npm - @agent-native/core - Versions diffs - 0.79.7 → 0.79.10 - Mend

@agent-native/core 0.79.7 → 0.79.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (94) hide show

package/dist/server/action-routes.js CHANGED Viewed

@@ -275,13 +275,17 @@ export function mountActionRoutes(nitroApp, actions, options) {
                             // ignore
                         }
                     }
-                    // If the action returned a string, try to parse as JSON for a clean response
+                    // If the action returned a string, try to parse as JSON for a
+                    // clean response. Plain strings still need to go over the HTTP
+                    // action transport as JSON, otherwise H3 sends text/plain and the
+                    // browser action client rejects the successful 2xx response.
                     if (typeof result === "string") {
                         try {
                             return JSON.parse(result);
                         }
                         catch {
-                            return result;
+                            setResponseHeader(event, "Content-Type", "application/json");
+                            return JSON.stringify(result);
                         }
                     }
                     return result;

package/dist/server/action-routes.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"action-routes.js","sourceRoot":"","sources":["../../src/server/action-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,SAAS,GACV,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,oBAAoB,IAAI,wBAAwB,EAChD,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAE9C,MAAM,UAAU,uBAAuB,CACrC,YAA6B;IAE7B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA8B;IAE9B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,IAAI,IAAI;gBAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA2B,EAC3B,MAAc,EACd,KAAU;IAEV,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7C,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAU;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,KAAU;IACzC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC,KAAK,GAAG,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAOD,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACrD,cAAc,EAAE,sBAAsB,EAAE;QACxC,sEAAsE;QACtE,8DAA8D;KAC/D,CAAC,CAAC;IACH,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,8BAA8B,CAAC,MAAM,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAU;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,oBAAoB,CAC/B,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;IAEF,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,iBAAiB,CAAC,KAAK,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QACD,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;QACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,IAAI,CAAC,WAAW;YACd,CAAC,CAAC,8KAA8K,mBAAmB,EAAE;YACrM,CAAC,CAAC,GAAG,4BAA4B,4EAA4E,CAChH,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,WAAW,GAAG,KAInB,CAAC;IACF,MAAM,MAAM,GACV,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ;QACxC,CAAC,CAAC,WAAW,CAAC,UAAU;QACxB,CAAC,CAAC,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ;YACtC,CAAC,CAAC,WAAW,CAAC,MAAM;YACpB,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CACL,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ;QAC7C,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAa,EACb,OAAoC,EACpC,OAAkC;IAElC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,0BAA0B;QAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAEnC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;QAE5C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,SAAS,EACT,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,eAAe,GACnB,SAAS,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAE/D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YAEtD,4BAA4B;YAC5B,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,MAAM,GAAG,EAAE,CAAC;YACzD,CAAC;YAED,oEAAoE;YACpE,0DAA0D;YAC1D,qEAAqE;YACrE,8DAA8D;YAC9D,kDAAkD;YAClD,gEAAgE;YAChE,mEAAmE;YACnE,gEAAgE;YAChE,uCAAuC;YACvC,+DAA+D;YAC/D,oEAAoE;YACpE,+BAA+B;YAC/B,MAAM,cAAc,GAClB,SAAS,CAAC,KAAK,EAAE,4BAA4B,CAAC,KAAK,GAAG,CAAC;YACzD,IAAI,cAAc,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,WAAW,IAAI,+BAA+B;iBACtD,CAAC;YACJ,CAAC;YAED,+CAA+C;YAC/C,IAAI,SAA6B,CAAC;YAClC,IAAI,QAA4B,CAAC;YACjC,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;oBACnD,QAAQ,GAAG,OAAO,EAAE,oBAAoB;wBACtC,CAAC,CAAC,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,SAAS,CAAC;gBAChB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IACE,KAAK,CAAC,YAAY,KAAK,KAAK;wBAC5B,uBAAuB,CAAC,KAAK,CAAC,EAC9B,CAAC;wBACD,SAAS,GAAG,SAAS,CAAC;wBACtB,QAAQ,GAAG,SAAS,CAAC;oBACvB,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,EAAE,YAAY;gBACjC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAE3C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EACxC,KAAK,IAAI,EAAE;gBACT,kEAAkE;gBAClE,qEAAqE;gBACrE,qEAAqE;gBACrE,sCAAsC;gBACtC,IAAI,MAA2B,CAAC;gBAChC,IAAI,CAAC;oBACH,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,sDAAsD;wBACtD,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC;4BAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;4BAChC,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;wBACrD,CAAC;6BAAM,CAAC;4BACN,MAAM,GAAG,sBAAsB,CAC7B,QAAQ,CAAC,KAAK,CAAwB,CACvC,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;4BAChD,6DAA6D;4BAC7D,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzD,CAAC;6BAAM,CAAC;4BACN,wCAAwC;4BACxC,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBAED,kEAAkE;gBAClE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,qEAAqE;gBACrE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,MAAM,CAAC;oBACX,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;wBACrC,SAAS;wBACT,KAAK,EAAE,KAAK,IAAI,IAAI;wBACpB,MAAM;wBACN,UAAU,EAAE,IAAI;qBACjB,CAAC,CAAC;oBAEH,8DAA8D;oBAC9D,+DAA+D;oBAC/D,gEAAgE;oBAChE,8DAA8D;oBAC9D,6DAA6D;oBAC7D,qDAAqD;oBACrD,+DAA+D;oBAC/D,mEAAmE;oBACnE,gEAAgE;oBAChE,6DAA6D;oBAC7D,MAAM,UAAU,GACd,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;wBACjC,CAAC,CAAC,KAAK,CAAC,QAAQ;wBAChB,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;oBACvB,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,IAAI,CAAC;4BACH,MAAM,kBAAkB,CAAC;gCACvB,UAAU,EAAE,IAAI;gCAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC3C,CAAC,CAAC;wBACL,CAAC;wBAAC,MAAM,CAAC;4BACP,SAAS;wBACX,CAAC;oBACH,CAAC;oBAED,6EAA6E;oBAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBAC/B,IAAI,CAAC;4BACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC5B,CAAC;wBAAC,MAAM,CAAC;4BACP,OAAO,MAAM,CAAC;wBAChB,CAAC;oBACH,CAAC;oBAED,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxC,MAAM,iBAAiB,GAAG,GAAG,CAAC,UAAU,CACtC,2BAA2B,CAC5B,CAAC;oBACF,MAAM,cAAc,GAClB,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ;wBACjC,CAAC,CAAC,GAAG,CAAC,UAAU;wBAChB,CAAC,CAAC,SAAS,CAAC;oBAChB,+DAA+D;oBAC/D,sBAAsB;oBACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;oBACjE,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAEjC,kDAAkD;oBAClD,6DAA6D;oBAC7D,iEAAiE;oBACjE,8DAA8D;oBAC9D,gEAAgE;oBAChE,2DAA2D;oBAC3D,kDAAkD;oBAClD,MAAM,YAAY,GAChB,iBAAiB;wBACjB,sBAAsB,CAAC,GAAG,CAAC;wBAC3B,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC;oBACzD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;oBACxB,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC;oBAC9D,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC,CACF,CAAC,CAAC,4BAA4B;QACjC,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;QACzC,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,CAAC,MAAM,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;AACN,CAAC","sourcesContent":["import {\n defineEventHandler,\n setResponseStatus,\n setResponseHeader,\n getMethod,\n getQuery,\n getHeader,\n} from \"h3\";\n\nimport { isAgentActionStopError } from \"../action.js\";\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { EMBED_TARGET_HEADER } from \"../shared/embed-auth.js\";\nimport {\n isMcpEmbedCorsOrigin,\n MCP_EMBED_CORS_ALLOW_HEADERS,\n shouldAllowMcpEmbedCredentials,\n} from \"../shared/mcp-embed-headers.js\";\nimport { notifyActionChange } from \"./action-change.js\";\nimport {\n getAllowedCorsOrigin as resolveAllowedCorsOrigin,\n readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\n/*\n Auto-mount actions as HTTP endpoints under /_agent-native/actions/:name.\n \n Actions are exposed as POST by default. Use `http: { method: \"GET\" }` in\n * defineAction to expose as GET. Use `http: false` to mark as agent-only.