@agent-native/core 0.211.0 → 0.212.0-nightly-20261021010049

package/dist/server/collab-plugin.d.ts

@@ -1,3 +1,4 @@
+import { LiveCopyError, type LiveCopyBinding } from "../collab/live-copy.js";
 import { type DbExec } from "../db/client.js";
 type NitroPluginDef = (nitroApp: any) => void | Promise<void>;
 export type CollabResourceIdResolver = (docId: string) => string | null | Promise<string | null>;
@@ -22,7 +23,14 @@ export interface CollabPluginOptions {
     idColumn?: string;
     autoSeed?: boolean;
     resolveSourceIdFromCollabDocumentId?: (docId: string) => string;
-    onContentSync?: (docId: string, text: string) => Promise<void>;
+    /**
+     * Documents this binding covers are live copies: each update commits with
+     * its derived text, and the text, JSON and search-replace routes refuse
+     * them. Requires `autoSeed: false`; seed with `seedLiveCopy`. Passing the
+     * binding here also imports it at server start, so the refusal holds from
+     * the first request rather than from whenever an action first loads it.
+     */
+    liveCopy?: LiveCopyBinding;
     contentType?: "text" | "json";
     jsonColumn?: string;
     access?: CollabAccess;
@@ -48,5 +56,6 @@ export declare function createCollabSourceSeeder(options: {
     seed: (docId: string, source: string, client?: DbExec) => Promise<void>;
     withLock?: (docId: string, run: (client?: DbExec) => Promise<void>) => Promise<void>;
 }): (docId: string) => Promise<void>;
+export declare function liveCopyErrorStatus(error: LiveCopyError): number;
 export declare function createCollabPlugin(options?: CollabPluginOptions): NitroPluginDef;
 export {};

