@agent-native/core 0.206.0-nightly-20261009153146 → 0.206.0

package/dist/mcp/oauth-token.js

@@ -67,6 +67,12 @@ export function parseMcpOAuthOrgIdClaim(payload) {
         : null;
 }
 export async function signMcpOAuthAccessToken(params) {
+    if (params.grantCreatedAtMs !== undefined &&
+        params.grantCreatedAtMs !== null &&
+        (!Number.isSafeInteger(params.grantCreatedAtMs) ||
+            params.grantCreatedAtMs < 0)) {
+        throw new Error("OAuth grant creation time must be a non-negative integer.");
+    }
     return new jose.SignJWT({
         typ: MCP_OAUTH_TOKEN_TYPE,
         credential_version: params.service
@@ -78,6 +84,9 @@ export async function signMcpOAuthAccessToken(params) {
         scope: params.scope,
         client_id: params.clientId,
         resource: params.resource,
+        ...(typeof params.grantCreatedAtMs === "number"
+            ? { grant_created_at_ms: params.grantCreatedAtMs }
+            : {}),
         ...(params.catalogScope === "full" ? { catalog_scope: "full" } : {}),
     })
         .setProtectedHeader({ alg: "HS256" })
@@ -155,6 +164,13 @@ export async function verifyMcpOAuthAccessToken(token, resource) {
         const orgIdClaim = parseMcpOAuthOrgIdClaim(payload);
         if (!orgIdClaim)
             return null;
+        const grantCreatedAtMs = payload.grant_created_at_ms;
+        if (grantCreatedAtMs !== undefined &&
+            (typeof grantCreatedAtMs !== "number" ||
+                !Number.isSafeInteger(grantCreatedAtMs) ||
+                grantCreatedAtMs < 0)) {
+            return null;
+        }
         return {
             userEmail: payload.sub,
             orgId: orgIdClaim.orgId,
@@ -162,6 +178,7 @@ export async function verifyMcpOAuthAccessToken(token, resource) {
             scopes,
             clientId: payload.client_id,
             jti: typeof payload.jti === "string" ? payload.jti : undefined,
+            ...(typeof grantCreatedAtMs === "number" ? { grantCreatedAtMs } : {}),
             ...(payload.catalog_scope === "full" ? { catalogScope: "full" } : {}),
             ...(typeof payload.iat === "number" ? { issuedAt: payload.iat } : {}),
         };

package/dist/mcp/screen-memory-stdio.d.ts

@@ -140,13 +140,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
         required?: undefined;
     };
@@ -171,13 +171,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
         required?: undefined;
     };
@@ -196,13 +196,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
         required?: undefined;
     };
@@ -231,13 +231,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
     };
 } | {
@@ -260,12 +260,12 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
     };
 } | {
@@ -317,7 +317,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -337,6 +336,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 type: string;
             };
             requestId?: undefined;
+            count?: undefined;
         };
     };
 } | {
@@ -352,7 +352,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -361,6 +360,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             requestId: {
                 type: string;
             };
+            count?: undefined;
         };
     };
 })[];

package/dist/mcp/server.d.ts

@@ -1,6 +1,6 @@
 import type { H3Event } from "h3";
-import { createMCPServerForRequest, verifyAuth, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, selectMcpDirectoryWidgetReadActions, type MCPConfig, type MCPCallerIdentity, type MCPRequestMeta } from "./build-server.js";
-export { createMCPServerForRequest, verifyAuth, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, selectMcpDirectoryWidgetReadActions, };
+import { createMCPServerForRequest, verifyAuth, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, selectMcpDirectoryWidgetReadActions, selectMcpDirectoryWidgetWriteActions, type MCPConfig, type MCPCallerIdentity, type MCPRequestMeta } from "./build-server.js";
+export { createMCPServerForRequest, verifyAuth, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, selectMcpDirectoryWidgetReadActions, selectMcpDirectoryWidgetWriteActions, };
 export type { MCPConfig, MCPCallerIdentity, MCPRequestMeta };
 export declare function handleMcpRequest(event: H3Event, config: MCPConfig, routePath?: string): Promise<Response | string | {
     error: string;

package/dist/mcp/server.js

@@ -8,10 +8,10 @@ import { getH3App } from "../server/framework-request-handler.js";
 import { getOrigin } from "../server/google-oauth.js";
 import { readBody } from "../server/h3-helpers.js";
 import { trackMcpInitialize } from "./analytics.js";
-import { createMCPServerForRequest, verifyAuth, McpIdentityVerificationUnavailableError, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, McpDirectoryProfileValidationError, validateMcpDirectoryProfile, validateMcpDirectoryWidgetDomain, selectMcpActionSurface, selectMcpDirectoryWidgetReadActions, } from "./build-server.js";
+import { createMCPServerForRequest, verifyAuth, McpIdentityVerificationUnavailableError, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, McpDirectoryProfileValidationError, validateMcpDirectoryProfile, validateMcpDirectoryWidgetDomain, selectMcpActionSurface, selectMcpDirectoryWidgetReadActions, selectMcpDirectoryWidgetWriteActions, } from "./build-server.js";
 import { buildMcpOAuthChallenge, getMcpOAuthAudiences, getMcpOAuthIssuer, getMcpOAuthProtectedResourceMetadataUrl, getMcpOAuthResource, } from "./oauth-route.js";
 import { MCP_DIRECTORY_ROUTE_PREFIX, MCP_PUBLIC_ROUTE_PREFIX, MCP_ROUTE_PREFIXES, joinMcpRoute, } from "./route-paths.js";
-export { createMCPServerForRequest, verifyAuth, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, selectMcpDirectoryWidgetReadActions, };
+export { createMCPServerForRequest, verifyAuth, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, selectMcpDirectoryWidgetReadActions, selectMcpDirectoryWidgetWriteActions, };
 function deriveRequestMeta(event) {
     const forwardedProto = getRequestHeader(event, "x-forwarded-proto");
     const host = getRequestHeader(event, "x-forwarded-host") ||