\n /\nimport { getH3App } from \"./framework-request-handler.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nconst ROUTE_PREFIX = \"/_agent-native/actions\";\n\nexport function parseActionSearchParams(\n searchParams: URLSearchParams,\n): Record<string, any> {\n const params: Record<string, any> = {};\n for (const [rawKey, value] of searchParams.entries()) {\n appendActionParam(params, rawKey, value);\n }\n return params;\n}\n\nfunction parseActionQueryObject(\n query: Record<string, unknown>,\n): Record<string, any> {\n const params: Record<string, any> = {};\n for (const [rawKey, rawValue] of Object.entries(query)) {\n const values = Array.isArray(rawValue) ? rawValue : [rawValue];\n for (const value of values) {\n if (value != null) appendActionParam(params, rawKey, String(value));\n }\n }\n return params;\n}\n\nfunction appendActionParam(\n params: Record<string, any>,\n rawKey: string,\n value: any,\n) {\n const isArrayKey = rawKey.endsWith(\"[]\");\n // The core client serializes arrays as `key[]=value` so even a single\n // value can validate against z.array() action schemas.\n const key = isArrayKey ? rawKey.slice(0, -2) : rawKey;\n const current = params[key];\n if (current === undefined) {\n params[key] = isArrayKey ? [value] : value;\n } else if (Array.isArray(current)) {\n current.push(value);\n } else {\n params[key] = [current, value];\n }\n}\n\n/\n Read the caller's IANA timezone from the `x-user-timezone` header. The core\n * client sends this on every action request so server-side \"today\" fallbacks\n * can honor the user's local day.\n /\nfunction readTimezoneHeader(event: any): string \| undefined {\n try {\n const raw = getHeader(event, \"x-user-timezone\");\n if (!raw \|\| typeof raw !== \"string\") return undefined;\n const trimmed = raw.trim();\n return trimmed.length > 0 && trimmed.length < 64 ? trimmed : undefined;\n } catch {\n return undefined;\n }\n}\n\n/\n True when the request originated from the browser action client\n * (`useActionQuery` / `useActionMutation` / `callAction`), which tags every\n * call with `X-Agent-Native-Frontend: 1`. Used to set `ctx.caller` to\n * `\"frontend\"` vs a bare programmatic `\"http\"` POST. The header carries no\n * auth weight — it only narrows the caller tag for tracking/branching.\n /\nfunction isFrontendActionRequest(event: any): boolean {\n try {\n return getHeader(event, \"x-agent-native-frontend\") === \"1\";\n } catch {\n return false;\n }\n}\n\ntype CorsOrigin = {\n origin: string;\n credentials: boolean;\n};\n\nfunction getAllowedCorsOrigin(origin: string \| undefined): CorsOrigin \| null {\n const allowedOrigin = resolveAllowedCorsOrigin(origin, {\n allowedOrigins: readCorsAllowedOrigins(),\n // Let the cors-origins default apply (dev-only). Omitting this option\n // keeps production from trusting arbitrary localhost callers.\n });\n if (allowedOrigin) {\n return { origin: allowedOrigin, credentials: true };\n }\n if (origin && isMcpEmbedCorsOrigin(origin)) {\n return {\n origin,\n credentials: shouldAllowMcpEmbedCredentials(origin),\n };\n }\n return null;\n}\n\nfunction handleOptionsRequest(event: any): string {\n const origin = getHeader(event, \"origin\");\n const cors = getAllowedCorsOrigin(\n typeof origin === \"string\" ? origin : undefined,\n );\n\n if (origin && !cors) {\n setResponseStatus(event, 403);\n return \"\";\n }\n\n if (cors) {\n setResponseHeader(event, \"Access-Control-Allow-Origin\", cors.origin);\n setResponseHeader(event, \"Vary\", \"Origin\");\n if (cors.credentials) {\n setResponseHeader(event, \"Access-Control-Allow-Credentials\", \"true\");\n }\n setResponseHeader(\n event,\n \"Access-Control-Allow-Methods\",\n \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n );\n setResponseHeader(\n event,\n \"Access-Control-Allow-Headers\",\n cors.credentials\n ? `Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,${EMBED_TARGET_HEADER}`\n : `${MCP_EMBED_CORS_ALLOW_HEADERS},X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend`,\n );\n }\n\n setResponseStatus(event, 204);\n return \"\";\n}\n\nexport interface MountActionRoutesOptions {\n /* Resolve owner email from the H3 event (for data scoping). /\n getOwnerFromEvent?: (event: any) => string \| Promise<string>;\n /* Resolve display name from the H3 event, when available. /\n getUserNameFromEvent?: (\n event: any,\n ) => string \| undefined \| Promise<string \| undefined>;\n /* Resolve org ID from the H3 event (for org scoping). /\n resolveOrgId?: (event: any) => string \| null \| Promise<string \| null>;\n}\n\nfunction isAuthResolutionFailure(error: unknown): boolean {\n if (!error \|\| typeof error !== \"object\") return false;\n const maybeStatus = error as {\n status?: unknown;\n statusCode?: unknown;\n statusMessage?: unknown;\n };\n const status =\n typeof maybeStatus.statusCode === \"number\"\n ? maybeStatus.statusCode\n : typeof maybeStatus.status === \"number\"\n ? maybeStatus.status\n : undefined;\n if (status === 401 \|\| status === 403) return true;\n return (\n typeof maybeStatus.statusMessage === \"string\" &&\n /unauthenticated\|forbidden/i.test(maybeStatus.statusMessage)\n );\n}\n\n/\n Mount discovered actions as HTTP endpoints.\n \n Only actions from `autoDiscoverActions` (template actions) are mounted.\n * Built-in actions (resource-, chat-, shell, etc.) are NOT passed here.\n */\nexport function mountActionRoutes(\n nitroApp: any,\n actions: Record<string, ActionEntry>,\n options?: MountActionRoutesOptions,\n) {\n const mounted: string[] = [];\n\n for (const [name, entry] of Object.entries(actions)) {\n // Skip agent-only actions\n if (entry.http === false) continue;\n\n const method = entry.http?.method ?? \"POST\";\n const path = entry.http?.path ?? name;\n const routePath = `${ROUTE_PREFIX}/${path}`;\n\n getH3App(nitroApp).use(\n routePath,\n defineEventHandler(async (event) => {\n const reqMethod = getMethod(event);\n const effectiveMethod =\n reqMethod === \"HEAD\" && method === \"GET\" ? \"GET\" : reqMethod;\n\n if (reqMethod === \"OPTIONS\") {\n return handleOptionsRequest(event);\n }\n\n setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n // Allow the declared method\n if (effectiveMethod !== method) {\n setResponseStatus(event, 405);\n return { error: `Method not allowed. Use ${method}.` };\n }\n\n // (audit H5) Per-action `toolCallable` opt-out for the tools-iframe\n // bridge. The bridge tags every outbound action call with\n // X-Agent-Native-Tool-Bridge: 1. When that header is present and the\n // action declares `toolCallable: false`, we 403 — used by the\n // framework's share-resource / unshare-resource /\n // set-resource-visibility for defense-in-depth on auth-adjacent\n // operations. Undefined defaults to allow: tools are intra-org and\n // typically authored by trusted teammates, so the default is to\n // trust the org-level access controls.\n // The header is set by the parent (the React host), not by the\n // iframe's user-authored content; sanitizeToolRequestOptions strips\n // iframe attempts to spoof it.\n const fromToolBridge =\n getHeader(event, \"x-agent-native-tool-bridge\") === \"1\";\n if (fromToolBridge && entry.toolCallable === false) {\n setResponseStatus(event, 403);\n return {\n error: `Action '${name}' is not callable from tools.`,\n };\n }\n\n // Resolve auth context for per-request scoping\n let userEmail: string \| undefined;\n let userName: string \| undefined;\n if (options?.getOwnerFromEvent) {\n try {\n userEmail = await options.getOwnerFromEvent(event);\n userName = options?.getUserNameFromEvent\n ? await options.getUserNameFromEvent(event)\n : undefined;\n } catch (error) {\n if (\n entry.requiresAuth === false &&\n isAuthResolutionFailure(error)\n ) {\n userEmail = undefined;\n userName = undefined;\n } else {\n throw error;\n }\n }\n }\n const orgId = options?.resolveOrgId\n ? ((await options.resolveOrgId(event)) ?? undefined)\n : undefined;\n const timezone = readTimezoneHeader(event);\n\n return runWithRequestContext(\n { userEmail, userName, orgId, timezone },\n async () => {\n // Parse params based on method. On web-standard runtimes (Netlify\n // Functions, CF Workers), event.req IS the web Request — use .json()\n // directly. H3's readBody fails on those runtimes because it expects\n // a Node.js stream on event.node.req.