@agent-native/core 0.206.0-nightly-20261009153146 → 0.206.0

package/dist/shared/embed-auth.d.ts

@@ -6,14 +6,28 @@ export declare const MCP_APP_CHAT_BRIDGE_QUERY_PARAM = "__an_mcp_chat_bridge";
 export declare const MCP_DIRECTORY_WIDGET_QUERY_PARAM = "__an_mcp_directory_widget";
 export declare const EMBED_SESSION_COOKIE = "an_embed_session";
 export declare const EMBED_TARGET_HEADER = "x-agent-native-embed-target";
+export declare const MCP_DIRECTORY_WIDGET_SESSION_EXPIRED_HEADER = "x-agent-native-widget-session-expired";
 export declare const MCP_DIRECTORY_WIDGET_READ_CAPABILITY_PREFIX = "capability:mcp-directory-widget-read:";
+export declare const MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_PREFIX = "capability:mcp-directory-widget-write:";
 export declare const MCP_DIRECTORY_WIDGET_READ_CAPABILITY_MAX_LENGTH = 2048;
+export declare const MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_LENGTH = 4096;
+export declare const MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_AGE_MS: number;
 export interface McpDirectoryWidgetReadCapabilityInput {
     appId: string;
     resourceUri: string;
     resourceIds: Record<string, string>;
     actionArguments: Record<string, Record<string, McpDirectoryWidgetReadArgument>>;
 }
+export interface McpDirectoryWidgetWriteCapabilityInput {
+    appId: string;
+    resourceUri: string;
+    resourceIds: Record<string, string>;
+    userEmail: string;
+    orgId?: string;
+    expiresAtMs: number;
+    readActionArguments: Record<string, Record<string, McpDirectoryWidgetReadArgument>>;
+    writeActionArguments: Record<string, Record<string, McpDirectoryWidgetReadArgument>>;
+}
 export type McpDirectoryWidgetReadArgument = string | {
     type: "integerRange";
     min: number;
@@ -22,21 +36,81 @@ export type McpDirectoryWidgetReadArgument = string | {
 /** Dynamic input validated against the server action schema after resource binding. */
  | {
     type: "actionSchema";
+}
+/** Dynamic input whose artifact relationship is checked by the action. */
+ | {
+    type: "actionSchemaResourceBound";
+    resourceKey: string;
 };
 export declare function createMcpDirectoryWidgetReadCapability(input: McpDirectoryWidgetReadCapabilityInput): string | undefined;
+export declare function createMcpDirectoryWidgetWriteCapability(input: McpDirectoryWidgetWriteCapabilityInput): string | undefined;
+export declare function renewMcpDirectoryWidgetCapabilityScope(scope: string | undefined, input: {
+    appId: string;
+    resourceUri: string;
+    userEmail: string;
+    orgId?: string | null;
+    expiresAtMs: number;
+    readAllowed: boolean;
+    writeAllowed: boolean;
+}): string | undefined;
+export declare function canRenewMcpDirectoryWidgetCapabilityScope(previousScope: string, renewedScope: string, identity: {
+    userEmail: string;
+    orgId?: string | null;
+}): boolean;
 export declare function isMcpDirectoryWidgetReadCapabilityScope(scope: string | undefined): boolean;
+export declare function isMcpDirectoryWidgetWriteCapabilityScope(scope: string | undefined): boolean;
+export declare function isMcpDirectoryWidgetCapabilityScope(scope: string | undefined): boolean;
+export declare function matchesMcpDirectoryWidgetWriteCapability(scope: string | undefined, input: {
+    appId: string;
+    resourceUri: string;
+    userEmail: string;
+    orgId?: string | null;
+}): boolean;
+export declare function isExpiredMcpDirectoryWidgetWriteCapability(scope: string | undefined, input: {
+    appId: string;
+    resourceUri: string;
+    userEmail: string;
+    orgId?: string | null;
+}): boolean;
