@agent-native/core 0.207.1-nightly-20261012070747 → 0.207.1

package/dist/automation/index.d.ts

@@ -139,8 +139,8 @@ export declare function createAutomationCallbackHandler(runtime: AutomationRunti
     duplicate?: undefined;
     eventId?: undefined;
 } | {
+    error?: undefined;
     accepted: boolean;
     duplicate: boolean;
     eventId: string;
-    error?: undefined;
 }>;

package/dist/client/action-query-cache.js

@@ -5,7 +5,7 @@ import { clear as clearStore, createStore, del as deleteEntry, get as getEntry,
 import { useEffect, useState } from "react";
 import { actionErrorStatus } from "./action-failure-circuit.js";
 import { clientBuildId } from "./build-compatibility.js";
-import { isBrowserPersistableActionQuery } from "./use-action.js";
+import { isBrowserPersistableActionQuery, markRestoredBrowserPersistableActionQuery, revokeBrowserPersistableActionQuery, } from "./use-action.js";
 import { useSession } from "./use-session.js";
 // Bump when a cached result's shape or meaning changes. A record stored under
 // another buster is discarded on restore instead of being hydrated.
@@ -65,6 +65,14 @@ function scopedPersister(scope) {
     let latest;
     let timer;
     let restored = new Map();
+    let restoredSources = new Map();
+    let restoreAccepted = false;
+    let restoreRevision = 0;
+    const clearRestoredState = () => {
+        restoreAccepted = false;
+        restored = new Map();
+        restoredSources = new Map();
+    };
     const flush = () => {
         timer = undefined;
         const next = latest;
@@ -83,25 +91,49 @@ function scopedPersister(scope) {
             timer ??= setTimeout(flush, WRITE_DELAY_MS);
         },
         async restoreClient() {
+            clearRestoredState();
             if (!open)
                 return undefined;
+            const revision = restoreRevision;
             const stored = await storage.get(scope);
-            // Closed while the read was in flight: the record belongs to a scope the
-            // page has left, so it must not be hydrated into this client.
-            const record = open ? withinMaxAge(stored) : undefined;
+            // A revoked record can still be in an outstanding storage read. Do not
+            // return it to the persister after discard, even if the read was started
+            // before the matching access-denied response.
+            const record = open && revision === restoreRevision ? withinMaxAge(stored) : undefined;
             restored = new Map(record?.clientState.queries.map((query) => [
                 query.queryHash,
                 query.state.dataUpdatedAt,
             ]));
+            restoredSources = new Map(record?.clientState.queries.map((query) => [
+                query.queryHash,
+                {
+                    dataUpdatedAt: query.state.dataUpdatedAt,
+                    data: query.state.data,
+                    queryKey: query.queryKey,
+                    status: query.state.status,
+                },
+            ]));
+            restoreAccepted =
+                open && revision === restoreRevision && record !== undefined;
             return record;
         },
         restoredStates() {
             return restored;
         },
+        restoredSources() {
+            return restoredSources;
+        },
+        restoreWasAccepted() {
+            return open && restoreAccepted;
+        },
         removeClient() {
+            restoreRevision += 1;
+            clearRestoredState();
             return storage.del(scope);
         },
         discard() {
+            restoreRevision += 1;
+            clearRestoredState();
             // A debounced write still holds the client as it was before the revoke,
             // and would put the revoked result back after this delete.
             latest = undefined;
@@ -113,6 +145,8 @@ function scopedPersister(scope) {
         },
         close() {
             open = false;
+            restoreRevision += 1;
+            clearRestoredState();
             latest = undefined;
             clearTimeout(timer);
             timer = undefined;
@@ -169,11 +203,66 @@ export async function bindActionQueryCache(client, scope) {
     if (generation !== bindingGeneration)
         return;
     const persister = scopedPersister(scope);
+    let payloadMappingValid = true;
+    let deserializeIndex = 0;
+    const deserializedByHash = new Map();
+    let cachedSourceEntries;
+    const sourceEntries = () => {
+        cachedSourceEntries ??= [...persister.restoredSources()].filter(([, source]) => source.data !== undefined);
+        return cachedSourceEntries;
+    };
+    const clientHydrateOptions = client.getDefaultOptions().hydrate;
+    const clientDeserializeData = clientHydrateOptions?.deserializeData;
+    const hydrateOptions = {