\n let params: Record<string, any>;\n try {\n if (method === \"GET\") {\n // H3 v2: prefer web Request URL, fallback to getQuery\n const webReq = (event as any).req;\n if (webReq?.url) {\n const url = new URL(webReq.url);\n params = parseActionSearchParams(url.searchParams);\n } else {\n params = parseActionQueryObject(\n getQuery(event) as Record<string, any>,\n );\n }\n } else {\n const webReq = (event as any).req;\n if (webReq && typeof webReq.json === \"function\") {\n // H3 v2: event.req is the web Request — use .json() directly\n params = (await webReq.json().catch(() => null)) ?? {};\n } else {\n // Fallback: H3's readBody (Node.js dev)\n params = (await readBody(event)) ?? {};\n }\n }\n } catch {\n params = {};\n }\n\n // Run the action. Tag the caller: browser calls (useActionQuery /\n // useActionMutation / callAction) send X-Agent-Native-Frontend: 1,\n // so they become \"frontend\"; bare programmatic POSTs are \"http\".\n // userEmail / orgId mirror the request context resolved above (do\n // NOT inject a dev identity — leave undefined when unauthenticated).\n try {\n const caller = isFrontendActionRequest(event)\n ? \"frontend\"\n : \"http\";\n const result = await entry.run(params, {\n userEmail,\n orgId: orgId ?? null,\n caller,\n actionName: name,\n });\n\n // Auto-refresh the UI after a successful mutating action. GET\n // actions and actions explicitly flagged readOnly are skipped.\n // Other tabs' useDbSync will see source:\"action\" and invalidate\n // their action queries. The calling tab already refetches via\n // useActionMutation's onSuccess, so this is mainly cross-tab\n // sync (and parity with the agent's tool-call path).\n // Explicit entry.readOnly (true OR false) wins over the method\n // heuristic. defineAction already auto-infers GET → readOnly=true,\n // so for actions registered through that path entry.readOnly is\n // always set and the fallback just guards legacy wrap paths.\n const isReadOnly =\n typeof entry.readOnly === \"boolean\"\n ? entry.readOnly\n : method === \"GET\";\n if (!isReadOnly) {\n try {\n await notifyActionChange({\n actionName: name,\n ...(userEmail ? { owner: userEmail } : {}),\n });\n } catch {\n // ignore\n }\n }\n\n // If the action returned a string, try to parse as JSON for a clean response\n if (typeof result === \"string\") {\n try {\n return JSON.parse(result);\n } catch {\n return result;\n }\n }\n\n return result;\n } catch (err: any) {\n const msg = err?.message ?? String(err);\n const isValidationError = msg.startsWith(\n \"Invalid action parameters\",\n );\n const explicitStatus =\n typeof err?.statusCode === \"number\"\n ? err.statusCode\n : undefined;\n // Return 400 for validation errors, the explicit statusCode if\n // set, otherwise 500.\n const status = isValidationError ? 400 : (explicitStatus ?? 500);\n setResponseStatus(event, status);\n\n // Only echo the raw message for known-safe cases:\n // - validation errors (deterministic, parameter-shape only)\n // - explicit user-facing errors (AgentActionStopError / fail())\n // - errors with an explicit statusCode < 500 (client errors)\n // For uncategorized 500s, return a generic message and keep the\n // real detail server-side only — it can contain DB/driver/\n // upstream text we must not leak to HTTP callers.\n const isUserFacing =\n isValidationError \|\|\n isAgentActionStopError(err) \|\|\n (explicitStatus !== undefined && explicitStatus < 500);\n if (isUserFacing) {\n return { error: msg };\n }\n console.error(`[agent-native] action '${name}' failed:`, err);\n return { error: \"Internal server error\" };\n }\n },\n ); // end runWithRequestContext\n }),\n );\n\n mounted.push(`${method} ${routePath}`);\n }\n\n if (mounted.length > 0 && process.env.DEBUG)\n console.log(\n `[action-routes] Mounted ${mounted.length} action route(s): ${mounted.join(\", \")}`,\n );\n}\n"]}
1	+ {"version":3,"file":"action-routes.js","sourceRoot":"","sources":["../../src/server/action-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,SAAS,GACV,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,oBAAoB,IAAI,wBAAwB,EAChD,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAE9C,MAAM,UAAU,uBAAuB,CACrC,YAA6B;IAE7B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA8B;IAE9B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,IAAI,IAAI;gBAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA2B,EAC3B,MAAc,EACd,KAAU;IAEV,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7C,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAU;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,KAAU;IACzC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC,KAAK,GAAG,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAOD,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACrD,cAAc,EAAE,sBAAsB,EAAE;QACxC,sEAAsE;QACtE,8DAA8D;KAC/D,CAAC,CAAC;IACH,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,8BAA8B,CAAC,MAAM,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAU;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,oBAAoB,CAC/B,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;IAEF,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,iBAAiB,CAAC,KAAK,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QACD,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;QACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,IAAI,CAAC,WAAW;YACd,CAAC,CAAC,8KAA8K,mBAAmB,EAAE;YACrM,CAAC,CAAC,GAAG,4BAA4B,4EAA4E,CAChH,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,WAAW,GAAG,KAInB,CAAC;IACF,MAAM,MAAM,GACV,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ;QACxC,CAAC,CAAC,WAAW,CAAC,UAAU;QACxB,CAAC,CAAC,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ;YACtC,CAAC,CAAC,WAAW,CAAC,MAAM;YACpB,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CACL,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ;QAC7C,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAa,EACb,OAAoC,EACpC,OAAkC;IAElC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,0BAA0B;QAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAEnC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;QAE5C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,SAAS,EACT,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,eAAe,GACnB,SAAS,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAE/D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YAEtD,4BAA4B;YAC5B,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,MAAM,GAAG,EAAE,CAAC;YACzD,CAAC;YAED,oEAAoE;YACpE,0DAA0D;YAC1D,qEAAqE;YACrE,8DAA8D;YAC9D,kDAAkD;YAClD,gEAAgE;YAChE,mEAAmE;YACnE,gEAAgE;YAChE,uCAAuC;YACvC,+DAA+D;YAC/D,oEAAoE;YACpE,+BAA+B;YAC/B,MAAM,cAAc,GAClB,SAAS,CAAC,KAAK,EAAE,4BAA4B,CAAC,KAAK,GAAG,CAAC;YACzD,IAAI,cAAc,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,WAAW,IAAI,+BAA+B;iBACtD,CAAC;YACJ,CAAC;YAED,+CAA+C;YAC/C,IAAI,SAA6B,CAAC;YAClC,IAAI,QAA4B,CAAC;YACjC,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;oBACnD,QAAQ,GAAG,OAAO,EAAE,oBAAoB;wBACtC,CAAC,CAAC,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,SAAS,CAAC;gBAChB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IACE,KAAK,CAAC,YAAY,KAAK,KAAK;wBAC5B,uBAAuB,CAAC,KAAK,CAAC,EAC9B,CAAC;wBACD,SAAS,GAAG,SAAS,CAAC;wBACtB,QAAQ,GAAG,SAAS,CAAC;oBACvB,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,EAAE,YAAY;gBACjC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAE3C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EACxC,KAAK,IAAI,EAAE;gBACT,kEAAkE;gBAClE,qEAAqE;gBACrE,qEAAqE;gBACrE,sCAAsC;gBACtC,IAAI,MAA2B,CAAC;gBAChC,IAAI,CAAC;oBACH,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,sDAAsD;wBACtD,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC;4BAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;4BAChC,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;wBACrD,CAAC;6BAAM,CAAC;4BACN,MAAM,GAAG,sBAAsB,CAC7B,QAAQ,CAAC,KAAK,CAAwB,CACvC,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;4BAChD,6DAA6D;4BAC7D,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzD,CAAC;6BAAM,CAAC;4BACN,wCAAwC;4BACxC,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBAED,kEAAkE;gBAClE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,qEAAqE;gBACrE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,MAAM,CAAC;oBACX,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;wBACrC,SAAS;wBACT,KAAK,EAAE,KAAK,IAAI,IAAI;wBACpB,MAAM;wBACN,UAAU,EAAE,IAAI;qBACjB,CAAC,CAAC;oBAEH,8DAA8D;oBAC9D,+DAA+D;oBAC/D,gEAAgE;oBAChE,8DAA8D;oBAC9D,6DAA6D;oBAC7D,qDAAqD;oBACrD,+DAA+D;oBAC/D,mEAAmE;oBACnE,gEAAgE;oBAChE,6DAA6D;oBAC7D,MAAM,UAAU,GACd,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;wBACjC,CAAC,CAAC