@agent-native/core 0.208.0 → 0.209.0-nightly-20261014070126

package/dist/provider-api/index.js

@@ -195,10 +195,12 @@ const PROVIDER_CONFIGS = {
                 "https://www.googleapis.com/auth/cloud-platform",
                 "https://www.googleapis.com/auth/bigquery",
             ],
+            oauthProvider: "google",
+            workspaceProvider: "bigquery",
         },
         credentialKeys: [
-            "GOOGLE_APPLICATION_CREDENTIALS_JSON",
             "BIGQUERY_PROJECT_ID",
+            "GOOGLE_APPLICATION_CREDENTIALS_JSON",
         ],
         docsUrls: ["https://cloud.google.com/bigquery/docs/reference/rest"],
         specUrls: ["https://bigquery.googleapis.com/$discovery/rest?version=v2"],
@@ -1564,11 +1566,21 @@ export async function resolveProviderApiOAuthAccessToken(args, runtime) {
                     tokenLabel: auth.tokenLabel,
                     workspaceProvider: auth.workspaceProvider,
                 }
-                : null;
+                : auth.type === "google-service-account" && auth.oauthProvider
+                    ? {
+                        type: "oauth-bearer",
+                        oauthProvider: auth.oauthProvider,
+                        tokenLabel: "Google OAuth token",
+                        workspaceProvider: auth.workspaceProvider,
+                    }
+                    : null;
     if (!oauthAuth) {
         throw new Error(`Provider API ${args.provider} does not use a direct OAuth bearer token.`);
     }
     const ctx = requireRuntimeCredentialContext(runtime, config.credentialKeys[0] ?? config.id);
+    if (args.provider === "bigquery" && ctx.credentialScope === "org") {
+        throw new Error("Personal BigQuery OAuth is unavailable for org-only credential scope.");
+    }
     const credential = oauthAuth.workspaceProvider
         ? await resolveOptionalConnectionBoundOAuthBearerToken({
             auth: oauthAuth,
@@ -2966,6 +2978,45 @@ async function resolveAuth(config, runtime, ctx, args, endpoint) {
         };
     }
     if (auth.type === "google-service-account") {
+        if (auth.oauthProvider &&
+            auth.workspaceProvider &&
+            !(auth.workspaceProvider === "bigquery" && ctx.credentialScope === "org")) {
+            let oauthCredential;
+            try {
+                oauthCredential = await resolveOptionalConnectionBoundOAuthBearerToken({
+                    auth: {
+                        type: "oauth-bearer",
+                        oauthProvider: auth.oauthProvider,
+                        tokenLabel: "Google OAuth token",
+                        workspaceProvider: auth.workspaceProvider,
+                    },
+                    runtime,
+                    ctx,
+                    workspaceProvider: auth.workspaceProvider,
+                    connectionId: args.connectionId,
+                    accountId: args.accountId,
+                });
+            }
+            catch (error) {
+                if (auth.workspaceProvider !== "bigquery" ||
+                    !(error instanceof AgentConnectionRequiredError) ||
+                    error.provider !== "bigquery" ||
+                    error.reason !== "reauthorize") {
+                    throw error;
+                }
+                if (args.connectionId?.trim() || args.accountId?.trim()) {
+                    throw error;
+                }
+                oauthCredential = null;
+            }
+            if (oauthCredential) {
+                return {
+                    headers: { Authorization: `Bearer ${oauthCredential.value}` },
+                    credentialSources: [omitCredentialValue(oauthCredential)],
+                    secretValues: [oauthCredential.value],
+                };
+            }
+        }
         const token = await getGoogleServiceAccountToken(auth.scopes, runtime, ctx);
         return {
             headers: { Authorization: `Bearer ${token}` },
@@ -3471,13 +3522,33 @@ async function resolveOAuthBearerToken(options) {
         throw new Error(`${options.auth.tokenLabel} account ${requestedAccountId} is not available to ${ownerEmail}.`);
     }
     const tokens = account.tokens;
-    const token = await getValidOAuthAccessToken({
-        oauthProvider: options.auth.oauthProvider,
-        accountId: account.accountId,
-        ownerEmail,
-        tokens,
-        salesforceLoginUrl: options.salesforceLoginUrl,
-    });
+    const preserveSharedGoogleGrant = options.auth.oauthProvider === "google" &&
+        Boolean(options.auth.workspaceProvider);
+    let token;
+    try {
+        token = await getValidOAuthAccessToken({
+            oauthProvider: options.auth.oauthProvider,
+            accountId: account.accountId,
+            ownerEmail,
+            tokens,
+            preserveTokensOnPermanentFailure: preserveSharedGoogleGrant,
+            salesforceLoginUrl: options.salesforceLoginUrl,
+        });
+    }
+    catch (error) {
+        if (preserveSharedGoogleGrant &&
+            options.auth.workspaceProvider &&
+            isPermanentGoogleOAuthRefreshFailure(error)) {
+            return throwWorkspaceConnectionRequired({
+                runtime: options.runtime,
+                provider: options.auth.workspaceProvider,
+                connectionId: options.connectionId,
+                message: `${options.auth.tokenLabel} requires an available workspace connection.`,
+                reason: "reauthorize",
+            });
+        }
+        throw error;
+    }
     return {
         key: `${options.auth.oauthProvider.toUpperCase()}_OAUTH_TOKEN`,
         value: token,
@@ -3535,24 +3606,37 @@ async function throwWorkspaceConnectionRequired(options) {
 }
 async function resolveOptionalConnectionBoundOAuthBearerToken(options) {
     const requestedConnectionId = options.connectionId?.trim();
+    const requestedAccountId = options.accountId?.trim();
     let resolved;
     try {
         resolved = await resolveWorkspaceConnectionForApp({
             appId: options.runtime.appId,
             provider: options.workspaceProvider,
             connectionId: requestedConnectionId,
+            accountId: requestedAccountId,
+            ...(options.workspaceProvider === "bigquery"
+                ? { connectionOwnerEmail: options.ctx.userEmail }
+                : {}),
             requireConnected: true,
         });
     }
     catch (error) {
         if (error instanceof Error &&
             error.message === "Workspace connections require an authenticated user.") {
+            if (requestedConnectionId || requestedAccountId) {
+                return throwWorkspaceConnectionRequired({
+                    runtime: options.runtime,
+                    provider: options.workspaceProvider,
+                    connectionId: requestedConnectionId,
+                    message: "Sign in to use the selected workspace connection.",
+                });
+            }
             return null;
         }
         throw error;
     }
     if (!resolved.available || !resolved.connection) {
-        if (requestedConnectionId) {
+        if (requestedConnectionId || requestedAccountId) {
             return throwWorkspaceConnectionRequired({
                 runtime: options.runtime,
                 provider: options.workspaceProvider,
@@ -3578,9 +3662,8 @@ async function resolveOptionalConnectionBoundOAuthBearerToken(options) {
             return null;
         throw new Error(`${options.auth.tokenLabel} workspace connection ${resolved.connection.id} is missing its OAuth account binding.`);
     }
-    const requestedAccountId = options.accountId?.trim();
     if (requestedAccountId && requestedAccountId !== connectionAccountId) {
-        throw new Error(`${options.auth.tokenLabel} account ${requestedAccountId} does not match workspace connection ${requestedConnectionId}.`);
+        throw new Error(`${options.auth.tokenLabel} account binding does not match the requested workspace connection.`);
     }
     const credential = await resolveOAuthBearerToken({
         auth: options.auth,