+export declare function getMcpDirectoryWidgetWriteCapabilityGrant(scope: string | undefined, input: {
+    appId: string;
+    resourceUri: string;
+    userEmail: string;
+    orgId?: string | null;
+}): {
+    resourceIds: Record<string, string>;
+    actionNames: string[];
+} | undefined;
+export declare function getMcpDirectoryWidgetWriteCapabilityExpiresAt(scope: string | undefined): number | undefined;
+export declare function matchesMcpDirectoryWidgetReadCapabilityResource(scope: string | undefined, input: {
+    appId: string;
+    resourceUri: string;
+}): boolean;
 export declare function normalizeMcpDirectoryWidgetReadActionArguments(scope: string | undefined, input: {
     actionName: string;
     appId: string | undefined;
     resourceUri: string | undefined;
     args?: Record<string, unknown>;
+    userEmail?: string;
+    orgId?: string | null;
     allowedArgumentNames?: readonly string[];
     requireArgumentMatch?: boolean;
 }): Record<string, unknown> | undefined;
+export declare function normalizeMcpDirectoryWidgetWriteActionArguments(scope: string | undefined, input: {
+    actionName: string;
+    appId: string | undefined;
+    resourceUri: string | undefined;
+    userEmail: string | undefined;
+    orgId?: string | null;
+    args?: Record<string, unknown>;
+    allowedArgumentNames?: readonly string[];
+}): Record<string, unknown> | undefined;
 export declare function allowsMcpDirectoryWidgetReadAction(scope: string | undefined, input: {
     actionName: string;
     appId: string | undefined;
     resourceUri: string | undefined;
+    userEmail?: string;
+    orgId?: string | null;
     args?: Record<string, unknown>;
     allowedArgumentNames?: readonly string[];
     requireArgumentMatch?: boolean;

package/dist/shared/embed-auth.js

@@ -6,8 +6,12 @@ export const MCP_APP_CHAT_BRIDGE_QUERY_PARAM = "__an_mcp_chat_bridge";
 export const MCP_DIRECTORY_WIDGET_QUERY_PARAM = "__an_mcp_directory_widget";
 export const EMBED_SESSION_COOKIE = "an_embed_session";
 export const EMBED_TARGET_HEADER = "x-agent-native-embed-target";
+export const MCP_DIRECTORY_WIDGET_SESSION_EXPIRED_HEADER = "x-agent-native-widget-session-expired";
 export const MCP_DIRECTORY_WIDGET_READ_CAPABILITY_PREFIX = "capability:mcp-directory-widget-read:";
+export const MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_PREFIX = "capability:mcp-directory-widget-write:";
 export const MCP_DIRECTORY_WIDGET_READ_CAPABILITY_MAX_LENGTH = 2048;
+export const MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_LENGTH = 4096;
+export const MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_AGE_MS = 15 * 60 * 1000;
 const MCP_DIRECTORY_WIDGET_INTEGER_ARGUMENT_MAX = 5_000;
 const MCP_DIRECTORY_ACTION_NAME = /^[A-Za-z0-9_.-]{1,128}$/;
 const MCP_DIRECTORY_SCOPE_KEY = /^[A-Za-z0-9_.-]{1,128}$/;
@@ -25,7 +29,7 @@ function isStringRecord(value, { minEntries = 1, maxEntries = 16 } = {}) {
             item.length <= 256 &&
             !CONTROL_CHARS.test(item)));
 }
-function isWidgetReadArgument(value) {
+function isWidgetReadArgument(value, allowResourceBound = false) {
     if (typeof value === "string") {
         return (value.length > 0 && value.length <= 256 && !CONTROL_CHARS.test(value));
     }
@@ -36,6 +40,12 @@ function isWidgetReadArgument(value) {
     if (range.type === "actionSchema") {
         return Object.keys(range).length === 1;
     }
+    if (range.type === "actionSchemaResourceBound") {
+        return (allowResourceBound &&
+            Object.keys(range).length === 2 &&
+            typeof range.resourceKey === "string" &&
