@agent-native/core 0.205.0 → 0.206.0-nightly-20261009011246

package/dist/client/sse-event-processor.js

@@ -504,17 +504,21 @@ async function readChunkWithProgressTimeout(reader, lastMeaningfulEventAt, noPro
 function isAutoRecoverableError(ev, errMsg) {
     const code = String(ev.errorCode ?? "").toLowerCase();
     const msg = errMsg.toLowerCase();
-    // An explicit `recoverable: false` outranks EVERY inference below — the code
-    // list as well as the message sniff — matching the server's own precedence in
-    // `isRecoverableContinuationError`. The repeat guards stop a turn with a
+    // Explicit terminal classifications outrank EVERY inference below — the
+    // code list as well as the message sniff — matching the server's precedence
+    // in `isRecoverableContinuationError`. The repeat guards stop a turn with a
     // message that names the looping tool, so a stop on
     // `list-workspace-connections` matched the "connection" sniff and
     // auto-continued the very loop it was emitted to break; the background
     // no-progress breaker stops one while PRESERVING the underlying transient
     // code (so the failure stays diagnosable), so reading the code instead of the
     // flag re-POSTs the exact chain the server just refused to continue.
-    if (ev.recoverable === false)
+    if (ev.providerRetryable === false || ev.recoverable === false)
         return false;
+    // A recoverable server timeout is a continuation boundary, even though its
+    // visitor-facing message sounds terminal.
+    if (code === "run_timeout" && ev.recoverable === true)
+        return true;
     // These messages can carry `recoverable: true` for banner rendering, but
     // repeating the request would retry the same rejected credential or a run
     // the user already stopped.
@@ -539,6 +543,7 @@ function isAutoRecoverableError(ev, errMsg) {
         code === "gateway_not_enabled" ||
         code === "missing_api_key" ||
         code === "missing_credentials" ||
+        code === "invalid_request" ||
         code === "invalid_request_error" ||
         code === "request_too_large" ||
         code === "not_found_error" ||
@@ -1619,8 +1624,7 @@ export function processEvent(ev, content, toolCallCounter, tabId, state, context
     }
     if (ev.type === "error") {
         const errMsg = ev.error ?? "Unknown error";
-        if ((ev.errorCode === "run_timeout" && ev.recoverable) ||
-            isAutoRecoverableError(ev, errMsg)) {
+        if (isAutoRecoverableError(ev, errMsg)) {
             const normalized = normalizeChatError(errMsg, ev.errorCode);
             return {
                 action: "auto_continue",

package/dist/client/use-chat-models.d.ts

@@ -1,4 +1,5 @@
 import { DEFAULT_MODEL } from "../agent/default-model.js";
+import { type ModelEngineConfig } from "../agent/model-version.js";
 export { DEFAULT_MODEL };
 import { type ReasoningEffort } from "../shared/reasoning-effort.js";
 import { type EngineModelGroup } from "./chat-model-groups.js";
@@ -36,6 +37,10 @@ export interface PersistedModelSelection {
 export type ChatModelCatalogLoad = {
     state: "available";
     groups: EngineModelGroup[];
+    /** Runtime normalization config for the engines represented in groups. */
+    modelEngines: Readonly<Record<string, ModelEngineConfig>>;
+    /** The server-selected engine, independent of a persisted chat choice. */
+    currentModelEngine: ModelEngineConfig | null;
     /** The server's current model, or `DEFAULT_MODEL` when it names none. */
     defaultModel: string;
     /**

