@agent-native/core 0.212.1 → 0.214.0

package/dist/audit/ocsf.js

@@ -177,6 +177,7 @@ export function auditEventToOcsf(event) {
     keep("reported_client_version", event.reportedClientVersion);
     keep("oauth_client_id", event.oauthClientId);
     keep("approval", event.approval);
+    keep("identity_assurance", event.identityAssurance);
     const resource = event.targetType || event.targetId
         ? [
             {

package/dist/audit/read-scope.js

@@ -4,9 +4,9 @@
  * decided on the server from `org_members`, never from anything the caller
  * sends.
  */
-import { getDbExec } from "../db/client.js";
 import { isMissingOrganizationTableError } from "../org/membership.js";
 import { canManageOrg } from "../org/permissions.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 export class AuditAccessError extends Error {
     statusCode = 403;
     constructor(message) {
@@ -16,17 +16,7 @@ export class AuditAccessError extends Error {
 }
 async function readOrgRole(orgId, email) {
     try {
-        const { rows } = await getDbExec().execute({
-            sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-            args: [orgId, email.toLowerCase()],
-        });
-        const role = rows[0]?.role;
-        return role === "owner" || role === "admin" || role === "member"
-            ? role
-            : null;
+        return await readOrgMemberRole(orgId, email);
     }
     catch (error) {
         // No org tables means no organization to administer. Any other failure

package/dist/audit/record.js

@@ -170,6 +170,7 @@ export async function recordActionAudit(input) {
             reportedClientVersion: reportedLabel(attribution.mcpClient?.version),
             oauthClientId: attribution.mcpClient?.oauthClientId ?? null,
             approval: approvalEvidence(attribution),
+            identityAssurance: attribution.identityAssurance ?? null,
         };
         if (integration) {
             if (ctx?.orgId &&

package/dist/audit/store.js

@@ -78,6 +78,12 @@ export const auditStore = defineStore({
                 "ALTER TABLE agent_audit_log ADD COLUMN IF NOT EXISTS approval TEXT",
             ],
         },
+        {
+            name: "a2a-identity-assurance",
+            sql: [
+                "ALTER TABLE agent_audit_log ADD COLUMN IF NOT EXISTS identity_assurance TEXT",
+            ],
+        },
     ],
 });
 export function ensureAuditTables() {
@@ -100,8 +106,8 @@ export async function insertAuditEvent(event) {
        error_code, owner_email, visibility, run_id, task_id, parent_task_id,
        source_kind, source_platform, source_id, source_url, network_protocol,
        network_id, network_peer, app, reported_client_name,
-       reported_client_version, oauth_client_id, approval)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       reported_client_version, oauth_client_id, approval, identity_assurance)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: [
             event.id,
             event.createdAt,
@@ -135,6 +141,7 @@ export async function insertAuditEvent(event) {
             event.reportedClientVersion ?? null,
             event.oauthClientId ?? null,
             event.approval ?? null,
+            event.identityAssurance ?? null,
         ].map(storableText),
     });
 }
@@ -203,6 +210,8 @@ function mapRow(row) {
         reportedClientVersion: row.reported_client_version ?? null,
         oauthClientId: row.oauth_client_id ?? null,
         approval: (row.approval ?? null),
+        identityAssurance: (row.identity_assurance ??
+            null),
     };
 }
 function sharedVisibilities(scope) {
@@ -252,7 +261,7 @@ const LIST_COLUMNS = "id, created_at, action, caller, actor_kind, actor_email, o
     "error_code, owner_email, visibility, app, run_id, task_id, " +
     "parent_task_id, source_kind, source_platform, source_id, source_url, " +
     "network_protocol, network_id, network_peer, reported_client_name, " +
-    "reported_client_version, oauth_client_id, approval";
+    "reported_client_version, oauth_client_id, approval, identity_assurance";
 function clampLimit(limit) {
     return Math.min(Math.max(1, Math.floor(limit ?? DEFAULT_LIMIT)), MAX_LIMIT);
 }

