npm - @agent-native/core - Versions diffs - 0.22.13 → 0.22.17 - Mend

@agent-native/core 0.22.13 → 0.22.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (93) hide show

package/dist/agent/engine/registry.d.ts.map +1 -1
package/dist/agent/engine/registry.js +13 -1
package/dist/agent/engine/registry.js.map +1 -1
package/dist/client/MultiTabAssistantChat.d.ts.map +1 -1
package/dist/client/MultiTabAssistantChat.js +5 -6
package/dist/client/MultiTabAssistantChat.js.map +1 -1
package/dist/client/agent-chat.d.ts.map +1 -1
package/dist/client/agent-chat.js +13 -0
package/dist/client/agent-chat.js.map +1 -1
package/dist/client/embed-auth.d.ts.map +1 -1
package/dist/client/embed-auth.js +161 -20
package/dist/client/embed-auth.js.map +1 -1
package/dist/client/index.d.ts +1 -0
package/dist/client/index.d.ts.map +1 -1
package/dist/client/index.js +1 -0
package/dist/client/index.js.map +1 -1
package/dist/client/mcp-app-host.d.ts +40 -0
package/dist/client/mcp-app-host.d.ts.map +1 -0
package/dist/client/mcp-app-host.js +165 -0
package/dist/client/mcp-app-host.js.map +1 -0
package/dist/client/sharing/ShareButton.d.ts +9 -0
package/dist/client/sharing/ShareButton.d.ts.map +1 -1
package/dist/client/sharing/ShareButton.js +19 -2
package/dist/client/sharing/ShareButton.js.map +1 -1
package/dist/client/use-action.d.ts.map +1 -1
package/dist/client/use-action.js +13 -0
package/dist/client/use-action.js.map +1 -1
package/dist/client/use-chat-models.d.ts.map +1 -1
package/dist/client/use-chat-models.js +4 -5
package/dist/client/use-chat-models.js.map +1 -1
package/dist/client/use-db-sync.d.ts.map +1 -1
package/dist/client/use-db-sync.js +58 -3
package/dist/client/use-db-sync.js.map +1 -1
package/dist/client/use-db-sync.spec.js +27 -0
package/dist/client/use-db-sync.spec.js.map +1 -1
package/dist/deploy/build.d.ts +30 -0
package/dist/deploy/build.d.ts.map +1 -1
package/dist/deploy/build.js +31 -16
package/dist/deploy/build.js.map +1 -1
package/dist/index.browser.d.ts +2 -1
package/dist/index.browser.d.ts.map +1 -1
package/dist/index.browser.js +2 -1
package/dist/index.browser.js.map +1 -1
package/dist/index.d.ts +2 -1
package/dist/index.d.ts.map +1 -1
package/dist/index.js +2 -1
package/dist/index.js.map +1 -1
package/dist/mcp/builtin-tools.d.ts.map +1 -1
package/dist/mcp/builtin-tools.js +0 -1
package/dist/mcp/builtin-tools.js.map +1 -1
package/dist/mcp/embed-app.d.ts +2 -0
package/dist/mcp/embed-app.d.ts.map +1 -1
package/dist/mcp/embed-app.js +180 -6
package/dist/mcp/embed-app.js.map +1 -1
package/dist/mcp/embed-route.d.ts +26 -0
package/dist/mcp/embed-route.d.ts.map +1 -0
package/dist/mcp/embed-route.js +38 -0
package/dist/mcp/embed-route.js.map +1 -0
package/dist/mcp/index.d.ts +1 -0
package/dist/mcp/index.d.ts.map +1 -1
package/dist/mcp/index.js +1 -0
package/dist/mcp/index.js.map +1 -1
package/dist/scripts/agent-engines/list-agent-engines.d.ts.map +1 -1
package/dist/scripts/agent-engines/list-agent-engines.js +18 -12
package/dist/scripts/agent-engines/list-agent-engines.js.map +1 -1
package/dist/server/auth.d.ts.map +1 -1
package/dist/server/auth.js +9 -1
package/dist/server/auth.js.map +1 -1
package/dist/server/core-routes-plugin.d.ts.map +1 -1
package/dist/server/core-routes-plugin.js +22 -1
package/dist/server/core-routes-plugin.js.map +1 -1
package/dist/server/embed-route.d.ts.map +1 -1
package/dist/server/embed-route.js +36 -7
package/dist/server/embed-route.js.map +1 -1
package/dist/server/embed-session.d.ts.map +1 -1
package/dist/server/embed-session.js +11 -1
package/dist/server/embed-session.js.map +1 -1
package/dist/server/security-headers.d.ts +6 -1
package/dist/server/security-headers.d.ts.map +1 -1
package/dist/server/security-headers.js +10 -2
package/dist/server/security-headers.js.map +1 -1
package/dist/shared/embed-auth.d.ts +1 -0
package/dist/shared/embed-auth.d.ts.map +1 -1
package/dist/shared/embed-auth.js +1 -0
package/dist/shared/embed-auth.js.map +1 -1
package/dist/vite/client.d.ts.map +1 -1
package/dist/vite/client.js +28 -0
package/dist/vite/client.js.map +1 -1
package/docs/content/actions.md +22 -7
package/docs/content/client.md +43 -0
package/docs/content/external-agents.md +40 -1
package/docs/content/mcp-protocol.md +25 -0
package/package.json +1 -1