+        defaultOptions: {
+            ...clientHydrateOptions,
+            deserializeData: (data) => {
+                const result = clientDeserializeData
+                    ? clientDeserializeData(data)
+                    : data;
+                const expected = sourceEntries()[deserializeIndex++];
+                if (!expected || !Object.is(expected[1].data, data)) {
+                    payloadMappingValid = false;
+                }
+                else {
+                    deserializedByHash.set(expected[0], {
+                        dataUpdatedAt: expected[1].dataUpdatedAt,
+                        data: result,
+                    });
+                }
+                return result;
+            },
+        },
+    };
+    const hydratedQueryHashes = new Set();
+    const unsubscribeHydration = client.getQueryCache().subscribe((event) => {
+        if (!persister.restoreWasAccepted())
+            return;
+        const hash = event.query.queryHash;
+        const source = persister.restoredSources().get(hash);
+        const deserialized = deserializedByHash.get(hash);
+        if (!source || !deserialized)
+            return;
+        // An unrelated local setState can happen while restore is pending. Count
+        // it only when its payload is the object produced by SDK deserialization.
+        const isHydratedState = (state) => state.status === source.status &&
+            state.dataUpdatedAt === source.dataUpdatedAt &&
+            Object.is(state.data, deserialized.data);
+        if (event.type === "added" && isHydratedState(event.query.state)) {
+            hydratedQueryHashes.add(hash);
+        }
+        else if (event.type === "updated" &&
+            event.action.type === "setState" &&
+            isHydratedState(event.action.state)) {
+            hydratedQueryHashes.add(hash);
+        }
+    });
     const [unsubscribe, restored] = persistQueryClient({
         queryClient: client,
         persister,
         buster: ACTION_QUERY_CACHE_BUSTER,
         maxAge: ACTION_QUERY_CACHE_MAX_AGE_MS,
+        hydrateOptions,
         dehydrateOptions: {
             shouldDehydrateQuery: isBrowserPersistableActionQuery,
             // A mutation replayed from disk would look like a write that succeeded.
@@ -191,8 +280,10 @@ export async function bindActionQueryCache(client, scope) {
         // The record may still hold this result from before the refetch. Only a
         // successful query is dehydrated, so the rewrite after this error leaves
         // it out.
-        if (status === 403 || status === 404)
+        if (status === 401 || status === 403 || status === 404) {
+            revokeBrowserPersistableActionQuery(event.query);
             persister.discard();
+        }
     });
     binding = {
         client,
@@ -200,8 +291,41 @@ export async function bindActionQueryCache(client, scope) {
         unsubscribe: () => {
             unsubscribe();
             unsubscribeRevoked();
+            unsubscribeHydration();
         },
     };
+    const finishAcceptedRestore = () => {
+        const expectedDataCount = sourceEntries().length;
+        if (deserializeIndex !== expectedDataCount)
+            payloadMappingValid = false;
+        if (!payloadMappingValid ||
+            generation !== bindingGeneration ||
+            !persister.restoreWasAccepted()) {
+            return;
+        }
+        const restoredStates = persister.restoredStates();
+        const restoredSources = persister.restoredSources();
+        for (const query of client.getQueryCache().getAll()) {
+            const source = restoredSources.get(query.queryHash);
+            const deserialized = deserializedByHash.get(query.queryHash);
+            if (hydratedQueryHashes.has(query.queryHash) &&
+                source?.queryKey[0] === "action" &&
+                source.status === "success" &&
+                query.queryKey[0] === "action" &&
+                query.state.status === "success" &&
+                restoredStates.get(query.queryHash) === query.state.dataUpdatedAt &&
+                source.dataUpdatedAt === deserialized?.dataUpdatedAt &&
+                Object.is(query.state.data, deserialized?.data)) {
+                markRestoredBrowserPersistableActionQuery(query);
+            }
+        }
+    };
+    // This runs after SDK hydration settles even if the UI's bounded wait has
+    // already released the app; a later scope generation cannot be authorized.
+    void restored.then(() => {
+        finishAcceptedRestore();
+        unsubscribeHydration();
+    }, () => unsubscribeHydration());
     await waitForRestore(restored);
     // A scope change during the restore can hydrate the old scope after the new
     // one has started; drop those results before the new scope saves them. A

