@agent-native/core 0.216.0 → 0.218.0

package/dist/server/analytics.d.ts

@@ -1,5 +1,4 @@
 export declare function getAgentNativeAnalyticsConfigScript(): string | null;
-export declare function getHeadScriptTag(): string | null;
 export declare function getGaInlineConfigScriptBody(options?: {
     dataLayerName?: string;
     sendPageView?: boolean;

package/dist/server/analytics.js

@@ -1,5 +1,7 @@
 import { getAppConfig } from "../app-config/index.js";
+import { CONSENT_REGION_PATH, CONSENT_REGION_TIME_ZONE_LIST, } from "../shared/consent.js";
 import { SYNTHETIC_TRAFFIC_BETA_E2E } from "../shared/test-traffic.js";
+import { publicFrameworkPath } from "./framework-route-prefix.js";
 const AGENT_NATIVE_ANALYTICS_DEFAULT_ENDPOINT = "https://analytics.agent-native.com/track";
 function normalizeMeasurementId(value) {
     const trimmed = value?.trim();
@@ -54,18 +56,18 @@ export function getAgentNativeAnalyticsConfigScript() {
         ");</script>",
     ].join("");
 }
-function escapeHtmlAttribute(value) {
-    return value
-        .replace(/&/g, "&amp;")
-        .replace(/"/g, "&quot;")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;");
-}
-export function getHeadScriptTag() {
+// A deployment's widget may set cookies or track, so it waits for
+// performance consent like GA does.
+function getHeadScript() {
     const src = getAppConfig().analytics.headScriptSrc;
     if (!src)
         return null;
-    return `<script src="${escapeHtmlAttribute(src)}" defer data-agent-native-head-script></script>`;
+    // "<" inside an inline script could close it early.
+    const jsSrc = JSON.stringify(src).replace(/</g, "\\x3c");
+    return consentGatedScript("performance", `var agentNativeHeadScript=document.createElement('script');` +
+        `agentNativeHeadScript.src=${jsSrc};` +
+        `agentNativeHeadScript.setAttribute('data-agent-native-head-script','');` +
+        `document.head.appendChild(agentNativeHeadScript);`);
 }
 export function getGaInlineConfigScriptBody(options) {
     const id = getGaMeasurementId();
@@ -100,47 +102,106 @@ export function getGaInlineConfigScriptBody(options) {
         `document.head.appendChild(agentNativeGtagScript);` +
         `}`);
 }
+/**
+ * Queue `body` until the visitor's region and choice allow `category`; the
+ * bootstrap after it, or `client/consent.ts` once loaded, runs it. A reject
+ * then a fresh accept calls it again, so it loads its tag only once a page.
+ */
+function consentGatedScript(category, body) {
+    return `<script>(window.__AN_CONSENT_QUEUE__=window.__AN_CONSENT_QUEUE__||[]).push([${JSON.stringify(category)},(function(){var ran=false;return function(){if(ran)return;ran=true;${body}}})()]);</script>`;
+}
+const GA_FALLBACK_DATA_LAYER = "__AGENT_NATIVE_GA_DATA_LAYER__";
+// gtag reads an `arguments` object from the data layer, never an array.
+const GOOGLE_CONSENT_PUSH = `function push(g){for(var i=0;i<L.length;i++){var l=w[L[i]]=w[L[i]]||[];` +
+    `(function(){l.push(arguments)})("consent",g.mode,{analytics_storage:g.p?"granted":"denied",ad_storage:g.t?"granted":"denied",ad_user_data:g.t?"granted":"denied",ad_personalization:g.t?"granted":"denied"})}}`;
+/**
+ * Google Consent Mode: before any Google tag loads, tell each data layer
+ * what the stored choice allows (nothing, without one), so tags already on
+ * the page stop storing and sending when `client/consent.ts` later pushes a
+ * reject. Lists the layers there, under `__AN_CONSENT_LAYERS__`.
+ */
+function getGoogleConsentDefaultScript(dataLayers) {
+    return (`<script data-agent-native-consent-mode>(function(w,d){var L=${JSON.stringify(dataLayers)};w.__AN_CONSENT_LAYERS__=L;` +
+        GOOGLE_CONSENT_PUSH +
+        `var m=/(?:^|;\\s*)an_consent=1\\.p([01])\\.t([01])(?:;|$)/.exec(d.cookie||"");` +
+        `push({mode:"default",p:!!m&&m[1]==="1",t:!!m&&m[2]==="1"})` +
+        `})(window,document);</script>`);
+}
+/**
+ * Runs the queued tags on pages that never load the app bundle, like the
+ * plain sign-in page, and runs them without waiting for it elsewhere: at once
+ * for a stored choice or a region already known this session, else after
+ * asking the server, with the time zone as fallback. Once
+ * `client/consent.ts` replaces the queue it owns what's left, so nothing runs
+ * twice. Keep its cookie and region rules in step with that module.
+ */
+function getConsentBootstrapScript() {
+    const zones = JSON.stringify(CONSENT_REGION_TIME_ZONE_LIST);
