@agent-native/core 0.47.1 → 0.48.1

package/dist/scripts/call-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"call-agent.js","sourceRoot":"","sources":["../../src/scripts/call-agent.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,SAAS,EACT,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAElE,MAAM,6CAA6C,GAAG,MAAM,CAAC;AAC7D,MAAM,kCAAkC,GAAG,KAAK,CAAC;AACjD,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB;IACvB,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,OAAO,CACL,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO;QACrB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACtC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM;QACpB,UAAU,IAAI,UAAU,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,0BAA0B,EAAE;QAAE,OAAO,SAAS,CAAC;IAE3E,MAAM,UAAU,GAAG,cAAc,CAC/B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CACpD,CAAC;IACF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAEhD,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,kCAAkC,CAAC;IAEnE,OAAO,6CAA6C,CAAC;AACvD,CAAC;AAED,SAAS,oCAAoC,CAC3C,SAAiB,EACjB,KAAc;IAEd,OAAO,oBAAoB,CAAC,KAAK,CAAC;QAChC,CAAC,CAAC,+BAA+B,CAAC,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAe;IAC9B,WAAW,EACT,+WAA+W;QAC/W,wSAAwS;QACxS,qCAAqC;QACrC,qMAAqM;QACrM,+QAA+Q;QAC/Q,qPAAqP;IACvP,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,+HAA+H;aAClI;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,iDAAiD;aAC/D;SACF;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;KAC/B;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAA4B,EAC5B,OAA0B,EAC1B,SAAkB;IAElB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE/C,IAAI,CAAC,aAAa;QAAE,OAAO,4BAA4B,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,8BAA8B,CAAC;IAEpD,2EAA2E;IAC3E,IAAI,SAAS,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,OAAO,sDAAsD,SAAS,6HAA6H,CAAC;IACtM,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,iBAAiB,aAAa,kCAAkC,SAAS,IAAI,QAAQ,EAAE,CAAC;IACjG,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,eAAe,GACnB,GAAG,OAAO,MAAM;QAChB,mKAAmK;QACnK,sGAAsG,KAAK,CAAC,GAAG,kDAAkD;QACjK,0GAA0G,CAAC;IAE7G,IAAI,CAAC;QACH,4EAA4E;QAC5E,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;YAE1C,+BAA+B;YAC/B,MAAM,WAAW,GAA4B,EAAE,CAAC;YAChD,IAAI,WAAW;gBAAE,WAAW,CAAC,SAAS,GAAG,WAAW,CAAC;YAErD,kDAAkD;YAClD,IAAI,eAAmC,CAAC;YACxC,IAAI,eAAmC,CAAC;YACxC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;oBACzC,IAAI,MAAM,EAAE,CAAC;wBACX,eAAe,GAAG,MAAM,CAAC;wBACzB,WAAW,CAAC,SAAS,GAAG,MAAM,CAAC;oBACjC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;oBAC5C,IAAI,MAAM;wBAAE,eAAe,GAAG,MAAM,CAAC;gBACvC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,+DAA+D;YAC/D,IAAI,MAA0B,CAAC;YAC/B,IAAI,WAAW,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,YAAY,CACzB,WAAW,EACX,eAAe,EACf,eAAe,EACf;wBACE,SAAS,EAAE,yBAAyB;wBACpC,kBAAkB,EAAE,CAAC,eAAe;qBACrC,CACF,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAEhD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,EAAE,CAAC;gBACzD,IAAI,CAAC;oBACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;oBAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,QAAQ,EACR,WAAW,CACZ,CAAC;oBACF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;oBACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;wBACzB,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;oBAChD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,IAAI,YAAY,GAAG,EAAE,CAAC;YACtB,IAAI,cAAc,GAAG,CAAC,CAAC;YACvB,MAAM,wBAAwB,GAC5B,MAAM,4CAA4C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrE,IAAI,wBAAwB;gBAAE,OAAO,wBAAwB,CAAC;YAE9D,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE;gBACtC,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;oBACpC,OAAO,CAAC,IAAK,CAAC;wBACZ,IAAI,EAAE,iBAAiB;wBACvB,KAAK,EAAE,KAAK,CAAC,IAAI;wBACjB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;qBACpC,CAAC,CAAC;oBACH,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;gBAClC,CAAC;gBACD,YAAY,GAAG,OAAO,CAAC;YACzB,CAAC,CAAC;YAEF,kEAAkE;YAClE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,iEAAiE;YACjE,sEAAsE;YACtE,wEAAwE;YACxE,+BAA+B;YAC/B,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,mEAAmE;gBACnE,qEAAqE;gBACrE,qEAAqE;gBACrE,MAAM,aAAa,GAAG,2BAA2B,EAAE,CAAC;gBACpD,YAAY,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE;oBACzD,MAAM;oBACN,SAAS,EAAE,WAAW;oBACtB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,eAAe;oBAC1B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;gBACH,YAAY;oBACV,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC;wBAC9D,YAAY,CAAC;gBACf,2DAA2D;gBAC3D,iEAAiE;gBACjE,uEAAuE;gBACvE,uEAAuE;gBACvE,YAAY,GAAG,kBAAkB,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3D,iEAAiE;gBACjE,IAAI,YAAY;oBAAE,WAAW,CAAC,YAAY,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,OAAY,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACvD,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAG,MAAM,wCAAwC,CAC3D,aAAa,EACb,KAAK,EACL,OAAO,EACP,WAAW,CACZ,CAAC;oBACF,IAAI,MAAM,EAAE,CAAC;wBACX,YAAY;4BACV,GAAG,8BAA8B,IAAI;gCACrC,OAAO,KAAK,CAAC,IAAI,iIAAiI;gCAClJ,eAAe,KAAK,CAAC,IAAI,6IAA6I,KAAK,CAAC,IAAI,oCAAoC,CAAC;oBACzN,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;wBACnD,YAAY,GAAG,OAAO,KAAK,CAAC,IAAI,oEAAoE,MAAM,GAAG,CAAC;oBAChH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;oBACnD,YAAY;wBACV,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;4BACzD,OAAO,KAAK,CAAC,IAAI,oEAAoE,MAAM,GAAG,CAAC;gBACnG,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,OAAO,YAAY,IAAI,kBAAkB,CAAC;QAC5C,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,IAAI,MAA0B,CAAC;QAC/B,IAAI,SAA6B,CAAC;QAClC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;QACvC,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE;YAC3D,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,MAAM;YACjB,SAAS;SACV,CAAC,CAAC;QACH,MAAM,SAAS,GACb,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC;QACzE,OAAO,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC;IACxE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,iBAAiB,GAAG,oCAAoC,CAC5D,KAAK,CAAC,IAAI,EACV,GAAG,CACJ,CAAC;QACF,IAAI,iBAAiB;YAAE,OAAO,iBAAiB,CAAC;QAChD,0EAA0E;QAC1E,sCAAsC;QACtC,IAAI,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,KAAK,CAAC,IAAI,gGAAgG,KAAK,CAAC,IAAI,gBAAgB,CAAC;QACrJ,CAAC;QACD,OAAO,iBAAiB,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wCAAwC,CACrD,MAAc,EACd,KAAoC,EACpC,OAAe,EACf,UAA8B;IAE9B,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,qBAAqB,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC,GAC5D,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,MAAM,CAAC,4CAA4C,CAAC;YACpD,MAAM,CAAC,+CAA+C,CAAC;SACxD,CAAC,CAAC;QACL,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC;YAC/C,iBAAiB,EAAE,WAAW,CAAC,MAAM;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ;YACvC,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB;YACvD,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,UAAU;YACV,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;YAChC,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,SAAS,EAAE,mCAAmC,CAAC,OAAO,CAAC;YACvD,SAAS,EAAE,MAAM;YACjB,oEAAoE;YACpE,+DAA+D;YAC/D,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,MAAM,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3D,OAAO,CAAC,KAAK,CACX,oDAAoD,YAAY,CAAC,EAAE,GAAG,EACtE,GAAG,CACJ,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAE1D,MAAM,SAAS,GAAG,GAGL,CAAC;IACd,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACjD,IACE,SAAS,EAAE,IAAI,KAAK,qBAAqB;QACzC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACrE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,4CAA4C,CACzD,KAGC,EACD,OAAe;IAEf,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,EAAE,0CAA0C,EAAE,GAClD,MAAM,MAAM,CAAC,4CAA4C,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,0CAA0C,CACpE,WAAW,CAAC,MAAM,EAClB,KAAK,CAAC,GAAG,EACT,mCAAmC,CAAC,OAAO,CAAC,CAC7C,CAAC;QACF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACjD,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAC3D,YAAY,CAAC,MAAM,CACpB,CACF,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,KAAK,WAAW;YAC3B,CAAC,CAAC,sGAAsG;YACxG,CAAC,CAAC,2GAA2G,CAAC;QAClH,OAAO,CACL,GAAG,8BAA8B,IAAI;YACrC,OAAO,KAAK,CAAC,IAAI,UAAU,KAAK,iBAAiB,KAAK,CAAC,IAAI,6IAA6I,KAAK,CAAC,IAAI,kDAAkD,CACrQ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAAC,OAAe;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,4CAA4C;AAC5C,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IAC/D,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzC,4EAA4E;IAC5E,8EAA8E;IAC9E,OAAO,IAAI,CAAC,OAAO,CACjB,qDAAqD,EACrD,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAChD,CAAC;AACJ,CAAC","sourcesContent":["import type { ActionTool } from \"../agent/types.js\";\nimport type { ActionRunContext } from \"../agent/production-agent.js\";\nimport { createHash } from \"node:crypto\";\nimport { findAgent, discoverAgents } from \"../server/agent-discovery.js\";\nimport {\n  A2AClient,\n  A2ATaskTimeoutError,\n  callAgent,\n  signA2AToken,\n} from \"../a2a/client.js\";\nimport { A2A_CONTINUATION_QUEUED_MARKER } from \"../integrations/a2a-continuation-marker.js\";\nimport {\n  formatLlmCredentialErrorMessage,\n  isLlmCredentialError,\n} from \"../agent/engine/credential-errors.js\";\nimport {\n  getRequestUserEmail,\n  getRequestOrgId,\n  isIntegrationCallerRequest,\n  getIntegrationRequestContext,\n} from \"../server/request-context.js\";\nimport { getOrgDomain, getOrgA2ASecret } from \"../org/context.js\";\n\nconst DEFAULT_SERVERLESS_INTEGRATION_A2A_TIMEOUT_MS = 18_000;\nconst NETLIFY_INTEGRATION_A2A_TIMEOUT_MS = 2_000;\nconst INTEGRATION_A2A_TOKEN_TTL = \"30m\";\n\nfunction parseTimeoutMs(value: string | undefined): number | undefined {\n  if (!value) return undefined;\n  const parsed = Number(value);\n  if (!Number.isFinite(parsed) || parsed <= 0) return undefined;\n  return Math.floor(parsed);\n}\n\nfunction isServerlessHost(): boolean {\n  // Detection mirrors db/migrations.ts:297-301. On Cloudflare Workers/Pages,\n  // `process.env` is shimmed and CF_PAGES isn't reliably populated at runtime —\n  // the canonical signal is the `__cf_env` global injected by workerd.\n  return (\n    !!process.env.NETLIFY ||\n    !!process.env.AWS_LAMBDA_FUNCTION_NAME ||\n    !!process.env.VERCEL ||\n    \"__cf_env\" in globalThis\n  );\n}\n\nfunction getIntegrationCallTimeoutMs(): number | undefined {\n  if (!isServerlessHost() || !isIntegrationCallerRequest()) return undefined;\n\n  const configured = parseTimeoutMs(\n    process.env.AGENT_NATIVE_INTEGRATION_A2A_TIMEOUT_MS,\n  );\n  if (configured !== undefined) return configured;\n\n  // Netlify's current synchronous function budget is 60s. Keep delegated\n  // calls very short so multi-agent integration requests queue downstream\n  // continuations quickly instead of spending the parent Slack/email processor\n  // budget waiting on separately deployed apps one-by-one.\n  if (process.env.NETLIFY) return NETLIFY_INTEGRATION_A2A_TIMEOUT_MS;\n\n  return DEFAULT_SERVERLESS_INTEGRATION_A2A_TIMEOUT_MS;\n}\n\nfunction formatDownstreamLlmCredentialFailure(\n  agentName: string,\n  value: unknown,\n): string | null {\n  return isLlmCredentialError(value)\n    ? formatLlmCredentialErrorMessage({ agentName })\n    : null;\n}\n\nexport const tool: ActionTool = {\n  description:\n    \"Call a DIFFERENT, separately-deployed agent app to ask a question or delegate a task. This is strictly for cross-app A2A communication — for example, asking the mail agent to send an email while you are the calendar agent. NEVER use this to call your own app or perform actions you can do with your own tools. Using call-agent on yourself will fail and waste time. \" +\n    'For brand-consistent generated media, the first-party Assets agent is available as agent=\"assets\"; use it when another app needs generated heroes, diagrams, product shots, thumbnails, videos, or design imagery, unless the current app has its own generation action that already delegates there. ' +\n    \"IMPORTANT — handling the response: \" +\n    \"(a) If it contains a URL or ID, copy it VERBATIM into your reply. Do not 'correct' or pluralize the path (e.g. /deck/ → /decks/), normalize casing, or change the slug — any edit breaks the link. \" +\n    '(b) If it does NOT contain a URL/ID and the user asked for one, say so explicitly (e.g. \"the agent created the deck/image but didn\\'t return a link — open the app directly to view it\"). NEVER invent a URL, slug, or path — guessing produces broken links that look real. ' +\n    \"(c) If the downstream response reports missing credentials, never repeat raw env var names, Vault key names, token names, secret names, or other credential identifiers. Tell the user the target app needs its LLM/provider connection configured.\",\n  parameters: {\n    type: \"object\",\n    properties: {\n      agent: {\n        type: \"string\",\n        description:\n          \"Name or URL of a DIFFERENT deployed agent app (e.g. 'mail', 'calendar', 'analytics'). Must not be the current app's own name.\",\n      },\n      message: {\n        type: \"string\",\n        description: \"The message/question to send to the other agent\",\n      },\n    },\n    required: [\"agent\", \"message\"],\n  },\n};\n\nexport async function run(\n  args: Record<string, string>,\n  context?: ActionRunContext,\n  selfAppId?: string,\n): Promise<string> {\n  const { agent: agentIdOrName, message } = args;\n\n  if (!agentIdOrName) return \"Error: --agent is required\";\n  if (!message) return \"Error: --message is required\";\n\n  // Prevent self-calls — the agent must use its own registered tools instead\n  if (selfAppId && agentIdOrName.toLowerCase() === selfAppId.toLowerCase()) {\n    return `Error: You cannot use call-agent to call yourself (${selfAppId}). Use your own registered actions/tools instead. call-agent is only for communicating with OTHER separately-deployed apps.`;\n  }\n\n  const agent = await findAgent(agentIdOrName, selfAppId);\n  if (!agent) {\n    const available = (await discoverAgents(selfAppId))\n      .map((a) => a.name)\n      .join(\", \");\n    return `Error: Agent \"${agentIdOrName}\" not found. Available agents: ${available || \"(none)\"}`;\n  }\n\n  // Append a small cross-app hint to the outgoing message so the receiving\n  // agent (which may be on an older deploy without the receiver-side hint\n  // in handlers.ts) still emits fully-qualified URLs. This is belt-and-\n  // suspenders with the receiver hint — but it works against any current\n  // deployment, no redeploy required.\n  const messageWithHint =\n    `${message}\\n\\n` +\n    `[Note: this request comes from another app via A2A. The caller cannot see your local UI, deck list, or navigation — only the literal text you put in your reply. ` +\n    `If you create or reference a deck/document/design/dashboard, include its FULLY-QUALIFIED URL (e.g. ${agent.url}/deck/<id>) in your reply, not a relative path. ` +\n    `Use only artifact IDs and URL paths returned by successful actions — never invent slugs, IDs, or hosts.]`;\n\n  try {\n    // If we have a send context, use streaming so the UI shows progressive text\n    if (context?.send) {\n      const callerEmail = getRequestUserEmail();\n\n      // Build metadata with identity\n      const a2aMetadata: Record<string, unknown> = {};\n      if (callerEmail) a2aMetadata.userEmail = callerEmail;\n\n      // Include org domain for cross-app org resolution\n      let callerOrgDomain: string | undefined;\n      let callerOrgSecret: string | undefined;\n      const orgId = getRequestOrgId();\n      if (orgId) {\n        try {\n          const domain = await getOrgDomain(orgId);\n          if (domain) {\n            callerOrgDomain = domain;\n            a2aMetadata.orgDomain = domain;\n          }\n        } catch {}\n        try {\n          const secret = await getOrgA2ASecret(orgId);\n          if (secret) callerOrgSecret = secret;\n        } catch {}\n      }\n\n      // Sign JWT with identity + org domain for the streaming client\n      let apiKey: string | undefined;\n      if (callerEmail && (callerOrgSecret || process.env.A2A_SECRET)) {\n        try {\n          apiKey = await signA2AToken(\n            callerEmail,\n            callerOrgDomain,\n            callerOrgSecret,\n            {\n              expiresIn: INTEGRATION_A2A_TOKEN_TTL,\n              preferGlobalSecret: !callerOrgSecret,\n            },\n          );\n        } catch {}\n      }\n\n      const client = new A2AClient(agent.url, apiKey);\n\n      if (process.env.NODE_ENV === \"production\" && callerEmail) {\n        try {\n          const { listOAuthAccountsByOwner } =\n            await import(\"../oauth-tokens/store.js\");\n          const accounts = await listOAuthAccountsByOwner(\n            \"google\",\n            callerEmail,\n          );\n          const tokens = accounts[0]?.tokens;\n          if (tokens?.access_token) {\n            a2aMetadata.googleToken = tokens.access_token;\n          }\n        } catch {}\n      }\n\n      let responseText = \"\";\n      let lastSentLength = 0;\n      const existingContinuationText =\n        await formatExistingIntegrationContinuationIfRetry(agent, message);\n      if (existingContinuationText) return existingContinuationText;\n\n      context.send({\n        type: \"agent_call\",\n        agent: agent.name,\n        status: \"start\",\n      });\n\n      const emitNewText = (newText: string) => {\n        if (newText.length > lastSentLength) {\n          context.send!({\n            type: \"agent_call_text\",\n            agent: agent.name,\n            text: newText.slice(lastSentLength),\n          });\n          lastSentLength = newText.length;\n        }\n        responseText = newText;\n      };\n\n      // Skip the SSE streaming attempt and go straight to async + poll.\n      // Why: on Netlify (Lambda), the receiving server has no streaming\n      // response support, so message/stream returns a single JSON-RPC error\n      // body in a 200 response that our SSE parser silently consumes — the\n      // `for await` loop yields nothing AND keeps the connection open until\n      // the function timeout, eating the current serverless budget. By the\n      // time we get to the sync fallback, Lambda is dead and the second fetch\n      // errors out as \"fetch failed\". Async+poll has its own short fetches\n      // with their own budgets, so it works reliably across hosts. The\n      // trade-off is we lose progressive in-UI text streaming for cross-app\n      // A2A calls, but the receiving agent's full response still surfaces via\n      // the tool_result event below.\n      try {\n        // Apply a polling cap ONLY for integration-platform callers on\n        // serverless hosts. Normal chat, local Node, self-hosted Node, and\n        // Docker can wait for slow-but-valid answers; integration processors\n        // still need to finish before their current function execution dies.\n        const callTimeoutMs = getIntegrationCallTimeoutMs();\n        responseText = await callAgent(agent.url, messageWithHint, {\n          apiKey,\n          userEmail: callerEmail,\n          orgDomain: callerOrgDomain,\n          orgSecret: callerOrgSecret,\n          ...(callTimeoutMs ? { timeoutMs: callTimeoutMs } : {}),\n        });\n        responseText =\n          formatDownstreamLlmCredentialFailure(agent.name, responseText) ??\n          responseText;\n        // Some agents reply with relative paths (e.g. slides emits\n        // \"/deck/abc\"). Those resolve against the caller's host, not the\n        // receiver's, so they're broken for the user. Expand any leading-slash\n        // URL into a fully-qualified one rooted at the receiving agent's host.\n        responseText = expandRelativeUrls(responseText, agent.url);\n        // Mirror the response into the streaming UI so the user sees it.\n        if (responseText) emitNewText(responseText);\n      } catch (pollErr: any) {\n        const timeoutTaskId = getA2ATaskTimeoutTaskId(pollErr);\n        if (timeoutTaskId) {\n          const queued = await enqueueIntegrationContinuationIfPossible(\n            timeoutTaskId,\n            agent,\n            message,\n            callerEmail,\n          );\n          if (queued) {\n            responseText =\n              `${A2A_CONTINUATION_QUEUED_MARKER}\\n` +\n              `The ${agent.name} agent accepted this delegated subtask and will post its own final result to the originating integration thread automatically. ` +\n              `Do not call ${agent.name} again for this same subtask. Continue any other requested work, then answer with the completed results you have; if needed, mention that ${agent.name} is posting its result separately.`;\n          } else {\n            const reason = pollErr?.message ?? \"unknown error\";\n            responseText = `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;\n          }\n        } else {\n          const reason = pollErr?.message ?? \"unknown error\";\n          responseText =\n            formatDownstreamLlmCredentialFailure(agent.name, pollErr) ??\n            `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;\n        }\n      }\n\n      context.send({\n        type: \"agent_call\",\n        agent: agent.name,\n        status: \"done\",\n      });\n\n      return responseText || \"(empty response)\";\n    }\n\n    // No context — use the async + poll call so we don't get cut off at the\n    // serverless gateway's ~30s timeout. callAgent defaults to async:true.\n    const email = getRequestUserEmail();\n    let domain: string | undefined;\n    let orgSecret: string | undefined;\n    const currentOrgId = getRequestOrgId();\n    if (currentOrgId) {\n      try {\n        domain = (await getOrgDomain(currentOrgId)) ?? undefined;\n      } catch {}\n      try {\n        orgSecret = (await getOrgA2ASecret(currentOrgId)) ?? undefined;\n      } catch {}\n    }\n    const response = await callAgent(agent.url, messageWithHint, {\n      userEmail: email,\n      orgDomain: domain,\n      orgSecret,\n    });\n    const sanitized =\n      formatDownstreamLlmCredentialFailure(agent.name, response) ?? response;\n    return expandRelativeUrls(sanitized, agent.url) || \"(empty response)\";\n  } catch (err: any) {\n    const msg = err?.message ?? String(err);\n    const credentialMessage = formatDownstreamLlmCredentialFailure(\n      agent.name,\n      err,\n    );\n    if (credentialMessage) return credentialMessage;\n    // Friendlier message for the common timeout case so the calling agent can\n    // decide whether to give up or retry.\n    if (/timeout|did not complete|Inactivity|504/i.test(msg)) {\n      return `The ${agent.name} agent is taking longer than expected. Please try again, ask a simpler question, or open the ${agent.name} app directly.`;\n    }\n    return `Error calling ${agent.name}: ${msg}`;\n  }\n}\n\nasync function enqueueIntegrationContinuationIfPossible(\n  taskId: string,\n  agent: { name: string; url: string },\n  message: string,\n  ownerEmail: string | undefined,\n): Promise<boolean> {\n  const integration = getIntegrationRequestContext();\n  if (!integration || !ownerEmail) return false;\n\n  try {\n    const [{ insertA2AContinuation }, { dispatchA2AContinuation }] =\n      await Promise.all([\n        import(\"../integrations/a2a-continuations-store.js\"),\n        import(\"../integrations/a2a-continuation-processor.js\"),\n      ]);\n    const continuation = await insertA2AContinuation({\n      integrationTaskId: integration.taskId,\n      platform: integration.incoming.platform,\n      externalThreadId: integration.incoming.externalThreadId,\n      incoming: integration.incoming,\n      placeholderRef: integration.placeholderRef,\n      ownerEmail,\n      orgId: getRequestOrgId() ?? null,\n      agentName: agent.name,\n      agentUrl: agent.url,\n      dedupeKey: getIntegrationContinuationDedupeKey(message),\n      a2aTaskId: taskId,\n      // Do not persist the short-lived JWT used for the initial send. The\n      // continuation processor can mint a fresh token for each poll.\n      a2aAuthToken: null,\n    });\n    await dispatchA2AContinuation(continuation.id).catch((err) => {\n      console.error(\n        `[call-agent] Failed to dispatch A2A continuation ${continuation.id}:`,\n        err,\n      );\n    });\n    return true;\n  } catch (err) {\n    console.error(\"[call-agent] Failed to enqueue A2A continuation:\", err);\n    return false;\n  }\n}\n\nfunction getA2ATaskTimeoutTaskId(err: unknown): string | null {\n  if (err instanceof A2ATaskTimeoutError) return err.taskId;\n\n  const candidate = err as\n    | { name?: unknown; taskId?: unknown; message?: unknown }\n    | null\n    | undefined;\n  const message = String(candidate?.message ?? \"\");\n  if (\n    candidate?.name === \"A2ATaskTimeoutError\" &&\n    typeof candidate.taskId === \"string\"\n  ) {\n    return candidate.taskId;\n  }\n\n  const match = message.match(/^A2A task ([^\\s]+) did not complete\\b/);\n  return match?.[1] ?? null;\n}\n\nasync function formatExistingIntegrationContinuationIfRetry(\n  agent: {\n    name: string;\n    url: string;\n  },\n  message: string,\n): Promise<string | null> {\n  const integration = getIntegrationRequestContext();\n  if (!integration || (integration.attempts ?? 1) <= 1) return null;\n\n  try {\n    const { getA2AContinuationsForIntegrationTaskAgent } =\n      await import(\"../integrations/a2a-continuations-store.js\");\n    const continuations = await getA2AContinuationsForIntegrationTaskAgent(\n      integration.taskId,\n      agent.url,\n      getIntegrationContinuationDedupeKey(message),\n    );\n    const active = continuations.find((continuation) =>\n      [\"pending\", \"processing\", \"delivering\", \"completed\"].includes(\n        continuation.status,\n      ),\n    );\n    if (!active) return null;\n\n    const state =\n      active.status === \"completed\"\n        ? \"already completed this delegated subtask and posted its result to the originating integration thread\"\n        : \"already accepted this delegated subtask and is still working on it for the originating integration thread\";\n    return (\n      `${A2A_CONTINUATION_QUEUED_MARKER}\\n` +\n      `The ${agent.name} agent ${state}. Do not call ${agent.name} again for this same subtask. Continue any other requested work, then answer with the completed results you have; if needed, mention that ${agent.name} is posting or has posted its result separately.`\n    );\n  } catch (err) {\n    console.error(\"[call-agent] Failed to inspect existing continuation:\", err);\n    return null;\n  }\n}\n\nfunction getIntegrationContinuationDedupeKey(message: string): string {\n  const normalized = message.trim().replace(/\\s+/g, \" \");\n  return createHash(\"sha256\").update(normalized).digest(\"hex\");\n}\n\n// Expand bare leading-slash paths (e.g. \"/deck/abc\") into fully-qualified URLs\n// rooted at the receiving agent's host. The receiver doesn't always know it's\n// being called cross-app, so it may emit relative paths that resolve against\n// the caller's host (broken). Match a path that starts at a word boundary,\n// begins with `/`, and has at least one path segment after that. Skip if it\n// already looks like a fully-qualified URL.\nexport function expandRelativeUrls(text: string, agentUrl: string): string {\n  if (!text || !agentUrl) return text;\n  const base = agentUrl.replace(/\\/$/, \"\");\n  // Path must start at boundary (start, whitespace, or punctuation that isn't\n  // ':' — to avoid mangling `https://example.com/foo` or markdown link bodies).\n  return text.replace(\n    /(^|[\\s(\\[<\"'`])(\\/[a-z0-9_-][a-z0-9_/?&=%#.,:-]*)/gi,\n    (_match, lead, path) => `${lead}${base}${path}`,\n  );\n}\n"]}
