@agent-native/core 0.209.1 → 0.209.2-nightly-20261016005836

package/dist/agent/actions/list-model-providers.js

@@ -6,6 +6,7 @@ import { secretKeyNames } from "../../secrets/key-aliases.js";
 import { readAppSecrets, } from "../../secrets/storage.js";
 import { readProviderCredentialRejections } from "../../server/credential-provider.js";
 import { isPersonalProviderKeyUseRestricted, readOrgMemberRole, } from "../../server/personal-provider-key-policy.js";
+import { getRequestContext } from "../../server/request-context.js";
 import { readDefaultAgentEngineSettingDetailed, resolveDefaultAgentEngineAuthority, } from "../default-agent-engine.js";
 import { registerBuiltinEngines } from "../engine/builtin.js";
 import { getAgentEngineEntry, isDeploymentEngineUsableForRequest, } from "../engine/registry.js";
@@ -130,8 +131,20 @@ export default defineAction({
             orgId
                 ? isPersonalProviderKeyUseRestricted({ email, orgId, role })
                 : Promise.resolve(false),
-            readDefaultAgentEngineSettingDetailed({ userEmail: email, orgId }),
-            resolveDefaultAgentEngineAuthority({ userEmail: email, orgId }),
+            readDefaultAgentEngineSettingDetailed({
+                userEmail: email,
+                orgId,
+                ...(getRequestContext()?.orgScope === "personal"
+                    ? { orgScope: "personal" }
+                    : {}),
+            }),
+            resolveDefaultAgentEngineAuthority({
+                userEmail: email,
+                orgId,
+                ...(getRequestContext()?.orgScope === "personal"
+                    ? { orgScope: "personal" }
+                    : {}),
+            }),
             Promise.all(AGENT_PROVIDER_CATALOG.map(async (option) => {
                 const engine = getAgentEngineEntry(option.engine);
                 return [

package/dist/agent/app-model-defaults.d.ts

@@ -7,6 +7,11 @@ export interface AgentAppModelDefaultSelection {
     updatedAt?: number;
     updatedBy?: string;
 }
+export interface AgentAppModelDefaultContext {
+    userEmail?: string | null;
+    orgId?: string | null;
+    orgScope?: "personal";
+}
 export interface AgentAppModelDefaultSettings {
     appId: string;
     engine: string | null;
@@ -16,21 +21,12 @@ export interface AgentAppModelDefaultSettings {
 }
 export declare function normalizeAgentAppModelDefaultAppId(appId: string | null | undefined): string | null;
 export declare function agentAppModelDefaultSettingsKey(appId: string): string;
-export declare function readAgentAppModelDefaultSettings(ctx: {
-    userEmail?: string | null;
-    orgId?: string | null;
-}, appIdInput: string | null | undefined): Promise<AgentAppModelDefaultSettings>;
-export declare function writeAgentAppModelDefaultSettings(ctx: {
-    userEmail?: string | null;
-    orgId?: string | null;
-}, appIdInput: string | null | undefined, selection: {
+export declare function readAgentAppModelDefaultSettings(ctx: AgentAppModelDefaultContext, appIdInput: string | null | undefined): Promise<AgentAppModelDefaultSettings>;
+export declare function writeAgentAppModelDefaultSettings(ctx: AgentAppModelDefaultContext, appIdInput: string | null | undefined, selection: {
     engine: string;
     model: string;
     updatedBy?: string | null;
 }): Promise<AgentAppModelDefaultSettings>;
-export declare function resetAgentAppModelDefaultSettings(ctx: {
-    userEmail?: string | null;
-    orgId?: string | null;
-}, appIdInput: string | null | undefined): Promise<AgentAppModelDefaultSettings>;
-export declare function canUpdateAgentAppModelDefaultSettings(userEmail: string | null | undefined, orgId: string | null | undefined): Promise<boolean>;
+export declare function resetAgentAppModelDefaultSettings(ctx: AgentAppModelDefaultContext, appIdInput: string | null | undefined): Promise<AgentAppModelDefaultSettings>;
+export declare function canUpdateAgentAppModelDefaultSettings(userEmail: string | null | undefined, orgId: string | null | undefined, orgScope?: "personal"): Promise<boolean>;
 export declare function getAgentAppModelDefaultForCurrentRequest(appIdInput: string | null | undefined): Promise<AgentAppModelDefaultSelection | null>;

