npm - @agent-native/core - Versions diffs - 0.79.16 → 0.79.18 - Mend

@agent-native/core 0.79.16 → 0.79.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (344) hide show

package/dist/server/create-server.d.ts CHANGED Viewed

@@ -18,16 +18,9 @@ export interface CreateServerOptions {
     pingMessage?: string;
     /** Disable the /_agent-native/ping health check. Default: false */
     disablePing?: boolean;
-    /** Env key configuration for the settings UI. Enables /_agent-native/env-status and /_agent-native/env-vars routes. */
+    /** Key configuration for the settings UI. Enables status plus the scoped-secret compatibility save route. */
     envKeys?: EnvKeyConfig[];
 }
-/**
- * Upsert vars into a .env file, preserving existing structure.
- */
-export declare function upsertEnvFile(envPath: string, vars: Array<{
-    key: string;
-    value: string;
-}>): Promise<void>;
 export interface CreateServerResult {
     app: ReturnType<typeof createApp>;
     router: ReturnType<typeof createRouter>;
@@ -36,7 +29,8 @@ export interface CreateServerResult {
  * Create a pre-configured H3 app with standard agent-native setup:
  * - CORS headers via middleware
  * - /_agent-native/ping health check
- * - /_agent-native/env-status and /_agent-native/env-vars (when envKeys is provided)
+ * - /_agent-native/env-status and the scoped-secret compatibility save route
+ *   at /_agent-native/env-vars (when envKeys is provided)
  *
  * Returns { app, router } — mount routes on `router`.
  */

package/dist/server/create-server.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"~~AAEA~~,OAAO,EACL,SAAS,EACT,YAAY,EAOb,MAAM,IAAI,CAAC;~~AAkBZ~~,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACvC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,~~uHAAuH~~;~~IACvH~~,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED~~;;GAEG;AACH~~,~~wBAAsB,aAAa,CACjC,OAAO,EAAE,~~MAAM,~~EACf,IAAI,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAoDf;AAED,MAAM,~~WAAW,kBAAkB;IACjC,GAAG,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;IAClC,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;CACzC;AAED~~;;;;;;;GAOG~~;AACH,wBAAgB,YAAY,CAC1B,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,~~CA0MpB~~"}
1	+ {"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EAOb,MAAM,IAAI,CAAC;AAyBZ,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACvC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6GAA6G;IAC7G,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;IAClC,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;CACzC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CAmMpB"}

package/dist/server/create-server.js CHANGED Viewed

@@ -1,69 +1,19 @@
-import path from "path";
 import { createApp, createRouter, defineEventHandler, getMethod, getRequestHeader, setResponseHeader, setResponseStatus, } from "h3";
+import { getOrgContext } from "../org/context.js";
 import { readBody } from "../server/h3-helpers.js";
-import { agentEnv } from "../shared/agent-env.js";
 import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
 import { EMBED_TRANSPLANT_HEADER, isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
-import { BUILDER_ENV_KEYS } from "./builder-browser.js";
+import { getSession } from "./auth.js";
 import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
-import { isEnvVarWriteAllowed } from "./env-var-writes.js";
-/**
- * Upsert vars into a .env file, preserving existing structure.
- */
-export async function upsertEnvFile(envPath, vars) {
-    // Sanitize: reject values that could inject additional env vars
-    for (const { key, value } of vars) {
-        if (/[\n\r\0]/.test(value)) {
-            throw new Error(`Invalid env var value for ${key}: must not contain newlines or control characters`);
-        }
-    }
-    const fs = await import("fs");
-    let content = "";
-    try {
-        content = fs.readFileSync(envPath, "utf-8");
-    }
-    catch {
-        // File doesn't exist yet
-    }
-    const lines = content.split("\n");
-    const remaining = new Map(vars.map((v) => [v.key, v.value]));
-    // Update existing lines in place
-    const updated = lines.map((line) => {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("#"))
-            return line;
-        const eqIndex = trimmed.indexOf("=");
-        if (eqIndex === -1)
-            return line;
-        const key = trimmed.slice(0, eqIndex).trim();
-        if (remaining.has(key)) {
-            const value = remaining.get(key);
-            remaining.delete(key);
-            return `${key}=${value}`;
-        }
-        return line;
-    });
-    // Append new vars
-    for (const [key, value] of remaining) {
-        updated.push(`${key}=${value}`);
-    }
-    // Ensure trailing newline
-    let result = updated.join("\n");
-    if (!result.endsWith("\n"))
-        result += "\n";
-    try {
-        fs.mkdirSync(path.dirname(envPath), { recursive: true });
-        fs.writeFileSync(envPath, result);
-    }
-    catch {
-        // Edge runtimes don't have writable filesystem — skip silently
-    }
-}
+import { resolveSecret } from "./credential-provider.js";
+import { runWithRequestContext } from "./request-context.js";
+import { findUnsupportedScopedKeyNames, saveKeyValuesToScopedSecrets, ScopedKeyStorageError, } from "./scoped-key-storage.js";
 /**
  * Create a pre-configured H3 app with standard agent-native setup:
  * - CORS headers via middleware
  * - /_agent-native/ping health check
- * - /_agent-native/env-status and /_agent-native/env-vars (when envKeys is provided)
+ * - /_agent-native/env-status and the scoped-secret compatibility save route
+ *   at /_agent-native/env-vars (when envKeys is provided)
  *
  * Returns { app, router } — mount routes on `router`.
  */
@@ -155,7 +105,6 @@ export function createServer(options = {}) {
         }));
     }
     const router = createRouter();
-    app.use(router);
     // Health check
     if (!options.disablePing) {
         router.get("/_agent-native/ping", defineEventHandler(() => {
@@ -166,52 +115,49 @@ export function createServer(options = {}) {
     // Env key management routes
     if (options.envKeys) {
         const envKeys = options.envKeys;
-        router.get("/_agent-native/env-status", defineEventHandler(() => {
-            return envKeys.map((cfg) => ({
+        const allowedEnvKeyNames = envKeys.map(({ key }) => key);
+        router.get("/_agent-native/env-status", defineEventHandler(async (event) => {
+            const session = await getSession(event).catch(() => null);
+            const userEmail = session?.email;
+            let orgId;
+            if (userEmail) {
+                const orgCtx = await getOrgContext(event).catch(() => null);
+                orgId = orgCtx?.orgId ?? undefined;
+            }
+            return Promise.all(envKeys.map(async (cfg) => ({
                 key: cfg.key,
                 label: cfg.label,
                 required: cfg.required ?? false,
-                configured: !!process.env[cfg.key],
+                configured: Boolean(process.env[cfg.key]) ||
+                    (await runWithRequestContext({ userEmail, orgId }, () => resolveSecret(cfg.key).then(Boolean))),
                 ...(cfg.helpText ? { helpText: cfg.helpText } : {}),
-            }));
+            })));
         }));
         router.post("/_agent-native/env-vars", defineEventHandler(async (event) => {
-            // Env vars are deployment-wide globals — see isEnvVarWriteAllowed
-            // above. Disable the endpoint on any multi-tenant deploy.
-            if (!isEnvVarWriteAllowed()) {
-                setResponseStatus(event, 403);
-                return {
-                    error: "env-vars endpoint disabled on multi-tenant deployments. Use scoped secrets or credentials for user/org API keys.",
-                };
-            }
             const body = await readBody(event);
-            const { vars } = body;
-            if (!Array.isArray(vars) || vars.length === 0) {
+            const { vars, scope } = body;
+            const unsupportedKeys = findUnsupportedScopedKeyNames(vars, allowedEnvKeyNames);
+            if (unsupportedKeys.length > 0) {
                 setResponseStatus(event, 400);
-                return { error: "vars array required" };
+                return {
+                    error: `Unsupported env key${unsupportedKeys.length === 1 ? "" : "s"}: ${unsupportedKeys.join(", ")}`,
+                };
             }
-            // Only allow keys that are in the env config
-            const allowedKeys = new Set(envKeys.map((k) => k.key));
-            const blockedEnvVarWriteKeys = new Set(BUILDER_ENV_KEYS);
-            const filtered = vars.filter((v) => typeof v.key === "string" &&
-                allowedKeys.has(v.key) &&
-                !blockedEnvVarWriteKeys.has(v.key));
-            if (filtered.length === 0) {
-                setResponseStatus(event, 400);
-                return { error: "No recognized env keys in request" };
+            try {
+                const result = await saveKeyValuesToScopedSecrets(event, vars, scope);
+                return { saved: result.saved, storage: "scoped-secrets" };
             }
-            // Write to .env file
-            const envPath = path.join(process.cwd(), ".env");
-            await upsertEnvFile(envPath, filtered);
-            // Update process.env so the app picks up the new values immediately
-            for (const { key, value } of filtered) {
-                process.env[key] = value;
+            catch (err) {
+                if (err instanceof ScopedKeyStorageError) {
+                    setResponseStatus(event, err.statusCode);
+                    return { error: err.message };
+                }
+                setResponseStatus(event, 500);
+                return { error: "Failed to save keys" };
             }
-            // Notify parent (Builder or frame) via postMessage
-            agentEnv.setVars(filtered);
-            return { saved: filtered.map((v) => v.key) };
         }));
     }
+    app.use(router);
     return { app, router };
 }
 //# sourceMappingURL=create-server.js.map