package/dist/server/collab-plugin.js

@@ -1,6 +1,7 @@
 import { defineEventHandler, getMethod, setResponseStatus, } from "h3";
 import { postAwareness, getActiveUsers } from "../collab/awareness.js";
 import { getCollabEmitter } from "../collab/emitter.js";
+import { LiveCopyError } from "../collab/live-copy.js";
 import { getCollabState, postCollabUpdate, postCollabText, postCollabSearchReplace, } from "../collab/routes.js";
 import { hasCollabState } from "../collab/storage.js";
 import { postCollabJson, getCollabJson, postCollabPatch, } from "../collab/struct-routes.js";
@@ -98,7 +99,67 @@ export function createCollabSourceSeeder(options) {
         }
     };
 }
+// Worker and capacity failures are the server's, so a client may retry them;
+// a task that broke its contract is a server bug, not a bad edit.
+const RETRYABLE_TASK_FAILURES = new Set([
+    "unavailable",
+    "closed",
+    "queue_full",
+    "queue_timeout",
+    "deadline_exceeded",
+    "memory_exceeded",
+    "worker_crashed",
+    "startup_failed",
+]);
+export function liveCopyErrorStatus(error) {
+    switch (error.code) {
+        case "write_refused":
+        case "read_refused":
+        case "not_live_copy":
+        case "not_seeded":
+        case "version_conflict":
+            return 409;
+        case "state_too_large":
+            return 413;
+        case "malformed_state":
+        case "unsupported_content":
+        case "derive_refused":
+        case "build_refused":
+            return 422;
+        case "derive_failed":
+        case "build_failed":
+            if (RETRYABLE_TASK_FAILURES.has(error.reason ?? ""))
+                return 503;
+            if (error.reason === "input_too_large" ||
+                error.reason === "output_too_large") {
+                return 413;
+            }
+            return 500;
+    }
+}
+function collabErrorResponse(event, error) {
+    if (error instanceof LiveCopyError) {
+        setResponseStatus(event, liveCopyErrorStatus(error));
+        return {
+            error: error.message,
+            code: `live_copy_${error.code}`,
+            ...(error.reason !== undefined ? { reason: error.reason } : {}),
+        };
+    }
+    return null;
+}
 export function createCollabPlugin(options = {}) {
+    if ("onContentSync" in options) {
+        throw new Error("createCollabPlugin no longer accepts onContentSync; it was never called. Use liveCopy (defineLiveCopy) to derive a document's text when its live copy changes.");
+    }
+    if (options.liveCopy) {
+        if (options.autoSeed !== false) {
+            throw new Error("createCollabPlugin liveCopy requires autoSeed: false; seed live copies with seedLiveCopy.");
+        }
+        if (options.contentType === "json") {
+            throw new Error('createCollabPlugin liveCopy derives text from an XML fragment and cannot be combined with contentType: "json".');
+        }
+    }
     const normalizedAccess = normalizeCollabAccess(options);
     const { table = "documents", contentColumn = "content", idColumn = "id", autoSeed = true, maxPayloadBytes = DEFAULT_MAX_PAYLOAD_BYTES, } = options;
     const resolveSourceIdFromCollabDocumentId = options.resolveSourceIdFromCollabDocumentId ?? ((docId) => docId);
@@ -355,26 +416,34 @@ export function createCollabPlugin(options = {}) {
                     (action === "search-replace" && method === "POST") ||
                     (action === "json" && (method === "GET" || method === "POST")) ||
                     (action === "patch" && method === "POST");
-                if (needsSeed)
-                    await ensureDocumentSeeded(docId);
-                if (action === "state" && method === "GET")
-                    return getCollabState(event);
-                if (action === "update" && method === "POST")
-                    return postCollabUpdate(event);
-                if (action === "text" && method === "POST")
-                    return postCollabText(event);
-                if (action === "search-replace" && method === "POST")
-                    return postCollabSearchReplace(event);
-                if (action === "json" && method === "POST")
-                    return postCollabJson(event);
-                if (action === "json" && method === "GET")
-                    return getCollabJson(event);
-                if (action === "patch" && method === "POST")
-                    return postCollabPatch(event);
-                if (action === "awareness" && method === "POST")
-                    return postAwareness(event);
-                if (action === "users" && method === "GET")
-                    return getActiveUsers(event);
+                try {
+                    if (needsSeed)
+                        await ensureDocumentSeeded(docId);
+                    if (action === "state" && method === "GET")
+                        return await getCollabState(event);
+                    if (action === "update" && method === "POST")
+                        return await postCollabUpdate(event);
+                    if (action === "text" && method === "POST")
+                        return await postCollabText(event);
+                    if (action === "search-replace" && method === "POST")
+                        return await postCollabSearchReplace(event);
+                    if (action === "json" && method === "POST")
+                        return await postCollabJson(event);
+                    if (action === "json" && method === "GET")
+                        return await getCollabJson(event);
+                    if (action === "patch" && method === "POST")
+                        return await postCollabPatch(event);
+                    if (action === "awareness" && method === "POST")
+                        return await postAwareness(event);
+                    if (action === "users" && method === "GET")
+                        return await getActiveUsers(event);
+                }
+                catch (error) {
+                    const response = collabErrorResponse(event, error);
+                    if (response)
+                        return response;
+                    throw error;
+                }
                 setResponseStatus(event, 404);
                 return { error: "Not found" };
             });

