@agent-native/core 0.59.1 → 0.61.0

package/dist/server/builder-space.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder-space.js","sourceRoot":"","sources":["../../src/server/builder-space.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiBzC,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEtD,gFAAgF;AAChF,wEAAwE;AACxE,MAAM,4BAA4B,GAChC,6CAA6C,CAAC;AAEhD,MAAM,iBAAiB,GAAG;IACxB,MAAM;IACN,aAAa;IACb,UAAU;IACV,WAAW;IACX,OAAO;IACP,kBAAkB;CACV,CAAC;AAEX,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;AAEhE,SAAS,mBAAmB;IAC1B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,iCAAiC,CACxE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,KAAsB;IAC1D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,IAAI,uBAAuB,EAAE,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM;YAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAClB,MAA+B,EAC/B,MAAyB;IAEzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAiC;IAEjC,MAAM,QAAQ,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;IACtC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,QAAmC,CAAC;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,IAAI,IAAI,CAAC;IACxD,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB;IAElB,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,OAA4D;IAE5D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;IAC9C,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,iBAAiB;QAC/B,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,sBAAsB,CAAC;QACrE,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,MAAM,GAA0B,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,mBAAmB,EAAE,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,UAAU,EAAE;aACtC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC7D,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,iBAAiB,EAAE,MAAM;SACrD,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgC,CAAC;YACpE,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,0CAA0C;IAC5C,CAAC;YAAS,CAAC;QACT,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,eAAe,CAAC,GAAG,EAAE;QACnB,SAAS,EACP,IAAI,CAAC,GAAG,EAAE;YACV,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAClE,MAAM;KACP,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,sBAAsB;IACpC,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC","sourcesContent":["/**\n * Resolve the human-readable Builder *space* a private key is scoped to.\n *\n * There is no public-key path to a space's display name; it comes from the\n * Builder Admin GraphQL API (`https://builder.io/api/v2/admin`) authenticated\n * with the private `bpk-…` key we already hold at user scope. A `bpk-` key is\n * space-scoped, so today this resolves the single connected space — but the\n * function returns a *list* so the multi-space drill-down can grow additively\n * (multiple credentials → multiple spaces) without a restructure.\n *\n * The exact `settings` field holding the display name is undocumented, so the\n * parser is deliberately defensive: it requests the whole `settings` JSON blob\n * and pulls the first plausible name/id field. Callers fall back to the generic\n * `orgName` when this returns nothing.\n */\n\nimport { createHash } from \"node:crypto\";\n\nexport interface BuilderSpaceSummary {\n  id: string;\n  name: string;\n}\n\ninterface BuilderAdminGraphQlResponse {\n  data?: { settings?: unknown } | null;\n  errors?: Array<{ message?: string }> | null;\n}\n\ninterface SpaceCacheEntry {\n  expiresAt: number;\n  spaces: BuilderSpaceSummary[];\n}\n\n// The admin API is polled indirectly via the Builder status route, which the\n// client refetches often. Cache per key so a poll storm hits Builder once.\n// A resolved name is cached for a while; an empty/failed lookup is cached only\n// briefly so a transient Builder hiccup recovers without hammering the API.\nconst SPACE_CACHE_TTL_MS = 5 * 60 * 1000;\nconst SPACE_NEGATIVE_TTL_MS = 60 * 1000;\nconst SPACE_CACHE_MAX_ENTRIES = 100;\n// Hard cap on the admin call — the status route must never block on Builder.\nconst ADMIN_FETCH_TIMEOUT_MS = 4000;\nconst spaceCache = new Map<string, SpaceCacheEntry>();\n\n// `query { settings }` selects the whole JSONObject scalar, so we don't have to\n// know the sub-field names up front — we parse the returned blob below.