package/dist/resources/handlers.d.ts

@@ -39,8 +39,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
     error: string;
 }>;
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/agent-engine-default-model-route.d.ts

@@ -8,17 +8,17 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  * resolveEngine's credential detection.
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     scope?: undefined;
-    ok?: undefined;
 } | {
     ok: boolean;
     error: any;
     scope?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     scope: "org" | "user";
-    error?: undefined;
 }>>;
 export interface DefaultModelSelectionRequest {
     engine: string;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -3,7 +3,7 @@ export declare function createAgentEngineOllamaModelsHandler(): import("h3").Eve
     models?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     models: string[];
+    error?: undefined;
 }>>;

package/dist/server/auth.js

@@ -2395,6 +2395,7 @@ function isWorkspaceGoogleOAuthProvider(provider) {
         provider === "google_calendar" ||
         provider === "google_docs" ||
         provider === "google_drive" ||
+        provider === "bigquery" ||
         provider === "google_sheets" ||
         provider === "google_slides");
 }

package/dist/server/core-routes-plugin.js

@@ -2391,6 +2391,7 @@ export function createCoreRoutesPlugin(options = {}) {
                 "google_calendar",
                 "google_docs",
                 "google_drive",
+                "bigquery",
                 "google_sheets",
                 "google_slides",
                 "github",

