@agent-native/core 0.37.3 → 0.38.0

package/dist/server/agents-bundle.js

@@ -19,11 +19,33 @@
  *
  * Result is cached in module scope so it's only computed once per cold start.
  */
+export const DEFAULT_SKILL_SCOPE = "both";
 const EMPTY = { agentsMd: "", workspaceAgentsMd: "", skills: {} };
 let cached = null;
+/**
+ * Coerce a raw frontmatter `scope` value into a known `SkillScope`. Unknown,
+ * empty, or malformed values fall back to the default (`both`) so a typo never
+ * silently hides a skill from the runtime agent. Optionally warns once per
+ * distinct bad value to aid debugging without spamming logs.
+ */
+const warnedBadScopes = new Set();
+export function normalizeSkillScope(raw) {
+    if (!raw)
+        return DEFAULT_SKILL_SCOPE;
+    const value = raw.trim().toLowerCase();
+    if (value === "runtime" || value === "dev" || value === "both") {
+        return value;
+    }
+    if (value && !warnedBadScopes.has(value)) {
+        warnedBadScopes.add(value);
+        console.warn(`[agents-bundle] Unknown skill scope "${raw}" — treating as "${DEFAULT_SKILL_SCOPE}". Valid values: runtime, dev, both.`);
+    }
+    return DEFAULT_SKILL_SCOPE;
+}
 /**
  * Parse the YAML frontmatter at the top of a skill file.
- * Only pulls out `name` and `description` — deliberately simple, no YAML lib.
+ * Only pulls out `name`, `description`, and `scope` — deliberately simple, no
+ * YAML lib.
  * Handles:
  *   - Inline: `description: Some text`
  *   - Folded scalar: `description: >-\n  multi\n  line` → "multi line"
@@ -76,6 +98,8 @@ export function parseSkillFrontmatter(content) {
             result.name = value;
         else if (key === "description" && value)
             result.description = value;
+        else if (key === "scope" && value)
+            result.scope = normalizeSkillScope(value);
     }
     return result;
 }
@@ -134,7 +158,11 @@ function readSkillsDir(skillsDir, rootForRelative, out, skipExistingNames) {
             catch { }
             extraFiles.sort();
             out[name] = {
-                meta: { name, description: meta.description ?? "" },
+                meta: {
+                    name,
+                    description: meta.description ?? "",
+                    scope: meta.scope ?? DEFAULT_SKILL_SCOPE,
+                },
                 content,
                 dir: path.relative(rootForRelative, skillDirAbs).replace(/\\/g, "/"),
                 extraFiles,
@@ -255,8 +283,18 @@ export async function loadAgentsBundle() {
  * no bash; templates that need skill content at runtime should inline the
  * critical parts directly in `AGENTS.md`.
  */
+/**
+ * Skills visible to the agent-native RUNTIME agent. Excludes `scope: dev`
+ * skills (those are for the human's coding agent only). Skills with no scope,
+ * `scope: runtime`, or `scope: both` are all included. Use this anywhere the
+ * runtime agent's view of skills is built (prompt block + docs-search) so a
+ * dev-scoped skill is invisible to the runtime agent everywhere.
+ */
+export function getRuntimeSkills(bundle) {
+    return Object.values(bundle.skills).filter((skill) => skill.meta.scope !== "dev");
+}
 export function generateSkillsPromptBlock(bundle) {
-    const entries = Object.values(bundle.skills);
+    const entries = getRuntimeSkills(bundle);
     if (entries.length === 0)
         return "";
     const lines = entries.map((s) => {

package/dist/server/agents-bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents-bundle.js","sourceRoot":"","sources":["../../src/server/agents-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA8CH,MAAM,KAAK,GAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEhF,IAAI,MAAM,GAAwB,IAAI,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAEtD,IAAI,KAAa,CAAC;QAClB,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC1B,kEAAkE;YAClE,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACf,CAAC,EAAE,CAAC;oBACJ,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM;gBAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;gBACrC,CAAC,EAAE,CAAC;YACN,CAAC;YACD,4BAA4B;YAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;YACvE,KAAK,GAAG,QAAQ;gBACd,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;QAED,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;aAC5C,IAAI,GAAG,KAAK,aAAa,IAAI,KAAK;YAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;IACtE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,oBAAoB,GAAG;IAC3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;CACrB,CAAC;AAeX;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,SAAiB,EACjB,eAAuB,EACvB,GAA0B,EAC1B,iBAA0B;IAE1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IACtC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;gBAAE,SAAS;YAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;YACrC,IAAI,iBAAiB,IAAI,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS,CAAC,gBAAgB;YAE9D,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,EAAE;oBAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;wBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;wBACtC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;wBACpD,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;4BAC1C,IAAI,CAAC;gCACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gCAC9B,IAAI,IAAI,CAAC,WAAW,EAAE;oCAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;4BACzC,CAAC;4BAAC,MAAM,CAAC,CAAA,CAAC;wBACZ,CAAC;6BAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;4BAC/C,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,UAAU,CAAC,IAAI,EAAE,CAAC;YAElB,GAAG,CAAC,IAAI,CAAC,GAAG;gBACV,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE;gBACnD,OAAO;gBACP,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;gBACpE,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,kBAAgD,IAAI;IAEpD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,IAAI,iBAAiB,GAAG,EAAE,CAAC;IAC3B,IAAI,eAAe,EAAE,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChD,iBAAiB,GAAG,EAAE,CAAC,YAAY,CACjC,eAAe,CAAC,YAAY,EAC5B,OAAO,CACR,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,eAAe,EAAE,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CACX,eAAe,CAAC,SAAS,EACzB,eAAe,CAAC,OAAO,EACvB,MAAM,EACN,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,uCAAuC;IACvC,IAAI,