package/dist/client/use-action.d.ts

@@ -105,8 +105,11 @@ export declare function guardActionQueryRefetchInterval<TData = unknown>(refetch
 export declare function resolveActionQueryRetry(retry: unknown, failureCount: number, error: unknown): boolean;
 /** @internal exported for tests */
 export declare function resetActionCircuitTripEventsForTests(): void;
-/** @internal read by the persisted query cache; keys are `hashKey` values. */
+/** @internal read by the persisted query cache. */
 export declare function isBrowserPersistableActionQuery(query: Query): boolean;
+/** @internal used only after a persisted action result is accepted and hydrated. */
+export declare function markRestoredBrowserPersistableActionQuery(query: Query): void;
+export declare function revokeBrowserPersistableActionQuery(query: Query): void;
 export declare function useActionQuery<TResult = undefined, TName extends ActionName = ActionName>(actionName: TName, params?: ActionParams<TName>, options?: Omit<UseQueryOptions<TResult extends undefined ? ActionResult<TName> : TResult>, "queryKey" | "queryFn"> & {
     queryKeyScope?: readonly unknown[];
     /**

package/dist/client/use-action.js

@@ -774,13 +774,20 @@ function trackActionCircuitTrip(actionName, error, trip) {
         // coercion-ok: telemetry must never change what the circuit does.
     }
 }
-// ponytail: one entry per action query this page has fetched; prune on query removal if this ever grows.
-const browserPersistableActionQueryHashes = new Set();
-/** @internal read by the persisted query cache; keys are `hashKey` values. */
+// Identical keys in another client or auth scope must earn their own permission.
+const browserPersistableActionQueries = new WeakSet();
+/** @internal read by the persisted query cache. */
 export function isBrowserPersistableActionQuery(query) {
     return (query.queryKey[0] === "action" &&
         query.state.status === "success" &&
-        browserPersistableActionQueryHashes.has(query.queryHash));
+        browserPersistableActionQueries.has(query));
+}
+/** @internal used only after a persisted action result is accepted and hydrated. */
+export function markRestoredBrowserPersistableActionQuery(query) {
+    browserPersistableActionQueries.add(query);
+}
+export function revokeBrowserPersistableActionQuery(query) {
+    browserPersistableActionQueries.delete(query);
 }
 export function useActionQuery(actionName, params, options) {
     const apiDisabled = Boolean(agentNativeApiDisabledReason());
@@ -789,8 +796,9 @@ export function useActionQuery(actionName, params, options) {
     const circuitKey = () => hashKey(queryKey);
     return useQuery({
         queryKey,
-        queryFn: async ({ signal }) => {
+        queryFn: async ({ signal, client }) => {
             const key = circuitKey();
+            const query = client.getQueryCache().find({ queryKey, exact: true });
             assertActionCircuitClosed(key);
             let browserPersist = false;
             const result = await actionFetch(actionName, "GET", params, {
@@ -802,10 +810,12 @@ export function useActionQuery(actionName, params, options) {
                 },
             });
             resetActionFailureCircuit(key);
-            if (browserPersist)
-                browserPersistableActionQueryHashes.add(key);
-            else
-                browserPersistableActionQueryHashes.delete(key);
+            if (query && !signal.aborted) {
+                if (browserPersist)
+                    browserPersistableActionQueries.add(query);
+                else
+                    browserPersistableActionQueries.delete(query);
+            }
             return result;
         },
         // The failure circuit counts fetch cycles, so a cycle is recorded where

package/dist/collab/awareness.d.ts

@@ -38,19 +38,19 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -13,8 +13,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
     };
 }>>;
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/get-file-storage.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { defineAction } from "../../action.js";
 import { getFileStorageStatus } from "../storage-settings.js";
 export default defineAction({
-    description: "Read the workspace's S3-compatible file storage settings: whether they are complete, the inferred provider, the saved endpoint, bucket, region, and public URL (owners and admins only), which keys are saved, whether a public URL is required, and where new uploads go now. Secret values are never returned.",
+    description: "Read the workspace's S3-compatible file storage settings: whether they are complete, the inferred provider, the saved endpoint, bucket, region, and public URL (owners and admins only), which keys are saved, whether a public URL is required, where new uploads go now, and whether private screenshot storage is ready in the selected storage context. Secret values are never returned.",
     schema: z.object({}),
     http: { method: "GET" },
     run: async (_args, ctx) => getFileStorageStatus(ctx),

package/dist/file-upload/index.d.ts

@@ -4,3 +4,4 @@ export { builderFileUploadProvider } from "./builder.js";
 export { ensureS3FileUploadProvider, s3FileUploadProvider } from "./s3.js";
 export { FILE_STORAGE_SECRET_KEYS, getFileStorageStatus, saveFileStorage, clearFileStorage, type FileStorageField, type FileStorageProviderId, type FileStorageStatus, type SaveFileStorageInput, } from "./storage-settings.js";
 export { preUploadImageAttachments, preUploadAttachments, isFileUploadProviderConfigured, type PreUploadAttachmentsResult, type PreUploadedImageAttachment, type PreUploadedFileAttachment, } from "./pre-upload-attachments.js";
+export { getPrivateStorageReadinessForRequest, getPrivateStorageReadinessForUser, type PrivateStorageReadinessStatus, } from "./storage-readiness.js";

package/dist/file-upload/index.js

@@ -3,3 +3,4 @@ export { builderFileUploadProvider } from "./builder.js";
 export { ensureS3FileUploadProvider, s3FileUploadProvider } from "./s3.js";
 export { FILE_STORAGE_SECRET_KEYS, getFileStorageStatus, saveFileStorage, clearFileStorage, } from "./storage-settings.js";
 export { preUploadImageAttachments, preUploadAttachments, isFileUploadProviderConfigured, } from "./pre-upload-attachments.js";
+export { getPrivateStorageReadinessForRequest, getPrivateStorageReadinessForUser, } from "./storage-readiness.js";

package/dist/file-upload/storage-readiness.d.ts

@@ -0,0 +1,8 @@
+export interface PrivateStorageReadinessStatus {
+    selectedOrg: "selected" | "none" | "unavailable";
+    provider: "s3" | "builder" | "none" | "other" | "unavailable";
+    readiness: "ready" | "unavailable";
+    builderAuthorized: "yes" | "no" | "unavailable";
+}
+export declare function getPrivateStorageReadinessForRequest(): Promise<PrivateStorageReadinessStatus>;
+export declare function getPrivateStorageReadinessForUser(userEmail: string | undefined): Promise<PrivateStorageReadinessStatus>;

