@agent-native/core 0.198.3 → 0.198.5

package/dist/localization/icon-picker-messages.d.ts

@@ -4,7 +4,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -83,7 +85,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -162,7 +166,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -241,7 +247,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -320,7 +328,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -399,7 +409,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -478,7 +490,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -557,7 +571,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -636,7 +652,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -715,7 +733,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -794,7 +814,9 @@ export declare const ICON_PICKER_MESSAGES: {
         allCategories: string;
         loadError: string;
         saveError: string;
+        uploadFailed: string;
         uploadTooLarge: string;
+        uploadUnsupportedType: string;
         retry: string;
         uploadHint: string;
         colorNames: {
@@ -874,7 +896,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {
@@ -952,7 +976,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {
@@ -1030,7 +1056,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {
@@ -1108,7 +1136,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {
@@ -1186,7 +1216,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {
@@ -1264,7 +1296,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {
@@ -1342,7 +1376,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {
@@ -1420,7 +1456,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {
@@ -1498,7 +1536,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {
@@ -1576,7 +1616,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {
@@ -1654,7 +1696,9 @@ export declare function iconPickerMessagesForLocale(locale: LocaleCode): {
     allCategories: string;
     loadError: string;
     saveError: string;
+    uploadFailed: string;
     uploadTooLarge: string;
+    uploadUnsupportedType: string;
     retry: string;
     uploadHint: string;
     colorNames: {

