@agent-native/core 0.205.0 → 0.206.0-nightly-20261009011246

package/dist/observability/traces.js

@@ -1,4 +1,5 @@
 import { credentialStateTrackingProperties } from "../agent/engine/credential-state.js";
+import { runErrorTelemetryProperties } from "../agent/engine/error-telemetry.js";
 import { isToolDoneFailure } from "../agent/tool-done-error.js";
 import { captureError } from "../server/capture-error.js";
 import { getRequestContext, getRequestOrgId, } from "../server/request-context.js";
@@ -9,6 +10,28 @@ export { redactSensitiveFields } from "./trace-redaction.js";
 import { recordAgentToolCall, recordGenAiChat, recordTraceWriteFailure, } from "./metrics.js";
 import { endAgentSpan, startAgentSpan, withAgentSpanContext, } from "./tracing.js";
 import { trackingIdentityProperties } from "./tracking-identity.js";
+function endRunTelemetrySpan(span, { errorCode, ...result }) {
+    if (result.status !== "error") {
+        endAgentSpan(span, result);
+        return;
+    }
+    const code = errorCode ?? result.attributes?.["agent.terminal_code"];
+    const { error_code, error_cause } = runErrorTelemetryProperties(typeof code === "string" ? code : undefined, result.errorMessage);
+    endAgentSpan(span, {
+        ...result,
+        errorMessage: `Agent run failed (${error_code})`,
+        attributes: {
+            ...result.attributes,
+            "agent.error_code": error_code,
+            "agent.error_cause": error_cause,
+        },
+    });
+}
+function endToolTelemetrySpan(span, result) {
+    endAgentSpan(span, result.status === "error"
+        ? { ...result, errorMessage: "Tool call failed" }
+        : result);
+}
 function spanId() {
     return `span-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
 }
@@ -136,6 +159,8 @@ function aiTraceMetadataProperties(metadata) {
         return {};
     const properties = {};
     for (const [key, value] of Object.entries(metadata)) {
+        if (key === "error_message" || key === "errorMessage")
+            continue;
         if (value === undefined || value === null)
             continue;
         const scalar = typeof value === "string"
@@ -234,7 +259,7 @@ function emitLlmGenerationTrackingEvent(args) {
         $ai_is_error: args.status === "error",
         $ai_error: resolveAiError(args.status === "error", toAiErrorDetail(error, {
             state: args.terminalOutcome?.state,
-            code: terminalCode,
+            code: terminalCode ?? args.errorCode,
             retryable: terminalRetryable,
         })),
         $ai_error_type: args.status === "error" ? (terminalCode ?? "llm_error") : undefined,
@@ -267,8 +292,6 @@ function emitLlmGenerationTrackingEvent(args) {
             properties.experiment_variant = args.experimentAssignments[0].variantId;
         }
     }
-    if (error)
-        properties.error_message = error;
     for (const key of Object.keys(properties)) {
         if (properties[key] === undefined)
             delete properties[key];
@@ -435,7 +458,7 @@ export async function instrumentAgentLoop(opts) {
                 return;
             if (entry.endResult) {
                 entry.ended = true;
-                endAgentSpan(span, entry.endResult);
+                endRunTelemetrySpan(span, entry.endResult);
             }
             else {
                 entry.span = span;
@@ -458,7 +481,7 @@ export async function instrumentAgentLoop(opts) {
             return;
         entry.ended = true;
         openOtelModelSpans.delete(entry.span);
-        endAgentSpan(entry.span, safeResult);
+        endRunTelemetrySpan(entry.span, safeResult);
     };
     const recordPreStreamModelFailure = (start, end, input, errorMessage) => {
         const tripIndex = modelRoundTrips.length;
@@ -479,7 +502,7 @@ export async function instrumentAgentLoop(opts) {
             endTime: end,
         });
     };
-    const finishAwaitingOtelModelSpans = (finalErrorMessage = null, markUnresolvedFailed = false) => {
+    const finishAwaitingOtelModelSpans = (finalErrorMessage = null, markUnresolvedFailed = false, finalErrorCode) => {
         for (const tripIndex of modelSpansAwaitingFinalError) {
             const trip = modelRoundTrips[tripIndex];
             const modelCallFailed = trip?.stopReason === "error" ||
@@ -500,6 +523,7 @@ export async function instrumentAgentLoop(opts) {
             finishOtelModelSpan(tripIndex, {
                 status: modelCallFailed ? "error" : "success",
                 errorMessage: modelErrorMessage,
+                errorCode: finalErrorCode,
                 attributes: modelSpanAttributes(tripIndex),
                 endTime: modelRoundTrips[tripIndex]?.end,
             });
@@ -516,6 +540,7 @@ export async function instrumentAgentLoop(opts) {
     let usage;
     let runStatus = "success";
     let errorMessage = null;
+    let errorCode;
     let runMetadata = opts.metadata ?? null;
     let terminalOutcome;
     let errorHttpStatus;
@@ -566,6 +591,7 @@ export async function instrumentAgentLoop(opts) {
                 finishAwaitingOtelModelSpans(null, event.type === "clear");
                 runStatus = "success";
                 errorMessage = null;
+                errorCode = undefined;
                 cutOffReason = null;
             }
             else if (event.type === "auto_continue") {
@@ -579,6 +605,7 @@ export async function instrumentAgentLoop(opts) {
             else if (event.type === "error") {