package/dist/server/index.d.ts

@@ -1,6 +1,7 @@
 export { readComposerWebsiteSource, type ComposerWebsiteExtraction, } from "./composer-website-source.js";
 export { isAgentKitFigmaSourceAvailable, listAgentKitCapabilities, readAgentKitIntegrationIntent, type AgentKitCapabilityAppId, type AgentKitCapabilityCatalog, type AgentKitIntegrationCapability, } from "../agentkit/capabilities.js";
 export { defineAppConfig, getAppConfig, resolveAppHomePath, resetAppConfigForTests, appConfigSchema, type AppConfig, type AppConfigInput, } from "../app-config/index.js";
+export { platformWaitUntil } from "./background-work.js";
 export { resolveDeployEnvironment } from "./deploy-environment.js";
 export { isTestIdentity, testIdentitySql } from "./test-identity.js";
 export { inferWorkspaceAppRootHomePath, readConfiguredWorkspaceAppHomePath, } from "../workspace-app-config.js";
@@ -16,7 +17,7 @@ export { createSSEHandler, type SSEHandlerOptions } from "./sse.js";
 export { isCredentialMembershipUnavailable } from "./credential-membership-unavailable.js";
 export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, isSessionResolutionUnavailable, getMcpOAuthBearerSession, logout, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, setFirstRunOnboardingCookie, clearFrameworkSessionCookies, runAuthGuard, registerDesktopExchange, prepareDesktopOAuthBrowserBinding, matchesDesktopOAuthBrowserBinding, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
 export { handleIdentitySso, ensureIdentityUser, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_BOOTSTRAP_ACTIVATE_PATH, IDENTITY_SSO_BOOTSTRAP_BINDING_COOKIE, clearIdentitySsoBootstrapBindingCookie, getIdentitySsoBootstrapBindingCookie, setIdentitySsoBootstrapBindingCookie, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
-export { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, hasGoogleAuthIdentity, setBetterAuthSessionCookie, } from "./better-auth-instance.js";
+export { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getBetterAuthUserIdForEmail, hasGoogleAuthIdentity, setBetterAuthSessionCookie, } from "./better-auth-instance.js";
 export { setIdentityGoogleAuthCookie } from "./identity-auth-provider.js";
 export { requireEnvKey, type MissingKeyResponse } from "./missing-key.js";
 export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";

package/dist/server/index.js

@@ -1,6 +1,7 @@
 export { readComposerWebsiteSource, } from "./composer-website-source.js";
 export { isAgentKitFigmaSourceAvailable, listAgentKitCapabilities, readAgentKitIntegrationIntent, } from "../agentkit/capabilities.js";
 export { defineAppConfig, getAppConfig, resolveAppHomePath, resetAppConfigForTests, appConfigSchema, } from "../app-config/index.js";
+export { platformWaitUntil } from "./background-work.js";
 export { resolveDeployEnvironment } from "./deploy-environment.js";
 export { isTestIdentity, testIdentitySql } from "./test-identity.js";
 export { inferWorkspaceAppRootHomePath, readConfiguredWorkspaceAppHomePath, } from "../workspace-app-config.js";
@@ -16,7 +17,7 @@ export { createSSEHandler } from "./sse.js";
 export { isCredentialMembershipUnavailable } from "./credential-membership-unavailable.js";
 export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, isSessionResolutionUnavailable, getMcpOAuthBearerSession, logout, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, setFirstRunOnboardingCookie, clearFrameworkSessionCookies, runAuthGuard, registerDesktopExchange, prepareDesktopOAuthBrowserBinding, matchesDesktopOAuthBrowserBinding, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
 export { handleIdentitySso, ensureIdentityUser, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_BOOTSTRAP_ACTIVATE_PATH, IDENTITY_SSO_BOOTSTRAP_BINDING_COOKIE, clearIdentitySsoBootstrapBindingCookie, getIdentitySsoBootstrapBindingCookie, setIdentitySsoBootstrapBindingCookie, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
-export { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, hasGoogleAuthIdentity, setBetterAuthSessionCookie, } from "./better-auth-instance.js";
+export { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getBetterAuthUserIdForEmail, hasGoogleAuthIdentity, setBetterAuthSessionCookie, } from "./better-auth-instance.js";
 export { setIdentityGoogleAuthCookie } from "./identity-auth-provider.js";
 export { requireEnvKey } from "./missing-key.js";
 export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;