package/dist/mcp/embed-app.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"embed-app.js","sourceRoot":"","sources":["../../src/mcp/embed-app.ts"],"names":[],"mappings":"AAEA,MAAM,cAAc,GAClB,mEAAmE,CAAC;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,gBAAgB,CAAC;AAalE,SAAS,IAAI,CAAC,KAAyB;IACrC,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,UAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;IACrD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC;IACtE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC;IAEnE,OAAO;QACL,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,EAAE,GAAG,EAAE,CAAC;;;;;;;;;oDASoC,MAAM;;;;;;+CAMX,MAAM,GAAG,EAAE;oDACN,MAAM,GAAG,EAAE;iEACE,MAAM,GAAG,EAAE;;;;oBAIxD,IAAI,CAAC,KAAK,CAAC;uBACR,IAAI,CAAC,WAAW,CAAC;qBACnB,IAAI,CAAC,SAAS,CAAC;qBACf,IAAI,CAAC,aAAa,CAAC;wBAChB,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;;;;4CAIN,IAAI,CAAC,KAAK,CAAC;;mDAEJ,IAAI,CAAC,SAAS,CAAC;;;;;;;;2BAQvC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAwHjC;QACJ,GAAG,EAAE;YACH,cAAc,EAAE,CAAC,gBAAgB,CAAC;YAClC,eAAe,EAAE,CAAC,gBAAgB,CAAC;YACnC,YAAY,EAAE;gBACZ,iCAAiC;gBACjC,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;aAChC;SACF;QACD,aAAa,EAAE,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import type { ActionMcpAppResourceConfig } from \"../action.js\";\n\nconst MCP_APP_IMPORT =\n \"https://esm.sh/@modelcontextprotocol/ext-apps@1.7.2/app-with-deps\";\n\nexport const MCP_APP_REQUEST_ORIGIN_CSP_SOURCE = \"$requestOrigin\";\n\nexport interface EmbedAppOptions {\n title?: string;\n description?: string;\n iframeTitle?: string;\n openLabel?: string;\n embedByDefault?: boolean;\n startToolName?: string;\n frameDomains?: string[];\n height?: number;\n}\n\nfunction attr(value: string \| undefined): string {\n return String(value ?? \"\")\n .replace(/&/g, \"&\")\n .replace(/\"/g, \""\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\");\n}\n\nexport function embedApp(\n options: EmbedAppOptions = {},\n): ActionMcpAppResourceConfig {\n const title = options.title ?? \"Open app\";\n const iframeTitle = options.iframeTitle ?? \"Agent Native app\";\n const openLabel = options.openLabel ?? \"Open in app\";\n const startToolName = options.startToolName ?? \"create_embed_session\";\n const embedByDefault = options.embedByDefault !== false;\n const height = Math.max(320, Math.min(900, options.height ?? 900));\n\n return {\n title,\n ...(options.description ? { description: options.description } : {}),\n html: () => `<!doctype html>\n<html lang=\"en\">\n<head>\n <meta charset=\"utf-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n <style>\n :root { color-scheme: light dark; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif; background: Canvas; color: CanvasText; }\n * { box-sizing: border-box; }\n body { margin: 0; }\n .shell { display: grid; gap: 8px; min-height: ${height}px; padding: 0; }\n .bar { display: flex; align-items: center; justify-content: space-between; gap: 8px; min-height: 36px; padding: 6px 8px; border-bottom: 1px solid color-mix(in srgb, CanvasText 12%, Canvas); }\n .title { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: 12px; font-weight: 700; color: color-mix(in srgb, CanvasText 72%, Canvas); }\n .actions { display: flex; align-items: center; gap: 6px; }\n button { min-height: 28px; border: 1px solid color-mix(in srgb, CanvasText 14%, Canvas); border-radius: 7px; background: Canvas; color: CanvasText; cursor: pointer; font: inherit; font-size: 12px; font-weight: 700; padding: 0 9px; }\n button:disabled { opacity: .55; cursor: default; }\n .stage { position: relative; min-height: ${height - 44}px; }\n iframe { display: block; width: 100%; height: ${height - 44}px; border: 0; background: Canvas; }\n .message { display: grid; place-items: center; min-height: ${height - 44}px; padding: 18px; color: color-mix(in srgb, CanvasText 62%, Canvas); font-size: 13px; line-height: 1.45; text-align: center; }\n </style>\n</head>\n<body\n data-app-title=\"${attr(title)}\"\n data-iframe-title=\"${attr(iframeTitle)}\"\n data-open-label=\"${attr(openLabel)}\"\n data-start-tool=\"${attr(startToolName)}\"\n data-embed-default=\"${embedByDefault ? \"1\" : \"0\"}\"\n>\n <main class=\"shell\">\n <div class=\"bar\">\n <div class=\"title\" data-title-label>${attr(title)}</div>\n <div class=\"actions\">\n <button type=\"button\" data-open disabled>${attr(openLabel)}</button>\n </div>\n </div>\n <section class=\"stage\" data-stage>\n <div class=\"message\">Preparing app</div>\n </section>\n </main>\n <script type=\"module\">\n import { App } from \"${MCP_APP_IMPORT}\";\n\n const app = new App({ name: \"Agent Native Embed\", version: \"1.0.0\" }, {});\n const body = document.body;\n const stage = document.querySelector(\"[data-stage]\");\n const titleEl = document.querySelector(\"[data-title-label]\");\n const openButton = document.querySelector(\"[data-open]\");\n const startTool = body.dataset.startTool \|\| \"create_embed_session\";\n const embedByDefault = body.dataset.embedDefault !== \"0\";\n let toolInput = {};\n let openUrl = \"\";\n let startedFor = \"\";\n\n function esc(value) {\n return String(value ?? \"\")\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/\"/g, \""\");\n }\n\n function parseJson(value, fallback) {\n if (value && typeof value === \"object\") return value;\n if (typeof value !== \"string\" \|\| !value.trim()) return fallback;\n try { return JSON.parse(value); } catch { return fallback; }\n }\n\n function parseToolResult(params) {\n if (!params) return {};\n if (params.structuredContent && typeof params.structuredContent === \"object\") {\n return params.structuredContent;\n }\n const parts = Array.isArray(params.content) ? params.content : [];\n const textPart = parts.find((part) => part && part.type === \"text\" && typeof part.text === \"string\");\n return parseJson(textPart ? textPart.text : \"\", {});\n }\n\n function openLinkFrom(params, data) {\n const metaUrl = params && params._meta && params._meta[\"agent-native/openLink\"]\n ? params._meta[\"agent-native/openLink\"].webUrl\n : \"\";\n return metaUrl \|\| data.url \|\| data.deepLink \|\| data.openUrl \|\| \"\";\n }\n\n function wantsEmbed() {\n if (toolInput.embed === false \|\| toolInput.embed === \"false\") return false;\n if (embedByDefault) return true;\n return toolInput.embed === true \|\| toolInput.embed === \"true\";\n }\n\n function setMessage(message) {\n stage.innerHTML = '<div class=\"message\">' + esc(message) + '</div>';\n }\n\n function renderFrame(src) {\n const frame = document.createElement(\"iframe\");\n frame.title = body.dataset.iframeTitle \|\| \"Agent Native app\";\n frame.src = src;\n frame.allow = \"clipboard-read; clipboard-write\";\n stage.replaceChildren(frame);\n }\n\n async function launchEmbed() {\n if (!openUrl) {\n setMessage(\"Open link was not available.\");\n return;\n }\n if (!wantsEmbed()) {\n setMessage(\"Ready to open.\");\n return;\n }\n if (startedFor === openUrl) return;\n startedFor = openUrl;\n setMessage(\"Loading app\");\n try {\n const result = await app.callServerTool({\n name: startTool,\n arguments: {\n url: openUrl,\n chrome: typeof toolInput.chrome === \"string\" ? toolInput.chrome : \"full\"\n }\n });\n const data = parseToolResult(result);\n if (!data.startUrl) {\n startedFor = \"\";\n setMessage(data.error \|\| \"This app can be opened, but not embedded from this MCP server.\");\n return;\n }\n renderFrame(data.startUrl);\n } catch (err) {\n startedFor = \"\";\n setMessage(err && err.message ? err.message : \"Could not launch embedded app.\");\n }\n }\n\n function updateOpenButton() {\n openButton.disabled = !openUrl;\n openButton.onclick = () => {\n if (openUrl) void app.openLink({ url: openUrl });\n };\n }\n\n function updateTitle(data) {\n const label = data.label \|\| data.app \|\| data.view \|\| body.dataset.appTitle \|\| \"App\";\n titleEl.textContent = String(label);\n }\n\n app.ontoolinput = (params) => {\n toolInput = params.arguments \|\| {};\n };\n app.ontoolresult = (params) => {\n const data = parseToolResult(params);\n openUrl = openLinkFrom(params, data);\n updateTitle(data);\n updateOpenButton();\n void launchEmbed();\n };\n await app.connect();\n </script>\n</body>\n</html>`,\n csp: {\n connectDomains: [\"https://esm.sh\"],\n resourceDomains: [\"https://esm.sh\"],\n frameDomains: [\n MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n ...(options.frameDomains ?? []),\n ],\n },\n prefersBorder: false,\n };\n}\n"]}