                 runStatus = "error";
                 errorMessage = redactCapturedError(event.error);
+                errorCode = event.errorCode;
             }
             else if (event.type === "tripwire") {
                 runStatus = "error";
@@ -652,7 +679,7 @@ export async function instrumentAgentLoop(opts) {
                     if (!span)
                         return;
                     if (entry.endResult) {
-                        endAgentSpan(span, {
+                        endToolTelemetrySpan(span, {
                             status: entry.endResult.status,
                             errorMessage: entry.endResult.errorMessage,
                         });
@@ -705,8 +732,7 @@ export async function instrumentAgentLoop(opts) {
                 }
                 else
                     successfulTools++;
-                // The full text goes to external sinks only when captureToolResults is
-                // on; the persisted span always keeps at least the signature.
+                // Local spans keep the error text; tracking keeps only its class.
                 const toolErrorMessage = isError && config.captureToolResults
                     ? sanitizeToolErrorMessage(event.result)
                     : null;
@@ -726,7 +752,6 @@ export async function instrumentAgentLoop(opts) {
                             : explicitError
                                 ? "tool_error"
                                 : "legacy_inferred_error",
-                        error_message: toolErrorMessage ?? undefined,
                     });
                 }
                 recordAgentToolCall({
@@ -743,7 +768,7 @@ export async function instrumentAgentLoop(opts) {
                 };
                 if (pending?.otelSpan) {
                     openOtelToolSpans.delete(pending.otelSpan);
-                    endAgentSpan(pending.otelSpan, {
+                    endToolTelemetrySpan(pending.otelSpan, {
                         status: otelEndResult.status,
                         errorMessage: otelEndResult.errorMessage,
                         attributes: { "gen_ai.tool.name": event.tool },
@@ -839,6 +864,7 @@ export async function instrumentAgentLoop(opts) {
             ? (err?.message ?? String(err))
             : classification.errorMessage);
         errorHttpStatus = httpStatusFromError(err);
+        errorCode = typeof err?.errorCode === "string" ? err.errorCode : undefined;
         const errorMetadata = classification?.metadata ?? null;
         runMetadata =
             runMetadata || errorMetadata
@@ -899,12 +925,11 @@ export async function instrumentAgentLoop(opts) {
                             duration_ms: Math.max(0, runEnd - pending.startMs),
                             status: "error",
                             error_class: "interrupted",
-                            error_message: capturedInterruptedMessage ?? undefined,
                         });
                     }
                     if (pending.otelSpan) {
                         openOtelToolSpans.delete(pending.otelSpan);
-                        endAgentSpan(pending.otelSpan, {
+                        endToolTelemetrySpan(pending.otelSpan, {
                             status: "error",
                             errorMessage: capturedInterruptedMessage,
                             attributes: { "gen_ai.tool.name": pending.toolName },
@@ -1149,6 +1174,7 @@ export async function instrumentAgentLoop(opts) {
                         status: generationStatus,
                         errorMessage: capturedGenerationError,
                         httpStatus: generationStatus === "error" ? errorHttpStatus : HTTP_STATUS_OK,
+                        errorCode: generationStatus === "error" ? errorCode : undefined,
                         toolCalls: generation.toolSpans.length,
                         successfulTools: generation.toolSpans.filter((span) => span.status === "success").length,
                         failedTools: generation.toolSpans.filter((span) => span.status === "error").length,
@@ -1196,7 +1222,7 @@ export async function instrumentAgentLoop(opts) {
                         code: effectiveTerminalOutcome?.state === "failed" ||
                             effectiveTerminalOutcome?.state === "input_required"
                             ? effectiveTerminalOutcome.code
-                            : undefined,
+                            : errorCode,
                         retryable: effectiveTerminalOutcome?.state === "failed"
                             ? effectiveTerminalOutcome.retryable
                             : undefined,
@@ -1263,24 +1289,16 @@ export async function instrumentAgentLoop(opts) {
                     },
                 });
                 for (const span of emittedToolSpans) {
-                    const toolErrorMessage = span.status === "error" &&
-                        span.errorMessage &&
-                        config.captureToolResults
-                        ? sanitizeToolErrorMessage(span.errorMessage)
-                        : undefined;
                     const toolErrorDetail = span.status !== "error"
                         ? undefined
-                        : toolErrorMessage
-                            ? toAiErrorDetail(toolErrorMessage)
-                            : !config.captureToolResults
-                                ? {