package/dist/server/workspace-provider-oauth.d.ts

@@ -1,7 +1,7 @@
 import { type H3Event } from "h3";
 import { type WorkspaceConnectionProvider } from "../connections/catalog.js";
 import { type OAuthStatePayload } from "./google-oauth.js";
-export type GenericWorkspaceOAuthProvider = "figma" | "gmail" | "google_calendar" | "google_docs" | "google_drive" | "google_sheets" | "google_slides" | "github" | "hubspot" | "salesforce" | "jira" | "sentry" | "notion";
+export type GenericWorkspaceOAuthProvider = "figma" | "gmail" | "google_calendar" | "google_docs" | "google_drive" | "bigquery" | "google_sheets" | "google_slides" | "github" | "hubspot" | "salesforce" | "jira" | "sentry" | "notion";
 export type WorkspaceProviderOAuthScope = "user" | "organization" | "app";
 export declare function isWorkspaceProviderOAuthScope(value: unknown): value is WorkspaceProviderOAuthScope;
 export declare function isGoogleWorkspaceOAuthProvider(provider: string): boolean;

package/dist/server/workspace-provider-oauth.js

@@ -19,6 +19,7 @@ const SUPPORTED_PROVIDERS = new Set([
     "google_calendar",
     "google_docs",
     "google_drive",
+    "bigquery",
     "google_sheets",
     "google_slides",
     "github",
@@ -43,6 +44,7 @@ export function isGoogleWorkspaceOAuthProvider(provider) {
         provider === "google_calendar" ||
         provider === "google_docs" ||
         provider === "google_drive" ||
+        provider === "bigquery" ||
         provider === "google_sheets" ||
         provider === "google_slides");
 }

package/dist/shared/context-status.js

@@ -50,5 +50,5 @@ export const SELECTION_CONTEXT_UNAVAILABLE_NOTE = wrapNote("Selected text unavai
 /** `partial` when another source did deliver context this turn. */
 export function preloadedContextUnavailableNote(status, options = {}) {
     const reason = status === "timed_out" ? "timed out" : "failed";
-    return wrapNote(`${options.partial ? "Some preloaded context" : "Preloaded context"} was unavailable this turn (${reason}); search for anything relevant with the available tools before answering.`);
+    return wrapNote(`${options.partial ? "Some preloaded context" : "Preloaded context"} was unavailable this turn (${reason}); if the request depends on workspace knowledge, such as prior work, team docs, brand defaults, or people, search for it with the available tools before answering; otherwise continue without it.`);
 }

package/dist/shared/optional-peer-ssr.d.ts

@@ -0,0 +1,2 @@
+export declare const CORE_BUNDLED_INGESTION_OPTIONAL_PEERS: readonly ["fast-xml-parser", "jszip", "officeparser", "pdf-parse", "pdfjs-dist"];
+export declare function getMissingCoreOptionalPeers(cwd: string): string[];