+    const regionPath = JSON.stringify(publicFrameworkPath(CONSENT_REGION_PATH));
+    return (`<script data-agent-native-consent>(function(w,d){var Q="__AN_CONSENT_QUEUE__",K="an_consent_region";` +
+        `function choice(){var m=/(?:^|;\\s*)an_consent=1\\.p([01])\\.t([01])(?:;|$)/.exec(d.cookie||"");return m?{performance:m[1]==="1",targeting:m[2]==="1"}:null}` +
+        `function allows(c,k,region){return c?c[k]:region==="none"}` +
+        `function run(region){var q=w[Q];if(!Array.isArray(q))return;var c=choice(),keep=[],L=w.__AN_CONSENT_LAYERS__||[];` +
+        GOOGLE_CONSENT_PUSH +
+        `push({mode:"update",p:allows(c,"performance",region),t:allows(c,"targeting",region)});` +
+        `for(var i=0;i<q.length;i++){var e=q[i];if(allows(c,e[0],region)){e[1]()}else{keep.push(e)}}q.length=0;q.push.apply(q,keep)}` +
+        `function zone(){try{return ${zones}.indexOf(Intl.DateTimeFormat().resolvedOptions().timeZone)>-1?"consent":"none"}catch(e){return"consent"}}` +
+        // coercion-ok: a page without session storage asks the server again.
+        `var cached=null;try{cached=w.sessionStorage.getItem(K)}catch(e){}` +
+        `if(choice()||cached==="consent"||cached==="none"){run(cached);return}` +
+        // An unreachable server falls back to the time zone.
+        // coercion-ok: a region it can't save is asked again on the next page.
+        `fetch(${regionPath},{credentials:"same-origin"}).then(function(r){return r.ok?r.json():{}}).then(function(b){return b&&(b.region==="consent"||b.region==="none")?b.region:zone()},zone).then(function(region){try{w.sessionStorage.setItem(K,region)}catch(e){}run(region)})` +
+        `})(window,document);</script>`);
+}
 function getGaScript() {
     const id = getGaMeasurementId();
     if (!id)
         return null;
     const inlineBody = getGaInlineConfigScriptBody();
-    return `<script>${inlineBody}</script>`;
+    return inlineBody ? consentGatedScript("performance", inlineBody) : null;
 }
 function getGtmGaFallbackScript() {
     const inlineBody = getGaInlineConfigScriptBody({
-        dataLayerName: "__AGENT_NATIVE_GA_DATA_LAYER__",
+        dataLayerName: GA_FALLBACK_DATA_LAYER,
         sendPageView: false,
     });
-    return inlineBody ? `<script>${inlineBody}</script>` : null;
+    return inlineBody ? consentGatedScript("performance", inlineBody) : null;
 }
+// The container carries the ad pixels (Meta, LinkedIn, Reddit, X, Bing,
+// Google Ads, OpenAI) and B2B identification tags alongside GA events, so it
+// all waits for targeting. Its <noscript> iframe can't wait, so there is none.
 function getGtmHeadScript(containerId) {
     const jsId = JSON.stringify(containerId);
-    return `<script>if(${getSyntheticTrafficBrowserGuard()}){(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer',${jsId});}</script>`;
-}
-function getGtmBodyFallback(containerId) {
-    const src = encodeURIComponent(containerId);
-    return `<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=${src}" height="0" width="0" style="display:none;visibility:hidden" title="Google Tag Manager"></iframe></noscript>`;
+    return consentGatedScript("targeting", `if(${getSyntheticTrafficBrowserGuard()}){(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer',${jsId});}`);
 }
 function getAnalyticsInjection() {
     const agentNativeAnalytics = getAgentNativeAnalyticsConfigScript();
-    const headScript = getHeadScriptTag();
+    const headScript = getHeadScript();
     const containerId = getGtmContainerId();
     if (containerId) {
         return {
             head: [
                 agentNativeAnalytics,
+                getGoogleConsentDefaultScript(["dataLayer", GA_FALLBACK_DATA_LAYER]),
                 getGtmHeadScript(containerId),
                 getGtmGaFallbackScript(),
                 headScript,
+                getConsentBootstrapScript(),
             ]
                 .filter(Boolean)
                 .join(""),
-            body: getGtmBodyFallback(containerId),
+            body: "",
         };
     }
     const gaScript = getGaScript();
-    const head = [agentNativeAnalytics, gaScript, headScript]
+    const head = [
+        agentNativeAnalytics,
+        gaScript ? getGoogleConsentDefaultScript(["dataLayer"]) : null,
+        gaScript,
+        headScript,
+        gaScript || headScript ? getConsentBootstrapScript() : null,
+    ]
         .filter(Boolean)
         .join("");
     return head ? { head, body: "" } : null;