package/dist/server/index.d.ts

@@ -58,7 +58,7 @@ export { refreshMcpManagerForPrincipal } from "./agent-chat/mcp-glue.js";
 export { AGENT_CHAT_STREAM_PATH, AGENT_CHAT_STREAM_TOKEN_SUFFIX, AGENT_CHAT_STREAM_TOKEN_TTL_SECONDS, createAgentChatStreamToken, isAgentChatStreamingRuntime, readAgentChatStreamBearerToken, verifyAgentChatStreamToken, type AgentChatStreamPrincipal, } from "./agent-chat-stream.js";
 export type { AgentChatMcpIcon, AgentChatMcpOptions, } from "./agent-chat/mcp-options.js";
 export { configureAgentNativeEmbeddedEnvironment, createAgentNativeEmbeddedAuthOptions, createAgentNativeEmbeddedPlugin, mountAgentNativeEmbedded, normalizeAgentNativeEmbeddedSession, type AgentNativeEmbeddedAuthOptions, type AgentNativeEmbeddedGetSession, type AgentNativeEmbeddedHostSession, type AgentNativeEmbeddedPluginOptions, } from "./embedded.js";
-export { createThread, getThread, listThreads, updateThreadData, deleteThread, setThreadArchived, setThreadPinned, setThreadScope, type ChatThread, type ChatThreadScope, type ChatThreadSummary, type ListThreadsOptions, } from "../chat-threads/store.js";
+export { createThread, getThread, listThreads, updateThreadData, deleteThread, setThreadArchived, setThreadPinned, setThreadScope, type ChatThread, type ChatThreadAccessBasis, type ChatThreadOwnership, type ChatThreadScope, type ChatThreadSummary, type ChatThreadListRow, type ListThreadsOptions, } from "../chat-threads/store.js";
 export { createResourcesPlugin, defaultResourcesPlugin, } from "./resources-plugin.js";
 export { createCoreRoutesPlugin, defaultCoreRoutesPlugin, FRAMEWORK_ROUTE_PREFIX, type CoreRoutesPluginOptions, } from "./core-routes-plugin.js";
 export type { CoreRoutesMcpOptions } from "./core-routes/mcp-connect-options.js";

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/shared/optional-node-builtins.d.ts

@@ -2,4 +2,5 @@ import type { AsyncLocalStorage } from "node:async_hooks";
 import type { EventEmitter } from "node:events";
 export type AsyncLocalStorageCtor = new <T>() => AsyncLocalStorage<T>;
 export declare function getAsyncLocalStorageCtor(): AsyncLocalStorageCtor | undefined;
+export declare function getWorkerThreads(): typeof import("node:worker_threads") | undefined;
 export declare function createEventEmitter(): EventEmitter;

package/dist/shared/optional-node-builtins.js

@@ -11,6 +11,9 @@ function nodeBuiltin(name) {
 export function getAsyncLocalStorageCtor() {
     return nodeBuiltin("node:async_hooks")?.AsyncLocalStorage;
 }
+export function getWorkerThreads() {
+    return nodeBuiltin("node:worker_threads");
+}
 export function createEventEmitter() {
     const Ctor = nodeBuiltin("node:events")?.EventEmitter;
     if (Ctor)

package/dist/sharing/access.d.ts

@@ -15,6 +15,7 @@ export interface AccessContext {
 }
 export declare function currentAccess(): AccessContext;
 export declare function resolveRegisteredAccessContext(reg: ShareableResourceRegistration | undefined, ctx: AccessContext): AccessContext;
+export declare function hasCurrentOrgMembership(reg: Pick<ShareableResourceRegistration, "getDb">, memberOrgId: string, email: string, ctx: AccessContext): Promise<boolean>;
 export declare function accessFilter(resourceTable: any, sharesTable: any, rawCtx?: AccessContext, minRole?: ShareRole, options?: {
     includePublic?: boolean;
 }): SQL;