package/dist/audit/types.d.ts

@@ -7,6 +7,8 @@ export type AuditActorKind = "agent" | "human" | "service" | "system";
  * accepted MCP elicitation response; the server cannot verify who responded.
  */
 export type AuditApproval = "agent-chat" | "a2a-review" | "mcp-client-accepted";
+/** Verified identity provenance for a request authenticated through A2A. */
+export type AuditIdentityAssurance = "user" | "organization" | "org-member";
 /**
  * Who can read an event besides its owner.
  * - `private` — the owner only (the default; personal content stays here).
@@ -80,6 +82,8 @@ export interface AuditEvent {
      * not verify who responded. Rows written before the column existed are null.
      */
     approval?: AuditApproval | null;
+    /** Verified identity provenance; null on older rows or non-A2A calls. */
+    identityAssurance?: AuditIdentityAssurance | null;
 }
 export interface AuditQueryFilters {
     targetType?: string;

package/dist/automation/index.d.ts

@@ -139,8 +139,8 @@ export declare function createAutomationCallbackHandler(runtime: AutomationRunti
     duplicate?: undefined;
     eventId?: undefined;
 } | {
+    error?: undefined;
     accepted: boolean;
     duplicate: boolean;
     eventId: string;
-    error?: undefined;
 }>;

package/dist/automations/service.js

@@ -6,6 +6,7 @@ import { deleteAutomationRunsWithDb, ensureAutomationRunHistoryReady, prepareAut
 import { applyJobResourceEdit } from "../jobs/update-job-resource.js";
 import { resolveUserSchedulingTimezone } from "../localization/user-timezone.js";
 import { organizationIdFromResourceOwner, organizationResourceOwner, ensureResourceStoreReady, prepareResourceBatchAssertion, prepareResourceCreate, prepareResourceDelete, prepareResourceUpdate, resourceGetByPath, resourceList, resourcePutWithDb, resourceDelete, SHARED_OWNER, } from "../resources/store.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { isReasoningEffort, } from "../shared/reasoning-effort.js";
 import { deleteAutomationWebhookToken, readAutomationWebhookPath, saveAutomationWebhookToken, } from "../triggers/webhook-store.js";
 import { createAutomationWebhookToken, automationWebhookPath, } from "../triggers/webhook.js";
@@ -61,16 +62,8 @@ function ownerForScope(actor, scope) {
     return organizationResourceOwner(actor.orgId);
 }
 async function readOrganizationMembership(orgId, email) {
-    const result = await getDbExec().execute({
-        sql: `SELECT role FROM org_members
-          WHERE org_id = ? AND LOWER(email) = ?
-            AND federation_removal_pending_at IS NULL
-          LIMIT 1`,
-        args: [orgId, email.toLowerCase()],
-    });
-    if (!result.rows.length)
-        return null;
-    return { role: String(result.rows[0]?.role ?? "").toLowerCase() };
+    const role = await readOrgMemberRole(orgId, email);
+    return role ? { role } : null;
 }
 async function requireOrganizationMembership(actor) {
     if (!actor.orgId) {

package/dist/client/org/hooks.d.ts

@@ -235,6 +235,9 @@ export declare function useSetA2ASecret(): import("@tanstack/react-query").UseMu
     a2aSecret: string;
     previousSecret: string | null;
 }, Error, string | undefined, unknown>;
+export declare function useSetA2AMemberDelegation(): import("@tanstack/react-query").UseMutationResult<{
+    enabled: boolean;
+}, Error, boolean, unknown>;
 export interface SyncA2ASecretResult {
     total: number;
     succeeded: number;

package/dist/client/org/hooks.js

@@ -486,6 +486,18 @@ export function useSetA2ASecret() {
         },
     });
 }
+export function useSetA2AMemberDelegation() {
+    const qc = useQueryClient();
+    return useMutation({
+        mutationFn: (enabled) => apiFetch(`${orgBasePath()}/a2a-member-delegation`, {
+            method: "PUT",
+            body: JSON.stringify({ enabled }),
+        }),
+        onSuccess: async () => {
+            await qc.invalidateQueries({ queryKey: ["org-me"] });
+        },
+    });
+}
 export function useSyncA2ASecret() {
     return useMutation({
         mutationFn: (vars) => apiFetch(`${orgBasePath()}/a2a-secret/sync`, {