package/dist/agent/app-model-defaults.js

@@ -1,5 +1,5 @@
 import { getDbExec } from "../db/client.js";
-import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+import { getRequestContext, getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
 import { deleteOrgSetting, deleteUserSetting, getOrgSetting, getUserSetting, putOrgSetting, putUserSetting, } from "../settings/index.js";
 export const AGENT_APP_MODEL_DEFAULT_KEY_PREFIX = "agent-app-model-default";
 export function normalizeAgentAppModelDefaultAppId(appId) {
@@ -50,12 +50,15 @@ export async function readAgentAppModelDefaultSettings(ctx, appIdInput) {
             ? { appId, ...stored, scope: "org", source: "org" }
             : emptySettings(appId, "org");
     }
-    if (ctx.userEmail) {
+    if (ctx.userEmail && ctx.orgScope === "personal") {
         const stored = parseSelection(await getUserSetting(ctx.userEmail, key));
         return stored
             ? { appId, ...stored, scope: "user", source: "user" }
             : emptySettings(appId, "user");
     }
+    if (ctx.userEmail) {
+        throw new Error("Organization scope could not be resolved.");
+    }
     return emptySettings(appId, "default");
 }
 export async function writeAgentAppModelDefaultSettings(ctx, appIdInput, selection) {
@@ -83,6 +86,9 @@ export async function writeAgentAppModelDefaultSettings(ctx, appIdInput, selecti
     if (!ctx.userEmail) {
         throw new Error("Authentication required to update model defaults.");
     }
+    if (ctx.orgScope !== "personal") {
+        throw new Error("Organization scope could not be resolved.");
+    }
     await putUserSetting(ctx.userEmail, key, value);
     return readAgentAppModelDefaultSettings(ctx, appId);
 }
@@ -98,14 +104,17 @@ export async function resetAgentAppModelDefaultSettings(ctx, appIdInput) {
     if (!ctx.userEmail) {
         throw new Error("Authentication required to reset model defaults.");
     }
+    if (ctx.orgScope !== "personal") {
+        throw new Error("Organization scope could not be resolved.");
+    }
     await deleteUserSetting(ctx.userEmail, key);
     return readAgentAppModelDefaultSettings(ctx, appId);
 }
-export async function canUpdateAgentAppModelDefaultSettings(userEmail, orgId) {
+export async function canUpdateAgentAppModelDefaultSettings(userEmail, orgId, orgScope) {
     if (!userEmail)
         return false;
     if (!orgId)
-        return true;
+        return orgScope === "personal";
     try {
         const exec = getDbExec();
         const { rows } = await exec.execute({
@@ -126,9 +135,18 @@ export async function getAgentAppModelDefaultForCurrentRequest(appIdInput) {
     const appId = normalizeAgentAppModelDefaultAppId(appIdInput);
     if (!appId)
         return null;
+    const requestContext = getRequestContext();
     const userEmail = getRequestUserEmail();
     const orgId = getRequestOrgId();
-    const settings = await readAgentAppModelDefaultSettings({ userEmail, orgId }, appId).catch(() => null);
+    if (!orgId && requestContext?.orgScope !== "personal")
+        return null;
+    const settings = await readAgentAppModelDefaultSettings({
+        userEmail,
+        orgId,
+        ...(requestContext?.orgScope === "personal"
+            ? { orgScope: "personal" }
+            : {}),
+    }, appId).catch(() => null);
     if (!settings?.engine || !settings.model)
         return null;
     return {

package/dist/agent/default-agent-engine.d.ts

@@ -20,6 +20,8 @@ export type DefaultAgentEngineSource = DefaultAgentEngineScope | "legacy" | "non
 export interface DefaultAgentEngineContext {
     userEmail?: string | null;
     orgId?: string | null;
+    orgScope?: "personal";
+    defaultAgentEngineScope?: "deployment";
 }
 export interface DefaultAgentEngineRead {
     /** The stored `{ engine, model }` row, or null when no default applies. */
@@ -37,7 +39,7 @@ export type DefaultAgentEngineAuthority = {
     userEmail: string;
 } | {
     allowed: false;
-    reason: "unauthenticated" | "not-admin";
+    reason: "unauthenticated" | "not-admin" | "scope-unavailable";
     message: string;
 };
 export interface DefaultAgentEngineChangeMeta {
@@ -54,8 +56,8 @@ export interface DefaultAgentEngineSelection {
 }
 /**
  * Read the default that applies to `ctx` (the current request when omitted):
- * the organization's row, else a no-org user's own row, else the legacy
- * deployment-wide row.
+ * the organization's row, else an explicitly personal user's own row, else
+ * the legacy deployment-wide row. An unresolved scope throws before fallback.
  *
  * A scoped row with no engine is an explicit "cleared" marker. It answers for
  * that scope instead of falling through to the legacy row, so clearing the