package/dist/client/use-chat-models.js

@@ -1,6 +1,6 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { DEFAULT_MODEL } from "../agent/default-model.js";
-import { upgradeModelToLatestSupportedVersion } from "../agent/model-version.js";
+import { upgradeModelForProvider, } from "../agent/model-version.js";
 export { DEFAULT_MODEL };
 import { DEFAULT_REASONING_EFFORT, getReasoningEffortOptionsForModel, resolveReasoningEffortSelection, } from "../shared/reasoning-effort.js";
 import { fetchOllamaModels } from "./agent-engine-key.js";
@@ -54,6 +54,7 @@ export async function loadChatModelCatalog() {
     const builderConnected = builderResult.value?.configured === true;
     const currentEngineName = enginesData.current?.engine;
     const currentModel = enginesData.current?.model;
+    const currentEngine = enginesData.engines.find((engine) => engine.name === currentEngineName);
     const build = (engines) => buildChatModelGroups({
         engines,
         configuredKeys,
@@ -61,10 +62,55 @@ export async function loadChatModelCatalog() {
         currentEngineName,
         currentModel,
     });
+    const groups = build(enginesData.engines);
+    const modelEngines = Object.fromEntries(enginesData.engines.flatMap((engine) => {
+        if (!engine.defaultModel)
+            return [];
+        const selectableModels = groups
+            .filter((group) => group.engine === engine.name)
+            .flatMap((group) => group.models);
+        const supportedModels = engine.runtimeSupportedModels ??
+            engine.supportedModels ??
+            selectableModels;
+        if (supportedModels.length === 0)
+            return [];
+        return [
+            [
+                engine.name,
+                {
+                    name: engine.name,
+                    label: engine.label,
+                    defaultModel: engine.defaultModel,
+                    supportedModels,
+                    selectableModels,
+                    ...(engine.acceptsCustomModels
+                        ? { acceptsCustomModels: true }
+                        : {}),
+                    ...(engine.preserveCustomModels
+                        ? { preserveCustomModels: true }
+                        : {}),
+                },
+            ],
+        ];
+    }));
+    const currentModelEngine = currentEngineName
+        ? (modelEngines[currentEngineName] ?? null)
+        : null;
+    const currentEngineModels = groups
+        .filter((group) => group.engine === currentEngineName)
+        .flatMap((group) => group.models);
+    const defaultModelCandidates = currentEngine?.runtimeSupportedModels ?? currentEngineModels;
+    const defaultModel = currentModel
+        ? currentEngine?.preserveCustomModels
+            ? currentModel
+            : (upgradeModelForProvider(currentModel, defaultModelCandidates, currentEngineName ?? "") ?? currentModel)
+        : DEFAULT_MODEL;
     return {
         state: "available",
-        groups: build(enginesData.engines),
-        defaultModel: currentModel ?? DEFAULT_MODEL,
+        groups,
+        modelEngines,
+        currentModelEngine,
+        defaultModel,
         loadLiveGroups: async () => {
             // Gated on Ollama actually being the current engine (not merely present
             // in the catalog, which it always is): every app registers it by
@@ -300,14 +346,14 @@ export function useChatModels({ storageKey = DEFAULT_STORAGE_KEY, enabled = true
                         const model = group.preserveCustomModels &&
                             selection.selectedEngine === group.engine
                             ? selection.selectedModel
-                            : upgradeModelToLatestSupportedVersion(selection.selectedModel, group.models);
+                            : upgradeModelForProvider(selection.selectedModel, group.models, group.engine);
                         return model ? [{ group, model }] : [];
                     });
                 const upgradeCandidateKeys = new Set(upgradeCandidates.map(({ group, model }) => JSON.stringify([group.engine, model])));
                 const upgradedSelection = upgradeCandidateKeys.size === 1 ? upgradeCandidates[0] : undefined;
                 const selectedGroup = exactSelectedGroup ?? upgradedSelection?.group;
                 if (selectedGroup) {
-                    const selectedModel = upgradeModelToLatestSupportedVersion(selection.selectedModel, selectedGroup.models) ?? selection.selectedModel;
+                    const selectedModel = upgradeModelForProvider(selection.selectedModel, selectedGroup.models, selectedGroup.engine) ?? selection.selectedModel;
                     const nextSelection = {
                         ...selection,
                         selectedModel,

package/dist/client/use-session.d.ts

@@ -1,6 +1,6 @@
 import type { AuthSession } from "../server/auth.js";
 export type { AuthSession };
-export { isSessionNavigationPending } from "../shared/ssr-session-bootstrap.js";
+export { hasSessionHint, isSessionNavigationPending, } from "../shared/ssr-session-bootstrap.js";
 /**
  * What the session endpoint said that the page acted on: a signed-out body,
  * an HTTP 401, or a signed-in answer. Recorded with every session-driven
@@ -25,6 +25,13 @@ interface UseSessionResult {
 }
 export declare function notifySessionInvalidated(): void;
 export declare function isSigningOut(): boolean;
+/**
+ * Whether the session this tab holds is the answer to the page load's first
+ * session read. A request the load sent before the session was known belongs
+ * to the account this session names only while this holds: once a retry or an
+ * invalidation answers instead, another tab may have changed the cookies.
+ */
+export declare function isSessionFromFirstRead(): boolean;
 /**
  * Re-resolve the session because an authenticated request came back 401.
  *