package/dist/client/theme-family.d.ts

@@ -0,0 +1,35 @@
+import { type ThemeFamily } from "../appearance/theme-family.js";
+export { DEFAULT_THEME_FAMILY, isThemeFamily, THEME_FAMILY_APP_STATE_KEY, THEME_FAMILY_ATTRIBUTE, THEME_FAMILY_STORAGE_KEY, themeFamilyAppStateKey, themeFamilyStorageKey, type ThemeFamily, } from "../appearance/theme-family.js";
+export declare const THEME_FAMILY_CHANGE_EVENT = "agent-native:theme-family-change";
+export type ThemeFamilyStorageStatus = "valid" | "missing" | "invalid" | "unreadable";
+export type StoredThemeFamily = {
+    status: "valid";
+    family: ThemeFamily;
+} | {
+    status: "missing";
+} | {
+    status: "invalid";
+    value: string;
+} | {
+    status: "unreadable";
+    error: Error;
+};
+export interface ThemeFamilyApplyResult {
+    family: ThemeFamily;
+    storageStatus: "saved" | "unavailable";
+}
+export interface ThemeFamilyPreference {
+    family: ThemeFamily;
+    source: "default" | "user-setting";
+    appId: string | null;
+}
+export declare function readStoredThemeFamily(appId?: string | null): StoredThemeFamily;
+export declare function applyThemeFamily(family: ThemeFamily, appId?: string | null): ThemeFamilyApplyResult;
+export interface ThemeFamilyHook {
+    family: ThemeFamily;
+    status: "loading" | "success" | "error";
+    error?: Error;
+    storageStatus: ThemeFamilyStorageStatus;
+    setFamily: (family: ThemeFamily) => Promise<ThemeFamily>;
+}
+export declare function useThemeFamily(): ThemeFamilyHook;