package/dist/sharing/access.js

@@ -3,7 +3,6 @@ import { drizzle as drizzleProxy } from "drizzle-orm/pg-proxy";
 import { getScopedDbExec, withDbExec } from "../db/client.js";
 import { evaluateFeatureFlagStrict } from "../feature-flags/store.js";
 import { CROSS_APP_ORG_FEDERATION_FLAG } from "../org/feature-flags.js";
-import { isMissingOrganizationTableError } from "../org/membership.js";
 import { orgMembers, organizations } from "../org/schema.js";
 import { implicitServiceOrgRole } from "../org/service-identity.js";
 import { getRequestAuthCapability, getRequestContext, getRequestUserEmail, getRequestOrgId, } from "../server/request-context.js";
@@ -111,19 +110,34 @@ function orgMembershipScope(ctx, orgId) {
     }
     return sql `1=1`;
 }
-async function isOrgMember(reg, memberOrgId, email, ctx) {
-    const requestContext = getRequestContext();
-    const verifiedServiceIdentity = requestContext?.verifiedServiceIdentity;
-    const db = reg.getDb();
-    if (normalizeEmailForAccess(requestContext?.userEmail) === email &&
-        normalizeEmailForAccess(verifiedServiceIdentity?.userEmail) === email &&
-        implicitServiceOrgRole({
-            email: verifiedServiceIdentity?.userEmail,
-            orgId: memberOrgId,
-            requestOrgId: requestContext?.orgId,
-        }) &&
-        verifiedServiceIdentity?.orgId === memberOrgId) {
-        try {
+export async function hasCurrentOrgMembership(reg, memberOrgId, email, ctx) {
+    const normalizedEmail = normalizeEmailForAccess(email);
+    if (!memberOrgId || !normalizedEmail)
+        return false;
+    const transaction = ctx.transaction ?? getScopedDbExec();
+    const membershipContext = transaction ? { ...ctx, transaction } : ctx;
+    return inAccessTransaction(membershipContext, async () => {
+        const requestContext = getRequestContext();
+        const verifiedServiceIdentity = requestContext?.verifiedServiceIdentity;
+        const db = transaction
+            ? drizzleProxy(async (query, params) => {
+                const result = await transaction.execute({
+                    sql: query,
+                    args: params,
+                });
+                return { rows: result.rows.map((row) => Object.values(row)) };
+            })
+            : reg.getDb();
+        const verifiedLocalService = normalizeEmailForAccess(requestContext?.userEmail) === normalizedEmail &&
+            normalizeEmailForAccess(verifiedServiceIdentity?.userEmail) ===
+                normalizedEmail &&
+            implicitServiceOrgRole({
+                email: verifiedServiceIdentity?.userEmail,
+                orgId: memberOrgId,
+                requestOrgId: requestContext?.orgId,
+            }) &&
+            verifiedServiceIdentity?.orgId === memberOrgId;
+        const loadOrganization = async () => {
             const [organization] = await db
                 .select({
                 identityAuthority: organizations.identityAuthority,
@@ -132,66 +146,46 @@ async function isOrgMember(reg, memberOrgId, email, ctx) {
                 .from(organizations)
                 .where(eq(organizations.id, memberOrgId))
                 .limit(1);
-            if (organization &&
-                !String(organization.identityAuthority ?? "").trim() &&
-                !String(organization.identityId ?? "").trim()) {
+            if (!organization) {
+                throw new Error("Organization metadata is unavailable for access validation");
+            }
+            return organization;
+        };
+        let organization;
+        if (verifiedLocalService) {
+            organization = await loadOrganization();
+            if (!organization.identityAuthority?.trim() &&
+                !organization.identityId?.trim()) {
                 return true;
             }
         }
-        catch (error) {
-            if (!isMissingOrganizationTableError(error))
-                throw error;
-        }
-    }
-    let rows;
-    try {
-        rows = await db
+        const rows = await db
             .select({ id: orgMembers.id })
             .from(orgMembers)