package/dist/server/builder-api-auth.d.ts

@@ -16,6 +16,13 @@ export interface BuilderRequestAuthorization {
     authorization: string;
     source: "oauth" | "legacy";
     oauthScope?: RemoteMcpScope;
+    oauthResource?: "general" | "publish";
+    oauthConnectionId?: string;
+    /**
+     * Space selected during Builder OAuth. This is only a request locator; the
+     * provider must verify the token and reject a different apiKey.
+     */
+    oauthSelectedPublicKey?: string;
     legacyCredentialKey?: BuilderLegacyCredentialKey;
     legacyPublicKey?: string;
     userId?: string;

package/dist/server/builder-api-auth.js

@@ -51,6 +51,22 @@ function isBuilderPublishResource(value) {
         !url.search &&
         !url.hash);
 }
+function selectedPublicKeyFromBuilderAccessToken(token) {
+    const payload = token.split(".")[1];
+    if (!payload)
+        return undefined;
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof decoded.org === "string" && decoded.org.trim()
+            ? decoded.org.trim()
+            : undefined;
+    }
+    catch {
+        // coercion-ok: an opaque or malformed optional locator claim is absent;
+        // authorization remains the provider's signed-token responsibility.
+        return undefined;
+    }
+}
 async function resolveBuilderPublishAuthorization(ownerEmail, orgId) {
     const candidates = orgId
         ? [{ scope: "org", scopeId: orgId }]
@@ -108,6 +124,7 @@ async function resolveBuilderPublishAuthorization(ownerEmail, orgId) {
             authorization: `Bearer ${match[1]}`,
             source: "oauth",
             oauthScope: candidate.scope,
+            oauthResource: "publish",
         };
     }
     if (ownerEmail) {
@@ -154,6 +171,7 @@ export async function resolveBuilderRequestAuthorization(input = {}) {
                 throw new ActionContractError(`Builder.io access needs re-authorizing to grant ${input.requiredScope}. Open Settings and authorize Builder.io again.`, {
                     errorCode: "builder_oauth_reauthorization_required",
                     statusCode: 400,
+                    details: { reason: "missing_scope", scope: input.requiredScope },
                 });
             }
             throw err;
@@ -168,6 +186,7 @@ export async function resolveBuilderRequestAuthorization(input = {}) {
             throw new ActionContractError(`Builder.io access needs re-authorizing to grant ${input.requiredScope}. Open Settings and authorize Builder.io again.`, {
                 errorCode: "builder_oauth_reauthorization_required",
                 statusCode: 400,
+                details: { reason: "missing_scope", scope: input.requiredScope },
             });
         }
         return {
@@ -175,6 +194,11 @@ export async function resolveBuilderRequestAuthorization(input = {}) {
             authorization: `Bearer ${session.accessToken}`,
             source: "oauth",
             oauthScope: session.scope,
+            oauthResource: "general",
+            ...(session.connectionId
+                ? { oauthConnectionId: session.connectionId }
+                : {}),
+            oauthSelectedPublicKey: selectedPublicKeyFromBuilderAccessToken(session.accessToken),
         };
     }
     return resolveBuilderLegacyRequestAuthorization(input.legacyCredentialKeys);

