@agent-native/core 0.72.2 → 0.72.4

package/dist/embedding/bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/embedding/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,0BAA0B,EAC1B,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AAoDvB,SAAS,mBAAmB,CAAC,GAAW,EAAE,QAAiB;IACzD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,cAAc,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,MAAqB,EACrB,YAA2B,EAC3B,QAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAoC,EAAE;IAEtC,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,CAAC,YAAY,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,YAAY,GAAG,CAAC,QAAkC,EAAE,EAAE,CAC1D,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAE1E,MAAM,QAAQ,GAAG,CAAC,KAAmB,EAAE,EAAE;QACvC,IAAI,SAAS;YAAE,OAAO;QACtB,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC;YAAE,OAAO;QACtE,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO;QAEpD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QAC5B,IAAI,QAAQ,CAAC,IAAI,KAAK,gCAAgC,CAAC,QAAQ,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YACrC,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,KAAK,CAAC,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,gCAAgC,CAAC,KAAK,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YACrC,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,KAAK,CAAC,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,oBAAoB,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO;QAC3B,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK;SAC4B,CAAC;QAEpC,IAAI,QAAQ,CAAC,IAAI,KAAK,gCAAgC,CAAC,OAAO,EAAE,CAAC;YAC/D,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;iBAC1C,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,YAAY,CACV,8BAA8B,CAC5B,gCAAgC,CAAC,QAAQ,EACzC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,CAC3C,CACF,CAAC;YACJ,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,YAAY,CACV,8BAA8B,CAC5B,gCAAgC,CAAC,KAAK,EACtC;oBACE,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAClC,CACF,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACL,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,gCAAgC,CAAC,OAAO,EAAE,CAAC;YAC/D,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE1C,OAAO;QACL,YAAY;QACZ,WAAW,CAAC,IAAI,EAAE,OAAO;YACvB,OAAO,YAAY,CACjB,8BAA8B,CAC5B,gCAAgC,CAAC,OAAO,EACxC,EAAE,IAAI,EAAE,OAAO,EAAE,CAClB,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CACL,IAAY,EACZ,OAAkB,EAClB,cAAuC;YAEvC,MAAM,SAAS,GAAG,0BAA0B,EAAE,CAAC;YAC/C,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC9C,MAAM,SAAS,GAAG,cAAc,EAAE,SAAS,IAAI,MAAM,CAAC;gBACtD,MAAM,KAAK,GACT,SAAS,GAAG,CAAC;oBACX,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;wBACd,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;wBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC/D,CAAC,EAAE,SAAS,CAAC;oBACf,CAAC,CAAC,SAAS,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE;oBACrB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAgB,CAAC;oBAC7C,MAAM;oBACN,KAAK;iBACN,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,YAAY,CACzB,8BAA8B,CAC5B,gCAAgC,CAAC,OAAO,EACxC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAC7B,CACF,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC1B,IAAI,KAAK;wBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;oBAC/B,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO;YACX,OAAO,YAAY,CACjB,8BAA8B,CAAC,gCAAgC,CAAC,KAAK,EAAE;gBACrE,OAAO;aACR,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,OAAO;YACX,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO;YACL,SAAS,GAAG,IAAI,CAAC;YACjB,GAAG,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3C,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,OAAkB,EAClB,UAGI,EAAE;IAEN,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO,YAAY,CACjB,GAAG,EACH,OAAO,CAAC,YAAY,IAAI,IAAI,EAC5B,YAAY,EACZ,8BAA8B,CAAC,gCAAgC,CAAC,OAAO,EAAE;QACvE,IAAI;QACJ,OAAO;KACR,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAkB,EAClB,UAGI,EAAE;IAEN,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO,YAAY,CACjB,GAAG,EACH,OAAO,CAAC,YAAY,IAAI,IAAI,EAC5B,YAAY,EACZ,8BAA8B,CAAC,gCAAgC,CAAC,KAAK,EAAE;QACrE,OAAO;KACR,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  AGENT_NATIVE_EMBED_MESSAGE_TYPES,\n  