package/dist/client/theme-family.js

@@ -0,0 +1,223 @@
+import { useCallback, useEffect, useRef, useState, useSyncExternalStore, } from "react";
+import { DEFAULT_THEME_FAMILY, isThemeFamily, THEME_FAMILY_ATTRIBUTE, THEME_FAMILY_STATUS_ATTRIBUTE, themeFamilyAppStateKey, themeFamilyStorageKey, } from "../appearance/theme-family.js";
+import { injectedAgentNativeAppId } from "./app-config.js";
+import { readClientAppState } from "./application-state.js";
+import { useActionMutation, useActionQuery } from "./use-action.js";
+import { useChangeVersion } from "./use-change-version.js";
+export { DEFAULT_THEME_FAMILY, isThemeFamily, THEME_FAMILY_APP_STATE_KEY, THEME_FAMILY_ATTRIBUTE, THEME_FAMILY_STORAGE_KEY, themeFamilyAppStateKey, themeFamilyStorageKey, } from "../appearance/theme-family.js";
+export const THEME_FAMILY_CHANGE_EVENT = "agent-native:theme-family-change";
+const familySnapshots = new Map();
+function resolvedAppId(appId) {
+    if (appId !== undefined)
+        return appId ?? undefined;
+    return injectedAgentNativeAppId() ?? undefined;
+}
+function scopeKey(appId) {
+    return themeFamilyStorageKey(resolvedAppId(appId));
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+export function readStoredThemeFamily(appId) {
+    if (typeof window === "undefined")
+        return { status: "missing" };
+    let value;
+    try {
+        value = window.localStorage.getItem(themeFamilyStorageKey(resolvedAppId(appId)));
+    }
+    catch (error) {
+        return { status: "unreadable", error: asError(error) };
+    }
+    if (value === null)
+        return { status: "missing" };
+    if (isThemeFamily(value))
+        return { status: "valid", family: value };
+    return { status: "invalid", value };
+}
+function getFamilySnapshot(appId) {
+    return familySnapshots.get(scopeKey(appId)) ?? DEFAULT_THEME_FAMILY;
+}
+function subscribe(onChange, appId) {
+    if (typeof window === "undefined")
+        return () => { };
+    const refreshFromStorage = () => {
+        const stored = readStoredThemeFamily(appId);
+        const key = scopeKey(appId);
+        if (stored.status === "valid") {
+            familySnapshots.set(key, stored.family);
+            window.document.documentElement.setAttribute(THEME_FAMILY_ATTRIBUTE, stored.family);
+            window.document.documentElement.removeAttribute(THEME_FAMILY_STATUS_ATTRIBUTE);
+        }
+        else if (stored.status === "missing" || stored.status === "invalid") {
+            familySnapshots.set(key, DEFAULT_THEME_FAMILY);
+            window.document.documentElement.setAttribute(THEME_FAMILY_ATTRIBUTE, DEFAULT_THEME_FAMILY);
+            if (stored.status === "invalid") {
+                window.document.documentElement.setAttribute(THEME_FAMILY_STATUS_ATTRIBUTE, "invalid");
+            }
+        }
+        onChange();
+    };
+    const onStorage = (event) => {
+        if (event.key === null || event.key === scopeKey(appId)) {
+            refreshFromStorage();
+        }
+    };
+    const onFamilyChange = (event) => {
+        const storageKey = event.detail
+            ?.storageKey;
+        if (storageKey === scopeKey(appId))
+            refreshFromStorage();
+    };
+    window.addEventListener("storage", onStorage);
+    window.addEventListener(THEME_FAMILY_CHANGE_EVENT, onFamilyChange);
+    return () => {
+        window.removeEventListener("storage", onStorage);
+        window.removeEventListener(THEME_FAMILY_CHANGE_EVENT, onFamilyChange);
+    };
+}
+export function applyThemeFamily(family, appId) {
+    if (!isThemeFamily(family)) {
+        throw new TypeError(`Unknown theme family: ${String(family)}`);
+    }
+    const storageAppId = resolvedAppId(appId);
+    const key = themeFamilyStorageKey(storageAppId);
+    familySnapshots.set(key, family);
+    if (typeof window === "undefined") {
+        return { family, storageStatus: "unavailable" };
+    }
+    const root = window.document.documentElement;
+    root.setAttribute(THEME_FAMILY_ATTRIBUTE, family);
+    try {
+        window.localStorage.setItem(key, family);
+        root.removeAttribute(THEME_FAMILY_STATUS_ATTRIBUTE);
+        window.dispatchEvent(new CustomEvent(THEME_FAMILY_CHANGE_EVENT, {
+            detail: { storageKey: key },
+        }));
+        return { family, storageStatus: "saved" };
+    }
+    catch {
+        root.setAttribute(THEME_FAMILY_STATUS_ATTRIBUTE, "unreadable");
+        window.dispatchEvent(new CustomEvent(THEME_FAMILY_CHANGE_EVENT, {
+            detail: { storageKey: key },
+        }));
+        return { family, storageStatus: "unavailable" };
+    }
+}
+function storageStatusForApply(result) {
+    return result.storageStatus === "saved" ? "valid" : "unreadable";
+}
+function errorForState(value) {
+    return new Error(`The open app's theme-family state is invalid: ${JSON.stringify(value)}`);
+}
+export function useThemeFamily() {
+    const runtimeAppId = injectedAgentNativeAppId();
+    const query = useActionQuery("get-theme-family", undefined, { retry: false, queryKeyScope: ["theme-family", runtimeAppId] });