,KAAK,CAAC,QAAQ;wBAChB,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;oBACvB,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,IAAI,CAAC;4BACH,MAAM,kBAAkB,CAAC;gCACvB,UAAU,EAAE,IAAI;gCAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC3C,CAAC,CAAC;wBACL,CAAC;wBAAC,MAAM,CAAC;4BACP,SAAS;wBACX,CAAC;oBACH,CAAC;oBAED,8DAA8D;oBAC9D,+DAA+D;oBAC/D,kEAAkE;oBAClE,6DAA6D;oBAC7D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBAC/B,IAAI,CAAC;4BACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC5B,CAAC;wBAAC,MAAM,CAAC;4BACP,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;4BAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;wBAChC,CAAC;oBACH,CAAC;oBAED,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxC,MAAM,iBAAiB,GAAG,GAAG,CAAC,UAAU,CACtC,2BAA2B,CAC5B,CAAC;oBACF,MAAM,cAAc,GAClB,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ;wBACjC,CAAC,CAAC,GAAG,CAAC,UAAU;wBAChB,CAAC,CAAC,SAAS,CAAC;oBAChB,+DAA+D;oBAC/D,sBAAsB;oBACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;oBACjE,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAEjC,kDAAkD;oBAClD,6DAA6D;oBAC7D,iEAAiE;oBACjE,8DAA8D;oBAC9D,gEAAgE;oBAChE,2DAA2D;oBAC3D,kDAAkD;oBAClD,MAAM,YAAY,GAChB,iBAAiB;wBACjB,sBAAsB,CAAC,GAAG,CAAC;wBAC3B,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC;oBACzD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;oBACxB,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC;oBAC9D,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC,CACF,CAAC,CAAC,4BAA4B;QACjC,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;QACzC,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,CAAC,MAAM,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;AACN,CAAC","sourcesContent":["import {\n defineEventHandler,\n setResponseStatus,\n setResponseHeader,\n getMethod,\n getQuery,\n getHeader,\n} from \"h3\";\n\nimport { isAgentActionStopError } from \"../action.js\";\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { EMBED_TARGET_HEADER } from \"../shared/embed-auth.js\";\nimport {\n isMcpEmbedCorsOrigin,\n MCP_EMBED_CORS_ALLOW_HEADERS,\n shouldAllowMcpEmbedCredentials,\n} from \"../shared/mcp-embed-headers.js\";\nimport { notifyActionChange } from \"./action-change.js\";\nimport {\n getAllowedCorsOrigin as resolveAllowedCorsOrigin,\n readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\n/*\n Auto-mount actions as HTTP endpoints under /_agent-native/actions/:name.\n \n Actions are exposed as POST by default. Use `http: { method: \"GET\" }` in\n * defineAction to expose as GET. Use `http: false` to mark as agent-only.\n /\nimport { getH3App } from \"./framework-request-handler.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nconst ROUTE_PREFIX = \"/_agent-native/actions\";\n\nexport function parseActionSearchParams(\n searchParams: URLSearchParams,\n): Record<string, any> {\n const params: Record<string, any> = {};\n for (const [rawKey, value] of searchParams.entries()) {\n appendActionParam(params, rawKey, value);\n }\n return params;\n}\n\nfunction parseActionQueryObject(\n query: Record<string, unknown>,\n): Record<string, any> {\n const params: Record<string, any> = {};\n for (const [rawKey, rawValue] of Object.entries(query)) {\n const values = Array.isArray(rawValue) ? rawValue : [rawValue];\n for (const value of values) {\n if (value != null) appendActionParam(params, rawKey, String(value));\n }\n }\n return params;\n}\n\nfunction appendActionParam(\n params: Record<string, any>,\n rawKey: string,\n value: any,\n) {\n const isArrayKey = rawKey.endsWith(\"[]\");\n // The core client serializes arrays as `key[]=value` so even a single\n // value can validate against z.array() action schemas.\n const key = isArrayKey ? rawKey.slice(0, -2) : rawKey;\n const current = params[key];\n if (current === undefined) {\n params[key] = isArrayKey ? [value] : value;\n } else if (Array.isArray(current)) {\n current.push(value);\n } else {\n params[key] = [current, value];\n }\n}\n\n/\n Read the caller's IANA timezone from the `x-user-timezone` header. The core\n * client sends this on every action request so server-side \"today\" fallbacks\n * can honor the user's local day.\n /\nfunction readTimezoneHeader(event: any): string \| undefined {\n try {\n const raw = getHeader(event, \"x-user-timezone\");\n if (!raw \|\| typeof raw !== \"string\") return undefined;\n const trimmed = raw.trim();\n return trimmed.length > 0 && trimmed.length < 64 ? trimmed : undefined;\n } catch {\n return undefined;\n }\n}\n\n/\n True when the request originated from the browser action client\n * (`useActionQuery` / `useActionMutation` / `callAction`), which tags every\n * call with `X-Agent-Native-Frontend: 1`. Used to set `ctx.caller` to\n * `\"frontend\"` vs a bare programmatic `\"http\"` POST. The header carries no\n * auth weight — it only narrows the caller tag for tracking/branching.\n /\nfunction isFrontendActionRequest(event: any): boolean {\n try {\n return getHeader(event, \"x-agent-native-frontend\") === \"1\";\n } catch {\n return false;\n }\n}\n\ntype CorsOrigin = {\n origin: string;\n credentials: boolean;\n};\n\nfunction getAllowedCorsOrigin(origin: string \| undefined): CorsOrigin \| null {\n const allowedOrigin = resolveAllowedCorsOrigin(origin, {\n allowedOrigins: readCorsAllowedOrigins(),\n // Let the cors-origins default apply (dev-only). Omitting this option\n // keeps production from trusting arbitrary localhost callers.\n });\n if (allowedOrigin) {\n return { origin: allowedOrigin, credentials: true };\n }\n if (origin && isMcpEmbedCorsOrigin(origin)) {\n return {\n origin,\n credentials: shouldAllowMcpEmbedCredentials(origin),\n };\n }\n return null;\n}\n\nfunction handleOptionsRequest(event: any): string {\n const origin = getHeader(event, \"origin\");\n const cors = getAllowedCorsOrigin(\n typeof origin === \"string\" ? origin : undefined,\n );\n\n if (origin && !cors) {\n setResponseStatus(event, 403);\n return \"\";\n }\n\n if (cors) {\n setResponseHeader(event, \"Access-Control-Allow-Origin\", cors.origin);\n setResponseHeader(event, \"Vary\", \"Origin\");\n if (cors.credentials) {\n setResponseHeader(event, \"Access-Control-Allow-Credentials\", \"true\");\n }\n setResponseHeader(\n event,\n \"Access-Control-Allow-Methods\",\n \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n );\n setResponseHeader(\n event,\n \"Access-Control-Allow-Headers\",\n cors.credentials\n ? `Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,${EMBED_TARGET_HEADER}`\n : `${MCP_EMBED_CORS_ALLOW_HEADERS},X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend`,\n );\n }\n\n setResponseStatus(event, 204);\n return \"\";\n}\n\nexport interface MountActionRoutesOptions {\n /* Resolve owner email from the H3 event (for data scoping). /\n getOwnerFromEvent?: (event: any) => string \| Promise<string>;\n /* Resolve display name from the H3 event, when available. /\n getUserNameFromEvent?: (\n event: any,\n ) => string \| undefined \| Promise<string \| undefined>;\n /* Resolve org ID from the H3 event (for org scoping). /\n resolveOrgId?: (event: any) => string \| null \| Promise<string \| null>;\n}\n\nfunction isAuthResolutionFailure(error: unknown): boolean {\n if (!error \|\| typeof error !== \"object\") return false;\n const maybeStatus = error as {\n status?: unknown;\n statusCode?: unknown;\n statusMessage?: unknown;\n };\n const status =\n typeof maybeStatus.statusCode === \"number\"\n ? maybeStatus.statusCode\n : typeof maybeStatus.status === \"number\"\n ? maybeStatus.status\n : undefined;\n if (status === 401 \|\| status === 403) return true;\n return (\n typeof maybeStatus.statusMessage === \"string\" &&\n /unauthenticated\|forbidden/i.test(maybeStatus.statusMessage)\n );\n}\n\n/\n Mount discovered actions as HTTP endpoints.\n \n Only actions from `autoDiscoverActions` (template actions) are mounted.\n * Built-in actions (resource-, chat-, shell, etc.) are NOT passed here.\n */\nexport function mountActionRoutes(\n nitroApp: any,\n actions: Record<string, ActionEntry>,\n options?: MountActionRoutesOptions,\n) {\n const mounted: string[] = [];\n\n for (const [name, entry] of Object.entries(actions)) {\n // Skip agent-only actions\n if (entry.http === false) continue;\n\n const method = entry.http?.method ?? \"POST\";\n const path = entry.http?.path ?? name;\n const routePath = `${ROUTE_PREFIX}/${path}`;\n\n getH3App(nitroApp).use(\n routePath,\n defineEventHandler(async (event) => {\n const reqMethod = getMethod(event);\n const effectiveMethod =\n reqMethod === \"HEAD\" && method === \"GET\" ? \"GET\" : reqMethod;\n\n if (reqMethod === \"OPTIONS\") {\n return handleOptionsRequest(event);\n }\n\n setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n // Allow the declared method\n if (effectiveMethod !