createAgentNativeEmbedEnvelope,\n  createEmbeddedAppRequestId,\n  embeddedAppOrigin,\n  isAgentNativeEmbedEnvelope,\n  isAllowedEmbeddedAppOrigin,\n  messageErrorPayload,\n  type AgentNativeEmbedEnvelope,\n} from \"./protocol.js\";\n\nexport interface EmbeddedAppMessageEvent<TPayload = unknown> {\n  name: string;\n  payload: TPayload;\n  event: MessageEvent;\n}\n\nexport type EmbeddedAppMessageHandler = (\n  message: EmbeddedAppMessageEvent,\n) => void;\n\nexport type EmbeddedAppRequestHandler = (\n  message: EmbeddedAppMessageEvent,\n) => unknown | Promise<unknown>;\n\nexport interface EmbeddedAppBridgeOptions {\n  /**\n   * Exact parent origin to post back to. Defaults to document.referrer's\n   * origin when available. If no origin can be resolved, sends fail closed.\n   */\n  parentOrigin?: string;\n  /**\n   * Origins allowed to send messages to the embedded app. Defaults to the\n   * resolved parent origin.\n   */\n  allowedOrigins?: string[];\n  onMessage?: EmbeddedAppMessageHandler;\n  onRequest?: EmbeddedAppRequestHandler;\n  targetWindow?: Window | null;\n  currentWindow?: Window;\n}\n\nexport interface EmbeddedAppBridge {\n  parentOrigin: string | null;\n  postMessage<TPayload = unknown>(name: string, payload?: TPayload): boolean;\n  request<TResult = unknown, TPayload = unknown>(\n    name: string,\n    payload?: TPayload,\n    options?: { timeoutMs?: number },\n  ): Promise<TResult>;\n  ready<TPayload = unknown>(payload?: TPayload): boolean;\n  close<TPayload = unknown>(payload?: TPayload): boolean;\n  destroy(): void;\n}\n\ntype PendingRequest = {\n  resolve: (value: unknown) => void;\n  reject: (error: Error) => void;\n  timer: ReturnType<typeof setTimeout> | undefined;\n};\n\nfunction resolveParentOrigin(win: Window, explicit?: string): string | null {\n  if (explicit) return explicit;\n  const referrerOrigin = embeddedAppOrigin(win.document?.referrer ?? \"\");\n  return referrerOrigin;\n}\n\nfunction postToParent(\n  win: Window,\n  parent: Window | null,\n  parentOrigin: string | null,\n  envelope: AgentNativeEmbedEnvelope,\n): boolean {\n  const target = parent ?? (win.parent === win ? null : win.parent);\n  if (!parentOrigin) return false;\n  if (!target) return false;\n  target.postMessage(envelope, parentOrigin);\n  return true;\n}\n\nexport function createEmbeddedAppBridge(\n  options: EmbeddedAppBridgeOptions = {},\n): EmbeddedAppBridge {\n  const win = options.currentWindow ?? window;\n  const parentOrigin = resolveParentOrigin(win, options.parentOrigin);\n  const allowedOrigins =\n    options.allowedOrigins ??\n    (parentOrigin && parentOrigin !== \"*\" ? [parentOrigin] : []);\n  const pending = new Map<string, PendingRequest>();\n  let destroyed = false;\n\n  const postEnvelope = (envelope: AgentNativeEmbedEnvelope) =>\n    postToParent(win, options.targetWindow ?? null, parentOrigin, envelope);\n\n  const listener = (event: MessageEvent) => {\n    if (destroyed) return;\n    if (!isAllowedEmbeddedAppOrigin(event.origin, allowedOrigins)) return;\n    if (!isAgentNativeEmbedEnvelope(event.data)) return;\n\n    const envelope = event.data;\n    if (envelope.type === AGENT_NATIVE_EMBED_MESSAGE_TYPES.RESPONSE) {\n      const requestId = envelope.requestId;\n      if (!requestId) return;\n      const entry = pending.get(requestId);\n      if (!entry) return;\n      pending.delete(requestId);\n      if (entry.timer) clearTimeout(entry.timer);\n      entry.resolve(envelope.payload);\n      return;\n    }\n\n    if (envelope.type === AGENT_NATIVE_EMBED_MESSAGE_TYPES.ERROR) {\n      const requestId = envelope.requestId;\n      if (!requestId) return;\n      const entry = pending.get(requestId);\n      if (!entry) return;\n      pending.delete(requestId);\n      if (entry.timer) clearTimeout(entry.timer);\n      entry.reject(new Error(envelope.error?.message ?? \"Embedded app error\"));\n      return;\n    }\n\n    if (!envelope.name) return;\n    const message = {\n      name: envelope.name,\n      payload: envelope.payload,\n      event,\n    } satisfies EmbeddedAppMessageEvent;\n\n    if (envelope.type === AGENT_NATIVE_EMBED_MESSAGE_TYPES.REQUEST) {\n      Promise.resolve(options.onRequest?.