+{"version":3,"file":"call-agent.js","sourceRoot":"","sources":["../../src/scripts/call-agent.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAElE,MAAM,6CAA6C,GAAG,MAAM,CAAC;AAC7D,MAAM,kCAAkC,GAAG,KAAK,CAAC;AACjD,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB;IACvB,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,OAAO,CACL,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO;QACrB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACtC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM;QACpB,UAAU,IAAI,UAAU,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,0BAA0B,EAAE;QAAE,OAAO,SAAS,CAAC;IAE3E,MAAM,UAAU,GAAG,cAAc,CAC/B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CACpD,CAAC;IACF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAEhD,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,kCAAkC,CAAC;IAEnE,OAAO,6CAA6C,CAAC;AACvD,CAAC;AAED,SAAS,oCAAoC,CAC3C,SAAiB,EACjB,KAAc;IAEd,OAAO,oBAAoB,CAAC,KAAK,CAAC;QAChC,CAAC,CAAC,+BAA+B,CAAC,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAe;IAC9B,WAAW,EACT,+WAA+W;QAC/W,wSAAwS;QACxS,qCAAqC;QACrC,qMAAqM;QACrM,+QAA+Q;QAC/Q,qPAAqP;IACvP,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,+HAA+H;aAClI;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,iDAAiD;aAC/D;SACF;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;KAC/B;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAA4B,EAC5B,OAA0B,EAC1B,SAAkB;IAElB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE/C,IAAI,CAAC,aAAa;QAAE,OAAO,4BAA4B,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,8BAA8B,CAAC;IAEpD,2EAA2E;IAC3E,IAAI,SAAS,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,OAAO,sDAAsD,SAAS,6HAA6H,CAAC;IACtM,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,iBAAiB,aAAa,kCAAkC,SAAS,IAAI,QAAQ,EAAE,CAAC;IACjG,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,eAAe,GACnB,GAAG,OAAO,MAAM;QAChB,mKAAmK;QACnK,sGAAsG,KAAK,CAAC,GAAG,kDAAkD;QACjK,0GAA0G,CAAC;IAE7G,IAAI,CAAC;QACH,4EAA4E;QAC5E,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;YAE1C,+BAA+B;YAC/B,MAAM,WAAW,GAA4B,EAAE,CAAC;YAChD,IAAI,WAAW;gBAAE,WAAW,CAAC,SAAS,GAAG,WAAW,CAAC;YAErD,kDAAkD;YAClD,IAAI,eAAmC,CAAC;YACxC,IAAI,eAAmC,CAAC;YACxC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;oBACzC,IAAI,MAAM,EAAE,CAAC;wBACX,eAAe,GAAG,MAAM,CAAC;wBACzB,WAAW,CAAC,SAAS,GAAG,MAAM,CAAC;oBACjC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;oBAC5C,IAAI,MAAM;wBAAE,eAAe,GAAG,MAAM,CAAC;gBACvC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,+DAA+D;YAC/D,IAAI,MAA0B,CAAC;YAC/B,IAAI,WAAW,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,YAAY,CACzB,WAAW,EACX,eAAe,EACf,eAAe,EACf;wBACE,SAAS,EAAE,yBAAyB;wBACpC,kBAAkB,EAAE,CAAC,eAAe;qBACrC,CACF,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,EAAE,CAAC;gBACzD,IAAI,CAAC;oBACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;oBAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,QAAQ,EACR,WAAW,CACZ,CAAC;oBACF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;oBACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;wBACzB,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;oBAChD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,IAAI,YAAY,GAAG,EAAE,CAAC;YACtB,IAAI,cAAc,GAAG,CAAC,CAAC;YACvB,MAAM,wBAAwB,GAC5B,MAAM,4CAA4C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrE,IAAI,wBAAwB;gBAAE,OAAO,wBAAwB,CAAC;YAE9D,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE;gBACtC,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;oBACpC,OAAO,CAAC,IAAK,CAAC;wBACZ,IAAI,EAAE,iBAAiB;wBACvB,KAAK,EAAE,KAAK,CAAC,IAAI;wBACjB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;qBACpC,CAAC,CAAC;oBACH,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;gBAClC,CAAC;gBACD,YAAY,GAAG,OAAO,CAAC;YACzB,CAAC,CAAC;YAEF,kEAAkE;YAClE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,iEAAiE;YACjE,sEAAsE;YACtE,wEAAwE;YACxE,+BAA+B;YAC/B,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,mEAAmE;gBACnE,qEAAqE;gBACrE,qEAAqE;gBACrE,MAAM,aAAa,GAAG,2BAA2B,EAAE,CAAC;gBACpD,YAAY,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE;oBACzD,MAAM;oBACN,SAAS,EAAE,WAAW;oBACtB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,eAAe;oBAC1B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;gBACH,YAAY;oBACV,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC;wBAC9D,YAAY,CAAC;gBACf,2DAA2D;gBAC3D,iEAAiE;gBACjE,uEAAuE;gBACvE,uEAAuE;gBACvE,YAAY,GAAG,kBAAkB,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3D,iEAAiE;gBACjE,IAAI,YAAY;oBAAE,WAAW,CAAC,YAAY,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,OAAY,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACvD,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAG,MAAM,wCAAwC,CAC3D,aAAa,EACb,KAAK,EACL,OAAO,EACP,WAAW,CACZ,CAAC;oBACF,IAAI,MAAM,EAAE,CAAC;wBACX,YAAY;4BACV,GAAG,8BAA8B,IAAI;gCACrC,OAAO,KAAK,CAAC,IAAI,iIAAiI;gCAClJ,eAAe,KAAK,CAAC,IAAI,6IAA6I,KAAK,CAAC,IAAI,oCAAoC,CAAC;oBACzN,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;wBACnD,YAAY,GAAG,OAAO,KAAK,CAAC,IAAI,oEAAoE,MAAM,GAAG,CAAC;oBAChH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;oBACnD,YAAY;wBACV,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;4BACzD,OAAO,KAAK,CAAC,IAAI,oEAAoE,MAAM,GAAG,CAAC;gBACnG,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,OAAO,YAAY,IAAI,kBAAkB,CAAC;QAC5C,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,IAAI,MAA0B,CAAC;QAC/B,IAAI,SAA6B,CAAC;QAClC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;QACvC,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE;YAC3D,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,MAAM;YACjB,SAAS;SACV,CAAC,CAAC;QACH,MAAM,SAAS,GACb,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC;QACzE,OAAO,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC;IACxE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,iBAAiB,GAAG,oCAAoC,CAC5D,KAAK,CAAC,IAAI,EACV,GAAG,CACJ,CAAC;QACF,IAAI,iBAAiB;YAAE,OAAO,iBAAiB,CAAC;QAChD,0EAA0E;QAC1E,sCAAsC;QACtC,IAAI,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,KAAK,CAAC,IAAI,gGAAgG,KAAK,CAAC,IAAI,gBAAgB,CAAC;QACrJ,CAAC;QACD,OAAO,iBAAiB,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wCAAwC,CACrD,MAAc,EACd,KAAoC,EACpC,OAAe,EACf,UAA8B;IAE9B,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,qBAAqB,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC,GAC5D,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,MAAM,CAAC,4CAA4C,CAAC;YACpD,MAAM,CAAC,+CAA+C,CAAC;SACxD,CAAC,CAAC;QACL,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC;YAC/C,iBAAiB,EAAE,WAAW,CAAC,MAAM;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ;YACvC,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB;YACvD,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,UAAU;YACV,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;YAChC,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,SAAS,EAAE,mCAAmC,CAAC,OAAO,CAAC;YACvD,SAAS,EAAE,MAAM;YACjB,oEAAoE;YACpE,+DAA+D;YAC/D,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,MAAM,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3D,OAAO,CAAC,KAAK,CACX,oDAAoD,YAAY,CAAC,EAAE,GAAG,EACtE,GAAG,CACJ,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAE1D,MAAM,SAAS,GAAG,GAGL,CAAC;IACd,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACjD,IACE,SAAS,EAAE,IAAI,KAAK,qBAAqB;QACzC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACrE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,4CAA4C,CACzD,KAGC,EACD,OAAe;IAEf,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,EAAE,0CAA0C,EAAE,GAClD,MAAM,MAAM,CAAC,4CAA4C,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,0CAA0C,CACpE,WAAW,CAAC,MAAM,EAClB,KAAK,CAAC,GAAG,EACT,mCAAmC,CAAC,OAAO,CAAC,CAC7C,CAAC;QACF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACjD,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAC3D,YAAY,CAAC,MAAM,CACpB,CACF,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,KAAK,WAAW;YAC3B,CAAC,CAAC,sGAAsG;YACxG,CAAC,CAAC,2GAA2G,CAAC;QAClH,OAAO,CACL,GAAG,8BAA8B,IAAI;YACrC,OAAO,KAAK,CAAC,IAAI,UAAU,KAAK,iBAAiB,KAAK,CAAC,IAAI,6IAA6I,KAAK,CAAC,IAAI,kDAAkD,CACrQ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAAC,OAAe;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,4CAA4C;AAC5C,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IAC/D,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzC,4EAA4E;IAC5E,8EAA8E;IAC9E,OAAO,IAAI,CAAC,OAAO,CACjB,qDAAqD,EACrD,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAChD,CAAC;AACJ,CAAC","sourcesContent":["import type { ActionTool } from \"../agent/types.js\";\nimport type { ActionRunContext } from \"../agent/production-agent.js\";\nimport { createHash } from \"node:crypto\";\nimport { findAgent, discoverAgents } from \"../server/agent-discovery.js\";\nimport { A2ATaskTimeoutError, callAgent, signA2AToken } from \"../a2a/client.js\";\nimport { A2A_CONTINUATION_QUEUED_MARKER } from \"../integrations/a2a-continuation-marker.js\";\nimport {\n  formatLlmCredentialErrorMessage,\n  isLlmCredentialError,\n} from \"../agent/engine/credential-errors.js\";\nimport {\n  getRequestUserEmail,\n  getRequestOrgId,\n  isIntegrationCallerRequest,\n  getIntegrationRequestContext,\n} from \"../server/request-context.js\";\nimport { getOrgDomain, getOrgA2ASecret } from \"../org/context.js\";\n\nconst DEFAULT_SERVERLESS_INTEGRATION_A2A_TIMEOUT_MS = 18_000;\nconst NETLIFY_INTEGRATION_A2A_TIMEOUT_MS = 2_000;\nconst INTEGRATION_A2A_TOKEN_TTL = \"30m\";\n\nfunction parseTimeoutMs(value: string | undefined): number | undefined {\n  if (!value) return undefined;\n  const parsed = Number(value);\n  if (!Number.isFinite(parsed) || parsed <= 0) return undefined;\n  return Math.floor(parsed);\n}\n\nfunction isServerlessHost(): boolean {\n  // Detection mirrors db/migrations.ts:297-301. On Cloudflare Workers/Pages,\n  // `process.env` is shimmed and CF_PAGES isn't reliably populated at runtime —\n  // the canonical signal is the `__cf_env` global injected by workerd.\n  return (\n    !!process.env.NETLIFY ||\n    !!process.env.AWS_LAMBDA_FUNCTION_NAME ||\n    !!process.env.VERCEL ||\n    \"__cf_env\" in globalThis\n  );\n}\n\nfunction getIntegrationCallTimeoutMs(): number | undefined {\n  if (!isServerlessHost() || !isIntegrationCallerRequest()) return undefined;\n\n  const configured = parseTimeoutMs(\n    process.env.AGENT_NATIVE_INTEGRATION_A2A_TIMEOUT_MS,\n  );\n  if (configured !== undefined) return configured;\n\n  // Netlify's current synchronous function budget is 60s. Keep delegated\n  // calls very short so multi-agent integration requests queue downstream\n  // continuations quickly instead of spending the parent Slack/email processor\n  // budget waiting on separately deployed apps one-by-one.\n  if (process.env.NETLIFY) return NETLIFY_INTEGRATION_A2A_TIMEOUT_MS;\n\n  return DEFAULT_SERVERLESS_INTEGRATION_A2A_TIMEOUT_MS;\n}\n\nfunction formatDownstreamLlmCredentialFailure(\n  agentName: string,\n  value: unknown,\n): string | null {\n  return isLlmCredentialError(value)\n    ? formatLlmCredentialErrorMessage({ agentName })\n    : null;\n}\n\nexport const tool: ActionTool = {\n  description:\n    \"Call a DIFFERENT, separately-deployed agent app to ask a question or delegate a task. This is strictly for cross-app A2A communication — for example, asking the mail agent to send an email while you are the calendar agent. NEVER use this to call your own app or perform actions you can do with your own tools. Using call-agent on yourself will fail and waste time. \" +\n    'For brand-consistent generated media, the first-party Assets agent is available as agent=\"assets\"; use it when another app needs generated heroes, diagrams, product shots, thumbnails, videos, or design imagery, unless the current app has its own generation action that already delegates there. ' +\n    \"IMPORTANT — handling the response: \" +\n    \"(a) If it contains a URL or ID, copy it VERBATIM into your reply. Do not 'correct' or pluralize the path (e.g. /deck/ → /decks/), normalize casing, or change the slug — any edit breaks the link. \" +\n    '(b) If it does NOT contain a URL/ID and the user asked for one, say so explicitly (e.g. \"the agent created the deck/image but didn\\'t return a link — open the app directly to view it\"). NEVER invent a URL, slug, or path — guessing produces broken links that look real. ' +\n    \"(c) If the downstream response reports missing credentials, never repeat raw env var names, Vault key names, token names, secret names, or other credential identifiers. Tell the user the target app needs its LLM/provider connection configured.\",\n  parameters: {\n    type: \"object\",\n    properties: {\n      agent: {\n        type: \"string\",\n        description:\n          \"Name or URL of a DIFFERENT deployed agent app (e.g. 'mail', 'calendar', 'analytics'). Must not be the current app's own name.\",\n      },\n      message: {\n        type: \"string\",\n        description: \"The message/question to send to the other agent\",\n      },\n    },\n    required: [\"agent\", \"message\"],\n  },\n};\n\nexport async function run(\n  args: Record<string, string>,\n  context?: ActionRunContext,\n  selfAppId?: string,\n): Promise<string> {\n  const { agent: agentIdOrName, message } = args;\n\n  if (!agentIdOrName) return \"Error: --agent is required\";\n  if (!message) return \"Error: --message is required\";\n\n  // Prevent self-calls — the agent must use its own registered tools instead\n  if (selfAppId && agentIdOrName.toLowerCase() === selfAppId.toLowerCase()) {\n    return `Error: You cannot use call-agent to call yourself (${selfAppId}). Use your own registered actions/tools instead. call-agent is only for communicating with OTHER separately-deployed apps.`;\n  }\n\n  const agent = await findAgent(agentIdOrName, selfAppId);\n  if (!agent) {\n    const available = (await discoverAgents(selfAppId))\n      .map((a) => a.name)\n      .join(\", \");\n    return `Error: Agent \"${agentIdOrName}\" not found. Available agents: ${available || \"(none)\"}`;\n  }\n\n  // Append a small cross-app hint to the outgoing message so the receiving\n  // agent (which may be on an older deploy without the receiver-side hint\n  // in handlers.ts) still emits fully-qualified URLs. This is belt-and-\n  // suspenders with the receiver hint — but it works against any current\n  // deployment, no redeploy required.\n  const messageWithHint =\n    `${message}\\n\\n` +\n    `[Note: this request comes from another app via A2A. The caller cannot see your local UI, deck list, or navigation — only the literal text you put in your reply. ` +\n    `If you create or reference a deck/document/design/dashboard, include its FULLY-QUALIFIED URL (e.g. ${agent.url}/deck/<id>) in your reply, not a relative path. ` +\n    `Use only artifact IDs and URL paths returned by successful actions — never invent slugs, IDs, or hosts.]`;\n\n  try {\n    // If we have a send context, use streaming so the UI shows progressive text\n    if (context?.send) {\n      const callerEmail = getRequestUserEmail();\n\n      // Build metadata with identity\n      const a2aMetadata: Record<string, unknown> = {};\n      if (callerEmail) a2aMetadata.userEmail = callerEmail;\n\n      // Include org domain for cross-app org resolution\n      let callerOrgDomain: string | undefined;\n      let callerOrgSecret: string | undefined;\n      const orgId = getRequestOrgId();\n      if (orgId) {\n        try {\n          const domain = await getOrgDomain(orgId);\n          if (domain) {\n            callerOrgDomain = domain;\n            a2aMetadata.orgDomain = domain;\n          }\n        } catch {}\n        try {\n          const secret = await getOrgA2ASecret(orgId);\n          if (secret) callerOrgSecret = secret;\n        } catch {}\n      }\n\n      // Sign JWT with identity + org domain for the streaming client\n      let apiKey: string | undefined;\n      if (callerEmail && (callerOrgSecret || process.env.A2A_SECRET)) {\n        try {\n          apiKey = await signA2AToken(\n            callerEmail,\n            callerOrgDomain,\n            callerOrgSecret,\n            {\n              expiresIn: INTEGRATION_A2A_TOKEN_TTL,\n              preferGlobalSecret: !callerOrgSecret,\n            },\n          );\n        } catch {}\n      }\n\n      if (process.env.NODE_ENV === \"production\" && callerEmail) {\n        try {\n          const { listOAuthAccountsByOwner } =\n            await import(\"../oauth-tokens/store.js\");\n          const accounts = await listOAuthAccountsByOwner(\n            \"google\",\n            callerEmail,\n          );\n          const tokens = accounts[0]?.tokens;\n          if (tokens?.access_token) {\n            a2aMetadata.googleToken = tokens.access_token;\n          }\n        } catch {}\n      }\n\n      let responseText = \"\";\n      let lastSentLength = 0;\n      const existingContinuationText =\n        await formatExistingIntegrationContinuationIfRetry(agent, message);\n      if (existingContinuationText) return existingContinuationText;\n\n      context.send({\n        type: \"agent_call\",\n        agent: agent.name,\n        status: \"start\",\n      });\n\n      const emitNewText = (newText: string) => {\n        if (newText.length > lastSentLength) {\n          context.send!({\n            type: \"agent_call_text\",\n            agent: agent.name,\n            text: newText.slice(lastSentLength),\n          });\n          lastSentLength = newText.length;\n        }\n        responseText = newText;\n      };\n\n      // Skip the SSE streaming attempt and go straight to async + poll.\n      // Why: on Netlify (Lambda), the receiving server has no streaming\n      // response support, so message/stream returns a single JSON-RPC error\n      // body in a 200 response that our SSE parser silently consumes — the\n      // `for await` loop yields nothing AND keeps the connection open until\n      // the function timeout, eating the current serverless budget. By the\n      // time we get to the sync fallback, Lambda is dead and the second fetch\n      // errors out as \"fetch failed\". Async+poll has its own short fetches\n      // with their own budgets, so it works reliably across hosts. The\n      // trade-off is we lose progressive in-UI text streaming for cross-app\n      // A2A calls, but the receiving agent's full response still surfaces via\n      // the tool_result event below.\n      try {\n        // Apply a polling cap ONLY for integration-platform callers on\n        // serverless hosts. Normal chat, local Node, self-hosted Node, and\n        // Docker can wait for slow-but-valid answers; integration processors\n        // still need to finish before their current function execution dies.\n        const callTimeoutMs = getIntegrationCallTimeoutMs();\n        responseText = await callAgent(agent.url, messageWithHint, {\n          apiKey,\n          userEmail: callerEmail,\n          orgDomain: callerOrgDomain,\n          orgSecret: callerOrgSecret,\n          ...(callTimeoutMs ? { timeoutMs: callTimeoutMs } : {}),\n        });\n        responseText =\n          formatDownstreamLlmCredentialFailure(agent.name, responseText) ??\n          responseText;\n        // Some agents reply with relative paths (e.g. slides emits\n        // \"/deck/abc\"). Those resolve against the caller's host, not the\n        // receiver's, so they're broken for the user. Expand any leading-slash\n        // URL into a fully-qualified one rooted at the receiving agent's host.\n        responseText = expandRelativeUrls(responseText, agent.url);\n        // Mirror the response into the streaming UI so the user sees it.\n        if (responseText) emitNewText(responseText);\n      } catch (pollErr: any) {\n        const timeoutTaskId = getA2ATaskTimeoutTaskId(pollErr);\n        if (timeoutTaskId) {\n          const queued = await enqueueIntegrationContinuationIfPossible(\n            timeoutTaskId,\n            agent,\n            message,\n            callerEmail,\n          );\n          if (queued) {\n            responseText =\n              `${A2A_CONTINUATION_QUEUED_MARKER}\\n` +\n              `The ${agent.name} agent accepted this delegated subtask and will post its own final result to the originating integration thread automatically. ` +\n              `Do not call ${agent.name} again for this same subtask. Continue any other requested work, then answer with the completed results you have; if needed, mention that ${agent.name} is posting its result separately.`;\n          } else {\n            const reason = pollErr?.message ?? \"unknown error\";\n            responseText = `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;\n          }\n        } else {\n          const reason = pollErr?.message ?? \"unknown error\";\n          responseText =\n            formatDownstreamLlmCredentialFailure(agent.name, pollErr) ??\n            `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;\n        }\n      }\n\n      context.send({\n        type: \"agent_call\",\n        agent: agent.name,\n        status: \"done\",\n      });\n\n      return responseText || \"(empty response)\";\n    }\n\n    // No context — use the async + poll call so we don't get cut off at the\n    // serverless gateway's ~30s timeout. callAgent defaults to async:true.\n    const email = getRequestUserEmail();\n    let domain: string | undefined;\n    let orgSecret: string | undefined;\n    const currentOrgId = getRequestOrgId();\n    if (currentOrgId) {\n      try {\n        domain = (await getOrgDomain(currentOrgId)) ?? undefined;\n      } catch {}\n      try {\n        orgSecret = (await getOrgA2ASecret(currentOrgId)) ?? undefined;\n      } catch {}\n    }\n    const response = await callAgent(agent.url, messageWithHint, {\n      userEmail: email,\n      orgDomain: domain,\n      orgSecret,\n    });\n    const sanitized =\n      formatDownstreamLlmCredentialFailure(agent.name, response) ?? response;\n    return expandRelativeUrls(sanitized, agent.url) || \"(empty response)\";\n  } catch (err: any) {\n    const msg = err?.message ?? String(err);\n    const credentialMessage = formatDownstreamLlmCredentialFailure(\n      agent.name,\n      err,\n    );\n    if (credentialMessage) return credentialMessage;\n    // Friendlier message for the common timeout case so the calling agent can\n    // decide whether to give up or retry.\n    if (/timeout|did not complete|Inactivity|504/i.test(msg)) {\n      return `The ${agent.name} agent is taking longer than expected. Please try again, ask a simpler question, or open the ${agent.name} app directly.`;\n    }\n    return `Error calling ${agent.name}: ${msg}`;\n  }\n}\n\nasync function enqueueIntegrationContinuationIfPossible(\n  taskId: string,\n  agent: { name: string; url: string },\n  message: string,\n  ownerEmail: string | undefined,\n): Promise<boolean> {\n  const integration = getIntegrationRequestContext();\n  if (!integration || !ownerEmail) return false;\n\n  try {\n    const [{ insertA2AContinuation }, { dispatchA2AContinuation }] =\n      await Promise.all([\n        import(\"../integrations/a2a-continuations-store.js\"),\n        import(\"../integrations/a2a-continuation-processor.js\"),\n      ]);\n    const continuation = await insertA2AContinuation({\n      integrationTaskId: integration.taskId,\n      platform: integration.incoming.platform,\n      externalThreadId: integration.incoming.externalThreadId,\n      incoming: integration.incoming,\n      placeholderRef: integration.placeholderRef,\n      ownerEmail,\n      orgId: getRequestOrgId() ?? null,\n      agentName: agent.name,\n      agentUrl: agent.url,\n      dedupeKey: getIntegrationContinuationDedupeKey(message),\n      a2aTaskId: taskId,\n      // Do not persist the short-lived JWT used for the initial send. The\n      // continuation processor can mint a fresh token for each poll.\n      a2aAuthToken: null,\n    });\n    await dispatchA2AContinuation(continuation.id).catch((err) => {\n      console.error(\n        `[call-agent] Failed to dispatch A2A continuation ${continuation.id}:`,\n        err,\n      );\n    });\n    return true;\n  } catch (err) {\n    console.error(\"[call-agent] Failed to enqueue A2A continuation:\", err);\n    return false;\n  }\n}\n\nfunction getA2ATaskTimeoutTaskId(err: unknown): string | null {\n  if (err instanceof A2ATaskTimeoutError) return err.taskId;\n\n  const candidate = err as\n    | { name?: unknown; taskId?: unknown; message?: unknown }\n    | null\n    | undefined;\n  const message = String(candidate?.message ?? \"\");\n  if (\n    candidate?.name === \"A2ATaskTimeoutError\" &&\n    typeof candidate.taskId === \"string\"\n  ) {\n    return candidate.taskId;\n  }\n\n  const match = message.match(/^A2A task ([^\\s]+) did not complete\\b/);\n  return match?.[1] ?? null;\n}\n\nasync function formatExistingIntegrationContinuationIfRetry(\n  agent: {\n    name: string;\n    url: string;\n  },\n  message: string,\n): Promise<string | null> {\n  const integration = getIntegrationRequestContext();\n  if (!integration || (integration.attempts ?? 1) <= 1) return null;\n\n  try {\n    const { getA2AContinuationsForIntegrationTaskAgent } =\n      await import(\"../integrations/a2a-continuations-store.js\");\n    const continuations = await getA2AContinuationsForIntegrationTaskAgent(\n      integration.taskId,\n      agent.url,\n      getIntegrationContinuationDedupeKey(message),\n    );\n    const active = continuations.find((continuation) =>\n      [\"pending\", \"processing\", \"delivering\", \"completed\"].includes(\n        continuation.status,\n      ),\n    );\n    if (!active) return null;\n\n    const state =\n      active.status === \"completed\"\n        ? \"already completed this delegated subtask and posted its result to the originating integration thread\"\n        : \"already accepted this delegated subtask and is still working on it for the originating integration thread\";\n    return (\n      `${A2A_CONTINUATION_QUEUED_MARKER}\\n` +\n      `The ${agent.name} agent ${state}. Do not call ${agent.name} again for this same subtask. Continue any other requested work, then answer with the completed results you have; if needed, mention that ${agent.name} is posting or has posted its result separately.`\n    );\n  } catch (err) {\n    console.error(\"[call-agent] Failed to inspect existing continuation:\", err);\n    return null;\n  }\n}\n\nfunction getIntegrationContinuationDedupeKey(message: string): string {\n  const normalized = message.trim().replace(/\\s+/g, \" \");\n  return createHash(\"sha256\").update(normalized).digest(\"hex\");\n}\n\n// Expand bare leading-slash paths (e.g. \"/deck/abc\") into fully-qualified URLs\n// rooted at the receiving agent's host. The receiver doesn't always know it's\n// being called cross-app, so it may emit relative paths that resolve against\n// the caller's host (broken). Match a path that starts at a word boundary,\n// begins with `/`, and has at least one path segment after that. Skip if it\n// already looks like a fully-qualified URL.\nexport function expandRelativeUrls(text: string, agentUrl: string): string {\n  if (!text || !agentUrl) return text;\n  const base = agentUrl.replace(/\\/$/, \"\");\n  // Path must start at boundary (start, whitespace, or punctuation that isn't\n  // ':' — to avoid mangling `https://example.com/foo` or markdown link bodies).\n  return text.replace(\n    /(^|[\\s(\\[<\"'`])(\\/[a-z0-9_-][a-z0-9_/?&=%#.,:-]*)/gi,\n    (_match, lead, path) => `${lead}${base}${path}`,\n  );\n}\n"]}