+    const mutation = useActionMutation("set-theme-family", { skipActionQueryInvalidation: true });
+    const appId = query.data === undefined ? runtimeAppId : query.data.appId;
+    const appStateKey = themeFamilyAppStateKey(appId ?? undefined);
+    const appStateVersion = useChangeVersion(`app-state:${appStateKey}`);
+    const [storageStatus, setStorageStatus] = useState(() => readStoredThemeFamily(appId).status);
+    const [mutationError, setMutationError] = useState();
+    const mutationPending = useRef(false);
+    const family = useSyncExternalStore((onChange) => subscribe(onChange, appId), () => getFamilySnapshot(appId), () => DEFAULT_THEME_FAMILY);
+    useEffect(() => {
+        if (mutationPending.current)
+            return;
+        if (query.data === undefined)
+            return;
+        if (!isThemeFamily(query.data?.family)) {
+            setMutationError(errorForState(query.data));
+            return;
+        }
+        const applied = applyThemeFamily(query.data.family, query.data.appId);
+        setStorageStatus(storageStatusForApply(applied));
+        setMutationError(undefined);
+    }, [mutationPending, query.data]);
+    useEffect(() => {
+        if (appStateVersion === 0)
+            return;
+        let current = true;
+        void readClientAppState(appStateKey)
+            .then((state) => {
+            if (!current || state === null)
+                return;
+            if (!isThemeFamily(state.family)) {
+                setMutationError(errorForState(state));
+                return;
+            }
+            const applied = applyThemeFamily(state.family, appId);
+            setStorageStatus(storageStatusForApply(applied));
+            setMutationError(undefined);
+        })
+            .catch((error) => {
+            if (current)
+                setMutationError(asError(error));
+        });
+        return () => {
+            current = false;
+        };
+    }, [appId, appStateKey, appStateVersion]);
+    const setFamily = useCallback(async (nextFamily) => {
+        if (!isThemeFamily(nextFamily)) {
+            throw new TypeError(`Unknown theme family: ${String(nextFamily)}`);
+        }
+        const previousAppId = appId;
+        const previousFamily = getFamilySnapshot(previousAppId);
+        mutationPending.current = true;
+        const optimistic = applyThemeFamily(nextFamily, previousAppId);
+        setStorageStatus(storageStatusForApply(optimistic));
+        setMutationError(undefined);
+        try {
+            const result = await mutation.mutateAsync({ family: nextFamily });
+            if (!isThemeFamily(result?.family)) {
+                throw errorForState(result);
+            }
+            if (result.appId !== null && typeof result.appId !== "string") {
+                throw errorForState(result);
+            }
+            if (result.family !== nextFamily) {
+                throw new Error("The saved theme family did not match the selection.");
+            }
+            mutationPending.current = false;
+            const applied = applyThemeFamily(result.family, result.appId);
+            setStorageStatus(storageStatusForApply(applied));
+            return result.family;
+        }
+        catch (error) {
+            const normalized = asError(error);
+            let reconciledFamily = previousFamily;
+            let reconciledAppId = previousAppId;
+            let reconciliationError;
+            try {
+                const refreshed = await query.refetch();
+                const data = refreshed.data;
+                if (refreshed.isError) {
+                    reconciliationError = asError(refreshed.error);
+                }
+                else if (!data ||
+                    !isThemeFamily(data.family) ||
+                    (data.appId !== null && typeof data.appId !== "string")) {
+                    reconciliationError = errorForState(data);
+                }
+                else {
+                    reconciledFamily = data.family;
+                    reconciledAppId = data.appId;
+                }
+            }
+            catch (refreshError) {
+                reconciliationError = asError(refreshError);
+            }
+            mutationPending.current = false;
+            const reconciled = applyThemeFamily(reconciledFamily, reconciledAppId);
+            setStorageStatus(storageStatusForApply(reconciled));
+            const failure = reconciliationError
+                ? new AggregateError([normalized, reconciliationError], "The theme family update failed and its saved value could not be reloaded.")
+                : normalized;
+            setMutationError(failure);
+            throw failure;
+        }
+    }, [appId, mutation]);
+    const error = mutationError ?? (query.isError ? asError(query.error) : undefined);
+    const status = error ? "error" : query.isSuccess ? "success" : "loading";
+    return { family, status, error, storageStatus, setFamily };
+}