-                                    message: "error text withheld: captureToolResults is off for this app",
-                                }
-                                : undefined;
-                    const toolOutputState = config.captureToolResults
-                        ? (toolErrorMessage ??
-                            span.metadata?.output)
-                        : "[tool result withheld: captureToolResults is off for this app]";
+                        : toAiErrorDetail(undefined, {
+                            code: toolSpanErrorClass.get(span.id) ?? "tool_error",
+                        });
+                    const toolOutputState = span.status === "error"
+                        ? "[tool error message omitted from telemetry]"
+                        : config.captureToolResults
+                            ? span.metadata?.output
+                            : "[tool result withheld: captureToolResults is off for this app]";
                     const requestingGeneration = toolSpanRoundTrip.get(span.id);
                     emitAiSpanEvent({
                         runId,
@@ -1329,6 +1347,10 @@ export async function instrumentAgentLoop(opts) {
                 createdAt: runStart,
             };
             writeTraceData(spans, summary, runId, config).catch((error) => reportTraceWriteFailure(runId, "write", error));
+            const runTerminalCode = effectiveTerminalOutcome?.state === "failed" ||
+                effectiveTerminalOutcome?.state === "input_required"
+                ? effectiveTerminalOutcome.code
+                : errorCode;
             try {
                 // Metrics are unsampled and independent of trace export.
                 for (const [tripIndex, trip] of modelRoundTrips.entries()) {
@@ -1365,6 +1387,7 @@ export async function instrumentAgentLoop(opts) {
                     finishOtelModelSpan(interruptedModelRoundTrip, {
                         status: "error",
                         errorMessage: errorMessage ?? "Model stream interrupted before completion.",
+                        errorCode: runTerminalCode,
                         attributes: modelSpanAttributes(interruptedModelRoundTrip),
                         endTime: runEnd,
                     });
@@ -1379,7 +1402,7 @@ export async function instrumentAgentLoop(opts) {
                         });
                     }
                 }
-                finishAwaitingOtelModelSpans(errorMessage);
+                finishAwaitingOtelModelSpans(errorMessage, false, runTerminalCode);
                 await Promise.all([...pendingOtelModelSpans.values()].map((entry) => entry.spanPromise));
                 if (usage && modelRoundTrips.length === 0) {
                     const aggregateLlmSpan = await withAgentSpanContext(otelRunSpan, () => startAgentSpan(`chat ${loopOpts.model}`, {
@@ -1387,9 +1410,10 @@ export async function instrumentAgentLoop(opts) {
                         "gen_ai.provider.name": engineName,
                         "gen_ai.request.model": loopOpts.model,
                     }, otelRunSpan));
-                    endAgentSpan(aggregateLlmSpan, {
+                    endRunTelemetrySpan(aggregateLlmSpan, {
                         status: runStatus,
                         errorMessage: errorMessage === null ? null : redactCapturedString(errorMessage),
+                        errorCode: runTerminalCode,
                         attributes: {
                             "gen_ai.response.model": usage.model,
                             ...(usage.usageReported
@@ -1405,20 +1429,21 @@ export async function instrumentAgentLoop(opts) {
                     });
                 }
                 for (const modelSpan of openOtelModelSpans) {
-                    endAgentSpan(modelSpan, {
+                    endRunTelemetrySpan(modelSpan, {
                         status: "error",
                         errorMessage: "Agent run ended before model_stream completed.",
+                        errorCode: runTerminalCode,
                     });
                 }
                 openOtelModelSpans.clear();
                 for (const toolSpan of openOtelToolSpans) {
-                    endAgentSpan(toolSpan, {
+                    endToolTelemetrySpan(toolSpan, {
                         status: "error",
                         errorMessage: "Agent run ended before tool_done.",
                     });
                 }
                 openOtelToolSpans.clear();
-                endAgentSpan(otelRunSpan, {
+                endRunTelemetrySpan(otelRunSpan, {
                     status: runStatus,
                     errorMessage: redactCapturedError(errorMessage),
                     attributes: {
@@ -1437,10 +1462,7 @@ export async function instrumentAgentLoop(opts) {
                             : undefined,
                         "agent.cost_cents_x100": costCentsX100,
                         "agent.terminal_state": effectiveTerminalOutcome?.state,
-                        "agent.terminal_code": effectiveTerminalOutcome?.state === "failed" ||
-                            effectiveTerminalOutcome?.state === "input_required"
-                            ? effectiveTerminalOutcome.code
-                            : undefined,
+                        "agent.terminal_code": runTerminalCode,
                     },
                 });
                 // coercion-ok: OTel export must never break the run.