package/dist/server/create-server.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"create-server.js","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EACL,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AA0B3D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,IAA2C;IAE3C,gEAAgE;IAChE,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,mDAAmD,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7D,iCAAiC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAClC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,IAAI,CAAC;IAE3C,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;AACH,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAO,GAAwB,EAAE;IAEjC,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,OAAO,CAAC,KAAK,EAAE,KAAK;YAClB,yFAAyF;YACzF,MAAM,GAAG,GAAG,KAA8B,CAAC;YAC3C,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAK,GAAG,EAAE,KAA+B,EAAE,IAAI,CAAC;YACtE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc;gBAAE,OAAO;YAC7D,IAAI,GAAG,EAAE,OAAO,KAAK,SAAS;gBAAE,OAAO;YACvC,OAAO,CAAC,KAAK,CACX,gCAAgC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAC5D,KAAK,CACN,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,kBAAkB;IAClB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,sBAAsB,EAAE,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAE3D;;;;WAIG;QACH,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,gBAAgB,GAAG,MAAM,CAC7B,gBAAgB,CAAC,KAAK,EAAE,gCAAgC,CAAC,IAAI,EAAE,CAChE;iBACE,WAAW,EAAE;iBACb,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,MAAM,gBAAgB,GACpB,oBAAoB,CAAC,aAAa,CAAC;gBACnC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;oBAC3D,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC;oBAClD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;oBACrD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;oBACzD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;YAEvD;;;;;;;eAOG;YACH,MAAM,aAAa,GAAG,gBAAgB;gBACpC,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,oBAAoB,CAAC,aAAa,EAAE;oBAClC,cAAc;oBACd,6BAA6B,EAAE,CAAC,YAAY;oBAC5C,gEAAgE;oBAChE,mEAAmE;iBACpE,CAAC,CAAC;YACP,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YAEnE,IAAI,aAAa,EAAE,CAAC;gBAClB,iBAAiB,CACf,KAAK,EACL,6BAA6B,EAC7B,aAAa,CACd,CAAC;gBACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3C,6DAA6D;gBAC7D,8DAA8D;gBAC9D,4DAA4D;gBAC5D,8DAA8D;gBAC9D,iDAAiD;gBACjD,IAAI,8BAA8B,CAAC,aAAa,CAAC,EAAE,CAAC;oBAClD,iBAAiB,CACf,KAAK,EACL,kCAAkC,EAClC,MAAM,CACP,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1B,kEAAkE;gBAClE,gEAAgE;gBAChE,2CAA2C;gBAC3C,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;YAED,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;YACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;YAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,+DAA+D;gBAC/D,mEAAmE;gBACnE,iEAAiE;gBACjE,qEAAqE;gBACrE,IAAI,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhB,eAAe;IACf,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CACR,qBAAqB,EACrB,kBAAkB,CAAC,GAAG,EAAE;YACtB,MAAM,OAAO,GACX,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAEhC,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,kBAAkB,CAAC,GAAG,EAAE;YACtB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC3B,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;gBAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;gBAClC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,kHAAkH;iBACrH,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,IAEhB,CAAC;YAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAC1C,CAAC;YAED,6CAA6C;YAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;gBACzB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACtB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CACrC,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACxD,CAAC;YAED,qBAAqB;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAEvC,oEAAoE;YACpE,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAED,mDAAmD;YACnD,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE3B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC","sourcesContent":["import path from \"path\";\n\nimport {\n createApp,\n createRouter,\n defineEventHandler,\n getMethod,\n getRequestHeader,\n setResponseHeader,\n setResponseStatus,\n type H3Event,\n} from \"h3\";\n\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { agentEnv } from \"../shared/agent-env.js\";\nimport { EMBED_TARGET_HEADER } from \"../shared/embed-auth.js\";\nimport {\n EMBED_TRANSPLANT_HEADER,\n isMcpEmbedCorsOrigin,\n MCP_EMBED_CORS_ALLOW_HEADERS,\n shouldAllowMcpEmbedCredentials,\n} from \"../shared/mcp-embed-headers.js\";\nimport { BUILDER_ENV_KEYS } from \"./builder-browser.js\";\nimport {\n getAllowedCorsOrigin,\n readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\nimport { isEnvVarWriteAllowed } from \"./env-var-writes.js\";\n\nexport interface EnvKeyConfig {\n /** Environment variable name (e.g. \"HUBSPOT_ACCESS_TOKEN\") /\n key: string;\n /* Human-readable label (e.g. \"HubSpot\") /\n label: string;\n /* Whether this key is required for the app to function /\n required?: boolean;\n /* Optional UI hint shown next to the field describing where to find this value. /\n helpText?: string;\n}\n\nexport interface CreateServerOptions {\n /* CORS options. Ignored (H3 handles CORS via middleware). Default: enabled. /\n cors?: Record<string, unknown> \| false;\n /* JSON body parser limit. Kept for API compatibility (H3 uses readBody). /\n jsonLimit?: string;\n /* Custom ping message. Default: reads PING_MESSAGE env var, falls back to \"pong\" /\n pingMessage?: string;\n /* Disable the /_agent-native/ping health check. Default: false /\n disablePing?: boolean;\n /* Env key configuration for the settings UI. Enables /_agent-native/env-status and /_agent-native/env-vars routes. /\n envKeys?: EnvKeyConfig[];\n}\n\n/\n Upsert vars into a .env file, preserving existing structure.\n /\nexport async function upsertEnvFile(\n envPath: string,\n vars: Array<{ key: string; value: string }>,\n): Promise<void> {\n // Sanitize: reject values that could inject additional env vars\n for (const { key, value } of vars) {\n if (/[\\n\\r\\0]/.test(value)) {\n throw new Error(\n `Invalid env var value for ${key}: must not contain newlines or control characters`,\n );\n }\n }\n\n const fs = await import(\"fs\");\n\n let content = \"\";\n try {\n content = fs.readFileSync(envPath, \"utf-8\");\n } catch {\n // File doesn't exist yet\n }\n\n const lines = content.split(\"\\n\");\n const remaining = new Map(vars.map((v) => [v.key, v.value]));\n\n // Update existing lines in place\n const updated = lines.map((line) => {\n const trimmed = line.trim();\n if (!trimmed \|\| trimmed.startsWith(\"#\")) return line;\n const eqIndex = trimmed.indexOf(\"=\");\n if (eqIndex === -1) return line;\n const key = trimmed.slice(0, eqIndex).trim();\n if (remaining.has(key)) {\n const value = remaining.get(key)!;\n remaining.delete(key);\n return `${key}=${value}`;\n }\n return line;\n });\n\n // Append new vars\n for (const [key, value] of remaining) {\n updated.push(`${key}=${value}`);\n }\n\n // Ensure trailing newline\n let result = updated.join(\"\\n\");\n if (!result.endsWith(\"\\n\")) result += \"\\n\";\n\n try {\n fs.mkdirSync(path.dirname(envPath), { recursive: true });\n fs.writeFileSync(envPath, result);\n } catch {\n // Edge runtimes don't have writable filesystem — skip silently\n }\n}\n\nexport interface CreateServerResult {\n app: ReturnType<typeof createApp>;\n router: ReturnType<typeof createRouter>;\n}\n\n/\n Create a pre-configured H3 app with standard agent-native setup:\n * - CORS headers via middleware\n * - /_agent-native/ping health check\n * - /_agent-native/env-status and /_agent-native/env-vars (when envKeys is provided)\n \n Returns { app, router } — mount routes on `router`.\n /\nexport function createServer(\n options: CreateServerOptions = {},\n): CreateServerResult {\n const app = createApp({\n onError(error, event) {\n // Suppress connection-reset errors — client disconnected mid-request (tab close, reload)\n const err = error as NodeJS.ErrnoException;\n const code = err?.code \|\| (err?.cause as NodeJS.ErrnoException)?.code;\n if (code === \"ECONNRESET\" \|\| code === \"ECONNABORTED\") return;\n if (err?.message === \"aborted\") return;\n console.error(\n `[agent-native] Server error: ${event.method} ${event.path}`,\n error,\n );\n },\n });\n\n // CORS middleware\n if (options.cors !== false) {\n const allowedOrigins = readCorsAllowedOrigins();\n const isProduction = process.env.NODE_ENV === \"production\";\n\n /\n When CORS_ALLOWED_ORIGINS is unset, production only allows trusted\n * localhost/native desktop origins. Development keeps the legacy \"echo\n * any origin\" behavior so local tools and docs previews keep working.\n /\n app.use(\n defineEventHandler((event) => {\n const requestOrigin = getRequestHeader(event, \"origin\");\n const method = getMethod(event);\n const requestedHeaders = String(\n getRequestHeader(event, \"access-control-request-headers\") ?? \"\",\n )\n .toLowerCase()\n .split(\",\")\n .map((header) => header.trim());\n const embedCorsRequest =\n isMcpEmbedCorsOrigin(requestOrigin) &&\n (requestedHeaders.includes(EMBED_TARGET_HEADER.toLowerCase()) \|\|\n requestedHeaders.includes(EMBED_TRANSPLANT_HEADER) \|\|\n Boolean(getRequestHeader(event, EMBED_TARGET_HEADER)) \|\|\n Boolean(getRequestHeader(event, EMBED_TRANSPLANT_HEADER)) \|\|\n Boolean(getRequestHeader(event, \"authorization\")));\n\n /\n Decide whether the requesting origin is allowed. We never fall back\n * to \"the first allowlist entry\" when the origin isn't in the list —\n * that previously sent `Access-Control-Allow-Origin: <other-origin>`\n * with credentials enabled to attacker-controlled origins, which was\n * permissive enough that some clients followed through with the\n * credentialed request.\n /\n const allowedOrigin = embedCorsRequest\n ? requestOrigin\n : getAllowedCorsOrigin(requestOrigin, {\n allowedOrigins,\n allowAnyOriginWhenNoAllowlist: !isProduction,\n // Let the cors-origins default apply (dev-only). Passing `true`\n // here unconditionally would re-open the production localhost gap.\n });\n // No origin header at all (same-origin fetch, server-to-server) and\n // no allowlist → fall through with ``-equivalent behaviour: omit\n // ACAO entirely and let the browser apply its same-origin default.\n\n if (allowedOrigin) {\n setResponseHeader(\n event,\n \"Access-Control-Allow-Origin\",\n allowedOrigin,\n );\n setResponseHeader(event, \"Vary\", \"Origin\");\n // A specific origin means we can honor credentialed requests\n // (fetch with `credentials: \"include\"` — used by desktop tray\n // apps that share a same-site cookie with the web app). The\n // wildcard `` is spec-incompatible with credentials, so only\n // set this when we're echoing a concrete origin.\n if (shouldAllowMcpEmbedCredentials(allowedOrigin)) {\n setResponseHeader(\n event,\n \"Access-Control-Allow-Credentials\",\n \"true\",\n );\n }\n } else if (!requestOrigin) {\n // No origin header — preserve the legacy permissive behaviour for\n // tools/scripts that hit the API directly (no credentialed CORS\n // semantics apply when there's no Origin).\n setResponseHeader(event, \"Access-Control-Allow-Origin\", \"\");\n }\n\n setResponseHeader(\n event,\n \"Access-Control-Allow-Methods\",\n \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n );\n setResponseHeader(\n event,\n \"Access-Control-Allow-Headers\",\n MCP_EMBED_CORS_ALLOW_HEADERS,\n );\n\n if (method === \"OPTIONS\") {\n // Reject preflights from disallowed cross-origin callers. We only\n // 204 if either (a) there was no Origin header (same-origin or\n // direct script invocation) or (b) the origin was in the allowlist\n // / dev fallback above. Otherwise we 403 so the browser surfaces\n // a hard CORS failure rather than blindly retrying with credentials.\n if (requestOrigin && !allowedOrigin) {\n return new Response(null, { status: 403 });\n }\n return new Response(null, { status: 204 });\n }\n }),\n );\n }\n\n const router = createRouter();\n app.use(router);\n\n // Health check\n if (!options.disablePing) {\n router.get(\n \"/_agent-native/ping\",\n defineEventHandler(() => {\n const message =\n options.pingMessage ?? process.env.PING_MESSAGE ?? \"pong\";\n return { message };\n }),\n );\n }\n\n // Env key management routes\n if (options.envKeys) {\n const envKeys = options.envKeys;\n\n router.get(\n \"/_agent-native/env-status\",\n defineEventHandler(() => {\n return envKeys.map((cfg) => ({\n key: cfg.key,\n label: cfg.label,\n required: cfg.required ?? false,\n configured: !!process.env[cfg.key],\n ...(cfg.helpText ? { helpText: cfg.helpText } : {}),\n }));\n }),\n );\n\n router.post(\n \"/_agent-native/env-vars\",\n defineEventHandler(async (event: H3Event) => {\n // Env vars are deployment-wide globals — see isEnvVarWriteAllowed\n // above. Disable the endpoint on any multi-tenant deploy.\n if (!isEnvVarWriteAllowed()) {\n setResponseStatus(event, 403);\n return {\n error:\n \"env-vars endpoint disabled on multi-tenant deployments. Use scoped secrets or credentials for user/org API keys.\",\n };\n }\n\n const body = await readBody(event);\n const { vars } = body as {\n vars?: Array<{ key: string; value: string }>;\n };\n\n if (!Array.isArray(vars) \|\| vars.length === 0) {\n setResponseStatus(event, 400);\n return { error: \"vars array required\" };\n }\n\n // Only allow keys that are in the env config\n const allowedKeys = new Set(envKeys.map((k) => k.key));\n const blockedEnvVarWriteKeys = new Set<string>(BUILDER_ENV_KEYS);\n const filtered = vars.filter(\n (v) =>\n typeof v.key === \"string\" &&\n allowedKeys.has(v.key) &&\n !blockedEnvVarWriteKeys.has(v.key),\n );\n if (filtered.length === 0) {\n setResponseStatus(event, 400);\n return { error: \"No recognized env keys in request\" };\n }\n\n // Write to .env file\n const envPath = path.join(process.cwd(), \".env\");\n await upsertEnvFile(envPath, filtered);\n\n // Update process.env so the app picks up the new values immediately\n for (const { key, value } of filtered) {\n process.env[key] = value;\n }\n\n // Notify parent (Builder or frame) via postMessage\n agentEnv.setVars(filtered);\n\n return { saved: filtered.map((v) => v.key) };\n }),\n );\n }\n\n return { app, router };\n}\n"]}