package/dist/agent/default-agent-engine.js

@@ -7,7 +7,7 @@
  * goes through this module so the scope rules live in one place.
  */
 import { recordOrgAdminAuditEvent } from "../audit/org-admin.js";
-import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+import { getRequestContext, getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
 import { getOrgSetting, putOrgSetting } from "../settings/org-settings.js";
 import { getSetting } from "../settings/store.js";
 import { getUserSetting, putUserSetting } from "../settings/user-settings.js";
@@ -17,7 +17,15 @@ export const DEFAULT_AGENT_ENGINE_SETTING_KEY = "agent-engine";
 /** Audit target type for default-model changes and refused attempts. */
 export const DEFAULT_AGENT_ENGINE_AUDIT_TARGET_TYPE = "agent-default-model";
 function requestContext() {
-    return { userEmail: getRequestUserEmail(), orgId: getRequestOrgId() };
+    const context = getRequestContext();
+    return {
+        userEmail: getRequestUserEmail(),
+        orgId: getRequestOrgId(),
+        ...(context?.orgScope === "personal" ? { orgScope: "personal" } : {}),
+        ...(context?.defaultAgentEngineScope === "deployment"
+            ? { defaultAgentEngineScope: "deployment" }
+            : {}),
+    };
 }
 function normalizedContext(ctx) {
     return {
@@ -30,8 +38,8 @@ function hasEngine(value) {
 }
 /**
  * Read the default that applies to `ctx` (the current request when omitted):
- * the organization's row, else a no-org user's own row, else the legacy
- * deployment-wide row.
+ * the organization's row, else an explicitly personal user's own row, else
+ * the legacy deployment-wide row. An unresolved scope throws before fallback.
  *
  * A scoped row with no engine is an explicit "cleared" marker. It answers for
  * that scope instead of falling through to the legacy row, so clearing the
@@ -39,13 +47,18 @@ function hasEngine(value) {
  */
 export async function readDefaultAgentEngineSettingDetailed(ctx = requestContext()) {
     const { userEmail, orgId } = normalizedContext(ctx);
+    if (!orgId &&
+        ctx.orgScope !== "personal" &&
+        ctx.defaultAgentEngineScope !== "deployment") {
+        throw new Error("Organization scope could not be resolved.");
+    }
     if (orgId) {
         const scoped = await getOrgSetting(orgId, DEFAULT_AGENT_ENGINE_SETTING_KEY);
         if (scoped) {
             return { value: hasEngine(scoped) ? scoped : null, source: "org" };
         }
     }
-    else if (userEmail) {
+    else if (userEmail && ctx.orgScope === "personal") {
         const scoped = await getUserSetting(userEmail, DEFAULT_AGENT_ENGINE_SETTING_KEY);
         if (scoped) {
             return { value: hasEngine(scoped) ? scoped : null, source: "user" };
@@ -76,9 +89,16 @@ export async function resolveDefaultAgentEngineAuthority(ctx = requestContext())
             message: "Sign in to change the default model.",
         };
     }
+    if (!orgId && ctx.orgScope !== "personal") {
+        return {
+            allowed: false,
+            reason: "scope-unavailable",
+            message: "Organization scope could not be resolved.",
+        };
+    }
     if (!orgId)
         return { allowed: true, scope: "user", userEmail };
-    if (await canUpdateAgentAppModelDefaultSettings(userEmail, orgId)) {
+    if (await canUpdateAgentAppModelDefaultSettings(userEmail, orgId, ctx.orgScope)) {
         return { allowed: true, scope: "org", orgId, userEmail };
     }
     return {
@@ -99,7 +119,12 @@ async function writeScopedRow(authority, value) {
  * stores only that scope and records the change.
  */
 export async function writeDefaultAgentEngineSelection(authority, selection, meta) {
-    const previous = await readDefaultAgentEngineSettingDetailed(authority);
+    const previous = await readDefaultAgentEngineSettingDetailed({
+        userEmail: authority.userEmail,
+        ...(authority.scope === "org"
+            ? { orgId: authority.orgId }
+            : { orgScope: "personal" }),
+    });
     await writeScopedRow(authority, {
         engine: selection.engine,
         model: selection.model,
@@ -132,7 +157,12 @@ export async function writeDefaultAgentEngineSelection(authority, selection, met
  * than deleting the row; see {@link readDefaultAgentEngineSettingDetailed}.
  */
 export async function clearDefaultAgentEngineSelection(authority, meta) {
-    const previous = await readDefaultAgentEngineSettingDetailed(authority);
+    const previous = await readDefaultAgentEngineSettingDetailed({
+        userEmail: authority.userEmail,
+        ...(authority.scope === "org"
+            ? { orgId: authority.orgId }
+            : { orgScope: "personal" }),
+    });
     await writeScopedRow(authority, {
         cleared: true,
         updatedAt: Date.now(),