package/dist/client/theme.d.ts

@@ -15,5 +15,5 @@ export interface NormalizedEmbeddedThemeUpdate {
 export declare function parseEmbeddedThemeUpdate(value: unknown): NormalizedEmbeddedThemeUpdate | null;
 export declare function buildEmbeddedThemeUpdate(theme: ResolvedTheme, vars?: Record<string, string>): EmbeddedThemeUpdate;
 export declare function applyEmbeddedThemeUpdate(root: HTMLElement, update: NormalizedEmbeddedThemeUpdate): void;
-export declare function getThemeInitScript(defaultTheme?: ThemePreference, enableSystem?: boolean): string;
+export declare function getThemeInitScript(defaultTheme?: ThemePreference, enableSystem?: boolean, appId?: string): string;
 export declare const themeInitScript: string;

package/dist/client/theme.js

@@ -1,4 +1,6 @@
+import { getThemeFamilyInitScript } from "../appearance/theme-family.js";
 import { THEME_VAR_NAMES } from "../extensions/theme.js";
+import { injectedAgentNativeAppId } from "./app-config.js";
 import { getViteDevRecoveryScript, shouldInlineViteDevRecoveryScript, } from "./vite-dev-recovery-script.js";
 export const EMBEDDED_THEME_UPDATE_MESSAGE = "agent-native-theme-update";
 export const EMBEDDED_THEME_CHANGE_EVENT = "agent-native:theme-change";
@@ -60,10 +62,11 @@ function normalizeDefaultTheme(theme) {
     }
     return "system";
 }
-export function getThemeInitScript(defaultTheme = "system", enableSystem = true) {
+export function getThemeInitScript(defaultTheme = "system", enableSystem = true, appId) {
     const safeDefaultTheme = normalizeDefaultTheme(defaultTheme);
     const systemEnabled = enableSystem ? "true" : "false";
-    const themeScript = `(function(){function m(){var d={};return{get length(){return Object.keys(d).length},key:function(i){return Object.keys(d)[i]||null},getItem:function(k){k=String(k);return Object.prototype.hasOwnProperty.call(d,k)?d[k]:null},setItem:function(k,v){d[String(k)]=String(v)},removeItem:function(k){delete d[String(k)]},clear:function(){d={}}}}function s(n){try{var x=window[n],p='__an_storage_probe__';x.setItem(p,'1');x.removeItem(p)}catch(e){try{Object.defineProperty(window,n,{configurable:true,value:m()})}catch(_){}}}s('localStorage');s('sessionStorage');try{var defaultTheme=${JSON.stringify(safeDefaultTheme)};var enableSystem=${systemEnabled};var stored=window.localStorage.getItem('theme');var valid=stored==='light'||stored==='dark'||stored==='system'||stored==='auto';var mode=valid?stored:defaultTheme;if(mode==='auto')mode='system';if(!enableSystem&&mode==='system')mode=defaultTheme==='system'?'light':defaultTheme;if(!valid){window.localStorage.removeItem('theme')}else if(stored!==mode){window.localStorage.setItem('theme',mode)}var prefersDark=enableSystem&&mode==='system'&&window.matchMedia&&window.matchMedia('(prefers-color-scheme: dark)').matches;var resolved=mode==='system'?(prefersDark?'dark':'light'):mode;var root=document.documentElement;root.classList.remove('light','dark');root.classList.add(resolved);root.setAttribute('data-theme',resolved);root.style.colorScheme=resolved;var appearance=window.localStorage.getItem('appearance');var appearanceValid=appearance==='warm'||appearance==='ocean'||appearance==='forest'||appearance==='rose'||appearance==='slate';if(appearanceValid){root.setAttribute('data-appearance',appearance)}else{root.removeAttribute('data-appearance');if(appearance!==null)window.localStorage.removeItem('appearance')}}catch(e){}})();`;
+    const themeFamilyAppId = appId ?? injectedAgentNativeAppId() ?? undefined;
+    const themeScript = `${getThemeFamilyInitScript(themeFamilyAppId)}\n(function(){function m(){var d={};return{get length(){return Object.keys(d).length},key:function(i){return Object.keys(d)[i]||null},getItem:function(k){k=String(k);return Object.prototype.hasOwnProperty.call(d,k)?d[k]:null},setItem:function(k,v){d[String(k)]=String(v)},removeItem:function(k){delete d[k]},clear:function(){d={}}}}function s(n){try{var x=window[n],p='__an_storage_probe__';x.setItem(p,'1');x.removeItem(p)}catch(e){try{Object.defineProperty(window,n,{configurable:true,value:m()})}catch(_){}}}s('localStorage');s('sessionStorage');try{var defaultTheme=${JSON.stringify(safeDefaultTheme)};var enableSystem=${systemEnabled};var stored=window.localStorage.getItem('theme');var valid=stored==='light'||stored==='dark'||stored==='system'||stored==='auto';var mode=valid?stored:defaultTheme;if(mode==='auto')mode='system';if(!enableSystem&&mode==='system')mode=defaultTheme==='system'?'light':defaultTheme;if(!valid){window.localStorage.removeItem('theme')}else if(stored!==mode){window.localStorage.setItem('theme',mode)}var prefersDark=enableSystem&&mode==='system'&&window.matchMedia&&window.matchMedia('(prefers-color-scheme: dark)').matches;var resolved=mode==='system'?(prefersDark?'dark':'light'):mode;var root=document.documentElement;root.classList.remove('light','dark');root.classList.add(resolved);root.setAttribute('data-theme',resolved);root.style.colorScheme=resolved;var appearance=window.localStorage.getItem('appearance');var appearanceValid=appearance==='warm'||appearance==='ocean'||appearance==='forest'||appearance==='rose'||appearance==='slate';if(appearanceValid){root.setAttribute('data-appearance',appearance)}else{root.removeAttribute('data-appearance');if(appearance!==null)window.localStorage.removeItem('appearance')}}catch(e){document.documentElement.setAttribute('data-theme-status','unreadable')}})();`;
     if (!shouldInlineViteDevRecoveryScript())
         return themeScript;
     return `${themeScript}\n${getViteDevRecoveryScript()}`;