package/dist/client/use-session.js

@@ -4,7 +4,7 @@ import { setSentryUser, trackEvent, trackSessionStatus } from "./analytics.js";
 import { agentNativeApiDisabledReason } from "./api-surface.js";
 import { expireClientStatusResult, fetchAuthSessionStatus, invalidateClientStatusRequest, SESSION_RESULT_LIFETIME_MS, } from "./client-status-requests.js";
 import { getFrameOrigin, getFramePostMessageTargetOrigin } from "./frame.js";
-export { isSessionNavigationPending } from "../shared/ssr-session-bootstrap.js";
+export { hasSessionHint, isSessionNavigationPending, } from "../shared/ssr-session-bootstrap.js";
 let cachedEvidence;
 let lastResolution;
 /**
@@ -47,6 +47,11 @@ let sessionRequest;
 let trackedSessionIdentity;
 let trackedSessionAuthUserId;
 let sessionGeneration = 0;
+// The page load's own session read is the only one sent with the cookies a
+// request made before the session was known also carried. A retry or a reset
+// replaces it for the life of the document.
+let firstSessionReadUnsent = true;
+let cachedSessionFromFirstRead = false;
 let sessionInvalidationListenersInstalled = false;
 let staleSessionRecheck;
 let signingOut = false;
@@ -130,6 +135,8 @@ function notifyParentAuthState(status) {
 }
 function resetSessionCache() {
     sessionGeneration += 1;
+    firstSessionReadUnsent = false;
+    cachedSessionFromFirstRead = false;
     cachedSession = undefined;
     cachedSessionAt = 0;
     cachedEvidence = undefined;
@@ -223,6 +230,15 @@ export function notifySessionInvalidated() {
 export function isSigningOut() {
     return signingOut;
 }
+/**
+ * Whether the session this tab holds is the answer to the page load's first
+ * session read. A request the load sent before the session was known belongs
+ * to the account this session names only while this holds: once a retry or an
+ * invalidation answers instead, another tab may have changed the cookies.
+ */
+export function isSessionFromFirstRead() {
+    return cachedSession !== undefined && cachedSessionFromFirstRead;
+}
 const UNAUTHORIZED_RECHECK_MIN_INTERVAL_MS = 5_000;
 let lastUnauthorizedRecheckAt = 0;
 /**
@@ -282,6 +298,8 @@ function fetchSharedSession() {
     if (sessionRequest)
         return sessionRequest;
     const requestGeneration = sessionGeneration;
+    const firstRead = firstSessionReadUnsent;
+    firstSessionReadUnsent = false;
     let request;
     const requestResult = (async () => {
         try {
@@ -306,6 +324,7 @@ function fetchSharedSession() {
                 : data;
             cachedSession = session;
             cachedSessionAt = Date.now();
+            cachedSessionFromFirstRead = firstRead;
             cachedEvidence = session
                 ? "signed_in"
                 : result.state === "unavailable"