package/dist/shared/optional-peer-ssr.js

@@ -0,0 +1,123 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+export const CORE_BUNDLED_INGESTION_OPTIONAL_PEERS = [
+    "fast-xml-parser",
+    "jszip",
+    "officeparser",
+    "pdf-parse",
+    "pdfjs-dist",
+];
+function isMissingFileError(error) {
+    return (error instanceof Error &&
+        "code" in error &&
+        typeof error.code === "string" &&
+        error.code === "ENOENT");
+}
+function findCorePackageRoot(cwd) {
+    const installedManifest = findDependencyManifestPath("@agent-native/core", cwd);
+    if (installedManifest) {
+        const manifest = JSON.parse(fs.readFileSync(installedManifest, "utf8"));
+        if (manifest.name === "@agent-native/core") {
+            return fs.realpathSync(path.dirname(installedManifest));
+        }
+    }
+    try {
+        const appPackage = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf8"));
+        const localCore = appPackage.dependencies?.["@agent-native/core"] ??
+            appPackage.devDependencies?.["@agent-native/core"];
+        if (localCore?.startsWith("file:")) {
+            const root = fileURLToPath(new URL(localCore, pathToFileURL(path.join(cwd, "package.json"))));
+            const manifestPath = path.join(root, "package.json");
+            if (fs.existsSync(manifestPath)) {
+                const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+                if (manifest.name === "@agent-native/core") {
+                    return fs.realpathSync(root);
+                }
+            }
+        }
+    }
+    catch (error) {
+        if (!isMissingFileError(error))
+            throw error;
+    }
+    for (const candidate of [
+        path.resolve(cwd, "packages/core"),
+        path.resolve(cwd, "../../packages/core"),
+        path.resolve(cwd, "../core"),
+    ]) {
+        const manifestPath = path.join(candidate, "package.json");
+        if (!fs.existsSync(manifestPath))
+            continue;
+        const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+        if (manifest.name === "@agent-native/core") {
+            return fs.realpathSync(candidate);
+        }
+    }
+    return null;
+}
+function findDependencyManifestPath(packageName, startDir) {
+    const packagePath = packageName.split("/");
+    let dir = path.resolve(startDir);
+    for (let i = 0; i < 20; i++) {
+        const candidate = path.join(dir, "node_modules", ...packagePath, "package.json");
+        if (fs.existsSync(candidate))
+            return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+function getRuntimeDependencyNames(cwd, coreRoot) {
+    const appPackage = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf8"));
+    const pending = [
+        ...Object.keys(appPackage.dependencies ?? {}),
+        ...Object.keys(appPackage.optionalDependencies ?? {}),
+        ...Object.keys(appPackage.peerDependencies ?? {}),
+    ].map((name) => ({ name, fromDir: cwd }));
+    const dependencies = new Set();
+    const visited = new Set();
+    while (pending.length > 0) {
+        const current = pending.pop();
+        const manifestPath = findDependencyManifestPath(current.name, current.fromDir);
+        if (!manifestPath)
+            continue;
+        if (findDependencyManifestPath(current.name, coreRoot)) {
+            dependencies.add(current.name);
+        }
+        const realManifestPath = fs.realpathSync(manifestPath);
+        if (visited.has(realManifestPath))
+            continue;
+        visited.add(realManifestPath);
+        const manifest = JSON.parse(fs.readFileSync(realManifestPath, "utf8"));
+        const packageDir = path.dirname(realManifestPath);
+        for (const name of [
+            ...Object.keys(manifest.dependencies ?? {}),
+            ...Object.keys(manifest.optionalDependencies ?? {}),
+        ]) {
+            pending.push({ name, fromDir: packageDir });
+        }
+        // A workspace-linked Core resolves its own dev-installed peers from coreRoot.
+        const peerFromDir = manifest.name === "@agent-native/core" ? cwd : packageDir;
+        for (const name of Object.keys(manifest.peerDependencies ?? {})) {
+            pending.push({ name, fromDir: peerFromDir });
+        }
+    }
+    return dependencies;
+}
+export function getMissingCoreOptionalPeers(cwd) {
+    const coreRoot = findCorePackageRoot(cwd);
+    if (!coreRoot)
+        return [];
+    const corePackage = JSON.parse(fs.readFileSync(path.join(coreRoot, "package.json"), "utf8"));
+    const runtimeDependencies = getRuntimeDependencyNames(cwd, coreRoot);
+    const bundledIngestionPeers = new Set(CORE_BUNDLED_INGESTION_OPTIONAL_PEERS);
+    return Object.entries(corePackage.peerDependenciesMeta ?? {})
+        .filter(([name, peer]) => peer.optional === true &&
+        !runtimeDependencies.has(name) &&
+        !bundledIngestionPeers.has(name))
+        .map(([name]) => name)
+        .sort();
+}

package/dist/shared/tool-inputs.d.ts

@@ -0,0 +1,2 @@
+export declare function toolInputsMatch(callInput: unknown, approvalInput: unknown): boolean;
+export declare function toolInputFingerprint(input: unknown): string | undefined;