package/dist/agent/durable-background.d.ts

@@ -54,6 +54,8 @@ export declare const AGENT_CHAT_DURABLE_BACKGROUND_ENV = "AGENT_CHAT_DURABLE_BAC
 export declare const AGENT_CHAT_BACKGROUND_RUN_FIELD = "__backgroundRun";
 /** Analytics-only source context captured before the run leaves its browser request. */
 export declare const AGENT_CHAT_BROWSER_SESSION_ID_FIELD = "__agentNativeBrowserSessionId";
+/** Captured turn origin; durable workers do not restore loopback trust from this payload. */
+export declare const AGENT_CHAT_REQUEST_CONTEXT_FIELD = "__agentChatRequestContext";
 export declare function isHostedRuntimeForDurableBackground(): boolean;
 export declare function isNetlifyHostedRuntimeForDurableBackground(): boolean;
 export declare function isInBackgroundFunctionRuntime(): boolean;

package/dist/agent/durable-background.js

@@ -134,6 +134,8 @@ export const AGENT_CHAT_DURABLE_BACKGROUND_ENV = "AGENT_CHAT_DURABLE_BACKGROUND"
 export const AGENT_CHAT_BACKGROUND_RUN_FIELD = "__backgroundRun";
 /** Analytics-only source context captured before the run leaves its browser request. */
 export const AGENT_CHAT_BROWSER_SESSION_ID_FIELD = "__agentNativeBrowserSessionId";
+/** Captured turn origin; durable workers do not restore loopback trust from this payload. */
+export const AGENT_CHAT_REQUEST_CONTEXT_FIELD = "__agentChatRequestContext";
 export function isHostedRuntimeForDurableBackground() {
     if (process.env.NETLIFY_LOCAL === "true")
         return false;

package/dist/agent/engine/registry.js

@@ -617,6 +617,8 @@ function identityUserEmail(identity) {
     return getRequestUserEmail()?.trim() || undefined;
 }
 async function chatGPTSubscriptionUsableForRequest(identity) {
+    if (identity?.orgId || getRequestOrgId())
+        return false;
     const email = identityUserEmail(identity);
     if (!email)
         return false;
@@ -908,6 +910,10 @@ export async function resolveEngine(config) {
     if (engineOption &&
         typeof engineOption === "object" &&
         "stream" in engineOption) {
+        if (engineOption.name === CHATGPT_SUBSCRIPTION_ENGINE_NAME &&
+            !(await chatGPTSubscriptionUsableForRequest(credentialIdentity))) {
+            throw new Error("Connect a ChatGPT account with direct model access before using this engine.");
+        }
         return engineOption;
     }
     if (engineOption &&