(message))\n        .then((payload) => {\n          postEnvelope(\n            createAgentNativeEmbedEnvelope(\n              AGENT_NATIVE_EMBED_MESSAGE_TYPES.RESPONSE,\n              { requestId: envelope.requestId, payload },\n            ),\n          );\n        })\n        .catch((error) => {\n          postEnvelope(\n            createAgentNativeEmbedEnvelope(\n              AGENT_NATIVE_EMBED_MESSAGE_TYPES.ERROR,\n              {\n                requestId: envelope.requestId,\n                error: messageErrorPayload(error),\n              },\n            ),\n          );\n        });\n      return;\n    }\n\n    if (envelope.type === AGENT_NATIVE_EMBED_MESSAGE_TYPES.MESSAGE) {\n      options.onMessage?.(message);\n    }\n  };\n\n  win.addEventListener(\"message\", listener);\n\n  return {\n    parentOrigin,\n    postMessage(name, payload) {\n      return postEnvelope(\n        createAgentNativeEmbedEnvelope(\n          AGENT_NATIVE_EMBED_MESSAGE_TYPES.MESSAGE,\n          { name, payload },\n        ),\n      );\n    },\n    request<TResult = unknown, TPayload = unknown>(\n      name: string,\n      payload?: TPayload,\n      requestOptions?: { timeoutMs?: number },\n    ) {\n      const requestId = createEmbeddedAppRequestId();\n      return new Promise<TResult>((resolve, reject) => {\n        const timeoutMs = requestOptions?.timeoutMs ?? 30_000;\n        const timer =\n          timeoutMs > 0\n            ? setTimeout(() => {\n                pending.delete(requestId);\n                reject(new Error(`Embedded app request timed out: ${name}`));\n              }, timeoutMs)\n            : undefined;\n        pending.set(requestId, {\n          resolve: (value) => resolve(value as TResult),\n          reject,\n          timer,\n        });\n        const posted = postEnvelope(\n          createAgentNativeEmbedEnvelope(\n            AGENT_NATIVE_EMBED_MESSAGE_TYPES.REQUEST,\n            { name, payload, requestId },\n          ),\n        );\n        if (!posted) {\n          pending.delete(requestId);\n          if (timer) clearTimeout(timer);\n          reject(new Error(\"Embedded app parent window is not available\"));\n        }\n      });\n    },\n    ready(payload) {\n      return postEnvelope(\n        createAgentNativeEmbedEnvelope(AGENT_NATIVE_EMBED_MESSAGE_TYPES.READY, {\n          payload,\n        }),\n      );\n    },\n    close(payload) {\n      return this.postMessage(\"close\", payload);\n    },\n    destroy() {\n      destroyed = true;\n      win.removeEventListener(\"message\", listener);\n      for (const entry of pending.values()) {\n        if (entry.timer) clearTimeout(entry.timer);\n        entry.reject(new Error(\"Embedded app bridge destroyed\"));\n      }\n      pending.clear();\n    },\n  };\n}\n\nexport function sendEmbeddedAppMessage<TPayload = unknown>(\n  name: string,\n  payload?: TPayload,\n  options: Pick<\n    EmbeddedAppBridgeOptions,\n    \"currentWindow\" | \"parentOrigin\" | \"targetWindow\"\n  > = {},\n): boolean {\n  const win = options.currentWindow ?? window;\n  const parentOrigin = resolveParentOrigin(win, options.parentOrigin);\n  return postToParent(\n    win,\n    options.targetWindow ?? null,\n    parentOrigin,\n    createAgentNativeEmbedEnvelope(AGENT_NATIVE_EMBED_MESSAGE_TYPES.MESSAGE, {\n      name,\n      payload,\n    }),\n  );\n}\n\nexport function announceEmbeddedAppReady<TPayload = unknown>(\n  payload?: TPayload,\n  options: Pick<\n    EmbeddedAppBridgeOptions,\n    \"currentWindow\" | \"parentOrigin\" | \"targetWindow\"\n  > = {},\n): boolean {\n  const win = options.currentWindow ?? window;\n  const parentOrigin = resolveParentOrigin(win, options.parentOrigin);\n  return postToParent(\n    win,\n    options.targetWindow ?? null,\n    parentOrigin,\n    createAgentNativeEmbedEnvelope(AGENT_NATIVE_EMBED_MESSAGE_TYPES.READY, {\n      payload,\n    }),\n  );\n}\n"]}
