@agent-native/core 0.204.0-nightly-20261008011018 → 0.204.0

package/dist/scripts/parse-args.js

@@ -23,6 +23,82 @@ export function parseArgs(args) {
     }
     return result;
 }
+export function serializeCliArgs(args) {
+    return Object.entries(args).flatMap(([key, raw]) => {
+        const value = raw != null && typeof raw === "object"
+            ? JSON.stringify(raw)
+            : String(raw);
+        return value.startsWith("--") ? [`--${key}=${value}`] : [`--${key}`, value];
+    });
+}
+export function normalizeShellArgs(input, options = {}) {
+    const tokens = [];
+    let current = "";
+    let inDouble = false;
+    let inSingle = false;
+    let wasQuoted = false;
+    let escape = false;
+    const pushToken = () => {
+        tokens.push({ value: current, quoted: wasQuoted });
+        current = "";
+        wasQuoted = false;
+    };
+    for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (escape) {
+            current += ch;
+            escape = false;
+            continue;
+        }
+        if (options.backslashEscapes && ch === "\\") {
+            if (inSingle) {
+                current += ch;
+            }
+            else {
+                escape = true;
+            }
+            continue;
+        }
+        if (ch === "'" && !inDouble) {
+            inSingle = !inSingle;
+            wasQuoted = true;
+            continue;
+        }
+        if (ch === '"' && !inSingle) {
+            inDouble = !inDouble;
+            wasQuoted = true;
+            continue;
+        }
+        if ((options.splitAllWhitespace
+            ? /\s/.test(ch)
+            : ch === " " || ch === "\t") &&
+            !inSingle &&
+            !inDouble) {
+            if (current.length > 0 || wasQuoted)
+                pushToken();
+            continue;
+        }
+        current += ch;
+    }
+    if (current.length > 0 || wasQuoted)
+        pushToken();
+    const normalized = [];
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        const next = tokens[i + 1];
+        if (token.value.startsWith("--") &&
+            !token.value.includes("=") &&
+            next?.quoted &&
+            next.value.startsWith("--")) {
+            normalized.push(`${token.value}=${next.value}`);
+            i++;
+        }
+        else {
+            normalized.push(token.value);
+        }
+    }
+    return normalized;
+}
 export function camelCaseArgs(args) {
     const result = {};
     for (const [key, value] of Object.entries(args)) {

package/dist/scripts/utils.d.ts

@@ -1,6 +1,6 @@
 export { findWorkspaceRoot } from "./workspace-root.js";
 export { fail, type FailOptions } from "../action.js";
-export { parseArgs, camelCaseArgs } from "./parse-args.js";
+export { parseArgs, serializeCliArgs, camelCaseArgs } from "./parse-args.js";
 export declare function loadEnv(envPath?: string): void;
 export declare function isValidPath(p: string): boolean;
 export declare function isValidProjectPath(project: string): boolean;

package/dist/scripts/utils.js

@@ -4,7 +4,7 @@ import dotenv from "dotenv";
 import { findWorkspaceRoot } from "./workspace-root.js";
 export { findWorkspaceRoot } from "./workspace-root.js";
 export { fail } from "../action.js";
-export { parseArgs, camelCaseArgs } from "./parse-args.js";
+export { parseArgs, serializeCliArgs, camelCaseArgs } from "./parse-args.js";
 export function loadEnv(envPath) {
     const appEnv = envPath ?? path.join(process.cwd(), ".env");
     const shellKeys = new Set(Object.keys(process.env));

package/dist/secrets/routes.d.ts

@@ -58,47 +58,47 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     error: string;
     errorCode?: undefined;
     retryable?: undefined;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable?: undefined;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable: boolean;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     errorCode?: undefined;
     retryable?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -126,11 +126,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/action-discovery.js