package/dist/file-upload/storage-readiness.js

@@ -0,0 +1,70 @@
+import { resolveActiveOrgIdForStorageCredential } from "../org/index.js";
+import { isAttachmentEncryptionKeyAvailable } from "../private-blob/attachment-ref.js";
+import { getPrivateBlobStorageReadinessForRequest } from "../private-blob/registry.js";
+import { canAuthorizeBuilderApiRequest } from "../server/builder-api-auth.js";
+import { BUILDER_ASSETS_WRITE_SCOPE } from "../server/builder-oauth.js";
+import { getRequestBuilderStorageCredentialOrgId, getRequestContext, runWithRequestContext, } from "../server/request-context.js";
+const UNAVAILABLE_STATUS = {
+    selectedOrg: "unavailable",
+    provider: "unavailable",
+    readiness: "unavailable",
+    builderAuthorized: "unavailable",
+};
+function toProviderStatus(providerId) {
+    if (!providerId)
+        return "none";
+    if (providerId === "s3" || providerId === "builder")
+        return providerId;
+    return "other";
+}
+export async function getPrivateStorageReadinessForRequest() {
+    const context = getRequestContext();
+    const storageOrgId = getRequestBuilderStorageCredentialOrgId();
+    if (!context?.userEmail?.trim() ||
+        context.orgScope !== "personal" ||
+        !Object.prototype.hasOwnProperty.call(context, "orgId") ||
+        context.orgId !== undefined ||
+        storageOrgId === undefined ||
+        (typeof storageOrgId === "string" && !storageOrgId.trim())) {
+        return UNAVAILABLE_STATUS;
+    }
+    const [storageResult, builderResult, encryptionReady] = await Promise.allSettled([
+        getPrivateBlobStorageReadinessForRequest(),
+        canAuthorizeBuilderApiRequest(BUILDER_ASSETS_WRITE_SCOPE),
+        isAttachmentEncryptionKeyAvailable(),
+    ]);
+    return {
+        selectedOrg: storageOrgId === null ? "none" : "selected",
+        provider: storageResult.status === "fulfilled"
+            ? toProviderStatus(storageResult.value.providerId)
+            : "unavailable",
+        readiness: storageResult.status === "fulfilled" &&
+            storageResult.value.configured &&
+            encryptionReady.status === "fulfilled" &&
+            encryptionReady.value
+            ? "ready"
+            : "unavailable",
+        builderAuthorized: builderResult.status === "fulfilled"
+            ? builderResult.value
+                ? "yes"
+                : "no"
+            : "unavailable",
+    };
+}
+export async function getPrivateStorageReadinessForUser(userEmail) {
+    const email = userEmail?.trim();
+    if (!email)
+        return UNAVAILABLE_STATUS;
+    try {
+        const storageOrgId = await resolveActiveOrgIdForStorageCredential(email);
+        return await runWithRequestContext({
+            userEmail: email,
+            orgId: undefined,
+            orgScope: "personal",
+            builderStorageCredentialOrgId: storageOrgId,
+        }, getPrivateStorageReadinessForRequest);
+    }
+    catch {
+        return UNAVAILABLE_STATUS;
+    }
+}

package/dist/file-upload/storage-settings.d.ts

@@ -8,6 +8,7 @@
  * keep uploading to the old bucket.
  */
 import { type ActionRunContext } from "../action.js";
+import { type PrivateStorageReadinessStatus } from "./storage-readiness.js";
 export declare const FILE_STORAGE_SECRET_KEYS: {
     readonly endpoint: "S3_ENDPOINT";
     readonly bucket: "S3_BUCKET";
@@ -47,6 +48,8 @@ export interface FileStorageStatus {
     } | null;
     /** Whether Builder.io storage would take uploads after a clear; null when the check failed. */
     builderUploadConfigured: boolean | null;
+    /** Private-blob readiness in the caller's strict selected-storage context. */
+    privateStorageReadiness: PrivateStorageReadinessStatus;
 }
 export interface SaveFileStorageInput {
     endpoint?: string;

package/dist/file-upload/storage-settings.js

@@ -11,6 +11,7 @@ import { fail } from "../action.js";
 import { getDbExec } from "../db/client.js";
 import { deleteAppSecret, readAppSecrets, writeAppSecret, } from "../secrets/storage.js";
 import { getActiveFileUploadProviderForRequest, listFileUploadProviders, } from "./registry.js";
+import { getPrivateStorageReadinessForUser, } from "./storage-readiness.js";
 export const FILE_STORAGE_SECRET_KEYS = {
     endpoint: "S3_ENDPOINT",
     bucket: "S3_BUCKET",
@@ -122,9 +123,10 @@ export async function getFileStorageStatus(ctx) {
     const access = await resolveFileStorageAccess(ctx);
     const publicUrlRequired = isFileStoragePublicUrlRequired();
     const values = await readWorkspaceValues(access.scopeId);
-    const [active, builderUploadConfigured] = await Promise.all([
+    const [active, builderUploadConfigured, privateStorageReadiness] = await Promise.all([
         getActiveFileUploadProviderForRequest(),
         readBuilderUploadConfigured(),
+        getPrivateStorageReadinessForUser(ctx?.userEmail),
     ]);
     const saved = {};
     for (const field of FIELDS) {
@@ -145,6 +147,7 @@ export async function getFileStorageStatus(ctx) {
         publicUrlRequired,
         activeProvider: active ? { id: active.id, name: active.name } : null,
         builderUploadConfigured,
+        privateStorageReadiness,
     };
 }
 const FIELD_LABELS = {