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/embedding/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,0BAA0B,EAC1B,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AAoDvB,SAAS,mBAAmB,CAAC,GAAW,EAAE,QAAiB;IACzD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,2BAA2B,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjD,MAAM,cAAc,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC/D,OAAO,CACL,UAAU,KAAK,GAAG;YAClB,UAAU,KAAK,MAAM;YACrB,SAAS,KAAK,GAAG;YACjB,SAAS,KAAK,MAAM,CACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,YAA2B,EAC3B,cAA6B;IAE7B,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,YAAY,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,MAAqB,EACrB,YAA2B,EAC3B,QAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAoC,EAAE;IAEtC,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,YAAY,GAAG,CAAC,QAAkC,EAAE,EAAE,CAC1D,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAE1E,MAAM,QAAQ,GAAG,CAAC,KAAmB,EAAE,EAAE;QACvC,IAAI,SAAS;YAAE,OAAO;QACtB,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC;YAAE,OAAO;QACtE,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO;QAEpD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QAC5B,IAAI,QAAQ,CAAC,IAAI,KAAK,gCAAgC,CAAC,QAAQ,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YACrC,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,KAAK,CAAC,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,gCAAgC,CAAC,KAAK,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YACrC,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,KAAK,CAAC,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,oBAAoB,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO;QAC3B,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK;SAC4B,CAAC;QAEpC,IAAI,QAAQ,CAAC,IAAI,KAAK,gCAAgC,CAAC,OAAO,EAAE,CAAC;YAC/D,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;iBAC1C,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,YAAY,CACV,8BAA8B,CAC5B,gCAAgC,CAAC,QAAQ,EACzC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,CAC3C,CACF,CAAC;YACJ,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,YAAY,CACV,8BAA8B,CAC5B,gCAAgC,CAAC,KAAK,EACtC;oBACE,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAClC,CACF,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACL,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,gCAAgC,CAAC,OAAO,EAAE,CAAC;YAC/D,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE1C,OAAO;QACL,YAAY;QACZ,WAAW,CAAC,IAAI,EAAE,OAAO;YACvB,OAAO,YAAY,CACjB,8BAA8B,CAC5B,gCAAgC,CAAC,OAAO,EACxC,EAAE,IAAI,EAAE,OAAO,EAAE,CAClB,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CACL,IAAY,EACZ,OAAkB,EAClB,cAAuC;YAEvC,MAAM,SAAS,GAAG,0BAA0B,EAAE,CAAC;YAC/C,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC9C,MAAM,SAAS,GAAG,cAAc,EAAE,SAAS,IAAI,MAAM,CAAC;gBACtD,MAAM,KAAK,GACT,SAAS,GAAG,CAAC;oBACX,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;wBACd,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;wBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC/D,CAAC,EAAE,SAAS,CAAC;oBACf,CAAC,CAAC,SAAS,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE;oBACrB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAgB,CAAC;oBAC7C,MAAM;oBACN,KAAK;iBACN,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,YAAY,CACzB,8BAA8B,CAC5B,gCAAgC,CAAC,OAAO,EACxC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAC7B,CACF,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC1B,IAAI,KAAK;wBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;oBAC/B,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO;YACX,OAAO,YAAY,CACjB,8BAA8B,CAAC,gCAAgC,CAAC,KAAK,EAAE;gBACrE,OAAO;aACR,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,OAAO;YACX,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO;YACL,SAAS,GAAG,IAAI,CAAC;YACjB,GAAG,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3C,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,OAAkB,EAClB,UAGI,EAAE;IAEN,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO,YAAY,CACjB,GAAG,EACH,OAAO,CAAC,YAAY,IAAI,IAAI,EAC5B,YAAY,EACZ,8BAA8B,CAAC,gCAAgC,CAAC,OAAO,EAAE;QACvE,IAAI;QACJ,OAAO;KACR,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAkB,EAClB,UAGI,EAAE;IAEN,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO,YAAY,CACjB,GAAG,EACH,OAAO,CAAC,YAAY,IAAI,IAAI,EAC5B,YAAY,EACZ,8BAA8B,CAAC,gCAAgC,CAAC,KAAK,EAAE;QACrE,OAAO;KACR,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  MCP_APP_CHAT_BRIDGE_QUERY_PARAM,\n  EMBED_MODE_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\nimport {\n  AGENT_NATIVE_EMBED_MESSAGE_TYPES,\n  