package/dist/scripts/resources/migrate-learnings.d.ts

@@ -6,5 +6,5 @@
  * Usage:
  *   pnpm action migrate-learnings
  */
-export default function migrateLearningsScript(args: string[]): Promise<void>;
+export default function migrateLearningsScript(_args: string[]): Promise<void>;
 //# sourceMappingURL=migrate-learnings.d.ts.map

package/dist/scripts/resources/migrate-learnings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-learnings.d.ts","sourceRoot":"","sources":["../../../src/scripts/resources/migrate-learnings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,wBAA8B,sBAAsB,CAClD,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,IAAI,CAAC,CAyBf"}
+{"version":3,"file":"migrate-learnings.d.ts","sourceRoot":"","sources":["../../../src/scripts/resources/migrate-learnings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,wBAA8B,sBAAsB,CAClD,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/scripts/resources/migrate-learnings.js

@@ -11,7 +11,7 @@ import path from "path";
 import { resourcePut } from "../../resources/store.js";
 import { getRequestUserEmail } from "../../server/request-context.js";
 import { fail } from "../utils.js";
-export default async function migrateLearningsScript(args) {
+export default async function migrateLearningsScript(_args) {
     const filePath = path.resolve(process.cwd(), "learnings.md");
     if (!fs.existsSync(filePath)) {
         console.log("No learnings.md found");

package/dist/scripts/resources/migrate-learnings.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-learnings.js","sourceRoot":"","sources":["../../../src/scripts/resources/migrate-learnings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,sBAAsB,CAClD,IAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAE7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,mBAAmB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CACF,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,KAAK,EACL,cAAc,EACd,OAAO,EACP,eAAe,CAChB,CAAC;IACF,OAAO,CAAC,GAAG,CACT,4CAA4C,QAAQ,CAAC,IAAI,SAAS,CACnE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Core script: migrate-learnings\n *\n * Migrate a learnings.md file from the project root into the SQL resource store.\n *\n * Usage:\n *   pnpm action migrate-learnings\n */\n\nimport fs from \"fs\";\nimport path from \"path\";\nimport { resourcePut } from \"../../resources/store.js\";\nimport { getRequestUserEmail } from \"../../server/request-context.js\";\nimport { fail } from \"../utils.js\";\n\nexport default async function migrateLearningsScript(\n  args: string[],\n): Promise<void> {\n  const filePath = path.resolve(process.cwd(), \"learnings.md\");\n\n  if (!fs.existsSync(filePath)) {\n    console.log(\"No learnings.md found\");\n    return;\n  }\n\n  const content = fs.readFileSync(filePath, \"utf-8\");\n  const owner = getRequestUserEmail() ?? process.env.AGENT_USER_EMAIL;\n  if (!owner) {\n    fail(\n      \"migrate-learnings requires an authenticated user (request context or AGENT_USER_EMAIL env var).\",\n    );\n  }\n\n  const resource = await resourcePut(\n    owner,\n    \"learnings.md\",\n    content,\n    \"text/markdown\",\n  );\n  console.log(\n    `Migrated learnings.md to resource store (${resource.size} bytes)`,\n  );\n}\n"]}
+{"version":3,"file":"migrate-learnings.js","sourceRoot":"","sources":["../../../src/scripts/resources/migrate-learnings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,sBAAsB,CAClD,KAAe;IAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAE7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,mBAAmB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CACF,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,KAAK,EACL,cAAc,EACd,OAAO,EACP,eAAe,CAChB,CAAC;IACF,OAAO,CAAC,GAAG,CACT,4CAA4C,QAAQ,CAAC,IAAI,SAAS,CACnE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Core script: migrate-learnings\n *\n * Migrate a learnings.md file from the project root into the SQL resource store.\n *\n * Usage:\n *   pnpm action migrate-learnings\n */\n\nimport fs from \"fs\";\nimport path from \"path\";\nimport { resourcePut } from \"../../resources/store.js\";\nimport { getRequestUserEmail } from \"../../server/request-context.js\";\nimport { fail } from \"../utils.js\";\n\nexport default async function migrateLearningsScript(\n  _args: string[],\n): Promise<void> {\n  const filePath = path.resolve(process.cwd(), \"learnings.md\");\n\n  if (!fs.existsSync(filePath)) {\n    console.log(\"No learnings.md found\");\n    return;\n  }\n\n  const content = fs.readFileSync(filePath, \"utf-8\");\n  const owner = getRequestUserEmail() ?? process.env.AGENT_USER_EMAIL;\n  if (!owner) {\n    fail(\n      \"migrate-learnings requires an authenticated user (request context or AGENT_USER_EMAIL env var).\",\n    );\n  }\n\n  const resource = await resourcePut(\n    owner,\n    \"learnings.md\",\n    content,\n    \"text/markdown\",\n  );\n  console.log(\n    `Migrated learnings.md to resource store (${resource.size} bytes)`,\n  );\n}\n"]}

package/dist/secrets/schema.d.ts

@@ -30,7 +30,7 @@ export declare const appSecrets: import("drizzle-orm/sqlite-core").SQLiteTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            length: number;
+            length: number | undefined;
         }>;
         scope: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "scope";
@@ -49,7 +49,7 @@ export declare const appSecrets: import("drizzle-orm/sqlite-core").SQLiteTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            length: number;
+            length: number | undefined;
         }>;
         scopeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "scope_id";
@@ -68,7 +68,7 @@ export declare const appSecrets: import("drizzle-orm/sqlite-core").SQLiteTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            length: number;
+            length: number | undefined;
         }>;
         key: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "key";
@@ -87,7 +87,7 @@ export declare const appSecrets: import("drizzle-orm/sqlite-core").SQLiteTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            length: number;
+            length: number | undefined;
         }>;
         encryptedValue: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "encrypted_value";
@@ -106,7 +106,7 @@ export declare const appSecrets: import("drizzle-orm/sqlite-core").SQLiteTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            length: number;
+            length: number | undefined;
         }>;
         description: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "description";
@@ -125,7 +125,7 @@ export declare const appSecrets: import("drizzle-orm/sqlite-core").SQLiteTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            length: number;
+            length: number | undefined;
         }>;
         urlAllowlist: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "url_allowlist";
@@ -144,7 +144,7 @@ export declare const appSecrets: import("drizzle-orm/sqlite-core").SQLiteTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            length: number;
+            length: number | undefined;
         }>;
         createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "created_at";

package/dist/server/action-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-discovery.d.ts","sourceRoot":"","sources":["../../src/server/action-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA4ChE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,IAAI,CAKN;AA8OD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAqC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAgGtC;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CA+Df;AAED,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,4BAAsB,CAAC"}
+{"version":3,"file":"action-discovery.d.ts","sourceRoot":"","sources":["../../src/server/action-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA4ChE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,IAAI,CAKN;AA8OD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAqC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAgGtC;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CA6Ef;AAED,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,4BAAsB,CAAC"}

package/dist/server/action-discovery.js

@@ -471,6 +471,20 @@ export async function mergeCoreSharingActions(registry) {
             () => import("../appearance/actions/change-appearance.js"),
         ],
         ["toggle-demo-mode", () => import("../demo/actions/toggle-demo-mode.js")],
+        // Org service tokens (CI credentials, e.g. PLAN_RECAP_TOKEN). Mint/revoke
+        // are toolCallable:false — preserved via preserveActionFlags below.
+        [
+            "create-org-service-token",
+            () => import("../mcp/actions/create-org-service-token.js"),
+        ],
+        [
+            "list-org-service-tokens",
+            () => import("../mcp/actions/list-org-service-tokens.js"),
+        ],
+        [
+            "revoke-org-service-token",
+            () => import("../mcp/actions/revoke-org-service-token.js"),
+        ],
     ];
     for (const [name, loader] of entries) {
         if (registry[name])