CAAC;QACH,qEAAqE;QACrE,oDAAoD;QACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAClD,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,OAAuB,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,CAAC;QACH,IAAI,eAAe,GAAiC,IAAI,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,uBAAuB,EAAE,GAC/B,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACxD,IAAI,EAAE,EAAE,CAAC;gBACP,eAAe,GAAG;oBAChB,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,YAAY,EAAE,EAAE,CAAC,YAAY;oBAC7B,OAAO,EAAE,EAAE,CAAC,UAAU;iBACvB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QACD,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,KAAK,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAoB;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,MAAM,GACV,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChD,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,GAAG,MAAM,EAAE,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;;;EAQP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;UACR,CAAC;AACX,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Agents bundle — loads AGENTS.md and .agents/skills/ from the template.\n * The legacy singular .agent/skills/ directory is also accepted as an alias.\n *\n * This is the single source of truth the framework's agent uses to mirror what\n * Claude Code / Codex / any other agent would see when running locally in the\n * repo. The filesystem is the canonical source; this module is just a loader\n * that works both in dev (direct fs read) and production (content bundled at\n * build time via the `virtual:agents-bundle` Vite plugin).\n *\n * Resolution order inside `loadAgentsBundle()`:\n *   1. Virtual module (`virtual:agents-bundle`) — inlined at build time by the\n *      framework's Vite plugin. This is the ONLY path that works on edge\n *      runtimes (Cloudflare Workers) where `readFileSync` doesn't exist.\n *   2. Filesystem fallback — `process.cwd()/AGENTS.md` +\n *      `process.cwd()/.agents/skills/` (or legacy `.agent/skills/`). Only reliable in local dev and Node\n *      production (`agent-native start`); not on Netlify/Vercel/CF at runtime.\n *   3. Empty bundle — everything silently returns empty strings.\n *\n * Result is cached in module scope so it's only computed once per cold start.\n */\n\nexport interface SkillMeta {\n  name: string;\n  description: string;\n}\n\nexport interface Skill {\n  meta: SkillMeta;\n  /** Contents of SKILL.md (the entry file of the skill). */\n  content: string;\n  /**\n   * Filesystem path to the skill directory, relative to the template root\n   * (e.g. `.agents/skills/create-deck`). The agent can read any file here via\n   * bash in dev — skills are folders, not single files, and may contain\n   * supporting assets, scripts, or additional markdown.\n   */\n  dir: string;\n  /**\n   * Files inside the skill directory (relative to the skill dir), excluding\n   * `SKILL.md`. Lets the agent know what else is available without a separate\n   * `ls` call. Empty array if the skill is single-file.\n   */\n  extraFiles: string[];\n}\n\nexport interface AgentsBundle {\n  /** Contents of the template's AGENTS.md (empty string if missing). */\n  agentsMd: string;\n  /**\n   * Contents of the workspace core's AGENTS.md, if the app is inside an\n   * enterprise monorepo with a `workspaceCore` configured. Empty string\n   * otherwise. Sits between the framework system prompt and the template's\n   * AGENTS.md in the instruction stack.\n   */\n  workspaceAgentsMd?: string;\n  /**\n   * Map from skill name → skill content. Contains skills merged from the\n   * workspace core layer (if present) and the template layer. On name\n   * collision, the template's version wins so apps can override a shared\n   * enterprise skill by dropping a same-named file under\n   * `.agents/skills/<name>/`.\n   */\n  skills: Record<string, Skill>;\n}\n\nconst EMPTY: AgentsBundle = { agentsMd: \"\", workspaceAgentsMd: \"\", skills: {} };\n\nlet cached: AgentsBundle | null = null;\n\n/**\n * Parse the YAML frontmatter at the top of a skill file.\n * Only pulls out `name` and `description` — deliberately simple, no YAML lib.\n * Handles:\n *   - Inline: `description: Some text`\n *   - Folded scalar: `description: >-\\n  multi\\n  line` → \"multi line\"\n *   - Literal scalar: `description: |\\n  multi\\n  line` → \"multi\\nline\"\n */\nexport function parseSkillFrontmatter(content: string): Partial<SkillMeta> {\n  const match = content.match(/^---\\r?\\n([\\s\\S]+?)\\r?\\n---/);\n  if (!match) return {};\n  const lines = match[1].split(/\\r?\\n/);\n  const result: Partial<SkillMeta> = {};\n\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    const keyMatch = line.match(/^([a-zA-Z_][a-zA-Z0-9_-]*):\\s*(.*)$/);\n    if (!keyMatch) continue;\n    const [, key, valueRaw] = keyMatch;\n    const trimmed = valueRaw.trim();\n\n    const isFolded = trimmed === \">\" || trimmed === \">-\";\n    const isLiteral = trimmed === \"|\" || trimmed === \"|-\";\n\n    let value: string;\n    if (isFolded || isLiteral) {\n      // Collect subsequent indented lines (at least one leading space).\n      const block: string[] = [];\n      let j = i + 1;\n      while (j < lines.length) {\n        const next = lines[j];\n        if (next.length === 0) {\n          block.push(\"\");\n          j++;\n          continue;\n        }\n        if (!/^\\s/.test(next)) break;\n        block.push(next.replace(/^\\s+/, \"\"));\n        j++;\n      }\n      // Trim trailing blank lines\n      while (block.length > 0 && block[block.length - 1] === \"\") block.pop();\n      value = isFolded\n        ? block.filter((l) => l !== \"\").join(\" \")\n        : block.join(\"\\n\");\n      i = j - 1;\n    } else {\n      value = trimmed;\n    }\n\n    if (key === \"name\" && value) result.name = value;\n    else if (key === \"description\" && value) result.description = value;\n  }\n\n  return result;\n}\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nconst TEMPLATE_SKILLS_DIRS = [\n  path.join(\".agents\", \"skills\"),\n  path.join(\".agent\", \"skills\"),\n] as const;\n\n/**\n * Paths to a workspace-core's agent resources, for merging into a template's\n * bundle. All fields optional — pass null for any missing piece.