@@ -1,6 +1,7 @@
 import nodePath from "node:path";
 import "../authorization/check-action.js";
 import { CORE_ACTION_GROUPS } from "../framework-tools.js";
+import { normalizeShellArgs, serializeCliArgs } from "../scripts/parse-args.js";
 import { captureCliOutput } from "./cli-capture.js";
 let _fs;
 async function getFs() {
@@ -54,39 +55,6 @@ export function mergePackageActions(registry) {
         registry[name] = entry;
     }
 }
-function splitShellArgs(input) {
-    const tokens = [];
-    let current = "";
-    let inDouble = false;
-    let inSingle = false;
-    let wasQuoted = false;
-    for (let i = 0; i < input.length; i++) {
-        const ch = input[i];
-        if (ch === '"' && !inSingle) {
-            inDouble = !inDouble;
-            wasQuoted = true;
-            continue;
-        }
-        if (ch === "'" && !inDouble) {
-            inSingle = !inSingle;
-            wasQuoted = true;
-            continue;
-        }
-        if ((ch === " " || ch === "\t") && !inDouble && !inSingle) {
-            if (current.length > 0 || wasQuoted) {
-                tokens.push(current);
-            }
-            current = "";
-            wasQuoted = false;
-            continue;
-        }
-        current += ch;
-    }
-    if (current.length > 0 || wasQuoted) {
-        tokens.push(current);
-    }
-    return tokens;
-}
 function wrapDefaultExport(name, defaultFn) {
     const tool = {
         description: `Run the "${name}" action. Pass arguments as key-value pairs.`,
@@ -103,15 +71,9 @@ function wrapDefaultExport(name, defaultFn) {
     return {
         tool,
         run: async (args) => {
-            const cliArgs = [];
-            if (args.args && Object.keys(args).length === 1) {
-                cliArgs.push(...splitShellArgs(args.args));
-            }
-            else {
-                for (const [k, v] of Object.entries(args)) {
-                    cliArgs.push(`--${k}`, v);
-                }
-            }
+            const cliArgs = args.args && Object.keys(args).length === 1
+                ? normalizeShellArgs(args.args)
+                : serializeCliArgs(args);
             return captureCliOutput(() => defaultFn(cliArgs));
         },
     };

package/dist/server/agent-chat/script-entries.js

@@ -1,5 +1,6 @@
 import { renameThread, resolveThreadAccess, setThreadArchived, setThreadPinned, } from "../../chat-threads/store.js";
 import { dbExecToolParameters } from "../../scripts/db/tool-schemas.js";
+import { serializeCliArgs } from "../../scripts/parse-args.js";
 import { captureCliOutput } from "../cli-capture.js";
 import { getAmbientUserEmail, getRequestOrgId, getRequestRunContext, getRequestUserEmail, } from "../request-context.js";
 function wrapCliScript(tool, cliDefault, opts) {
@@ -7,18 +8,12 @@ function wrapCliScript(tool, cliDefault, opts) {
         tool,
         ...(opts?.readOnly ? { readOnly: true } : {}),
         run: async (args) => {
-            const cliArgs = [];
-            for (const [k, v] of Object.entries(args)) {
+            for (const k of Object.keys(args)) {
                 if (opts?.allowedArgs && !opts.allowedArgs.includes(k)) {
                     throw new Error(`Unknown argument: ${k}`);
                 }
-                const raw = v;
-                const value = raw != null && typeof raw === "object"
-                    ? JSON.stringify(raw)
-                    : String(raw);
-                cliArgs.push(`--${k}`, value);
             }
-            return captureCliOutput(() => cliDefault(cliArgs));
+            return captureCliOutput(() => cliDefault(serializeCliArgs(args)));
         },
     };
 }

package/dist/server/agent-chat-plugin.js

@@ -46,6 +46,7 @@ import { setProgressPreListHook } from "../progress/store.js";
 import { getSkillNameFromPath } from "../resources/metadata.js";
 import { resourceList, resourceListAccessible, resourceGet, ensurePersonalDefaults, isWorkspaceResourceOwner, SHARED_OWNER, WORKSPACE_OWNER, } from "../resources/store.js";
 import { normalizeDatabaseToolsMode } from "../scripts/db/tool-mode.js";
+import { normalizeShellArgs, serializeCliArgs } from "../scripts/parse-args.js";
 import { getSetting, putSetting } from "../settings/store.js";
 import { retryContextFromRequest, } from "../shared/agent-chat-run-not-started.js";
 import { ANALYTICS_CLIENT_PLATFORM_BODY_FIELD, normalizeAnalyticsClientPlatform, } from "../shared/analytics-platform.js";
@@ -1043,54 +1044,19 @@ export function createAgentChatPlugin(options) {
                                     }
                                     const tokens = [];
                                     if (typeof input?.args === "string" && input.args.trim()) {
-                                        let current = "";
-                                        let inSingle = false;
-                                        let inDouble = false;
-                                        let escape = false;
-                                        for (let i = 0; i < input.args.length; i++) {
-                                            const char = input.args[i];
-                                            if (escape) {
-                                                current += char;
-                                                escape = false;
-                                                continue;
-                                            }
-                                            if (char === "\\") {
-                                                if (inSingle) {
-                                                    current += char;
-                                                }
-                                                else {
-                                                    escape = true;
-                                                }
-                                                continue;
-                                            }
-                                            if (char === "'" && !inDouble) {
-                                                inSingle = !inSingle;
-                                                continue;
-                                            }
-                                            if (char === '"' && !inSingle) {
-                                                inDouble = !inDouble;
-                                                continue;
-                                            }
-                                            if (/\s/.test(char) && !inSingle && !inDouble) {
-                                                if (current.length > 0) {
-                                                    tokens.push(current);
-                                                    current = "";
-                                                }
-                                                continue;
-                                            }
-                                            current += char;
-                                        }
-                                        if (current.length > 0) {
-                                            tokens.push(current);
-                                        }
+                                        tokens.push(...normalizeShellArgs(input.args, {
+                                            backslashEscapes: true,
+                                            splitAllWhitespace: true,
+                                        }));
                                     }
                                     else if (input && typeof input === "object") {
+                                        const actionArgs = {};
                                         for (const [k, v] of Object.entries(input)) {
                                             if (k === "args" || v === undefined || v === null)
                                                 continue;
-                                            const strVal = typeof v === "object" ? JSON.stringify(v) : String(v);
-                                            tokens.push(`--${k}`, strVal);
+                                            actionArgs[k] = v;
                                         }
+                                        tokens.push(...serializeCliArgs(actionArgs));
                                     }
                                     const BLOCKED_OPERATORS = new Set([
                                         ";",