package/dist/localization/icon-picker-messages.js

@@ -4,7 +4,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "All categories",
         loadError: "Could not load icons.",
         saveError: "Could not save icon.",
+        uploadFailed: "Could not upload icon image. Try again.",
         uploadTooLarge: "Icon image must be 5 MiB or smaller.",
+        uploadUnsupportedType: "Only PNG, JPEG, WebP, or SVG images can be uploaded.",
         retry: "Try again",
         uploadHint: "PNG, JPG, WebP, SVG",
         colorNames: {
@@ -83,7 +85,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "Todas las categorías",
         loadError: "No se pudieron cargar los iconos.",
         saveError: "No se pudo guardar el icono.",
+        uploadFailed: "No se pudo subir la imagen del icono. Inténtalo de nuevo.",
         uploadTooLarge: "La imagen del icono debe ser de 5 MiB o menos.",
+        uploadUnsupportedType: "Solo se pueden subir imágenes PNG, JPEG, WebP o SVG.",
         retry: "Reintentar",
         uploadHint: "PNG, JPG, WebP, SVG",
         colorNames: {
@@ -162,7 +166,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "Toutes les catégories",
         loadError: "Impossible de charger les icônes.",
         saveError: "Impossible d’enregistrer l’icône.",
+        uploadFailed: "Impossible d’importer l’image de l’icône. Réessayez.",
         uploadTooLarge: "L’image de l’icône ne doit pas dépasser 5 MiB.",
+        uploadUnsupportedType: "Seules les images PNG, JPEG, WebP ou SVG peuvent être importées.",
         retry: "Réessayer",
         uploadHint: "PNG, JPG, WebP, SVG",
         colorNames: {
@@ -241,7 +247,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "Alle Kategorien",
         loadError: "Symbole konnten nicht geladen werden.",
         saveError: "Symbol konnte nicht gespeichert werden.",
+        uploadFailed: "Das Icon-Bild konnte nicht hochgeladen werden. Versuche es erneut.",
         uploadTooLarge: "Das Icon-Bild darf höchstens 5 MiB groß sein.",
+        uploadUnsupportedType: "Nur PNG-, JPEG-, WebP- oder SVG-Bilder können hochgeladen werden.",
         retry: "Erneut versuchen",
         uploadHint: "PNG, JPG, WebP, SVG",
         colorNames: {
@@ -320,7 +328,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "Todas as categorias",
         loadError: "Não foi possível carregar os ícones.",
         saveError: "Não foi possível salvar o ícone.",
+        uploadFailed: "Não foi possível enviar a imagem do ícone. Tente novamente.",
         uploadTooLarge: "A imagem do ícone deve ter no máximo 5 MiB.",
+        uploadUnsupportedType: "Só é possível enviar imagens PNG, JPEG, WebP ou SVG.",
         retry: "Tentar novamente",
         uploadHint: "PNG, JPG, WebP, SVG",
         colorNames: {
@@ -399,7 +409,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "所有分类",
         loadError: "无法加载图标。",
         saveError: "无法保存图标。",
+        uploadFailed: "无法上传图标图片，请重试。",
         uploadTooLarge: "图标图片不能超过 5 MiB。",
+        uploadUnsupportedType: "只能上传 PNG、JPEG、WebP 或 SVG 图片。",
         retry: "重试",
         uploadHint: "PNG、JPG、WebP、SVG",
         colorNames: {
@@ -478,7 +490,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "所有分類",
         loadError: "無法載入圖示。",
         saveError: "無法儲存圖示。",
+        uploadFailed: "無法上傳圖示圖片，請再試一次。",
         uploadTooLarge: "圖示圖片不可超過 5 MiB。",
+        uploadUnsupportedType: "只能上傳 PNG、JPEG、WebP 或 SVG 圖片。",
         retry: "重試",
         uploadHint: "PNG、JPG、WebP、SVG",
         colorNames: {
@@ -557,7 +571,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "すべてのカテゴリー",
         loadError: "アイコンを読み込めませんでした。",
         saveError: "アイコンを保存できませんでした。",
+        uploadFailed: "アイコン画像をアップロードできませんでした。再試行してください。",
         uploadTooLarge: "アイコン画像は 5 MiB 以下にしてください。",
+        uploadUnsupportedType: "PNG、JPEG、WebP、SVG 形式の画像のみアップロードできます。",
         retry: "再試行",
         uploadHint: "PNG、JPG、WebP、SVG",
         colorNames: {
@@ -636,7 +652,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "모든 카테고리",
         loadError: "아이콘을 불러오지 못했습니다.",
         saveError: "아이콘을 저장하지 못했습니다.",
+        uploadFailed: "아이콘 이미지를 업로드하지 못했습니다. 다시 시도하세요.",
         uploadTooLarge: "아이콘 이미지는 5 MiB 이하여야 합니다.",
+        uploadUnsupportedType: "PNG, JPEG, WebP 또는 SVG 이미지만 업로드할 수 있습니다.",
         retry: "다시 시도",
         uploadHint: "PNG, JPG, WebP, SVG",
         colorNames: {
@@ -715,7 +733,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "सभी श्रेणियाँ",
         loadError: "आइकन लोड नहीं हो सके।",
         saveError: "आइकन सहेजा नहीं जा सका।",
+        uploadFailed: "आइकन चित्र अपलोड नहीं हो सका। फिर से प्रयास करें।",
         uploadTooLarge: "आइकन छवि 5 MiB या उससे छोटी होनी चाहिए।",
+        uploadUnsupportedType: "केवल PNG, JPEG, WebP या SVG चित्र अपलोड किए जा सकते हैं।",
         retry: "फिर से प्रयास करें",
         uploadHint: "PNG, JPG, WebP, SVG",
         colorNames: {
@@ -794,7 +814,9 @@ export const ICON_PICKER_MESSAGES = {
         allCategories: "جميع الفئات",
         loadError: "تعذر تحميل الأيقونات.",
         saveError: "تعذر حفظ الأيقونة.",
+        uploadFailed: "تعذر تحميل صورة الأيقونة. حاول مرة أخرى.",
         uploadTooLarge: "يجب ألا يتجاوز حجم صورة الأيقونة 5 MiB.",
+        uploadUnsupportedType: "يمكن تحميل صور PNG أو JPEG أو WebP أو SVG فقط.",
         retry: "إعادة المحاولة",
         uploadHint: "PNG, JPG, WebP, SVG",
         colorNames: {

package/dist/mcp-client/oauth-client.d.ts

@@ -23,6 +23,7 @@ export interface McpOAuthProviderOptions {
     serverUrl: string;
     redirectUrl: string;
     state: string;
+    tokenEndpointAuthMethod?: OAuthClientMetadata["token_endpoint_auth_method"];
     clientInformation?: StoredOAuthClientInformation;
     codeVerifier?: string;
     discoveryState?: McpOAuthDiscoveryState;