\n */\nexport interface WorkspaceAgentsSource {\n  /** Absolute path to the workspace core's skills/ directory. */\n  skillsDir: string | null;\n  /** Absolute path to the workspace core's AGENTS.md. */\n  agentsMdPath: string | null;\n  /** Root dir (used to compute `dir` paths for workspace-core skills). */\n  rootDir: string;\n}\n\n/**\n * Read one skills directory into a `Record<string, Skill>`. Extracted so\n * both the template and workspace-core paths can reuse it. `dirPrefix` is\n * the display path that will be reported to the agent (e.g.\n * `.agents/skills/<name>` for templates, or\n * `<workspace-shared-package>/.agents/skills/<name>` for the workspace layer).\n */\nfunction readSkillsDir(\n  skillsDir: string,\n  rootForRelative: string,\n  out: Record<string, Skill>,\n  skipExistingNames: boolean,\n): void {\n  if (!fs.existsSync(skillsDir)) return;\n  const entries = fs.readdirSync(skillsDir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;\n    const skillDirAbs = path.join(skillsDir, entry.name);\n    const skillFile = path.join(skillDirAbs, \"SKILL.md\");\n    try {\n      const realSkillFile = fs.realpathSync(skillFile);\n      if (!fs.existsSync(realSkillFile)) continue;\n      const content = fs.readFileSync(realSkillFile, \"utf-8\");\n      const meta = parseSkillFrontmatter(content);\n      const name = meta.name ?? entry.name;\n      if (skipExistingNames && out[name]) continue; // Template wins\n\n      const extraFiles: string[] = [];\n      try {\n        const walk = (subdir: string, prefix: string) => {\n          for (const e of fs.readdirSync(subdir, { withFileTypes: true })) {\n            const abs = path.join(subdir, e.name);\n            const rel = prefix ? `${prefix}/${e.name}` : e.name;\n            if (e.isDirectory() || e.isSymbolicLink()) {\n              try {\n                const stat = fs.statSync(abs);\n                if (stat.isDirectory()) walk(abs, rel);\n              } catch {}\n            } else if (e.isFile() && e.name !== \"SKILL.md\") {\n              extraFiles.push(rel);\n            }\n          }\n        };\n        walk(skillDirAbs, \"\");\n      } catch {}\n      extraFiles.sort();\n\n      out[name] = {\n        meta: { name, description: meta.description ?? \"\" },\n        content,\n        dir: path.relative(rootForRelative, skillDirAbs).replace(/\\\\/g, \"/\"),\n        extraFiles,\n      };\n    } catch {\n      // Skip unreadable skills\n    }\n  }\n}\n\n/**\n * Read AGENTS.md + all skills directly from the filesystem rooted at `cwd`.\n * Optionally also reads a workspace-core's AGENTS.md and skills directory\n * and merges them in (template wins on name collisions). Used by both the\n * Vite plugin (at build time) and the runtime fallback (in dev / Node prod).\n *\n * Synchronous — the Vite plugin's load hook calls it inline during the build.\n */\nexport function readAgentsBundleFromFs(\n  cwd: string,\n  workspaceSource: WorkspaceAgentsSource | null = null,\n): AgentsBundle {\n  let agentsMd = \"\";\n  try {\n    const agentsMdPath = path.join(cwd, \"AGENTS.md\");\n    if (fs.existsSync(agentsMdPath)) {\n      agentsMd = fs.readFileSync(agentsMdPath, \"utf-8\");\n    }\n  } catch {}\n\n  let workspaceAgentsMd = \"\";\n  if (workspaceSource?.agentsMdPath) {\n    try {\n      if (fs.existsSync(workspaceSource.agentsMdPath)) {\n        workspaceAgentsMd = fs.readFileSync(\n          workspaceSource.agentsMdPath,\n          \"utf-8\",\n        );\n      }\n    } catch {}\n  }\n\n  // Merge skills: template first (so its entries are authoritative), then\n  // workspace-core with skipExistingNames=true so same-named skills don't\n  // overwrite the template's. `.agents/skills` is canonical; `.agent/skills`\n  // is accepted as a legacy alias and does not override canonical skills.\n  const skills: Record<string, Skill> = {};\n  for (const [index, relSkillsDir] of TEMPLATE_SKILLS_DIRS.entries()) {\n    try {\n      readSkillsDir(path.join(cwd, relSkillsDir), cwd, skills, index > 0);\n    } catch {}\n  }\n\n  if (workspaceSource?.skillsDir) {\n    try {\n      readSkillsDir(\n        workspaceSource.skillsDir,\n        workspaceSource.rootDir,\n        skills,\n        true,\n      );\n    } catch {}\n  }\n\n  return { agentsMd, workspaceAgentsMd, skills };\n}\n\n/**\n * Load the agents bundle. Returns a cached result on subsequent calls.\n * Tries the virtual module first (works everywhere, including edge), then\n * falls back to filesystem reads from `process.cwd()` — which, when a\n * workspace core is present, also merges in the workspace core's skills\n * and AGENTS.md.\n */\nexport async function loadAgentsBundle(): Promise<AgentsBundle> {\n  if (cached) return cached;\n\n  // 1. Try the Vite-emitted virtual module. This is the path that works on\n  //    every deployment target because the content is inlined at build time.\n  //    The Vite plugin itself is responsible for merging workspace-core\n  //    content into the bundle it emits.\n  try {\n    // @ts-expect-error — virtual module is resolved at build time by our\n    // Vite plugin; nothing exists at this path on disk.\n    const mod = await import(\"virtual:agents-bundle\");\n    if (mod && mod.default) {\n      cached = mod.default as AgentsBundle;\n      return cached;\n    }\n  } catch {\n    // Virtual module not available — fall through to filesystem.\n  }\n\n  // 2. Filesystem fallback — works in dev / Node prod. If a workspace core\n  //    is present in the ancestor chain, merge its skills + AGENTS.md in.\n  try {\n    let workspaceSource: WorkspaceAgentsSource | null = null;\n    try {\n      const { getWorkspaceCoreExports } =\n        await import(\"../deploy/workspace-core.js\");\n      const ws = await getWorkspaceCoreExports(process.cwd());\n      if (ws) {\n        workspaceSource = {\n          skillsDir: ws.skillsDir,\n          agentsMdPath: ws.agentsMdPath,\n          rootDir: ws.packageDir,\n        };\n      }\n    } catch {\n      // workspace-core discovery isn't available (e.g. edge runtime).\n    }\n    cached = readAgentsBundleFromFs(process.cwd(), workspaceSource);\n    return cached;\n  } catch {\n    cached = EMPTY;\n    return cached;\n  }\n}\n\n/**\n * Generate the `<skills>` block to inject into the system prompt.