== method) {\n setResponseStatus(event, 405);\n return { error: `Method not allowed. Use ${method}.` };\n }\n\n // (audit H5) Per-action `toolCallable` opt-out for the tools-iframe\n // bridge. The bridge tags every outbound action call with\n // X-Agent-Native-Tool-Bridge: 1. When that header is present and the\n // action declares `toolCallable: false`, we 403 — used by the\n // framework's share-resource / unshare-resource /\n // set-resource-visibility for defense-in-depth on auth-adjacent\n // operations. Undefined defaults to allow: tools are intra-org and\n // typically authored by trusted teammates, so the default is to\n // trust the org-level access controls.\n // The header is set by the parent (the React host), not by the\n // iframe's user-authored content; sanitizeToolRequestOptions strips\n // iframe attempts to spoof it.\n const fromToolBridge =\n getHeader(event, \"x-agent-native-tool-bridge\") === \"1\";\n if (fromToolBridge && entry.toolCallable === false) {\n setResponseStatus(event, 403);\n return {\n error: `Action '${name}' is not callable from tools.`,\n };\n }\n\n // Resolve auth context for per-request scoping\n let userEmail: string \| undefined;\n let userName: string \| undefined;\n if (options?.getOwnerFromEvent) {\n try {\n userEmail = await options.getOwnerFromEvent(event);\n userName = options?.getUserNameFromEvent\n ? await options.getUserNameFromEvent(event)\n : undefined;\n } catch (error) {\n if (\n entry.requiresAuth === false &&\n isAuthResolutionFailure(error)\n ) {\n userEmail = undefined;\n userName = undefined;\n } else {\n throw error;\n }\n }\n }\n const orgId = options?.resolveOrgId\n ? ((await options.resolveOrgId(event)) ?? undefined)\n : undefined;\n const timezone = readTimezoneHeader(event);\n\n return runWithRequestContext(\n { userEmail, userName, orgId, timezone },\n async () => {\n // Parse params based on method. On web-standard runtimes (Netlify\n // Functions, CF Workers), event.req IS the web Request — use .json()\n // directly. H3's readBody fails on those runtimes because it expects\n // a Node.js stream on event.node.req.\n let params: Record<string, any>;\n try {\n if (method === \"GET\") {\n // H3 v2: prefer web Request URL, fallback to getQuery\n const webReq = (event as any).req;\n if (webReq?.url) {\n const url = new URL(webReq.url);\n params = parseActionSearchParams(url.searchParams);\n } else {\n params = parseActionQueryObject(\n getQuery(event) as Record<string, any>,\n );\n }\n } else {\n const webReq = (event as any).req;\n if (webReq && typeof webReq.json === \"function\") {\n // H3 v2: event.req is the web Request — use .json() directly\n params = (await webReq.json().catch(() => null)) ?? {};\n } else {\n // Fallback: H3's readBody (Node.js dev)\n params = (await readBody(event)) ?? {};\n }\n }\n } catch {\n params = {};\n }\n\n // Run the action. Tag the caller: browser calls (useActionQuery /\n // useActionMutation / callAction) send X-Agent-Native-Frontend: 1,\n // so they become \"frontend\"; bare programmatic POSTs are \"http\".\n // userEmail / orgId mirror the request context resolved above (do\n // NOT inject a dev identity — leave undefined when unauthenticated).\n try {\n const caller = isFrontendActionRequest(event)\n ? \"frontend\"\n : \"http\";\n const result = await entry.run(params, {\n userEmail,\n orgId: orgId ?? null,\n caller,\n actionName: name,\n });\n\n // Auto-refresh the UI after a successful mutating action. GET\n // actions and actions explicitly flagged readOnly are skipped.\n // Other tabs' useDbSync will see source:\"action\" and invalidate\n // their action queries. The calling tab already refetches via\n // useActionMutation's onSuccess, so this is mainly cross-tab\n // sync (and parity with the agent's tool-call path).\n // Explicit entry.readOnly (true OR false) wins over the method\n // heuristic. defineAction already auto-infers GET → readOnly=true,\n // so for actions registered through that path entry.readOnly is\n // always set and the fallback just guards legacy wrap paths.\n const isReadOnly =\n typeof entry.readOnly === \"boolean\"\n ? entry.readOnly\n : method === \"GET\";\n if (!isReadOnly) {\n try {\n await notifyActionChange({\n actionName: name,\n ...(userEmail ? { owner: userEmail } : {}),\n });\n } catch {\n // ignore\n }\n }\n\n // If the action returned a string, try to parse as JSON for a\n // clean response. Plain strings still need to go over the HTTP\n // action transport as JSON, otherwise H3 sends text/plain and the\n // browser action client rejects the successful 2xx response.\n if (typeof result === \"string\") {\n try {\n return JSON.parse(result);\n } catch {\n setResponseHeader(event, \"Content-Type\", \"application/json\");\n return JSON.stringify(result);\n }\n }\n\n return result;\n } catch (err: any) {\n const msg = err?.message ?? String(err);\n const isValidationError = msg.startsWith(\n \"Invalid action parameters\",\n );\n const explicitStatus =\n typeof err?.statusCode === \"number\"\n ? err.statusCode\n : undefined;\n // Return 400 for validation errors, the explicit statusCode if\n // set, otherwise 500.\n const status = isValidationError ? 400 : (explicitStatus ?? 500);\n setResponseStatus(event, status);\n\n // Only echo the raw message for known-safe cases:\n // - validation errors (deterministic, parameter-shape only)\n // - explicit user-facing errors (AgentActionStopError / fail())\n // - errors with an explicit statusCode < 500 (client errors)\n // For uncategorized 500s, return a generic message and keep the\n // real detail server-side only — it can contain DB/driver/\n // upstream text we must not leak to HTTP callers.\n const isUserFacing =\n isValidationError \|\|\n isAgentActionStopError(err) \|\|\n (explicitStatus !== undefined && explicitStatus < 500);\n if (isUserFacing) {\n return { error: msg };\n }\n console.error(`[agent-native] action '${name}' failed:`, err);\n return { error: \"Internal server error\" };\n }\n },\n ); // end runWithRequestContext\n }),\n );\n\n mounted.push(`${method} ${routePath}`);\n }\n\n if (mounted.length > 0 && process.env.DEBUG)\n console.log(\n `[action-routes] Mounted ${mounted.length} action route(s): ${mounted.join(\", \")}`,\n );\n}\n"]}

package/dist/server/agent-chat-plugin.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAEZ,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAkCrC,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAa7D,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAElB,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAkBL,KAAK,UAAU,EAGhB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,gBAAgB,EAcjB,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;~~AAwBpC~~,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AA2E5B,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACrE,iBAAiB,EAAE,CACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;CACjC;AAsID,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,6BAA6B;;;;YA/L/B,MAAM;eACH,MAAM;iBACJ,MAAM;sBACD,MAAM;mBACT,MAAM;mBACN,MAAM;eACV;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI;kBACpC,KAAK,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;YACtC,IAAI,EAAE,MAAM,CAAC;YACb,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;SAC7B,CAAC;;;GAiNH;AA2ZD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,KAAK,CAAC;IACP,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;CACzC,CAAC,CASD;AAmBD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,OAAO,GAAE,0BAA0B,GAAG;IAAE,KAAK,CAAC,EAAE,GAAG,CAAA;CAAO,GACzD;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,~~CAO7C~~;~~AAoWD~~,iBAAS,6BAA6B,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAyDpE;AAurCD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,wCAAwC;IACxC,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;sDAGkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EACH,OAAO,0BAA0B,EAAE,WAAW,GAC9C,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,gBAAgB,CAAC,EACb,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QACd,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,uEAAuE;QACvE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