package/dist/server/builder-oauth.d.ts

@@ -3,7 +3,9 @@ export declare const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
 export declare const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
 export declare const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
 export declare const BUILDER_ASSETS_WRITE_SCOPE = "builder:assets:write";
-export declare const BUILDER_OAUTH_SCOPES: readonly ["builder:ai:invoke", "builder:agents:run", "builder:browser:connect", "builder:assets:write", "builder:projects:read", "builder:projects:write", "builder:designsystem:read", "builder:designsystem:write"];
+export declare const BUILDER_CONTENT_READ_SCOPE = "builder:content:read";
+export declare const BUILDER_CONTENT_WRITE_SCOPE = "builder:content:write";
+export declare const BUILDER_OAUTH_SCOPES: readonly ["builder:ai:invoke", "builder:agents:run", "builder:browser:connect", "builder:assets:write", "builder:content:read", "builder:content:write", "builder:projects:read", "builder:projects:write", "builder:designsystem:read", "builder:designsystem:write"];
 export type BuilderOAuthPermissionScope = (typeof BUILDER_OAUTH_SCOPES)[number];
 export type BuilderOAuthPendingFlow = {
     codeVerifier: string;
@@ -43,6 +45,8 @@ export type BuilderOAuthSession = {
     expiresAt?: number;
     scopes: string[];
     scope: BuilderOAuthScope;
+    /** Opaque identity of the selected stored OAuth credential lane. */
+    connectionId?: string;
 };
 export type BuilderOAuthRequestAccess = BuilderOAuthSession & {
     ownerEmail: string;

package/dist/server/builder-oauth.js

@@ -9,11 +9,15 @@ export const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
 export const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
 export const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
 export const BUILDER_ASSETS_WRITE_SCOPE = "builder:assets:write";
+export const BUILDER_CONTENT_READ_SCOPE = "builder:content:read";
+export const BUILDER_CONTENT_WRITE_SCOPE = "builder:content:write";
 export const BUILDER_OAUTH_SCOPES = [
     BUILDER_OAUTH_SCOPE,
     "builder:agents:run",
     "builder:browser:connect",
     BUILDER_ASSETS_WRITE_SCOPE,
+    BUILDER_CONTENT_READ_SCOPE,
+    BUILDER_CONTENT_WRITE_SCOPE,
     "builder:projects:read",
     "builder:projects:write",
     "builder:designsystem:read",
@@ -290,6 +294,7 @@ export async function getBuilderOAuthSession(ownerEmail, orgId, requiredScope, a
             expiresAt: credentials.tokenExpiresAt,
             scopes,
             scope: options.scope,
+            connectionId: options.key,
         };
     }
     if (requiredScope && missingRequiredScope) {

package/dist/server/first-touch-route.d.ts

@@ -17,8 +17,8 @@ export type FirstTouchSyncResult = {
  * browser's `an_ft` and `an_lt` again, so Safari keeps them their 30 days.
  */
 export declare function createFirstTouchHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    reason?: undefined;
     error: string;
+    reason?: undefined;
     stored?: undefined;
     firstTouch?: undefined;
 } | {
@@ -32,8 +32,8 @@ export declare function createFirstTouchHandler(): import("h3").EventHandlerWith
     reason: "expired";
     firstTouch?: undefined;
 } | {
-    reason?: undefined;
     error?: undefined;
+    reason?: undefined;
     stored: true;
     firstTouch: FirstTouchAttribution;
 }>>;