package/dist/org/actions/offboard-member.d.ts

@@ -1,5 +1,5 @@
 declare const _default: import("../../action.js").ActionDefinition<{
     email: string;
     transferTo: string;
-}, import("../../identity/offboard.js").OffboardMemberResult>;
+}, import("../index.js").OffboardMemberResult>;
 export default _default;

package/dist/org/index.d.ts

@@ -61,7 +61,7 @@ export declare const createSSOProviderHandler: import("h3").EventHandlerWithFetc
         redirectURI: string;
         spMetadataUrl: string;
     };
-    domainVerificationToken?: string | undefined;
+    domainVerificationToken?: string;
     registeredBy: string;
 }>>;
 export declare const verifySSOProviderHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
@@ -73,7 +73,7 @@ export declare const verifySSOProviderHandler: import("h3").EventHandlerWithFetc
         type: "oidc" | "saml";
         redirectURI: string;
         spMetadataUrl: string;
-    } | null;
+    };
 }>>;
 export declare const deleteSSOProviderHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     ok: boolean;
@@ -95,30 +95,13 @@ export declare const createSCIMHandler: import("h3").EventHandlerWithFetch<impor
     };
     token: string;
 }>>;
-export declare const deleteSCIMHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{}>>;
+export declare const deleteSCIMHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<unknown>>;
 export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     email: string;
-    orgId: string | null;
-    orgName: string | null;
-    role: import("./types.js").OrgRole | null;
-    icon: {
-        version: 1;
-        kind: "emoji";
-        emoji: string;
-    } | {
-        version: 1;
-        kind: "library";
-        library: "tabler";
-        name: string;
-        variant?: "filled" | "outline" | undefined;
-        color?: "blue" | "brown" | "gray" | "green" | "orange" | "pink" | "purple" | "red" | "yellow" | undefined;
-    } | {
-        version: 1;
-        kind: "image";
-        assetId: string;
-        authority: string;
-        alt?: string | undefined;
-    } | null;
+    orgId: string;
+    orgName: string;
+    role: import("./types.js").OrgRole;
+    icon: any;
     iconRevision: number;
     emailConfigured: boolean;
     access: {
@@ -144,15 +127,15 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
             kind: "library";
             library: "tabler";
             name: string;
-            variant?: "filled" | "outline" | undefined;
-            color?: "blue" | "brown" | "gray" | "green" | "orange" | "pink" | "purple" | "red" | "yellow" | undefined;
+            variant?: "filled" | "outline";
+            color?: "blue" | "brown" | "gray" | "green" | "orange" | "pink" | "purple" | "red" | "yellow";
         } | {
             version: 1;
             kind: "image";
             assetId: string;
             authority: string;
-            alt?: string | undefined;
-        } | null;
+            alt?: string;
+        };
         iconRevision: number;
     }[];
     pendingRemovals: {
@@ -169,18 +152,18 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
         orgId: string;
         orgName: string;
     }[];
-    allowedDomain: string | null;
-    workspaceUrl: string | null;
+    allowedDomain: string;
+    workspaceUrl: string;
     requiredAuthProvider: import("./types.js").RequiredAuthProvider;
     workspaceAppDefaultVisibility: import("./types.js").WorkspaceAppDefaultVisibility;
-    signInMethods: import("./sign-in-methods.js").OrgSignInMethods | undefined;
-    a2aSecretSet: boolean | undefined;
-    soloDeploymentAdmin: boolean | undefined;
+    signInMethods: import("./sign-in-methods.js").OrgSignInMethods;
+    a2aSecretSet: boolean;
+    soloDeploymentAdmin: boolean;
 }>>;
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    name?: undefined;
     success: boolean;
     id?: undefined;
+    name?: undefined;
     role?: undefined;
 } | {
     success?: undefined;
@@ -193,10 +176,6 @@ export declare const updateOrgHandler: import("h3").EventHandlerWithFetch<import
     name: any;
 }>>;
 export declare const switchOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    orgId: string | null;
-    orgName: string | null;
-    role: import("./types.js").OrgRole | null;
-} | {
     orgId: any;
     orgName: string;
     role: import("./types.js").OrgRole;
@@ -206,12 +185,12 @@ export declare const listMembersHandler: import("h3").EventHandlerWithFetch<impo
         email: string;
         role: import("./types.js").OrgRole;
         joinedAt: number;
-        name?: string | undefined;
-        image: string | null;
+        name?: string;
+        image: string;
     }[];
     totalCount: number;
     hasMore: boolean;
-    nextOffset: number | null;
+    nextOffset: number;
 }>>;
 export declare const removeMemberHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     success: boolean;
@@ -243,7 +222,7 @@ export declare const acceptInvitationHandler: import("h3").EventHandlerWithFetch
 }>>;
 export declare const setA2ASecretHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     a2aSecret: any;
-    previousSecret: string | null;
+    previousSecret: string;
 }>>;
 export declare const syncA2ASecretHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     total: number;
@@ -272,41 +251,24 @@ export declare const setWorkspaceAppDefaultVisibilityHandler: import("h3").Event
 }>>;
 export declare const setOrgVisualIdentityHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     orgId: string;
-    icon: {
-        version: 1;
-        kind: "emoji";
-        emoji: string;
-    } | {
-        version: 1;
-        kind: "library";
-        library: "tabler";
-        name: string;
-        variant?: "filled" | "outline" | undefined;
-        color?: "blue" | "brown" | "gray" | "green" | "orange" | "pink" | "purple" | "red" | "yellow" | undefined;
-    } | {
-        version: 1;
-        kind: "image";
-        assetId: string;
-        authority: string;
-        alt?: string | undefined;
-    } | null;
+    icon: any;
     iconRevision: number;
     syncPending: boolean;
 }>>;
 export declare const listAppRolesHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     appId: string;
     roles: readonly string[];
-    defaultRole: string | null;
+    defaultRole: string;
     roleLabels: Partial<Record<string, string>>;
     permissions: Partial<Record<string, readonly string[]>>;
     canManage: boolean;
     assignments: {
-        email: string;
         roles: string[];
-        role: string | null;
+        role: string;
+        email: string;
     }[];
     myRoles: string[];
-    myRole: string | null;
+    myRole: string;
 }>>;
 export declare const setAppRoleHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     appId: string;