gFAAgF;QAChF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gFAAgF;QAChF,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,8BAA8B,EAAE,2BAA2B,CAAC;IACxF;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;KACtB,KACG,IAAI,GACJ;QACE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,GACD,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,CAAC,CAAC;IACP;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,OAAO,iBAAiB,EAAE,OAAO,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAC;QACrD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,KACG,OAAO,iBAAiB,EAAE,OAAO,GACjC,MAAM,GACN,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,OAAO,iBAAiB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC3E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE;QACd,UAAU,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,SAAS,CAAC;QAC7C;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAyLD;;;;;;;;GAQG;AACH,iBAAS,qBAAqB,CAC5B,QAAQ,CAAC,EAAE,cAAc,EACzB,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E;IACD,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6BAA6B,EAAE,MAAM,CAAC;IACtC,4BAA4B,EAAE,MAAM,CAAC;CACtC,~~CAgLA~~;AAED,eAAO,MAAM,gCAAgC;;;;;;;CAczC,CAAC;AAEL;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,UAAQ,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAoLjB;AAsBD;;;;;;;;;;;GAWG;AACH,iBAAS,qBAAqB,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,IAAI,GAAE,KAAK,GAAG,MAAe,GAC5B,MAAM,CAoER;AA0KD,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,OAAO,CA2BV;AAED,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,~~CAi3IhB~~;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAa9E,yEAAyE;AACzE,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAE7D;AAED,yFAAyF;AACzF,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAKhE"}
1	+ {"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAEZ,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAkCrC,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAa7D,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAElB,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAkBL,KAAK,UAAU,EAGhB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,gBAAgB,EAcjB,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AA+BpC,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AA2E5B,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACrE,iBAAiB,EAAE,CACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;CACjC;AAsID,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,6BAA6B;;;;YA/L/B,MAAM;eACH,MAAM;iBACJ,MAAM;sBACD,MAAM;mBACT,MAAM;mBACN,MAAM;eACV;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI;kBACpC,KAAK,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;YACtC,IAAI,EAAE,MAAM,CAAC;YACb,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;SAC7B,CAAC;;;GAiNH;AA2ZD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,KAAK,CAAC;IACP,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;CACzC,CAAC,CASD;AAmBD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,OAAO,GAAE,0BAA0B,GAAG;IAAE,KAAK,CAAC,EAAE,GAAG,CAAA;CAAO,GACzD;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAa7C;AAmYD,iBAAS,6BAA6B,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAyDpE;AAurCD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,wCAAwC;IACxC,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;sDAGkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EACH,OAAO,0BAA0B,EAAE,WAAW,GAC9C,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,gBAAgB,CAAC,EACb,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QACd,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,uEAAuE;QACvE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gFAAgF;QAChF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gFAAgF;QAChF,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,8BAA8B,EAAE,2BAA2B,CAAC;IACxF;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;KACtB,KACG,IAAI,GACJ;QACE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,GACD,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,CAAC,CAAC;IACP;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,OAAO,iBAAiB,EAAE,OAAO,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAC;QACrD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,KACG,OAAO,iBAAiB,EAAE,OAAO,GACjC,MAAM,GACN,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,OAAO,iBAAiB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC3E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE;QACd,UAAU,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,SAAS,CAAC;QAC7C;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAyLD;;;;;;;;GAQG;AACH,iBAAS,qBAAqB,CAC5B,QAAQ,CAAC,EAAE,cAAc,EACzB,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E;IACD,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6BAA6B,EAAE,MAAM,CAAC;IACtC,4BAA4B,EAAE,MAAM,CAAC;CACtC,CAoLA;AAED,eAAO,MAAM,gCAAgC;;;;;;;CAczC,CAAC;AAEL;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,UAAQ,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAoLjB;AAsBD;;;;;;;;;;;GAWG;AACH,iBAAS,qBAAqB,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,IAAI,GAAE,KAAK,GAAG,MAAe,GAC5B,MAAM,CAoER;AA0KD,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,OAAO,CA2BV;AAED,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAivIhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAa9E,yEAAyE;AACzE,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAE7D;AAED,yFAAyF;AACzF,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAKhE"}

package/dist/server/agent-chat-plugin.js CHANGED Viewed

@@ -28,10 +28,12 @@ import { normalizeDatabaseToolsMode, } from "../scripts/db/tool-mode.js";
 import { dbExecToolParameters } from "../scripts/db/tool-schemas.js";
 import { getSetting, putSetting } from "../settings/store.js";
 import { discoverAgents } from "./agent-discovery.js";
+import { resolveAgentRunOwnerContext, runWithAgentRunContext, seedBackgroundAgentRunOwnerContext, } from "./agent-run-context.js";
 import { AGENT_TEAM_PROCESS_RUN_PATH, getCurrentDelegationDepth, processAgentTeamRun, reconcileAgentTeamRunsForOwner, } from "./agent-teams.js";
 import { withConfiguredAppBasePath } from "./app-base-path.js";
 import { getSession } from "./auth.js";
 import { getBuilderBrowserConnectUrlForOwner, resolveBuilderBranchProjectId, } from "./builder-browser.js";
+import { captureError } from "./capture-error.js";
 import { captureCliOutput } from "./cli-capture.js";
 import { getH3App, markDefaultPluginProvided, trackPluginInit, } from "./framework-request-handler.js";
 import { getOrigin } from "./google-oauth.js";
@@ -581,13 +583,47 @@ function resolveArtifactBaseUrl(event) {
     return undefined;
 }
 export function assembleA2AFinalResponse(events, toolResults, options = {}) {
-    const responseText = collectFinalResponseTextFromAgentEvents(events);
+    const terminalError = getA2ATerminalErrorEvent(events);
+    const responseText = collectFinalResponseTextFromAgentEvents(events, {
+        fallbackToPreToolText: !terminalError,
+    });
     const finalText = appendA2AArtifactLinks(responseText, [...toolResults], {
         baseUrl: options.baseUrl ?? resolveArtifactBaseUrl(options.event),
         includeReferencedArtifacts: true,
     });
+    if (terminalError && !finalText.trim()) {
+        throw new Error(formatA2ATerminalError(terminalError));
+    }
     return { responseText, finalText };
 }
+function getA2ATerminalErrorEvent(events) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const event = events[i];
+        if (event.type === "clear")
+            continue;
+        if (event.type === "done")
+            return null;
+        if (event.type === "error")
+            return event;
+        if (event.type === "auto_continue") {
+            return {
+                type: "error",
+                error: `Agent stopped before finishing (${event.reason}).`,
+                errorCode: event.reason,
+                recoverable: true,
+            };
+        }
+    }
+    return null;
+}
+function formatA2ATerminalError(event) {
+    const parts = [
+        event.error || "Agent failed before producing a final response.",
+        event.errorCode ? `code: ${event.errorCode}` : "",
+        event.details ? `details: ${event.details}` : "",
+    ].filter(Boolean);
+    return parts.join("\n");
+}
 /**
  * Creates the `get-framework-context` tool. Returns detailed instructions
  * for framework capabilities that are summarized in the compact prompt.