package/dist/mcp-client/oauth-client.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { auth, refreshAuthorization, validateAuthorizationResponseIssuer, } from "@modelcontextprotocol/client";
+import { auth, discoverOAuthServerInfo, refreshAuthorization, validateAuthorizationResponseIssuer, } from "@modelcontextprotocol/client";
 import { getAppConfig } from "../app-config/index.js";
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import { readOAuthCredentialState, resolveOAuthCredentialAccess, markOAuthReconnectRequired, revokeOAuthCredential, saveOAuthCredential, } from "../oauth-tokens/lifecycle.js";
@@ -375,6 +375,18 @@ function validateDiscoveryUrls(state) {
         }
     }
 }
+function dynamicClientAuthMethod(metadata) {
+    const methods = metadata?.token_endpoint_auth_methods_supported;
+    if (!Array.isArray(methods))
+        return "client_secret_basic";
+    if (methods.includes("none"))
+        return "none";
+    for (const method of ["client_secret_basic", "client_secret_post"]) {
+        if (methods.includes(method))
+            return method;
+    }
+    throw new Error("MCP OAuth server does not support a client authentication method this connector can register with.");
+}
 function issuerForDiscovery(discovery) {
     const issuer = discovery?.authorizationServerMetadata?.issuer;
     return typeof issuer === "string" && issuer ? issuer : undefined;
@@ -458,7 +470,7 @@ export class McpOAuthClientProvider {
         this.metadata = {
             ...brandedOAuthClientMetadata(),
             redirect_uris: [options.redirectUrl],
-            token_endpoint_auth_method: "none",
+            token_endpoint_auth_method: options.tokenEndpointAuthMethod ?? "none",
             grant_types: ["authorization_code", "refresh_token"],
             response_types: ["code"],
             application_type: applicationTypeForRedirect(options.redirectUrl),
@@ -609,11 +621,37 @@ export async function startMcpOAuthAuthorization(options) {
     if (googleScopes) {
         return startGoogleMcpOAuthAuthorization({ ...options, serverUrl: serverUrl.toString() }, googleScopes);
     }
-    if (!options.clientInformation && options.discoveryState) {
-        assertRegisterableClient(options.discoveryState, undefined);
+    const resourceMetadataUrl = options.resourceMetadataUrl
+        ? checkedRemoteUrl(options.resourceMetadataUrl, "resource metadata").href
+        : undefined;
+    const discoveredState = !options.clientInformation && !options.discoveryState
+        ? await discoverOAuthServerInfo(serverUrl, {
+            fetchFn: guardedOAuthFetch(),
+            ...(resourceMetadataUrl
+                ? { resourceMetadataUrl: new URL(resourceMetadataUrl) }
+                : {}),
+        })
+        : undefined;
+    const discoveryState = options.discoveryState ??
+        (discoveredState
+            ? {
+                ...discoveredState,
+                ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}),
+            }
+            : undefined);
+    if (discoveryState)
+        validateDiscoveryUrls(discoveryState);
+    if (!options.clientInformation && discoveryState) {
+        assertRegisterableClient(discoveryState, undefined);
     }
     const provider = new McpOAuthClientProvider({
         ...options,
+        ...(discoveryState ? { discoveryState } : {}),
+        ...(!options.clientInformation
+            ? {
+                tokenEndpointAuthMethod: dynamicClientAuthMethod(discoveryState?.authorizationServerMetadata),
+            }
+            : {}),
         ...(options.clientInformation
             ? {}
             : { onDiscoveryState: assertRegisterableClient }),

package/dist/mcp-client/oauth-routes.js

@@ -38,6 +38,7 @@ const MCP_WORKSPACE_STATE_PROVIDER = "mcp";
 const MANAGED_MCP_OAUTH_CLIENTS = [
     {
         serverOrigins: ["https://mcp.hubspot.com"],
+        requireClientCredentials: true,
         credentialPairs: [
             ["HUBSPOT_MCP_CLIENT_ID", "HUBSPOT_MCP_CLIENT_SECRET"],
             ["HUBSPOT_INTEGRATION_CLIENT_ID", "HUBSPOT_INTEGRATION_CLIENT_SECRET"],
@@ -55,12 +56,19 @@ const MANAGED_MCP_OAUTH_CLIENTS = [
             "https://chatmcp.googleapis.com",
             "https://people.googleapis.com",
         ],
+        requireClientCredentials: true,
         credentialPairs: [["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]],
     },
     {
         serverOrigins: ["https://workspacemcp.googleapis.com"],
+        requireClientCredentials: true,
         credentialPairs: [["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]],
     },
+    {
+        serverOrigins: ["https://mcp.gong.io"],
+        allowOrganizationScope: true,
+        credentialPairs: [["GONG_MCP_CLIENT_ID", "GONG_MCP_CLIENT_SECRET"]],
+    },
 ];
 export function resolveMcpOAuthReturnPath(connected, flow) {
     if (!connected)
@@ -216,7 +224,8 @@ async function handleMcpOAuthStart(event) {
     try {
         const started = await runWithRequestContext(requestContext, async () => {
             const clientInformation = await resolveManagedMcpOAuthClient(urlCheck.url);
-            if (isManagedMcpOAuthServer(urlCheck.url) && !clientInformation) {
+            if (managedMcpOAuthClientFor(urlCheck.url)?.requireClientCredentials &&
+                !clientInformation) {
                 return null;
             }
             const storedCredentials = reconnectServer?.oauthSecretKey && reconnectScopeId
@@ -347,7 +356,11 @@ export function wantsHtmlResponse(event) {
     return (getRequestHeader(event, "accept") ?? "").includes("text/html");
 }
 function isManagedMcpOAuthServer(serverUrl) {
-    return MANAGED_MCP_OAUTH_CLIENTS.some((client) => client.serverOrigins.includes(serverUrl.origin));
+    const client = managedMcpOAuthClientFor(serverUrl);
+    return Boolean(client && !client.allowOrganizationScope);
+}
+function managedMcpOAuthClientFor(serverUrl) {
+    return MANAGED_MCP_OAUTH_CLIENTS.find((client) => client.serverOrigins.includes(serverUrl.origin));
 }
 export function resolveMcpOAuthScope(serverUrl, requestedScope, options) {
     if (isBuilderPublishMcpServer(serverUrl)) {