1	+ {"version":3,"file":"embed-app.js","sourceRoot":"","sources":["../../src/mcp/embed-app.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAE1E,MAAM,cAAc,GAClB,mEAAmE,CAAC;AAEtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,gBAAgB,CAAC;AAClE,MAAM,6BAA6B,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AACnD,MAAM,CAAC,MAAM,4BAA4B,GACvC,+BAA+B,GAAG,6BAA6B,CAAC;AAalE,SAAS,IAAI,CAAC,KAAyB;IACrC,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,UAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC;IACrD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC;IACtE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CACrB,GAAG,EACH,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,IAAI,4BAA4B,CAAC,CAC9D,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,GAAG,6BAA6B,CAAC;IAE9D,OAAO;QACL,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,EAAE,GAAG,EAAE,CAAC;;;;;;;;;oDASoC,MAAM;;;;;;+CAMX,cAAc;oDACT,cAAc;iEACD,cAAc;;;;oBAI3D,IAAI,CAAC,KAAK,CAAC;uBACR,IAAI,CAAC,WAAW,CAAC;qBACnB,IAAI,CAAC,SAAS,CAAC;qBACf,IAAI,CAAC,aAAa,CAAC;wBAChB,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;;;;4CAIN,IAAI,CAAC,KAAK,CAAC;;;mDAGJ,IAAI,CAAC,SAAS,CAAC;;;;;;;;2BAQvC,cAAc;;;;;;;;;;8BAUX,IAAI,CAAC,SAAS,CAAC,+BAA+B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAkRrE;QACJ,GAAG,EAAE;YACH,cAAc,EAAE,CAAC,gBAAgB,CAAC;YAClC,eAAe,EAAE;gBACf,gBAAgB;gBAChB,iCAAiC;gBACjC,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;aAChC;YACD,YAAY,EAAE;gBACZ,iCAAiC;gBACjC,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;aAChC;SACF;QACD,aAAa,EAAE,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import type { ActionMcpAppResourceConfig } from \"../action.js\";\nimport { MCP_APP_CHAT_BRIDGE_QUERY_PARAM } from \"../shared/embed-auth.js\";\n\nconst MCP_APP_IMPORT =\n \"https://esm.sh/@modelcontextprotocol/ext-apps@1.7.2/app-with-deps\";\n\nexport const MCP_APP_REQUEST_ORIGIN_CSP_SOURCE = \"$requestOrigin\";\nconst MCP_APP_WRAPPER_CHROME_HEIGHT = 44;\nexport const DEFAULT_MCP_APP_VIEWPORT_HEIGHT = 720;\nexport const DEFAULT_MCP_APP_SHELL_HEIGHT =\n DEFAULT_MCP_APP_VIEWPORT_HEIGHT + MCP_APP_WRAPPER_CHROME_HEIGHT;\n\nexport interface EmbedAppOptions {\n title?: string;\n description?: string;\n iframeTitle?: string;\n openLabel?: string;\n embedByDefault?: boolean;\n startToolName?: string;\n frameDomains?: string[];\n height?: number;\n}\n\nfunction attr(value: string \| undefined): string {\n return String(value ?? \"\")\n .replace(/&/g, \"&\")\n .replace(/\"/g, \""\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\");\n}\n\nexport function embedApp(\n options: EmbedAppOptions = {},\n): ActionMcpAppResourceConfig {\n const title = options.title ?? \"Open app\";\n const iframeTitle = options.iframeTitle ?? \"Agent Native app\";\n const openLabel = options.openLabel ?? \"Open in app\";\n const startToolName = options.startToolName ?? \"create_embed_session\";\n const embedByDefault = options.embedByDefault !== false;\n const height = Math.max(\n 320,\n Math.min(900, options.height ?? DEFAULT_MCP_APP_SHELL_HEIGHT),\n );\n const viewportHeight = height - MCP_APP_WRAPPER_CHROME_HEIGHT;\n\n return {\n title,\n ...(options.description ? { description: options.description } : {}),\n html: () => `<!doctype html>\n<html lang=\"en\">\n<head>\n <meta charset=\"utf-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n <style>\n :root { color-scheme: light dark; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif; background: Canvas; color: CanvasText; }\n * { box-sizing: border-box; }\n body { margin: 0; }\n .shell { display: grid; gap: 8px; min-height: ${height}px; padding: 0; }\n .bar { display: flex; align-items: center; justify-content: space-between; gap: 8px; min-height: 36px; padding: 6px 8px; border-bottom: 1px solid color-mix(in srgb, CanvasText 12%, Canvas); }\n .title { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: 12px; font-weight: 700; color: color-mix(in srgb, CanvasText 72%, Canvas); }\n .actions { display: flex; align-items: center; gap: 6px; }\n button { min-height: 28px; border: 1px solid color-mix(in srgb, CanvasText 14%, Canvas); border-radius: 7px; background: Canvas; color: CanvasText; cursor: pointer; font: inherit; font-size: 12px; font-weight: 700; padding: 0 9px; }\n button:disabled { opacity: .55; cursor: default; }\n .stage { position: relative; min-height: ${viewportHeight}px; }\n iframe { display: block; width: 100%; height: ${viewportHeight}px; border: 0; background: Canvas; }\n .message { display: grid; place-items: center; min-height: ${viewportHeight}px; padding: 18px; color: color-mix(in srgb, CanvasText 62%, Canvas); font-size: 13px; line-height: 1.45; text-align: center; }\n </style>\n</head>\n<body\n data-app-title=\"${attr(title)}\"\n data-iframe-title=\"${attr(iframeTitle)}\"\n data-open-label=\"${attr(openLabel)}\"\n data-start-tool=\"${attr(startToolName)}\"\n data-embed-default=\"${embedByDefault ? \"1\" : \"0\"}\"\n>\n <main class=\"shell\">\n <div class=\"bar\">\n <div class=\"title\" data-title-label>${attr(title)}</div>\n <div class=\"actions\">\n <button type=\"button\" data-display hidden disabled>Fullscreen</button>\n <button type=\"button\" data-open disabled>${attr(openLabel)}</button>\n </div>\n </div>\n <section class=\"stage\" data-stage>\n <div class=\"message\">Preparing app</div>\n </section>\n </main>\n <script type=\"module\">\n import { App } from \"${MCP_APP_IMPORT}\";\n\n const app = new App({ name: \"Agent Native Embed\", version: \"1.0.0\" }, {});\n const body = document.body;\n const stage = document.querySelector(\"[data-stage]\");\n const titleEl = document.querySelector(\"[data-title-label]\");\n const openButton = document.querySelector(\"[data-open]\");\n const displayButton = document.querySelector(\"[data-display]\");\n const startTool = body.dataset.startTool \|\| \"create_embed_session\";\n const embedByDefault = body.dataset.embedDefault !== \"0\";\n const chatBridgeParam = ${JSON.stringify(MCP_APP_CHAT_BRIDGE_QUERY_PARAM)};\n let toolInput = {};\n let openUrl = \"\";\n let startedFor = \"\";\n let appFrame = null;\n\n function esc(value) {\n return String(value ?? \"\")\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/\"/g, \""\");\n }\n\n function parseJson(value, fallback) {\n if (value && typeof value === \"object\") return value;\n if (typeof value !