1	+ {"version":3,"file":"create-server.js","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AA+BjC;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAO,GAAwB,EAAE;IAEjC,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,OAAO,CAAC,KAAK,EAAE,KAAK;YAClB,yFAAyF;YACzF,MAAM,GAAG,GAAG,KAA8B,CAAC;YAC3C,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAK,GAAG,EAAE,KAA+B,EAAE,IAAI,CAAC;YACtE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc;gBAAE,OAAO;YAC7D,IAAI,GAAG,EAAE,OAAO,KAAK,SAAS;gBAAE,OAAO;YACvC,OAAO,CAAC,KAAK,CACX,gCAAgC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAC5D,KAAK,CACN,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,kBAAkB;IAClB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,sBAAsB,EAAE,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAE3D;;;;WAIG;QACH,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,gBAAgB,GAAG,MAAM,CAC7B,gBAAgB,CAAC,KAAK,EAAE,gCAAgC,CAAC,IAAI,EAAE,CAChE;iBACE,WAAW,EAAE;iBACb,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,MAAM,gBAAgB,GACpB,oBAAoB,CAAC,aAAa,CAAC;gBACnC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;oBAC3D,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC;oBAClD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;oBACrD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;oBACzD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;YAEvD;;;;;;;eAOG;YACH,MAAM,aAAa,GAAG,gBAAgB;gBACpC,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,oBAAoB,CAAC,aAAa,EAAE;oBAClC,cAAc;oBACd,6BAA6B,EAAE,CAAC,YAAY;oBAC5C,gEAAgE;oBAChE,mEAAmE;iBACpE,CAAC,CAAC;YACP,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YAEnE,IAAI,aAAa,EAAE,CAAC;gBAClB,iBAAiB,CACf,KAAK,EACL,6BAA6B,EAC7B,aAAa,CACd,CAAC;gBACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3C,6DAA6D;gBAC7D,8DAA8D;gBAC9D,4DAA4D;gBAC5D,8DAA8D;gBAC9D,iDAAiD;gBACjD,IAAI,8BAA8B,CAAC,aAAa,CAAC,EAAE,CAAC;oBAClD,iBAAiB,CACf,KAAK,EACL,kCAAkC,EAClC,MAAM,CACP,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1B,kEAAkE;gBAClE,gEAAgE;gBAChE,2CAA2C;gBAC3C,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;YAED,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;YACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;YAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,+DAA+D;gBAC/D,mEAAmE;gBACnE,iEAAiE;gBACjE,qEAAqE;gBACrE,IAAI,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAE9B,eAAe;IACf,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CACR,qBAAqB,EACrB,kBAAkB,CAAC,GAAG,EAAE;YACtB,MAAM,OAAO,GACX,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAEzD,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,CAAC;YACjC,IAAI,KAAyB,CAAC;YAC9B,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC5D,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC;YACrC,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1B,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;gBAC/B,UAAU,EACR,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC7B,CAAC,MAAM,qBAAqB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CACtD,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CACrC,CAAC;gBACJ,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC,CACJ,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAGvB,CAAC;YACF,MAAM,eAAe,GAAG,6BAA6B,CACnD,IAAI,EACJ,kBAAkB,CACnB,CAAC;YACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,sBAAsB,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACtG,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACtE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;oBACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;oBACzC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChC,CAAC;gBACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC","sourcesContent":["import {\n createApp,\n createRouter,\n defineEventHandler,\n getMethod,\n getRequestHeader,\n setResponseHeader,\n setResponseStatus,\n type H3Event,\n} from \"h3\";\n\nimport { getOrgContext } from \"../org/context.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { EMBED_TARGET_HEADER } from \"../shared/embed-auth.js\";\nimport {\n EMBED_TRANSPLANT_HEADER,\n isMcpEmbedCorsOrigin,\n MCP_EMBED_CORS_ALLOW_HEADERS,\n shouldAllowMcpEmbedCredentials,\n} from \"../shared/mcp-embed-headers.js\";\nimport { getSession } from \"./auth.js\";\nimport {\n getAllowedCorsOrigin,\n readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\nimport { resolveSecret } from \"./credential-provider.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport {\n findUnsupportedScopedKeyNames,\n saveKeyValuesToScopedSecrets,\n ScopedKeyStorageError,\n type ScopedKeySaveRequestScope,\n} from \"./scoped-key-storage.js\";\n\nexport interface EnvKeyConfig {\n /** Environment variable name (e.g. \"HUBSPOT_ACCESS_TOKEN\") /\n key: string;\n /* Human-readable label (e.g. \"HubSpot\") /\n label: string;\n /* Whether this key is required for the app to function /\n required?: boolean;\n /* Optional UI hint shown next to the field describing where to find this value. /\n helpText?: string;\n}\n\nexport interface CreateServerOptions {\n /* CORS options. Ignored (H3 handles CORS via middleware). Default: enabled. /\n cors?: Record<string, unknown> \| false;\n /* JSON body parser limit. Kept for API compatibility (H3 uses readBody). /\n jsonLimit?: string;\n /* Custom ping message. Default: reads PING_MESSAGE env var, falls back to \"pong\" /\n pingMessage?: string;\n /* Disable the /_agent-native/ping health check. Default: false /\n disablePing?: boolean;\n /* Key configuration for the settings UI. Enables status plus the scoped-secret compatibility save route. /\n envKeys?: EnvKeyConfig[];\n}\n\nexport interface CreateServerResult {\n app: ReturnType<typeof createApp>;\n router: ReturnType<typeof createRouter>;\n}\n\n/\n Create a pre-configured H3 app with standard agent-native setup:\n * - CORS headers via middleware\n * - /_agent-native/ping health check\n * - /_agent-native/env-status and the scoped-secret compatibility save route\n * at /_agent-native/env-vars (when envKeys is provided)\n \n Returns { app, router } — mount routes on `router`.\n /\nexport function createServer(\n options: CreateServerOptions = {},\n): CreateServerResult {\n const app = createApp({\n onError(error, event) {\n // Suppress connection-reset errors — client disconnected mid-request (tab close, reload)\n const err = error as NodeJS.ErrnoException;\n const code = err?.code \|\| (err?.cause as NodeJS.ErrnoException)?.code;\n if (code === \"ECONNRESET\" \|\| code === \"ECONNABORTED\") return;\n if (err?.message === \"aborted\") return;\n console.error(\n `[agent-native] Server error: ${event.method} ${event.path}`,\n error,\n );\n },\n });\n\n // CORS middleware\n if (options.cors !== false) {\n const allowedOrigins = readCorsAllowedOrigins();\n const isProduction = process.env.NODE_ENV === \"production\";\n\n /\n When CORS_ALLOWED_ORIGINS is unset, production only allows trusted\n * localhost/native desktop origins. Development keeps the legacy \"echo\n * any origin\" behavior so local tools and docs previews keep working.\n /\n app.use(\n defineEventHandler((event) => {\n const requestOrigin = getRequestHeader(event, \"origin\");\n const method = getMethod(event);\n const requestedHeaders = String(\n getRequestHeader(event, \"access-control-request-headers\") ?? \"\",\n )\n .toLowerCase()\n .split(\",\")\n .map((header) => header.trim());\n const embedCorsRequest =\n isMcpEmbedCorsOrigin(requestOrigin) &&\n (requestedHeaders.includes(EMBED_TARGET_HEADER.toLowerCase()) \|\|\n requestedHeaders.includes(EMBED_TRANSPLANT_HEADER) \|\|\n Boolean(getRequestHeader(event, EMBED_TARGET_HEADER)) \|\|\n Boolean(getRequestHeader(event, EMBED_TRANSPLANT_HEADER)) \|\|\n Boolean(getRequestHeader(event, \"authorization\")));\n\n /\n Decide whether the requesting origin is allowed. We never fall back\n * to \"the first allowlist entry\" when the origin isn't in the list —\n * that previously sent `Access-Control-Allow-Origin: <other-origin>`\n * with credentials enabled to attacker-controlled origins, which was\n * permissive enough that some clients followed through with the\n * credentialed request.\n /\n const allowedOrigin = embedCorsRequest\n ? requestOrigin\n : getAllowedCorsOrigin(requestOrigin, {\n allowedOrigins,\n allowAnyOriginWhenNoAllowlist: !isProduction,\n // Let the cors-origins default apply (dev-only). Passing `true`\n // here unconditionally would re-open the production localhost gap.\n });\n // No origin header at all (same-origin fetch, server-to-server) and\n // no allowlist → fall through with ``-equivalent behaviour: omit\n // ACAO entirely and let the browser apply its same-origin default.\n\n if (allowedOrigin) {\n setResponseHeader(\n event,\n \"Access-Control-Allow-Origin\",\n allowedOrigin,\n );\n setResponseHeader(event, \"Vary\", \"Origin\");\n // A specific origin means we can honor credentialed requests\n // (fetch with `credentials: \"include\"` — used by desktop tray\n // apps that share a same-site cookie with the web app). The\n // wildcard `` is spec-incompatible with credentials, so only\n // set this when we're echoing a concrete origin.\n if (shouldAllowMcpEmbedCredentials(allowedOrigin)) {\n setResponseHeader(\n event,\n \"Access-Control-Allow-Credentials\",\n \"true\",\n );\n }\n } else if (!requestOrigin) {\n // No origin header — preserve the legacy permissive behaviour for\n // tools/scripts that hit the API directly (no credentialed CORS\n // semantics apply when there's no Origin).\n setResponseHeader(event, \"Access-Control-Allow-Origin\", \"\");\n }\n\n setResponseHeader(\n event,\n \"Access-Control-Allow-Methods\",\n \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n );\n setResponseHeader(\n event,\n \"Access-Control-Allow-Headers\",\n MCP_EMBED_CORS_ALLOW_HEADERS,\n );\n\n if (method === \"OPTIONS\") {\n // Reject preflights from disallowed cross-origin callers. We only\n // 204 if either (a) there was no Origin header (same-origin or\n // direct script invocation) or (b) the origin was in the allowlist\n // / dev fallback above. Otherwise we 403 so the browser surfaces\n // a hard CORS failure rather than blindly retrying with credentials.\n if (requestOrigin && !allowedOrigin) {\n return new Response(null, { status: 403 });\n }\n return new Response(null, { status: 204 });\n }\n }),\n );\n }\n\n const router = createRouter();\n\n // Health check\n if (!options.disablePing) {\n router.get(\n \"/_agent-native/ping\",\n defineEventHandler(() => {\n const message =\n options.pingMessage ?? process.env.PING_MESSAGE ?? \"pong\";\n return { message };\n }),\n );\n }\n\n // Env key management routes\n if (options.envKeys) {\n const envKeys = options.envKeys;\n const allowedEnvKeyNames = envKeys.map(({ key }) => key);\n\n router.get(\n \"/_agent-native/env-status\",\n defineEventHandler(async (event) => {\n const session = await getSession(event).catch(() => null);\n const userEmail = session?.email;\n let orgId: string \| undefined;\n if (userEmail) {\n const orgCtx = await getOrgContext(event).catch(() => null);\n orgId = orgCtx?.orgId ?? undefined;\n }\n return Promise.all(\n envKeys.map(async (cfg) => ({\n key: cfg.key,\n label: cfg.label,\n required: cfg.required ?? false,\n configured:\n Boolean(process.env[cfg.key]) \|\|\n (await runWithRequestContext({ userEmail, orgId }, () =>\n resolveSecret(cfg.key).then(Boolean),\n )),\n ...(cfg.helpText ? { helpText: cfg.helpText } : {}),\n })),\n );\n }),\n );\n\n router.post(\n \"/_agent-native/env-vars\",\n defineEventHandler(async (event: H3Event) => {\n const body = await readBody(event);\n const { vars, scope } = body as {\n vars?: Array<{ key: string; value: string }>;\n scope?: ScopedKeySaveRequestScope;\n };\n const unsupportedKeys = findUnsupportedScopedKeyNames(\n vars,\n allowedEnvKeyNames,\n );\n if (unsupportedKeys.length > 0) {\n setResponseStatus(event, 400);\n return {\n error: `Unsupported env key${unsupportedKeys.length === 1 ? \"\" : \"s\"}: ${unsupportedKeys.join(\", \")}`,\n };\n }\n try {\n const result = await saveKeyValuesToScopedSecrets(event, vars, scope);\n return { saved: result.saved, storage: \"scoped-secrets\" };\n } catch (err) {\n if (err instanceof ScopedKeyStorageError) {\n setResponseStatus(event, err.statusCode);\n return { error: err.message };\n }\n setResponseStatus(event, 500);\n return { error: \"Failed to save keys\" };\n }\n }),\n );\n }\n\n app.use(router);\n return { app, router };\n}\n"]}