package/dist/shared/tool-inputs.js

@@ -0,0 +1,56 @@
+export function toolInputsMatch(callInput, approvalInput) {
+    return (callInput !== null &&
+        approvalInput !== null &&
+        typeof callInput === "object" &&
+        typeof approvalInput === "object" &&
+        !Array.isArray(callInput) &&
+        !Array.isArray(approvalInput) &&
+        toolInputValuesMatch(callInput, approvalInput));
+}
+export function toolInputFingerprint(input) {
+    let serialized;
+    try {
+        serialized = JSON.stringify(input, (_key, value) => {
+            if (value && typeof value === "object" && !Array.isArray(value)) {
+                return Object.fromEntries(Object.keys(value)
+                    .sort()
+                    .map((key) => [key, value[key]]));
+            }
+            return value;
+        });
+    }
+    catch (error) {
+        if (error instanceof TypeError)
+            return undefined;
+        throw error;
+    }
+    if (serialized === undefined)
+        return undefined;
+    let hash = 0xcbf29ce484222325n;
+    for (let index = 0; index < serialized.length; index += 1) {
+        hash ^= BigInt(serialized.charCodeAt(index));
+        hash = BigInt.asUintN(64, hash * 0x100000001b3n);
+    }
+    return `fnv1a64:${hash.toString(16).padStart(16, "0")}`;
+}
+function toolInputValuesMatch(left, right) {
+    if (Object.is(left, right))
+        return true;
+    if (Array.isArray(left) || Array.isArray(right)) {
+        return (Array.isArray(left) &&
+            Array.isArray(right) &&
+            left.length === right.length &&
+            left.every((value, index) => toolInputValuesMatch(value, right[index])));
+    }
+    if (left === null ||
+        right === null ||
+        typeof left !== "object" ||
+        typeof right !== "object") {
+        return false;
+    }
+    const leftKeys = Object.keys(left);
+    const rightKeys = Object.keys(right);
+    return (leftKeys.length === rightKeys.length &&
+        leftKeys.every((key) => Object.hasOwn(right, key) &&
+            toolInputValuesMatch(left[key], right[key])));
+}

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -2,7 +2,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
 }, {
-    role?: undefined;
     ownerEmail: any;
     visibility: any;
     shares: any[];
@@ -12,6 +11,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
         supportsGroupShares?: boolean;
     };
     orgId?: undefined;
+    role?: undefined;
     agentReadable?: undefined;
 } | {
     ownerEmail: string;

package/dist/tracking/index.d.ts

@@ -1,5 +1,6 @@
 export { track, identify, flushTracking, registerTrackingProvider, unregisterTrackingProvider, listTrackingProviders, type TrackingMeta, type TrackingSource, } from "./registry.js";
 export { registerBuiltinProviders } from "./providers.js";
+export { readAnalyticsAnonymousId } from "../server/attribution.js";
 export { AGENT_NATIVE_ACTION_EVENTS, AGENT_NATIVE_LIFECYCLE_EVENTS, trackActionEvent, trackLifecycleEvent, type AgentNativeActionEventName, type AgentNativeLifecycleEventName, } from "./lifecycle.js";
 export { captureException, type TrackingExceptionContext, type TrackingExceptionLevel, } from "./error-capture.js";
 export { classifyTrackingFailure, type TrackingFailureCategory, } from "./failure-category.js";

package/dist/tracking/index.js

@@ -1,5 +1,6 @@
 export { track, identify, flushTracking, registerTrackingProvider, unregisterTrackingProvider, listTrackingProviders, } from "./registry.js";
 export { registerBuiltinProviders } from "./providers.js";
+export { readAnalyticsAnonymousId } from "../server/attribution.js";
 export { AGENT_NATIVE_ACTION_EVENTS, AGENT_NATIVE_LIFECYCLE_EVENTS, trackActionEvent, trackLifecycleEvent, } from "./lifecycle.js";
 export { captureException, } from "./error-capture.js";
 export { classifyTrackingFailure, } from "./failure-category.js";