package/dist/server/index.d.ts

@@ -104,7 +104,7 @@ export { resolveDeployPlatform, type DeployPlatform, } from "./deploy-environmen
 export { isServerlessRuntime } from "../db/client.js";
 export { BUILDER_PUBLISH_MCP_RESOURCE, canAuthorizeBuilderApiRequest, hasBuilderApiCredentialCustody, resolveBuilderApiAuthorization, resolveBuilderLegacyRequestAuthorization, resolveBuilderRequestAuthorization, type BuilderLegacyCredentialKey, type BuilderRequestAuthorization, } from "./builder-api-auth.js";
 export { createFusionAgentFeed, fusionStepToAgentChatEvents, type FusionAgentFeedSummary, } from "./fusion-agent-feed.js";
-export { BUILDER_ASSETS_WRITE_SCOPE, BUILDER_OAUTH_SCOPE, type BuilderOAuthPermissionScope, } from "./builder-oauth.js";
+export { BUILDER_ASSETS_WRITE_SCOPE, BUILDER_CONTENT_READ_SCOPE, BUILDER_CONTENT_WRITE_SCOPE, BUILDER_OAUTH_RESOURCE, BUILDER_OAUTH_SCOPE, type BuilderOAuthPermissionScope, } from "./builder-oauth.js";
 export { assertBuilderDesignSystemCodeIndexingAllowed, builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, collectBuilderDesignSystemGitHubFiles, createBuilderDesignSystemProxyFields, designSystemTierUpgradeUrl, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, fetchBuilderDesignSystemDocumentCount, fetchBuilderDesignSystemRecord, fetchBuilderDesignSystemTierLimit, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, isBuilderDesignSystemReadyByCount, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, type BuildBuilderDesignSystemIndexFilesOptions, type BuilderDesignSystemCodeFileInput, type BuilderDesignSystemDecodeJobStatus, type BuilderDesignSystemDocsOptions, type BuilderDesignSystemDocument, type BuilderDesignSystemDocumentCountResult, type BuilderDesignSystemHydratedReference, type BuilderDesignSystemIndexFile, type BuilderDesignSystemIndexFromSourcesOptions, type BuilderDesignSystemIndexOptions, type BuilderDesignSystemIndexResult, type BuilderDesignSystemRecord, type BuilderDesignSystemStatus, type BuilderDesignSystemTierLimit, type BuilderDesignSystemGitHubFile, type BuilderDesignSystemGitHubFileCollection, type BuilderDesignSystemGitHubSource, type BuilderDesignSystemUploadAttachment, type BuilderDesignSystemUploadSlot, type BuilderDesignSystemProxyFields, type BuilderDesignSystemProxyFieldsOptions, type BuilderDesignSystemProxyReference, type BuilderDesignSystemSourceKind, } from "./builder-design-systems.js";
 export { cdnSafeOriginStatus, createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, normalizeBuilderAgentAttachments, runBuilderAgent, type BuilderAgentAttachment, type BuilderAgentUploadAttachment, type BuilderAgentUrlAttachment, type BuilderProjectResult, type RunBuilderAgentResult, } from "./builder-browser.js";
 export { BuilderBranchError, getBuilderBranchStatus, sendBuilderBranchMessage, type BuilderBranchAgentState, type BuilderBranchErrorCode, type BuilderBranchOperation, type BuilderBranchPrStatus, type BuilderBranchRef, type BuilderBranchState, type BuilderBranchStatus, type GetBuilderBranchStatusOptions, type SendBuilderBranchMessageOptions, type SendBuilderBranchMessageResult, } from "./builder-branch.js";

package/dist/server/index.js

@@ -98,7 +98,7 @@ export { resolveDeployPlatform, } from "./deploy-environment.js";
 export { isServerlessRuntime } from "../db/client.js";
 export { BUILDER_PUBLISH_MCP_RESOURCE, canAuthorizeBuilderApiRequest, hasBuilderApiCredentialCustody, resolveBuilderApiAuthorization, resolveBuilderLegacyRequestAuthorization, resolveBuilderRequestAuthorization, } from "./builder-api-auth.js";
 export { createFusionAgentFeed, fusionStepToAgentChatEvents, } from "./fusion-agent-feed.js";
-export { BUILDER_ASSETS_WRITE_SCOPE, BUILDER_OAUTH_SCOPE, } from "./builder-oauth.js";
+export { BUILDER_ASSETS_WRITE_SCOPE, BUILDER_CONTENT_READ_SCOPE, BUILDER_CONTENT_WRITE_SCOPE, BUILDER_OAUTH_RESOURCE, BUILDER_OAUTH_SCOPE, } from "./builder-oauth.js";
 export { assertBuilderDesignSystemCodeIndexingAllowed, builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, collectBuilderDesignSystemGitHubFiles, createBuilderDesignSystemProxyFields, designSystemTierUpgradeUrl, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, fetchBuilderDesignSystemDocumentCount, fetchBuilderDesignSystemRecord, fetchBuilderDesignSystemTierLimit, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, isBuilderDesignSystemReadyByCount, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, } from "./builder-design-systems.js";
 export { cdnSafeOriginStatus, createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, normalizeBuilderAgentAttachments, runBuilderAgent, } from "./builder-browser.js";
 export { BuilderBranchError, getBuilderBranchStatus, sendBuilderBranchMessage, } from "./builder-branch.js";