\n *\n * Skills are folders at `.agents/skills/<name>/` (or legacy\n * `.agent/skills/<name>/`) containing a `SKILL.md` entry file plus any number\n * of supporting files (additional markdown, examples, images, scripts). This\n * block lists what's available and how to read them.\n *\n * In dev mode the agent has bash access and reads skills via `cat` — exactly\n * like running `claude` locally in the repo. In production mode the agent has\n * no bash; templates that need skill content at runtime should inline the\n * critical parts directly in `AGENTS.md`.\n */\nexport function generateSkillsPromptBlock(bundle: AgentsBundle): string {\n  const entries = Object.values(bundle.skills);\n  if (entries.length === 0) return \"\";\n\n  const lines = entries.map((s) => {\n    const extras =\n      s.extraFiles.length > 0\n        ? ` (also contains: ${s.extraFiles.join(\", \")})`\n        : \"\";\n    return `- \\`${s.meta.name}\\` at \\`${s.dir}/\\` — ${s.meta.description || \"(no description)\"}${extras}`;\n  });\n\n  return `<skills>\nThe following skills live in the repo, usually at \\`.agents/skills/<name>/\\` (legacy \\`.agent/skills/<name>/\\` is also supported). Each skill is a folder containing a \\`SKILL.md\\` entry file and sometimes supporting files. Read a skill BEFORE starting a task it applies to.\n\nTo read a skill in dev mode (when you have bash access):\n  \\`bash(command=\"cat <skill-dir>/SKILL.md\")\\`\n  \\`bash(command=\"ls <skill-dir>/\")\\` to see all files in the folder\n\nAvailable skills:\n${lines.join(\"\\n\")}\n</skills>`;\n}\n\n/** For tests — reset the module cache. */\nexport function __resetAgentsBundleCache(): void {\n  cached = null;\n}\n"]}
+{"version":3,"file":"agents-bundle.js","sourceRoot":"","sources":["../../src/server/agents-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAYH,MAAM,CAAC,MAAM,mBAAmB,GAAe,MAAM,CAAC;AAoDtD,MAAM,KAAK,GAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEhF,IAAI,MAAM,GAAwB,IAAI,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;AAC1C,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,mBAAmB,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,IAAI,CACV,wCAAwC,GAAG,oBAAoB,mBAAmB,sCAAsC,CACzH,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAEtD,IAAI,KAAa,CAAC;QAClB,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC1B,kEAAkE;YAClE,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACf,CAAC,EAAE,CAAC;oBACJ,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM;gBAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;gBACrC,CAAC,EAAE,CAAC;YACN,CAAC;YACD,4BAA4B;YAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;YACvE,KAAK,GAAG,QAAQ;gBACd,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;QAED,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;aAC5C,IAAI,GAAG,KAAK,aAAa,IAAI,KAAK;YAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;aAC/D,IAAI,GAAG,KAAK,OAAO,IAAI,KAAK;YAC/B,MAAM,CAAC,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,oBAAoB,GAAG;IAC3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;CACrB,CAAC;AAeX;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,SAAiB,EACjB,eAAuB,EACvB,GAA0B,EAC1B,iBAA0B;IAE1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IACtC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;gBAAE,SAAS;YAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;YACrC,IAAI,iBAAiB,IAAI,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS,CAAC,gBAAgB;YAE9D,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,EAAE;oBAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;wBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;wBACtC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;wBACpD,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;4BAC1C,IAAI,CAAC;gCACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gCAC9B,IAAI,IAAI,CAAC,WAAW,EAAE;oCAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;4BACzC,CAAC;4BAAC,MAAM,CAAC,CAAA,CAAC;wBACZ,CAAC;6BAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;4BAC/C,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,UAAU,CAAC,IAAI,EAAE,CAAC;YAElB,GAAG,CAAC,IAAI,CAAC,GAAG;gBACV,IAAI,EAAE;oBACJ,IAAI;oBACJ,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;oBACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,mBAAmB;iBACzC;gBACD,OAAO;gBACP,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;gBACpE,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,kBAAgD,IAAI;IAEpD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,IAAI,iBAAiB,GAAG,EAAE,CAAC;IAC3B,IAAI,eAAe,EAAE,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChD,iBAAiB,GAAG,EAAE,CAAC,YAAY,CACjC,eAAe,CAAC,YAAY,EAC5B,OAAO,CACR,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,eAAe,EAAE,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CACX,eAAe,CAAC,SAAS,EACzB,eAAe,CAAC,OAAO,EACvB,MAAM,EACN,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,uCAAuC;IACvC,IAAI,CAAC;QACH,qEAAqE;QACrE,oDAAoD;QACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAClD,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,OAAuB,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,CAAC;QACH,IAAI,eAAe,GAAiC,IAAI,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,uBAAuB,EAAE,GAC/B,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACxD,IAAI,EAAE,EAAE,CAAC;gBACP,eAAe,GAAG;oBAChB,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,YAAY,EAAE,EAAE,CAAC,YAAY;oBAC7B,OAAO,EAAE,EAAE,CAAC,UAAU;iBACvB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QACD,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,KAAK,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAoB;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CACxC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAoB;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,MAAM,GACV,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChD,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,GAAG,MAAM,EAAE,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;;;EAQP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;UACR,CAAC;AACX,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Agents bundle — loads AGENTS.md and .agents/skills/ from the template.\n * The legacy singular .agent/skills/ directory is also accepted as an alias.