package/dist/server/agent-engine-default-model-route.d.ts

@@ -8,17 +8,17 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  * resolveEngine's credential detection.
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     scope?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     error: any;
     scope?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     scope: "org" | "user";
+    error?: undefined;
 }>>;
 export interface DefaultModelSelectionRequest {
     engine: string;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,6 +1,6 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
     models?: undefined;
 } | {
     error?: undefined;

package/dist/server/auth.js

@@ -85,6 +85,7 @@ import * as loopback from "./loopback.js";
 import { encodeMagicLinkSignupAttribution, MAGIC_LINK_ATTRIBUTION_PARAM, } from "./magic-link-attribution.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { getDeploySettingsRequiredHtml, getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
+import { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 import { getRequestContext, markRequestIdentityAuthenticatedAtMs, hasContinuationLocalRequestContext, hasExplicitPersonalOrgScope, markExplicitPersonalOrgScope, runWithRequestContext, } from "./request-context.js";
 import { captureAuthError } from "./sentry.js";
 import { isTestIdentity } from "./test-identity.js";
@@ -4901,7 +4902,9 @@ async function mountBetterAuthRoutes(app, options) {
             response.status < 300) {
             setFirstRunOnboardingCookie(event);
         }
-        return response;
+        return isResponse
+            ? queryEchoSafeRedirect(event, response)
+            : response;
     }));
     app.use("/_agent-native/auth/login", defineEventHandler(async (event) => {
         if (getMethod(event) !== "POST") {
@@ -4968,7 +4971,7 @@ async function mountBetterAuthRoutes(app, options) {
             ? query.return[0]
             : query.return;
         setFirstRunOnboardingCookie(event);
-        return redirectWithStagedCookies(event, safeReturnPath(rawReturn), 302);
+        return queryEchoSafeRedirect(event, redirectWithStagedCookies(event, safeReturnPath(rawReturn), 302));
     }));
     app.use("/_agent-native/auth/magic-link", defineEventHandler(async (event) => {
         if (getMethod(event) === "POST" &&

package/dist/server/google-oauth.js

@@ -14,6 +14,7 @@ import { setIdentityGoogleAuthCookie } from "./identity-auth-provider.js";
 import { isNetlifyDeployPermalinkGoogleOAuthClientOrigin, isNetlifyDeployPermalinkGoogleOAuthClientRequest, } from "./identity-sso-store.js";
 import { appendSessionToOAuthReturnUrl } from "./oauth-return-url.js";
 import { EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS, firstOriginFromEnv, getConfiguredOriginAllowlist, isLoopbackHost, normalizeOrigin, WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS, } from "./origin-allowlist.js";
+import { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
 function safeReturnPath(raw) {
     return normalizeAppPath(raw) ?? "/";
@@ -669,9 +670,6 @@ export function oauthCallbackResponse(event, email, opts) {
       </script></body></html>`);
     }
     const location = appendSessionToOAuthReturnUrl(opts.returnUrl, opts.sessionToken);
-    setResponseStatus(event, 302);
-    setResponseHeader(event, "Location", location);
-    setResponseHeader(event, "Referrer-Policy", "no-referrer");
     const headers = new Headers({
         Location: location,
         "Referrer-Policy": "no-referrer",
@@ -679,7 +677,13 @@ export function oauthCallbackResponse(event, email, opts) {
     for (const cookie of event.res?.headers?.getSetCookie?.() ?? []) {
         headers.append("set-cookie", cookie);
     }
-    return new Response(null, { status: 302, headers });
+    const response = queryEchoSafeRedirect(event, new Response(null, { status: 302, headers }));
+    if (response.status === 302) {
+        setResponseStatus(event, 302);
+        setResponseHeader(event, "Location", location);
+    }
+    setResponseHeader(event, "Referrer-Policy", "no-referrer");
+    return response;
 }
 export function oauthErrorPage(message, status = 400) {
     const safe = escapeHtml(message);