-            .where(and(eq(orgMembers.orgId, memberOrgId), emailColumnMatches(orgMembers.email, email), isNull(orgMembers.federationRemovalPendingAt)))
+            .where(and(eq(orgMembers.orgId, memberOrgId), emailColumnMatches(orgMembers.email, normalizedEmail), isNull(orgMembers.federationRemovalPendingAt)))
             .limit(1);
-    }
-    catch (error) {
-        if (!isMissingOrganizationTableError(error))
-            throw error;
-        return false;
-    }
-    if (rows.length === 0)
-        return false;
-    let organization = null;
-    try {
-        [organization] = await db
-            .select({
-            identityAuthority: organizations.identityAuthority,
-            identityId: organizations.identityId,
-        })
-            .from(organizations)
-            .where(eq(organizations.id, memberOrgId))
-            .limit(1);
-    }
-    catch (error) {
-        if (!isMissingOrganizationTableError(error))
-            throw error;
-        return true;
-    }
-    const linked = String(organization?.identityAuthority ?? "").trim() ||
-        String(organization?.identityId ?? "").trim();
-    if (!linked)
-        return true;
-    if (!(await evaluateFeatureFlagStrict(CROSS_APP_ORG_FEDERATION_FLAG.key, {
-        userEmail: email,
-        userKey: email,
-        orgId: memberOrgId,
-        transaction: ctx.transaction,
-    }))) {
-        return true;
-    }
-    const { validateFederatedOrganizationMembershipForCurrentRequest } = await import("../org/federation.js");
-    const validation = await validateFederatedOrganizationMembershipForCurrentRequest({
-        orgId: memberOrgId,
-        email,
+        if (rows.length === 0)
+            return false;
+        organization ??= await loadOrganization();
+        if (!organization.identityAuthority?.trim() &&
+            !organization.identityId?.trim()) {
+            return true;
+        }
+        if (!(await evaluateFeatureFlagStrict(CROSS_APP_ORG_FEDERATION_FLAG.key, {
+            userEmail: normalizedEmail,
+            userKey: normalizedEmail,
+            orgId: memberOrgId,
+            transaction,
+        }))) {
+            return true;
+        }
+        const { validateFederatedOrganizationMembershipForCurrentRequest } = await import("../org/federation.js");
+        const validation = await validateFederatedOrganizationMembershipForCurrentRequest({
+            orgId: memberOrgId,
+            email: normalizedEmail,
+        });
+        return validation.active;
     });
-    return validation.active;
 }
 export function accessFilter(resourceTable, sharesTable, rawCtx = currentAccess(), minRole = "viewer", options = {}) {
     const reg = findRegistrationByTable(resourceTable);
@@ -469,6 +463,17 @@ async function ownerOrAdminRole(reg, resource, ctx, normalizedUserEmail) {
 async function accessToResource(reg, resourceId, resource, ctx) {
     const { userEmail } = ctx;
     const normalizedUserEmail = normalizeEmailForAccess(userEmail);
+    const memberships = new Map();
+    const isOrgMember = (orgId) => {
+        let membership = memberships.get(orgId);
+        if (!membership) {
+            membership = normalizedUserEmail
+                ? hasCurrentOrgMembership(reg, orgId, normalizedUserEmail, ctx)
+                : Promise.resolve(false);
+            memberships.set(orgId, membership);
+        }
+        return membership;
+    };
     // A host can deny outright. When it grants access, the resource's owner
     // and admins keep their own roles; the host's role covers everyone else.
     const hostResolver = hostAccessResolvers.get(reg.type);
@@ -482,21 +487,19 @@ async function accessToResource(reg, resourceId, resource, ctx) {
         return { role: managingRole, resource };
     if (hosted !== undefined)
         return { role: hosted, resource };
+    const role = await highestShareRole(reg, resourceId, ctx, resource, isOrgMember);
     if (resource.visibility === "public" && reg.allowPublic !== false) {
         const publicRole = await publicAccessRoleForResource(reg, resource, ctx);
-        const role = await highestShareRole(reg, resourceId, ctx, resource);