== \"string\" \|\| !value.trim()) return fallback;\n try { return JSON.parse(value); } catch { return fallback; }\n }\n\n function parseToolResult(params) {\n if (!params) return {};\n if (params.structuredContent && typeof params.structuredContent === \"object\") {\n return params.structuredContent;\n }\n const parts = Array.isArray(params.content) ? params.content : [];\n const textPart = parts.find((part) => part && part.type === \"text\" && typeof part.text === \"string\");\n return parseJson(textPart ? textPart.text : \"\", {});\n }\n\n function openLinkFrom(params, data) {\n const metaUrl = params && params._meta && params._meta[\"agent-native/openLink\"]\n ? params._meta[\"agent-native/openLink\"].webUrl\n : \"\";\n return metaUrl \|\| data.url \|\| data.deepLink \|\| data.openUrl \|\| \"\";\n }\n\n function hostState() {\n return {\n context: app.getHostContext ? app.getHostContext() : undefined,\n capabilities: app.getHostCapabilities ? app.getHostCapabilities() : undefined,\n version: app.getHostVersion ? app.getHostVersion() : undefined\n };\n }\n\n function sendToAppFrame(message) {\n if (!appFrame \|\| !appFrame.contentWindow) return;\n try { appFrame.contentWindow.postMessage(message, \"\"); } catch {}\n }\n\n function sendHostContext() {\n sendToAppFrame({ type: \"agentNative.mcpHostContext\", data: hostState() });\n }\n\n function sendFrameReadyMessages(frame) {\n const originPayload = { type: \"agentNative.frameOrigin\", origin: window.location.origin };\n [0, 200, 500, 1500].forEach((delay) => {\n setTimeout(() => {\n try { frame.contentWindow && frame.contentWindow.postMessage(originPayload, \"\"); } catch {}\n sendHostContext();\n }, delay);\n });\n }\n\n function withChatBridgeParam(value) {\n if (typeof value !== \"string\" \|\| !value) return value;\n try {\n const base = \"http://agent-native.invalid\";\n const url = value.startsWith(\"/\") ? new URL(value, base) : new URL(value);\n url.searchParams.set(chatBridgeParam, \"1\");\n return value.startsWith(\"/\")\n ? url.pathname + url.search + url.hash\n : url.toString();\n } catch {\n return value;\n }\n }\n\n function wantsEmbed() {\n if (toolInput.embed === false \|\| toolInput.embed === \"false\") return false;\n if (embedByDefault) return true;\n return toolInput.embed === true \|\| toolInput.embed === \"true\";\n }\n\n function supportedDisplayMode(mode) {\n const modes = hostState().context && hostState().context.availableDisplayModes;\n return Array.isArray(modes) && modes.includes(mode);\n }\n\n async function requestHostDisplayMode(mode) {\n const result = await app.requestDisplayMode({ mode });\n updateDisplayButton();\n sendHostContext();\n return result;\n }\n\n function updateDisplayButton() {\n const context = hostState().context \|\| {};\n const nextMode = context.displayMode === \"fullscreen\" ? \"inline\" : \"fullscreen\";\n const supported = supportedDisplayMode(nextMode);\n displayButton.hidden = !supported;\n displayButton.disabled = !supported;\n displayButton.textContent = nextMode === \"fullscreen\" ? \"Fullscreen\" : \"Inline\";\n displayButton.onclick = () => {\n if (!supportedDisplayMode(nextMode)) return;\n void requestHostDisplayMode(nextMode).catch((err) => {\n console.warn(\"[agent-native] MCP host rejected display mode request\", err);\n });\n };\n }\n\n function setMessage(message) {\n stage.innerHTML = '<div class=\"message\">' + esc(message) + '</div>';\n }\n\n function renderFrame(src) {\n const frame = document.createElement(\"iframe\");\n frame.title = body.dataset.iframeTitle \|\| \"Agent Native app\";\n frame.src = src;\n frame.allow = \"clipboard-read; clipboard-write\";\n appFrame = frame;\n frame.addEventListener(\"load\", () => sendFrameReadyMessages(frame));\n stage.replaceChildren(frame);\n }\n\n async function updateHostModelContext(data) {\n const params = {};\n if (Array.isArray(data && data.content)) params.content = data.content;\n if (data && data.structuredContent && typeof data.structuredContent === \"object\") {\n params.structuredContent = data.structuredContent;\n }\n await app.updateModelContext(params);\n }\n\n async function openHostLink(data) {\n const url = typeof (data && data.url) === \"string\" ? data.url : \"\";\n if (!url) return { isError: true };\n return await app.openLink({ url });\n }\n\n function respondToAppFrame(requestId, work) {\n if (!requestId) return;\n Promise.resolve(work)\n .then((result) => {\n sendToAppFrame({\n type: \"agentNative.mcpHost.response\",\n data: { requestId, ok: true, result }\n });\n })\n .catch((err) => {\n sendToAppFrame({\n type: \"agentNative.mcpHost.response\",\n data: {\n requestId,\n ok: false,\n error: err && err.message ? err.message : String(err)\n }\n });\n });\n }\n\n async function sendHostChat(chat) {\n if (!chat \|\| chat.submit === false) return;\n const message = typeof chat.message === \"string\" ? chat.message : \"\";\n if (!message.trim()) return;\n const context = typeof chat.context === \"string\" ? chat.context : \"\";\n if (context.trim()) {\n try {\n await app.updateModelContext({\n content: [{ type: \"text\", text: context }]\n });\n } catch (err) {\n console.warn(\"[agent-native] MCP host rejected model context update\", err);\n }\n }\n try {\n const result = await app.sendMessage({\n role: \"user\",\n content: [{ type: \"text\", text: message }]\n });\n if (result && result.isError) {\n console.warn(\"[agent-native] MCP host rejected chat message\", result);\n }\n } catch (err) {\n console.warn(\"[agent-native] MCP host chat bridge failed\", err);\n }\n }\n\n window.addEventListener(\"message\", (event) => {\n if (!appFrame \|\| event.source !== appFrame.contentWindow) return;\n if (!event.data) return;\n const data = event.data.data \|\| {};\n if (event.data.type === \"agentNative.submitChat\") {\n void sendHostChat(data);\n return;\n }\n if (event.data.type === \"agentNative.mcpHost.updateModelContext\") {\n respondToAppFrame(data.requestId, updateHostModelContext(data));\n return;\n }\n if (event.data.type === \"agentNative.mcpHost.openLink\") {\n respondToAppFrame(data.requestId, openHostLink(data));\n return;\n }\n if (event.data.type === \"agentNative.mcpHost.requestDisplayMode\") {\n respondToAppFrame(data.requestId, requestHostDisplayMode(data.mode));\n }\n });\n\n async function launchEmbed() {\n if (!openUrl) {\n setMessage(\"Open link was not available.\");\n return;\n }\n if (!wantsEmbed()) {\n setMessage(\"Ready to open.\");\n return;\n }\n if (startedFor === openUrl) return;\n startedFor = openUrl;\n setMessage(\"Loading app\");\n try {\n const embedUrl = withChatBridgeParam(openUrl);\n const result = await app.callServerTool({\n name: startTool,\n arguments: {\n url: embedUrl,\n chrome: typeof toolInput.chrome === \"string\" ? toolInput.chrome : \"full\"\n }\n });\n const data = parseToolResult(result);\n if (!data.startUrl) {\n startedFor = \"\";\n setMessage(data.error \|\| \"This app can be opened, but not embedded from this MCP server.\");\n return;\n }\n renderFrame(data.startUrl);\n } catch (err) {\n startedFor = \"\";\n setMessage(err && err.message ? err.message : \"Could not launch embedded app.\");\n }\n }\n\n function updateOpenButton() {\n openButton.disabled = !openUrl;\n openButton.onclick = () => {\n if (openUrl) void app.openLink({ url: openUrl });\n };\n }\n\n function updateTitle(data) {\n const label = data.label \|\| data.app \|\| data.view \|\| body.dataset.appTitle \|\| \"App\";\n titleEl.textContent = String(label);\n }\n\n app.ontoolinput = (params) => {\n toolInput = params.arguments \|\| {};\n };\n app.ontoolresult = (params) => {\n const data = parseToolResult(params);\n openUrl = openLinkFrom(params, data);\n updateTitle(data);\n updateOpenButton();\n void launchEmbed();\n };\n app.onhostcontextchanged = () => {\n updateDisplayButton();\n sendHostContext();\n };\n await app.connect();\n updateDisplayButton();\n sendHostContext();\n </script>\n</body>\n</html>`,\n csp: {\n connectDomains: [\"https://esm.sh\"],\n resourceDomains: [\n \"https://esm.sh\",\n MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n ...(options.frameDomains ?? []),\n ],\n frameDomains: [\n MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n ...(options.frameDomains ?? []),\n ],\n },\n prefersBorder: false,\n };\n}\n"]}