package/dist/org/app-roles.d.ts

@@ -12,9 +12,12 @@ export type AppRoleLookup<R extends string = string> = {
     status: "assigned";
     roles: R[];
     orgId: string;
+    orgRole?: string;
 } | {
     status: "unassigned";
     orgId: string;
+    orgRole?: string;
+    hasAssignments?: boolean;
 } | {
     status: "not-a-member";
     orgId: string;
@@ -27,6 +30,10 @@ export interface AppRoleCaller {
     userEmail?: string | null;
     orgId?: string | null;
 }
+export interface AppPermissionPolicy<R extends string> {
+    unassignedRole?: R;
+    allowOrgAdmins?: boolean;
+}
 export interface AppAuthorizationContext {
     appId: string;
     roles: string[];
@@ -44,7 +51,7 @@ export interface AppRoles<R extends string = string, P extends string = string>
 }
 export declare function getRegisteredAppRoles(appId: string): AppRolesDescriptor<string, string> | undefined;
 export declare function listRegisteredAppRoles(): AppRolesDescriptor<string, string>[];
-export declare function defineAppRoles<const R extends string, const P extends string = string>(descriptor: AppRolesDescriptor<R, P>): AppRoles<R, P>;
+export declare function defineAppRoles<const R extends string, const P extends string = string>(descriptor: AppRolesDescriptor<R, P>, permissionPolicy?: AppPermissionPolicy<R>): AppRoles<R, P>;
 export declare function resolveAppRole<R extends string>(descriptor: AppRolesDescriptor<R>, caller?: AppRoleCaller): Promise<AppRoleLookup<R>>;
 export interface AppMemberRoleRow {
     email: string;