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/shared/consent.d.ts

@@ -3,6 +3,8 @@
  * follow builder.io's consent banner: visitors in these countries opt in, and
  * every other visitor is tracked as before, with no banner.
  */
+/** For the inline bootstrap the server writes into each page. */
+export declare const CONSENT_REGION_TIME_ZONE_LIST: readonly string[];
 export declare function isConsentRegionCountry(code: string | null | undefined): boolean;
 export declare function isConsentRegionTimeZone(timeZone: string | null | undefined): boolean;
 /**

package/dist/shared/consent.js

@@ -106,6 +106,10 @@ const CONSENT_REGION_TIME_ZONES = new Set([
     "Portugal",
     "WET",
 ]);
+/** For the inline bootstrap the server writes into each page. */
+export const CONSENT_REGION_TIME_ZONE_LIST = [
+    ...CONSENT_REGION_TIME_ZONES,
+];
 export function isConsentRegionCountry(code) {
     return CONSENT_REGION_COUNTRY_CODES.has(code?.trim().toUpperCase() ?? "");
 }

package/dist/templates/builder-code-starter/template-layer.json

@@ -9,6 +9,7 @@
     "app/components/layout/AgentInspector.test.tsx",
     "app/components/layout/AgentInspector.tsx",
     "app/components/layout/Header.tsx",
+    "app/components/layout/Sidebar.spec.tsx",
     "app/components/layout/Sidebar.tsx",
     "app/i18n",
     "app/i18n-data.ts",

package/dist/templates/chat/app/components/layout/Sidebar.tsx

@@ -1,3 +1,4 @@
+import { appPath } from "@agent-native/core/client/api-path";
 import { useT } from "@agent-native/core/client/i18n";
 import {
   navigateWithAgentChatViewTransition,
@@ -5,14 +6,15 @@ import {
   useChatThreads,
   type ChatThreadSummary,
 } from "@agent-native/toolkit/app/chat/agentkit-chat/rail";
+import {
+  ownDraftRows,
+  OwnershipChatHistoryRail,
+  useOwnershipChatHistory,
+  type OwnDraftRow,
+} from "@agent-native/toolkit/app/chat/ownership-history";
 import { OrgSwitcher } from "@agent-native/toolkit/app/org";
 import { openCommandMenu } from "@agent-native/toolkit/app/shared";
 import { AgentNativeIcon } from "@agent-native/toolkit/app/shared/AgentNativeIcon";
-import {
-  ChatHistoryList,
-  type ChatHistoryItem,
-  type ChatHistorySection,
-} from "@agent-native/toolkit/chat-history/ChatHistoryList";
 import {
   IconApps,
   IconClock,
@@ -25,7 +27,7 @@ import {
   IconPin,
   IconSearch,
 } from "@tabler/icons-react";
-import { useEffect, useMemo, useRef, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { Link, useLocation, useNavigate } from "react-router";
 import { toast } from "sonner";
 
@@ -41,7 +43,6 @@ import {
 } from "@/components/ui/tooltip";
 import { APP_TITLE } from "@/lib/app-config";
 import { chatThreadPath, HOME_PATH, threadIdFromPath } from "@/lib/chat-paths";
-import { visibleChatThreads } from "@/lib/sidebar-thread-state";
 import { cn } from "@/lib/utils";
 
 const CHAT_STORAGE_KEY = "chat";
@@ -53,11 +54,9 @@ interface SidebarProps {
   onCollapsedChange?: (collapsed: boolean) => void;
 }
 