package/dist/agent/production-agent.js

@@ -58,7 +58,7 @@ import { CONTINUE_UNAVAILABLE_CODE, } from "./auto-continue.js";
 import { clipHead } from "./clip-text.js";
 import { connectionRequiredMessage, priorConnectionContextNote, resolvePriorConnectionNote, } from "./connection-required-note.js";
 import { buildSystemManifestSections, readContextXraySystemSections, } from "./context-xray/manifest.js";
-import { AGENT_CHAT_BROWSER_SESSION_ID_FIELD, AGENT_CHAT_BACKGROUND_RUN_FIELD, AGENT_CHAT_PROCESS_RUN_PATH, AGENT_CHAT_RECOVERY_OF_RUN_FIELD, backgroundRuntimeDiagnosticDetail, dispatchPathTargetsNetlifyBackgroundFunction, isAgentChatDurableBackgroundEnabled, isAgentChatForegroundSelfChainEnabled, isInBackgroundFunctionRuntime, resolveAgentChatProcessRunDispatchPath, shouldUseBackgroundFunctionTimeoutForWorker, } from "./durable-background.js";
+import { AGENT_CHAT_BROWSER_SESSION_ID_FIELD, AGENT_CHAT_REQUEST_CONTEXT_FIELD, AGENT_CHAT_BACKGROUND_RUN_FIELD, AGENT_CHAT_PROCESS_RUN_PATH, AGENT_CHAT_RECOVERY_OF_RUN_FIELD, backgroundRuntimeDiagnosticDetail, dispatchPathTargetsNetlifyBackgroundFunction, isAgentChatDurableBackgroundEnabled, isAgentChatForegroundSelfChainEnabled, isInBackgroundFunctionRuntime, resolveAgentChatProcessRunDispatchPath, shouldUseBackgroundFunctionTimeoutForWorker, } from "./durable-background.js";
 import { applyContextXrayTransformForIteration } from "./engine/context-directives-transform.js";
 import { attemptContinuationDispatch } from "./engine/continuation-dispatch-retry.js";
 import { formatLlmCredentialErrorMessage, LLM_MISSING_CREDENTIALS_ERROR_CODE, LLM_MISSING_CREDENTIALS_MESSAGE, userFacingLlmCredentialError, } from "./engine/credential-errors.js";
@@ -488,6 +488,12 @@ export async function getOwnerActiveApiKey(ownerEmail) {
         const engineSetting = await readDefaultAgentEngineSetting({
             userEmail: ownerEmail ?? getRequestUserEmail(),
             orgId: getRequestOrgId(),
+            ...(getRequestContext()?.orgScope === "personal"
+                ? { orgScope: "personal" }
+                : {}),
+            ...(getRequestContext()?.defaultAgentEngineScope === "deployment"
+                ? { defaultAgentEngineScope: "deployment" }
+                : {}),
         });
         const activeEngine = engineSetting?.engine ?? "anthropic";
         return (await getOwnerApiKeyForEngine(activeEngine, ownerEmail)).apiKey;
@@ -523,8 +529,8 @@ export async function resolveOwnerEngineApiKey(input) {
     }
     else {
         try {
-            const { getSetting } = await import("../settings/store.js");
-            const engineSetting = await getSetting("agent-engine");
+            const { readDefaultAgentEngineSetting } = await import("./default-agent-engine.js");
+            const engineSetting = await readDefaultAgentEngineSetting();
             activeEngineSetting = {
                 status: "available",
                 engine: engineSetting?.engine ?? "anthropic",
@@ -8101,6 +8107,13 @@ export function createProductionAgentHandler(options) {
             // A client can submit this private field, so overwrite it at the boundary.
             mutableBody[AGENT_CHAT_BROWSER_SESSION_ID_FIELD] =
                 getRequestContext()?.browserSessionId ?? null;
+            const requestContext = getRequestContext();
+            mutableBody[AGENT_CHAT_REQUEST_CONTEXT_FIELD] = {
+                requestOrigin: requestContext?.requestOrigin ?? null,
+                isLoopbackRequest: !dispatchToBackground && requestContext?.isLoopbackRequest === true,
+                isDirectLoopbackRequest: !dispatchToBackground &&
+                    requestContext?.isDirectLoopbackRequest === true,
+            };
             delete mutableBody[ANALYTICS_CLIENT_PLATFORM_BODY_FIELD];
         }
         if (dispatchToBackground) {
@@ -10286,12 +10299,32 @@ export function createProductionAgentHandler(options) {
                     return;
                 }
                 if (exactApprovedToolCall && approvedToolCallsForExecution) {
+                    let pausedResult;
+                    if (!isBackgroundWorker) {
+                        const pausedResults = agentLoopOpts.messages.flatMap((message) => message.content.filter((part) => part.type === "tool-result" &&
+                            part.toolCallId === exactApprovedToolCall.callId &&
+                            part.approvalPause === true));
+                        if (pausedResults.length !== 1) {
+                            send({
+                                type: "error",
+                                error: "The agent run failed.",
+                                errorCode: "approved_tool_call_result_missing",
+                                recoverable: false,
+                            });
+                            return;
+                        }
+                        const [candidate] = pausedResults;
+                        if (candidate?.type !== "tool-result") {
+                            throw new Error("Approved tool result changed unexpectedly.");
+                        }
+                        pausedResult = candidate;
+                    }
                     send({
                         type: "activity",
                         label: `Running approved ${exactApprovedToolCall.name} action`,
                         tool: exactApprovedToolCall.name,
                     });
-                    await executeAgentToolCall({
+                    const approvedExecution = await executeAgentToolCall({
                         actions: requestActions,
                         name: exactApprovedToolCall.name,
                         input: exactApprovedToolCall.input,
@@ -10313,7 +10346,27 @@ export function createProductionAgentHandler(options) {
                         isToolAlwaysAllowed: approvalHooks.isToolAlwaysAllowed,
                         send,
                     });
-                    return;
+                    if (approvedExecution.status === "approval_required" ||
+                        (approvedExecution.status === "failed" &&
+                            approvedExecution.terminalError)) {
+                        return;
+                    }
+                    if (isBackgroundWorker)
+                        return;
+                    if (!pausedResult) {
+                        throw new Error("Approved tool result was not validated.");
+                    }
+                    pausedResult.content = approvedExecution.output;
+                    if (approvedExecution.status === "failed") {
+                        pausedResult.isError = true;
+                    }
+                    else {
+                        delete pausedResult.isError;
+                    }
+                    delete pausedResult.approvalPause;
+                    delete pausedResult.approvalAskId;
+                    delete agentLoopOpts.approvedToolCalls;
+                    delete agentLoopOpts.approvedToolCallAskId;
                 }
                 try {
                     const { getObservabilityConfig, instrumentAgentLoop } = await import("../observability/traces.js");