         return { role: higherShareRole(publicRole, role), resource };
     }
+    if (role)
+        return { role, resource };
     if (resource.visibility === "org" &&
         resource.orgId &&
         normalizedUserEmail &&
-        (await isOrgMember(reg, resource.orgId, normalizedUserEmail, ctx))) {
-        const role = await highestShareRole(reg, resourceId, ctx, resource);
-        return { role: role ?? "viewer", resource };
+        (await isOrgMember(resource.orgId))) {
+        return { role: "viewer", resource };
     }
-    const role = await highestShareRole(reg, resourceId, ctx, resource);
-    if (role)
-        return { role, resource };
     return null;
 }
 /**
@@ -530,7 +533,7 @@ export async function resolveAccessStatus(resourceType, resourceId, ctx = curren
         return { state: available ? "allowed" : "trashed", role: access.role };
     });
 }
-async function highestShareRole(reg, resourceId, ctx, resource) {
+async function highestShareRole(reg, resourceId, ctx, resource, isOrgMember) {
     const { userEmail, orgId } = ctx;
     const normalizedUserEmail = normalizeEmailForAccess(userEmail);
     if (!normalizedUserEmail && !orgId)
@@ -545,34 +548,49 @@ async function highestShareRole(reg, resourceId, ctx, resource) {
     if (orgId) {
         principalClauses.push(and(eq(reg.sharesTable.principalType, "org"), eq(reg.sharesTable.principalId, orgId)));
     }
+    if (principalClauses.length === 0)
+        return null;
+    const rows = await db
+        .select({
+        role: reg.sharesTable.role,
+        principalType: reg.sharesTable.principalType,
+    })
+        .from(reg.sharesTable)
+        .where(and(eq(reg.sharesTable.resourceId, resourceId), or(...principalClauses)))
+        .limit(10);
     let best = null;
+    const grantRows = rows;
+    for (const row of grantRows) {
+        if (row.principalType === "user")
+            best = higherShareRole(row.role, best);
+    }
+    // Direct admin grants are already maximal and do not depend on organization health.
+    if (best === "admin")
+        return best;
+    if (orgId &&
+        grantRows.some((row) => row.principalType === "org") &&
+        (await isOrgMember(orgId))) {
+        for (const row of grantRows) {
+            if (row.principalType === "org")
+                best = higherShareRole(row.role, best);
+        }
+    }
     if (reg.supportsGroupShares && normalizedUserEmail && resource.orgId) {
-        if (await isOrgMember(reg, resource.orgId, normalizedUserEmail, ctx)) {
-            const groupRows = await db
-                .select({
-                principalId: reg.sharesTable.principalId,
-                role: reg.sharesTable.role,
-            })
-                .from(reg.sharesTable)
-                .where(and(eq(reg.sharesTable.resourceId, resourceId), eq(reg.sharesTable.principalType, "group")));
+        const groupRows = await db
+            .select({
+            principalId: reg.sharesTable.principalId,
+            role: reg.sharesTable.role,
+        })
+            .from(reg.sharesTable)
+            .where(and(eq(reg.sharesTable.resourceId, resourceId), eq(reg.sharesTable.principalType, "group")));
+        if (groupRows.length > 0 && (await isOrgMember(resource.orgId))) {
             for (const row of groupRows) {
                 if (await workspaceUserGroupsIncludeUser(resource.orgId, [row.principalId], normalizedUserEmail)) {
-                    if (!best || ROLE_RANK[row.role] > ROLE_RANK[best]) {
-                        best = row.role;
-                    }
+                    best = higherShareRole(row.role, best);
                 }
             }
         }
     }
-    const rows = await db
-        .select({ role: reg.sharesTable.role })
-        .from(reg.sharesTable)
-        .where(and(eq(reg.sharesTable.resourceId, resourceId), or(...principalClauses)))
-        .limit(10);
-    for (const r of rows) {
-        if (!best || ROLE_RANK[r.role] > ROLE_RANK[best])
-            best = r.role;
-    }
     return best;
 }
 export async function assertAccess(resourceType, resourceId, minRole = "viewer", ctx = currentAccess(), options = {}) {