package/dist/private-blob/attachment-ref.d.ts

@@ -71,6 +71,7 @@ export declare function attachmentOwnerKey(email: string): string;
 export declare function isAttachmentRef(value: unknown): value is AttachmentRef;
 /** Retryable means the same ref can succeed later; nothing else qualifies. */
 export declare function isRetryableAttachmentFailure(failure: AttachmentFailure): failure is StorageUnavailable;
+export declare function isAttachmentEncryptionKeyAvailable(): boolean;
 export declare function mintAttachmentRef(input: {
     data: Uint8Array | Buffer;
     filename: string;

package/dist/private-blob/attachment-ref.js

@@ -132,7 +132,7 @@ function unsealDescriptor(sealed) {
     ]);
     return inflateRawSync(deflated).toString("utf8");
 }
-function encryptionKeyAvailable() {
+export function isAttachmentEncryptionKeyAvailable() {
     try {
         getSecretEncryptionKey();
         return true;
@@ -145,7 +145,7 @@ function encryptionKeyAvailable() {
 }
 export async function mintAttachmentRef(input) {
     const filename = path.basename(input.filename);
-    if (!encryptionKeyAvailable()) {
+    if (!isAttachmentEncryptionKeyAvailable()) {
         const failure = storageUnavailable("encryption_key_unavailable", filename);
         logFailure("mint", failure);
         return failure;
@@ -221,7 +221,7 @@ function openDescriptor(ref, scope) {
     const prefix = Object.keys(DESCRIPTOR_KINDS).find((candidate) => ref.startsWith(candidate));
     if (!prefix)
         return { status: "malformed", reason: "unrecognized_scheme" };
-    if (!encryptionKeyAvailable()) {
+    if (!isAttachmentEncryptionKeyAvailable()) {
         return storageUnavailable("encryption_key_unavailable");
     }
     let parsed;

package/dist/private-blob/index.d.ts

@@ -1,8 +1,9 @@
 export type { PrivateBlobDeleteResult, PrivateBlobHandle, PrivateBlobMetadata, PrivateBlobProvider, PrivateBlobPutInput, PrivateBlobReadResult, } from "./types.js";
 export type { AttachmentFailure, AttachmentFile, AttachmentRef, AttachmentResolution, AttachmentScope, DeleteAttachmentResult, MintAttachmentResult, StorageFixer, StorageUnavailable, StorageUnavailableReason, } from "./attachment-ref.js";
-export { ATTACHMENT_REF_MAX_CHARS, ATTACHMENT_REF_PREFIX, LEGACY_SLIDES_UPLOAD_REF_PREFIX, attachmentOwnerKey, deleteAttachment, isAttachmentRef, isRetryableAttachmentFailure, mintAttachmentRef, resolveAttachment, } from "./attachment-ref.js";
+export { ATTACHMENT_REF_MAX_CHARS, ATTACHMENT_REF_PREFIX, LEGACY_SLIDES_UPLOAD_REF_PREFIX, attachmentOwnerKey, deleteAttachment, isAttachmentRef, isAttachmentEncryptionKeyAvailable, isRetryableAttachmentFailure, mintAttachmentRef, resolveAttachment, } from "./attachment-ref.js";
 export type { AttachmentErrorCode, AttachmentFailureDescription, AttachmentFailureDetails, AttachmentOperation, } from "./attachment-errors.js";
 export { ATTACHMENT_ERROR_CODES, AttachmentStorageUnavailableError, AttachmentUnavailableError, attachmentFailureDetails, attachmentFailureToError, describeAttachmentFailure, isAttachmentError, unwrapAttachment, } from "./attachment-errors.js";
 export type { PrivateBlobFailureKind } from "./errors.js";
 export { PrivateBlobError, isPrivateBlobError } from "./errors.js";
-export { deletePrivateBlob, getActivePrivateBlobProvider, getActivePrivateBlobProviderForRequest, isPrivateBlobConfiguredForRequest, listPrivateBlobProviders, putPrivateBlob, readPrivateBlob, registerPrivateBlobProvider, setPrivateBlobPublicUploadFallbackEnabled, unregisterPrivateBlobProvider, } from "./registry.js";
+export { deletePrivateBlob, getActivePrivateBlobProvider, getActivePrivateBlobProviderForRequest, getPrivateBlobStorageReadinessForRequest, isPrivateBlobConfiguredForRequest, listPrivateBlobProviders, putPrivateBlob, readPrivateBlob, registerPrivateBlobProvider, setPrivateBlobPublicUploadFallbackEnabled, unregisterPrivateBlobProvider, } from "./registry.js";
+export type { PrivateBlobStorageReadiness } from "./registry.js";