package/dist/app-config/clips.d.ts

@@ -0,0 +1,43 @@
+import { z } from "zod";
+export declare const clipsHostedStorageConfig: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    endpoint: z.ZodOptional<z.ZodString>;
+    bucket: z.ZodOptional<z.ZodString>;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
+    perIdentityClipLimit: z.ZodDefault<z.ZodNumber>;
+    maxClipBytes: z.ZodDefault<z.ZodNumber>;
+    maxClipDurationMs: z.ZodDefault<z.ZodNumber>;
+    globalDailyClipCap: z.ZodOptional<z.ZodNumber>;
+    ipPrefixDailyGrantCap: z.ZodOptional<z.ZodNumber>;
+    globalRetainedByteCap: z.ZodOptional<z.ZodNumber>;
+    retainedByteAlertRatio: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const clipsConfig: z.ZodObject<{
+    hostedStorage: z.ZodPrefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        bucket: z.ZodOptional<z.ZodString>;
+        accessKeyId: z.ZodOptional<z.ZodString>;
+        secretAccessKey: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodString>;
+        perIdentityClipLimit: z.ZodDefault<z.ZodNumber>;
+        maxClipBytes: z.ZodDefault<z.ZodNumber>;
+        maxClipDurationMs: z.ZodDefault<z.ZodNumber>;
+        globalDailyClipCap: z.ZodOptional<z.ZodNumber>;
+        ipPrefixDailyGrantCap: z.ZodOptional<z.ZodNumber>;
+        globalRetainedByteCap: z.ZodOptional<z.ZodNumber>;
+        retainedByteAlertRatio: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ClipsHostedStorageConfig = z.output<typeof clipsHostedStorageConfig>;
+export type ResolvedClipsHostedStorageConfig = ClipsHostedStorageConfig & {
+    enabled: true;
+    endpoint: string;
+    bucket: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    region: string;
+};
+export declare function resolveClipsHostedStorageConfig(config: ClipsHostedStorageConfig): ResolvedClipsHostedStorageConfig | null;