package/dist/mcp/embed-route.d.ts ADDED Viewed

@@ -0,0 +1,26 @@
+import type { ActionDeepLink, ActionLinkBuilder, ActionMcpAppConfig } from "../action.js";
+import { type EmbedAppOptions } from "./embed-app.js";
+export interface EmbedRouteContext<TArgs extends Record<string, any> = Record<string, any>, TResult = any> {
+    args: TArgs;
+    result: TResult;
+}
+export type EmbedRoutePathBuilder<TArgs extends Record<string, any> = Record<string, any>, TResult = any> = (ctx: EmbedRouteContext<TArgs, TResult>) => string | ActionDeepLink | null | undefined;
+export interface EmbedRouteOptions<TArgs extends Record<string, any> = Record<string, any>, TResult = any> extends Pick<EmbedAppOptions, "description" | "iframeTitle" | "embedByDefault" | "startToolName" | "frameDomains" | "height"> {
+    title: string;
+    openLabel: string;
+    /** Build the app route or full deep-link surfaced after an action completes. */
+    path: EmbedRoutePathBuilder<TArgs, TResult>;
+}
+export interface EmbedRouteResult {
+    link: ActionLinkBuilder;
+    mcpApp: ActionMcpAppConfig;
+}
+/**
+ * Create matching action `link` and `mcpApp` metadata for an embeddable route.
+ *
+ * The `path` builder stays pure and synchronous, just like action link
+ * builders. Return an app-relative path string for the common case, or an
+ * `ActionDeepLink` when you need a custom label/view.
+ */
+export declare function embedRoute<TArgs extends Record<string, any> = Record<string, any>, TResult = any>(options: EmbedRouteOptions<TArgs, TResult>): EmbedRouteResult;
+//# sourceMappingURL=embed-route.d.ts.map

package/dist/mcp/embed-route.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"embed-route.d.ts","sourceRoot":"","sources":["../../src/mcp/embed-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,WAAW,iBAAiB,CAChC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACvD,OAAO,GAAG,GAAG;IAEb,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,CAC/B,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACvD,OAAO,GAAG,GAAG,IACX,CACF,GAAG,EAAE,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,KACnC,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,iBAAiB,CAChC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACvD,OAAO,GAAG,GAAG,CACb,SAAQ,IAAI,CACZ,eAAe,EACb,aAAa,GACb,aAAa,GACb,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,QAAQ,CACX;IACC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,IAAI,EAAE,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACvD,OAAO,GAAG,GAAG,EACb,OAAO,EAAE,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,gBAAgB,CA4B9D"}

package/dist/mcp/embed-route.js ADDED Viewed

@@ -0,0 +1,38 @@
+import { embedApp } from "./embed-app.js";
+/**
+ * Create matching action `link` and `mcpApp` metadata for an embeddable route.
+ *
+ * The `path` builder stays pure and synchronous, just like action link
+ * builders. Return an app-relative path string for the common case, or an
+ * `ActionDeepLink` when you need a custom label/view.
+ */
+export function embedRoute(options) {
+    const label = options.openLabel;
+    return {
+        link: ({ args, result }) => {
+            const route = options.path({
+                args: args,
+                result: result,
+            });
+            if (!route)
+                return null;
+            if (typeof route === "string") {
+                return { url: route, label };
+            }
+            return route;
+        },
+        mcpApp: {
+            resource: embedApp({
+                title: options.title,
+                description: options.description,
+                iframeTitle: options.iframeTitle,
+                openLabel: options.openLabel,
+                embedByDefault: options.embedByDefault,
+                startToolName: options.startToolName,
+                frameDomains: options.frameDomains,
+                height: options.height,
+            }),
+        },
+    };
+}
+//# sourceMappingURL=embed-route.js.map

package/dist/mcp/embed-route.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"embed-route.js","sourceRoot":"","sources":["../../src/mcp/embed-route.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAwB,MAAM,gBAAgB,CAAC;AAwChE;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAGxB,OAA0C;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC;IAEhC,OAAO;QACL,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;YACzB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;gBACzB,IAAI,EAAE,IAAa;gBACnB,MAAM,EAAE,MAAiB;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,QAAQ,CAAC;gBACjB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC;SACH;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n ActionDeepLink,\n ActionLinkBuilder,\n ActionMcpAppConfig,\n} from \"../action.js\";\nimport { embedApp, type EmbedAppOptions } from \"./embed-app.js\";\n\nexport interface EmbedRouteContext<\n TArgs extends Record<string, any> = Record<string, any>,\n TResult = any,\n> {\n args: TArgs;\n result: TResult;\n}\n\nexport type EmbedRoutePathBuilder<\n TArgs extends Record<string, any> = Record<string, any>,\n TResult = any,\n> = (\n ctx: EmbedRouteContext<TArgs, TResult>,\n) => string | ActionDeepLink | null | undefined;\n\nexport interface EmbedRouteOptions<\n TArgs extends Record<string, any> = Record<string, any>,\n TResult = any,\n> extends Pick<\n EmbedAppOptions,\n | \"description\"\n | \"iframeTitle\"\n | \"embedByDefault\"\n | \"startToolName\"\n | \"frameDomains\"\n | \"height\"\n> {\n title: string;\n openLabel: string;\n /** Build the app route or full deep-link surfaced after an action completes. */\n path: EmbedRoutePathBuilder<TArgs, TResult>;\n}\n\nexport interface EmbedRouteResult {\n link: ActionLinkBuilder;\n mcpApp: ActionMcpAppConfig;\n}\n\n/**\n * Create matching action `link` and `mcpApp` metadata for an embeddable route.\n *\n * The `path` builder stays pure and synchronous, just like action link\n * builders. Return an app-relative path string for the common case, or an\n * `ActionDeepLink` when you need a custom label/view.\n */\nexport function embedRoute<\n TArgs extends Record<string, any> = Record<string, any>,\n TResult = any,\n>(options: EmbedRouteOptions<TArgs, TResult>): EmbedRouteResult {\n const label = options.openLabel;\n\n return {\n link: ({ args, result }) => {\n const route = options.path({\n args: args as TArgs,\n result: result as TResult,\n });\n if (!route) return null;\n if (typeof route === \"string\") {\n return { url: route, label };\n }\n return route;\n },\n mcpApp: {\n resource: embedApp({\n title: options.title,\n description: options.description,\n iframeTitle: options.iframeTitle,\n openLabel: options.openLabel,\n embedByDefault: options.embedByDefault,\n startToolName: options.startToolName,\n frameDomains: options.frameDomains,\n height: options.height,\n }),\n },\n };\n}\n"]}