package/dist/collab/struct-routes.d.ts

@@ -1,6 +1,6 @@
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/deploy/build.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { execFileSync } from "child_process";
 import fs from "fs";
-import { createRequire } from "module";
+import { createRequire, isBuiltin } from "module";
 import path from "path";
 import { fileURLToPath } from "url";
 import { runInNewContext } from "vm";
@@ -3853,6 +3853,342 @@ function copyInstalledFfmpegStaticPackage(serverDir) {
     copyDir(src, path.join(serverDir, "node_modules", FFMPEG_STATIC_PACKAGE_NAME));
     console.log("[deploy] Copied ffmpeg-static into the server bundle for media transcription fallback.");
 }
+function exclusiveBrowserInstallerPackages(functionDir) {
+    const nodeModulesDir = path.join(functionDir, "node_modules");
+    if (!fs.existsSync(path.join(nodeModulesDir, "@puppeteer/browsers")))
+        return new Set();
+    const functionRoot = fs.realpathSync(functionDir);
+    const isWithinFunction = (directory) => {
+        const relative = path.relative(functionRoot, directory);
+        return (relative === "" ||
+            (relative !== ".." &&
+                !relative.startsWith(`..${path.sep}`) &&
+                !path.isAbsolute(relative)));
+    };
+    const packageSegments = (name) => {
+        const segments = name.split("/");
+        if (!name ||
+            name.includes("\\") ||
+            segments.some((segment) => !segment || segment === "." || segment === "..") ||
+            segments.length > 2 ||
+            (segments.length === 2 && !segments[0].startsWith("@")) ||
+            (segments.length === 1 && segments[0].startsWith("@")))
+            return null;
+        return segments;
+    };
+    const resolvePackageDirectory = (segments, fromPackageDir, resolvedPackageDir) => {
+        if (resolvedPackageDir) {
+            const resolved = fs.realpathSync(resolvedPackageDir);
+            if (!isWithinFunction(resolved))
+                return null;
+            return fs.statSync(resolved).isDirectory() ? resolved : null;
+        }
+        let current = fromPackageDir ?? functionRoot;
+        if (!isWithinFunction(current))
+            return null;
+        while (isWithinFunction(current)) {
+            if (current === functionRoot ||
+                path.basename(current) !== "node_modules") {
+                const candidate = path.join(current, "node_modules", ...segments);
+                if (fs.existsSync(candidate)) {
+                    const resolved = fs.realpathSync(candidate);
+                    // A nearer out-of-bound install must not fall through to another version.
+                    if (!isWithinFunction(resolved))
+                        return null;
+                    if (fs.statSync(resolved).isDirectory())
+                        return resolved;
+                    return null;
+                }
+            }
+            if (current === functionRoot)
+                break;
+            const parent = path.dirname(current);
+            if (parent === current)
+                break;
+            current = parent;
+        }
+        return null;
+    };
+    const candidateReferencesByFile = new Map();
+    const packageReferencesByDirectory = new Map();
+    const isEnoent = (error) => error !== null &&
+        typeof error === "object" &&
+        "code" in error &&
+        error.code === "ENOENT";
+    const isMissingDanglingSymlink = (fileStats, error) => fileStats.isSymbolicLink() && isEnoent(error);
+    const resolveScannablePath = (filePath) => {
+        const fileStats = fs.lstatSync(filePath);
+        let resolvedPath;
+        try {
+            resolvedPath = fs.realpathSync(filePath);
+        }
+        catch (error) {
+            if (isMissingDanglingSymlink(fileStats, error))
+                return null;
+            throw error;
+        }
+        if (!isWithinFunction(resolvedPath))
+            return null;
+        let stats;
+        try {
+            stats = fs.statSync(filePath);
+        }
+        catch (error) {
+            if (isMissingDanglingSymlink(fileStats, error))
+                return null;
+            throw error;
+        }
+        return { path: resolvedPath, stats };
+    };
+    const collect = (roots, scanPackageReferences) => {
+        const collected = new Set();
+        const visited = new Set();
+        const visit = (request, parentPackageDir) => {
+            const name = typeof request === "string" ? request : request.name;
+            const fromPackageDir = typeof request === "string" ? parentPackageDir : request.fromPackageDir;
+            const segments = packageSegments(name);
+            if (!segments)
+                return;