\nconst BUILDER_SPACE_SETTINGS_QUERY =\n  \"query AgentNativeSpaceSettings { settings }\";\n\nconst SPACE_NAME_FIELDS = [\n  \"name\",\n  \"displayName\",\n  \"siteName\",\n  \"spaceName\",\n  \"title\",\n  \"organizationName\",\n] as const;\n\nconst SPACE_ID_FIELDS = [\"id\", \"spaceId\", \"publicKey\"] as const;\n\nfunction builderAdminApiHost() {\n  return (\n    process.env.BUILDER_ADMIN_API_HOST ?? \"https://builder.io/api/v2/admin\"\n  ).replace(/\\/+$/, \"\");\n}\n\nfunction cacheKey(privateKey: string) {\n  return createHash(\"sha256\").update(privateKey).digest(\"hex\");\n}\n\nfunction setCachedSpaces(key: string, entry: SpaceCacheEntry) {\n  if (!spaceCache.has(key) && spaceCache.size >= SPACE_CACHE_MAX_ENTRIES) {\n    const [oldest] = spaceCache.keys();\n    if (oldest) spaceCache.delete(oldest);\n  }\n  spaceCache.set(key, entry);\n}\n\nfunction firstString(\n  record: Record<string, unknown>,\n  fields: readonly string[],\n): string | null {\n  for (const field of fields) {\n    const value = record[field];\n    if (typeof value === \"string\" && value.trim()) return value.trim();\n  }\n  return null;\n}\n\nexport function parseSpacesFromSettings(\n  json: BuilderAdminGraphQlResponse,\n): BuilderSpaceSummary[] {\n  const settings = json?.data?.settings;\n  if (!settings || typeof settings !== \"object\") return [];\n  const record = settings as Record<string, unknown>;\n  const name = firstString(record, SPACE_NAME_FIELDS);\n  if (!name) return [];\n  const id = firstString(record, SPACE_ID_FIELDS) ?? name;\n  return [{ id, name }];\n}\n\n/**\n * Synchronously read the cached space list for a key, or null if there's no\n * fresh entry. The status route uses this to stay non-blocking — it returns\n * whatever is cached now and kicks `listBuilderSpaces` in the background to\n * populate the cache for the next poll.\n */\nexport function getCachedBuilderSpaces(\n  privateKey: string,\n): BuilderSpaceSummary[] | null {\n  if (!privateKey) return null;\n  const cached = spaceCache.get(cacheKey(privateKey));\n  if (cached && Date.now() < cached.expiresAt) return cached.spaces;\n  return null;\n}\n\n/**\n * List the Builder spaces reachable with this private key. Best-effort: returns\n * `[]` on any network/auth/parse failure (caller should fall back to orgName).\n */\nexport async function listBuilderSpaces(\n  privateKey: string,\n  options?: { fetchImpl?: typeof fetch; signal?: AbortSignal },\n): Promise<BuilderSpaceSummary[]> {\n  if (!privateKey) return [];\n\n  const key = cacheKey(privateKey);\n  const cached = spaceCache.get(key);\n  if (cached && Date.now() < cached.expiresAt) {\n    return cached.spaces;\n  }\n\n  const fetchImpl = options?.fetchImpl ?? fetch;\n  // Cap the admin call ourselves so a stalled Builder can't hang the status\n  // route. If the caller passed its own signal, respect it instead.\n  const timeoutController = options?.signal ? null : new AbortController();\n  const timeout = timeoutController\n    ? setTimeout(() => timeoutController.abort(), ADMIN_FETCH_TIMEOUT_MS)\n    : null;\n  let spaces: BuilderSpaceSummary[] = [];\n  try {\n    const response = await fetchImpl(builderAdminApiHost(), {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/json\",\n        authorization: `Bearer ${privateKey}`,\n      },\n      body: JSON.stringify({ query: BUILDER_SPACE_SETTINGS_QUERY }),\n      signal: options?.signal ?? timeoutController?.signal,\n    });\n    if (response.ok) {\n      const json = (await response.json()) as BuilderAdminGraphQlResponse;\n      spaces = parseSpacesFromSettings(json);\n    }\n  } catch {\n    // Network / timeout / admin API unavailable — fall through to the empty\n    // list; the caller falls back to orgName.\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n\n  // Cache a resolved name for the full TTL; cache an empty/failed lookup only\n  // briefly so a transient Builder hiccup recovers without per-poll hammering.\n  setCachedSpaces(key, {\n    expiresAt:\n      Date.now() +\n      (spaces.length > 0 ? SPACE_CACHE_TTL_MS : SPACE_NEGATIVE_TTL_MS),\n    spaces,\n  });\n  return spaces;\n}\n\n/** Test/maintenance hook — drop cached space lookups. */\nexport function clearBuilderSpaceCache() {\n  spaceCache.clear();\n}\n"]}

package/dist/server/core-routes-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAuBlC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA+CvD,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AA4DzD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,eAAO,MAAM,sBAAsB,0BAAqC,CAAC;AACzE,eAAO,MAAM,6BAA6B,+BAA0C,CAAC;AAErF,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrE;AAmBD,eAAO,MAAM,kBAAkB,QAAwC,CAAC;AA0HxE,KAAK,6BAA6B,GAAG,CACnC,KAAK,EAAE,OAAO,KACX,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjE,EACN,IAAI,CAAC,EAAE,SAAS,GAAG,UAAU,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAsD9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CASf;AAUD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;wCACoC;IACpC,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAChF,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CA0iFhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}