\n *\n * This is the single source of truth the framework's agent uses to mirror what\n * Claude Code / Codex / any other agent would see when running locally in the\n * repo. The filesystem is the canonical source; this module is just a loader\n * that works both in dev (direct fs read) and production (content bundled at\n * build time via the `virtual:agents-bundle` Vite plugin).\n *\n * Resolution order inside `loadAgentsBundle()`:\n *   1. Virtual module (`virtual:agents-bundle`) — inlined at build time by the\n *      framework's Vite plugin. This is the ONLY path that works on edge\n *      runtimes (Cloudflare Workers) where `readFileSync` doesn't exist.\n *   2. Filesystem fallback — `process.cwd()/AGENTS.md` +\n *      `process.cwd()/.agents/skills/` (or legacy `.agent/skills/`). Only reliable in local dev and Node\n *      production (`agent-native start`); not on Netlify/Vercel/CF at runtime.\n *   3. Empty bundle — everything silently returns empty strings.\n *\n * Result is cached in module scope so it's only computed once per cold start.\n */\n\n/**\n * Where a skill is meant to be used:\n *   - `runtime` — only the in-app agent at runtime (not the human's coding agent).\n *   - `dev`     — only the human's development/coding agent (e.g. Claude Code).\n *                 EXCLUDED from the runtime agent's prompt block and docs-search.\n *   - `both`    — loaded everywhere. This is the default when `scope` is absent\n *                 or set to an unrecognized value (fully backward compatible).\n */\nexport type SkillScope = \"runtime\" | \"dev\" | \"both\";\n\nexport const DEFAULT_SKILL_SCOPE: SkillScope = \"both\";\n\nexport interface SkillMeta {\n  name: string;\n  description: string;\n  /**\n   * Audience for the skill. Defaults to `both` when the SKILL.md frontmatter\n   * omits `scope` or specifies an unknown value. `dev`-scoped skills are hidden\n   * from the runtime agent everywhere (prompt block + docs-search).\n   */\n  scope: SkillScope;\n}\n\nexport interface Skill {\n  meta: SkillMeta;\n  /** Contents of SKILL.md (the entry file of the skill). */\n  content: string;\n  /**\n   * Filesystem path to the skill directory, relative to the template root\n   * (e.g. `.agents/skills/create-deck`). The agent can read any file here via\n   * bash in dev — skills are folders, not single files, and may contain\n   * supporting assets, scripts, or additional markdown.\n   */\n  dir: string;\n  /**\n   * Files inside the skill directory (relative to the skill dir), excluding\n   * `SKILL.md`. Lets the agent know what else is available without a separate\n   * `ls` call. Empty array if the skill is single-file.\n   */\n  extraFiles: string[];\n}\n\nexport interface AgentsBundle {\n  /** Contents of the template's AGENTS.md (empty string if missing). */\n  agentsMd: string;\n  /**\n   * Contents of the workspace core's AGENTS.md, if the app is inside an\n   * enterprise monorepo with a `workspaceCore` configured. Empty string\n   * otherwise. Sits between the framework system prompt and the template's\n   * AGENTS.md in the instruction stack.\n   */\n  workspaceAgentsMd?: string;\n  /**\n   * Map from skill name → skill content. Contains skills merged from the\n   * workspace core layer (if present) and the template layer. On name\n   * collision, the template's version wins so apps can override a shared\n   * enterprise skill by dropping a same-named file under\n   * `.agents/skills/<name>/`.\n   */\n  skills: Record<string, Skill>;\n}\n\nconst EMPTY: AgentsBundle = { agentsMd: \"\", workspaceAgentsMd: \"\", skills: {} };\n\nlet cached: AgentsBundle | null = null;\n\n/**\n * Coerce a raw frontmatter `scope` value into a known `SkillScope`. Unknown,\n * empty, or malformed values fall back to the default (`both`) so a typo never\n * silently hides a skill from the runtime agent. Optionally warns once per\n * distinct bad value to aid debugging without spamming logs.\n */\nconst warnedBadScopes = new Set<string>();\nexport function normalizeSkillScope(raw: string | undefined): SkillScope {\n  if (!raw) return DEFAULT_SKILL_SCOPE;\n  const value = raw.trim().toLowerCase();\n  if (value === \"runtime\" || value === \"dev\" || value === \"both\") {\n    return value;\n  }\n  if (value && !warnedBadScopes.has(value)) {\n    warnedBadScopes.add(value);\n    console.warn(\n      `[agents-bundle] Unknown skill scope \"${raw}\" — treating as \"${DEFAULT_SKILL_SCOPE}\". Valid values: runtime, dev, both.`,\n    );\n  }\n  return DEFAULT_SKILL_SCOPE;\n}\n\n/**\n * Parse the YAML frontmatter at the top of a skill file.\n * Only pulls out `name`, `description`, and `scope` — deliberately simple, no\n * YAML lib.\n * Handles:\n *   - Inline: `description: Some text`\n *   - Folded scalar: `description: >-\\n  multi\\n  line` → \"multi line\"\n *   - Literal scalar: `description: |\\n  multi\\n  line` → \"multi\\nline\"\n */\nexport function parseSkillFrontmatter(content: string): Partial<SkillMeta> {\n  const match = content.match(/^---\\r?\\n([\\s\\S]+?)\\r?\\n---/);\n  if (!match) return {};\n  const lines = match[1].split(/\\r?\\n/);\n  const result: Partial<SkillMeta> = {};\n\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    const keyMatch = line.match(/^([a-zA-Z_][a-zA-Z0-9_-]*):\\s*(.*)$/);\n    if (!keyMatch) continue;\n    const [, key, valueRaw] = keyMatch;\n    const trimmed = valueRaw.trim();\n\n    const isFolded = trimmed === \">\" || trimmed === \">-\";\n    const isLiteral = trimmed === \"|\" || trimmed === \"|-\";\n\n    let value: string;\n    if (isFolded || isLiteral) {\n      // Collect subsequent indented lines (at least one leading space).\n      const block: string[] = [];\n      let j = i + 1;\n      while (j < lines.length) {\n        const next = lines[j];\n        if (next.length === 0) {\n          block.push(\"\");\n          j++;\n          continue;\n        }\n        if (!/^\\s/.test(next)) break;\n        block.push(next.replace(/^\\s+/, \"\"));\n        j++;\n      }\n      // Trim trailing blank lines\n      while (block.length > 0 && block[block.length - 1] === \"\") block.pop();\n      value = isFolded\n        ? block.filter((l) => l !