createAgentNativeEmbedEnvelope,\n  createEmbeddedAppRequestId,\n  embeddedAppOrigin,\n  isAgentNativeEmbedEnvelope,\n  isAllowedEmbeddedAppOrigin,\n  messageErrorPayload,\n  type AgentNativeEmbedEnvelope,\n} from \"./protocol.js\";\n\nexport interface EmbeddedAppMessageEvent<TPayload = unknown> {\n  name: string;\n  payload: TPayload;\n  event: MessageEvent;\n}\n\nexport type EmbeddedAppMessageHandler = (\n  message: EmbeddedAppMessageEvent,\n) => void;\n\nexport type EmbeddedAppRequestHandler = (\n  message: EmbeddedAppMessageEvent,\n) => unknown | Promise<unknown>;\n\nexport interface EmbeddedAppBridgeOptions {\n  /**\n   * Exact parent origin to post back to. Defaults to document.referrer's\n   * origin when available. If no origin can be resolved, sends fail closed.\n   */\n  parentOrigin?: string;\n  /**\n   * Origins allowed to send messages to the embedded app. Defaults to the\n   * resolved parent origin.\n   */\n  allowedOrigins?: string[];\n  onMessage?: EmbeddedAppMessageHandler;\n  onRequest?: EmbeddedAppRequestHandler;\n  targetWindow?: Window | null;\n  currentWindow?: Window;\n}\n\nexport interface EmbeddedAppBridge {\n  parentOrigin: string | null;\n  postMessage<TPayload = unknown>(name: string, payload?: TPayload): boolean;\n  request<TResult = unknown, TPayload = unknown>(\n    name: string,\n    payload?: TPayload,\n    options?: { timeoutMs?: number },\n  ): Promise<TResult>;\n  ready<TPayload = unknown>(payload?: TPayload): boolean;\n  close<TPayload = unknown>(payload?: TPayload): boolean;\n  destroy(): void;\n}\n\ntype PendingRequest = {\n  resolve: (value: unknown) => void;\n  reject: (error: Error) => void;\n  timer: ReturnType<typeof setTimeout> | undefined;\n};\n\nfunction resolveParentOrigin(win: Window, explicit?: string): string | null {\n  if (explicit) return explicit;\n  if (shouldUseOpaqueParentTarget(win)) return \"*\";\n  const referrerOrigin = embeddedAppOrigin(win.document?.referrer ?? \"\");\n  return referrerOrigin;\n}\n\nfunction shouldUseOpaqueParentTarget(win: Window): boolean {\n  try {\n    const url = new URL(win.location.href);\n    const chatBridge = url.searchParams.get(MCP_APP_CHAT_BRIDGE_QUERY_PARAM);\n    const embedMode = url.searchParams.get(EMBED_MODE_QUERY_PARAM);\n    return (\n      chatBridge === \"1\" ||\n      chatBridge === \"true\" ||\n      embedMode === \"1\" ||\n      embedMode === \"true\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction defaultAllowedOrigins(\n  parentOrigin: string | null,\n  referrerOrigin: string | null,\n): string[] {\n  if (!parentOrigin) return [];\n  if (parentOrigin === \"*\") {\n    return [\"null\", ...(referrerOrigin ? [referrerOrigin] : [])];\n  }\n  return [parentOrigin];\n}\n\nfunction postToParent(\n  win: Window,\n  parent: Window | null,\n  parentOrigin: string | null,\n  envelope: AgentNativeEmbedEnvelope,\n): boolean {\n  const target = parent ?? (win.parent === win ? null : win.parent);\n  if (!parentOrigin) return false;\n  if (!target) return false;\n  target.postMessage(envelope, parentOrigin);\n  return true;\n}\n\nexport function createEmbeddedAppBridge(\n  options: EmbeddedAppBridgeOptions = {},\n): EmbeddedAppBridge {\n  const win = options.currentWindow ?? window;\n  const parentOrigin = resolveParentOrigin(win, options.parentOrigin);\n  const referrerOrigin = embeddedAppOrigin(win.document?.referrer ?? \"\");\n  const allowedOrigins =\n    options.allowedOrigins ??\n    defaultAllowedOrigins(parentOrigin, referrerOrigin);\n  const pending = new Map<string, PendingRequest>();\n  let destroyed = false;\n\n  const postEnvelope = (envelope: AgentNativeEmbedEnvelope) =>\n    postToParent(win, options.targetWindow ?? null, parentOrigin, envelope);\n\n  const listener = (event: MessageEvent) => {\n    if (destroyed) return;\n    if (!isAllowedEmbeddedAppOrigin(event.origin, allowedOrigins)) return;\n    if (!isAgentNativeEmbedEnvelope(event.data)) return;\n\n    const envelope = event.data;\n    if (envelope.type === AGENT_NATIVE_EMBED_MESSAGE_TYPES.RESPONSE) {\n      const requestId = envelope.requestId;\n      if (!requestId) return;\n      const entry = pending.get(requestId);\n      if (!entry) return;\n      pending.delete(requestId);\n      if (entry.timer) clearTimeout(entry.timer);\n      entry.resolve(envelope.payload);\n      return;\n    }\n\n    if (envelope.type === AGENT_NATIVE_EMBED_MESSAGE_TYPES.ERROR) {\n      const requestId = envelope.requestId;\n      if (!requestId) return;\n      const entry = pending.get(requestId);\n      if (!entry) return;\n      pending.delete(requestId);\n      if (entry.timer) clearTimeout(entry.timer);\n      entry.reject(new Error(envelope.error?.message ?? \"Embedded app error\"));\n      return;\n    }\n\n    if (!envelope.name) return;\n    const message = {\n      name: envelope.name,\n      payload: envelope.payload,\n      event,\n    } satisfies EmbeddedAppMessageEvent;\n\n    if (envelope.type === AGENT_NATIVE_EMBED_MESSAGE_TYPES.REQUEST) {\n      Promise.resolve(options.onRequest?.(message))\n        .then((payload) => {\n          postEnvelope(\n            createAgentNativeEmbedEnvelope(\n              AGENT_NATIVE_EMBED_MESSAGE_TYPES.RESPONSE,\n              { requestId: envelope.requestId, payload },\n            ),\n          );\n        })\n        .catch((error) => {\n          postEnvelope(\n            createAgentNativeEmbedEnvelope(\n              AGENT_NATIVE_EMBED_MESSAGE_TYPES.ERROR,\n              {\n                requestId: envelope.requestId,\n                error: messageErrorPayload(error),\n              },\n            ),\n          );\n        });\n      return;\n    }\n\n    if (envelope.type === AGENT_NATIVE_EMBED_MESSAGE_TYPES.MESSAGE) {\n      options.onMessage?.(message);\n    }\n  };\n\n  win.addEventListener(\"message\", listener);\n\n  return {\n    parentOrigin,\n    postMessage(name, payload) {\n      return postEnvelope(\n        createAgentNativeEmbedEnvelope(\n          AGENT_NATIVE_EMBED_MESSAGE_TYPES.MESSAGE,\n          { name, payload },\n        ),\n      );\n    },\n    request<TResult = unknown, TPayload = unknown>(\n      name: string,\n      payload?: TPayload,\n      requestOptions?: { timeoutMs?: number },\n    ) {\n      const requestId = createEmbeddedAppRequestId();\n      return new Promise<TResult>((resolve, reject) => {\n        const timeoutMs = requestOptions?.timeoutMs ?? 30_000;\n        const timer =\n          timeoutMs > 0\n            ? setTimeout(() => {\n                pending.delete(requestId);\n                reject(new Error(`Embedded app request timed out: ${name}`));\n              }, timeoutMs)\n            : undefined;\n        pending.set(requestId, {\n          resolve: (value) => resolve(value as TResult),\n          reject,\n          timer,\n        });\n        const posted = postEnvelope(\n          createAgentNativeEmbedEnvelope(\n            AGENT_NATIVE_EMBED_MESSAGE_TYPES.REQUEST,\n            { name, payload, requestId },\n          ),\n        );\n        if (!posted) {\n          pending.delete(requestId);\n          if (timer) clearTimeout(timer);\n          reject(new Error(\"Embedded app parent window is not available\"));\n        }\n      });\n    },\n    ready(payload) {\n      return postEnvelope(\n        createAgentNativeEmbedEnvelope(AGENT_NATIVE_EMBED_MESSAGE_TYPES.READY, {\n          payload,\n        }),\n      );\n    },\n    close(payload) {\n      return this.postMessage(\"close\", payload);\n    },\n    destroy() {\n      destroyed = true;\n      win.removeEventListener(\"message\", listener);\n      for (const entry of pending.values()) {\n        if (entry.timer) clearTimeout(entry.timer);\n        entry.reject(new Error(\"Embedded app bridge destroyed\"));\n      }\n      pending.clear();\n    },\n  };\n}\n\nexport function sendEmbeddedAppMessage<TPayload = unknown>(\n  name: string,\n  payload?: TPayload,\n  options: Pick<\n    EmbeddedAppBridgeOptions,\n    \"currentWindow\" | \"parentOrigin\" | \"targetWindow\"\n  > = {},\n): boolean {\n  const win = options.currentWindow ?? window;\n  const parentOrigin = resolveParentOrigin(win, options.parentOrigin);\n  return postToParent(\n    win,\n    options.targetWindow ?? null,\n    parentOrigin,\n    createAgentNativeEmbedEnvelope(AGENT_NATIVE_EMBED_MESSAGE_TYPES.MESSAGE, {\n      name,\n      payload,\n    }),\n  );\n}\n\nexport function announceEmbeddedAppReady<TPayload = unknown>(\n  payload?: TPayload,\n  options: Pick<\n    EmbeddedAppBridgeOptions,\n    \"currentWindow\" | \"parentOrigin\" | \"targetWindow\"\n  > = {},\n): boolean {\n  const win = options.currentWindow ?? window;\n  const parentOrigin = resolveParentOrigin(win, options.parentOrigin);\n  return postToParent(\n    win,\n    options.targetWindow ?? null,\n    parentOrigin,\n    createAgentNativeEmbedEnvelope(AGENT_NATIVE_EMBED_MESSAGE_TYPES.READY, {\n      payload,\n    }),\n  );\n}\n"]}