package/dist/server/email-actions.d.ts CHANGED Viewed

@@ -2,9 +2,8 @@
  * Framework-level agent action for sending transactional/notification emails
  * via the configured core email transport (Resend or SendGrid).
  *
- * Registered as a native tool in every template when RESEND_API_KEY or
- * SENDGRID_API_KEY is set. When neither key is present the tool is omitted
- * from the agent surface so the agent never sees it.
+ * Registered as a native tool in every template. sendEmail() checks the
+ * scoped Resend/SendGrid configuration at call time.
  *
  * SAFETY: the action description instructs the agent to draft-first and only
  * send when the user explicitly confirms, matching the mail template convention.

package/dist/server/email-actions.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"email-actions.d.ts","sourceRoot":"","sources":["../../src/server/email-actions.ts"],"names":[],"mappings":"AAAA~~;;;;;;;;;;;;;;;GAeG~~;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAmGhE,wBAAgB,4BAA4B,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,~~CAwG1E~~"}
1	+ {"version":3,"file":"email-actions.d.ts","sourceRoot":"","sources":["../../src/server/email-actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAmGhE,wBAAgB,4BAA4B,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAsG1E"}

package/dist/server/email-actions.js CHANGED Viewed

@@ -2,9 +2,8 @@
  * Framework-level agent action for sending transactional/notification emails
  * via the configured core email transport (Resend or SendGrid).
  *
- * Registered as a native tool in every template when RESEND_API_KEY or
- * SENDGRID_API_KEY is set. When neither key is present the tool is omitted
- * from the agent surface so the agent never sees it.
+ * Registered as a native tool in every template. sendEmail() checks the
+ * scoped Resend/SendGrid configuration at call time.
  *
  * SAFETY: the action description instructs the agent to draft-first and only
  * send when the user explicitly confirms, matching the mail template convention.
@@ -14,7 +13,7 @@
  * when both would be present under the same key. To avoid any ambiguity this
  * action is keyed "core-send-email" which is distinct from the template name.
  */
-import { isEmailConfigured, sendEmail } from "./email.js";
+import { sendEmail } from "./email.js";
 function markdownToText(md) {
     return md
         .replace(/!\[([^\]]*)\]\([^\s)]+\)/g, "$1")
@@ -91,8 +90,6 @@ function markdownToHtml(md) {
     return html;
 }
 export function createCoreEmailActionEntries() {
-    if (!isEmailConfigured())
-        return {};
     return {
         "core-send-email": {
             tool: {