package/dist/observability/routes.d.ts

@@ -27,39 +27,39 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    ok?: undefined;
     error: string;
     message: string;
     summary?: undefined;
     spans?: undefined;
+    ok?: undefined;
 } | {
     error?: undefined;
-    ok?: undefined;
     message?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
+    ok?: undefined;
 } | {
     error?: undefined;
-    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     traceMissing: true;
     id: string;
+    ok?: undefined;
 } | {
     error?: undefined;
-    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     traceMissing?: undefined;
     id: string;
-} | {
     ok?: undefined;
+} | {
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     error: any;
+    ok?: undefined;
 } | {
     error?: undefined;
     message?: undefined;

package/dist/org/handlers.d.ts

@@ -72,8 +72,8 @@ export declare const setWorkspaceAppDefaultVisibilityHandler: import("h3").Event
 }>>;
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     success: boolean;
-    name?: undefined;
     id?: undefined;
+    name?: undefined;
     role?: undefined;
 } | {
     success?: undefined;

package/dist/org/workspace-app-access-request.d.ts

@@ -0,0 +1,8 @@
+import { type WorkspaceAppAccessOutcome } from "./workspace-app-access.js";
+export type WorkspaceAppAccessRequest = {
+    path: string;
+    method: string;
+    email: string;
+    orgId?: string | null;
+};
+export declare function checkWorkspaceAppAccessForRequest(request: WorkspaceAppAccessRequest): Promise<WorkspaceAppAccessOutcome | null>;

package/dist/org/workspace-app-access-request.js

@@ -0,0 +1,20 @@
+import { isWorkspaceAppAccessAllowed, } from "./workspace-app-access.js";
+import { resolveWorkspaceAccessAppId } from "./workspace-app-identity.js";
+function isWorkspaceAccessRecoveryPath(path, method) {
+    return (path === "/_agent-native/org/me" ||
+        path === "/_agent-native/actions/list-workspace-apps" ||
+        (method === "GET" &&
+            path === "/_agent-native/actions/list-workspace-app-access") ||
+        (method === "POST" &&
+            path === "/_agent-native/actions/set-workspace-app-access"));
+}
+export async function checkWorkspaceAppAccessForRequest(request) {
+    const appId = resolveWorkspaceAccessAppId();
+    if (!appId || isWorkspaceAccessRecoveryPath(request.path, request.method)) {
+        return null;
+    }
+    return isWorkspaceAppAccessAllowed(appId, {
+        email: request.email,
+        orgId: request.orgId,
+    });
+}

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,10 +75,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
+    message?: undefined;
     deleted?: undefined;
     id?: undefined;
     provider?: undefined;
-    message?: undefined;
     providers: {
         id: string;
         label: string;
@@ -93,9 +93,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     label?: undefined;
 } | {
+    message?: undefined;
     deleted?: undefined;
     id?: undefined;
-    message?: undefined;
     providers?: undefined;
     count?: undefined;
     found: boolean;
@@ -103,9 +103,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     label?: undefined;
 } | {
+    message?: undefined;
     deleted?: undefined;
     provider?: undefined;
-    message?: undefined;
     providers?: undefined;
     count?: undefined;
     found: boolean;
@@ -113,8 +113,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     label?: undefined;
 } | {
-    provider?: undefined;
     message?: undefined;
+    provider?: undefined;
     providers?: undefined;
     count?: undefined;
     found?: undefined;

package/dist/resources/handlers.d.ts

@@ -39,8 +39,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
     error: string;
 }>;
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -58,47 +58,47 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     error: string;
     errorCode?: undefined;
     retryable?: undefined;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable?: undefined;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable: boolean;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     errorCode?: undefined;
     retryable?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -126,11 +126,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/action-routes.d.ts

@@ -42,6 +42,8 @@ export interface MountActionRoutesOptions {
     mcpDirectoryWidgetReadActionSchemaArguments?: Record<string, readonly string[]>;
     mcpDirectoryWidgetReadOnlyActions?: readonly string[];
     mcpDirectoryWidgetReadPublicActions?: readonly string[];
+    mcpDirectoryWidgetWriteActionArguments?: Record<string, readonly string[]>;
+    mcpDirectoryWidgetWriteActionSchemaArguments?: Record<string, readonly string[]>;
     mcpDirectoryWidgetAppId?: string;
     mcpDirectoryWidgetResourceUri?: string;
     getOwnerContextFromEvent?: (event: any) => AgentRunOwnerContext | Promise<AgentRunOwnerContext>;