package/dist/tracking/providers.d.ts

@@ -1,2 +1,3 @@
+export declare const AGENT_NATIVE_ANALYTICS_PROVIDER = "agent-native-analytics";
 export declare function sendPostHogEvent(name: string, properties: Record<string, unknown>, distinctId: string): boolean;
 export declare function registerBuiltinProviders(): void;

package/dist/tracking/providers.js

@@ -6,6 +6,7 @@ import { reshapeTrackedExceptionProperties } from "./posthog-exception.js";
 import { registerTrackingProvider } from "./registry.js";
 const POSTHOG_DEFAULT_HOST = "https://us.i.posthog.com";
 const AGENT_NATIVE_ANALYTICS_DEFAULT_ENDPOINT = "https://analytics.agent-native.com/track";
+export const AGENT_NATIVE_ANALYTICS_PROVIDER = "agent-native-analytics";
 const BATCH_INTERVAL_MS = 10_000;
 const MAX_BATCH_SIZE = 50;
 const QUEUE_KEY = Symbol.for("@agent-native/core/tracking.queue");
@@ -323,7 +324,7 @@ function createWebhookProvider(url, authHeader) {
 function createAgentNativeAnalyticsProvider(publicKey, endpoint) {
     const flushImmediately = agentNativeAnalyticsFlushesImmediately();
     return {
-        name: "agent-native-analytics",
+        name: AGENT_NATIVE_ANALYTICS_PROVIDER,
         acceptsTestIdentityExceptions: true,
         track(event) {
             enqueue(endpoint, JSON.stringify({

package/dist/triggers/actions/manage-automation.d.ts

@@ -13,7 +13,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
     executionEngine?: string;
     executionCwd?: string;
 }, {
-    deleted?: undefined;
     created: boolean;
     name: string;
     scope: "organization" | "personal";
@@ -24,6 +23,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     reasoningEffort: "auto" | "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh";
     webhookPath: string;
     nextRun: string;
+    deleted?: undefined;
     enabled?: undefined;
     executionHostId?: undefined;
     executionEngine?: undefined;
@@ -45,11 +45,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     nextRun?: undefined;
     webhookPath?: undefined;
 } | {
-    deleted?: undefined;
     created?: undefined;
     scope?: undefined;
     triggerType?: undefined;
     event?: undefined;
+    deleted?: undefined;
     name: string;
     enabled: boolean;
     schedule: string;

package/dist/vite/bounded-task-plugin.d.ts

@@ -0,0 +1,22 @@
+interface PluginContext {
+    resolve(source: string, importer?: string, options?: {
+        skipSelf?: boolean;
+    }): Promise<{
+        id: string;
+        external?: boolean | string;
+    } | null>;
+    addWatchFile(file: string): void;
+}
+/**
+ * `import source from "./tasks.ts?bounded-task"` yields the module bundled
+ * into a `BoundedTaskSource` at build time, so deployed servers never run
+ * esbuild. Registered for Vite (dev and client builds) and the production
+ * Nitro build.
+ */
+export declare function boundedTaskSourcePlugin(): {
+    name: string;
+    enforce: "pre";
+    resolveId(this: PluginContext, source: string, importer?: string): Promise<string>;
+    load(this: PluginContext, id: string): Promise<string>;
+};
+export {};