package/dist/mcp/index.d.ts CHANGED Viewed

@@ -6,6 +6,7 @@ export { runMCPStdio } from "./stdio.js";
 export type { RunMCPStdioOptions } from "./stdio.js";
 export { getBuiltinCrossAppTools } from "./builtin-tools.js";
 export { embedApp, MCP_APP_REQUEST_ORIGIN_CSP_SOURCE, type EmbedAppOptions, } from "./embed-app.js";
+export { embedRoute, type EmbedRouteContext, type EmbedRouteOptions, type EmbedRoutePathBuilder, type EmbedRouteResult, } from "./embed-route.js";
 export { resolveWorkspace, resolveLocalAppOrigin, findWorkspaceRoot, } from "./workspace-resolve.js";
 export type { ResolvedApp, ResolvedWorkspace } from "./workspace-resolve.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EACL,QAAQ,EACR,iCAAiC,EACjC,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;~~AAGxB~~,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EACL,QAAQ,EACR,iCAAiC,EACjC,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/mcp/index.js CHANGED Viewed

@@ -6,6 +6,7 @@ export { runMCPStdio } from "./stdio.js";
 // Generic cross-app builtin tools (merged into the registry, template wins).
 export { getBuiltinCrossAppTools } from "./builtin-tools.js";
 export { embedApp, MCP_APP_REQUEST_ORIGIN_CSP_SOURCE, } from "./embed-app.js";
+export { embedRoute, } from "./embed-route.js";
 // Workspace / app resolution helpers (Node-only).
 export { resolveWorkspace, resolveLocalAppOrigin, findWorkspaceRoot, } from "./workspace-resolve.js";
 //# sourceMappingURL=index.js.map

package/dist/mcp/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,iFAAiF;AACjF,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,4DAA4D;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EACL,QAAQ,EACR,iCAAiC,GAElC,MAAM,gBAAgB,CAAC;~~AAExB~~,kDAAkD;AAClD,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC","sourcesContent":["export { mountMCP } from \"./server.js\";\nexport type { MCPConfig } from \"./server.js\";\n\n// Shared MCP server builder (also re-exported from ./server.js for back-compat).\nexport {\n createMCPServerForRequest,\n verifyAuth,\n getAccessTokens,\n resolveOrgIdFromDomain,\n buildLinkArtifacts,\n} from \"./build-server.js\";\nexport type { MCPCallerIdentity, MCPRequestMeta } from \"./build-server.js\";\n\n// stdio transport for `agent-native mcp serve` (Node-only).\nexport { runMCPStdio } from \"./stdio.js\";\nexport type { RunMCPStdioOptions } from \"./stdio.js\";\n\n// Generic cross-app builtin tools (merged into the registry, template wins).\nexport { getBuiltinCrossAppTools } from \"./builtin-tools.js\";\nexport {\n embedApp,\n MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n type EmbedAppOptions,\n} from \"./embed-app.js\";\n\n// Workspace / app resolution helpers (Node-only).\nexport {\n resolveWorkspace,\n resolveLocalAppOrigin,\n findWorkspaceRoot,\n} from \"./workspace-resolve.js\";\nexport type { ResolvedApp, ResolvedWorkspace } from \"./workspace-resolve.js\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,iFAAiF;AACjF,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,4DAA4D;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EACL,QAAQ,EACR,iCAAiC,GAElC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,GAKX,MAAM,kBAAkB,CAAC;AAE1B,kDAAkD;AAClD,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC","sourcesContent":["export { mountMCP } from \"./server.js\";\nexport type { MCPConfig } from \"./server.js\";\n\n// Shared MCP server builder (also re-exported from ./server.js for back-compat).\nexport {\n createMCPServerForRequest,\n verifyAuth,\n getAccessTokens,\n resolveOrgIdFromDomain,\n buildLinkArtifacts,\n} from \"./build-server.js\";\nexport type { MCPCallerIdentity, MCPRequestMeta } from \"./build-server.js\";\n\n// stdio transport for `agent-native mcp serve` (Node-only).\nexport { runMCPStdio } from \"./stdio.js\";\nexport type { RunMCPStdioOptions } from \"./stdio.js\";\n\n// Generic cross-app builtin tools (merged into the registry, template wins).\nexport { getBuiltinCrossAppTools } from \"./builtin-tools.js\";\nexport {\n embedApp,\n MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n type EmbedAppOptions,\n} from \"./embed-app.js\";\nexport {\n embedRoute,\n type EmbedRouteContext,\n type EmbedRouteOptions,\n type EmbedRoutePathBuilder,\n type EmbedRouteResult,\n} from \"./embed-route.js\";\n\n// Workspace / app resolution helpers (Node-only).\nexport {\n resolveWorkspace,\n resolveLocalAppOrigin,\n findWorkspaceRoot,\n} from \"./workspace-resolve.js\";\nexport type { ResolvedApp, ResolvedWorkspace } from \"./workspace-resolve.js\";\n"]}

package/dist/scripts/agent-engines/list-agent-engines.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"list-agent-engines.d.ts","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAcvD,eAAO,MAAM,IAAI,EAAE,UAQlB,CAAC;AAEF,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,~~CAoE5E~~"}
1	+ {"version":3,"file":"list-agent-engines.d.ts","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAcvD,eAAO,MAAM,IAAI,EAAE,UAQlB,CAAC;AAEF,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyE5E"}

package/dist/scripts/agent-engines/list-agent-engines.js CHANGED Viewed

@@ -37,15 +37,19 @@ export async function run(args = {}) {
         !!appDefaultEntry &&
         (await isStoredEngineUsableForRequest(appDefault, appDefaultEntry));
     const detectedFromUser = await detectEngineFromUserSecrets();
-    const currentEntry = (process.env.AGENT_ENGINE
+    const envEntry = process.env.AGENT_ENGINE
         ? getAgentEngineEntry(process.env.AGENT_ENGINE)
-        : undefined) ??
-        (appDefaultUsable ? appDefaultEntry : undefined) ??
-        (detectedFromUser?.name === "builder" ? detectedFromUser : undefined) ??
-        (storedUsable ? storedEntry : undefined) ??
-        detectedFromUser ??
-        detectEngineFromEnv() ??
-        undefined;
+        : undefined;
+    const envUnavailable = !!envEntry && !isAgentEnginePackageInstalled(envEntry);
+    const currentEntry = envUnavailable
+        ? undefined
+        : (envEntry ??
+            (appDefaultUsable ? appDefaultEntry : undefined) ??
+            (detectedFromUser?.name === "builder" ? detectedFromUser : undefined) ??
+            (storedUsable ? storedEntry : undefined) ??
+            detectedFromUser ??
+            detectEngineFromEnv() ??
+            undefined);
     const currentModel = appDefaultUsable && currentEntry?.name === appDefault?.engine
         ? appDefault?.model
         : storedUsable && currentEntry?.name === current?.engine
@@ -64,10 +68,12 @@ export async function run(args = {}) {
             installPackage: e.installPackage,
             packageInstalled: isAgentEnginePackageInstalled(e),
         })),
-        current: {
-            engine: currentEngineName,
-            model: currentModel ?? currentEntry?.defaultModel ?? DEFAULT_MODEL,
-        },
+        current: envUnavailable
+            ? null
+            : {
+                engine: currentEngineName,
+                model: currentModel ?? currentEntry?.defaultModel ?? DEFAULT_MODEL,
+            },
     };
     return JSON.stringify(result, null, 2);
 }