package/dist/extensions/schema.d.ts

@@ -62,7 +62,7 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
             tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
-            data: "public" | "private" | "org";
+            data: "private" | "org" | "public";
             driverParam: string;
             notNull: true;
             hasDefault: true;
@@ -335,7 +335,7 @@ export declare const extensionShares: import("drizzle-orm/sqlite-core").SQLiteTa
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "admin" | "viewer" | "editor";
+            data: "viewer" | "editor" | "admin";
             driverParam: string;
             notNull: true;
             hasDefault: true;

package/dist/mcp/build-server.d.ts

@@ -112,6 +112,8 @@ export interface MCPCallerIdentity {
     oauthScopes?: string[];
     /** Present only for standard remote MCP OAuth access tokens. */
     oauthClientId?: string;
+    /** Present only for framework-minted first-party MCP client tokens. */
+    firstPartyMcp?: boolean;
 }
 /** Per-request context used to turn an action's relative deep link into the
  *  absolute web URL (and desktop `agentnative://` URL) the external agent

package/dist/mcp/build-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-server.d.ts","sourceRoot":"","sources":["../../src/mcp/build-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAuChE,MAAM,WAAW,SAAS;IACxB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAC1B,CAAC,CAAC;IACH,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,qEAAqE;IACrE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;kEAGkE;AAClE,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GACtC,OAAO,CAgBT;AA8YD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,MAAM,EAAE,GAAG,EACX,IAAI,EAAE,cAAc,GAAG,SAAS,GAC/B;IACD,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CA2BA;AA+hBD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,WAAW,CAAC,EAAE,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwe7B;AAOD,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAc1C;AAyCD,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAIpB;AAwED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAAO,GACxE,OAAO,CAAC;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CAyID;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B"}
+{"version":3,"file":"build-server.d.ts","sourceRoot":"","sources":["../../src/mcp/build-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAuChE,MAAM,WAAW,SAAS;IACxB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAC1B,CAAC,CAAC;IACH,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,qEAAqE;IACrE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;kEAGkE;AAClE,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GACtC,OAAO,CAgBT;AA8YD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,MAAM,EAAE,GAAG,EACX,IAAI,EAAE,cAAc,GAAG,SAAS,GAC/B;IACD,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CA2BA;AA+hBD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,WAAW,CAAC,EAAE,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwe7B;AAOD,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAc1C;AAyCD,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAIpB;AA+FD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAAO,GACxE,OAAO,CAAC;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CA4ID;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B"}

package/dist/mcp/build-server.js

@@ -494,7 +494,7 @@ function safeUiSegment(value, fallback) {
 }
 // ChatGPT and Claude cache MCP App resource HTML by `ui://` URI. Bump this
 // when the shared shell changes in a way that must invalidate host caches.