package/dist/client/ui/index.d.ts

@@ -2,3 +2,4 @@ export { buildErrorReportTemplate, buildGitHubIssueUrl, type ErrorReportDebugIte
 export { getClientSurface, type ClientSurface } from "../client-surface.js";
 export { applyEmbeddedThemeUpdate, buildEmbeddedThemeUpdate, EMBEDDED_THEME_CHANGE_EVENT, EMBEDDED_THEME_UPDATE_MESSAGE, getThemeInitScript, parseEmbeddedThemeUpdate, themeInitScript, type EmbeddedThemeUpdate, type NormalizedEmbeddedThemeUpdate, type ResolvedTheme, type ThemePreference, } from "../theme.js";
 export { APPEARANCE_PRESETS, applyAppearance, getStoredAppearance, useAppearance, useAppearanceSync, type AppearancePresetId, } from "../appearance.js";
+export { applyThemeFamily, readStoredThemeFamily, THEME_FAMILY_CHANGE_EVENT, useThemeFamily, type StoredThemeFamily, type ThemeFamily, type ThemeFamilyApplyResult, type ThemeFamilyHook, type ThemeFamilyStorageStatus, } from "../theme-family.js";

package/dist/client/ui/index.js

@@ -2,3 +2,4 @@ export { buildErrorReportTemplate, buildGitHubIssueUrl, } from "../error-reporti
 export { getClientSurface } from "../client-surface.js";
 export { applyEmbeddedThemeUpdate, buildEmbeddedThemeUpdate, EMBEDDED_THEME_CHANGE_EVENT, EMBEDDED_THEME_UPDATE_MESSAGE, getThemeInitScript, parseEmbeddedThemeUpdate, themeInitScript, } from "../theme.js";
 export { APPEARANCE_PRESETS, applyAppearance, getStoredAppearance, useAppearance, useAppearanceSync, } from "../appearance.js";
+export { applyThemeFamily, readStoredThemeFamily, THEME_FAMILY_CHANGE_EVENT, useThemeFamily, } from "../theme-family.js";

package/dist/collab/awareness.d.ts

@@ -38,19 +38,19 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -13,12 +13,12 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
     };
 }>>;
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
-    error?: undefined;
     liveCopy: "derived" | "not_derived" | "unchanged";
     liveCopyReason?: string;
+    error?: undefined;
     ok: boolean;
 } | {
     error?: undefined;

package/dist/collab/struct-routes.d.ts

@@ -1,6 +1,6 @@
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/connections/catalog.d.ts