package/dist/notifications/routes.d.ts

@@ -16,6 +16,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -27,38 +27,38 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    id?: undefined;
+    ok?: undefined;
     error: string;
     message: string;
     summary?: undefined;
     spans?: undefined;
+} | {
     id?: undefined;
+    error?: undefined;
     ok?: undefined;
-} | {
     message?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
-    id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    id?: undefined;
+    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
-    id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    id?: undefined;
+    error?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
-    id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/org/actions/list-workspace-icons.d.ts

@@ -0,0 +1,7 @@
+declare const _default: import("../../action.js").ActionDefinition<Record<string, never>, {
+    assets: {
+        id: string;
+        alt: string;
+    }[];
+}>;
+export default _default;

package/dist/org/actions/list-workspace-icons.js

@@ -0,0 +1,41 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { getDbExec } from "../../db/client.js";
+import { listIconAssets } from "../../icon-assets/index.js";
+import { listFederatedWorkspaceIconsForOwner } from "../../icon-assets/workspace-transport.js";
+import { requireOrgMember } from "../actions.js";
+export default defineAction({
+    description: "List private workspace icons uploaded by the current organization administrator.",
+    http: { method: "GET" },
+    readOnly: true,
+    schema: z.object({}),
+    run: async (_args, ctx) => {
+        const caller = await requireOrgMember(ctx, true);
+        const result = await getDbExec().execute({
+            sql: `SELECT identity_authority, identity_id, allowed_domain FROM organizations WHERE id = ? LIMIT 1`,
+            args: [caller.orgId],
+        });
+        const row = result.rows[0];
+        if (!row)
+            throw new Error("Organization not found.");
+        const authority = {
+            identityAuthority: typeof row.identity_authority === "string"
+                ? row.identity_authority
+                : null,
+            identityId: typeof row.identity_id === "string" ? row.identity_id : null,
+            allowedDomain: typeof row.allowed_domain === "string" ? row.allowed_domain : null,
+        };
+        if (Boolean(authority.identityAuthority) !== Boolean(authority.identityId)) {
+            throw new Error("Workspace identity mapping is incomplete.");
+        }
+        const assets = authority.identityAuthority
+            ? await listFederatedWorkspaceIconsForOwner(authority, caller.email)
+            : await listIconAssets({ ownerEmail: caller.email, orgId: caller.orgId });
+        return {
+            assets: assets.map((asset) => ({
+                id: asset.id,
+                alt: asset.filename?.replace(/\.[^./\\]+$/, "") || undefined,
+            })),
+        };
+    },
+});

package/dist/org/handlers.d.ts

@@ -72,9 +72,9 @@ export declare const setWorkspaceAppDefaultVisibilityHandler: import("h3").Event
 }>>;
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     success: boolean;
-    id?: undefined;
     name?: undefined;
     role?: undefined;
+    id?: undefined;
 } | {
     success?: undefined;
     id: string;