+            if (scanPackageReferences &&
+                SERVERLESS_FUNCTION_PACKAGE_DENYLIST.has(name))
+                return;
+            collected.add(name);
+            const packageDir = resolvePackageDirectory(segments, fromPackageDir, typeof request === "string" ? undefined : request.resolvedPackageDir);
+            if (!packageDir)
+                return;
+            const manifest = readPackageManifest(packageDir);
+            const version = typeof manifest?.version === "string" ? manifest.version : "";
+            const identity = `${packageDir}\0${version}`;
+            if (visited.has(identity))
+                return;
+            visited.add(identity);
+            if (scanPackageReferences) {
+                for (const reference of scanPackageReferences(packageDir))
+                    visit(reference);
+            }
+            for (const field of [
+                ...RUNTIME_PACKAGE_DEPENDENCY_FIELDS,
+                "peerDependencies",
+            ]) {
+                const dependencies = manifest?.[field];
+                if (!dependencies ||
+                    typeof dependencies !== "object" ||
+                    Array.isArray(dependencies))
+                    continue;
+                for (const dependency of Object.keys(dependencies))
+                    visit(dependency, packageDir);
+            }
+        };
+        for (const root of roots)
+            visit(root);
+        return collected;
+    };
+    const candidates = collect([
+        "puppeteer",
+        "puppeteer-core",
+        "chromium-bidi",
+        "@puppeteer/browsers",
+    ]);
+    const findResolvedCandidate = (specifier, fromPackageDir) => {
+        if (!specifier.startsWith("./") &&
+            !specifier.startsWith("../") &&
+            !path.isAbsolute(specifier))
+            return;
+        const target = path.resolve(fromPackageDir, specifier);
+        if (!isWithinFunction(target))
+            return;
+        let match;
+        for (const name of candidates) {
+            if (SERVERLESS_FUNCTION_PACKAGE_DENYLIST.has(name))
+                continue;
+            const marker = `${path.sep}node_modules${path.sep}${name
+                .split("/")
+                .join(path.sep)}`;
+            const markerStart = target.lastIndexOf(marker);
+            const suffix = target[markerStart + marker.length];
+            if (markerStart < 0 || (suffix !== undefined && suffix !== path.sep))
+                continue;
+            const candidateDir = target.slice(0, markerStart + marker.length);
+            if (!fs.existsSync(candidateDir))
+                continue;
+            const resolvedPackageDir = fs.realpathSync(candidateDir);
+            if (!isWithinFunction(resolvedPackageDir) ||
+                !fs.statSync(resolvedPackageDir).isDirectory())
+                continue;
+            if (!match || markerStart > match.markerStart)
+                match = { name, resolvedPackageDir, markerStart };
+        }
+        return (match && {
+            name: match.name,
+            resolvedPackageDir: match.resolvedPackageDir,
+        });
+    };
+    const isNonPackageSpecifier = (specifier) => path.isAbsolute(specifier) ||
+        specifier.startsWith(".") ||
+        specifier.startsWith("#") ||
+        /^[A-Za-z][A-Za-z\d+.-]*:/.test(specifier);
+    const findResolvedPackage = (specifier, fromPackageDir) => {
+        const relativeCandidate = findResolvedCandidate(specifier, fromPackageDir);
+        if (relativeCandidate)
+            return relativeCandidate;
+        if (isNonPackageSpecifier(specifier))
+            return;
+        const specifierSegments = specifier.split("/");
+        const name = specifierSegments[0]?.startsWith("@")
+            ? specifierSegments.slice(0, 2).join("/")
+            : specifierSegments[0];
+        const segments = name && packageSegments(name);
+        if (!name ||
+            !segments ||
+            isBuiltin(name) ||
+            SERVERLESS_FUNCTION_PACKAGE_DENYLIST.has(name))
+            return;
+        const resolvedPackageDir = resolvePackageDirectory(segments, fromPackageDir);
+        return resolvedPackageDir ? { name, resolvedPackageDir } : undefined;
+    };
+    const findPackageImportReferences = (packageDir, packageManifest = readPackageManifest(packageDir)) => {
+        const imports = packageManifest?.imports;
+        if (!imports || typeof imports !== "object" || Array.isArray(imports))
+            return [];
+        const targets = [];
+        const collectTargets = (value) => {
+            if (typeof value === "string") {
+                targets.push(value);
+            }
+            else if (Array.isArray(value)) {
+                for (const target of value)