package/dist/server/email-actions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"email-actions.js","sourceRoot":"","sources":["../../src/server/email-actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE1D,SAAS,cAAc,CAAC,EAAU;IAChC,OAAO,EAAE;SACN,OAAO,CAAC,2BAA2B,EAAE,IAAI,CAAC;SAC1C,OAAO,CAAC,0BAA0B,EAAE,SAAS,CAAC;SAC9C,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;SAC3B,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC;SACjC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC;SAC/B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,EAAU;IAChC,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,2EAA2E;IAC3E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CACxB,CAAC;SACE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE7B,yDAAyD;IACzD,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CACnC,CAAC;SACE,OAAO,CACN,uCAAuC,EACvC,CAAC,EAAE,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE,CACjC,YAAY,GAAG,CAAC,GAAG,CAAC,+CAA+C,GAAG,CAAC,KAAK,CAAC,MAAM,CACtF;SACA,OAAO,CACN,mCAAmC,EACnC,CAAC,EAAE,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CAC/B,GAAG,GAAG,YAAY,GAAG,CAAC,GAAG,CAAC,+CAA+C,GAAG,CAAC,GAAG,CAAC,MAAM,CAC1F;SACA,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;SACxE,OAAO,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;SAClD,OAAO,CAAC,0CAA0C,EAAE,eAAe,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAE7B,oBAAoB;QACpB,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,OAAO;iBACjB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;iBAC5B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC1B,OAAO,cAAc,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;QAChD,CAAC;QAED,UAAU;QACV,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC9C,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3B,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC;QACnD,CAAC;QAED,iBAAiB;QACjB,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO;iBAClB,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;iBAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,iDAAiD,KAAK,OAAO,CAAC;QACvE,CAAC;QAED,eAAe;QACf,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO;iBAClB,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;iBAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,iDAAiD,KAAK,OAAO,CAAC;QACvE,CAAC;QAED,aAAa;QACb,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,OAAO;iBAClB,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;iBACjD,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO,oGAAoG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QAC1I,CAAC;QAED,OAAO,6BAA6B,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;IACrF,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAO,EAAE,CAAC;IAEpC,OAAO;QACL,iBAAiB,EAAE;YACjB,IAAI,EAAE;gBACJ,WAAW,EAAE;oBACX,0FAA0F;oBAC1F,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,4EAA4E;oBAC5E,EAAE;oBACF,sFAAsF;oBACtF,+DAA+D;oBAC/D,EAAE;oBACF,qFAAqF;oBACrF,uFAAuF;oBACvF,eAAe;iBAChB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACZ,UAAU,EAAE;oBACV,IAAI,EAAE,QAAiB;oBACvB,UAAU,EAAE;wBACV,EAAE,EAAE;4BACF,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,0BAA0B;yBACxC;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,qBAAqB;yBACnC;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,sGAAsG;yBACzG;wBACD,EAAE,EAAE;4BACF,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,yCAAyC;yBACvD;wBACD,GAAG,EAAE;4BACH,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,0CAA0C;yBACxD;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,6DAA6D;yBAChE;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,iLAAiL;yBACpL;qBACF;oBACD,QAAQ,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC;iBACpC;aACF;YACD,GAAG,EAAE,KAAK,EAAE,KAA8B,EAAE,EAAE;gBAC5C,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,EAAE,GACN,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;oBAC7C,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;oBACjB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;oBAC/C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;oBAClB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;oBACvD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;oBACtB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;oBACjD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;oBACnB,CAAC,CAAC,SAAS,CAAC;gBAEhB,IAAI,CAAC,EAAE;oBAAE,OAAO,0BAA0B,CAAC;gBAC3C,IAAI,CAAC,OAAO;oBAAE,OAAO,+BAA+B,CAAC;gBACrD,IAAI,CAAC,MAAM;oBAAE,OAAO,4BAA4B,CAAC;gBAEjD,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC;wBACd,EAAE;wBACF,OAAO;wBACP,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC;wBAC5B,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC;wBAC5B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACzB,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChC,CAAC,CAAC;oBAEH,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5C,OAAO,iBAAiB,EAAE,GAAG,OAAO,MAAM,OAAO,GAAG,CAAC;gBACvD,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,OAAO,wBAAwB,GAAG,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["/*\n Framework-level agent action for sending transactional/notification emails\n * via the configured core email transport (Resend or SendGrid).\n \n Registered as a native tool in every template when RESEND_API_KEY or\n * SENDGRID_API_KEY is set. When neither key is present the tool is omitted\n * from the agent surface so the agent never sees it.\n \n SAFETY: the action description instructs the agent to draft-first and only\n * send when the user explicitly confirms, matching the mail template convention.\n \n COLLISION: the mail template registers its own richer \"send-email\" action.\n * The template's registration comes after this one in the spread, so it wins\n * when both would be present under the same key. To avoid any ambiguity this\n * action is keyed \"core-send-email\" which is distinct from the template name.\n /\n\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport { isEmailConfigured, sendEmail } from \"./email.js\";\n\nfunction markdownToText(md: string): string {\n return md\n .replace(/!\\[([^\\]])\\]\$[^\\s)]+\$/g, \"$1\")\n .replace(/\\[([^\\]]+)\\]\$[^\\s)]+\$/g, \"$1 ($2)\")\n .replace(/`([^`]+)`/g, \"$1\")\n .replace(/\\\\([^]+)\\\\/g, \"$1\")\n .replace(/\\([^\\n]+)\\/g, \"$1\")\n .replace(/^#{1,6}\\s+/gm, \"\")\n .trim();\n}\n\nfunction markdownToHtml(md: string): string {\n const normalized = md.replace(/\\r\\n/g, \"\\n\").trim();\n if (!normalized) return \"<p></p>\";\n\n // Escape HTML entities in a string, preserving already-encoded references.\n const esc = (s: string) =>\n s\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/\"/g, \""\");\n\n // Inline markdown: links, bold, italic, code, bare URLs.\n const inline = (s: string): string =>\n s\n .replace(\n /\\[([^\\]]+)\\]\$(https?:\\/\\/[^\\s)]+)\$/g,\n (_m, label: string, url: string) =>\n `<a href=\"${esc(url)}\" target=\"_blank\" rel=\"noopener noreferrer\">${esc(label)}</a>`,\n )\n .replace(\n /(^\|[^\\w\"'=])(https?:\\/\\/[^\\s<]+)/g,\n (_m, pre: string, url: string) =>\n `${pre}<a href=\"${esc(url)}\" target=\"_blank\" rel=\"noopener noreferrer\">${esc(url)}</a>`,\n )\n .replace(/`([^`]+)`/g, (_m, code: string) => `<code>${esc(code)}</code>`)\n .replace(/\\\\([^]+)\\\\/g, \"<strong>$1</strong>\")\n .replace(/(^\|[\\s(])\\([^\\n]+)\\(?=$\|[\\s).,!?:;])/g, \"$1<em>$2</em>\");\n\n const blocks = normalized.split(/\\n{2,}/);\n const html = blocks\n .map((block) => {\n const trimmed = block.trim();\n\n // Fenced code block\n if (trimmed.startsWith(\"```\") && trimmed.endsWith(\"```\")) {\n const code = trimmed\n .replace(/^```[^\\n]\\n?/, \"\")\n .replace(/\\n?```$/, \"\");\n return `<pre><code>${esc(code)}</code></pre>`;\n }\n\n // Heading\n const hm = trimmed.match(/^(#{1,6})\\s+(.+)$/);\n if (hm) {\n const level = hm[1].length;\n return `<h${level}>${inline(hm[2])}</h${level}>`;\n }\n\n // Unordered list\n if (/^[-+]\\s+/m.test(trimmed)) {\n const items = trimmed\n .split(\"\\n\")\n .filter(Boolean)\n .map((l) => `<li>${inline(l.replace(/^[-*+]\\s+/, \"\"))}</li>`)\n .join(\"\");\n return `<ul style=\"margin:0 0 1em;padding-left:1.5em\">${items}</ul>`;\n }\n\n // Ordered list\n if (/^\\d+\\.\\s+/m.test(trimmed)) {\n const items = trimmed\n .split(\"\\n\")\n .filter(Boolean)\n .map((l) => `<li>${inline(l.replace(/^\\d+\\.\\s+/, \"\"))}</li>`)\n .join(\"\");\n return `<ol style=\"margin:0 0 1em;padding-left:1.5em\">${items}</ol>`;\n }\n\n // Blockquote\n if (trimmed.startsWith(\"> \")) {\n const inner = trimmed\n .split(\"\\n\")\n .map((l) => (l.startsWith(\"> \") ? l.slice(2) : l))\n .join(\"\\n\");\n return `<blockquote style=\"margin:0 0 1em 1em;border-left:3px solid #ccc;padding-left:0.75em;color:#555\">${inline(inner)}</blockquote>`;\n }\n\n return `<p style=\"margin:0 0 1em\">${inline(trimmed).replace(/\\n/g, \"<br />\")}</p>`;\n })\n .join(\"\");\n\n return html;\n}\n\nexport function createCoreEmailActionEntries(): Record<string, ActionEntry> {\n if (!isEmailConfigured()) return {};\n\n return {\n \"core-send-email\": {\n tool: {\n description: [\n \"Send a transactional email via the app's configured email provider (Resend or SendGrid).\",\n \"\",\n \"IMPORTANT — DRAFT-FIRST SAFETY RULE: Never call this tool until the user has explicitly\",\n \"confirmed they want to send. Always compose the full email content first, show it to the\",\n \"user, and wait for an explicit 'yes, send it' before invoking this action.\",\n \"\",\n \"The body is written in markdown. Tables, lists, bold, italic, links, and code blocks\",\n \"are all supported and will render correctly in email clients.\",\n \"\",\n \"This sends via the framework transport (Resend/SendGrid). It is NOT the Gmail-based\",\n \"send-email action in the mail template — use this for system/notification emails from\",\n \"any template.\",\n ].join(\"\\n\"),\n parameters: {\n type: \"object\" as const,\n properties: {\n to: {\n type: \"string\",\n description: \"Recipient email address.\",\n },\n subject: {\n type: \"string\",\n description: \"Email subject line.\",\n },\n body: {\n type: \"string\",\n description:\n \"Email body in markdown. Tables, lists, headings, bold, italic, links, and code blocks are supported.\",\n },\n cc: {\n type: \"string\",\n description: \"CC email address (single address only).\",\n },\n bcc: {\n type: \"string\",\n description: \"BCC email address (single address only).\",\n },\n replyTo: {\n type: \"string\",\n description:\n \"Reply-To address. Useful when sending on behalf of someone.\",\n },\n from: {\n type: \"string\",\n description:\n 'Override the sender address. Must be a verified sender for the configured provider. Example: \"Team Name <team@example.com>\". Leave unset to use the default EMAIL_FROM env var.',\n },\n },\n required: [\"to\", \"subject\", \"body\"],\n },\n },\n run: async (input: Record<string, unknown>) => {\n const to = typeof input.to === \"string\" ? input.to.trim() : \"\";\n const subject =\n typeof input.subject === \"string\" ? input.subject.trim() : \"\";\n const bodyMd = typeof input.body === \"string\" ? input.body.trim() : \"\";\n const cc =\n typeof input.cc === \"string\" && input.cc.trim()\n ? input.cc.trim()\n : undefined;\n const bcc =\n typeof input.bcc === \"string\" && input.bcc.trim()\n ? input.bcc.trim()\n : undefined;\n const replyTo =\n typeof input.replyTo === \"string\" && input.replyTo.trim()\n ? input.replyTo.trim()\n : undefined;\n const from =\n typeof input.from === \"string\" && input.from.trim()\n ? input.from.trim()\n : undefined;\n\n if (!to) return \"Error: 'to' is required.\";\n if (!subject) return \"Error: 'subject' is required.\";\n if (!bodyMd) return \"Error: 'body' is required.\";\n\n try {\n await sendEmail({\n to,\n subject,\n html: markdownToHtml(bodyMd),\n text: markdownToText(bodyMd),\n ...(from ? { from } : {}),\n ...(cc ? { cc } : {}),\n ...(replyTo ? { replyTo } : {}),\n });\n\n const bccNote = bcc ? ` (bcc: ${bcc})` : \"\";\n return `Email sent to ${to}${bccNote}: \"${subject}\"`;\n } catch (err: unknown) {\n const msg = err instanceof Error ? err.message : String(err);\n return `Error sending email: ${msg}`;\n }\n },\n },\n };\n}\n"]}
1	+ {"version":3,"file":"email-actions.js","sourceRoot":"","sources":["../../src/server/email-actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,SAAS,cAAc,CAAC,EAAU;IAChC,OAAO,EAAE;SACN,OAAO,CAAC,2BAA2B,EAAE,IAAI,CAAC;SAC1C,OAAO,CAAC,0BAA0B,EAAE,SAAS,CAAC;SAC9C,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;SAC3B,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC;SACjC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC;SAC/B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,EAAU;IAChC,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,2EAA2E;IAC3E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CACxB,CAAC;SACE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE7B,yDAAyD;IACzD,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CACnC,CAAC;SACE,OAAO,CACN,uCAAuC,EACvC,CAAC,EAAE,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE,CACjC,YAAY,GAAG,CAAC,GAAG,CAAC,+CAA+C,GAAG,CAAC,KAAK,CAAC,MAAM,CACtF;SACA,OAAO,CACN,mCAAmC,EACnC,CAAC,EAAE,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CAC/B,GAAG,GAAG,YAAY,GAAG,CAAC,GAAG,CAAC,+CAA+C,GAAG,CAAC,GAAG,CAAC,MAAM,CAC1F;SACA,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;SACxE,OAAO,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;SAClD,OAAO,CAAC,0CAA0C,EAAE,eAAe,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAE7B,oBAAoB;QACpB,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,OAAO;iBACjB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;iBAC5B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC1B,OAAO,cAAc,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;QAChD,CAAC;QAED,UAAU;QACV,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC9C,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3B,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC;QACnD,CAAC;QAED,iBAAiB;QACjB,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO;iBAClB,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;iBAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,iDAAiD,KAAK,OAAO,CAAC;QACvE,CAAC;QAED,eAAe;QACf,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO;iBAClB,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;iBAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,iDAAiD,KAAK,OAAO,CAAC;QACvE,CAAC;QAED,aAAa;QACb,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,OAAO;iBAClB,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;iBACjD,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO,oGAAoG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QAC1I,CAAC;QAED,OAAO,6BAA6B,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;IACrF,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,iBAAiB,EAAE;YACjB,IAAI,EAAE;gBACJ,WAAW,EAAE;oBACX,0FAA0F;oBAC1F,EAAE;oBACF,yFAAyF;oBACzF,0FAA0F;oBAC1F,4EAA4E;oBAC5E,EAAE;oBACF,sFAAsF;oBACtF,+DAA+D;oBAC/D,EAAE;oBACF,qFAAqF;oBACrF,uFAAuF;oBACvF,eAAe;iBAChB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACZ,UAAU,EAAE;oBACV,IAAI,EAAE,QAAiB;oBACvB,UAAU,EAAE;wBACV,EAAE,EAAE;4BACF,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,0BAA0B;yBACxC;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,qBAAqB;yBACnC;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,sGAAsG;yBACzG;wBACD,EAAE,EAAE;4BACF,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,yCAAyC;yBACvD;wBACD,GAAG,EAAE;4BACH,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,0CAA0C;yBACxD;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,6DAA6D;yBAChE;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,iLAAiL;yBACpL;qBACF;oBACD,QAAQ,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC;iBACpC;aACF;YACD,GAAG,EAAE,KAAK,EAAE,KAA8B,EAAE,EAAE;gBAC5C,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,EAAE,GACN,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;oBAC7C,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;oBACjB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;oBAC/C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;oBAClB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;oBACvD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;oBACtB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;oBACjD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;oBACnB,CAAC,CAAC,SAAS,CAAC;gBAEhB,IAAI,CAAC,EAAE;oBAAE,OAAO,0BAA0B,CAAC;gBAC3C,IAAI,CAAC,OAAO;oBAAE,OAAO,+BAA+B,CAAC;gBACrD,IAAI,CAAC,MAAM;oBAAE,OAAO,4BAA4B,CAAC;gBAEjD,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC;wBACd,EAAE;wBACF,OAAO;wBACP,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC;wBAC5B,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC;wBAC5B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACzB,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChC,CAAC,CAAC;oBAEH,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5C,OAAO,iBAAiB,EAAE,GAAG,OAAO,MAAM,OAAO,GAAG,CAAC;gBACvD,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,OAAO,wBAAwB,GAAG,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["/*\n Framework-level agent action for sending transactional/notification emails\n * via the configured core email transport (Resend or SendGrid).\n \n Registered as a native tool in every template. sendEmail() checks the\n * scoped Resend/SendGrid configuration at call time.\n \n SAFETY: the action description instructs the agent to draft-first and only\n * send when the user explicitly confirms, matching the mail template convention.\n \n COLLISION: the mail template registers its own richer \"send-email\" action.\n * The template's registration comes after this one in the spread, so it wins\n * when both would be present under the same key. To avoid any ambiguity this\n * action is keyed \"core-send-email\" which is distinct from the template name.\n /\n\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport { sendEmail } from \"./email.js\";\n\nfunction markdownToText(md: string): string {\n return md\n .replace(/!\\[([^\\]])\\]\$[^\\s)]+\$/g, \"$1\")\n .replace(/\\[([^\\]]+)\\]\$[^\\s)]+\$/g, \"$1 ($2)\")\n .replace(/`([^`]+)`/g, \"$1\")\n .replace(/\\\\([^]+)\\\\/g, \"$1\")\n .replace(/\\([^\\n]+)\\/g, \"$1\")\n .replace(/^#{1,6}\\s+/gm, \"\")\n .trim();\n}\n\nfunction markdownToHtml(md: string): string {\n const normalized = md.replace(/\\r\\n/g, \"\\n\").trim();\n if (!normalized) return \"<p></p>\";\n\n // Escape HTML entities in a string, preserving already-encoded references.\n const esc = (s: string) =>\n s\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/\"/g, \""\");\n\n // Inline markdown: links, bold, italic, code, bare URLs.\n const inline = (s: string): string =>\n s\n .replace(\n /\\[([^\\]]+)\\]\$(https?:\\/\\/[^\\s)]+)\$/g,\n (_m, label: string, url: string) =>\n `<a href=\"${esc(url)}\" target=\"_blank\" rel=\"noopener noreferrer\">${esc(label)}</a>`,\n )\n .replace(\n /(^\|[^\\w\"'=])(https?:\\/\\/[^\\s<]+)/g,\n (_m, pre: string, url: string) =>\n `${pre}<a href=\"${esc(url)}\" target=\"_blank\" rel=\"noopener noreferrer\">${esc(url)}</a>`,\n )\n .replace(/`([^`]+)`/g, (_m, code: string) => `<code>${esc(code)}</code>`)\n .replace(/\\\\([^]+)\\\\/g, \"<strong>$1</strong>\")\n .replace(/(^\|[\\s(])\\([^\\n]+)\\(?=$\|[\\s).,!?:;])/g, \"$1<em>$2</em>\");\n\n const blocks = normalized.split(/\\n{2,}/);\n const html = blocks\n .map((block) => {\n const trimmed = block.trim();\n\n // Fenced code block\n if (trimmed.startsWith(\"```\") && trimmed.endsWith(\"```\")) {\n const code = trimmed\n .replace(/^```[^\\n]\\n?/, \"\")\n .replace(/\\n?```$/, \"\");\n return `<pre><code>${esc(code)}</code></pre>`;\n }\n\n // Heading\n const hm = trimmed.match(/^(#{1,6})\\s+(.+)$/);\n if (hm) {\n const level = hm[1].length;\n return `<h${level}>${inline(hm[2])}</h${level}>`;\n }\n\n // Unordered list\n if (/^[-+]\\s+/m.test(trimmed)) {\n const items = trimmed\n .split(\"\\n\")\n .filter(Boolean)\n .map((l) => `<li>${inline(l.replace(/^[-*+]\\s+/, \"\"))}</li>`)\n .join(\"\");\n return `<ul style=\"margin:0 0 1em;padding-left:1.5em\">${items}</ul>`;\n }\n\n // Ordered list\n if (/^\\d+\\.\\s+/m.test(trimmed)) {\n const items = trimmed\n .split(\"\\n\")\n .filter(Boolean)\n .map((l) => `<li>${inline(l.replace(/^\\d+\\.\\s+/, \"\"))}</li>`)\n .join(\"\");\n return `<ol style=\"margin:0 0 1em;padding-left:1.5em\">${items}</ol>`;\n }\n\n // Blockquote\n if (trimmed.startsWith(\"> \")) {\n const inner = trimmed\n .split(\"\\n\")\n .map((l) => (l.startsWith(\"> \") ? l.slice(2) : l))\n .join(\"\\n\");\n return `<blockquote style=\"margin:0 0 1em 1em;border-left:3px solid #ccc;padding-left:0.75em;color:#555\">${inline(inner)}</blockquote>`;\n }\n\n return `<p style=\"margin:0 0 1em\">${inline(trimmed).replace(/\\n/g, \"<br />\")}</p>`;\n })\n .join(\"\");\n\n return html;\n}\n\nexport function createCoreEmailActionEntries(): Record<string, ActionEntry> {\n return {\n \"core-send-email\": {\n tool: {\n description: [\n \"Send a transactional email via the app's configured email provider (Resend or SendGrid).\",\n \"\",\n \"IMPORTANT — DRAFT-FIRST SAFETY RULE: Never call this tool until the user has explicitly\",\n \"confirmed they want to send. Always compose the full email content first, show it to the\",\n \"user, and wait for an explicit 'yes, send it' before invoking this action.\",\n \"\",\n \"The body is written in markdown. Tables, lists, bold, italic, links, and code blocks\",\n \"are all supported and will render correctly in email clients.\",\n \"\",\n \"This sends via the framework transport (Resend/SendGrid). It is NOT the Gmail-based\",\n \"send-email action in the mail template — use this for system/notification emails from\",\n \"any template.\",\n ].join(\"\\n\"),\n parameters: {\n type: \"object\" as const,\n properties: {\n to: {\n type: \"string\",\n description: \"Recipient email address.\",\n },\n subject: {\n type: \"string\",\n description: \"Email subject line.\",\n },\n body: {\n type: \"string\",\n description:\n \"Email body in markdown. Tables, lists, headings, bold, italic, links, and code blocks are supported.\",\n },\n cc: {\n type: \"string\",\n description: \"CC email address (single address only).\",\n },\n bcc: {\n type: \"string\",\n description: \"BCC email address (single address only).\",\n },\n replyTo: {\n type: \"string\",\n description:\n \"Reply-To address. Useful when sending on behalf of someone.\",\n },\n from: {\n type: \"string\",\n description:\n 'Override the sender address. Must be a verified sender for the configured provider. Example: \"Team Name <team@example.com>\". Leave unset to use the default EMAIL_FROM env var.',\n },\n },\n required: [\"to\", \"subject\", \"body\"],\n },\n },\n run: async (input: Record<string, unknown>) => {\n const to = typeof input.to === \"string\" ? input.to.trim() : \"\";\n const subject =\n typeof input.subject === \"string\" ? input.subject.trim() : \"\";\n const bodyMd = typeof input.body === \"string\" ? input.body.trim() : \"\";\n const cc =\n typeof input.cc === \"string\" && input.cc.trim()\n ? input.cc.trim()\n : undefined;\n const bcc =\n typeof input.bcc === \"string\" && input.bcc.trim()\n ? input.bcc.trim()\n : undefined;\n const replyTo =\n typeof input.replyTo === \"string\" && input.replyTo.trim()\n ? input.replyTo.trim()\n : undefined;\n const from =\n typeof input.from === \"string\" && input.from.trim()\n ? input.from.trim()\n : undefined;\n\n if (!to) return \"Error: 'to' is required.\";\n if (!subject) return \"Error: 'subject' is required.\";\n if (!bodyMd) return \"Error: 'body' is required.\";\n\n try {\n await sendEmail({\n to,\n subject,\n html: markdownToHtml(bodyMd),\n text: markdownToText(bodyMd),\n ...(from ? { from } : {}),\n ...(cc ? { cc } : {}),\n ...(replyTo ? { replyTo } : {}),\n });\n\n const bccNote = bcc ? ` (bcc: ${bcc})` : \"\";\n return `Email sent to ${to}${bccNote}: \"${subject}\"`;\n } catch (err: unknown) {\n const msg = err instanceof Error ? err.message : String(err);\n return `Error sending email: ${msg}`;\n }\n },\n },\n };\n}\n"]}