-function threadTitle(thread: ChatThreadSummary, untitledLabel: string) {
-  return thread.title || untitledLabel;
-}
-
-function threadUpdatedAt(thread: ChatThreadSummary) {
+function threadUpdatedAt(
+  thread: Pick<ChatThreadSummary, "createdAt" | "updatedAt">,
+) {
   return Number.isFinite(thread.updatedAt)
     ? thread.updatedAt
     : Number.isFinite(thread.createdAt)
@@ -65,14 +64,6 @@ function threadUpdatedAt(thread: ChatThreadSummary) {
       : 0;
 }
 
-function compareRecentThreads(a: ChatThreadSummary, b: ChatThreadSummary) {
-  return threadUpdatedAt(b) - threadUpdatedAt(a);
-}
-
-function comparePinnedThreads(a: ChatThreadSummary, b: ChatThreadSummary) {
-  return (b.pinnedAt ?? 0) - (a.pinnedAt ?? 0);
-}
-
 function formatRelativeTime(timestamp: number) {
   const elapsed = timestamp - Date.now();
   const intervals = [
@@ -106,7 +97,10 @@ function ThreadHistoryTitle({
   title,
   running,
 }: {
-  thread: ChatThreadSummary;
+  thread: OwnDraftRow &
+    Partial<
+      Pick<ChatThreadSummary, "preview" | "scope" | "source" | "pinnedAt">
+    >;
   title: string;
   running: boolean;
 }) {
@@ -287,7 +281,7 @@ function ChatThreadsSection({ collapsed }: { collapsed: boolean }) {
     pinThread,
     archiveThread,
     renameThread,
-    refreshThreads,
+    isNewThread,
   } = useChatThreads(undefined, CHAT_STORAGE_KEY, undefined, {
     autoCreate: false,
     restoreActiveThread: false,
@@ -295,66 +289,46 @@ function ChatThreadsSection({ collapsed }: { collapsed: boolean }) {
   const { workingThreadIds, observedThreadStarts } =
     useAgentChatRunningThreads();
 
-  const visibleThreads = useMemo(
-    () => visibleChatThreads(threads, observedThreadStarts),
-    [observedThreadStarts, threads],
-  );
-  const displayedActiveThreadId =
-    threadIdFromPath(location.pathname) ??
-    activeThreadId ??
-    persistedActiveThreadId();
-
-  const historySections = useMemo<ChatHistorySection[]>(() => {
-    const untitledLabel = t("chat.untitledChat");
-    const toItem = (thread: ChatThreadSummary): ChatHistoryItem => {
-      const title = threadTitle(thread, untitledLabel);
+  const localMineRows = ownDraftRows({
+    threads,
+    isNewThread,
+    observedThreadStarts,
+  });
+  const history = useOwnershipChatHistory({
+    getThreadUrl: (threadId) => appPath(chatThreadPath(threadId)),
+    activeId:
+      threadIdFromPath(location.pathname) ??
+      activeThreadId ??
+      persistedActiveThreadId(),
+    localMineRows,
+    pinned: { label: t("chat.pinned") },
+    mutations: {
+      pin: pinThread,
+      rename: renameThread,
+      archive: archiveThread,
+    },
+    onMutationFailed: (kind) => {
+      if (kind === "archive") toast.error(t("chat.archiveFailed"));
+      if (kind === "rename") toast.error(t("chat.renameFailed"));
+    },
+    decorateItem: (item, row) => {
+      const title = row.title || row.preview || t("chat.untitledChat");
       return {
-        id: thread.id,
+        ...item,
         title: (
           <ThreadHistoryTitle
-            thread={thread}
+            thread={row}
             title={title}
-            running={workingThreadIds.has(thread.id)}
+            running={workingThreadIds.has(row.id)}
           />
         ),
-        titleText: title,
-        pinned: Boolean(thread.pinnedAt),
       };
-    };
-    const pinned = visibleThreads
-      .filter((thread) => Boolean(thread.pinnedAt))
-      .sort(comparePinnedThreads)
-      .map(toItem);
-    const recent = visibleThreads
-      .filter((thread) => !thread.pinnedAt)
-      .sort(compareRecentThreads)
-      .slice(0, 30)
-      .map(toItem);
-
-    return [
-      { id: "pinned", label: t("chat.pinned"), items: pinned },
-      { id: "recents", label: t("chat.recents"), items: recent },
-    ];
-  }, [t, visibleThreads, workingThreadIds]);
-
-  useEffect(() => {
-    const refresh = () => refreshThreads();
-    const handleRunning = (event: Event) => {
-      const detail = (event as CustomEvent).detail as
-        | { isRunning?: unknown }
-        | undefined;
-      if (typeof detail?.isRunning === "boolean") refreshThreads();
-    };
-
-    window.addEventListener("agent-chat:threads-updated", refresh);
-    window.addEventListener("agentNative.chatRunning", handleRunning);
-    window.addEventListener("focus", refresh);
-    return () => {
-      window.removeEventListener("agent-chat:threads-updated", refresh);
-      window.removeEventListener("agentNative.chatRunning", handleRunning);
-      window.removeEventListener("focus", refresh);
-    };
-  }, [refreshThreads]);
+    },
+  });
+  const displayedActiveThreadId =
+    threadIdFromPath(location.pathname) ??
+    activeThreadId ??
+    persistedActiveThreadId();
 