+                    collectTargets(target);
+            }
+            else if (value && typeof value === "object") {
+                for (const target of Object.values(value))
+                    collectTargets(target);
+            }
+        };
+        for (const target of Object.values(imports))
+            collectTargets(target);
+        const references = new Map();
+        for (const target of targets) {
+            const resolved = findResolvedPackage(target, packageDir);
+            if (resolved) {
+                const reference = { ...resolved, fromPackageDir: packageDir };
+                references.set(`${reference.name}\0${reference.resolvedPackageDir}`, reference);
+                continue;
+            }
+            if (isNonPackageSpecifier(target))
+                continue;
+            const targetSegments = target.split("/");
+            const packageName = targetSegments[0]?.startsWith("@")
+                ? targetSegments.slice(0, 2).join("/")
+                : targetSegments[0];
+            if (packageName?.includes("*")) {
+                for (const name of candidates) {
+                    if (SERVERLESS_FUNCTION_PACKAGE_DENYLIST.has(name))
+                        continue;
+                    const reference = { name, fromPackageDir: packageDir };
+                    references.set(`${name}\0`, reference);
+                }
+                continue;
+            }
+        }
+        return [...references.values()];
+    };
+    const manifest = readPackageManifest(functionDir);
+    // Nitro's manifest flattens transitive dependencies, so installer children
+    // are not independent runtime roots merely because they appear there.
+    const retained = new Set(PACKAGE_DEPENDENCY_FIELDS.flatMap((field) => Object.keys(manifest?.[field] ?? {})).filter((name) => !candidates.has(name) &&
+        !SERVERLESS_FUNCTION_PACKAGE_DENYLIST.has(name)));
+    const findCandidateReferences = (resolvedFilePath) => {
+        const cached = candidateReferencesByFile.get(resolvedFilePath);
+        if (cached)
+            return cached;
+        const fromPackageDir = path.dirname(resolvedFilePath);
+        const source = fs.readFileSync(resolvedFilePath, "utf8");
+        const references = new Map();
+        const addReference = (reference) => {
+            const identity = `${reference.name}\0${reference.fromPackageDir}\0${reference.resolvedPackageDir ?? ""}`;
+            references.set(identity, reference);
+        };
+        const literalSpecifier = /\b(?:import|export)\s*(?:[^;'"`]*?\s*from\s*)?(['"`])([^'"`]+)\1|\b(?:import\s*\.\s*meta\s*\.\s*resolve|import|require(?:\s*\.\s*resolve)?)\s*\(\s*(['"`])([^'"`]+)\3/g;
+        for (const match of source.matchAll(literalSpecifier)) {
+            const specifier = match[2] ?? match[4];
+            if (!specifier)
+                continue;
+            const resolved = findResolvedPackage(specifier, fromPackageDir);
+            if (resolved)
+                addReference({ ...resolved, fromPackageDir });
+        }
+        for (const name of candidates) {
+            if (!SERVERLESS_FUNCTION_PACKAGE_DENYLIST.has(name) &&
+                source.includes(name) &&
+                (hasExternalSsrRuntimeReference(source, name) ||
+                    ["/", '"', "'", "`"].some((boundary) => source.includes(`node_modules/${name}${boundary}`))))
+                addReference({ name, fromPackageDir });
+        }
+        const found = [...references.values()];
+        candidateReferencesByFile.set(resolvedFilePath, found);
+        return found;
+    };
+    const collectTreeReferences = (roots) => {
+        const references = new Map();
+        const visitedDirectories = new Set();
+        const visitedFiles = new Set();
+        const visit = (entryPath) => {
+            const resolved = resolveScannablePath(entryPath);
+            if (!resolved)
+                return;
+            if (resolved.stats.isDirectory()) {
+                if (visitedDirectories.has(resolved.path))
+                    return;
+                visitedDirectories.add(resolved.path);
+                for (const entry of fs.readdirSync(resolved.path, {
+                    withFileTypes: true,
+                })) {
+                    if (entry.isDirectory() ||
+                        entry.isSymbolicLink() ||
+                        (entry.isFile() && /\.(?:[cm]?js)$/.test(entry.name)))
+                        visit(path.join(resolved.path, entry.name));
+                }
+                return;
+            }
+            if (!resolved.stats.isFile() ||
+                !/\.(?:[cm]?js)$/.test(path.basename(entryPath)) ||
+                visitedFiles.has(resolved.path))