package/dist/scripts/agent-engines/list-agent-engines.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"list-agent-engines.js","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,CAAC,MAAM,IAAI,GAAe;IAC9B,WAAW,EACT,mNAAmN;IACrN,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAA+B,EAAE;IACzD,sBAAsB,EAAE,CAAC;IAEzB,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,cAAc;QAC5B,CAAC,CAAE,cAAsD;QACzD,CAAC,CAAC,IAAI,CAAC;IAET,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,WAAW,GACf,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,YAAY,GAChB,CAAC,CAAC,WAAW;QACb,CAAC,MAAM,8BAA8B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,eAAe,GACnB,OAAO,UAAU,EAAE,MAAM,KAAK,QAAQ;QACpC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GACpB,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,eAAe;QACjB,CAAC,MAAM,8BAA8B,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,EAAE,CAAC;~~IAE7D~~,MAAM,~~YAAY~~,~~GAChB~~,~~CAAC,~~OAAO,CAAC,GAAG,CAAC,YAAY;~~QACvB~~,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;~~QACd~~,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;~~QAChD~~,CAAC,gBAAgB,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;~~QACrE~~,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;~~QACxC~~,gBAAgB;~~QAChB~~,mBAAmB,EAAE;~~QACrB~~,SAAS,CAAC;~~IACZ~~,MAAM,YAAY,GAChB,gBAAgB,IAAI,YAAY,EAAE,IAAI,KAAK,UAAU,EAAE,MAAM;QAC3D,CAAC,CAAC,UAAU,EAAE,KAAK;QACnB,CAAC,CAAC,YAAY,IAAI,YAAY,EAAE,IAAI,KAAK,OAAO,EAAE,MAAM;YACtD,CAAC,CAAC,OAAO,EAAE,KAAK;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,iBAAiB,GAAG,YAAY,EAAE,IAAI,IAAI,WAAW,CAAC;IAE5D,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,EAAE;~~YACP~~,MAAM,EAAE,iBAAiB;~~YACzB~~,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,YAAY,IAAI,aAAa;~~SACnE~~;~~KACF~~,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC","sourcesContent":["/*\n list-agent-engines — returns the registered engine registry and current selection.\n */\n\nimport type { ActionTool } from \"../../agent/types.js\";\nimport {\n listAgentEngines,\n registerBuiltinEngines,\n detectEngineFromEnv,\n detectEngineFromUserSecrets,\n getAgentEngineEntry,\n isAgentEnginePackageInstalled,\n isStoredEngineUsableForRequest,\n} from \"../../agent/engine/index.js\";\nimport { DEFAULT_MODEL } from \"../../agent/default-model.js\";\nimport { getAgentAppModelDefaultForCurrentRequest } from \"../../agent/app-model-defaults.js\";\nimport { getSetting } from \"../../settings/index.js\";\n\nexport const tool: ActionTool = {\n description:\n 'List all available AI agent engines (Anthropic, OpenAI, Gemini, Groq, etc.) and the currently selected engine. Use this to check what engines are available before calling manage-agent-engine with action=\"set\".',\n parameters: {\n type: \"object\",\n properties: {},\n required: [],\n },\n};\n\nexport async function run(args: Record<string, string> = {}): Promise<string> {\n registerBuiltinEngines();\n\n const engines = listAgentEngines();\n const currentSetting = await getSetting(\"agent-engine\");\n const current = currentSetting\n ? (currentSetting as { engine?: string; model?: string })\n : null;\n\n // Same priority chain resolveEngine uses after explicit request options:\n // AGENT_ENGINE → app default → Builder app_secrets → stored (if usable)\n // → user BYOK app_secrets → env → anthropic. Gating stored/app defaults\n // on the request-aware helper keeps the picker in step with the runtime.\n const storedEntry =\n typeof current?.engine === \"string\"\n ? getAgentEngineEntry(current.engine)\n : undefined;\n const storedUsable =\n !!storedEntry &&\n (await isStoredEngineUsableForRequest(current, storedEntry));\n const appDefault = await getAgentAppModelDefaultForCurrentRequest(args.appId);\n const appDefaultEntry =\n typeof appDefault?.engine === \"string\"\n ? getAgentEngineEntry(appDefault.engine)\n : undefined;\n const appDefaultUsable =\n !!appDefault &&\n !!appDefaultEntry &&\n (await isStoredEngineUsableForRequest(appDefault, appDefaultEntry));\n const detectedFromUser = await detectEngineFromUserSecrets();\n\n const ~~currentEntry~~ ~~=\n (~~process.env.AGENT_ENGINE\n ? getAgentEngineEntry(process.env.AGENT_ENGINE)\n : undefined) ~~??\~~n (appDefaultUsable ? appDefaultEntry : undefined) ??\n (detectedFromUser?.name === \"builder\" ? detectedFromUser : undefined) ??\n (storedUsable ? storedEntry : undefined) ??\n detectedFromUser ??\n detectEngineFromEnv() ??\n undefined;\n const currentModel =\n appDefaultUsable && currentEntry?.name === appDefault?.engine\n ? appDefault?.model\n : storedUsable && currentEntry?.name === current?.engine\n ? current?.model\n : undefined;\n const currentEngineName = currentEntry?.name ?? \"anthropic\";\n\n const result = {\n engines: engines.map((e) => ({\n name: e.name,\n label: e.label,\n description: e.description,\n defaultModel: e.defaultModel,\n supportedModels: e.supportedModels,\n capabilities: e.capabilities,\n requiredEnvVars: e.requiredEnvVars,\n installPackage: e.installPackage,\n packageInstalled: isAgentEnginePackageInstalled(e),\n })),\n current: {\n engine: currentEngineName,\n model: currentModel ?? currentEntry?.defaultModel ?? DEFAULT_MODEL,\n },\n };\n\n return JSON.stringify(result, null, 2);\n}\n"]}
1	+ {"version":3,"file":"list-agent-engines.js","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,CAAC,MAAM,IAAI,GAAe;IAC9B,WAAW,EACT,mNAAmN;IACrN,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAA+B,EAAE;IACzD,sBAAsB,EAAE,CAAC;IAEzB,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,cAAc;QAC5B,CAAC,CAAE,cAAsD;QACzD,CAAC,CAAC,IAAI,CAAC;IAET,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,WAAW,GACf,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,YAAY,GAChB,CAAC,CAAC,WAAW;QACb,CAAC,MAAM,8BAA8B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,eAAe,GACnB,OAAO,UAAU,EAAE,MAAM,KAAK,QAAQ;QACpC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GACpB,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,eAAe;QACjB,CAAC,MAAM,8BAA8B,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY;QACvC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,cAAc,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAE9E,MAAM,YAAY,GAAG,cAAc;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,QAAQ;YACT,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,gBAAgB,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACxC,gBAAgB;YAChB,mBAAmB,EAAE;YACrB,SAAS,CAAC,CAAC;IACf,MAAM,YAAY,GAChB,gBAAgB,IAAI,YAAY,EAAE,IAAI,KAAK,UAAU,EAAE,MAAM;QAC3D,CAAC,CAAC,UAAU,EAAE,KAAK;QACnB,CAAC,CAAC,YAAY,IAAI,YAAY,EAAE,IAAI,KAAK,OAAO,EAAE,MAAM;YACtD,CAAC,CAAC,OAAO,EAAE,KAAK;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,iBAAiB,GAAG,YAAY,EAAE,IAAI,IAAI,WAAW,CAAC;IAE5D,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,EAAE,cAAc;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,MAAM,EAAE,iBAAiB;gBACzB,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,YAAY,IAAI,aAAa;aACnE;KACN,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC","sourcesContent":["/*\n list-agent-engines — returns the registered engine registry and current selection.\n */\n\nimport type { ActionTool } from \"../../agent/types.js\";\nimport {\n listAgentEngines,\n registerBuiltinEngines,\n detectEngineFromEnv,\n detectEngineFromUserSecrets,\n getAgentEngineEntry,\n isAgentEnginePackageInstalled,\n isStoredEngineUsableForRequest,\n} from \"../../agent/engine/index.js\";\nimport { DEFAULT_MODEL } from \"../../agent/default-model.js\";\nimport { getAgentAppModelDefaultForCurrentRequest } from \"../../agent/app-model-defaults.js\";\nimport { getSetting } from \"../../settings/index.js\";\n\nexport const tool: ActionTool = {\n description:\n 'List all available AI agent engines (Anthropic, OpenAI, Gemini, Groq, etc.) and the currently selected engine. Use this to check what engines are available before calling manage-agent-engine with action=\"set\".',\n parameters: {\n type: \"object\",\n properties: {},\n required: [],\n },\n};\n\nexport async function run(args: Record<string, string> = {}): Promise<string> {\n registerBuiltinEngines();\n\n const engines = listAgentEngines();\n const currentSetting = await getSetting(\"agent-engine\");\n const current = currentSetting\n ? (currentSetting as { engine?: string; model?: string })\n : null;\n\n // Same priority chain resolveEngine uses after explicit request options:\n // AGENT_ENGINE → app default → Builder app_secrets → stored (if usable)\n // → user BYOK app_secrets → env → anthropic. Gating stored/app defaults\n // on the request-aware helper keeps the picker in step with the runtime.\n const storedEntry =\n typeof current?.engine === \"string\"\n ? getAgentEngineEntry(current.engine)\n : undefined;\n const storedUsable =\n !!storedEntry &&\n (await isStoredEngineUsableForRequest(current, storedEntry));\n const appDefault = await getAgentAppModelDefaultForCurrentRequest(args.appId);\n const appDefaultEntry =\n typeof appDefault?.engine === \"string\"\n ? getAgentEngineEntry(appDefault.engine)\n : undefined;\n const appDefaultUsable =\n !!appDefault &&\n !!appDefaultEntry &&\n (await isStoredEngineUsableForRequest(appDefault, appDefaultEntry));\n const detectedFromUser = await detectEngineFromUserSecrets();\n const envEntry = process.env.AGENT_ENGINE\n ? getAgentEngineEntry(process.env.AGENT_ENGINE)\n : undefined;\n const envUnavailable = !!envEntry && !isAgentEnginePackageInstalled(envEntry);\n\n const currentEntry = envUnavailable\n ? undefined\n : (envEntry ??\n (appDefaultUsable ? appDefaultEntry : undefined) ??\n (detectedFromUser?.name === \"builder\" ? detectedFromUser : undefined) ??\n (storedUsable ? storedEntry : undefined) ??\n detectedFromUser ??\n detectEngineFromEnv() ??\n undefined);\n const currentModel =\n appDefaultUsable && currentEntry?.name === appDefault?.engine\n ? appDefault?.model\n : storedUsable && currentEntry?.name === current?.engine\n ? current?.model\n : undefined;\n const currentEngineName = currentEntry?.name ?? \"anthropic\";\n\n const result = {\n engines: engines.map((e) => ({\n name: e.name,\n label: e.label,\n description: e.description,\n defaultModel: e.defaultModel,\n supportedModels: e.supportedModels,\n capabilities: e.capabilities,\n requiredEnvVars: e.requiredEnvVars,\n installPackage: e.installPackage,\n packageInstalled: isAgentEnginePackageInstalled(e),\n })),\n current: envUnavailable\n ? null\n : {\n engine: currentEngineName,\n model: currentModel ?? currentEntry?.defaultModel ?? DEFAULT_MODEL,\n },\n };\n\n return JSON.stringify(result, null, 2);\n}\n"]}