   function openThread(threadId: string, options?: { isNew?: boolean }) {
     switchThread(threadId);
@@ -382,23 +356,6 @@ function ChatThreadsSection({ collapsed }: { collapsed: boolean }) {
     if (threadId) openThread(threadId, { isNew: true });
   }
 
-  async function handleArchiveThread(threadId: string) {
-    const wasActive =
-      threadId === activeThreadId || threadId === persistedActiveThreadId();
-    const archived = await archiveThread(threadId);
-    if (!archived) {
-      toast.error(t("chat.archiveFailed"));
-      return;
-    }
-    if (wasActive) await handleNewChat();
-  }
-
-  function handleRenameThread(threadId: string, title: string) {
-    void renameThread(threadId, title).then((renamed) => {
-      if (!renamed) toast.error(t("chat.renameFailed"));
-    });
-  }
-
   const newChatButton = (
     <button
       type="button"
@@ -430,17 +387,20 @@ function ChatThreadsSection({ collapsed }: { collapsed: boolean }) {
   return (
     <div className="flex min-h-0 flex-1 flex-col">
       <div className="px-2 pb-3">{newChatButton}</div>
-      <ChatHistoryList
-        sections={historySections}
+      <OwnershipChatHistoryRail
+        {...history}
+        onNewChat={() => void handleNewChat()}
+        showNewChat={false}
         activeId={displayedActiveThreadId}
         onSelect={openThread}
-        onTogglePin={(threadId) => {
-          const thread = visibleThreads.find((item) => item.id === threadId);
-          if (thread) void pinThread(threadId, !thread.pinnedAt);
+        onDelete={async (threadId) => {
+          const wasActive =
+            threadId === activeThreadId ||
+            threadId === persistedActiveThreadId();
+          const archived = await history.listProps.onDelete?.(threadId);
+          if (archived && wasActive) await handleNewChat();
         }}
-        onRename={handleRenameThread}
         renameMaxLength={160}
-        onDelete={(threadId) => void handleArchiveThread(threadId)}
         labels={{
           options: (item) =>
             t("chat.optionsFor", { title: item.titleText ?? "" }),
@@ -451,8 +411,9 @@ function ChatThreadsSection({ collapsed }: { collapsed: boolean }) {
           unpin: t("chat.unpinChat"),
           delete: t("chat.archiveChat"),
         }}
-        variant="rail"
-        emptyLabel={null}
+        railLabels={{
+          newChat: t("chat.newChat"),
+        }}
         className="chat-sidebar-history min-h-0 flex-1"
         listClassName="pb-4"
       />

package/dist/triggers/actions/manage-automation.d.ts

@@ -93,7 +93,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
     previouslyEnabled?: undefined;
     requestedEnabled?: undefined;
 } | {
-    scope?: undefined;
     enabled?: undefined;
     nextRun?: undefined;
     created?: undefined;
@@ -101,6 +100,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceId: string;
     name: string;
     updated?: undefined;
+    scope?: undefined;
     triggerType?: undefined;
     event?: undefined;
     schedule?: undefined;