend for the rows; the category splits above are token-priced estimates. */
+    totalCents: number;
+    /** The same tokens priced at list rates, so it is comparable to `noCacheCents`. */
+    estimatedCents: number;
+    /** What the same tokens would have cost with no prompt caching. */
+    noCacheCents: number;
+}
+export interface UsageTokenTotals {
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadTokens: number;
+    cacheWriteTokens: number;
+}
+export type UsageScoreSource = "heuristic" | "judge" | "human";
+export interface UsageRunScore {
+    source: UsageScoreSource;
+    criteria: string;
+    score: number;
+    reasoning: string | null;
+}
+export interface UsageRunTool {
+    name: string;
+    calls: number;
+    failed: number;
+    error: string | null;
+}
+/**
+ * The context was re-sent in full when the cache could have been re-used.
+ * `tool-lookup`: new tools were loaded; `prefix-changed`: something else at
+ * the start of the prompt changed.
+ */
+export type UsageRestartCause = "tool-lookup" | "prefix-changed";
+export interface UsageRunRestarts {
+    count: number;
+    cents: number;
+    byCause: Record<UsageRestartCause, {
+        count: number;
+        cents: number;
+    }>;
+}
+export interface UsageRunListItem {
+    runId: string;
+    threadId: string | null;
+    createdAt: number;
+    ownerEmail: string;
+    label: string;
+    model: string;
+    prompt: string | null;
+    /** `unknown` when the trace was never written or has been cleaned up. */
+    status: "success" | "error" | "unknown";
+    tokens: UsageTokenTotals;
+    cost: UsageCostBreakdown;
+    modelCalls: number;
+    tools: UsageRunTool[];
+    restarts: UsageRunRestarts;
+    /** Tool calls that overlapped another call in the same step, and the time that saved. */
+    parallel: {
+        calls: number;
+        savedMs: number;
+    };
+    /** Failed tool calls in a run that still finished. */
+    recoveredErrors: number;
+    durationMs: number | null;
+    feedback: "up" | "down" | null;
+}
+export interface UsagePeriodTotals {
+    runs: number;
+    tokens: UsageTokenTotals;
+    cost: UsageCostBreakdown;
+}
+export interface UsageInsights {
+    sinceDays: number;
+    current: UsagePeriodTotals;
+    previous: UsagePeriodTotals;
+    runs: UsageRunListItem[];
+}
+export interface UsageRunToolCall {
+    name: string;
+    startedAt: number;
+    durationMs: number;
+    status: string;
+    errorMessage: string | null;
+}
+/** One model call and the tools it asked for. */
+export interface UsageRunTurn {
+    index: number;
+    model: string;
+    durationMs: number;
+    tokens: UsageTokenTotals;
+    cost: UsageCostBreakdown;
+    status: string;
+    /** Set only when re-sending the context cost a meaningful amount. */
+    restart: {
+        cause: UsageRestartCause;
+        cents: number;
+    } | null;
+    /** The provider cache had expired after an idle gap; expected, not a fault. */
+    cacheExpired: boolean;
+    toolCalls: UsageRunToolCall[];
+}
+export interface UsageRunDetail extends UsageRunListItem {
+    reply: string | null;
+    turns: UsageRunTurn[];
+    scores: UsageRunScore[];
+}
+export declare function getUsageInsights(input: {
+    sinceDays?: number;
+    scope?: UsageMetricsScope;
+    userEmail?: string | null;
+}, accessInput: RunAccessInput): Promise<UsageInsights>;
+export declare function getUsageRun(input: {
+    runId: string;
+    scope?: UsageMetricsScope;
+    userEmail?: string | null;
+}, accessInput: RunAccessInput): Promise<UsageRunDetail | null>;
+export {};