package/dist/vite/client.js

@@ -22,6 +22,7 @@ import { EMBED_SESSION_COOKIE, EMBED_TOKEN_QUERY_PARAM, MCP_APP_CHAT_BRIDGE_QUER
 import { FRAMEWORK_INTERNAL_ROUTE_PREFIX, matchesPathPrefix, normalizeFrameworkRoutePrefix, } from "../shared/framework-route-prefix.js";
 import { isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, MCP_EMBED_STATIC_ASSET_HEADERS, mcpEmbedStaticAssetRouteRules, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
 import { normalizeMcpIntegrationsConfig, } from "../shared/mcp-integration-config.js";
+import { getMissingCoreOptionalPeers } from "../shared/optional-peer-ssr.js";
 import { isMissingPeer } from "../shared/optional-peer.js";
 import { normalizeAgentNativeRouteWarmupConfig, } from "../shared/route-warmup-config.js";
 import { AGENT_NATIVE_TYPEGEN_ENV, formatRuntimeConfigReport, getRuntimeConfigReport, isTruthyRuntimeValue, } from "../shared/runtime-config.js";
@@ -2229,6 +2230,41 @@ function ssrStubPlugin(packages) {
         },
     };
 }
+function toolkitTablerIconSsrStubPlugin(cwd) {
+    const toolkitRoot = findToolkitPackageRoot(cwd);
+    if (!toolkitRoot)
+        return null;
+    const catalogPaths = new Set([
+        path.join(toolkitRoot, "src/icons/catalog.ts"),
+        path.join(toolkitRoot, "dist/icons/catalog.js"),
+    ]
+        .filter((catalogPath) => fs.existsSync(catalogPath))
+        .map((catalogPath) => fs.realpathSync(catalogPath)));
+    const stubId = "\0agent-native-toolkit-tabler-chunk-loaders-ssr";
+    return {
+        name: "agent-native-toolkit-tabler-chunk-loaders-ssr",
+        enforce: "pre",
+        resolveId(id, importer, options) {
+            if (!options?.ssr || id !== "./tabler-chunk-loaders.js" || !importer) {
+                return null;
+            }
+            const importerPath = path.resolve(importer.split("?")[0]);
+            if (!fs.existsSync(importerPath) ||
+                !catalogPaths.has(fs.realpathSync(importerPath))) {
+                return null;
+            }
+            return stubId;
+        },
+        load(id) {
+            if (id !== stubId)
+                return null;
+            return [
+                'const unavailable = () => { throw new Error("Tabler icons are available only in the browser"); };',
+                "export default unavailable;",
+            ].join("\n");
+        },
+    };
+}
 function enterpriseAuthAdapterStubPlugin(enabled) {
     if (enabled)
         return null;
@@ -3613,6 +3649,7 @@ function createAgentNativePlugins(options, { command, includeReactTransform, use
             ...(options.ssrStubs ?? []),
         ]),
         enterpriseAuthAdapterStubPlugin(enterpriseAuthAdaptersEnabled),
+        toolkitTablerIconSsrStubPlugin(cwd),
         clientOptionalPeerStubPlugin(cwd),
         ...userPlugins,
         externalStoreShimPlugin(),
@@ -3696,8 +3733,12 @@ function reportRuntimeConfigDiagnostics(appConfig, context, mode, env = process.
     }
     console.warn(message);
 }
-function createAgentNativeConfig(options = {}, command, userConfig = {}, mode = process.env.NODE_ENV === "production" ? "production" : "development", projectConfig, workspaceConfig) {
+function createAgentNativeConfig(options = {}, command, userConfig = {}, mode = process.env.NODE_ENV === "production" ? "production" : "development", projectConfig, workspaceConfig, isSsrBuild = false) {
     const cwd = process.cwd();
+    const optionalSsrExternals = isBuildCommand(command)
+        ? getMissingCoreOptionalPeers(cwd)
+        : [];
+    const optionalBuildExternals = isSsrBuild ? optionalSsrExternals : [];
     const usesAgentKit = hasDep("@agent-native/agentkit", cwd);
     const configContext = createAgentNativeConfigContext(command, mode);
     const projectConfigInput = projectConfig ?? options.agentNativeConfig;
@@ -3894,8 +3935,9 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
         build: {
             ...userBuild,
             rolldownOptions: {
+                external: optionalBuildExternals,
                 experimental: {
-                    lazyBarrel: userConfig.build?.rolldownOptions?.experimental?.lazyBarrel ?? true,
+                    lazyBarrel: _buildRolldownOptions?.experimental?.lazyBarrel ?? true,
                 },
             },
             outDir: options.outDir ?? userConfig.build?.outDir ?? "dist/spa",
@@ -3911,6 +3953,7 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
                 ...(userConfig.ssr ?? {}),
                 noExternal: /^(?!(?:react|react-dom|react-router|@tanstack\/react-query)(?:\/|$))(?!node:)/,
                 external: [
+                    ...optionalSsrExternals,
                     "yjs",
                     "@agent-native/core",
                     "react",
@@ -4015,7 +4058,7 @@ function createAgentNativeConfigPlugin(options) {
             const workspaceConfig = await loadWorkspaceAgentNativeConfigFile(process.cwd());
             const projectConfig = options.agentNativeConfig ??
                 (await loadAgentNativeConfigFile(process.cwd()));
-            return createAgentNativeConfig(options, env.command, config, env.mode, projectConfig, workspaceConfig);
+            return createAgentNativeConfig(options, env.command, config, env.mode, projectConfig, workspaceConfig, env.isSsrBuild === true);
         },
     };
 }