+            MCP_DIRECTORY_SCOPE_KEY.test(range.resourceKey));
+    }
     return (range.type === "integerRange" &&
         Object.keys(range).length === 3 &&
         Number.isSafeInteger(range.min) &&
@@ -44,14 +54,15 @@ function isWidgetReadArgument(value) {
         range.max >= range.min &&
         range.max <= MCP_DIRECTORY_WIDGET_INTEGER_ARGUMENT_MAX);
 }
-function isWidgetReadArgumentRecord(value, { minEntries = 1, maxEntries = 16 } = {}) {
+function isWidgetReadArgumentRecord(value, { minEntries = 1, maxEntries = 16, allowResourceBound = false, } = {}) {
     if (!value || typeof value !== "object" || Array.isArray(value)) {
         return false;
     }
     const entries = Object.entries(value);
     return (entries.length >= minEntries &&
         entries.length <= maxEntries &&
-        entries.every(([key, item]) => MCP_DIRECTORY_SCOPE_KEY.test(key) && isWidgetReadArgument(item)));
+        entries.every(([key, item]) => MCP_DIRECTORY_SCOPE_KEY.test(key) &&
+            isWidgetReadArgument(item, allowResourceBound)));
 }
 function isWidgetReadCapability(value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -109,6 +120,68 @@ function decodeMcpDirectoryWidgetReadCapability(scope) {
         ? { ok: true, capability: value }
         : { ok: false, reason: "invalid-capability" };
 }
+function decodeMcpDirectoryWidgetWriteCapability(scope) {
+    if (!scope.startsWith(MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_PREFIX) ||
+        scope.length > MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_LENGTH) {
+        return undefined;
+    }
+    try {
+        const value = JSON.parse(decodeURIComponent(scope.slice(MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_PREFIX.length)));
+        if (value.version !== 1 ||
+            typeof value.appId !== "string" ||
+            !MCP_DIRECTORY_SCOPE_KEY.test(value.appId) ||
+            typeof value.resourceUri !== "string" ||
+            !value.resourceUri.startsWith("ui://") ||
+            value.resourceUri.length > 512 ||
+            CONTROL_CHARS.test(value.resourceUri) ||
+            !isStringRecord(value.resourceIds) ||
+            typeof value.userEmail !== "string" ||
+            value.userEmail.length > 320 ||
+            CONTROL_CHARS.test(value.userEmail) ||
+            (value.orgId !== undefined &&
+                (typeof value.orgId !== "string" ||
+                    value.orgId.length > 256 ||
+                    CONTROL_CHARS.test(value.orgId))) ||
+            !Number.isSafeInteger(value.expiresAtMs)) {
+            return undefined;
+        }
+        const readActionArguments = value.readActionArguments;
+        const writeActionArguments = value.writeActionArguments;
+        if (!isWidgetActionArgumentMap(readActionArguments, { minActions: 0 }) ||
+            !isWidgetActionArgumentMap(writeActionArguments, {
+                maxArguments: 32,
+                allowResourceBound: true,
+            }) ||
+            Object.keys(writeActionArguments).some((actionName) => {
+                const args = writeActionArguments[actionName];
+                return !Object.values(args).some((argument) => typeof argument === "string"
+                    ? Object.values(value.resourceIds).includes(argument)
+                    : argument.type === "actionSchemaResourceBound" &&
+                        Object.hasOwn(value.resourceIds, argument.resourceKey));
+            })) {
+            return undefined;
+        }
+        return value;
+    }
+    catch {
+        // coercion-ok: malformed caller scope remains an absent, denied capability.