package/dist/private-blob/index.js

@@ -1,4 +1,4 @@
-export { ATTACHMENT_REF_MAX_CHARS, ATTACHMENT_REF_PREFIX, LEGACY_SLIDES_UPLOAD_REF_PREFIX, attachmentOwnerKey, deleteAttachment, isAttachmentRef, isRetryableAttachmentFailure, mintAttachmentRef, resolveAttachment, } from "./attachment-ref.js";
+export { ATTACHMENT_REF_MAX_CHARS, ATTACHMENT_REF_PREFIX, LEGACY_SLIDES_UPLOAD_REF_PREFIX, attachmentOwnerKey, deleteAttachment, isAttachmentRef, isAttachmentEncryptionKeyAvailable, isRetryableAttachmentFailure, mintAttachmentRef, resolveAttachment, } from "./attachment-ref.js";
 export { ATTACHMENT_ERROR_CODES, AttachmentStorageUnavailableError, AttachmentUnavailableError, attachmentFailureDetails, attachmentFailureToError, describeAttachmentFailure, isAttachmentError, unwrapAttachment, } from "./attachment-errors.js";
 export { PrivateBlobError, isPrivateBlobError } from "./errors.js";
-export { deletePrivateBlob, getActivePrivateBlobProvider, getActivePrivateBlobProviderForRequest, isPrivateBlobConfiguredForRequest, listPrivateBlobProviders, putPrivateBlob, readPrivateBlob, registerPrivateBlobProvider, setPrivateBlobPublicUploadFallbackEnabled, unregisterPrivateBlobProvider, } from "./registry.js";
+export { deletePrivateBlob, getActivePrivateBlobProvider, getActivePrivateBlobProviderForRequest, getPrivateBlobStorageReadinessForRequest, isPrivateBlobConfiguredForRequest, listPrivateBlobProviders, putPrivateBlob, readPrivateBlob, registerPrivateBlobProvider, setPrivateBlobPublicUploadFallbackEnabled, unregisterPrivateBlobProvider, } from "./registry.js";

package/dist/private-blob/registry.d.ts

@@ -5,6 +5,11 @@ export declare function listPrivateBlobProviders(): PrivateBlobProvider[];
 export declare function getActivePrivateBlobProvider(): PrivateBlobProvider | null;
 export declare function getActivePrivateBlobProviderForRequest(): Promise<PrivateBlobProvider | null>;
 export declare function isPrivateBlobConfiguredForRequest(): Promise<boolean>;
+export interface PrivateBlobStorageReadiness {
+    configured: boolean;
+    providerId: string | null;
+}
+export declare function getPrivateBlobStorageReadinessForRequest(): Promise<PrivateBlobStorageReadiness>;
 export declare function setPrivateBlobPublicUploadFallbackEnabled(enabled: boolean): void;
 export declare function putPrivateBlob(input: PrivateBlobPutInput): Promise<PrivateBlobHandle | null>;
 export declare function readPrivateBlob(handle: PrivateBlobHandle): Promise<PrivateBlobReadResult>;