+{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAuBlC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA+CvD,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AA6DzD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,eAAO,MAAM,sBAAsB,0BAAqC,CAAC;AACzE,eAAO,MAAM,6BAA6B,+BAA0C,CAAC;AAErF,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrE;AAmBD,eAAO,MAAM,kBAAkB,QAAwC,CAAC;AA0HxE,KAAK,6BAA6B,GAAG,CACnC,KAAK,EAAE,OAAO,KACX,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjE,EACN,IAAI,CAAC,EAAE,SAAS,GAAG,UAAU,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAsD9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CASf;AAUD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;wCACoC;IACpC,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAChF,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CA89EhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}

package/dist/server/core-routes-plugin.js

@@ -34,6 +34,7 @@ import { validateTrackPayload } from "../tracking/route.js";
 import { registerBuiltinNotificationChannels } from "../notifications/channels.js";
 import { createNotificationsHandler } from "../notifications/routes.js";
 import { createProgressHandler } from "../progress/routes.js";
+import { createAutomationsHandler } from "../triggers/routes.js";
 import { createGoogleRealtimeSessionHandler } from "./google-realtime-session.js";
 import { createTranscribeVoiceHandler } from "./transcribe-voice.js";
 import { runWithRequestContext } from "./request-context.js";
@@ -445,6 +446,21 @@ export function createCoreRoutesPlugin(options = {}) {
             // See `csrf.ts` for the threat model and allowlist.
             const { createCsrfMiddleware } = await import("./csrf.js");
             getH3App(nitroApp).use(createCsrfMiddleware(P));
+            // Agent discovery primitive — shared by headless CLI/A2A surfaces and
+            // UI shells that need to show connected peer apps without depending on
+            // the chat route namespace.
+            getH3App(nitroApp).use(`${P}/agents`, defineEventHandler(async (event) => {
+                const method = getMethod(event);
+                if (method !== "GET") {
+                    setResponseStatus(event, 405);
+                    return { error: "Method not allowed" };
+                }
+                const query = getRequestURL(event).searchParams;
+                const selfAppId = query.get("selfAppId") ?? undefined;
+                const { discoverAgents } = await import("./agent-discovery.js");
+                const agents = await discoverAgents(selfAppId);
+                return { agents };
+            }));
             // Demo-mode status — read by the client fetch interceptor and the
             // Demo mode settings toggle. `forced` reflects the DEMO_MODE env (a
             // hosted demo deployment); `enabled` ORs that with the per-user
@@ -643,6 +659,26 @@ export function createCoreRoutesPlugin(options = {}) {
                             });
                         }
                         if (creds.privateKey && creds.publicKey) {
+                            // Best-effort: surface the real space name(s) from Builder's
+                            // Admin API. Stay NON-BLOCKING — return whatever is cached now
+                            // and refresh in the background for the next poll. Falls back
+                            // to orgName until the cache warms.
+                            let spaces;
+                            try {
+                                const { getCachedBuilderSpaces, listBuilderSpaces } = await import("./builder-space.js");
+                                const privateKey = creds.privateKey;
+                                const cachedSpaces = getCachedBuilderSpaces(privateKey);
+                                if (cachedSpaces && cachedSpaces.length > 0) {
+                                    spaces = cachedSpaces;
+                                }
+                                if (!cachedSpaces) {
+                                    // Warm the cache without blocking this response.
+                                    void listBuilderSpaces(privateKey).catch(() => { });
+                                }
+                            }
+                            catch {
+                                // Admin API helper unavailable — leave spaces undefined.