+        return undefined;
+    }
+}
+function isWidgetActionArgumentMap(value, { minActions = 1, maxArguments = 16, allowResourceBound = false, } = {}) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const actions = Object.entries(value);
+    return (actions.length >= minActions &&
+        actions.length <= 32 &&
+        actions.every(([actionName, args]) => MCP_DIRECTORY_ACTION_NAME.test(actionName) &&
+            isWidgetReadArgumentRecord(args, {
+                minEntries: 0,
+                maxEntries: maxArguments,
+                allowResourceBound,
+            })));
+}
 function sortStringRecord(value) {
     return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
 }
@@ -156,22 +229,253 @@ export function createMcpDirectoryWidgetReadCapability(input) {
         ? scope
         : undefined;
 }
+export function createMcpDirectoryWidgetWriteCapability(input) {
+    const now = Date.now();
+    if (!input ||
+        typeof input.appId !== "string" ||
+        !MCP_DIRECTORY_SCOPE_KEY.test(input.appId) ||
+        typeof input.resourceUri !== "string" ||
+        !input.resourceUri.startsWith("ui://") ||
+        input.resourceUri.length > 512 ||
+        CONTROL_CHARS.test(input.resourceUri) ||
+        !isStringRecord(input.resourceIds) ||
+        typeof input.userEmail !== "string" ||
+        !input.userEmail.trim() ||
+        input.userEmail.length > 320 ||
+        CONTROL_CHARS.test(input.userEmail) ||
+        (input.orgId !== undefined &&
+            (typeof input.orgId !== "string" ||
+                !input.orgId.trim() ||
+                input.orgId.length > 256 ||
+                CONTROL_CHARS.test(input.orgId))) ||
+        !Number.isSafeInteger(input.expiresAtMs) ||
+        input.expiresAtMs <= now ||
+        input.expiresAtMs >
+            now + MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_AGE_MS ||
+        !isWidgetActionArgumentMap(input.readActionArguments, { minActions: 0 }) ||
+        !isWidgetActionArgumentMap(input.writeActionArguments, {
+            maxArguments: 32,
+            allowResourceBound: true,
+        }) ||
+        Object.values(input.writeActionArguments).some((args) => !Object.values(args).some((argument) => typeof argument === "string"
+            ? Object.values(input.resourceIds).includes(argument)
+            : argument.type === "actionSchemaResourceBound" &&
+                Object.hasOwn(input.resourceIds, argument.resourceKey)))) {
+        return undefined;
+    }
+    const capability = {
+        version: 1,
+        appId: input.appId,
+        resourceUri: input.resourceUri,
+        resourceIds: sortStringRecord(input.resourceIds),
+        userEmail: input.userEmail.trim().toLowerCase(),
+        ...(input.orgId ? { orgId: input.orgId } : {}),
+        expiresAtMs: input.expiresAtMs,
+        readActionArguments: Object.fromEntries(Object.entries(input.readActionArguments)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([actionName, args]) => [
+            actionName,
+            sortWidgetReadArgumentRecord(args),
+        ])),
+        writeActionArguments: Object.fromEntries(Object.entries(input.writeActionArguments)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([actionName, args]) => [
+            actionName,
+            sortWidgetReadArgumentRecord(args),
+        ])),
+    };
+    const scope = MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_PREFIX +
+        encodeURIComponent(JSON.stringify(capability));
+    return scope.length <= MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_LENGTH
+        ? scope
+        : undefined;
+}
+export function renewMcpDirectoryWidgetCapabilityScope(scope, input) {
+    if (!scope || !input.appId || !input.userEmail || !input.readAllowed) {
+        return undefined;
+    }
+    if (isMcpDirectoryWidgetWriteCapabilityScope(scope)) {
+        const capability = decodeMcpDirectoryWidgetWriteCapability(scope);
+        if (!capability ||
+            capability.appId !== input.appId ||
+            capability.userEmail !== input.userEmail.trim().toLowerCase() ||
+            capability.orgId !== (input.orgId ?? undefined)) {
+            return undefined;
+        }
+        if (!input.writeAllowed) {
+            return createMcpDirectoryWidgetReadCapability({
+                appId: capability.appId,
+                resourceUri: input.resourceUri,
+                resourceIds: capability.resourceIds,
+                actionArguments: capability.readActionArguments,
+            });
+        }