package/dist/server/action-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-discovery.js","sourceRoot":"","sources":["../../src/server/action-discovery.ts"],"names":[],"mappings":"AA6BA,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,sDAAsD;AACtD,yFAAyF;AACzF,IAAI,GAAoC,CAAC;AACzC,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,0DAA0D;AAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,SAAS;IACT,KAAK;IACL,YAAY;IACZ,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAgC,EAAE,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAoC;IAEpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,qBAAqB,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,qBAAqB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtC,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,iBAAiB;IACxB,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,IAAY,EACZ,SAA4C;IAE5C,MAAM,IAAI,GAAe;QACvB,WAAW,EAAE,YAAY,IAAI,8CAA8C;QAC3E,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,+DAA+D;iBAClE;aACF;SACF;KACF,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,KAAK,EAAE,IAA4B,EAAmB,EAAE;YAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,+DAA+D;YAC/D,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA0B;IACrD,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAC1E,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACvE,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IACE,KAAK,CAAC,WAAW;QACjB,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EACjC,CAAC;QACD,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,IACE,KAAK,CAAC,MAAM;QACZ,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAC5B,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,qEAAqE;IACrE,8DAA8D;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,eAAe,CAAC;QACpD,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,eAAe,CAAC;QACpD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CACpC,UAAkB,EAClB,QAAqC,EACrC,YAAqB;IAErB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QACvC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,YAAY,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAE7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAEtD,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;iBAC5B,CAAC;YACJ,CAAC;iBAAM,IACL,GAAG,CAAC,OAAO;gBACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAC/B,GAAG,CAAC,OAAO,CAAC,IAAI;gBAChB,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,UAAU,EACrC,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBACtB,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;oBACpB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;iBACpC,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,WAAW;YACX,MAAM,GAAG,GACP,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CACV,+BAA+B,IAAI,sCAAsC;gBACvE,gFAAgF,GAAG,EAAE,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAgC;IAEhC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAA6C,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;aAC5B,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,IACE,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,CAAC,IAAI;YACR,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAC7B,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;aAC5B,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY;IAEZ,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAgC,EAAE,CAAC;IAEjD,wEAAwE;IACxE,0EAA0E;IAC1E,WAAW;IACX,IAAI,CAAC;QACH,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,2DAA2D,UAAU,MAAM,GAAG,EAAE,OAAO,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,gEAAgE;IAChE,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,YAAoB,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,YAAY,GAAG,QAAQ,CAAC,OAAO,CAC7B,SAAS,EACT,sCAAsC,CACvC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,QAAQ,CAAC,OAAO,CAC7B,IAAI,EACJ,mCAAmC,CACpC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC1D,MAAM,aAAa,GAAG,6BAA6B,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;YACxE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,GAAG,CACT,kEAAkE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,gDAAgD;oBACjJ,kGAAkG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CACV,4DAA4D;YAC1D,kDAAkD;YAClD,sFAAsF;YACtF,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,uDAAuD;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,iCAAiC;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,uBAAuB,EAAE,GAC/B,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,uBAAuB,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAqC;IAErC,MAAM,OAAO,GAAwC;QACnD,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACxE;YACE,kBAAkB;YAClB,GAAG,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC;SACvD;QACD;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC;SAC9D;QACD,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC;QACxE;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,uDAAuD,CAAC;SACtE;QACD;YACE,aAAa;YACb,GAAG,EAAE,CAAC,MAAM,CAAC,8CAA8C,CAAC;SAC7D;QACD;YACE,eAAe;YACf,GAAG,EAAE,CAAC,MAAM,CAAC,gDAAgD,CAAC;SAC/D;QACD;YACE,iBAAiB;YACjB,GAAG,EAAE,CAAC,MAAM,CAAC,kDAAkD,CAAC;SACjE;QACD;YACE,gBAAgB;YAChB,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC;SAChE;QACD;YACE,mBAAmB;YACnB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;KAC1E,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;YACxB,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBACrD,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,kEAAkE;oBAClE,gEAAgE;oBAChE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,GAAG,mBAAmB,CAAC,GAAG,CAAC;iBAC5B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC","sourcesContent":["/**\n * Auto-discover actions from a template's actions/ directory.\n *\n * Scans for .ts/.js files and builds an action registry suitable for\n * `createAgentChatPlugin({ actions })`.\n *\n * Supports two action conventions:\n *\n * 1. **Full interface** — exports `tool: ActionTool` and `run(args): Promise<string>`.\n *    These are used directly.\n *\n * 2. **CLI-style** — exports only `default async function(args: string[])`.\n *    These are wrapped: args are converted from `Record<string, string>` to\n *    `[\"--key\", \"value\", ...]`, console output is captured, and a tool\n *    definition is synthesized from the action name.\n *\n * 3. **defineAction** — exports `default` from `defineAction()`. Has `tool` and `run`.\n *\n * Usage in agent-chat plugins:\n * ```ts\n * import { autoDiscoverActions } from \"@agent-native/core/server\";\n *\n * export default createAgentChatPlugin({\n *   actions: () => autoDiscoverActions(import.meta.url),\n * });\n * ```\n */\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport type { ActionTool } from \"../agent/types.js\";\nimport nodePath from \"node:path\";\nimport { captureCliOutput } from \"./cli-capture.js\";\n\n// Lazy fs — loaded via dynamic import() on first use.\n// Avoids require() which bundlers convert to createRequire() that crashes on CF Workers.\nlet _fs: typeof import(\"fs\") | undefined;\nasync function getFs(): Promise<typeof import(\"fs\")> {\n  if (!_fs) {\n    _fs = await import(\"node:fs\");\n  }\n  return _fs;\n}\nimport { fileURLToPath } from \"node:url\";\n\n/** Files to skip during auto-discovery (no extension). */\nconst SKIP_FILES = new Set([\n  \"helpers\",\n  \"run\",\n  \"db-connect\",\n  \"db-status\",\n  \"registry\",\n]);\n\nfunction isRuntimeSourceFile(filename: string): boolean {\n  if (!/\\.(ts|js)$/.test(filename)) return false;\n  if (/\\.d\\.ts$/.test(filename)) return false;\n  if (/\\.(test|spec)\\.(ts|js)$/.test(filename)) return false;\n  return true;\n}\n\n/**\n * Global registry of actions contributed by published packages\n * (e.g. `@agent-native/dispatch`). Populated by `registerPackageActions()`\n * which the package calls from import side effects, then merged into\n * `autoDiscoverActions` after the template's local `actions/` directory.\n *\n * Ordering: template `actions/` files always win on name collision so\n * consumers can override a packaged action by dropping a same-named file\n * in their own `actions/` dir.\n */\nconst packageActionRegistry: Record<string, ActionEntry> = {};\n\n/**\n * Register a map of actions contributed by a published package.\n *\n * Called from a package's server entrypoint via import side effects:\n * ```ts\n * // packages/dispatch/src/server/index.ts\n * import { registerPackageActions } from \"@agent-native/core/server\";\n * import { actions } from \"../actions/index.js\";\n * registerPackageActions(actions);\n * ```\n *\n * Idempotent — re-registering the same name from the same import is a no-op\n * so HMR / repeated dynamic imports don't double-warn.\n */\nexport function registerPackageActions(\n  actions: Record<string, ActionEntry>,\n): void {\n  for (const [name, entry] of Object.entries(actions)) {\n    if (packageActionRegistry[name]) continue;\n    packageActionRegistry[name] = entry;\n  }\n}\n\n/** Internal — used by `autoDiscoverActions`. Returns a shallow copy. */\nfunction getPackageActions(): Record<string, ActionEntry> {\n  return { ...packageActionRegistry };\n}\n\n/**\n * Split a string into shell-like tokens, handling double and single quotes.\n * `--title \"My Page\" --content \"\"` → `[\"--title\", \"My Page\", \"--content\", \"\"]`\n */\nfunction splitShellArgs(input: string): string[] {\n  const tokens: string[] = [];\n  let current = \"\";\n  let inDouble = false;\n  let inSingle = false;\n  let wasQuoted = false;\n\n  for (let i = 0; i < input.length; i++) {\n    const ch = input[i];\n    if (ch === '\"' && !inSingle) {\n      inDouble = !inDouble;\n      wasQuoted = true;\n      continue;\n    }\n    if (ch === \"'\" && !inDouble) {\n      inSingle = !inSingle;\n      wasQuoted = true;\n      continue;\n    }\n    if ((ch === \" \" || ch === \"\\t\") && !inDouble && !inSingle) {\n      if (current.length > 0 || wasQuoted) {\n        tokens.push(current);\n      }\n      current = \"\";\n      wasQuoted = false;\n      continue;\n    }\n    current += ch;\n  }\n  if (current.length > 0 || wasQuoted) {\n    tokens.push(current);\n  }\n  return tokens;\n}\n\n/**\n * Wrap a CLI-style action (that writes to console.log) as an ActionEntry\n * by capturing stdout/stderr and intercepting process.exit. Uses the\n * shared AsyncLocalStorage-backed capture so concurrent invocations do\n * not corrupt the global `console.log` / `process.stdout.write` /\n * `process.exit` pointers (see `cli-capture.ts`).\n */\nfunction wrapDefaultExport(\n  name: string,\n  defaultFn: (args: string[]) => Promise<void>,\n): ActionEntry {\n  const tool: ActionTool = {\n    description: `Run the \"${name}\" action. Pass arguments as key-value pairs.`,\n    parameters: {\n      type: \"object\",\n      properties: {\n        args: {\n          type: \"string\",\n          description:\n            \"Space-separated CLI arguments (e.g. '--id abc --title Hello')\",\n        },\n      },\n    },\n  };\n\n  return {\n    tool,\n    run: async (args: Record<string, string>): Promise<string> => {\n      const cliArgs: string[] = [];\n      // If only an \"args\" key was provided, split it into CLI tokens\n      if (args.args && Object.keys(args).length === 1) {\n        cliArgs.push(...splitShellArgs(args.args));\n      } else {\n        for (const [k, v] of Object.entries(args)) {\n          cliArgs.push(`--${k}`, v);\n        }\n      }\n      return captureCliOutput(() => defaultFn(cliArgs));\n    },\n  };\n}\n\nfunction preserveActionFlags(entry: Record<string, any>): Partial<ActionEntry> {\n  const out: Partial<ActionEntry> = {};\n  if (typeof entry.agentTool === \"boolean\") out.agentTool = entry.agentTool;\n  if (typeof entry.readOnly === \"boolean\") out.readOnly = entry.readOnly;\n  if (typeof entry.parallelSafe === \"boolean\") {\n    out.parallelSafe = entry.parallelSafe;\n  }\n  if (typeof entry.toolCallable === \"boolean\") {\n    out.toolCallable = entry.toolCallable;\n  }\n  if (\n    entry.publicAgent &&\n    typeof entry.publicAgent === \"object\" &&\n    !Array.isArray(entry.publicAgent)\n  ) {\n    out.publicAgent = entry.publicAgent;\n  }\n  if (typeof entry.link === \"function\") {\n    out.link = entry.link;\n  }\n  if (\n    entry.mcpApp &&\n    typeof entry.mcpApp === \"object\" &&\n    !Array.isArray(entry.mcpApp)\n  ) {\n    out.mcpApp = entry.mcpApp;\n  }\n  return out;\n}\n\n/**\n * Resolve the actions directory from the caller's context.\n *\n * @param from - Either an `import.meta.url` (file:// URL from a plugin file),\n *   an absolute directory path, or \"auto\" to use `process.cwd() + \"/actions\"`.\n *   When an import.meta.url is provided, the actions directory is resolved as\n *   `../../actions/` relative to the caller (typically `server/plugins/agent-chat.ts`).\n *   If the resolved directory doesn't exist, falls back to `../../scripts/` for\n *   backwards compatibility, then to `process.cwd() + \"/actions\"`.\n */\nasync function resolveActionsDir(from: string): Promise<string> {\n  const fs = await getFs();\n  const exists = (p: string) => {\n    try {\n      return fs.existsSync(p);\n    } catch {\n      return false;\n    }\n  };\n  // On edge runtimes (e.g. Cloudflare Workers), import.meta.url may be\n  // undefined after bundling. Fall back to cwd-based discovery.\n  if (!from) {\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  if (from.startsWith(\"file://\") || from.startsWith(\"file:///\")) {\n    const callerPath = fileURLToPath(from);\n    const callerDir = nodePath.dirname(callerPath);\n    const actionsResolved = nodePath.resolve(callerDir, \"../../actions\");\n    if (exists(actionsResolved)) return actionsResolved;\n    const scriptsResolved = nodePath.resolve(callerDir, \"../../scripts\");\n    if (exists(scriptsResolved)) return scriptsResolved;\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  if (from === \"auto\") {\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  return nodePath.resolve(from);\n}\n\n/**\n * Load actions from a single directory into the given registry. Shared by\n * both the template-actions discovery path and the workspace-core actions\n * layer. When `skipExisting` is true, an entry with the same name that's\n * already in the registry is left untouched (template-wins on collision).\n */\nasync function loadActionsIntoRegistry(\n  actionsDir: string,\n  registry: Record<string, ActionEntry>,\n  skipExisting: boolean,\n): Promise<void> {\n  let files: string[];\n  try {\n    const fs = await getFs();\n    if (!fs.existsSync(actionsDir)) return;\n    files = fs.readdirSync(actionsDir);\n  } catch {\n    return;\n  }\n\n  const actionFiles = files.filter((f) => {\n    if (!isRuntimeSourceFile(f)) return false;\n    const name = f.replace(/\\.(ts|js)$/, \"\");\n    if (name.startsWith(\"_\")) return false;\n    if (SKIP_FILES.has(name)) return false;\n    return true;\n  });\n\n  for (const file of actionFiles) {\n    const name = file.replace(/\\.(ts|js)$/, \"\");\n    if (skipExisting && registry[name]) continue;\n\n    const filePath = nodePath.join(actionsDir, file);\n    try {\n      const mod = await import(/* @vite-ignore */ filePath);\n\n      if (mod.tool && typeof mod.run === \"function\") {\n        registry[name] = {\n          tool: mod.tool,\n          run: mod.run,\n          ...(mod.http !== undefined ? { http: mod.http } : {}),\n          ...preserveActionFlags(mod),\n        };\n      } else if (\n        mod.default &&\n        typeof mod.default === \"object\" &&\n        mod.default.tool &&\n        typeof mod.default.run === \"function\"\n      ) {\n        registry[name] = {\n          tool: mod.default.tool,\n          run: mod.default.run,\n          ...(mod.default.http !== undefined ? { http: mod.default.http } : {}),\n          ...preserveActionFlags(mod.default),\n        };\n      } else if (typeof mod.default === \"function\") {\n        registry[name] = wrapDefaultExport(name, mod.default);\n      }\n    } catch (err) {\n      // CLI-style scripts (top-level execution) throw on import — expected,\n      // they're available via `pnpm action <name>` / shell instead. But a\n      // syntax error, bad import, or malformed defineAction in a real action\n      // file lands here too and would silently vanish from the agent's tools.\n      // Warn so a broken action file is diagnosable instead of mysteriously\n      // missing.\n      const msg =\n        err instanceof Error ? (err.stack ?? err.message) : String(err);\n      console.warn(\n        `[action-discovery] Skipped \"${file}\" — failed to import. If this is an ` +\n          `agent action (not a CLI script), it will be missing from the agent's tools:\\n${msg}`,\n      );\n    }\n  }\n}\n\n/**\n * Normalize a pre-bundled static action registry (name → raw module) into\n * the `Record<string, ActionEntry>` shape the agent-chat plugin expects.\n *\n * Used by `autoDiscoverActions` when `.generated/actions-registry.ts` is\n * present so that Nitro-bundled serverless functions (Netlify, Vercel,\n * AWS-Lambda) can serve `/_agent-native/actions/*` routes without relying\n * on a filesystem scan that doesn't work in bundled output.\n */\nexport function loadActionsFromStaticRegistry(\n  modules: Record<string, unknown>,\n): Record<string, ActionEntry> {\n  const registry: Record<string, ActionEntry> = {};\n  for (const [name, raw] of Object.entries(modules)) {\n    const mod = raw as Record<string, any> | null | undefined;\n    if (!mod) continue;\n\n    if (mod.tool && typeof mod.run === \"function\") {\n      registry[name] = {\n        tool: mod.tool,\n        run: mod.run,\n        ...(mod.http !== undefined ? { http: mod.http } : {}),\n        ...preserveActionFlags(mod),\n      };\n      continue;\n    }\n\n    const def = mod.default;\n    if (\n      def &&\n      typeof def === \"object\" &&\n      def.tool &&\n      typeof def.run === \"function\"\n    ) {\n      registry[name] = {\n        tool: def.tool,\n        run: def.run,\n        ...(def.http !== undefined ? { http: def.http } : {}),\n        ...preserveActionFlags(def),\n      };\n      continue;\n    }\n\n    if (typeof def === \"function\") {\n      registry[name] = wrapDefaultExport(name, def);\n    }\n  }\n  return registry;\n}\n\n/**\n * Auto-discover actions from a directory.\n *\n * Merges in any actions from the enterprise workspace core (if present in\n * the ancestor chain). Template actions take precedence over workspace-core\n * actions on name collision, so an app can override an enterprise-wide\n * action by dropping a same-named file under its own `actions/`.\n *\n * Note: this helper uses a filesystem scan, which works in dev and in\n * non-bundled Node deployments. In bundled serverless functions (Nitro's\n * netlify / vercel / aws-lambda presets) the `actions/` directory is not\n * on disk at runtime; templates should pass the static registry generated\n * by the Vite plugin to `createAgentChatPlugin({ actions })` instead, so\n * the bundler sees static imports and pulls every action into the bundle.\n *\n * @param from - The caller's `import.meta.url` or an absolute path to the\n *   actions directory.\n * @returns A record mapping action names to ActionEntry objects, suitable for\n *   passing to `createAgentChatPlugin({ actions })`.\n */\nexport async function autoDiscoverActions(\n  from: string,\n): Promise<Record<string, ActionEntry>> {\n  const actionsDir = await resolveActionsDir(from);\n  const registry: Record<string, ActionEntry> = {};\n\n  // 1. Template actions first — these are the authoritative layer for the\n  //    current app and must override any workspace-core entry with the same\n  //    name.\n  try {\n    await loadActionsIntoRegistry(actionsDir, registry, false);\n  } catch (err: any) {\n    console.warn(\n      `[autoDiscoverActions] Could not read actions directory: ${actionsDir} — ${err?.message}`,\n    );\n  }\n\n  // 1b. Fallback: if filesystem discovery found no template actions (common\n  //     in bundled serverless environments like Netlify/Vercel where the\n  //     actions/ directory doesn't exist on disk), try importing the\n  //     generated static registry at .generated/actions-registry.\n  //\n  //     This prevents the silent-empty-tools footgun where the agent has no\n  //     template actions and falls back to generic tools like web-request.\n  //     Prefer `loadActionsFromStaticRegistry` over `autoDiscoverActions` for\n  //     production reliability — this fallback is a safety net, not the\n  //     primary path.\n  if (Object.keys(registry).length === 0 && from) {\n    try {\n      let registryPath: string;\n      if (from.startsWith(\"file://\") || from.startsWith(\"file:///\")) {\n        const callerDir = nodePath.dirname(fileURLToPath(from));\n        registryPath = nodePath.resolve(\n          callerDir,\n          \"../../.generated/actions-registry.js\",\n        );\n      } else {\n        registryPath = nodePath.resolve(\n          from,\n          \"../.generated/actions-registry.js\",\n        );\n      }\n      const mod = await import(/* @vite-ignore */ registryPath);\n      const staticEntries = loadActionsFromStaticRegistry(mod.default || mod);\n      Object.assign(registry, staticEntries);\n      if (Object.keys(staticEntries).length > 0) {\n        console.log(\n          `[autoDiscoverActions] Filesystem scan found 0 actions — loaded ${Object.keys(staticEntries).length} from .generated/actions-registry.ts instead. ` +\n            `Consider switching to loadActionsFromStaticRegistry(actionsRegistry) for production reliability.`,\n        );\n      }\n    } catch {\n      // No generated registry available — registry stays empty.\n    }\n  }\n\n  // If still empty after all fallbacks, warn loudly.\n  if (Object.keys(registry).length === 0) {\n    console.warn(\n      `[autoDiscoverActions] WARNING: No template actions found! ` +\n        `The agent will have no template-specific tools. ` +\n        `If in production, switch from autoDiscoverActions to loadActionsFromStaticRegistry. ` +\n        `See: https://docs.agent-native.com/actions#static-registry`,\n    );\n  }\n\n  // 1c. Package-registered actions — contributed by published packages\n  //     (e.g. @agent-native/dispatch) via `registerPackageActions()` from\n  //     import side effects. Merged with skip-existing so the template's\n  //     own actions/ files always win on name collision.\n  for (const [name, entry] of Object.entries(getPackageActions())) {\n    if (registry[name]) continue;\n    registry[name] = entry;\n  }\n\n  // 2. Workspace-core actions — merged in with skipExisting so they can't\n  //    overwrite template entries.\n  try {\n    const { getWorkspaceCoreExports } =\n      await import(\"../deploy/workspace-core.js\");\n    const ws = await getWorkspaceCoreExports(process.cwd());\n    if (ws && ws.actionsDir) {\n      await loadActionsIntoRegistry(ws.actionsDir, registry, true);\n    }\n  } catch {\n    // workspace-core discovery unavailable (e.g. edge runtime) — skip.\n  }\n\n  // 3. Framework-level sharing + file-upload actions — always available to any\n  //    template. Merged with skipExisting so templates can override by\n  //    providing a same-named file.\n  try {\n    await mergeCoreSharingActions(registry);\n  } catch {\n    // Ignore — templates without sharing still work.\n  }\n\n  return registry;\n}\n\nexport async function mergeCoreSharingActions(\n  registry: Record<string, ActionEntry>,\n): Promise<void> {\n  const entries: Array<[string, () => Promise<any>]> = [\n    [\"share-resource\", () => import(\"../sharing/actions/share-resource.js\")],\n    [\n      \"unshare-resource\",\n      () => import(\"../sharing/actions/unshare-resource.js\"),\n    ],\n    [\n      \"list-resource-shares\",\n      () => import(\"../sharing/actions/list-resource-shares.js\"),\n    ],\n    [\n      \"set-resource-visibility\",\n      () => import(\"../sharing/actions/set-resource-visibility.js\"),\n    ],\n    [\"upload-image\", () => import(\"../file-upload/actions/upload-image.js\")],\n    [\n      \"context-manifest-get\",\n      () => import(\"../agent/context-xray/actions/context-manifest-get.js\"),\n    ],\n    [\n      \"context-pin\",\n      () => import(\"../agent/context-xray/actions/context-pin.js\"),\n    ],\n    [\n      \"context-evict\",\n      () => import(\"../agent/context-xray/actions/context-evict.js\"),\n    ],\n    [\n      \"context-restore\",\n      () => import(\"../agent/context-xray/actions/context-restore.js\"),\n    ],\n    [\n      \"context-report\",\n      () => import(\"../agent/context-xray/actions/context-report.js\"),\n    ],\n    [\n      \"change-appearance\",\n      () => import(\"../appearance/actions/change-appearance.js\"),\n    ],\n    [\"toggle-demo-mode\", () => import(\"../demo/actions/toggle-demo-mode.js\")],\n  ];\n  for (const [name, loader] of entries) {\n    if (registry[name]) continue;\n    try {\n      const mod = await loader();\n      const def = mod.default;\n      if (def && def.tool && typeof def.run === \"function\") {\n        registry[name] = {\n          tool: def.tool,\n          run: def.run,\n          ...(def.http !== undefined ? { http: def.http } : {}),\n          // Carry security-relevant flags (toolCallable, publicAgent, link,\n          // mcpApp) plus readOnly/parallelSafe. Without this, the sharing\n          // actions' `toolCallable: false` (audit-H5) is dropped and the\n          // tools-iframe bridge 403 in action-routes.ts never fires.\n          ...preserveActionFlags(def),\n        };\n      }\n    } catch {\n      // Skip any sharing action that fails to import.\n    }\n  }\n}\n\n/** @deprecated Use `autoDiscoverActions` instead */\nexport const autoDiscoverScripts = autoDiscoverActions;\n"]}