package/dist/org/app-roles.js

@@ -18,13 +18,17 @@ function callerIdentity(caller) {
         orgId: orgId && orgId.trim() ? orgId.trim() : null,
     };
 }
-export function defineAppRoles(descriptor) {
+export function defineAppRoles(descriptor, permissionPolicy = {}) {
     const appId = descriptor.appId.trim();
     if (!appId)
         throw new Error("defineAppRoles: appId is required");
     if (!descriptor.roles.length) {
         throw new Error(`defineAppRoles(${appId}): at least one role is required`);
     }
+    if (permissionPolicy.unassignedRole &&
+        !descriptor.roles.includes(permissionPolicy.unassignedRole)) {
+        throw new Error(`defineAppRoles(${appId}): unassignedRole is not in roles`);
+    }
     if (descriptor.defaultRole &&
         !descriptor.roles.includes(descriptor.defaultRole)) {
         throw new Error(`defineAppRoles(${appId}): defaultRole "${descriptor.defaultRole}" is not in roles`);
@@ -61,11 +65,19 @@ export function defineAppRoles(descriptor) {
         if (!identity.email || !identity.orgId)
             throw new ForbiddenError(`Requires ${appId} permission ${permissions.join(" or ")}`);
         const lookup = await resolve(caller);
-        if (lookup.status !== "assigned")
+        if (lookup.status !== "assigned" && lookup.status !== "unassigned")
             throw new ForbiddenError(`Requires ${appId} permission ${permissions.join(" or ")}`);
+        if (permissionPolicy.allowOrgAdmins &&
+            (lookup.orgRole === "owner" || lookup.orgRole === "admin"))
+            return;
+        const roles = lookup.status === "assigned"
+            ? lookup.roles
+            : permissionPolicy.unassignedRole && !lookup.hasAssignments
+                ? [permissionPolicy.unassignedRole]
+                : [];
         const overrides = await getAppPermissionOverrides(appId, identity.orgId);
         const grants = permissions.flatMap((permission) => overrides[permission] ?? descriptor.permissions?.[permission] ?? []);
-        if (!lookup.roles.some((role) => grants.includes(role))) {
+        if (!roles.some((role) => grants.includes(role))) {
             throw new ForbiddenError(`Requires ${appId} permission ${permissions.join(" or ")}`);
         }
     };
@@ -128,7 +140,7 @@ export async function resolveAppRole(descriptor, caller) {
     let rows;
     try {
         rows = (await getDbExec().execute({
-            sql: `SELECT array_agg(r.role ORDER BY r.role) FILTER (WHERE r.role IS NOT NULL) AS roles,
+            sql: `SELECT m.role AS "orgRole", array_agg(r.role ORDER BY r.role) FILTER (WHERE r.role IS NOT NULL) AS roles,
                      o.identity_authority AS "identityAuthority",
                      o.identity_id AS "identityId"
               FROM org_members m
@@ -139,7 +151,7 @@ export async function resolveAppRole(descriptor, caller) {
                AND LOWER(r.email) = LOWER(m.email)
               WHERE m.org_id = ? AND LOWER(m.email) = ?
                 AND m.federation_removal_pending_at IS NULL
-              GROUP BY o.identity_authority, o.identity_id`,
+              GROUP BY m.role, o.identity_authority, o.identity_id`,
             args: [descriptor.appId, orgId, normalizeEmail(email)],
         })).rows;
     }
@@ -147,7 +159,7 @@ export async function resolveAppRole(descriptor, caller) {
         if (!isMissingOrganizationTableError(error))
             throw error;
         rows = (await getDbExec().execute({
-            sql: `SELECT array_agg(r.role ORDER BY r.role) FILTER (WHERE r.role IS NOT NULL) AS roles
+            sql: `SELECT m.role AS "orgRole", array_agg(r.role ORDER BY r.role) FILTER (WHERE r.role IS NOT NULL) AS roles
               FROM org_members m
               LEFT JOIN app_member_roles r
                 ON r.org_id = m.org_id
@@ -155,7 +167,7 @@ export async function resolveAppRole(descriptor, caller) {
                AND LOWER(r.email) = LOWER(m.email)
               WHERE m.org_id = ? AND LOWER(m.email) = ?
                 AND m.federation_removal_pending_at IS NULL
-              GROUP BY m.org_id, m.email`,
+              GROUP BY m.org_id, m.email, m.role`,
             args: [descriptor.appId, orgId, normalizeEmail(email)],
         })).rows;
     }
@@ -164,6 +176,7 @@ export async function resolveAppRole(descriptor, caller) {
         return { status: "not-a-member", orgId };
     const identityAuthority = String(row.identityAuthority ?? row.identity_authority ?? "").trim();
     const identityId = String(row.identityId ?? row.identity_id ?? "").trim();
+    let orgRole = typeof row.orgRole === "string" ? row.orgRole : undefined;
     if (identityAuthority || identityId) {
         const { validateFederatedOrganizationMembershipForCurrentRequest } = await import("./federation.js");
         const membership = await validateFederatedOrganizationMembershipForCurrentRequest({
@@ -172,15 +185,22 @@ export async function resolveAppRole(descriptor, caller) {
         });
         if (!membership.active)
             return { status: "not-a-member", orgId };
+        orgRole = membership.role;
     }
     const raw = row.roles ?? row.appRoles ?? row.approles;
     const roles = Array.isArray(raw) ? raw.map(String) : [];
     const validRoles = [
         ...new Set(roles.filter((role) => descriptor.roles.includes(role))),
     ];
+    const membership = orgRole ? { orgRole } : {};
     if (!validRoles.length)
-        return { status: "unassigned", orgId };
-    return { status: "assigned", roles: validRoles, orgId };
+        return {
+            status: "unassigned",
+            orgId,
+            ...membership,
+            ...(roles.length ? { hasAssignments: true } : {}),
+        };
+    return { status: "assigned", roles: validRoles, orgId, ...membership };
 }
 export async function listAppMemberRoles(appId, orgId) {
     const { rows } = await getDbExec().execute({