+        return createMcpDirectoryWidgetWriteCapability({
+            ...capability,
+            resourceUri: input.resourceUri,
+            expiresAtMs: input.expiresAtMs,
+        });
+    }
+    const decoded = decodeMcpDirectoryWidgetReadCapability(scope);
+    return decoded.ok && decoded.capability.appId === input.appId
+        ? createMcpDirectoryWidgetReadCapability({
+            ...decoded.capability,
+            resourceUri: input.resourceUri,
+        })
+        : undefined;
+}
+function sameWidgetActionArguments(left, right) {
+    const normalize = (value) => Object.fromEntries(Object.entries(value)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([actionName, args]) => [
+        actionName,
+        Object.fromEntries(Object.entries(args).sort(([a], [b]) => a.localeCompare(b))),
+    ]));
+    return JSON.stringify(normalize(left)) === JSON.stringify(normalize(right));
+}
+export function canRenewMcpDirectoryWidgetCapabilityScope(previousScope, renewedScope, identity) {
+    if (!identity.userEmail.trim())
+        return false;
+    const previousWrite = isMcpDirectoryWidgetWriteCapabilityScope(previousScope);
+    const renewedWrite = isMcpDirectoryWidgetWriteCapabilityScope(renewedScope);
+    if (renewedWrite && !previousWrite)
+        return false;
+    const identityMatches = (capability) => capability.userEmail === identity.userEmail.trim().toLowerCase() &&
+        capability.orgId === (identity.orgId ?? undefined);
+    if (previousWrite) {
+        const previous = decodeMcpDirectoryWidgetWriteCapability(previousScope);
+        if (!previous || !identityMatches(previous))
+            return false;
+        if (renewedWrite) {
+            const renewed = decodeMcpDirectoryWidgetWriteCapability(renewedScope);
+            return Boolean(renewed &&
+                identityMatches(renewed) &&
+                renewed.appId === previous.appId &&
+                sameWidgetActionArguments(renewed.readActionArguments, previous.readActionArguments) &&
+                sameWidgetActionArguments(renewed.writeActionArguments, previous.writeActionArguments) &&
+                JSON.stringify(renewed.resourceIds) ===
+                    JSON.stringify(previous.resourceIds));
+        }
+        const renewed = decodeMcpDirectoryWidgetReadCapability(renewedScope);
+        return Boolean(renewed.ok &&
+            renewed.capability.appId === previous.appId &&
+            sameWidgetActionArguments(renewed.capability.actionArguments, previous.readActionArguments) &&
+            JSON.stringify(renewed.capability.resourceIds) ===
+                JSON.stringify(previous.resourceIds));
+    }
+    const previous = decodeMcpDirectoryWidgetReadCapability(previousScope);
+    const renewed = decodeMcpDirectoryWidgetReadCapability(renewedScope);
+    return Boolean(!renewedWrite &&
+        previous.ok &&
+        renewed.ok &&
+        renewed.capability.appId === previous.capability.appId &&
+        sameWidgetActionArguments(renewed.capability.actionArguments, previous.capability.actionArguments) &&
+        JSON.stringify(renewed.capability.resourceIds) ===
+            JSON.stringify(previous.capability.resourceIds));
+}
 export function isMcpDirectoryWidgetReadCapabilityScope(scope) {
     return (scope?.startsWith(MCP_DIRECTORY_WIDGET_READ_CAPABILITY_PREFIX) === true);
 }
+export function isMcpDirectoryWidgetWriteCapabilityScope(scope) {
+    return (scope?.startsWith(MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_PREFIX) === true);
+}
+export function isMcpDirectoryWidgetCapabilityScope(scope) {
+    return (isMcpDirectoryWidgetReadCapabilityScope(scope) ||
+        isMcpDirectoryWidgetWriteCapabilityScope(scope));
+}
+export function matchesMcpDirectoryWidgetWriteCapability(scope, input) {
+    if (!scope || !isMcpDirectoryWidgetWriteCapabilityScope(scope)) {
+        return false;
+    }
+    const capability = decodeMcpDirectoryWidgetWriteCapability(scope);
+    return (capability !== undefined &&
+        capability.expiresAtMs > Date.now() &&
+        capability.appId === input.appId &&
+        capability.resourceUri === input.resourceUri &&
+        capability.userEmail === input.userEmail.trim().toLowerCase() &&
+        capability.orgId === (input.orgId ?? undefined));
+}
+export function isExpiredMcpDirectoryWidgetWriteCapability(scope, input) {
+    if (!scope || !isMcpDirectoryWidgetWriteCapabilityScope(scope)) {
+        return false;
+    }
+    const capability = decodeMcpDirectoryWidgetWriteCapability(scope);
+    return (capability !== undefined &&