+{"version":3,"file":"action-discovery.js","sourceRoot":"","sources":["../../src/server/action-discovery.ts"],"names":[],"mappings":"AA6BA,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,sDAAsD;AACtD,yFAAyF;AACzF,IAAI,GAAoC,CAAC;AACzC,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,0DAA0D;AAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,SAAS;IACT,KAAK;IACL,YAAY;IACZ,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAgC,EAAE,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAoC;IAEpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,qBAAqB,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,qBAAqB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtC,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,iBAAiB;IACxB,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,IAAY,EACZ,SAA4C;IAE5C,MAAM,IAAI,GAAe;QACvB,WAAW,EAAE,YAAY,IAAI,8CAA8C;QAC3E,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,+DAA+D;iBAClE;aACF;SACF;KACF,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,KAAK,EAAE,IAA4B,EAAmB,EAAE;YAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,+DAA+D;YAC/D,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA0B;IACrD,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAC1E,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACvE,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IACE,KAAK,CAAC,WAAW;QACjB,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EACjC,CAAC;QACD,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,IACE,KAAK,CAAC,MAAM;QACZ,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAC5B,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,qEAAqE;IACrE,8DAA8D;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,eAAe,CAAC;QACpD,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,eAAe,CAAC;QACpD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CACpC,UAAkB,EAClB,QAAqC,EACrC,YAAqB;IAErB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QACvC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,YAAY,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAE7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAEtD,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;iBAC5B,CAAC;YACJ,CAAC;iBAAM,IACL,GAAG,CAAC,OAAO;gBACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAC/B,GAAG,CAAC,OAAO,CAAC,IAAI;gBAChB,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,UAAU,EACrC,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBACtB,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;oBACpB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;iBACpC,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,WAAW;YACX,MAAM,GAAG,GACP,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CACV,+BAA+B,IAAI,sCAAsC;gBACvE,gFAAgF,GAAG,EAAE,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAgC;IAEhC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAA6C,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;aAC5B,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,IACE,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,CAAC,IAAI;YACR,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAC7B,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;aAC5B,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY;IAEZ,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAgC,EAAE,CAAC;IAEjD,wEAAwE;IACxE,0EAA0E;IAC1E,WAAW;IACX,IAAI,CAAC;QACH,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,2DAA2D,UAAU,MAAM,GAAG,EAAE,OAAO,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,gEAAgE;IAChE,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,YAAoB,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,YAAY,GAAG,QAAQ,CAAC,OAAO,CAC7B,SAAS,EACT,sCAAsC,CACvC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,QAAQ,CAAC,OAAO,CAC7B,IAAI,EACJ,mCAAmC,CACpC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC1D,MAAM,aAAa,GAAG,6BAA6B,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;YACxE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,GAAG,CACT,kEAAkE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,gDAAgD;oBACjJ,kGAAkG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CACV,4DAA4D;YAC1D,kDAAkD;YAClD,sFAAsF;YACtF,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,uDAAuD;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,iCAAiC;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,uBAAuB,EAAE,GAC/B,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,uBAAuB,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAqC;IAErC,MAAM,OAAO,GAAwC;QACnD,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACxE;YACE,kBAAkB;YAClB,GAAG,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC;SACvD;QACD;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC;SAC9D;QACD,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC;QACxE;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,uDAAuD,CAAC;SACtE;QACD;YACE,aAAa;YACb,GAAG,EAAE,CAAC,MAAM,CAAC,8CAA8C,CAAC;SAC7D;QACD;YACE,eAAe;YACf,GAAG,EAAE,CAAC,MAAM,CAAC,gDAAgD,CAAC;SAC/D;QACD;YACE,iBAAiB;YACjB,GAAG,EAAE,CAAC,MAAM,CAAC,kDAAkD,CAAC;SACjE;QACD;YACE,gBAAgB;YAChB,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC;SAChE;QACD;YACE,mBAAmB;YACnB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACzE,0EAA0E;QAC1E,oEAAoE;QACpE;YACE,0BAA0B;YAC1B,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC;SAC1D;QACD;YACE,0BAA0B;YAC1B,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;YACxB,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBACrD,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,kEAAkE;oBAClE,gEAAgE;oBAChE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,GAAG,mBAAmB,CAAC,GAAG,CAAC;iBAC5B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC","sourcesContent":["/**\n * Auto-discover actions from a template's actions/ directory.\n *\n * Scans for .ts/.js files and builds an action registry suitable for\n * `createAgentChatPlugin({ actions })`.\n *\n * Supports two action conventions:\n *\n * 1. **Full interface** — exports `tool: ActionTool` and `run(args): Promise<string>`.\n *    These are used directly.\n *\n * 2. **CLI-style** — exports only `default async function(args: string[])`.\n *    These are wrapped: args are converted from `Record<string, string>` to\n *    `[\"--key\", \"value\", ...]`, console output is captured, and a tool\n *    definition is synthesized from the action name.\n *\n * 3. **defineAction** — exports `default` from `defineAction()`. Has `tool` and `run`.\n *\n * Usage in agent-chat plugins:\n * ```ts\n * import { autoDiscoverActions } from \"@agent-native/core/server\";\n *\n * export default createAgentChatPlugin({\n *   actions: () => autoDiscoverActions(import.meta.url),\n * });\n * ```\n */\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport type { ActionTool } from \"../agent/types.js\";\nimport nodePath from \"node:path\";\nimport { captureCliOutput } from \"./cli-capture.js\";\n\n// Lazy fs — loaded via dynamic import() on first use.\n// Avoids require() which bundlers convert to createRequire() that crashes on CF Workers.\nlet _fs: typeof import(\"fs\") | undefined;\nasync function getFs(): Promise<typeof import(\"fs\")> {\n  if (!_fs) {\n    _fs = await import(\"node:fs\");\n  }\n  return _fs;\n}\nimport { fileURLToPath } from \"node:url\";\n\n/** Files to skip during auto-discovery (no extension). */\nconst SKIP_FILES = new Set([\n  \"helpers\",\n  \"run\",\n  \"db-connect\",\n  \"db-status\",\n  \"registry\",\n]);\n\nfunction isRuntimeSourceFile(filename: string): boolean {\n  if (!/\\.(ts|js)$/.test(filename)) return false;\n  if (/\\.d\\.ts$/.test(filename)) return false;\n  if (/\\.(test|spec)\\.(ts|js)$/.test(filename)) return false;\n  return true;\n}\n\n/**\n * Global registry of actions contributed by published packages\n * (e.g. `@agent-native/dispatch`). Populated by `registerPackageActions()`\n * which the package calls from import side effects, then merged into\n * `autoDiscoverActions` after the template's local `actions/` directory.\n *\n * Ordering: template `actions/` files always win on name collision so\n * consumers can override a packaged action by dropping a same-named file\n * in their own `actions/` dir.\n */\nconst packageActionRegistry: Record<string, ActionEntry> = {};\n\n/**\n * Register a map of actions contributed by a published package.\n *\n * Called from a package's server entrypoint via import side effects:\n * ```ts\n * // packages/dispatch/src/server/index.ts\n * import { registerPackageActions } from \"@agent-native/core/server\";\n * import { actions } from \"../actions/index.js\";\n * registerPackageActions(actions);\n * ```\n *\n * Idempotent — re-registering the same name from the same import is a no-op\n * so HMR / repeated dynamic imports don't double-warn.\n */\nexport function registerPackageActions(\n  actions: Record<string, ActionEntry>,\n): void {\n  for (const [name, entry] of Object.entries(actions)) {\n    if (packageActionRegistry[name]) continue;\n    packageActionRegistry[name] = entry;\n  }\n}\n\n/** Internal — used by `autoDiscoverActions`. Returns a shallow copy. */\nfunction getPackageActions(): Record<string, ActionEntry> {\n  return { ...packageActionRegistry };\n}\n\n/**\n * Split a string into shell-like tokens, handling double and single quotes.\n * `--title \"My Page\" --content \"\"` → `[\"--title\", \"My Page\", \"--content\", \"\"]`\n */\nfunction splitShellArgs(input: string): string[] {\n  const tokens: string[] = [];\n  let current = \"\";\n  let inDouble = false;\n  let inSingle = false;\n  let wasQuoted = false;\n\n  for (let i = 0; i < input.length; i++) {\n    const ch = input[i];\n    if (ch === '\"' && !inSingle) {\n      inDouble = !inDouble;\n      wasQuoted = true;\n      continue;\n    }\n    if (ch === \"'\" && !inDouble) {\n      inSingle = !inSingle;\n      wasQuoted = true;\n      continue;\n    }\n    if ((ch === \" \" || ch === \"\\t\") && !inDouble && !inSingle) {\n      if (current.length > 0 || wasQuoted) {\n        tokens.push(current);\n      }\n      current = \"\";\n      wasQuoted = false;\n      continue;\n    }\n    current += ch;\n  }\n  if (current.length > 0 || wasQuoted) {\n    tokens.push(current);\n  }\n  return tokens;\n}\n\n/**\n * Wrap a CLI-style action (that writes to console.log) as an ActionEntry\n * by capturing stdout/stderr and intercepting process.exit. Uses the\n * shared AsyncLocalStorage-backed capture so concurrent invocations do\n * not corrupt the global `console.log` / `process.stdout.write` /\n * `process.exit` pointers (see `cli-capture.ts`).\n */\nfunction wrapDefaultExport(\n  name: string,\n  defaultFn: (args: string[]) => Promise<void>,\n): ActionEntry {\n  const tool: ActionTool = {\n    description: `Run the \"${name}\" action. Pass arguments as key-value pairs.`,\n    parameters: {\n      type: \"object\",\n      properties: {\n        args: {\n          type: \"string\",\n          description:\n            \"Space-separated CLI arguments (e.g. '--id abc --title Hello')\",\n        },\n      },\n    },\n  };\n\n  return {\n    tool,\n    run: async (args: Record<string, string>): Promise<string> => {\n      const cliArgs: string[] = [];\n      // If only an \"args\" key was provided, split it into CLI tokens\n      if (args.args && Object.keys(args).length === 1) {\n        cliArgs.push(...splitShellArgs(args.args));\n      } else {\n        for (const [k, v] of Object.entries(args)) {\n          cliArgs.push(`--${k}`, v);\n        }\n      }\n      return captureCliOutput(() => defaultFn(cliArgs));\n    },\n  };\n}\n\nfunction preserveActionFlags(entry: Record<string, any>): Partial<ActionEntry> {\n  const out: Partial<ActionEntry> = {};\n  if (typeof entry.agentTool === \"boolean\") out.agentTool = entry.agentTool;\n  if (typeof entry.readOnly === \"boolean\") out.readOnly = entry.readOnly;\n  if (typeof entry.parallelSafe === \"boolean\") {\n    out.parallelSafe = entry.parallelSafe;\n  }\n  if (typeof entry.toolCallable === \"boolean\") {\n    out.toolCallable = entry.toolCallable;\n  }\n  if (\n    entry.publicAgent &&\n    typeof entry.publicAgent === \"object\" &&\n    !Array.isArray(entry.publicAgent)\n  ) {\n    out.publicAgent = entry.publicAgent;\n  }\n  if (typeof entry.link === \"function\") {\n    out.link = entry.link;\n  }\n  if (\n    entry.mcpApp &&\n    typeof entry.mcpApp === \"object\" &&\n    !Array.isArray(entry.mcpApp)\n  ) {\n    out.mcpApp = entry.mcpApp;\n  }\n  return out;\n}\n\n/**\n * Resolve the actions directory from the caller's context.\n *\n * @param from - Either an `import.meta.url` (file:// URL from a plugin file),\n *   an absolute directory path, or \"auto\" to use `process.cwd() + \"/actions\"`.\n *   When an import.meta.url is provided, the actions directory is resolved as\n *   `../../actions/` relative to the caller (typically `server/plugins/agent-chat.ts`).\n *   If the resolved directory doesn't exist, falls back to `../../scripts/` for\n *   backwards compatibility, then to `process.cwd() + \"/actions\"`.\n */\nasync function resolveActionsDir(from: string): Promise<string> {\n  const fs = await getFs();\n  const exists = (p: string) => {\n    try {\n      return fs.existsSync(p);\n    } catch {\n      return false;\n    }\n  };\n  // On edge runtimes (e.g. Cloudflare Workers), import.meta.url may be\n  // undefined after bundling. Fall back to cwd-based discovery.\n  if (!from) {\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  if (from.startsWith(\"file://\") || from.startsWith(\"file:///\")) {\n    const callerPath = fileURLToPath(from);\n    const callerDir = nodePath.dirname(callerPath);\n    const actionsResolved = nodePath.resolve(callerDir, \"../../actions\");\n    if (exists(actionsResolved)) return actionsResolved;\n    const scriptsResolved = nodePath.resolve(callerDir, \"../../scripts\");\n    if (exists(scriptsResolved)) return scriptsResolved;\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  if (from === \"auto\") {\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  return nodePath.resolve(from);\n}\n\n/**\n * Load actions from a single directory into the given registry. Shared by\n * both the template-actions discovery path and the workspace-core actions\n * layer. When `skipExisting` is true, an entry with the same name that's\n * already in the registry is left untouched (template-wins on collision).\n */\nasync function loadActionsIntoRegistry(\n  actionsDir: string,\n  registry: Record<string, ActionEntry>,\n  skipExisting: boolean,\n): Promise<void> {\n  let files: string[];\n  try {\n    const fs = await getFs();\n    if (!fs.existsSync(actionsDir)) return;\n    files = fs.readdirSync(actionsDir);\n  } catch {\n    return;\n  }\n\n  const actionFiles = files.filter((f) => {\n    if (!isRuntimeSourceFile(f)) return false;\n    const name = f.replace(/\\.(ts|js)$/, \"\");\n    if (name.startsWith(\"_\")) return false;\n    if (SKIP_FILES.has(name)) return false;\n    return true;\n  });\n\n  for (const file of actionFiles) {\n    const name = file.replace(/\\.(ts|js)$/, \"\");\n    if (skipExisting && registry[name]) continue;\n\n    const filePath = nodePath.join(actionsDir, file);\n    try {\n      const mod = await import(/* @vite-ignore */ filePath);\n\n      if (mod.tool && typeof mod.run === \"function\") {\n        registry[name] = {\n          tool: mod.tool,\n          run: mod.run,\n          ...(mod.http !== undefined ? { http: mod.http } : {}),\n          ...preserveActionFlags(mod),\n        };\n      } else if (\n        mod.default &&\n        typeof mod.default === \"object\" &&\n        mod.default.tool &&\n        typeof mod.default.run === \"function\"\n      ) {\n        registry[name] = {\n          tool: mod.default.tool,\n          run: mod.default.run,\n          ...(mod.default.http !== undefined ? { http: mod.default.http } : {}),\n          ...preserveActionFlags(mod.default),\n        };\n      } else if (typeof mod.default === \"function\") {\n        registry[name] = wrapDefaultExport(name, mod.default);\n      }\n    } catch (err) {\n      // CLI-style scripts (top-level execution) throw on import — expected,\n      // they're available via `pnpm action <name>` / shell instead. But a\n      // syntax error, bad import, or malformed defineAction in a real action\n      // file lands here too and would silently vanish from the agent's tools.\n      // Warn so a broken action file is diagnosable instead of mysteriously\n      // missing.\n      const msg =\n        err instanceof Error ? (err.stack ?? err.message) : String(err);\n      console.warn(\n        `[action-discovery] Skipped \"${file}\" — failed to import. If this is an ` +\n          `agent action (not a CLI script), it will be missing from the agent's tools:\\n${msg}`,\n      );\n    }\n  }\n}\n\n/**\n * Normalize a pre-bundled static action registry (name → raw module) into\n * the `Record<string, ActionEntry>` shape the agent-chat plugin expects.\n *\n * Used by `autoDiscoverActions` when `.generated/actions-registry.ts` is\n * present so that Nitro-bundled serverless functions (Netlify, Vercel,\n * AWS-Lambda) can serve `/_agent-native/actions/*` routes without relying\n * on a filesystem scan that doesn't work in bundled output.\n */\nexport function loadActionsFromStaticRegistry(\n  modules: Record<string, unknown>,\n): Record<string, ActionEntry> {\n  const registry: Record<string, ActionEntry> = {};\n  for (const [name, raw] of Object.entries(modules)) {\n    const mod = raw as Record<string, any> | null | undefined;\n    if (!mod) continue;\n\n    if (mod.tool && typeof mod.run === \"function\") {\n      registry[name] = {\n        tool: mod.tool,\n        run: mod.run,\n        ...(mod.http !== undefined ? { http: mod.http } : {}),\n        ...preserveActionFlags(mod),\n      };\n      continue;\n    }\n\n    const def = mod.default;\n    if (\n      def &&\n      typeof def === \"object\" &&\n      def.tool &&\n      typeof def.run === \"function\"\n    ) {\n      registry[name] = {\n        tool: def.tool,\n        run: def.run,\n        ...(def.http !== undefined ? { http: def.http } : {}),\n        ...preserveActionFlags(def),\n      };\n      continue;\n    }\n\n    if (typeof def === \"function\") {\n      registry[name] = wrapDefaultExport(name, def);\n    }\n  }\n  return registry;\n}\n\n/**\n * Auto-discover actions from a directory.\n *\n * Merges in any actions from the enterprise workspace core (if present in\n * the ancestor chain). Template actions take precedence over workspace-core\n * actions on name collision, so an app can override an enterprise-wide\n * action by dropping a same-named file under its own `actions/`.\n *\n * Note: this helper uses a filesystem scan, which works in dev and in\n * non-bundled Node deployments. In bundled serverless functions (Nitro's\n * netlify / vercel / aws-lambda presets) the `actions/` directory is not\n * on disk at runtime; templates should pass the static registry generated\n * by the Vite plugin to `createAgentChatPlugin({ actions })` instead, so\n * the bundler sees static imports and pulls every action into the bundle.\n *\n * @param from - The caller's `import.meta.url` or an absolute path to the\n *   actions directory.\n * @returns A record mapping action names to ActionEntry objects, suitable for\n *   passing to `createAgentChatPlugin({ actions })`.\n */\nexport async function autoDiscoverActions(\n  from: string,\n): Promise<Record<string, ActionEntry>> {\n  const actionsDir = await resolveActionsDir(from);\n  const registry: Record<string, ActionEntry> = {};\n\n  // 1. Template actions first — these are the authoritative layer for the\n  //    current app and must override any workspace-core entry with the same\n  //    name.\n  try {\n    await loadActionsIntoRegistry(actionsDir, registry, false);\n  } catch (err: any) {\n    console.warn(\n      `[autoDiscoverActions] Could not read actions directory: ${actionsDir} — ${err?.message}`,\n    );\n  }\n\n  // 1b. Fallback: if filesystem discovery found no template actions (common\n  //     in bundled serverless environments like Netlify/Vercel where the\n  //     actions/ directory doesn't exist on disk), try importing the\n  //     generated static registry at .generated/actions-registry.\n  //\n  //     This prevents the silent-empty-tools footgun where the agent has no\n  //     template actions and falls back to generic tools like web-request.\n  //     Prefer `loadActionsFromStaticRegistry` over `autoDiscoverActions` for\n  //     production reliability — this fallback is a safety net, not the\n  //     primary path.\n  if (Object.keys(registry).length === 0 && from) {\n    try {\n      let registryPath: string;\n      if (from.startsWith(\"file://\") || from.startsWith(\"file:///\")) {\n        const callerDir = nodePath.dirname(fileURLToPath(from));\n        registryPath = nodePath.resolve(\n          callerDir,\n          \"../../.generated/actions-registry.js\",\n        );\n      } else {\n        registryPath = nodePath.resolve(\n          from,\n          \"../.generated/actions-registry.js\",\n        );\n      }\n      const mod = await import(/* @vite-ignore */ registryPath);\n      const staticEntries = loadActionsFromStaticRegistry(mod.default || mod);\n      Object.assign(registry, staticEntries);\n      if (Object.keys(staticEntries).length > 0) {\n        console.log(\n          `[autoDiscoverActions] Filesystem scan found 0 actions — loaded ${Object.keys(staticEntries).length} from .generated/actions-registry.ts instead. ` +\n            `Consider switching to loadActionsFromStaticRegistry(actionsRegistry) for production reliability.`,\n        );\n      }\n    } catch {\n      // No generated registry available — registry stays empty.\n    }\n  }\n\n  // If still empty after all fallbacks, warn loudly.\n  if (Object.keys(registry).length === 0) {\n    console.warn(\n      `[autoDiscoverActions] WARNING: No template actions found! ` +\n        `The agent will have no template-specific tools. ` +\n        `If in production, switch from autoDiscoverActions to loadActionsFromStaticRegistry. ` +\n        `See: https://docs.agent-native.com/actions#static-registry`,\n    );\n  }\n\n  // 1c. Package-registered actions — contributed by published packages\n  //     (e.g. @agent-native/dispatch) via `registerPackageActions()` from\n  //     import side effects. Merged with skip-existing so the template's\n  //     own actions/ files always win on name collision.\n  for (const [name, entry] of Object.entries(getPackageActions())) {\n    if (registry[name]) continue;\n    registry[name] = entry;\n  }\n\n  // 2. Workspace-core actions — merged in with skipExisting so they can't\n  //    overwrite template entries.\n  try {\n    const { getWorkspaceCoreExports } =\n      await import(\"../deploy/workspace-core.js\");\n    const ws = await getWorkspaceCoreExports(process.cwd());\n    if (ws && ws.actionsDir) {\n      await loadActionsIntoRegistry(ws.actionsDir, registry, true);\n    }\n  } catch {\n    // workspace-core discovery unavailable (e.g. edge runtime) — skip.\n  }\n\n  // 3. Framework-level sharing + file-upload actions — always available to any\n  //    template. Merged with skipExisting so templates can override by\n  //    providing a same-named file.\n  try {\n    await mergeCoreSharingActions(registry);\n  } catch {\n    // Ignore — templates without sharing still work.\n  }\n\n  return registry;\n}\n\nexport async function mergeCoreSharingActions(\n  registry: Record<string, ActionEntry>,\n): Promise<void> {\n  const entries: Array<[string, () => Promise<any>]> = [\n    [\"share-resource\", () => import(\"../sharing/actions/share-resource.js\")],\n    [\n      \"unshare-resource\",\n      () => import(\"../sharing/actions/unshare-resource.js\"),\n    ],\n    [\n      \"list-resource-shares\",\n      () => import(\"../sharing/actions/list-resource-shares.js\"),\n    ],\n    [\n      \"set-resource-visibility\",\n      () => import(\"../sharing/actions/set-resource-visibility.js\"),\n    ],\n    [\"upload-image\", () => import(\"../file-upload/actions/upload-image.js\")],\n    [\n      \"context-manifest-get\",\n      () => import(\"../agent/context-xray/actions/context-manifest-get.js\"),\n    ],\n    [\n      \"context-pin\",\n      () => import(\"../agent/context-xray/actions/context-pin.js\"),\n    ],\n    [\n      \"context-evict\",\n      () => import(\"../agent/context-xray/actions/context-evict.js\"),\n    ],\n    [\n      \"context-restore\",\n      () => import(\"../agent/context-xray/actions/context-restore.js\"),\n    ],\n    [\n      \"context-report\",\n      () => import(\"../agent/context-xray/actions/context-report.js\"),\n    ],\n    [\n      \"change-appearance\",\n      () => import(\"../appearance/actions/change-appearance.js\"),\n    ],\n    [\"toggle-demo-mode\", () => import(\"../demo/actions/toggle-demo-mode.js\")],\n    // Org service tokens (CI credentials, e.g. PLAN_RECAP_TOKEN). Mint/revoke\n    // are toolCallable:false — preserved via preserveActionFlags below.\n    [\n      \"create-org-service-token\",\n      () => import(\"../mcp/actions/create-org-service-token.js\"),\n    ],\n    [\n      \"list-org-service-tokens\",\n      () => import(\"../mcp/actions/list-org-service-tokens.js\"),\n    ],\n    [\n      \"revoke-org-service-token\",\n      () => import(\"../mcp/actions/revoke-org-service-token.js\"),\n    ],\n  ];\n  for (const [name, loader] of entries) {\n    if (registry[name]) continue;\n    try {\n      const mod = await loader();\n      const def = mod.default;\n      if (def && def.tool && typeof def.run === \"function\") {\n        registry[name] = {\n          tool: def.tool,\n          run: def.run,\n          ...(def.http !== undefined ? { http: def.http } : {}),\n          // Carry security-relevant flags (toolCallable, publicAgent, link,\n          // mcpApp) plus readOnly/parallelSafe. Without this, the sharing\n          // actions' `toolCallable: false` (audit-H5) is dropped and the\n          // tools-iframe bridge 403 in action-routes.ts never fires.\n          ...preserveActionFlags(def),\n        };\n      }\n    } catch {\n      // Skip any sharing action that fails to import.\n    }\n  }\n}\n\n/** @deprecated Use `autoDiscoverActions` instead */\nexport const autoDiscoverScripts = autoDiscoverActions;\n"]}