package/dist/org/context.js

@@ -7,7 +7,7 @@ import { getDbExec, isTransientDatabaseError } from "../db/client.js";
 import { isAnonymousWaitlistSessionEmail } from "../server/anonymous-identity.js";
 import { crossSiteCookieAttrs, getSession } from "../server/auth.js";
 import { shouldWriteFirstRunOnboardingEligibility } from "../server/first-run-onboarding-build-mode.js";
-import { getRequestContext, hasExplicitPersonalOrgScope, } from "../server/request-context.js";
+import { getVerifiedServiceIdentityFromEvent, getRequestContext, hasExplicitPersonalOrgScope, } from "../server/request-context.js";
 import { getSetting } from "../settings/store.js";
 import { getUserSetting } from "../settings/user-settings.js";
 import { FIRST_RUN_ONBOARDING_ELIGIBLE_KEY } from "../shared/first-run-onboarding.js";
@@ -170,6 +170,7 @@ async function resolveOrgContextUncached(event) {
         : null;
     const sessionOrgRole = normalizeOrgRole(session.orgRole);
     const requestContext = getRequestContext();
+    const verifiedServiceIdentity = getVerifiedServiceIdentityFromEvent(event);
     const serviceRole = implicitServiceOrgRole({
         email,
         orgId: sessionOrgId,
@@ -177,13 +178,28 @@ async function resolveOrgContextUncached(event) {
             ? null
             : (requestContext?.orgId ?? sessionOrgId),
     });
-    if (serviceRole && sessionOrgId) {
-        return {
-            email,
-            orgId: sessionOrgId,
-            orgName: null,
-            role: serviceRole,
-        };
+    if (serviceRole &&
+        sessionOrgId &&
+        verifiedServiceIdentity &&
+        verifiedServiceIdentity.userEmail.trim().toLowerCase() ===
+            email.trim().toLowerCase() &&
+        verifiedServiceIdentity.orgId === sessionOrgId) {
+        const organization = await getDbExec().execute({
+            sql: `SELECT identity_authority, identity_id
+            FROM organizations WHERE id = ? LIMIT 1`,
+            args: [sessionOrgId],
+        });
+        const metadata = organization.rows[0];
+        if (metadata &&
+            !String(metadata.identity_authority ?? "").trim() &&
+            !String(metadata.identity_id ?? "").trim()) {
+            return {
+                email,
+                orgId: sessionOrgId,
+                orgName: null,
+                role: serviceRole,
+            };
+        }
     }
     const exec = getDbExec();
     const activeOrgSettingPromise = loadActiveOrgSettingForEvent(event, email);