== \"\").join(\" \")\n        : block.join(\"\\n\");\n      i = j - 1;\n    } else {\n      value = trimmed;\n    }\n\n    if (key === \"name\" && value) result.name = value;\n    else if (key === \"description\" && value) result.description = value;\n    else if (key === \"scope\" && value)\n      result.scope = normalizeSkillScope(value);\n  }\n\n  return result;\n}\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nconst TEMPLATE_SKILLS_DIRS = [\n  path.join(\".agents\", \"skills\"),\n  path.join(\".agent\", \"skills\"),\n] as const;\n\n/**\n * Paths to a workspace-core's agent resources, for merging into a template's\n * bundle. All fields optional — pass null for any missing piece.\n */\nexport interface WorkspaceAgentsSource {\n  /** Absolute path to the workspace core's skills/ directory. */\n  skillsDir: string | null;\n  /** Absolute path to the workspace core's AGENTS.md. */\n  agentsMdPath: string | null;\n  /** Root dir (used to compute `dir` paths for workspace-core skills). */\n  rootDir: string;\n}\n\n/**\n * Read one skills directory into a `Record<string, Skill>`. Extracted so\n * both the template and workspace-core paths can reuse it. `dirPrefix` is\n * the display path that will be reported to the agent (e.g.\n * `.agents/skills/<name>` for templates, or\n * `<workspace-shared-package>/.agents/skills/<name>` for the workspace layer).\n */\nfunction readSkillsDir(\n  skillsDir: string,\n  rootForRelative: string,\n  out: Record<string, Skill>,\n  skipExistingNames: boolean,\n): void {\n  if (!fs.existsSync(skillsDir)) return;\n  const entries = fs.readdirSync(skillsDir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;\n    const skillDirAbs = path.join(skillsDir, entry.name);\n    const skillFile = path.join(skillDirAbs, \"SKILL.md\");\n    try {\n      const realSkillFile = fs.realpathSync(skillFile);\n      if (!fs.existsSync(realSkillFile)) continue;\n      const content = fs.readFileSync(realSkillFile, \"utf-8\");\n      const meta = parseSkillFrontmatter(content);\n      const name = meta.name ?? entry.name;\n      if (skipExistingNames && out[name]) continue; // Template wins\n\n      const extraFiles: string[] = [];\n      try {\n        const walk = (subdir: string, prefix: string) => {\n          for (const e of fs.readdirSync(subdir, { withFileTypes: true })) {\n            const abs = path.join(subdir, e.name);\n            const rel = prefix ? `${prefix}/${e.name}` : e.name;\n            if (e.isDirectory() || e.isSymbolicLink()) {\n              try {\n                const stat = fs.statSync(abs);\n                if (stat.isDirectory()) walk(abs, rel);\n              } catch {}\n            } else if (e.isFile() && e.name !== \"SKILL.md\") {\n              extraFiles.push(rel);\n            }\n          }\n        };\n        walk(skillDirAbs, \"\");\n      } catch {}\n      extraFiles.sort();\n\n      out[name] = {\n        meta: {\n          name,\n          description: meta.description ?? \"\",\n          scope: meta.scope ?? DEFAULT_SKILL_SCOPE,\n        },\n        content,\n        dir: path.relative(rootForRelative, skillDirAbs).replace(/\\\\/g, \"/\"),\n        extraFiles,\n      };\n    } catch {\n      // Skip unreadable skills\n    }\n  }\n}\n\n/**\n * Read AGENTS.md + all skills directly from the filesystem rooted at `cwd`.\n * Optionally also reads a workspace-core's AGENTS.md and skills directory\n * and merges them in (template wins on name collisions). Used by both the\n * Vite plugin (at build time) and the runtime fallback (in dev / Node prod).\n *\n * Synchronous — the Vite plugin's load hook calls it inline during the build.\n */\nexport function readAgentsBundleFromFs(\n  cwd: string,\n  workspaceSource: WorkspaceAgentsSource | null = null,\n): AgentsBundle {\n  let agentsMd = \"\";\n  try {\n    const agentsMdPath = path.join(cwd, \"AGENTS.md\");\n    if (fs.existsSync(agentsMdPath)) {\n      agentsMd = fs.readFileSync(agentsMdPath, \"utf-8\");\n    }\n  } catch {}\n\n  let workspaceAgentsMd = \"\";\n  if (workspaceSource?.agentsMdPath) {\n    try {\n      if (fs.existsSync(workspaceSource.agentsMdPath)) {\n        workspaceAgentsMd = fs.readFileSync(\n          workspaceSource.agentsMdPath,\n          \"utf-8\",\n        );\n      }\n    } catch {}\n  }\n\n  // Merge skills: template first (so its entries are authoritative), then\n  // workspace-core with skipExistingNames=true so same-named skills don't\n  // overwrite the template's. `.agents/skills` is canonical; `.agent/skills`\n  // is accepted as a legacy alias and does not override canonical skills.\n  const skills: Record<string, Skill> = {};\n  for (const [index, relSkillsDir] of TEMPLATE_SKILLS_DIRS.entries()) {\n    try {\n      readSkillsDir(path.join(cwd, relSkillsDir), cwd, skills, index > 0);\n    } catch {}\n  }\n\n  if (workspaceSource?.skillsDir) {\n    try {\n      readSkillsDir(\n        workspaceSource.skillsDir,\n        workspaceSource.rootDir,\n        skills,\n        true,\n      );\n    } catch {}\n  }\n\n  return { agentsMd, workspaceAgentsMd, skills };\n}\n\n/**\n * Load the agents bundle. Returns a cached result on subsequent calls.\n * Tries the virtual module first (works everywhere, including edge), then\n * falls back to filesystem reads from `process.cwd()` — which, when a\n * workspace core is present, also merges in the workspace core's skills\n * and AGENTS.md.\n */\nexport async function loadAgentsBundle(): Promise<AgentsBundle> {\n  if (cached) return cached;\n\n  // 1. Try the Vite-emitted virtual module. This is the path that works on\n  //    every deployment target because the content is inlined at build time.\n  //    The Vite plugin itself is responsible for merging workspace-core\n  //    content into the bundle it emits.\n  try {\n    // @ts-expect-error — virtual module is resolved at build time by our\n    // Vite plugin; nothing exists at this path on disk.\n    const mod = await import(\"virtual:agents-bundle\");\n    if (mod && mod.default) {\n      cached = mod.default as AgentsBundle;\n      return cached;\n    }\n  } catch {\n    // Virtual module not available — fall through to filesystem.\n  }\n\n  // 2. Filesystem fallback — works in dev / Node prod. If a workspace core\n  //    is present in the ancestor chain, merge its skills + AGENTS.md in.