package/dist/app-config/clips.js

@@ -0,0 +1,91 @@
+import { z } from "zod";
+import { AppConfigurationError } from "./configuration-error.js";
+export const clipsHostedStorageConfig = z.object({
+    enabled: z.boolean().default(false).meta({
+        env: "CLIPS_HOSTED_STORAGE_ENABLED",
+        doc: "Enable server-hosted Clips recordings.",
+    }),
+    endpoint: z.string().url().optional().meta({
+        env: "CLIPS_HOSTED_STORAGE_ENDPOINT",
+        doc: "S3-compatible endpoint for server-hosted Clips recordings.",
+    }),
+    bucket: z.string().min(1).optional().meta({
+        env: "CLIPS_HOSTED_STORAGE_BUCKET",
+        doc: "Private object-storage bucket for server-hosted Clips recordings.",
+    }),
+    accessKeyId: z.string().min(1).optional().meta({
+        env: "CLIPS_HOSTED_STORAGE_ACCESS_KEY_ID",
+        doc: "Access key for server-hosted Clips object storage.",
+    }),
+    secretAccessKey: z.string().min(1).optional().meta({
+        env: "CLIPS_HOSTED_STORAGE_SECRET_ACCESS_KEY",
+        doc: "Secret access key for server-hosted Clips object storage.",
+    }),
+    region: z.string().min(1).optional().meta({
+        env: "CLIPS_HOSTED_STORAGE_REGION",
+        doc: "S3-compatible object-storage region for server-hosted Clips recordings.",
+    }),
+    perIdentityClipLimit: z.number().int().positive().default(3).meta({
+        env: "CLIPS_HOSTED_STORAGE_PER_IDENTITY_CLIP_LIMIT",
+        doc: "Maximum number of retained hosted Clips recordings per identity.",
+    }),
+    maxClipBytes: z
+        .number()
+        .int()
+        .positive()
+        .default(250 * 1024 * 1024)
+        .meta({
+        env: "CLIPS_HOSTED_STORAGE_MAX_CLIP_BYTES",
+        doc: "Maximum size of a hosted Clips recording in bytes.",
+    }),
+    maxClipDurationMs: z
+        .number()
+        .int()
+        .positive()
+        .default(10 * 60 * 1000)
+        .meta({
+        env: "CLIPS_HOSTED_STORAGE_MAX_CLIP_DURATION_MS",
+        doc: "Maximum recording duration shown by the Clips UI; the hosted-storage server does not enforce duration.",
+    }),
+    globalDailyClipCap: z.number().int().positive().optional().meta({
+        env: "CLIPS_HOSTED_STORAGE_GLOBAL_DAILY_CLIP_CAP",
+        doc: "Optional maximum number of hosted Clips recordings granted per day across the deployment.",
+    }),
+    ipPrefixDailyGrantCap: z.number().int().positive().optional().meta({
+        env: "CLIPS_HOSTED_STORAGE_IP_PREFIX_DAILY_GRANT_CAP",
+        doc: "Optional maximum number of hosted Clips recording grants per IP prefix per day.",
+    }),
+    globalRetainedByteCap: z.number().int().positive().optional().meta({
+        env: "CLIPS_HOSTED_STORAGE_GLOBAL_RETAINED_BYTE_CAP",
+        doc: "Optional maximum total bytes retained in hosted Clips object storage.",
+    }),
+    retainedByteAlertRatio: z.number().min(0).max(1).default(0.8).meta({
+        env: "CLIPS_HOSTED_STORAGE_RETAINED_BYTE_ALERT_RATIO",
+        doc: "Fraction of the global retained-byte cap at which hosted Clips storage should alert.",
+    }),
+});
+export const clipsConfig = z.object({
+    hostedStorage: clipsHostedStorageConfig.prefault({}),
+});
+export function resolveClipsHostedStorageConfig(config) {
+    if (!config.enabled)
+        return null;
+    const requiredSettings = {
+        endpoint: config.endpoint,
+        bucket: config.bucket,
+        accessKeyId: config.accessKeyId,
+        secretAccessKey: config.secretAccessKey,
+        region: config.region,
+    };
+    const missingSettings = Object.entries(requiredSettings)
+        .filter(([, value]) => typeof value !== "string" || !value.trim())
+        .map(([key]) => key);
+    if (missingSettings.length > 0) {
+        throw new AppConfigurationError(`Clips hosted storage is enabled but missing required settings: ${missingSettings.join(", ")}.`);
+    }
+    return {
+        ...config,
+        ...requiredSettings,
+        enabled: true,
+    };
+}