package/dist/server/auth.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;~~AAwChE~~,KAAK,KAAK,GAAG,SAAS,CAAC;AAQvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAMlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAwB5D,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAc7C;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAoCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAEpD;AAED,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,yBAAyB,QACQ,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAGvD;AAmCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAExE;AAgCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIjE;AAkGD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAUrE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAOpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQzD;AAmJD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7D;AAyDD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB3E;AAsED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAmBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,QAWd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,2BAA2B,QAOnC;AAmGD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;~~AAwmBD~~;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAY5E;AAgID,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAS7E;AAo7CD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAmMlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAEzE"}
1	+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAyChE,KAAK,KAAK,GAAG,SAAS,CAAC;AAQvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAMlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAwB5D,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAc7C;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAoCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAEpD;AAED,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,yBAAyB,QACQ,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAGvD;AAmCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAExE;AAgCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIjE;AAkGD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAUrE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAOpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQzD;AAmJD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7D;AAyDD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB3E;AAsED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAmBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,QAWd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,2BAA2B,QAOnC;AAmGD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AA+mBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAY5E;AAgID,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAS7E;AAo7CD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAmMlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAEzE"}

package/dist/server/auth.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import { defineEventHandler, getMethod, getQuery, getRequestIP, setResponseHeader, setResponseStatus, getCookie, setCookie, deleteCookie, getHeader, } from "h3";
 import { EMBED_START_PATH } from "../shared/embed-auth.js";
+import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
 import { resolveEmbedSessionFromRequest } from "./embed-session.js";
 // In h3 v2, `event.req` IS the web Request — but in Nitro's dev server (srvx
 // runtime), event.url and event.req share the same underlying URL object.
@@ -764,7 +765,14 @@ function applyCorsHeaders(event) {
     setResponseHeader(event, "Vary", "Origin");
     setResponseHeader(event, "Access-Control-Allow-Credentials", "true");
     setResponseHeader(event, "Access-Control-Allow-Methods", "GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS");
-    setResponseHeader(event, "Access-Control-Allow-Headers", "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF");
+    setResponseHeader(event, "Access-Control-Allow-Headers", [
+        "Content-Type",
+        "Authorization",
+        "X-Requested-With",
+        "X-Request-Source",
+        "X-Agent-Native-CSRF",
+        EMBED_TARGET_HEADER,
+    ].join(","));
     return { hasOrigin: true, allowed: true };
 }
 function createAuthCorsHandler() {