package/dist/server/identity-sso.js

@@ -16,6 +16,7 @@ import { createOAuthSession, getAppUrl, getOrigin } from "./google-oauth.js";
 import { hasIdentityGoogleAuthCookie } from "./identity-auth-provider.js";
 import { IDENTITY_SSO_PROVIDER_ID } from "./identity-sso-provider.js";
 import { consumeSsoState, createSsoState, CANONICAL_IDENTITY_SSO_HUB_URL, NETLIFY_PREVIEW_IDENTITY_SSO_HUB_URL, getIdentityHubUrl, identitySsoLoginButtonHtml, isCanonicalIdentitySsoClientRequest, isDesktopSsoUserAgent, isIdentitySsoExplicitlyEnabled, isIdentitySsoEnabled, isNetlifyDeployPermalinkIdentitySsoClientRequest, isJtiReplayed, SSO_STATE_TTL_MS, } from "./identity-sso-store.js";
+import { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 import { getRequestContext, hasContinuationLocalRequestContext, runWithRequestContext, } from "./request-context.js";
 export { getIdentityHubUrl, identitySsoLoginButtonHtml, isIdentitySsoEnabled };
 export { IDENTITY_SSO_PROVIDER_ID };
@@ -63,7 +64,7 @@ function redirect(event, location) {
     const staged = event.res?.headers?.getSetCookie?.() ?? [];
     for (const cookie of staged)
         headers.append("set-cookie", cookie);
-    return new Response("", { status: 302, headers });
+    return queryEchoSafeRedirect(event, new Response("", { status: 302, headers }));
 }
 function errorPage(message, loginPath) {
     const safe = message

package/dist/server/index.d.ts

@@ -86,6 +86,7 @@ export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/
 export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, uploadFile, builderFileUploadProvider, type FileUploadInput, type FileUploadProvider, type FileUploadResult, } from "../file-upload/index.js";
 export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, slackAdapter, telegramAdapter, whatsappAdapter, discordAdapter, microsoftTeamsAdapter, emailAdapter, assertPlatformCapability, type PlatformAdapter, type IncomingMessage, type OutgoingMessage, type PlatformAdapterCapabilities, type ImmediateWebhookResponse, type IntegrationStatus, type IntegrationsPluginOptions, type IntegrationExecutionContext, BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, type BuiltInChannelId, type ChannelCapabilities, type IntegrationAvailability, type IntegrationCatalogEntry, type IntegrationCategory, type IntegrationCredentialRequirement, type IntegrationIconKey, type IntegrationSupportMaturity, } from "../integrations/index.js";
 export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, encodeOAuthState, decodeOAuthState, encodeNetlifyPreviewGoogleOAuthRelayState, decodeNetlifyPreviewGoogleOAuthRelayState, wrapNetlifyPreviewGoogleOAuthState, getNetlifyPreviewGoogleOAuthCallbackUrl, isNetlifyPreviewGoogleOAuthCallbackUrl, isNetlifyPreviewGoogleOAuthRelayState, AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET_ENV, NETLIFY_PREVIEW_GOOGLE_OAUTH_CALLBACK_URL, logOAuthStateDecodeFailure, resolveOAuthOwner, createOAuthSession, oauthCallbackResponse, oauthErrorPage, oauthDesktopExchangePage, type OAuthStatePayload, type OAuthStateDecodeFailureReason, type DecodeOAuthStateResult, type OAuthOwnerResult, type OAuthSessionResult, } from "./google-oauth.js";
+export { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, hasWorkspaceProviderOAuthCredentials, isGoogleWorkspaceOAuthProvider, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, type GenericWorkspaceOAuthProvider, type WorkspaceProviderOAuthFlow, } from "./workspace-provider-oauth.js";
 export { CredentialStoreUnavailableError, FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderEmbeddingsBaseUrl, getBuilderVideoGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderGatewayCredentialsDetailed, resolveBuilderGatewayAuth, resolveBuilderGatewayCredentials, resolveHasBuilderGatewayCredential, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, resolveVercelDeploymentProtectionHeaders, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, resolveSecretDetailed, prefetchSecrets, BuilderCredentialLookupError, type BuilderCredentialsDetailed, type ResolvedSecretDetail, } from "./credential-provider.js";
 export { GEMINI_API_KEY, LEGACY_GEMINI_API_KEY, canonicalSecretKey, readGeminiDeployCredentialEnv, resolveGeminiApiKey, resolveGeminiApiKeyDetailed, resolveSecretWithAliases, resolveSecretWithAliasesDetailed, secretKeyNames, type ResolvedAliasedSecret, } from "./secret-key-aliases.js";