-const MCP_APP_RESOURCE_SHELL_VERSION = "shell-v46";
+const MCP_APP_RESOURCE_SHELL_VERSION = "shell-v51";
 function legacyDefaultMcpAppUri(config, actionName) {
     const app = safeUiSegment(config.appId ?? config.name, "agent-native");
     const action = safeUiSegment(actionName, "tool");
@@ -1324,7 +1324,7 @@ function addSecretCandidate(candidates, secret) {
         return;
     candidates.push(trimmed);
 }
-async function verifyA2AJwtForMcp(token) {
+async function verifyA2AJwtForMcp(token, resourceUrl) {
     const jose = await import("jose");
     let unverifiedPayload = null;
     try {
@@ -1347,17 +1347,37 @@ async function verifyA2AJwtForMcp(token) {
             // DB not ready or org lookup unavailable — fall back to other candidates.
         }
     }
+    const firstPartyMcp = unverifiedPayload.agent_native_first_party_mcp === true;
+    const audiences = firstPartyMcp ? mcpAudienceList(resourceUrl) : null;
+    if (firstPartyMcp && !audiences?.length)
+        return null;
     for (const secret of candidateSecrets) {
-        try {
-            const { payload } = await jose.jwtVerify(token, new TextEncoder().encode(secret));
-            return payload;
-        }
-        catch {
-            // Try the next candidate without exposing which secret matched.
+        const encodedSecret = new TextEncoder().encode(secret);
+        for (const audience of audiences ?? [undefined]) {
+            try {
+                const { payload } = await jose.jwtVerify(token, encodedSecret, audience ? { audience } : undefined);
+                return payload;
+            }
+            catch {
+                // Try the next candidate without exposing which secret matched.
+            }
         }
     }
     return null;
 }
+function mcpAudienceList(resource) {
+    const raw = Array.isArray(resource) ? resource : resource ? [resource] : [];
+    const seen = new Set();
+    const out = [];
+    for (const value of raw) {
+        const normalized = value.replace(/\/+$/, "");
+        if (normalized && !seen.has(normalized)) {
+            seen.add(normalized);
+            out.push(normalized);
+        }
+    }
+    return out;
+}
 async function isConnectTokenAllowed(jti) {
     if (!jti)
         return false;
@@ -1442,7 +1462,7 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
         return { authed: false };
     // Try an A2A JWT via the shared A2A_SECRET first, then the caller org's
     // synced A2A secret when the token carries org_domain.
-    const payload = await verifyA2AJwtForMcp(token);
+    const payload = await verifyA2AJwtForMcp(token, options.resourceUrl);
     if (payload) {
         const tokenScope = typeof payload.scope === "string" ? payload.scope : undefined;
         if (tokenScope && tokenScope !== MCP_CONNECT_SCOPE) {
@@ -1473,6 +1493,9 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
                 orgDomain: typeof payload.org_domain === "string"
                     ? payload.org_domain
                     : undefined,
+                ...(payload.agent_native_first_party_mcp === true
+                    ? { firstPartyMcp: true }
+                    : {}),
             },
             // Verified JWT (connect-minted or A2A delegation) — a real caller.
             fullSurface: true,