package/dist/vite/bounded-task-plugin.js

@@ -0,0 +1,44 @@
+import path from "node:path";
+import { bundleBoundedTaskSource } from "../collab/bounded-task-bundle.js";
+const QUERY = "?bounded-task";
+const RESOLVED_PREFIX = "\0agent-native-bounded-task:";
+/**
+ * `import source from "./tasks.ts?bounded-task"` yields the module bundled
+ * into a `BoundedTaskSource` at build time, so deployed servers never run
+ * esbuild. Registered for Vite (dev and client builds) and the production
+ * Nitro build.
+ */
+export function boundedTaskSourcePlugin() {
+    return {
+        name: "agent-native-bounded-task-source",
+        enforce: "pre",
+        async resolveId(source, importer) {
+            if (!source.endsWith(QUERY))
+                return null;
+            const request = source.slice(0, -QUERY.length);
+            const resolved = await this.resolve(request, importer, {
+                skipSelf: true,
+            });
+            if (!resolved || resolved.external) {
+                throw new Error(`Cannot resolve bounded task module ${request}${importer ? ` from ${importer}` : ""}`);
+            }
+            return RESOLVED_PREFIX + resolved.id.split("?")[0];
+        },
+        async load(id) {
+            if (!id.startsWith(RESOLVED_PREFIX))
+                return null;
+            const entry = id.slice(RESOLVED_PREFIX.length);
+            const bundled = await bundleBoundedTaskSource(entry, {
+                name: path.basename(entry).replace(/\.[^.]+$/, ""),
+            });
+            for (const input of bundled.inputs)
+                this.addWatchFile(input);
+            const source = {
+                kind: bundled.kind,
+                name: bundled.name,
+                code: bundled.code,
+            };
+            return `export default Object.freeze(${JSON.stringify(source)});\n`;
+        },
+    };
+}

package/dist/vite/client.js

@@ -29,6 +29,7 @@ import { AGENT_NATIVE_TYPEGEN_ENV, formatRuntimeConfigReport, getRuntimeConfigRe
 import { actionTypesPlugin } from "./action-types-plugin.js";
 import { createAgentNativeConfigContext, loadAgentNativeConfigFile, loadWorkspaceAgentNativeConfigFile, readAgentNativeJsonConfig, resolveFirstRunOnboardingBuildReplacement, resolveHarnessBuildReplacement, writeAgentNativeBuildConfigMarker, } from "./agent-native-config-loader.js";
 import { agentsBundlePlugin } from "./agents-bundle-plugin.js";
+import { boundedTaskSourcePlugin } from "./bounded-task-plugin.js";
 import { migrationDiagnosticPlugin } from "./migration-diagnostic-plugin.js";
 import { motionSourceProvenancePlugin } from "./motion-source-provenance-plugin.js";
 import { resolveAgentNativePackageVersions } from "./package-versions.js";
@@ -3657,6 +3658,7 @@ function createAgentNativePlugins(options, { command, includeReactTransform, use
         appChangelogRawPlugin(),
         actionTypesPlugin(),
         agentsBundlePlugin({ agentNativeConfig: options.agentNativeConfig }),
+        boundedTaskSourcePlugin(),
         authClientAssetPlugin(cwd),
         autoReloadOnOptimizeDep(),
         fullReloadOnOptimizeDep504(),

package/dist/vitest-config.js

@@ -1,3 +1,4 @@
+import { boundedTaskSourcePlugin } from "./vite/bounded-task-plugin.js";
 const DEFAULT_MAX_WORKERS = "25%";
 const ENV_KEYS = ["VITEST_CONCURRENCY", "AGENT_NATIVE_VITEST_CONCURRENCY"];
 export function resolveMaxWorkers(env = process.env, fallback = DEFAULT_MAX_WORKERS) {
@@ -25,6 +26,8 @@ export function resolveMaxWorkers(env = process.env, fallback = DEFAULT_MAX_WORK
     return count;
 }
 const vitestBaseConfig = {
+    // App tests import server modules that load `?bounded-task` sources.
+    plugins: [boundedTaskSourcePlugin()],
     test: {
         maxWorkers: resolveMaxWorkers(),
         // Vitest's 5 s default only holds while a worker has a core to itself.

package/dist/workspace-connections/actions/list-workspace-user-groups.d.ts

@@ -1,10 +1,10 @@
 declare const _default: import("../../action.js").ActionDefinition<Record<string, never>, {
+    memberEmails: any[];
     id: string;
     orgId: string;
     name: string;
     createdByEmail: string;
     createdAt: string;
     updatedAt: string;
-    memberEmails: any[];
 }[]>;
 export default _default;