package/dist/server/email.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 /**
  * Email transport for system emails (password resets, invitations, notifications).
  *
- * Providers are selected by env var:
+ * Providers are selected by scoped secrets:
  *   RESEND_API_KEY    — https://resend.com
  *   SENDGRID_API_KEY  — https://sendgrid.com
  *   EMAIL_FROM        — "Name <addr@domain>" (optional; defaults to Resend's sandbox)
@@ -29,7 +29,7 @@ export interface SendEmailArgs {
     references?: string;
     attachments?: EmailAttachment[];
 }
-export declare function isEmailConfigured(): boolean;
-export declare function getEmailProvider(): EmailProvider;
+export declare function isEmailConfigured(): Promise<boolean>;
+export declare function getEmailProvider(): Promise<EmailProvider>;
 export declare function sendEmail(args: SendEmailArgs): Promise<void>;
 //# sourceMappingURL=email.d.ts.map

package/dist/server/email.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/server/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;~~AAEH~~,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC;~~AAED~~,~~wBAAgB~~,iBAAiB,IAAI,OAAO,~~CAE3C~~;AAED,~~wBAAgB~~,gBAAgB,IAAI,aAAa,~~CAIhD~~;~~AAeD~~,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,~~CA8GlE~~"}
1	+ {"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/server/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC;AAiCD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE1D;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAE/D;AAkBD,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA+GlE"}