package/dist/app-config/index.d.ts

@@ -1,5 +1,6 @@
 export { defineAppConfig, enterpriseAuthAdaptersBuilt, getAppConfig, resetAppConfigForTests, } from "./store.js";
 export { resolveAppHomePath } from "./app-identity.js";
 export { AppConfigurationError } from "./configuration-error.js";
+export { resolveClipsHostedStorageConfig, type ClipsHostedStorageConfig, type ResolvedClipsHostedStorageConfig, } from "./clips.js";
 export { DEFAULT_EXTENSION_DISPLAY_SOURCES } from "./extensions.js";
 export { appConfigSchema, type AppConfig, type AppConfigInput, } from "./schema.js";

package/dist/app-config/index.js

@@ -1,5 +1,6 @@
 export { defineAppConfig, enterpriseAuthAdaptersBuilt, getAppConfig, resetAppConfigForTests, } from "./store.js";
 export { resolveAppHomePath } from "./app-identity.js";
 export { AppConfigurationError } from "./configuration-error.js";
+export { resolveClipsHostedStorageConfig, } from "./clips.js";
 export { DEFAULT_EXTENSION_DISPLAY_SOURCES } from "./extensions.js";
 export { appConfigSchema, } from "./schema.js";

package/dist/app-config/schema.d.ts

@@ -67,6 +67,23 @@ export declare const appConfigSchema: z.ZodObject<{
         mcpOwnerEmail: z.ZodOptional<z.ZodString>;
         requireEmailVerification: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
+    clips: z.ZodPrefault<z.ZodObject<{
+        hostedStorage: z.ZodPrefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            endpoint: z.ZodOptional<z.ZodString>;
+            bucket: z.ZodOptional<z.ZodString>;
+            accessKeyId: z.ZodOptional<z.ZodString>;
+            secretAccessKey: z.ZodOptional<z.ZodString>;
+            region: z.ZodOptional<z.ZodString>;
+            perIdentityClipLimit: z.ZodDefault<z.ZodNumber>;
+            maxClipBytes: z.ZodDefault<z.ZodNumber>;
+            maxClipDurationMs: z.ZodDefault<z.ZodNumber>;
+            globalDailyClipCap: z.ZodOptional<z.ZodNumber>;
+            ipPrefixDailyGrantCap: z.ZodOptional<z.ZodNumber>;
+            globalRetainedByteCap: z.ZodOptional<z.ZodNumber>;
+            retainedByteAlertRatio: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     dispatch: z.ZodPrefault<z.ZodObject<{
         adminEmails: z.ZodDefault<z.ZodArray<z.ZodString>>;
         workspaceOwnerEmails: z.ZodDefault<z.ZodArray<z.ZodString>>;

package/dist/app-config/schema.js

@@ -5,6 +5,7 @@ import { agentConfig } from "./agent.js";
 import { analyticsConfig } from "./analytics.js";
 import { appConfig } from "./app.js";
 import { authConfig } from "./auth.js";
+import { clipsConfig } from "./clips.js";
 import { dispatchConfig } from "./dispatch.js";
 import { extensionsConfig } from "./extensions.js";
 import { integrationsConfig } from "./integrations.js";
@@ -26,6 +27,7 @@ export const appConfigSchema = z.object({
     analytics: analyticsConfig.prefault({}),
     app: appConfig.prefault({}),
     auth: authConfig.prefault({}),
+    clips: clipsConfig.prefault({}),
     dispatch: dispatchConfig.prefault({}),
     extensions: extensionsConfig.prefault({}),
     integrations: integrationsConfig.prefault({}),

package/dist/automations/service.d.ts

@@ -72,6 +72,8 @@ export declare function deleteAutomation(actorInput: AutomationActor, scope: Aut
 export interface AutomationExecutionIdentity {
     userEmail: string;
     orgId?: string;
+    orgScope?: "personal";
+    defaultAgentEngineScope?: "deployment";
     eventOwner: string;
 }
 /**

package/dist/automations/service.js

@@ -473,7 +473,10 @@ export async function resolveAutomationExecutionIdentity(resourceOwner, meta) {
                 code: "config_invalid",
             };
         }
-        return { ok: true, identity: { userEmail, eventOwner: userEmail } };
+        return {
+            ok: true,
+            identity: { userEmail, orgScope: "personal", eventOwner: userEmail },
+        };
     }
     const userEmail = meta.createdBy?.trim().toLowerCase();
     if (!userEmail) {