package/dist/server/action-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-routes.d.ts","sourceRoot":"","sources":["../../src/server/action-routes.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAkBhE,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,eAAe,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMrB;AA0HD,MAAM,WAAW,wBAAwB;IACvC,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,CACrB,KAAK,EAAE,GAAG,KACP,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD,0DAA0D;IAC1D,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACvE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,EACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACpC,OAAO,CAAC,EAAE,wBAAwB,QA+LnC"}
+{"version":3,"file":"action-routes.d.ts","sourceRoot":"","sources":["../../src/server/action-routes.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAkBhE,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,eAAe,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMrB;AA2HD,MAAM,WAAW,wBAAwB;IACvC,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,CACrB,KAAK,EAAE,GAAG,KACP,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD,0DAA0D;IAC1D,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACvE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,EACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACpC,OAAO,CAAC,EAAE,wBAAwB,QA+LnC"}

package/dist/server/action-routes.js

@@ -83,12 +83,13 @@ function isFrontendActionRequest(event) {
 function getAllowedCorsOrigin(origin) {
     const allowedOrigin = resolveAllowedCorsOrigin(origin, {
         allowedOrigins: readCorsAllowedOrigins(),
-        allowLocalhostWhenNoAllowlist: true,
+        // Let the cors-origins default apply (dev-only). Omitting this option
+        // keeps production from trusting arbitrary localhost callers.
     });
     if (allowedOrigin) {
         return { origin: allowedOrigin, credentials: true };
     }
-    if (isMcpEmbedCorsOrigin(origin)) {
+    if (origin && isMcpEmbedCorsOrigin(origin)) {
         return {
             origin,
             credentials: shouldAllowMcpEmbedCredentials(origin),