@@ -65,7 +65,7 @@ export declare const WORKSPACE_CONNECTION_PROVIDERS: readonly [{
         readonly scopes: readonly ["repo", "read:org", "read:user", "user:email"];
     };
     readonly capabilities: readonly ["search", "import", "code", "docs"];
-    readonly recommendedTemplateUses: readonly ["brain", "analytics", "dispatch", "factory"];
+    readonly recommendedTemplateUses: readonly ["brain", "analytics", "content", "dispatch", "factory"];
 }, {
     readonly id: "figma";
     readonly label: "Figma";

package/dist/connections/catalog.js

@@ -59,7 +59,13 @@ export const WORKSPACE_CONNECTION_PROVIDERS = [
             scopes: ["repo", "read:org", "read:user", "user:email"],
         },
         capabilities: ["search", "import", "code", "docs"],
-        recommendedTemplateUses: ["brain", "analytics", "dispatch", "factory"],
+        recommendedTemplateUses: [
+            "brain",
+            "analytics",
+            "content",
+            "dispatch",
+            "factory",
+        ],
     }),
     defineWorkspaceConnectionProvider({
         id: "figma",

package/dist/credentials/index.js

@@ -5,6 +5,7 @@ import { deleteAppSecret, readAppSecret, } from "../secrets/storage.js";
 import { assertCredentialStoreReadable } from "../server/credential-provider.js";
 import { isPersonalCredentialScope, readsOrgCredentialFirst, } from "../server/credential-read-order.js";
 import { isPersonalProviderKeyUseRestricted, isPersonalProviderPolicyKey, readOrgMemberRole, } from "../server/personal-provider-key-policy.js";
+import { getRequestContext } from "../server/request-context.js";
 import { getSetting, putSetting, deleteSetting } from "../settings/store.js";
 const SETTING_PREFIX = "credential:";
 export class CredentialEndpointMismatchError extends Error {
@@ -239,7 +240,20 @@ export async function resolveCredential(key, ctx) {
 export async function describeCredentialScopeGap(keys, ctx) {
     if (!ctx?.userEmail)
         return null;
-    const orgLookup = await resolveEffectiveOrgId(ctx);
+    const requestContext = getRequestContext();
+    const isDelegatedOrgMember = requestContext?.a2aIdentityAssurance === "org-member";
+    const delegatedEmail = requestContext?.userEmail?.trim().toLowerCase();
+    const delegatedOrgId = requestContext?.orgId?.trim();
+    if (isDelegatedOrgMember &&
+        (!delegatedEmail ||
+            delegatedEmail !== ctx.userEmail.trim().toLowerCase() ||
+            !delegatedOrgId ||
+            (ctx.orgId && ctx.orgId.trim() !== delegatedOrgId))) {
+        return null;
+    }
+    const orgLookup = isDelegatedOrgMember
+        ? { orgId: delegatedOrgId, lookupFailed: false }
+        : await resolveEffectiveOrgId(ctx);
     if (orgLookup.lookupFailed || !orgLookup.orgId)
         return null;
     const scopedCtx = { ...ctx, orgId: orgLookup.orgId };
@@ -251,7 +265,9 @@ export async function describeCredentialScopeGap(keys, ctx) {
                 `integration, job, or automation — so it needs "${key}" saved with ` +
                 `Workspace or Organization scope instead.`);
         }
-        const holder = await findMemberOrgHoldingCredential(key, scopedCtx);
+        const holder = isDelegatedOrgMember
+            ? null
+            : await findMemberOrgHoldingCredential(key, scopedCtx);
         if (holder) {
             return (`A "${key}" key is saved in the ${holder} organization, but this ` +
                 `request resolved to a different organization you also belong to. ` +