package/dist/server/email.js CHANGED Viewed

@@ -1,7 +1,7 @@
 /**
  * Email transport for system emails (password resets, invitations, notifications).
  *
- * Providers are selected by env var:
+ * Providers are selected by scoped secrets:
  *   RESEND_API_KEY    — https://resend.com
  *   SENDGRID_API_KEY  — https://sendgrid.com
  *   EMAIL_FROM        — "Name <addr@domain>" (optional; defaults to Resend's sandbox)
@@ -9,30 +9,51 @@
  * With neither provider configured, `sendEmail` logs the message to the console
  * so the reset-password flow still works end-to-end for local development.
  */
-export function isEmailConfigured() {
-    return !!(process.env.RESEND_API_KEY || process.env.SENDGRID_API_KEY);
+import { resolveSecret } from "./credential-provider.js";
+async function resolveEmailTransport() {
+    const [resendApiKey, sendgridApiKey, from] = await Promise.all([
+        resolveSecret("RESEND_API_KEY"),
+        resolveSecret("SENDGRID_API_KEY"),
+        resolveSecret("EMAIL_FROM"),
+    ]);
+    const resolvedFrom = from ?? undefined;
+    if (resendApiKey) {
+        return {
+            provider: "resend",
+            resendApiKey,
+            from: resolvedFrom,
+        };
+    }
+    if (sendgridApiKey) {
+        return {
+            provider: "sendgrid",
+            sendgridApiKey,
+            from: resolvedFrom,
+        };
+    }
+    return { provider: "dev", from: resolvedFrom };
+}
+export async function isEmailConfigured() {
+    return (await resolveEmailTransport()).provider !== "dev";
 }
-export function getEmailProvider() {
-    if (process.env.RESEND_API_KEY)
-        return "resend";
-    if (process.env.SENDGRID_API_KEY)
-        return "sendgrid";
-    return "dev";
+export async function getEmailProvider() {
+    return (await resolveEmailTransport()).provider;
 }
-function getFromAddress(override, provider) {
-    const explicit = override || process.env.EMAIL_FROM;
+function getFromAddress(config, override) {
+    const explicit = override || config.from;
     if (explicit)
         return explicit;
     // Resend lets unverified accounts send from its sandbox domain; SendGrid
     // does not, so falling back there would cause silent 403s at runtime.
-    if (provider === "sendgrid") {
-        throw new Error("EMAIL_FROM is required when using SendGrid — set it to a verified sender address.");
+    if (config.provider === "sendgrid") {
+        throw new Error("EMAIL_FROM is required when using SendGrid — save it as a verified sender address.");
     }
     return "Agent Native <onboarding@resend.dev>";
 }
 export async function sendEmail(args) {
-    const provider = getEmailProvider();
-    const from = getFromAddress(args.from, provider);
+    const config = await resolveEmailTransport();
+    const provider = config.provider;
+    const from = getFromAddress(config, args.from);
     if (provider === "resend") {
         const payload = {
             from,
@@ -65,7 +86,7 @@ export async function sendEmail(args) {
         const res = await fetch("https://api.resend.com/emails", {
             method: "POST",
             headers: {
-                Authorization: `Bearer ${process.env.RESEND_API_KEY}`,
+                Authorization: `Bearer ${config.resendApiKey}`,
                 "Content-Type": "application/json",
             },
             body: JSON.stringify(payload),
@@ -116,7 +137,7 @@ export async function sendEmail(args) {
         const res = await fetch("https://api.sendgrid.com/v3/mail/send", {
             method: "POST",
             headers: {
-                Authorization: `Bearer ${process.env.SENDGRID_API_KEY}`,
+                Authorization: `Bearer ${config.sendgridApiKey}`,
                 "Content-Type": "application/json",
             },
             body: JSON.stringify(sgPayload),
@@ -131,10 +152,10 @@ export async function sendEmail(args) {
     // reset tokens, so only do it outside production. In production, refuse
     // to send rather than silently leaking secrets to logs.
     if (process.env.NODE_ENV === "production") {
-        throw new Error("No email provider configured. Set RESEND_API_KEY or SENDGRID_API_KEY.");
+        throw new Error("No email provider configured. Save RESEND_API_KEY or SENDGRID_API_KEY in settings.");
     }
     console.log(`\n[agent-native:email] No email provider configured. ` +
-        `Set RESEND_API_KEY or SENDGRID_API_KEY to send real emails.\n` +
+        `Save RESEND_API_KEY or SENDGRID_API_KEY in settings to send real emails.\n` +
         `---\nTo: ${args.to}\nFrom: ${from}\nSubject: ${args.subject}\n\n` +
         `${args.text || stripHtml(args.html)}\n---\n`);
 }