+        capability.expiresAtMs <= Date.now() &&
+        capability.appId === input.appId &&
+        capability.resourceUri === input.resourceUri &&
+        capability.userEmail === input.userEmail.trim().toLowerCase() &&
+        capability.orgId === (input.orgId ?? undefined));
+}
+export function getMcpDirectoryWidgetWriteCapabilityGrant(scope, input) {
+    if (!matchesMcpDirectoryWidgetWriteCapability(scope, input) || !scope) {
+        return undefined;
+    }
+    const capability = decodeMcpDirectoryWidgetWriteCapability(scope);
+    return capability
+        ? {
+            resourceIds: { ...capability.resourceIds },
+            actionNames: Object.keys(capability.writeActionArguments),
+        }
+        : undefined;
+}
+export function getMcpDirectoryWidgetWriteCapabilityExpiresAt(scope) {
+    if (!scope || !isMcpDirectoryWidgetWriteCapabilityScope(scope)) {
+        return undefined;
+    }
+    return decodeMcpDirectoryWidgetWriteCapability(scope)?.expiresAtMs;
+}
+export function matchesMcpDirectoryWidgetReadCapabilityResource(scope, input) {
+    if (!scope || !isMcpDirectoryWidgetReadCapabilityScope(scope))
+        return false;
+    const decoded = decodeMcpDirectoryWidgetReadCapability(scope);
+    return (decoded.ok &&
+        decoded.capability.appId === input.appId &&
+        decoded.capability.resourceUri === input.resourceUri);
+}
+function widgetReadActionArgumentsForScope(scope) {
+    if (isMcpDirectoryWidgetWriteCapabilityScope(scope)) {
+        const capability = decodeMcpDirectoryWidgetWriteCapability(scope);
+        return capability && capability.expiresAtMs > Date.now()
+            ? capability.readActionArguments
+            : undefined;
+    }
+    const decoded = decodeMcpDirectoryWidgetReadCapability(scope);
+    return decoded.ok ? decoded.capability.actionArguments : undefined;
+}
 export function normalizeMcpDirectoryWidgetReadActionArguments(scope, input) {
     if (!scope || !input.appId || !input.resourceUri)
         return undefined;
-    const decoded = decodeMcpDirectoryWidgetReadCapability(scope);
-    if (!decoded.ok)
+    const actionArguments = widgetReadActionArgumentsForScope(scope);
+    if (!actionArguments)
         return undefined;
-    const capability = decoded.capability;
-    if (!capability ||
-        capability.appId !== input.appId ||
-        capability.resourceUri !== input.resourceUri) {
+    let capabilityAppId;
+    let capabilityResourceUri;
+    let capabilityUserEmail;
+    let capabilityOrgId;
+    if (isMcpDirectoryWidgetWriteCapabilityScope(scope)) {
+        const capability = decodeMcpDirectoryWidgetWriteCapability(scope);
+        capabilityAppId = capability?.appId;
+        capabilityResourceUri = capability?.resourceUri;
+        capabilityUserEmail = capability?.userEmail;
+        capabilityOrgId = capability?.orgId;
+    }
+    else {
+        const decoded = decodeMcpDirectoryWidgetReadCapability(scope);
+        capabilityAppId = decoded.ok ? decoded.capability.appId : undefined;
+        capabilityResourceUri = decoded.ok
+            ? decoded.capability.resourceUri
+            : undefined;
+    }
+    if (capabilityAppId !== input.appId ||
+        capabilityResourceUri !== input.resourceUri ||
+        (capabilityUserEmail &&
+            capabilityUserEmail !== input.userEmail?.trim().toLowerCase()) ||
+        (isMcpDirectoryWidgetWriteCapabilityScope(scope) &&
+            capabilityOrgId !== (input.orgId ?? undefined))) {
         return undefined;
     }
-    const expectedArgs = capability.actionArguments[input.actionName];
+    const expectedArgs = actionArguments[input.actionName];
     if (!expectedArgs)
         return undefined;
     const allowedNames = [...(input.allowedArgumentNames ?? [])].sort();
@@ -205,6 +509,71 @@ export function normalizeMcpDirectoryWidgetReadActionArguments(scope, input) {
             normalizedArgs.push([name, value]);
             continue;
         }
+        if (expected.type === "actionSchemaResourceBound")
+            return undefined;
+        const number = typeof value === "number"
+            ? value
+            : typeof value === "string" && /^(0|[1-9]\d*)$/.test(value)
+                ? Number(value)
+                : Number.NaN;
+        if (!Number.isSafeInteger(number) ||
+            number < expected.min ||
+            number > expected.max) {
+            return undefined;
+        }
+        normalizedArgs.push([name, number]);
+    }
+    return Object.fromEntries(normalizedArgs);
+}
+export function normalizeMcpDirectoryWidgetWriteActionArguments(scope, input) {