package/dist/server/action-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-routes.js","sourceRoot":"","sources":["../../src/server/action-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,SAAS,GACV,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,oBAAoB,IAAI,wBAAwB,EAChD,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AAExC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAE9C,MAAM,UAAU,uBAAuB,CACrC,YAA6B;IAE7B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA8B;IAE9B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,IAAI,IAAI;gBAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA2B,EAC3B,MAAc,EACd,KAAU;IAEV,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7C,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAU;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,KAAU;IACzC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC,KAAK,GAAG,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAOD,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACrD,cAAc,EAAE,sBAAsB,EAAE;QACxC,6BAA6B,EAAE,IAAI;KACpC,CAAC,CAAC;IACH,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,MAAM;YACN,WAAW,EAAE,8BAA8B,CAAC,MAAM,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAU;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,oBAAoB,CAC/B,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;IAEF,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,iBAAiB,CAAC,KAAK,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QACD,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;QACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,IAAI,CAAC,WAAW;YACd,CAAC,CAAC,8KAA8K,mBAAmB,EAAE;YACrM,CAAC,CAAC,GAAG,4BAA4B,4EAA4E,CAChH,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAa,EACb,OAAoC,EACpC,OAAkC;IAElC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,0BAA0B;QAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAEnC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;QAE5C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,SAAS,EACT,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,eAAe,GACnB,SAAS,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAE/D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YAEtD,4BAA4B;YAC5B,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,MAAM,GAAG,EAAE,CAAC;YACzD,CAAC;YAED,oEAAoE;YACpE,0DAA0D;YAC1D,qEAAqE;YACrE,8DAA8D;YAC9D,kDAAkD;YAClD,gEAAgE;YAChE,mEAAmE;YACnE,gEAAgE;YAChE,uCAAuC;YACvC,+DAA+D;YAC/D,oEAAoE;YACpE,+BAA+B;YAC/B,MAAM,cAAc,GAClB,SAAS,CAAC,KAAK,EAAE,4BAA4B,CAAC,KAAK,GAAG,CAAC;YACzD,IAAI,cAAc,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,WAAW,IAAI,+BAA+B;iBACtD,CAAC;YACJ,CAAC;YAED,+CAA+C;YAC/C,MAAM,SAAS,GAAG,OAAO,EAAE,iBAAiB;gBAC1C,CAAC,CAAC,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,QAAQ,GAAG,OAAO,EAAE,oBAAoB;gBAC5C,CAAC,CAAC,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;gBAC3C,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,KAAK,GAAG,OAAO,EAAE,YAAY;gBACjC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAE3C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EACxC,KAAK,IAAI,EAAE;gBACT,kEAAkE;gBAClE,qEAAqE;gBACrE,qEAAqE;gBACrE,sCAAsC;gBACtC,IAAI,MAA2B,CAAC;gBAChC,IAAI,CAAC;oBACH,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,sDAAsD;wBACtD,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC;4BAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;4BAChC,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;wBACrD,CAAC;6BAAM,CAAC;4BACN,MAAM,GAAG,sBAAsB,CAC7B,QAAQ,CAAC,KAAK,CAAwB,CACvC,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;4BAChD,6DAA6D;4BAC7D,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzD,CAAC;6BAAM,CAAC;4BACN,wCAAwC;4BACxC,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBAED,kEAAkE;gBAClE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,qEAAqE;gBACrE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,MAAM,CAAC;oBACX,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;wBACrC,SAAS;wBACT,KAAK,EAAE,KAAK,IAAI,IAAI;wBACpB,MAAM;qBACP,CAAC,CAAC;oBAEH,8DAA8D;oBAC9D,+DAA+D;oBAC/D,gEAAgE;oBAChE,8DAA8D;oBAC9D,6DAA6D;oBAC7D,qDAAqD;oBACrD,+DAA+D;oBAC/D,mEAAmE;oBACnE,gEAAgE;oBAChE,6DAA6D;oBAC7D,MAAM,UAAU,GACd,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;wBACjC,CAAC,CAAC,KAAK,CAAC,QAAQ;wBAChB,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;oBACvB,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,IAAI,CAAC;4BACH,MAAM,kBAAkB,CAAC;gCACvB,UAAU,EAAE,IAAI;gCAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC3C,CAAC,CAAC;wBACL,CAAC;wBAAC,MAAM,CAAC;4BACP,SAAS;wBACX,CAAC;oBACH,CAAC;oBAED,6EAA6E;oBAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBAC/B,IAAI,CAAC;4BACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC5B,CAAC;wBAAC,MAAM,CAAC;4BACP,OAAO,MAAM,CAAC;wBAChB,CAAC;oBACH,CAAC;oBAED,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxC,MAAM,iBAAiB,GAAG,GAAG,CAAC,UAAU,CACtC,2BAA2B,CAC5B,CAAC;oBACF,MAAM,cAAc,GAClB,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ;wBACjC,CAAC,CAAC,GAAG,CAAC,UAAU;wBAChB,CAAC,CAAC,SAAS,CAAC;oBAChB,+DAA+D;oBAC/D,sBAAsB;oBACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;oBACjE,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAEjC,kDAAkD;oBAClD,6DAA6D;oBAC7D,iEAAiE;oBACjE,8DAA8D;oBAC9D,gEAAgE;oBAChE,2DAA2D;oBAC3D,kDAAkD;oBAClD,MAAM,YAAY,GAChB,iBAAiB;wBACjB,sBAAsB,CAAC,GAAG,CAAC;wBAC3B,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC;oBACzD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;oBACxB,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC;oBAC9D,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC,CACF,CAAC,CAAC,4BAA4B;QACjC,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;QACzC,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,CAAC,MAAM,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;AACN,CAAC","sourcesContent":["/**\n * Auto-mount actions as HTTP endpoints under /_agent-native/actions/:name.\n *\n * Actions are exposed as POST by default. Use `http: { method: \"GET\" }` in\n * defineAction to expose as GET. Use `http: false` to mark as agent-only.\n */\nimport { getH3App } from \"./framework-request-handler.js\";\nimport {\n  defineEventHandler,\n  setResponseStatus,\n  setResponseHeader,\n  getMethod,\n  getQuery,\n  getHeader,\n} from \"h3\";\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport { isAgentActionStopError } from \"../action.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { notifyActionChange } from \"./action-change.js\";\nimport {\n  getAllowedCorsOrigin as resolveAllowedCorsOrigin,\n  readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\nimport { EMBED_TARGET_HEADER } from \"../shared/embed-auth.js\";\nimport {\n  isMcpEmbedCorsOrigin,\n  MCP_EMBED_CORS_ALLOW_HEADERS,\n  shouldAllowMcpEmbedCredentials,\n} from \"../shared/mcp-embed-headers.js\";\n\nconst ROUTE_PREFIX = \"/_agent-native/actions\";\n\nexport function parseActionSearchParams(\n  searchParams: URLSearchParams,\n): Record<string, any> {\n  const params: Record<string, any> = {};\n  for (const [rawKey, value] of searchParams.entries()) {\n    appendActionParam(params, rawKey, value);\n  }\n  return params;\n}\n\nfunction parseActionQueryObject(\n  query: Record<string, unknown>,\n): Record<string, any> {\n  const params: Record<string, any> = {};\n  for (const [rawKey, rawValue] of Object.entries(query)) {\n    const values = Array.isArray(rawValue) ? rawValue : [rawValue];\n    for (const value of values) {\n      if (value != null) appendActionParam(params, rawKey, String(value));\n    }\n  }\n  return params;\n}\n\nfunction appendActionParam(\n  params: Record<string, any>,\n  rawKey: string,\n  value: any,\n) {\n  const isArrayKey = rawKey.endsWith(\"[]\");\n  // The core client serializes arrays as `key[]=value` so even a single\n  // value can validate against z.array() action schemas.\n  const key = isArrayKey ? rawKey.slice(0, -2) : rawKey;\n  const current = params[key];\n  if (current === undefined) {\n    params[key] = isArrayKey ? [value] : value;\n  } else if (Array.isArray(current)) {\n    current.push(value);\n  } else {\n    params[key] = [current, value];\n  }\n}\n\n/**\n * Read the caller's IANA timezone from the `x-user-timezone` header. The core\n * client sends this on every action request so server-side \"today\" fallbacks\n * can honor the user's local day.\n */\nfunction readTimezoneHeader(event: any): string | undefined {\n  try {\n    const raw = getHeader(event, \"x-user-timezone\");\n    if (!raw || typeof raw !== \"string\") return undefined;\n    const trimmed = raw.trim();\n    return trimmed.length > 0 && trimmed.length < 64 ? trimmed : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * True when the request originated from the browser action client\n * (`useActionQuery` / `useActionMutation` / `callAction`), which tags every\n * call with `X-Agent-Native-Frontend: 1`. Used to set `ctx.caller` to\n * `\"frontend\"` vs a bare programmatic `\"http\"` POST. The header carries no\n * auth weight — it only narrows the caller tag for tracking/branching.\n */\nfunction isFrontendActionRequest(event: any): boolean {\n  try {\n    return getHeader(event, \"x-agent-native-frontend\") === \"1\";\n  } catch {\n    return false;\n  }\n}\n\ntype CorsOrigin = {\n  origin: string;\n  credentials: boolean;\n};\n\nfunction getAllowedCorsOrigin(origin: string | undefined): CorsOrigin | null {\n  const allowedOrigin = resolveAllowedCorsOrigin(origin, {\n    allowedOrigins: readCorsAllowedOrigins(),\n    allowLocalhostWhenNoAllowlist: true,\n  });\n  if (allowedOrigin) {\n    return { origin: allowedOrigin, credentials: true };\n  }\n  if (isMcpEmbedCorsOrigin(origin)) {\n    return {\n      origin,\n      credentials: shouldAllowMcpEmbedCredentials(origin),\n    };\n  }\n  return null;\n}\n\nfunction handleOptionsRequest(event: any): string {\n  const origin = getHeader(event, \"origin\");\n  const cors = getAllowedCorsOrigin(\n    typeof origin === \"string\" ? origin : undefined,\n  );\n\n  if (origin && !cors) {\n    setResponseStatus(event, 403);\n    return \"\";\n  }\n\n  if (cors) {\n    setResponseHeader(event, \"Access-Control-Allow-Origin\", cors.origin);\n    setResponseHeader(event, \"Vary\", \"Origin\");\n    if (cors.credentials) {\n      setResponseHeader(event, \"Access-Control-Allow-Credentials\", \"true\");\n    }\n    setResponseHeader(\n      event,\n      \"Access-Control-Allow-Methods\",\n      \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n    );\n    setResponseHeader(\n      event,\n      \"Access-Control-Allow-Headers\",\n      cors.credentials\n        ? `Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,${EMBED_TARGET_HEADER}`\n        : `${MCP_EMBED_CORS_ALLOW_HEADERS},X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend`,\n    );\n  }\n\n  setResponseStatus(event, 204);\n  return \"\";\n}\n\nexport interface MountActionRoutesOptions {\n  /** Resolve owner email from the H3 event (for data scoping). */\n  getOwnerFromEvent?: (event: any) => string | Promise<string>;\n  /** Resolve display name from the H3 event, when available. */\n  getUserNameFromEvent?: (\n    event: any,\n  ) => string | undefined | Promise<string | undefined>;\n  /** Resolve org ID from the H3 event (for org scoping). */\n  resolveOrgId?: (event: any) => string | null | Promise<string | null>;\n}\n\n/**\n * Mount discovered actions as HTTP endpoints.\n *\n * Only actions from `autoDiscoverActions` (template actions) are mounted.\n * Built-in actions (resource-*, chat-*, shell, etc.) are NOT passed here.\n */\nexport function mountActionRoutes(\n  nitroApp: any,\n  actions: Record<string, ActionEntry>,\n  options?: MountActionRoutesOptions,\n) {\n  const mounted: string[] = [];\n\n  for (const [name, entry] of Object.entries(actions)) {\n    // Skip agent-only actions\n    if (entry.http === false) continue;\n\n    const method = entry.http?.method ?? \"POST\";\n    const path = entry.http?.path ?? name;\n    const routePath = `${ROUTE_PREFIX}/${path}`;\n\n    getH3App(nitroApp).use(\n      routePath,\n      defineEventHandler(async (event) => {\n        const reqMethod = getMethod(event);\n        const effectiveMethod =\n          reqMethod === \"HEAD\" && method === \"GET\" ? \"GET\" : reqMethod;\n\n        if (reqMethod === \"OPTIONS\") {\n          return handleOptionsRequest(event);\n        }\n\n        setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n        // Allow the declared method\n        if (effectiveMethod !== method) {\n          setResponseStatus(event, 405);\n          return { error: `Method not allowed. Use ${method}.` };\n        }\n\n        // (audit H5) Per-action `toolCallable` opt-out for the tools-iframe\n        // bridge. The bridge tags every outbound action call with\n        // X-Agent-Native-Tool-Bridge: 1. When that header is present and the\n        // action declares `toolCallable: false`, we 403 — used by the\n        // framework's share-resource / unshare-resource /\n        // set-resource-visibility for defense-in-depth on auth-adjacent\n        // operations. Undefined defaults to allow: tools are intra-org and\n        // typically authored by trusted teammates, so the default is to\n        // trust the org-level access controls.\n        // The header is set by the parent (the React host), not by the\n        // iframe's user-authored content; sanitizeToolRequestOptions strips\n        // iframe attempts to spoof it.\n        const fromToolBridge =\n          getHeader(event, \"x-agent-native-tool-bridge\") === \"1\";\n        if (fromToolBridge && entry.toolCallable === false) {\n          setResponseStatus(event, 403);\n          return {\n            error: `Action '${name}' is not callable from tools.`,\n          };\n        }\n\n        // Resolve auth context for per-request scoping\n        const userEmail = options?.getOwnerFromEvent\n          ? await options.getOwnerFromEvent(event)\n          : undefined;\n        const userName = options?.getUserNameFromEvent\n          ? await options.getUserNameFromEvent(event)\n          : undefined;\n        const orgId = options?.resolveOrgId\n          ? ((await options.resolveOrgId(event)) ?? undefined)\n          : undefined;\n        const timezone = readTimezoneHeader(event);\n\n        return runWithRequestContext(\n          { userEmail, userName, orgId, timezone },\n          async () => {\n            // Parse params based on method. On web-standard runtimes (Netlify\n            // Functions, CF Workers), event.req IS the web Request — use .json()\n            // directly. H3's readBody fails on those runtimes because it expects\n            // a Node.js stream on event.node.req.\n            let params: Record<string, any>;\n            try {\n              if (method === \"GET\") {\n                // H3 v2: prefer web Request URL, fallback to getQuery\n                const webReq = (event as any).req;\n                if (webReq?.url) {\n                  const url = new URL(webReq.url);\n                  params = parseActionSearchParams(url.searchParams);\n                } else {\n                  params = parseActionQueryObject(\n                    getQuery(event) as Record<string, any>,\n                  );\n                }\n              } else {\n                const webReq = (event as any).req;\n                if (webReq && typeof webReq.json === \"function\") {\n                  // H3 v2: event.req is the web Request — use .json() directly\n                  params = (await webReq.json().catch(() => null)) ?? {};\n                } else {\n                  // Fallback: H3's readBody (Node.js dev)\n                  params = (await readBody(event)) ?? {};\n                }\n              }\n            } catch {\n              params = {};\n            }\n\n            // Run the action. Tag the caller: browser calls (useActionQuery /\n            // useActionMutation / callAction) send X-Agent-Native-Frontend: 1,\n            // so they become \"frontend\"; bare programmatic POSTs are \"http\".\n            // userEmail / orgId mirror the request context resolved above (do\n            // NOT inject a dev identity — leave undefined when unauthenticated).\n            try {\n              const caller = isFrontendActionRequest(event)\n                ? \"frontend\"\n                : \"http\";\n              const result = await entry.run(params, {\n                userEmail,\n                orgId: orgId ?? null,\n                caller,\n              });\n\n              // Auto-refresh the UI after a successful mutating action. GET\n              // actions and actions explicitly flagged readOnly are skipped.\n              // Other tabs' useDbSync will see source:\"action\" and invalidate\n              // their action queries. The calling tab already refetches via\n              // useActionMutation's onSuccess, so this is mainly cross-tab\n              // sync (and parity with the agent's tool-call path).\n              // Explicit entry.readOnly (true OR false) wins over the method\n              // heuristic. defineAction already auto-infers GET → readOnly=true,\n              // so for actions registered through that path entry.readOnly is\n              // always set and the fallback just guards legacy wrap paths.\n              const isReadOnly =\n                typeof entry.readOnly === \"boolean\"\n                  ? entry.readOnly\n                  : method === \"GET\";\n              if (!isReadOnly) {\n                try {\n                  await notifyActionChange({\n                    actionName: name,\n                    ...(userEmail ? { owner: userEmail } : {}),\n                  });\n                } catch {\n                  // ignore\n                }\n              }\n\n              // If the action returned a string, try to parse as JSON for a clean response\n              if (typeof result === \"string\") {\n                try {\n                  return JSON.parse(result);\n                } catch {\n                  return result;\n                }\n              }\n\n              return result;\n            } catch (err: any) {\n              const msg = err?.message ?? String(err);\n              const isValidationError = msg.startsWith(\n                \"Invalid action parameters\",\n              );\n              const explicitStatus =\n                typeof err?.statusCode === \"number\"\n                  ? err.statusCode\n                  : undefined;\n              // Return 400 for validation errors, the explicit statusCode if\n              // set, otherwise 500.\n              const status = isValidationError ? 400 : (explicitStatus ?? 500);\n              setResponseStatus(event, status);\n\n              // Only echo the raw message for known-safe cases:\n              //  - validation errors (deterministic, parameter-shape only)\n              //  - explicit user-facing errors (AgentActionStopError / fail())\n              //  - errors with an explicit statusCode < 500 (client errors)\n              // For uncategorized 500s, return a generic message and keep the\n              // real detail server-side only — it can contain DB/driver/\n              // upstream text we must not leak to HTTP callers.\n              const isUserFacing =\n                isValidationError ||\n                isAgentActionStopError(err) ||\n                (explicitStatus !== undefined && explicitStatus < 500);\n              if (isUserFacing) {\n                return { error: msg };\n              }\n              console.error(`[agent-native] action '${name}' failed:`, err);\n              return { error: \"Internal server error\" };\n            }\n          },\n        ); // end runWithRequestContext\n      }),\n    );\n\n    mounted.push(`${method} ${routePath}`);\n  }\n\n  if (mounted.length > 0 && process.env.DEBUG)\n    console.log(\n      `[action-routes] Mounted ${mounted.length} action route(s): ${mounted.join(\", \")}`,\n    );\n}\n"]}