\n  try {\n    let workspaceSource: WorkspaceAgentsSource | null = null;\n    try {\n      const { getWorkspaceCoreExports } =\n        await import(\"../deploy/workspace-core.js\");\n      const ws = await getWorkspaceCoreExports(process.cwd());\n      if (ws) {\n        workspaceSource = {\n          skillsDir: ws.skillsDir,\n          agentsMdPath: ws.agentsMdPath,\n          rootDir: ws.packageDir,\n        };\n      }\n    } catch {\n      // workspace-core discovery isn't available (e.g. edge runtime).\n    }\n    cached = readAgentsBundleFromFs(process.cwd(), workspaceSource);\n    return cached;\n  } catch {\n    cached = EMPTY;\n    return cached;\n  }\n}\n\n/**\n * Generate the `<skills>` block to inject into the system prompt.\n *\n * Skills are folders at `.agents/skills/<name>/` (or legacy\n * `.agent/skills/<name>/`) containing a `SKILL.md` entry file plus any number\n * of supporting files (additional markdown, examples, images, scripts). This\n * block lists what's available and how to read them.\n *\n * In dev mode the agent has bash access and reads skills via `cat` — exactly\n * like running `claude` locally in the repo. In production mode the agent has\n * no bash; templates that need skill content at runtime should inline the\n * critical parts directly in `AGENTS.md`.\n */\n/**\n * Skills visible to the agent-native RUNTIME agent. Excludes `scope: dev`\n * skills (those are for the human's coding agent only). Skills with no scope,\n * `scope: runtime`, or `scope: both` are all included. Use this anywhere the\n * runtime agent's view of skills is built (prompt block + docs-search) so a\n * dev-scoped skill is invisible to the runtime agent everywhere.\n */\nexport function getRuntimeSkills(bundle: AgentsBundle): Skill[] {\n  return Object.values(bundle.skills).filter(\n    (skill) => skill.meta.scope !== \"dev\",\n  );\n}\n\nexport function generateSkillsPromptBlock(bundle: AgentsBundle): string {\n  const entries = getRuntimeSkills(bundle);\n  if (entries.length === 0) return \"\";\n\n  const lines = entries.map((s) => {\n    const extras =\n      s.extraFiles.length > 0\n        ? ` (also contains: ${s.extraFiles.join(\", \")})`\n        : \"\";\n    return `- \\`${s.meta.name}\\` at \\`${s.dir}/\\` — ${s.meta.description || \"(no description)\"}${extras}`;\n  });\n\n  return `<skills>\nThe following skills live in the repo, usually at \\`.agents/skills/<name>/\\` (legacy \\`.agent/skills/<name>/\\` is also supported). Each skill is a folder containing a \\`SKILL.md\\` entry file and sometimes supporting files. Read a skill BEFORE starting a task it applies to.\n\nTo read a skill in dev mode (when you have bash access):\n  \\`bash(command=\"cat <skill-dir>/SKILL.md\")\\`\n  \\`bash(command=\"ls <skill-dir>/\")\\` to see all files in the folder\n\nAvailable skills:\n${lines.join(\"\\n\")}\n</skills>`;\n}\n\n/** For tests — reset the module cache. */\nexport function __resetAgentsBundleCache(): void {\n  cached = null;\n}\n"]}

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAkDhE,KAAK,KAAK,GAAG,SAAS,CAAC;AAQvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAUlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAgC5D,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAc7C;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mNAAmN;IACnN,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAoCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAEpD;AAED,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,yBAAyB,QACQ,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAGvD;AAmCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAExE;AAgCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIjE;AAkGD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAUrE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQzD;AAqID,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7D;AAyDD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB3E;AAiHD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAmBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,QAWd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,2BAA2B,QAOnC;AAmGD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAyuBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAY5E;AAoID,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAS7E;AAimCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAqKlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAMzE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAkDhE,KAAK,KAAK,GAAG,SAAS,CAAC;AAQvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAUlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAgC5D,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAc7C;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mNAAmN;IACnN,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAoCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAEpD;AAED,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,yBAAyB,QACQ,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAGvD;AAmCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAExE;AAgCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIjE;AAkGD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAUrE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQzD;AAgND,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7D;AAyDD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB3E;AAiHD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAmBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,QAWd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,2BAA2B,QAOnC;AAmGD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAyuBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAY5E;AAsID,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAS7E;AAimCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAqKlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAMzE"}

package/dist/server/auth.js

@@ -446,6 +446,77 @@ async function getBearerLegacySession(event) {
     const email = await getSessionEmail(bearerToken);
     return email ? { email, token: bearerToken } : null;
 }
+/**
+ * Verify a connect-minted MCP OAuth access token presented as
+ * `Authorization: Bearer <jwt>` and resolve it to a session.