@@ -2149,6 +2185,8 @@ In Act mode, if the user asks for generated interactive UI in chat, choose the s
 These are **NOT** source-code changes and do **NOT** go through \`connect-builder\`. Extensions are sandboxed mini-apps — no source files are touched, no PR is opened, no build is required. Saved extensions can be edited later via \`update-extension\`.
+If the app exposes native actions or instructions for dashboards, reports, analyses, charts, documents, decks, or other domain artifacts, use those app-native actions first. Choose an extension only when the user explicitly asks for an extension/custom mini-app, or when the app's native artifact format cannot faithfully express the requested interaction.
 Keep \`create-extension\` payloads compact enough to finish quickly. For complex extensions, create a useful working v1 first, then call \`update-extension\` with focused edits for refinements instead of trying to assemble one enormous initial tool input.
 Generated UI content can use appAction(), appFetch(), dbQuery(), dbExec(), extensionFetch(), extensionData, agentNative.ui.output(value, opts?), and agentNative.chat.send(...)/sendToAgentChat(...). It can receive chat inputs through slotContext/window.onSlotContext. Use agentNative.ui.output for passive current values from knobs, sliders, selections, and controls; it writes application state at \`inline-ui:<extensionId>:output\` scoped to the inline extension id returned by \`render-inline-extension\` or \`show-extension-inline\`. When the user later says "use that value", "apply the current setting", or similar, read it with \`readAppState("inline-ui:<id>:output")\` instead of asking them to send it again. Use agentNative.chat.send for visible submit/apply actions that should put a message into chat. Transient extensionData is browser-local and not agent-readable, synced, promoted, or garbage-collected; use application_state/appFetch, appAction, ui.output, or chat.send for anything the agent or app must observe. Use semantic Tailwind classes like bg-background, text-foreground, bg-primary, border-border, and text-muted-foreground so the UI inherits the parent app theme.
@@ -2176,7 +2214,7 @@ Route by what the request changes, not how it is phrased. Extensions render in t
 | Ambiguous, satisfiable either way (e.g. "give me an unread view") | \`render-inline-extension\` for chat-only, \`create-extension\` for reusable |
 </routing>
-Worked examples: "a widget showing unread emails grouped by sender", "a dashboard summarizing my pipeline", "a tracker for my newsletter subscriptions" → \`create-extension\`. "Add an Unread tab to the left navigation", "make the subject lines wrap", "change the inbox grouping logic", "add a field to the compose form" → \`connect-builder\`.`
+Worked examples: "a widget showing unread emails grouped by sender", "a tracker for my newsletter subscriptions", "a custom kanban board with drag-and-drop rules the app does not have" → \`create-extension\`. "Add an Unread tab to the left navigation", "make the subject lines wrap", "change the inbox grouping logic", "add a field to the compose form" → \`connect-builder\`.`
         : `### Extensions Disabled
 Extension creation and management tools are disabled for this app. Do not claim you can create, edit, hide, or delete Agent-Native extensions unless the template exposes its own typed action for that workflow. For requests that would otherwise be handled as an extension/widget/dashboard/calculator mini-app, explain that this app has disabled extension tools and use the app's available actions instead.`;
@@ -2185,6 +2223,8 @@ Extension creation and management tools are disabled for this app. Do not claim
 In Act mode, if the user asks for generated interactive UI in chat, call \`render-inline-extension\` for one-time inline controls/knobs/calculators/visualizers that do not need saving. If the user asks for an **extension**, **widget**, **dashboard**, **calculator**, or **mini-app** that should be reusable or saved, call \`create-extension\` with a self-contained Alpine.js HTML body. To load a saved extension inline, call \`show-extension-inline\`. These are NOT code changes — extensions are sandboxed mini-apps. Do not preface with "let me build…" — just call the right extension action.
+Use app-native artifact actions first when they exist for dashboards, reports, analyses, charts, documents, decks, or similar domain artifacts. Pick \`create-extension\` only for explicit extension/custom mini-app requests or for behavior the native artifact format cannot support.
 Keep the first \`create-extension\` call compact and working. If the request is complex, create the v1 first and then refine with focused \`update-extension\` edits.
 Generated UI can read chat inputs from slotContext/window.onSlotContext, see/update app state through appFetch/appAction, use extensionData, record passive current values through agentNative.ui.output(value, opts?), and send visible results through agentNative.chat.send(...) or sendToAgentChat(...). ui.output writes \`inline-ui:<extensionId>:output\` in application state; when the user asks to use the current slider/selection/value, read \`readAppState("inline-ui:<id>:output")\`. Transient extensionData is browser-local only, so do not rely on it for values the agent or app must observe. Use semantic Tailwind theme classes.
@@ -3798,36 +3838,11 @@ export function createAgentChatPlugin(options) {
                     },
                 });
             }
-            const OWNER_CONTEXT_KEY = "__agentNativeOwnerContext";
             // Resolve owner from the H3 event's session, with an optional
             // template-provided anonymous owner for public read-only surfaces.
             const resolveOwnerContext = async (event) => {
-                const eventContext = event?.context;
-                if (eventContext?.[OWNER_CONTEXT_KEY]) {
-                    return eventContext[OWNER_CONTEXT_KEY];
-                }
-                const session = await getSession(event);
-                if (session?.email) {
-                    const resolved = {
-                        owner: session.email,
-                        anonymous: false,
-                        name: session.name,
-                    };
-                    if (eventContext)
-                        eventContext[OWNER_CONTEXT_KEY] = resolved;
-                    return resolved;
-                }
-                const anonymousOwner = await options?.anonymousOwner?.(event);
-                if (anonymousOwner) {
-                    const resolved = { owner: anonymousOwner, anonymous: true };
-                    if (eventContext)
-                        eventContext[OWNER_CONTEXT_KEY] = resolved;
-                    return resolved;
-                }
-                const { createError } = await import("h3");
-                throw createError({
-                    statusCode: 401,
-                    statusMessage: "Unauthenticated",
+                return resolveAgentRunOwnerContext(event, {
+                    anonymousOwner: options?.anonymousOwner,
                 });
             };
             const getOwnerFromEvent = async (event) => {
@@ -6078,91 +6093,13 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // the background worker), so both go through identical context + handler
             // selection.
             const invokeAgentChatHandler = async (event) => {
-                // Resolve per-request auth context
+                // Resolve per-request auth context.
                 const ownerContext = await resolveOwnerContext(event);
-                const owner = ownerContext.owner;
-                // Resolve org ID: explicit callback > session.orgId from Better Auth
-                // > implicit org membership. Better Auth leaves session.orgId null
-                // until the user explicitly switches orgs, so a fresh signup with
-                // implicit membership (e.g. domain-matched org) would otherwise see
-                // no org-scoped credentials. getOrgContext() does the same DB lookup
-                // the /builder/status endpoint uses to decide "Connected".