package/dist/server/email.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/server/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAyBH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAAE,OAAO,UAAU,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,QAAiB,EAAE,QAAwB;IACjE,MAAM,QAAQ,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,sCAAsC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,OAAO,GAA4B;YACvC,IAAI;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;QACF,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QAClD,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC7B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjD,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,OAAO,EACL,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;oBAC3B,CAAC,CAAC,CAAC,CAAC,OAAO;oBACX,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAClC,YAAY,EAAE,CAAC,CAAC,WAAW;gBAC3B,UAAU,EAAE,CAAC,CAAC,SAAS;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;QACD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5D,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7D,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;QAE3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE;gBACrD,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,eAAe,GAA4B;YAC/C,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;SACzB,CAAC;QACF,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,eAAe,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,SAAS,GAA4B;YACzC,gBAAgB,EAAE,CAAC,eAAe,CAAC;YACnC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE;gBACP,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;aACxC;SACF,CAAC;QACF,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS,CAAC,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,SAAS;YAAE,SAAS,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9D,IAAI,IAAI,CAAC,UAAU;YAAE,SAAS,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;YAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC;QACjE,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC7B,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnD,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,OAAO,EACL,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;oBAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC3C,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAClC,IAAI,EAAE,CAAC,CAAC,WAAW;gBACnB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;gBAClE,UAAU,EAAE,CAAC,CAAC,SAAS;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,uCAAuC,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBACvD,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,wDAAwD;IACxD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,uDAAuD;QACrD,+DAA+D;QAC/D,YAAY,IAAI,CAAC,EAAE,WAAW,IAAI,cAAc,IAAI,CAAC,OAAO,MAAM;QAClE,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["/*\n Email transport for system emails (password resets, invitations, notifications).\n \n Providers are selected by env var:\n * RESEND_API_KEY — https://resend.com\n * SENDGRID_API_KEY — https://sendgrid.com\n * EMAIL_FROM — \"Name <addr@domain>\" (optional; defaults to Resend's sandbox)\n \n With neither provider configured, `sendEmail` logs the message to the console\n * so the reset-password flow still works end-to-end for local development.\n /\n\nexport type EmailProvider = \"resend\" \| \"sendgrid\" \| \"dev\";\n\nexport interface EmailAttachment {\n filename: string;\n content: string \| Buffer;\n contentType?: string;\n contentId?: string;\n disposition?: \"attachment\" \| \"inline\";\n}\n\nexport interface SendEmailArgs {\n to: string;\n subject: string;\n html: string;\n text?: string;\n from?: string;\n cc?: string \| string[];\n replyTo?: string;\n inReplyTo?: string;\n references?: string;\n attachments?: EmailAttachment[];\n}\n\nexport function isEmailConfigured(): boolean {\n return !!(process.env.RESEND_API_KEY \|\| process.env.SENDGRID_API_KEY);\n}\n\nexport function getEmailProvider(): EmailProvider {\n if (process.env.RESEND_API_KEY) return \"resend\";\n if (process.env.SENDGRID_API_KEY) return \"sendgrid\";\n return \"dev\";\n}\n\nfunction getFromAddress(override?: string, provider?: EmailProvider): string {\n const explicit = override \|\| process.env.EMAIL_FROM;\n if (explicit) return explicit;\n // Resend lets unverified accounts send from its sandbox domain; SendGrid\n // does not, so falling back there would cause silent 403s at runtime.\n if (provider === \"sendgrid\") {\n throw new Error(\n \"EMAIL_FROM is required when using SendGrid — set it to a verified sender address.\",\n );\n }\n return \"Agent Native <onboarding@resend.dev>\";\n}\n\nexport async function sendEmail(args: SendEmailArgs): Promise<void> {\n const provider = getEmailProvider();\n const from = getFromAddress(args.from, provider);\n\n if (provider === \"resend\") {\n const payload: Record<string, unknown> = {\n from,\n to: args.to,\n subject: args.subject,\n html: args.html,\n text: args.text,\n };\n if (args.cc) payload.cc = Array.isArray(args.cc) ? args.cc : [args.cc];\n if (args.replyTo) payload.reply_to = args.replyTo;\n if (args.attachments?.length) {\n payload.attachments = args.attachments.map((a) => ({\n filename: a.filename,\n content:\n typeof a.content === \"string\"\n ? a.content\n : a.content.toString(\"base64\"),\n content_type: a.contentType,\n content_id: a.contentId,\n }));\n }\n const headers: Record<string, string> = {};\n if (args.inReplyTo) headers[\"In-Reply-To\"] = args.inReplyTo;\n if (args.references) headers[\"References\"] = args.references;\n if (Object.keys(headers).length) payload.headers = headers;\n\n const res = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${process.env.RESEND_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(payload),\n });\n if (!res.ok) {\n const body = await res.text().catch(() => \"\");\n throw new Error(`Resend error ${res.status}: ${body}`);\n }\n return;\n }\n\n if (provider === \"sendgrid\") {\n const personalization: Record<string, unknown> = {\n to: [{ email: args.to }],\n };\n if (args.cc) {\n const ccList = Array.isArray(args.cc) ? args.cc : [args.cc];\n personalization.cc = ccList.map((email) => ({ email }));\n }\n\n const sgPayload: Record<string, unknown> = {\n personalizations: [personalization],\n from: parseSendGridFrom(from),\n subject: args.subject,\n content: [\n ...(args.text ? [{ type: \"text/plain\", value: args.text }] : []),\n { type: \"text/html\", value: args.html },\n ],\n };\n if (args.replyTo) sgPayload.reply_to = parseSendGridFrom(args.replyTo);\n const sgHeaders: Record<string, string> = {};\n if (args.inReplyTo) sgHeaders[\"In-Reply-To\"] = args.inReplyTo;\n if (args.references) sgHeaders[\"References\"] = args.references;\n if (Object.keys(sgHeaders).length) sgPayload.headers = sgHeaders;\n if (args.attachments?.length) {\n sgPayload.attachments = args.attachments.map((a) => ({\n filename: a.filename,\n content:\n typeof a.content === \"string\"\n ? Buffer.from(a.content).toString(\"base64\")\n : a.content.toString(\"base64\"),\n type: a.contentType,\n disposition: a.disposition ?? (a.contentId ? \"inline\" : undefined),\n content_id: a.contentId,\n }));\n }\n\n const res = await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${process.env.SENDGRID_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(sgPayload),\n });\n if (!res.ok) {\n const body = await res.text().catch(() => \"\");\n throw new Error(`SendGrid error ${res.status}: ${body}`);\n }\n return;\n }\n\n // Dev fallback — no provider configured. Logging the full body exposes\n // reset tokens, so only do it outside production. In production, refuse\n // to send rather than silently leaking secrets to logs.\n if (process.env.NODE_ENV === \"production\") {\n throw new Error(\n \"No email provider configured. Set RESEND_API_KEY or SENDGRID_API_KEY.\",\n );\n }\n console.log(\n `\\n[agent-native:email] No email provider configured. ` +\n `Set RESEND_API_KEY or SENDGRID_API_KEY to send real emails.\\n` +\n `---\\nTo: ${args.to}\\nFrom: ${from}\\nSubject: ${args.subject}\\n\\n` +\n `${args.text \|\| stripHtml(args.html)}\\n---\\n`,\n );\n}\n\nfunction parseSendGridFrom(from: string): { email: string; name?: string } {\n const m = from.match(/^\\s(.?)\\s<(.+)>\\s$/);\n if (m && m[2]) return { name: m[1] \|\| undefined, email: m[2] };\n return { email: from.trim() };\n}\n\nfunction stripHtml(html: string): string {\n return html\n .replace(/<br\\s\\/?>/gi, \"\\n\")\n .replace(/<\\/p>/gi, \"\\n\\n\")\n .replace(/<[^>]+>/g, \"\")\n .replace(/ /g, \" \")\n .trim();\n}\n"]}
1	+ {"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/server/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAgCzD,KAAK,UAAU,qBAAqB;IAClC,MAAM,CAAC,YAAY,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7D,aAAa,CAAC,gBAAgB,CAAC;QAC/B,aAAa,CAAC,kBAAkB,CAAC;QACjC,aAAa,CAAC,YAAY,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,IAAI,SAAS,CAAC;IACvC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,YAAY;YACZ,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,cAAc;YACd,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,OAAO,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,OAAO,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CACrB,MAA4B,EAC5B,QAAiB;IAEjB,MAAM,QAAQ,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,sCAAsC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,OAAO,GAA4B;YACvC,IAAI;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;QACF,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QAClD,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC7B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjD,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,OAAO,EACL,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;oBAC3B,CAAC,CAAC,CAAC,CAAC,OAAO;oBACX,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAClC,YAAY,EAAE,CAAC,CAAC,WAAW;gBAC3B,UAAU,EAAE,CAAC,CAAC,SAAS;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;QACD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5D,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7D,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;QAE3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE;gBAC9C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,eAAe,GAA4B;YAC/C,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;SACzB,CAAC;QACF,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,eAAe,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,SAAS,GAA4B;YACzC,gBAAgB,EAAE,CAAC,eAAe,CAAC;YACnC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE;gBACP,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;aACxC;SACF,CAAC;QACF,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS,CAAC,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,SAAS;YAAE,SAAS,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9D,IAAI,IAAI,CAAC,UAAU;YAAE,SAAS,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;YAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC;QACjE,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC7B,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnD,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,OAAO,EACL,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;oBAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC3C,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAClC,IAAI,EAAE,CAAC,CAAC,WAAW;gBACnB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;gBAClE,UAAU,EAAE,CAAC,CAAC,SAAS;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,uCAAuC,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,CAAC,cAAc,EAAE;gBAChD,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,wDAAwD;IACxD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,uDAAuD;QACrD,4EAA4E;QAC5E,YAAY,IAAI,CAAC,EAAE,WAAW,IAAI,cAAc,IAAI,CAAC,OAAO,MAAM;QAClE,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["/*\n Email transport for system emails (password resets, invitations, notifications).\n \n Providers are selected by scoped secrets:\n * RESEND_API_KEY — https://resend.com\n * SENDGRID_API_KEY — https://sendgrid.com\n * EMAIL_FROM — \"Name <addr@domain>\" (optional; defaults to Resend's sandbox)\n \n With neither provider configured, `sendEmail` logs the message to the console\n * so the reset-password flow still works end-to-end for local development.\n /\n\nimport { resolveSecret } from \"./credential-provider.js\";\n\nexport type EmailProvider = \"resend\" \| \"sendgrid\" \| \"dev\";\n\nexport interface EmailAttachment {\n filename: string;\n content: string \| Buffer;\n contentType?: string;\n contentId?: string;\n disposition?: \"attachment\" \| \"inline\";\n}\n\nexport interface SendEmailArgs {\n to: string;\n subject: string;\n html: string;\n text?: string;\n from?: string;\n cc?: string \| string[];\n replyTo?: string;\n inReplyTo?: string;\n references?: string;\n attachments?: EmailAttachment[];\n}\n\ninterface EmailTransportConfig {\n provider: EmailProvider;\n resendApiKey?: string;\n sendgridApiKey?: string;\n from?: string;\n}\n\nasync function resolveEmailTransport(): Promise<EmailTransportConfig> {\n const [resendApiKey, sendgridApiKey, from] = await Promise.all([\n resolveSecret(\"RESEND_API_KEY\"),\n resolveSecret(\"SENDGRID_API_KEY\"),\n resolveSecret(\"EMAIL_FROM\"),\n ]);\n const resolvedFrom = from ?? undefined;\n if (resendApiKey) {\n return {\n provider: \"resend\",\n resendApiKey,\n from: resolvedFrom,\n };\n }\n if (sendgridApiKey) {\n return {\n provider: \"sendgrid\",\n sendgridApiKey,\n from: resolvedFrom,\n };\n }\n return { provider: \"dev\", from: resolvedFrom };\n}\n\nexport async function isEmailConfigured(): Promise<boolean> {\n return (await resolveEmailTransport()).provider !== \"dev\";\n}\n\nexport async function getEmailProvider(): Promise<EmailProvider> {\n return (await resolveEmailTransport()).provider;\n}\n\nfunction getFromAddress(\n config: EmailTransportConfig,\n override?: string,\n): string {\n const explicit = override \|\| config.from;\n if (explicit) return explicit;\n // Resend lets unverified accounts send from its sandbox domain; SendGrid\n // does not, so falling back there would cause silent 403s at runtime.\n if (config.provider === \"sendgrid\") {\n throw new Error(\n \"EMAIL_FROM is required when using SendGrid — save it as a verified sender address.\",\n );\n }\n return \"Agent Native <onboarding@resend.dev>\";\n}\n\nexport async function sendEmail(args: SendEmailArgs): Promise<void> {\n const config = await resolveEmailTransport();\n const provider = config.provider;\n const from = getFromAddress(config, args.from);\n\n if (provider === \"resend\") {\n const payload: Record<string, unknown> = {\n from,\n to: args.to,\n subject: args.subject,\n html: args.html,\n text: args.text,\n };\n if (args.cc) payload.cc = Array.isArray(args.cc) ? args.cc : [args.cc];\n if (args.replyTo) payload.reply_to = args.replyTo;\n if (args.attachments?.length) {\n payload.attachments = args.attachments.map((a) => ({\n filename: a.filename,\n content:\n typeof a.content === \"string\"\n ? a.content\n : a.content.toString(\"base64\"),\n content_type: a.contentType,\n content_id: a.contentId,\n }));\n }\n const headers: Record<string, string> = {};\n if (args.inReplyTo) headers[\"In-Reply-To\"] = args.inReplyTo;\n if (args.references) headers[\"References\"] = args.references;\n if (Object.keys(headers).length) payload.headers = headers;\n\n const res = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${config.resendApiKey}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(payload),\n });\n if (!res.ok) {\n const body = await res.text().catch(() => \"\");\n throw new Error(`Resend error ${res.status}: ${body}`);\n }\n return;\n }\n\n if (provider === \"sendgrid\") {\n const personalization: Record<string, unknown> = {\n to: [{ email: args.to }],\n };\n if (args.cc) {\n const ccList = Array.isArray(args.cc) ? args.cc : [args.cc];\n personalization.cc = ccList.map((email) => ({ email }));\n }\n\n const sgPayload: Record<string, unknown> = {\n personalizations: [personalization],\n from: parseSendGridFrom(from),\n subject: args.subject,\n content: [\n ...(args.text ? [{ type: \"text/plain\", value: args.text }] : []),\n { type: \"text/html\", value: args.html },\n ],\n };\n if (args.replyTo) sgPayload.reply_to = parseSendGridFrom(args.replyTo);\n const sgHeaders: Record<string, string> = {};\n if (args.inReplyTo) sgHeaders[\"In-Reply-To\"] = args.inReplyTo;\n if (args.references) sgHeaders[\"References\"] = args.references;\n if (Object.keys(sgHeaders).length) sgPayload.headers = sgHeaders;\n if (args.attachments?.length) {\n sgPayload.attachments = args.attachments.map((a) => ({\n filename: a.filename,\n content:\n typeof a.content === \"string\"\n ? Buffer.from(a.content).toString(\"base64\")\n : a.content.toString(\"base64\"),\n type: a.contentType,\n disposition: a.disposition ?? (a.contentId ? \"inline\" : undefined),\n content_id: a.contentId,\n }));\n }\n\n const res = await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${config.sendgridApiKey}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(sgPayload),\n });\n if (!res.ok) {\n const body = await res.text().catch(() => \"\");\n throw new Error(`SendGrid error ${res.status}: ${body}`);\n }\n return;\n }\n\n // Dev fallback — no provider configured. Logging the full body exposes\n // reset tokens, so only do it outside production. In production, refuse\n // to send rather than silently leaking secrets to logs.\n if (process.env.NODE_ENV === \"production\") {\n throw new Error(\n \"No email provider configured. Save RESEND_API_KEY or SENDGRID_API_KEY in settings.\",\n );\n }\n console.log(\n `\\n[agent-native:email] No email provider configured. ` +\n `Save RESEND_API_KEY or SENDGRID_API_KEY in settings to send real emails.\\n` +\n `---\\nTo: ${args.to}\\nFrom: ${from}\\nSubject: ${args.subject}\\n\\n` +\n `${args.text \|\| stripHtml(args.html)}\\n---\\n`,\n );\n}\n\nfunction parseSendGridFrom(from: string): { email: string; name?: string } {\n const m = from.match(/^\\s(.?)\\s<(.+)>\\s$/);\n if (m && m[2]) return { name: m[1] \|\| undefined, email: m[2] };\n return { email: from.trim() };\n}\n\nfunction stripHtml(html: string): string {\n return html\n .replace(/<br\\s\\/?>/gi, \"\\n\")\n .replace(/<\\/p>/gi, \"\\n\\n\")\n .replace(/<[^>]+>/g, \"\")\n .replace(/ /g, \" \")\n .trim();\n}\n"]}