+    if (!scope ||
+        !isMcpDirectoryWidgetWriteCapabilityScope(scope) ||
+        !input.appId ||
+        !input.resourceUri ||
+        !input.userEmail) {
+        return undefined;
+    }
+    const capability = decodeMcpDirectoryWidgetWriteCapability(scope);
+    if (!capability ||
+        capability.expiresAtMs <= Date.now() ||
+        capability.appId !== input.appId ||
+        capability.resourceUri !== input.resourceUri ||
+        capability.userEmail !== input.userEmail.trim().toLowerCase() ||
+        capability.orgId !== (input.orgId ?? undefined)) {
+        return undefined;
+    }
+    const expectedArgs = capability.writeActionArguments[input.actionName];
+    if (!expectedArgs)
+        return undefined;
+    const allowedNames = [...(input.allowedArgumentNames ?? [])].sort();
+    const expectedNames = Object.keys(expectedArgs).sort();
+    if (allowedNames.length !== expectedNames.length ||
+        allowedNames.some((name, index) => name !== expectedNames[index])) {
+        return undefined;
+    }
+    const suppliedArgs = Object.entries(input.args ?? {});
+    const includesResourceBinding = suppliedArgs.some(([name, value]) => typeof expectedArgs[name] === "string" && expectedArgs[name] === value) ||
+        Object.values(expectedArgs).some((expected) => typeof expected !== "string" &&
+            expected.type === "actionSchemaResourceBound" &&
+            Object.hasOwn(capability.resourceIds, expected.resourceKey));
+    if (!includesResourceBinding)
+        return undefined;
+    const normalizedArgs = [];
+    for (const [name, value] of suppliedArgs) {
+        if (!Object.hasOwn(expectedArgs, name))
+            return undefined;
+        const expected = expectedArgs[name];
+        if (typeof expected === "string") {
+            if (expected !== value)
+                return undefined;
+            normalizedArgs.push([name, value]);
+            continue;
+        }
+        if (expected.type === "actionSchema" ||
+            expected.type === "actionSchemaResourceBound") {
+            normalizedArgs.push([name, value]);
+            continue;
+        }
         const number = typeof value === "number"
             ? value
             : typeof value === "string" && /^(0|[1-9]\d*)$/.test(value)

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -2,6 +2,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
 }, {
+    role?: undefined;
     ownerEmail: any;
     visibility: any;
     shares: any[];
@@ -11,7 +12,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
         supportsGroupShares?: boolean;
     };
     orgId?: undefined;
-    role?: undefined;
     agentReadable?: undefined;
 } | {
     ownerEmail: string;

package/dist/triggers/actions/manage-automation.d.ts

@@ -14,6 +14,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     executionCwd?: string;
 }, {
     deleted?: undefined;
+    enabled?: undefined;
     created: boolean;
     name: string;
     scope: "organization" | "personal";
@@ -24,25 +25,24 @@ declare const _default: import("../../action.js").ActionDefinition<{
     reasoningEffort: "auto" | "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh";
     webhookPath: string;
     nextRun: string;
-    enabled?: undefined;
     executionHostId?: undefined;
     executionEngine?: undefined;
     executionCwd?: undefined;
 } | {
+    enabled?: undefined;
+    nextRun?: undefined;
     created?: undefined;
     scope?: undefined;
     triggerType?: undefined;
     event?: undefined;
     deleted: boolean;
     name: string;
-    enabled?: undefined;
     schedule?: undefined;
     timezone?: undefined;
     reasoningEffort?: undefined;
     executionHostId?: undefined;
     executionEngine?: undefined;
     executionCwd?: undefined;
-    nextRun?: undefined;
     webhookPath?: undefined;
 } | {
     deleted?: undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.206.0-nightly-20261009153146",
+  "version": "0.206.0",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -688,8 +688,8 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.206.0-nightly-20261009153146",
-    "@agent-native/recap-cli": "^0.5.68-nightly-20261009153146"
+    "@agent-native/agentkit": "^0.206.0",
+    "@agent-native/recap-cli": "^0.5.68"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",
@@ -759,7 +759,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": "0.206.0-nightly-20261009153146",
+    "@agent-native/core-corpus": ">=0.196.0",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",