package/dist/org/handlers.js

@@ -28,6 +28,7 @@ import { CORE_INVITE_EMAIL_ID } from "../email-catalog/system-emails.js";
 import { renderTransactionalEmail } from "../email-catalog/templates.js";
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import { evaluateFeatureFlagStrict } from "../feature-flags/store.js";
+import { verifyFederatedWorkspaceIconOwner } from "../icon-assets/workspace-transport.js";
 import { offboardMember } from "../identity/offboard.js";
 import { getAppProductionUrl } from "../server/app-url.js";
 import { isTrustedSelfHostedRuntime, resolveVercelDeploymentProtectionHeaders, } from "../server/credential-provider.js";
@@ -46,6 +47,7 @@ import { CROSS_APP_ORG_FEDERATION_FLAG } from "./feature-flags.js";
 import { FederatedIconConflictError, addFederatedOrganizationMember, updateFederatedOrganizationMemberRole, revokeFederatedOrganizationMember, syncOrganizationToIdentityHub, } from "./federation.js";
 import { isFreeEmailProvider } from "./free-email-providers.js";
 import { canManageOrgA2ASecret, canManageOrgDomain } from "./permissions.js";
+import { assertOwnedLocalWorkspaceIcon, requirePrivateWorkspaceIconId, } from "./private-icon-handlers.js";
 import { invalidateMemberOrgCaches } from "./request-org-cache.js";
 import { isBootstrapAdmin } from "./signup-admission.js";
 import { registerBackgroundWork, trackInviteAccepted, } from "./track-invite-accepted.js";
@@ -1119,7 +1121,7 @@ export const setOrgVisualIdentityHandler = defineEventHandler(async (event) => {
     }
     const e = await exec();
     const currentResult = await e.execute({
-        sql: `SELECT name, icon_revision, identity_authority, identity_id
+        sql: `SELECT name, icon_revision, identity_authority, identity_id, allowed_domain
             FROM organizations WHERE id = ? LIMIT 1`,
         args: [ctx.orgId],
     });
@@ -1130,6 +1132,31 @@ export const setOrgVisualIdentityHandler = defineEventHandler(async (event) => {
     const iconRevision = Number(current.icon_revision ?? 0) + 1;
     const isFederated = Boolean(String(current.identity_authority ?? "").trim() ||
         String(current.identity_id ?? "").trim());
+    if (icon?.kind === "image") {
+        if (icon.authority !== "private-icon") {
+            throw createError({
+                statusCode: 400,
+                message: "Workspace images must use private icon storage",
+            });
+        }
+        requirePrivateWorkspaceIconId(icon.assetId);
+        if (isFederated) {
+            const owned = await verifyFederatedWorkspaceIconOwner(event, {
+                identityAuthority: String(current.identity_authority ?? "") || null,
+                identityId: String(current.identity_id ?? "") || null,
+                allowedDomain: String(current.allowed_domain ?? "") || null,
+            }, ctx.email, icon.assetId);
+            if (!owned) {
+                throw createError({
+                    statusCode: 403,
+                    message: "Workspace icon asset is not owned by this organization administrator",
+                });
+            }
+        }
+        else {
+            await assertOwnedLocalWorkspaceIcon(icon.assetId, ctx.email, ctx.orgId);
+        }
+    }
     const updated = await e.execute({
         sql: `UPDATE organizations
             SET icon_json = ?, icon_revision = ?

package/dist/org/index.d.ts

@@ -179,8 +179,8 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     name?: undefined;
     success: boolean;
-    id?: undefined;
     role?: undefined;
+    id?: undefined;
 } | {
     success?: undefined;
     id: string;

package/dist/org/migrations.js

@@ -263,4 +263,25 @@ export const ORG_MIGRATIONS = [
       ALTER TABLE organizations ADD COLUMN IF NOT EXISTS icon_revision BIGINT NOT NULL DEFAULT 0;
     `,
     },
+    {
+        version: 1034,
+        name: "private-icon-assets",
+        sql: `
+      CREATE TABLE IF NOT EXISTS private_icon_assets (
+        id TEXT PRIMARY KEY,
+        owner_email TEXT NOT NULL,
+        org_id TEXT,
+        mime_type TEXT NOT NULL,
+        filename TEXT,
+        alt TEXT,
+        size BIGINT NOT NULL,
+        sha256 TEXT NOT NULL,
+        blob_handle_json TEXT NOT NULL,
+        created_at BIGINT NOT NULL,
+        updated_at BIGINT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS private_icon_assets_owner_org_created_idx
+        ON private_icon_assets (owner_email, org_id, created_at);
+    `,
+    },
 ];