+                            }
                             return withConnectToken({
                                 ...requestStatus,
                                 configured: true,
@@ -650,6 +686,7 @@ export function createCoreRoutesPlugin(options = {}) {
                                 publicKeyConfigured: !!creds.publicKey,
                                 userId: creds.userId || envStatus.userId,
                                 orgName: creds.orgName || envStatus.orgName,
+                                spaces,
                                 orgKind: creds.orgKind || envStatus.orgKind,
                                 subscription: creds.subscription || envStatus.subscription || undefined,
                                 subscriptionLevel: creds.subscriptionLevel ||
@@ -1982,105 +2019,9 @@ export function createCoreRoutesPlugin(options = {}) {
             getH3App(nitroApp).use(`${P}/runs`, createProgressHandler());
             // ─── Automations API ──────────────────────────────────────────────
             // GET  /_agent-native/automations — list all automations (parsed triggers)
+            // PATCH /_agent-native/automations — enable/disable a jobs/*.md automation
             // POST /_agent-native/automations/fire-test — emit test.event.fired
-            getH3App(nitroApp).use(`${P}/automations`, defineEventHandler(async (event) => {
-                const method = getMethod(event);
-                const pathname = (event.path || event.url?.pathname || "")
-                    .split("?")[0]
-                    .replace(/^\/+/, "")
-                    .replace(/\/+$/, "");
-                // Auth check applies to every method. Without this, any anonymous
-                // caller could `POST /fire-test` to emit unowned events that fan
-                // out across every tenant's matching trigger (the dispatcher
-                // short-circuits its owner check when `eventMeta.owner` is
-                // undefined). See audit 12 / fire-test finding.
-                const session = await getSession(event).catch(() => null);
-                if (!session?.email) {
-                    setResponseStatus(event, 401);
-                    return { error: "Unauthenticated" };
-                }
-                if ((pathname === "fire-test" || pathname.endsWith("/fire-test")) &&
-                    method === "POST") {
-                    try {
-                        const { emit } = await import("../event-bus/index.js");
-                        const body = (await readBody(event).catch(() => ({})));
-                        // Scope the test event to the current user so only their
-                        // automations fire, not those owned by other tenants.
-                        emit("test.event.fired", { data: body.data ?? {} }, {
-                            owner: session.email,
-                        });
-                        return { ok: true };
-                    }
-                    catch (err) {
-                        setResponseStatus(event, 500);
-                        return { error: err?.message ?? "Failed to emit test event" };
-                    }
-                }
-                if (method !== "GET") {
-                    setResponseStatus(event, 405);
-                    return { error: "Method not allowed" };
-                }
-                try {
-                    const owner = session.email;
-                    const { resourceListAllOwners, SHARED_OWNER } = await import("../resources/store.js");
-                    const allResources = await resourceListAllOwners("jobs/");
-                    const resources = allResources.filter((r) => r.owner === owner || r.owner === SHARED_OWNER);
-                    const FRONT_RE = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/;
-                    const automations = resources
-                        .filter((r) => r.path.endsWith(".md") && !r.path.endsWith(".keep"))
-                        .map((r) => {
-                        const match = r.content.match(FRONT_RE);
-                        if (!match)
-                            return {
-                                id: r.id,
-                                name: r.path.replace(/^jobs\//, "").replace(/\.md$/, ""),
-                                path: r.path,
-                                owner: r.owner,
-                                triggerType: "schedule",
-                                enabled: false,
-                                mode: "agentic",
-                                body: r.content,
-                            };
-                        const yaml = match[1];
-                        const body = match[2].trim();
-                        const meta = {};
-                        for (const line of yaml.split("\n")) {
-                            const ci = line.indexOf(":");
-                            if (ci === -1)
-                                continue;
-                            const k = line.slice(0, ci).trim();
-                            let v = line.slice(ci + 1).trim();
-                            if ((v.startsWith('"') && v.endsWith('"')) ||
-                                (v.startsWith("'") && v.endsWith("'")))
-                                v = v.slice(1, -1);
-                            meta[k] = v;
-                        }
-                        return {
-                            id: r.id,
-                            name: r.path.replace(/^jobs\//, "").replace(/\.md$/, ""),
-                            path: r.path,
-                            owner: r.owner,
-                            triggerType: meta.triggerType || "schedule",
-                            event: meta.event,
-                            schedule: meta.schedule,
-                            condition: meta.condition,
-                            mode: meta.mode || "agentic",
-                            domain: meta.domain,
-                            enabled: meta.enabled !== "false",
-                            lastStatus: meta.lastStatus,
-                            lastRun: meta.lastRun,
-                            lastError: meta.lastError,
-                            createdBy: meta.createdBy,
-                            body,
-                        };
-                    });
-                    return automations;
-                }
-                catch (err) {
-                    setResponseStatus(event, 500);
-                    return { error: err?.message ?? "Failed to list automations" };
-                }
-            }));
+            getH3App(nitroApp).use(`${P}/automations`, createAutomationsHandler());
             // ─── Application State CRUD ──────────────────────────────────────
             // Auto-mounted so templates don't need boilerplate route files.
             // ─── User-scoped settings store ────────────────────────────────────