+ *
+ * `agent-native connect` mints this token for the local Plans publish flow and
+ * POSTs it to the HOSTED action route
+ * `/_agent-native/actions/import-visual-plan-source`. That token is audience-
+ * bound to the app's MCP resource (`{appUrl}/_agent-native/mcp`), not to the
+ * legacy `sessions` table — so the legacy bearer lookup above never matches it.
+ * Reuse the MCP surface's canonical `verifyAuth` here so the HTTP action surface
+ * honors EXACTLY the tokens the MCP endpoint honors: same signature check, same
+ * audience binding to THIS app's resource, same connect-token revocation gate.
+ * It resolves to the same `{ userEmail, orgId }` identity the MCP path uses, so
+ * downstream `accessFilter` / ownable-data scoping is identical.
+ *
+ * `allowDevOpen: false` and the `userEmail` guard ensure an invalid token (or a
+ * bare ACCESS_TOKEN with no owner hint) never escalates to an unauthenticated
+ * or unscoped identity on this path — it strictly adds acceptance of verified,
+ * audience-bound caller tokens, nothing more.
+ */
+async function getMcpOAuthBearerSession(event) {
+    const authHeader = getHeader(event, "authorization");
+    if (!authHeader)
+        return null;
+    const bearerToken = getBearerSessionToken(event);
+    if (!bearerToken)
+        return null;
+    try {
+        const [{ getMcpOAuthResource }, { verifyAuth, resolveOrgIdFromDomain }] = await Promise.all([
+            import("../mcp/oauth-route.js"),
+            import("../mcp/build-server.js"),
+        ]);
+        const result = await verifyAuth(authHeader, undefined, {
+            resourceUrl: getMcpOAuthResource(event),
+            allowDevOpen: false,
+        });
+        const identity = result.authed ? result.identity : undefined;
+        if (!identity?.userEmail)
+            return null;
+        const orgId = identity.orgId ?? (await resolveOrgIdFromDomain(identity.orgDomain));
+        return {
+            email: identity.userEmail,
+            token: bearerToken,
+            ...(orgId ? { orgId } : {}),
+        };
+    }
+    catch (e) {
+        console.error("[auth] MCP OAuth bearer verification error:", e);
+        return null;
+    }
+}
+function isFrameworkActionRoute(event) {
+    const { rawPath } = getRequestPathAndSearch(event);
+    const path = stripAppBasePath(rawPath);
+    return (path === "/_agent-native/actions" ||
+        path.startsWith("/_agent-native/actions/"));
+}
+/**
+ * Resolve an `Authorization: Bearer` token to a session: first the legacy
+ * `sessions` table (desktop/native persisted tokens), then, only on the
+ * framework HTTP action surface, a connect-minted MCP OAuth access token (the
+ * local Plans publish credential).
+ */
+async function getBearerSession(event) {
+    const legacy = await getBearerLegacySession(event);
+    if (legacy)
+        return legacy;
+    if (!isFrameworkActionRoute(event))
+        return null;
+    return getMcpOAuthBearerSession(event);
+}
 function shouldExposeSessionTokenInBody(event) {
     const origin = getHeader(event, "origin");
     if (origin && DESKTOP_AUTH_TOKEN_BODY_ORIGINS.has(origin))
@@ -1442,7 +1513,7 @@ async function resolveSessionUncached(event) {
         const session = await customGetSession(event);
         if (session)
             return session;
-        const bearerSession = await getBearerLegacySession(event);
+        const bearerSession = await getBearerSession(event);
         if (bearerSession)
             return bearerSession;
         // Desktop SSO broker: even with BYOA auth, fall back to the broker
@@ -1456,9 +1527,11 @@ async function resolveSessionUncached(event) {
         // Fall through to mobile _session check
     }
     else {
-        // 4. Bearer legacy session. Desktop/native clients can persist a session
+        // 4. Bearer session. Desktop/native clients can persist a legacy session
         // token outside the WebView cookie jar and attach it to all app requests.
-        const bearerSession = await getBearerLegacySession(event);
+        // `agent-native connect` clients may present a connect-minted MCP OAuth
+        // token, but only the framework action route accepts that fallback.
+        const bearerSession = await getBearerSession(event);
         if (bearerSession)
             return bearerSession;
         // 5. Better Auth session (cookie or Bearer token)