+{"version":3,"file":"action-routes.js","sourceRoot":"","sources":["../../src/server/action-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,SAAS,GACV,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,oBAAoB,IAAI,wBAAwB,EAChD,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AAExC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAE9C,MAAM,UAAU,uBAAuB,CACrC,YAA6B;IAE7B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA8B;IAE9B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,IAAI,IAAI;gBAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA2B,EAC3B,MAAc,EACd,KAAU;IAEV,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7C,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAU;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,KAAU;IACzC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC,KAAK,GAAG,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAOD,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACrD,cAAc,EAAE,sBAAsB,EAAE;QACxC,sEAAsE;QACtE,8DAA8D;KAC/D,CAAC,CAAC;IACH,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,8BAA8B,CAAC,MAAM,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAU;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,oBAAoB,CAC/B,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;IAEF,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,iBAAiB,CAAC,KAAK,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QACD,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;QACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,IAAI,CAAC,WAAW;YACd,CAAC,CAAC,8KAA8K,mBAAmB,EAAE;YACrM,CAAC,CAAC,GAAG,4BAA4B,4EAA4E,CAChH,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAa,EACb,OAAoC,EACpC,OAAkC;IAElC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,0BAA0B;QAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAEnC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;QAE5C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,SAAS,EACT,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,eAAe,GACnB,SAAS,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAE/D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YAEtD,4BAA4B;YAC5B,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,MAAM,GAAG,EAAE,CAAC;YACzD,CAAC;YAED,oEAAoE;YACpE,0DAA0D;YAC1D,qEAAqE;YACrE,8DAA8D;YAC9D,kDAAkD;YAClD,gEAAgE;YAChE,mEAAmE;YACnE,gEAAgE;YAChE,uCAAuC;YACvC,+DAA+D;YAC/D,oEAAoE;YACpE,+BAA+B;YAC/B,MAAM,cAAc,GAClB,SAAS,CAAC,KAAK,EAAE,4BAA4B,CAAC,KAAK,GAAG,CAAC;YACzD,IAAI,cAAc,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,WAAW,IAAI,+BAA+B;iBACtD,CAAC;YACJ,CAAC;YAED,+CAA+C;YAC/C,MAAM,SAAS,GAAG,OAAO,EAAE,iBAAiB;gBAC1C,CAAC,CAAC,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,QAAQ,GAAG,OAAO,EAAE,oBAAoB;gBAC5C,CAAC,CAAC,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;gBAC3C,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,KAAK,GAAG,OAAO,EAAE,YAAY;gBACjC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAE3C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EACxC,KAAK,IAAI,EAAE;gBACT,kEAAkE;gBAClE,qEAAqE;gBACrE,qEAAqE;gBACrE,sCAAsC;gBACtC,IAAI,MAA2B,CAAC;gBAChC,IAAI,CAAC;oBACH,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,sDAAsD;wBACtD,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC;4BAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;4BAChC,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;wBACrD,CAAC;6BAAM,CAAC;4BACN,MAAM,GAAG,sBAAsB,CAC7B,QAAQ,CAAC,KAAK,CAAwB,CACvC,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;4BAChD,6DAA6D;4BAC7D,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzD,CAAC;6BAAM,CAAC;4BACN,wCAAwC;4BACxC,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBAED,kEAAkE;gBAClE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,qEAAqE;gBACrE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,MAAM,CAAC;oBACX,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;wBACrC,SAAS;wBACT,KAAK,EAAE,KAAK,IAAI,IAAI;wBACpB,MAAM;qBACP,CAAC,CAAC;oBAEH,8DAA8D;oBAC9D,+DAA+D;oBAC/D,gEAAgE;oBAChE,8DAA8D;oBAC9D,6DAA6D;oBAC7D,qDAAqD;oBACrD,+DAA+D;oBAC/D,mEAAmE;oBACnE,gEAAgE;oBAChE,6DAA6D;oBAC7D,MAAM,UAAU,GACd,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;wBACjC,CAAC,CAAC,KAAK,CAAC,QAAQ;wBAChB,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;oBACvB,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,IAAI,CAAC;4BACH,MAAM,kBAAkB,CAAC;gCACvB,UAAU,EAAE,IAAI;gCAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC3C,CAAC,CAAC;wBACL,CAAC;wBAAC,MAAM,CAAC;4BACP,SAAS;wBACX,CAAC;oBACH,CAAC;oBAED,6EAA6E;oBAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBAC/B,IAAI,CAAC;4BACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC5B,CAAC;wBAAC,MAAM,CAAC;4BACP,OAAO,MAAM,CAAC;wBAChB,CAAC;oBACH,CAAC;oBAED,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxC,MAAM,iBAAiB,GAAG,GAAG,CAAC,UAAU,CACtC,2BAA2B,CAC5B,CAAC;oBACF,MAAM,cAAc,GAClB,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ;wBACjC,CAAC,CAAC,GAAG,CAAC,UAAU;wBAChB,CAAC,CAAC,SAAS,CAAC;oBAChB,+DAA+D;oBAC/D,sBAAsB;oBACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;oBACjE,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAEjC,kDAAkD;oBAClD,6DAA6D;oBAC7D,iEAAiE;oBACjE,8DAA8D;oBAC9D,gEAAgE;oBAChE,2DAA2D;oBAC3D,kDAAkD;oBAClD,MAAM,YAAY,GAChB,iBAAiB;wBACjB,sBAAsB,CAAC,GAAG,CAAC;wBAC3B,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC;oBACzD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;oBACxB,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC;oBAC9D,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC,CACF,CAAC,CAAC,4BAA4B;QACjC,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;QACzC,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,CAAC,MAAM,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;AACN,CAAC","sourcesContent":["/**\n * Auto-mount actions as HTTP endpoints under /_agent-native/actions/:name.\n *\n * Actions are exposed as POST by default. Use `http: { method: \"GET\" }` in\n * defineAction to expose as GET. Use `http: false` to mark as agent-only.\n */\nimport { getH3App } from \"./framework-request-handler.js\";\nimport {\n  defineEventHandler,\n  setResponseStatus,\n  setResponseHeader,\n  getMethod,\n  getQuery,\n  getHeader,\n} from \"h3\";\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport { isAgentActionStopError } from \"../action.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { notifyActionChange } from \"./action-change.js\";\nimport {\n  getAllowedCorsOrigin as resolveAllowedCorsOrigin,\n  readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\nimport { EMBED_TARGET_HEADER } from \"../shared/embed-auth.js\";\nimport {\n  isMcpEmbedCorsOrigin,\n  MCP_EMBED_CORS_ALLOW_HEADERS,\n  shouldAllowMcpEmbedCredentials,\n} from \"../shared/mcp-embed-headers.js\";\n\nconst ROUTE_PREFIX = \"/_agent-native/actions\";\n\nexport function parseActionSearchParams(\n  searchParams: URLSearchParams,\n): Record<string, any> {\n  const params: Record<string, any> = {};\n  for (const [rawKey, value] of searchParams.entries()) {\n    appendActionParam(params, rawKey, value);\n  }\n  return params;\n}\n\nfunction parseActionQueryObject(\n  query: Record<string, unknown>,\n): Record<string, any> {\n  const params: Record<string, any> = {};\n  for (const [rawKey, rawValue] of Object.entries(query)) {\n    const values = Array.isArray(rawValue) ? rawValue : [rawValue];\n    for (const value of values) {\n      if (value != null) appendActionParam(params, rawKey, String(value));\n    }\n  }\n  return params;\n}\n\nfunction appendActionParam(\n  params: Record<string, any>,\n  rawKey: string,\n  value: any,\n) {\n  const isArrayKey = rawKey.endsWith(\"[]\");\n  // The core client serializes arrays as `key[]=value` so even a single\n  // value can validate against z.array() action schemas.\n  const key = isArrayKey ? rawKey.slice(0, -2) : rawKey;\n  const current = params[key];\n  if (current === undefined) {\n    params[key] = isArrayKey ? [value] : value;\n  } else if (Array.isArray(current)) {\n    current.push(value);\n  } else {\n    params[key] = [current, value];\n  }\n}\n\n/**\n * Read the caller's IANA timezone from the `x-user-timezone` header. The core\n * client sends this on every action request so server-side \"today\" fallbacks\n * can honor the user's local day.\n */\nfunction readTimezoneHeader(event: any): string | undefined {\n  try {\n    const raw = getHeader(event, \"x-user-timezone\");\n    if (!raw || typeof raw !== \"string\") return undefined;\n    const trimmed = raw.trim();\n    return trimmed.length > 0 && trimmed.length < 64 ? trimmed : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * True when the request originated from the browser action client\n * (`useActionQuery` / `useActionMutation` / `callAction`), which tags every\n * call with `X-Agent-Native-Frontend: 1`. Used to set `ctx.caller` to\n * `\"frontend\"` vs a bare programmatic `\"http\"` POST. The header carries no\n * auth weight — it only narrows the caller tag for tracking/branching.\n */\nfunction isFrontendActionRequest(event: any): boolean {\n  try {\n    return getHeader(event, \"x-agent-native-frontend\") === \"1\";\n  } catch {\n    return false;\n  }\n}\n\ntype CorsOrigin = {\n  origin: string;\n  credentials: boolean;\n};\n\nfunction getAllowedCorsOrigin(origin: string | undefined): CorsOrigin | null {\n  const allowedOrigin = resolveAllowedCorsOrigin(origin, {\n    allowedOrigins: readCorsAllowedOrigins(),\n    // Let the cors-origins default apply (dev-only). Omitting this option\n    // keeps production from trusting arbitrary localhost callers.\n  });\n  if (allowedOrigin) {\n    return { origin: allowedOrigin, credentials: true };\n  }\n  if (origin && isMcpEmbedCorsOrigin(origin)) {\n    return {\n      origin,\n      credentials: shouldAllowMcpEmbedCredentials(origin),\n    };\n  }\n  return null;\n}\n\nfunction handleOptionsRequest(event: any): string {\n  const origin = getHeader(event, \"origin\");\n  const cors = getAllowedCorsOrigin(\n    typeof origin === \"string\" ? origin : undefined,\n  );\n\n  if (origin && !cors) {\n    setResponseStatus(event, 403);\n    return \"\";\n  }\n\n  if (cors) {\n    setResponseHeader(event, \"Access-Control-Allow-Origin\", cors.origin);\n    setResponseHeader(event, \"Vary\", \"Origin\");\n    if (cors.credentials) {\n      setResponseHeader(event, \"Access-Control-Allow-Credentials\", \"true\");\n    }\n    setResponseHeader(\n      event,\n      \"Access-Control-Allow-Methods\",\n      \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n    );\n    setResponseHeader(\n      event,\n      \"Access-Control-Allow-Headers\",\n      cors.credentials\n        ? `Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,${EMBED_TARGET_HEADER}`\n        : `${MCP_EMBED_CORS_ALLOW_HEADERS},X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend`,\n    );\n  }\n\n  setResponseStatus(event, 204);\n  return \"\";\n}\n\nexport interface MountActionRoutesOptions {\n  /** Resolve owner email from the H3 event (for data scoping). */\n  getOwnerFromEvent?: (event: any) => string | Promise<string>;\n  /** Resolve display name from the H3 event, when available. */\n  getUserNameFromEvent?: (\n    event: any,\n  ) => string | undefined | Promise<string | undefined>;\n  /** Resolve org ID from the H3 event (for org scoping). */\n  resolveOrgId?: (event: any) => string | null | Promise<string | null>;\n}\n\n/**\n * Mount discovered actions as HTTP endpoints.\n *\n * Only actions from `autoDiscoverActions` (template actions) are mounted.\n * Built-in actions (resource-*, chat-*, shell, etc.) are NOT passed here.\n */\nexport function mountActionRoutes(\n  nitroApp: any,\n  actions: Record<string, ActionEntry>,\n  options?: MountActionRoutesOptions,\n) {\n  const mounted: string[] = [];\n\n  for (const [name, entry] of Object.entries(actions)) {\n    // Skip agent-only actions\n    if (entry.http === false) continue;\n\n    const method = entry.http?.method ?? \"POST\";\n    const path = entry.http?.path ?? name;\n    const routePath = `${ROUTE_PREFIX}/${path}`;\n\n    getH3App(nitroApp).use(\n      routePath,\n      defineEventHandler(async (event) => {\n        const reqMethod = getMethod(event);\n        const effectiveMethod =\n          reqMethod === \"HEAD\" && method === \"GET\" ? \"GET\" : reqMethod;\n\n        if (reqMethod === \"OPTIONS\") {\n          return handleOptionsRequest(event);\n        }\n\n        setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n        // Allow the declared method\n        if (effectiveMethod !== method) {\n          setResponseStatus(event, 405);\n          return { error: `Method not allowed. Use ${method}.` };\n        }\n\n        // (audit H5) Per-action `toolCallable` opt-out for the tools-iframe\n        // bridge. The bridge tags every outbound action call with\n        // X-Agent-Native-Tool-Bridge: 1. When that header is present and the\n        // action declares `toolCallable: false`, we 403 — used by the\n        // framework's share-resource / unshare-resource /\n        // set-resource-visibility for defense-in-depth on auth-adjacent\n        // operations. Undefined defaults to allow: tools are intra-org and\n        // typically authored by trusted teammates, so the default is to\n        // trust the org-level access controls.\n        // The header is set by the parent (the React host), not by the\n        // iframe's user-authored content; sanitizeToolRequestOptions strips\n        // iframe attempts to spoof it.\n        const fromToolBridge =\n          getHeader(event, \"x-agent-native-tool-bridge\") === \"1\";\n        if (fromToolBridge && entry.toolCallable === false) {\n          setResponseStatus(event, 403);\n          return {\n            error: `Action '${name}' is not callable from tools.`,\n          };\n        }\n\n        // Resolve auth context for per-request scoping\n        const userEmail = options?.getOwnerFromEvent\n          ? await options.getOwnerFromEvent(event)\n          : undefined;\n        const userName = options?.getUserNameFromEvent\n          ? await options.getUserNameFromEvent(event)\n          : undefined;\n        const orgId = options?.resolveOrgId\n          ? ((await options.resolveOrgId(event)) ?? undefined)\n          : undefined;\n        const timezone = readTimezoneHeader(event);\n\n        return runWithRequestContext(\n          { userEmail, userName, orgId, timezone },\n          async () => {\n            // Parse params based on method. On web-standard runtimes (Netlify\n            // Functions, CF Workers), event.req IS the web Request — use .json()\n            // directly. H3's readBody fails on those runtimes because it expects\n            // a Node.js stream on event.node.req.\n            let params: Record<string, any>;\n            try {\n              if (method === \"GET\") {\n                // H3 v2: prefer web Request URL, fallback to getQuery\n                const webReq = (event as any).req;\n                if (webReq?.url) {\n                  const url = new URL(webReq.url);\n                  params = parseActionSearchParams(url.searchParams);\n                } else {\n                  params = parseActionQueryObject(\n                    getQuery(event) as Record<string, any>,\n                  );\n                }\n              } else {\n                const webReq = (event as any).req;\n                if (webReq && typeof webReq.json === \"function\") {\n                  // H3 v2: event.req is the web Request — use .json() directly\n                  params = (await webReq.json().catch(() => null)) ?? {};\n                } else {\n                  // Fallback: H3's readBody (Node.js dev)\n                  params = (await readBody(event)) ?? {};\n                }\n              }\n            } catch {\n              params = {};\n            }\n\n            // Run the action. Tag the caller: browser calls (useActionQuery /\n            // useActionMutation / callAction) send X-Agent-Native-Frontend: 1,\n            // so they become \"frontend\"; bare programmatic POSTs are \"http\".\n            // userEmail / orgId mirror the request context resolved above (do\n            // NOT inject a dev identity — leave undefined when unauthenticated).\n            try {\n              const caller = isFrontendActionRequest(event)\n                ? \"frontend\"\n                : \"http\";\n              const result = await entry.run(params, {\n                userEmail,\n                orgId: orgId ?? null,\n                caller,\n              });\n\n              // Auto-refresh the UI after a successful mutating action. GET\n              // actions and actions explicitly flagged readOnly are skipped.\n              // Other tabs' useDbSync will see source:\"action\" and invalidate\n              // their action queries. The calling tab already refetches via\n              // useActionMutation's onSuccess, so this is mainly cross-tab\n              // sync (and parity with the agent's tool-call path).\n              // Explicit entry.readOnly (true OR false) wins over the method\n              // heuristic. defineAction already auto-infers GET → readOnly=true,\n              // so for actions registered through that path entry.readOnly is\n              // always set and the fallback just guards legacy wrap paths.\n              const isReadOnly =\n                typeof entry.readOnly === \"boolean\"\n                  ? entry.readOnly\n                  : method === \"GET\";\n              if (!isReadOnly) {\n                try {\n                  await notifyActionChange({\n                    actionName: name,\n                    ...(userEmail ? { owner: userEmail } : {}),\n                  });\n                } catch {\n                  // ignore\n                }\n              }\n\n              // If the action returned a string, try to parse as JSON for a clean response\n              if (typeof result === \"string\") {\n                try {\n                  return JSON.parse(result);\n                } catch {\n                  return result;\n                }\n              }\n\n              return result;\n            } catch (err: any) {\n              const msg = err?.message ?? String(err);\n              const isValidationError = msg.startsWith(\n                \"Invalid action parameters\",\n              );\n              const explicitStatus =\n                typeof err?.statusCode === \"number\"\n                  ? err.statusCode\n                  : undefined;\n              // Return 400 for validation errors, the explicit statusCode if\n              // set, otherwise 500.\n              const status = isValidationError ? 400 : (explicitStatus ?? 500);\n              setResponseStatus(event, status);\n\n              // Only echo the raw message for known-safe cases:\n              //  - validation errors (deterministic, parameter-shape only)\n              //  - explicit user-facing errors (AgentActionStopError / fail())\n              //  - errors with an explicit statusCode < 500 (client errors)\n              // For uncategorized 500s, return a generic message and keep the\n              // real detail server-side only — it can contain DB/driver/\n              // upstream text we must not leak to HTTP callers.\n              const isUserFacing =\n                isValidationError ||\n                isAgentActionStopError(err) ||\n                (explicitStatus !== undefined && explicitStatus < 500);\n              if (isUserFacing) {\n                return { error: msg };\n              }\n              console.error(`[agent-native] action '${name}' failed:`, err);\n              return { error: \"Internal server error\" };\n            }\n          },\n        ); // end runWithRequestContext\n      }),\n    );\n\n    mounted.push(`${method} ${routePath}`);\n  }\n\n  if (mounted.length > 0 && process.env.DEBUG)\n    console.log(\n      `[action-routes] Mounted ${mounted.length} action route(s): ${mounted.join(\", \")}`,\n    );\n}\n"]}