-                let resolvedOrgId;
-                if (options?.resolveOrgId) {
-                    resolvedOrgId = (await options.resolveOrgId(event)) ?? undefined;
-                }
-                else {
-                    try {
-                        const session = await getSession(event);
-                        resolvedOrgId = session?.orgId ?? undefined;
-                    }
-                    catch {
-                        // Session not available
-                    }
-                    if (!resolvedOrgId) {
-                        try {
-                            const { getOrgContext } = await import("../org/context.js");
-                            const ctx = await getOrgContext(event);
-                            resolvedOrgId = ctx.orgId ?? undefined;
-                        }
-                        catch {
-                            // org_members table may not exist yet on first boot
-                        }
-                    }
-                }
-                // Cookieless durable background worker: getSession()/getOrgContext()
-                // resolve from the (absent) session, so org-scoped credential resolution
-                // (the Builder engine) would miss the owner's org and resolveEngine would
-                // fall back to the anthropic default — bailing on a missing key before
-                // the worker claims its run. The owner IS known here (seeded via
-                // OWNER_CONTEXT_KEY from the run's thread), so resolve the org directly
-                // from the owner email, the same active-org logic the foreground session
-                // would yield.
-                if (!resolvedOrgId && owner) {
-                    try {
-                        const { resolveOrgIdForEmail } = await import("../org/context.js");
-                        resolvedOrgId = (await resolveOrgIdForEmail(owner)) ?? undefined;
-                    }
-                    catch {
-                        // org tables unavailable — proceed without org (foreground-equivalent)
-                    }
-                }
-                // DURABLE OWNER CONTEXT, PART 2: ORG.
-                // The cookieless `_process-run` self-dispatch (and any other background
-                // re-entry) resolves the owner from the run row, but has NO session —
-                // every org resolver above ultimately derives identity from
-                // getSession(event), so they all come back null here. That silently
-                // scopes the agent to `org_id IS NULL` rows only: it sees and writes
-                // resources outside the user's org, while the foreground UI — which
-                // carries the session cookie — resolves the real org. The result is the
-                // observed split where the agent can't list/read the same resources the
-                // UI shows and writes new rows with a null org. Resolve the org from the
-                // now-known owner email (the same active-org / membership logic
-                // getOrgContext uses, minus the session) so the agent and the UI operate
-                // over the same org-scoped data.
-                if (!resolvedOrgId && owner && !ownerContext.anonymous) {
-                    try {
-                        const { resolveOrgIdForEmail } = await import("../org/context.js");
-                        resolvedOrgId = (await resolveOrgIdForEmail(owner)) ?? undefined;
-                    }
-                    catch {
-                        // org tables unavailable (first boot) — leave org unscoped
-                    }
-                }
-                // Propagate the caller's IANA timezone from `x-user-timezone` so that
-                // tool calls made by the agent (e.g. log-meal with no explicit date)
-                // resolve "today" in the user's local timezone instead of server UTC.
-                const tzRaw = getHeader(event, "x-user-timezone");
-                const timezone = typeof tzRaw === "string" &&
-                    tzRaw.trim().length > 0 &&
-                    tzRaw.trim().length < 64
-                    ? tzRaw.trim()
-                    : undefined;
-                return runWithRequestContext({
-                    userEmail: owner,
-                    userName: ownerContext.name,
-                    orgId: resolvedOrgId,
-                    timezone,
+                return runWithAgentRunContext({
+                    event,
+                    ownerContext,
+                    resolveOrgId: options?.resolveOrgId,
+                    isBackgroundWorker: Boolean(event.context?.__agentChatBackgroundBody),
                 }, () => {
                     // App-rendered chat can't host direct code edits — HMR/full
                     // reloads would kill the same chat surface mid-run. Force the
@@ -6256,51 +6193,29 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 // is already consumed, so the handler reads this instead.
                 event.context = event.context ?? {};
                 event.context.__agentChatBackgroundBody = prepared.body;
-                // DURABLE OWNER CONTEXT: this self-dispatch is cookieless (HMAC-only —
-                // the foreground POST carried the user's session, but this background-
-                // function invocation does not). Without a session, resolveOwnerContext()
-                // falls through to its 401 "Unauthenticated" throw and the worker dies
-                // before it can even claim the run (observed in prod as the `route_threw`
-                // diag stage — every durable run only completed via the foreground
-                // circuit-breaker's inline recovery). The run's chat thread already
-                // records the authenticated owner (written by the foreground under the
-                // signed-in user), so resolve the owner from the run row — NOT from the
-                // request body, which the HMAC does not cover and a caller could forge —
-                // and pre-seed the owner context the handler reads (resolveOwnerContext
-                // returns it before attempting any session lookup).
-                let backgroundOwner = null;
-                try {
-                    const { getRunOwnerEmail } = await import("../agent/run-store.js");
-                    backgroundOwner = await getRunOwnerEmail(prepared.runId);
-                    if (backgroundOwner) {
-                        event.context[OWNER_CONTEXT_KEY] = {
-                            owner: backgroundOwner,
-                            anonymous: false,
-                        };
-                    }
-                }
-                catch {
-                    // Best-effort: if the lookup fails, resolveOwnerContext runs as before
-                    // and throws its normal 401, surfaced via the route_threw diagnostic.
-                }
+                // Durable owner context: this self-dispatch is cookieless (HMAC-only).
+                // Resolve the owner from the persisted run row, never the request body,
+                // then invoke the normal handler. The shared agent-run context helper
+                // expands that owner into the same user/org AsyncLocalStorage context the
+                // foreground request uses, so credential and data scoping stay aligned.
+                await seedBackgroundAgentRunOwnerContext(event, prepared.runId);
                 try {
-                    // Run the worker INSIDE the owner's AsyncLocalStorage request context.
-                    // Seeding OWNER_CONTEXT_KEY (above) only feeds getOwnerFromEvent; the
-                    // engine-resolution path (detectEngineFromUserSecrets) and other
-                    // owner-scoped reads use getRequestUserEmail()/getRequestOrgId(),
-                    // which a cookieless background worker otherwise leaves empty. Without
-                    // this, resolveEngine can't see the owner's Builder credential, falls
-                    // back to the anthropic default, and — when the owner has no stored
-                    // anthropic key and deploy-credential fallback is blocked — bails at
-                    // the API-key check BEFORE claiming its run (the analytics durable
-                    // worker's "stalls at post_model, never claims" bug).
-                    const invoke = () => invokeAgentChatHandler(event);
-                    return await (backgroundOwner
-                        ? runWithRequestContext({ userEmail: backgroundOwner }, invoke)
-                        : invoke());
+                    return await invokeAgentChatHandler(event);
                 }
                 catch (err) {
                     console.error("[agent-chat] _process-run failed:", err);
+                    captureError(err, {
+                        route: AGENT_CHAT_PROCESS_RUN_PATH,
+                        method: getMethod(event),
+                        userAgent: getHeader(event, "user-agent"),
+                        tags: {
+                            source: "agent-chat-bg-worker",
+                            phase: "process-run",
+                        },
+                        extra: {
+                            runId: prepared.runId,
+                        },
+                    });
                     // DIAGNOSTIC: the worker invocation threw at the route boundary —
                     // record the message so the failure cause is readable client-side.
                     if (diag) {