package/dist/server/index.js

@@ -81,6 +81,7 @@ export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/
 export { registerFileUploadProvider, unregisterFileUploadProvider, listFileUploadProviders, getActiveFileUploadProvider, getActiveFileUploadProviderForRequest, uploadFile, builderFileUploadProvider, } from "../file-upload/index.js";
 export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, slackAdapter, telegramAdapter, whatsappAdapter, discordAdapter, microsoftTeamsAdapter, emailAdapter, assertPlatformCapability, BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, } from "../integrations/index.js";
 export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, encodeOAuthState, decodeOAuthState, encodeNetlifyPreviewGoogleOAuthRelayState, decodeNetlifyPreviewGoogleOAuthRelayState, wrapNetlifyPreviewGoogleOAuthState, getNetlifyPreviewGoogleOAuthCallbackUrl, isNetlifyPreviewGoogleOAuthCallbackUrl, isNetlifyPreviewGoogleOAuthRelayState, AGENT_NATIVE_GOOGLE_OAUTH_RELAY_SECRET_ENV, NETLIFY_PREVIEW_GOOGLE_OAUTH_CALLBACK_URL, logOAuthStateDecodeFailure, resolveOAuthOwner, createOAuthSession, oauthCallbackResponse, oauthErrorPage, oauthDesktopExchangePage, } from "./google-oauth.js";
+export { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
 export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, hasWorkspaceProviderOAuthCredentials, isGoogleWorkspaceOAuthProvider, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, } from "./workspace-provider-oauth.js";
 export { CredentialStoreUnavailableError, FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderEmbeddingsBaseUrl, getBuilderVideoGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderGatewayCredentialsDetailed, resolveBuilderGatewayAuth, resolveBuilderGatewayCredentials, resolveHasBuilderGatewayCredential, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, resolveVercelDeploymentProtectionHeaders, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, resolveSecretDetailed, prefetchSecrets, BuilderCredentialLookupError, } from "./credential-provider.js";
 export { GEMINI_API_KEY, LEGACY_GEMINI_API_KEY, canonicalSecretKey, readGeminiDeployCredentialEnv, resolveGeminiApiKey, resolveGeminiApiKeyDetailed, resolveSecretWithAliases, resolveSecretWithAliasesDetailed, secretKeyNames, } from "./secret-key-aliases.js";

package/dist/server/poll.d.ts

@@ -86,6 +86,10 @@ export declare class AppSyncState {
     private accessCacheTtl;
     private durableEventId;
     getVersion(): number;
+    getPollBaseline(useDurableEvents: boolean): Promise<{
+        version: number;
+        cursor: string;
+    }>;
     getPollEmitter(): EventEmitter;
     wireLocalEmitters(): void;
     ensureSyncEventsTable(): Promise<boolean>;
@@ -154,6 +158,7 @@ export declare class AppSyncState {
     getChangesSinceForUser(since: number, userEmail: string, orgId: string | undefined, cursor?: SyncCursor): ChangeReadResult;
     getDurableChangesSinceForUser(since: number, userEmail: string, orgId: string | undefined, cursor?: SyncCursor): Promise<ChangeReadResult>;
     getCombinedChangesSinceForUser(since: number, userEmail: string, orgId: string | undefined, useDurableEvents: boolean, cursor?: SyncCursor): Promise<ChangeReadResult>;
+    private readCombinedChangesSinceForUser;
     seedVersionFromDb(): Promise<void>;
     checkExternalDbChanges(options: {
         durableEvents: boolean;
@@ -164,6 +169,10 @@ declare function hostedRealtimeTransportEnabled(): boolean;
 export declare const __hostedRealtimeTransportEnabledForTests: typeof hostedRealtimeTransportEnabled;
 export declare function getDefaultAppSyncState(): AppSyncState;
 export declare function getVersion(): number;
+export declare function getCurrentPollBaseline(state?: AppSyncState): Promise<{
+    version: number;
+    cursor: string;
+}>;
 export declare function getPollEmitter(): EventEmitter;
 export declare function invalidateCollabAccessCache(resourceType: string, resourceId: string): void;
 export declare function __resetCollabAccessCacheForTests(): void;