+                return;
+            visitedFiles.add(resolved.path);
+            for (const reference of findCandidateReferences(resolved.path)) {
+                const identity = `${reference.name}\0${reference.fromPackageDir}\0${reference.resolvedPackageDir ?? ""}`;
+                references.set(identity, reference);
+            }
+        };
+        for (const root of roots)
+            visit(root);
+        return [...references.values()];
+    };
+    const emittedRoots = fs
+        .readdirSync(functionDir, { withFileTypes: true })
+        .filter((entry) => entry.name !== "node_modules" &&
+        (entry.isDirectory() ||
+            entry.isSymbolicLink() ||
+            (entry.isFile() && /\.(?:[cm]?js)$/.test(entry.name))))
+        .map((entry) => path.join(functionDir, entry.name));
+    const emittedReferences = collectTreeReferences(emittedRoots);
+    const needed = collect([
+        ...retained,
+        ...emittedReferences,
+        ...findPackageImportReferences(functionDir, manifest),
+    ], (packageDir) => {
+        const cached = packageReferencesByDirectory.get(packageDir);
+        if (cached)
+            return cached;
+        const references = [
+            ...collectTreeReferences([packageDir]),
+            ...findPackageImportReferences(packageDir),
+        ];
+        packageReferencesByDirectory.set(packageDir, references);
+        return references;
+    });
+    return new Set([...candidates].filter((name) => !needed.has(name)));
+}
 export function sanitizeServerlessFunctionPackageManifest(functionDir) {
     if (!functionDir || !fs.existsSync(functionDir))
         return;
@@ -3866,13 +4202,17 @@ export function sanitizeServerlessFunctionPackageManifest(functionDir) {
     catch {
         return;
     }
+    const deniedPackages = new Set([
+        ...SERVERLESS_FUNCTION_PACKAGE_DENYLIST,
+        ...exclusiveBrowserInstallerPackages(functionDir),
+    ]);
     let removed = 0;
     for (const field of PACKAGE_DEPENDENCY_FIELDS) {
         const deps = packageJson[field];
         if (!deps || typeof deps !== "object" || Array.isArray(deps))
             continue;
         const depRecord = deps;
-        for (const packageName of SERVERLESS_FUNCTION_PACKAGE_DENYLIST) {
+        for (const packageName of deniedPackages) {
             if (Object.prototype.hasOwnProperty.call(depRecord, packageName)) {
                 delete depRecord[packageName];
                 removed++;
@@ -3883,7 +4223,7 @@ export function sanitizeServerlessFunctionPackageManifest(functionDir) {
         }
     }
     const nodeModulesDir = path.join(functionDir, "node_modules");
-    for (const packageName of SERVERLESS_FUNCTION_PACKAGE_DENYLIST) {
+    for (const packageName of deniedPackages) {
         const packageDir = path.join(nodeModulesDir, ...packageName.split("/"));
         if (fs.existsSync(packageDir)) {
             fs.rmSync(packageDir, { recursive: true, force: true });
@@ -4029,6 +4369,12 @@ export async function runNitroBuildPipeline(opts) {
         patchReactRouterServerManifestInOutput(nitro.options.output.serverDir, trustedClientDirectory, resolvedClientDir);
     }
 }
+function removeServerSourceMaps(serverDir) {
+    const sourceMaps = fs.globSync("**/*.map", { cwd: serverDir });
+    for (const sourceMap of sourceMaps) {
+        fs.rmSync(path.join(serverDir, sourceMap), { force: true });
+    }
+}
 function resolveNitroClientDirectory(cwd, defaultClientDirectory) {
     const configured = process.env[PREBUILT_CLIENT_DIRECTORY_ENV]?.trim();
     const clientDirectory = configured
@@ -4357,6 +4703,10 @@ export default bundle;
     if (isCloudflareModulePreset(preset)) {
         bundleYjsRuntimeForServerlessOutput(nitro.options.output.serverDir, cwd);
     }
+    if (sentryServerSourceMapPlugins.length > 0) {
+        removeServerSourceMaps(nitro.options.output.serverDir);
+        console.log("[deploy] Ensured Nitro server output is free of source maps before function packaging.");
+    }
     if (preset === "netlify") {
         if (isDurableBackgroundEmitRequired()) {
             emitSingleTemplateNetlifyBackgroundFunction(cwd);

package/dist/file-upload/actions/upload-image.d.ts

@@ -33,9 +33,9 @@ declare const _default: import("../../action.js").ActionDefinition<{
     idempotencyKey: string;
     deleted: boolean;
 } | {
-    id?: undefined;
     error: string;
     url?: undefined;
+    id?: undefined;
     provider?: undefined;
     configured?: undefined;
 } | {
@@ -45,8 +45,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     configured?: undefined;
     error?: undefined;
 } | {
-    id?: undefined;
     url?: undefined;
+    id?: undefined;
     provider?: undefined;
     error: string;
     configured: boolean;