package/dist/org/index.d.ts

@@ -23,7 +23,7 @@ export { registerIdentityColumns } from "../identity/rekey.js";
 export type { AppIdentityColumn, IdentityEmailChange, IdentityOffboard, IdentityOrgScope, } from "../identity/rekey.js";
 export { claimWorkspaceAppForOrganization, isStandaloneDispatchRuntime, isWorkspaceAppAccessAllowed, } from "./workspace-app-access.js";
 export { defineAppRoles, getRegisteredAppRoles, listRegisteredAppRoles, listAppMemberRoles, resolveAppRole, setAppMemberRole, setAppMemberRoles, applyInvitationAppRoles, getAppPermissionOverrides, setAppPermissionRoles, resolveAppAuthorizationContext, } from "./app-roles.js";
-export type { AppRoles, AppRolesDescriptor, AppRoleCaller, AppRoleLookup, AppMemberRoleRow, AppAuthorizationContext, } from "./app-roles.js";
+export type { AppRoles, AppRolesDescriptor, AppRoleCaller, AppPermissionPolicy, AppRoleLookup, AppMemberRoleRow, AppAuthorizationContext, } from "./app-roles.js";
 export { ORG_MIGRATIONS } from "./migrations.js";
 export { CROSS_APP_ORG_FEDERATION_FLAG, CROSS_APP_ORG_FEDERATION_SCOPE, } from "./feature-flags.js";
 export declare const addFederatedOrganizationMember: typeof import("./federation.js").addFederatedOrganizationMember;
@@ -179,8 +179,8 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     name?: undefined;
     success: boolean;
-    id?: undefined;
     role?: undefined;
+    id?: undefined;
 } | {
     success?: undefined;
     id: string;

package/dist/org/workspace-app-identity.d.ts

@@ -0,0 +1 @@
+export declare function resolveWorkspaceAccessAppId(targetAppId?: string): string;

package/dist/org/workspace-app-identity.js

@@ -0,0 +1,25 @@
+import { getAppConfig } from "../app-config/index.js";
+export function resolveWorkspaceAccessAppId(targetAppId) {
+    const app = getAppConfig().app;
+    const identities = [
+        app.id,
+        app.legacyId,
+        app.template,
+        app.slug,
+        app.packageName,
+        app.workspaceId,
+    ]
+        .map((value) => value?.trim())
+        .filter(Boolean);
+    // Other apps still require their own workspace grant; only this deployment's
+    // aliases resolve to the identity used by its HTTP access gate.
+    const target = targetAppId?.trim();
+    if (target && !identities.includes(target))
+        return target;
+    const workspaceId = app.workspaceId?.trim();
+    if (workspaceId)
+        return workspaceId;
+    return identities.some((value) => value?.toLowerCase() === "dispatch")
+        ? "dispatch"
+        : "";
+}

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,9 +75,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
+    deleted?: undefined;
     message?: undefined;
     id?: undefined;
-    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -89,45 +89,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     }[];
     count: number;
     provider?: undefined;
-    deleted?: undefined;
+    found?: undefined;
     registered?: undefined;
     label?: undefined;
 } | {
+    deleted?: undefined;
     message?: undefined;
     id?: undefined;
-    count?: undefined;
     providers?: undefined;
+    count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
-    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
 } | {
+    deleted?: undefined;
     message?: undefined;
-    count?: undefined;
     providers?: undefined;
+    count?: undefined;
     provider?: undefined;
     found: boolean;
     id: string;
-    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
 } | {
     message?: undefined;
-    count?: undefined;
-    found?: undefined;
     providers?: undefined;
+    count?: undefined;
     provider?: undefined;
+    found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
 } | {
-    count?: undefined;
-    found?: undefined;
+    deleted?: undefined;
     providers?: undefined;
+    count?: undefined;
     provider?: undefined;
-    deleted?: undefined;
+    found?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -315,7 +315,6 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         provider?: undefined;
         message?: undefined;
         deleted?: undefined;
-        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -326,6 +325,7 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
+        found?: undefined;
         registered?: undefined;
         label?: undefined;
     } | {
@@ -352,8 +352,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         provider?: undefined;
         count?: undefined;
         message?: undefined;
-        found?: undefined;
         providers?: undefined;
+        found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
@@ -362,8 +362,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         provider?: undefined;
         count?: undefined;
         deleted?: undefined;
-        found?: undefined;
         providers?: undefined;
+        found?: undefined;
         registered: boolean;
         id: string;
         label: string;