package/dist/private-blob/registry.js

@@ -1,6 +1,6 @@
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { getAppConfig } from "../app-config/index.js";
-import { deleteUploadedFile, getActiveFileUploadProviderForRequest, uploadFile, } from "../file-upload/index.js";
+import { deleteUploadedFile, getActiveFileUploadProviderForRequest, uploadFile, } from "../file-upload/registry.js";
 import { decryptSecretValue, encryptSecretValue, getSecretEncryptionKey, } from "../secrets/crypto.js";
 import { PrivateBlobError } from "./errors.js";
 const PUBLIC_UPLOAD_HANDLE_PREFIX = "public-upload:v1:";
@@ -240,13 +240,22 @@ export async function getActivePrivateBlobProviderForRequest() {
     return null;
 }
 export async function isPrivateBlobConfiguredForRequest() {
-    if (await getActivePrivateBlobProviderForRequest())
-        return true;
-    if (!publicUploadFallbackRef.enabled)
-        return false;
-    if (!getAppConfig().privateBlob.publicUploadFallback)
-        return false;
-    return Boolean(await getActiveFileUploadProviderForRequest());
+    return (await getPrivateBlobStorageReadinessForRequest()).configured;
+}
+export async function getPrivateBlobStorageReadinessForRequest() {
+    const privateProvider = await getActivePrivateBlobProviderForRequest();
+    if (privateProvider) {
+        return { configured: true, providerId: privateProvider.id };
+    }
+    if (!publicUploadFallbackRef.enabled ||
+        !getAppConfig().privateBlob.publicUploadFallback) {
+        return { configured: false, providerId: null };
+    }
+    const uploadProvider = await getActiveFileUploadProviderForRequest();
+    return {
+        configured: Boolean(uploadProvider),
+        providerId: uploadProvider?.id ?? null,
+    };
 }
 export function setPrivateBlobPublicUploadFallbackEnabled(enabled) {
     publicUploadFallbackRef.enabled = enabled;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,10 +75,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    provider?: undefined;
-    id?: undefined;
-    deleted?: undefined;
     message?: undefined;
+    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -89,45 +87,47 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    found?: undefined;
+    provider?: undefined;
+    deleted?: undefined;
     registered?: undefined;
+    id?: undefined;
     label?: undefined;
 } | {
-    id?: undefined;
     count?: undefined;
-    deleted?: undefined;
     message?: undefined;
     providers?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
+    deleted?: undefined;
     registered?: undefined;
+    id?: undefined;
     label?: undefined;
 } | {
-    provider?: undefined;
     count?: undefined;
-    deleted?: undefined;
     message?: undefined;
     providers?: undefined;
+    provider?: undefined;
     found: boolean;
     id: string;
+    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
 } | {
-    provider?: undefined;
     count?: undefined;
     message?: undefined;
-    providers?: undefined;
     found?: undefined;
+    providers?: undefined;
+    provider?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
 } | {
-    provider?: undefined;
     count?: undefined;
-    deleted?: undefined;
-    providers?: undefined;
     found?: undefined;
+    providers?: undefined;
+    provider?: undefined;
+    deleted?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,9 +311,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        message?: undefined;
         id?: undefined;
-        deleted?: undefined;
+        message?: undefined;
+        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -325,45 +325,45 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         }[];
         count: number;
         provider?: undefined;
-        found?: undefined;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
     } | {
-        message?: undefined;
         id?: undefined;
-        deleted?: undefined;
-        count?: undefined;
+        message?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
     } | {
         message?: undefined;
-        deleted?: undefined;
-        count?: undefined;
         providers?: undefined;
+        count?: undefined;
         provider?: undefined;
         found: boolean;
         id: string;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
     } | {
         message?: undefined;
-        count?: undefined;
+        found?: undefined;
         providers?: undefined;
+        count?: undefined;
         provider?: undefined;
-        found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
     } | {
-        deleted?: undefined;
-        count?: undefined;
+        found?: undefined;
         providers?: undefined;
+        count?: undefined;
         provider?: undefined;
-        found?: undefined;
+        deleted?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/secrets/routes.d.ts

@@ -73,32 +73,32 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     status?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     errorCode?: undefined;
     retryable?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     error: string;
     removed?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
     note?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -126,11 +126,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-default-model-route.d.ts

@@ -9,16 +9,16 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    scope?: undefined;
     ok?: undefined;
+    scope?: undefined;
 } | {
     ok: boolean;
     error: any;
     scope?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     scope: "org" | "user";
-    error?: undefined;
 }>>;
 export interface DefaultModelSelectionRequest {
     engine: string;

package/dist/server/core-routes-plugin.d.ts

@@ -584,8 +584,8 @@ export declare function createPublicRemoteAgentsHandler(discover?: PublicAgentDi
     error: string;
     agents?: undefined;
 } | {
-    agents: Omit<import("./agent-discovery.js").DiscoveredAgent, "auth" | "kind">[];
     error?: undefined;
+    agents: Omit<import("./agent-discovery.js").DiscoveredAgent, "auth" | "kind">[];
 }>>;
 export declare function getBuilderConnectErrorDisposition(error: unknown, connectAttemptId: string | null): "correlated" | "legacy" | null;
 export declare function getBuilderConnectErrorKey(ownerEmail: string, connectAttemptId?: string | null): string;

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;

package/dist/triggers/actions/manage-automation.d.ts

@@ -29,10 +29,10 @@ declare const _default: import("../../action.js").ActionDefinition<{
     executionEngine?: undefined;
     executionCwd?: undefined;
 } | {
+    scope?: undefined;
     enabled?: undefined;
     nextRun?: undefined;
     created?: undefined;
-    scope?: undefined;
     triggerType?: undefined;
     event?: undefined;
     deleted: boolean;
@@ -45,9 +45,9 @@ declare const _default: import("../../action.js").ActionDefinition<{
     executionCwd?: undefined;
     webhookPath?: undefined;
 } | {
+    scope?: undefined;
     deleted?: undefined;
     created?: undefined;
-    scope?: undefined;
     triggerType?: undefined;
     event?: undefined;
     name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.207.1-nightly-20261012070747",
+  "version": "0.207.1",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -694,8 +694,8 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.207.1-nightly-20261012070747",
-    "@agent-native/recap-cli": "^0.5.69"
+    "@agent-native/agentkit": "^0.207.1",
+    "@agent-native/recap-cli": "^0.5.70"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",
@@ -765,7 +765,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": "0.207.1-nightly-20261012070747",
+    "@agent-native/core-corpus": ">=0.196.0",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",