@agent-native/core 0.79.9 → 0.79.10

package/corpus/README.md

@@ -28,4 +28,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 ## Generated Counts
 
 - core files: 2029
-- template files: 4373
+- template files: 4374

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @agent-native/core
 
+## 0.79.10
+
+### Patch Changes
+
+- 7e19ed6: Return plain string action results with a JSON content type so browser action clients can parse successful responses.
+
 ## 0.79.9
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.79.9",
+  "version": "0.79.10",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/server/action-routes.ts

@@ -356,12 +356,16 @@ export function mountActionRoutes(
                 }
               }
 
-              // If the action returned a string, try to parse as JSON for a clean response
+              // If the action returned a string, try to parse as JSON for a
+              // clean response. Plain strings still need to go over the HTTP
+              // action transport as JSON, otherwise H3 sends text/plain and the
+              // browser action client rejects the successful 2xx response.
               if (typeof result === "string") {
                 try {
                   return JSON.parse(result);
                 } catch {
-                  return result;
+                  setResponseHeader(event, "Content-Type", "application/json");
+                  return JSON.stringify(result);
                 }
               }
 

package/corpus/templates/mail/app/hooks/use-emails.ts

@@ -90,6 +90,17 @@ export function markExternalEmailRefresh() {
   externalRefreshAt = Date.now();
 }
 
+export function consumeExternalEmailRefresh(): number | undefined {
+  const refreshAt = externalRefreshAt;
+  if (!refreshAt) return undefined;
+  if (Date.now() - refreshAt >= 5000) {
+    externalRefreshAt = 0;
+    return undefined;
+  }
+  externalRefreshAt = 0;
+  return refreshAt;
+}
+
 function parseRecipients(value?: string): EmailMessage["to"] {
   return (value || "")
     .split(",")
@@ -501,8 +512,11 @@ export function useEmails(
       if (search) params.set("q", search);
       if (label) params.set("label", label);
       if (pageParam) params.set("pageToken", pageParam);
-      if (externalRefreshAt && Date.now() - externalRefreshAt < 5000) {
-        params.set("forceRefresh", String(externalRefreshAt));
+      const forceRefreshAt = !pageParam
+        ? consumeExternalEmailRefresh()
+        : undefined;
+      if (forceRefreshAt) {
+        params.set("forceRefresh", String(forceRefreshAt));
       }
       return apiFetch<EmailsPage>(`/api/emails?${params}`, { signal });
     },
@@ -682,6 +696,7 @@ export function useMarkThreadRead() {
         .map((e) => ({ id: e.id, accountEmail: e.accountEmail }));
       pendingByThread.current.set(threadId, unreadEntries);
       const unreadIds = unreadEntries.map((e) => e.id);
+      const previousThread = getCachedThread(threadId);
       // Set overrides so refetches don't revert read state
       for (const id of unreadIds) {
         setOptimisticOverride(id, { isRead: true });
@@ -694,13 +709,22 @@ export function useMarkThreadRead() {
           ),
         ),
       );
-      return { previous, overrideIds: [...unreadIds] };
+      if (previousThread) {
+        setCachedThread(
+          threadId,
+          previousThread.map((message) => ({ ...message, isRead: true })),
+        );
+      }
+      return { previous, overrideIds: [...unreadIds], previousThread };
     },
-    onError: (_err, _vars, context) => {
+    onError: (_err, threadId, context) => {
       for (const id of context?.overrideIds ?? []) {
         clearOptimisticOverride(id);
       }
       context?.previous.forEach(([key, data]) => qc.setQueryData(key, data));
+      if (context?.previousThread) {
+        setCachedThread(threadId, context.previousThread);
+      }
     },
     onSettled: () => delayedInvalidate(qc, [["emails"], ["labels"]]),
   });

package/corpus/templates/mail/app/root.tsx

@@ -74,6 +74,12 @@ function getHydrationStableLocaleInitScript() {
 const THEME_INIT_SCRIPT = getHydrationStableThemeInitScript();
 const LOCALE_INIT_SCRIPT = getHydrationStableLocaleInitScript();
 
+function skipBroadActionInvalidation() {
+  // Mail's Gmail-backed reads are expensive and already refresh through the
+  // explicit app-state refresh-signal that mutating mail actions write.
+  return false;
+}
+
 const MAIL_ERROR_COPY: Record<
   LocaleCode,
   { title: string; fallback: string; back: string; reload: string }
@@ -275,6 +281,7 @@ function DbSyncSetup() {
   useDbSync({
     queryClient: qc,
     queryKeys: [],
+    actionInvalidatePredicate: skipBroadActionInvalidation,
     // Skip events this tab caused — our mutations already handle cache updates
     ignoreSource: TAB_ID,
     onEvent: (data: {
@@ -328,8 +335,13 @@ function DbSyncSetup() {
           invalidateSettingsSurfaces();
         }
       } else if (data.source === "action") {
+        // The core sync hook already refreshes action-backed queries for action
+        // events. Email and label reads are refreshed by the explicit
+        // refresh-signal app-state event so generic action changes do not
+        // cancel and restart Gmail list requests.
+      } else if (data.source === "screen-refresh") {
         if (!isOwnEvent) {
-          qc.invalidateQueries({ queryKey: ["action"] });
+          markExternalEmailRefresh();
           qc.invalidateQueries({ queryKey: ["emails"] });
           qc.invalidateQueries({ queryKey: ["email"] });
           qc.invalidateQueries({ queryKey: ["labels"] });
@@ -337,12 +349,6 @@ function DbSyncSetup() {
         }
       } else if (!isOwnEvent) {
         qc.invalidateQueries({ queryKey: ["action"] });
-        qc.invalidateQueries({ queryKey: ["emails"] });
-        qc.invalidateQueries({ queryKey: ["email"] });
-        qc.invalidateQueries({ queryKey: ["labels"] });
-        qc.invalidateQueries({ queryKey: ["settings"] });
-        qc.invalidateQueries({ queryKey: ["aliases"] });
-        invalidateSettingsSurfaces();
       }
     },
   });

package/corpus/templates/mail/changelog/2026-06-26-mail-avoids-unnecessary-message-list-reloads-after-backgroun.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-06-26
+---
+
+Mail avoids unnecessary message list reloads after background updates.

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;
@@ -42,8 +42,8 @@ export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import
  */
 export declare const postCollabText: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     ok?: undefined;
-    error: string;
     text?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -3,18 +3,18 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url?: string;
     filename?: string;
 }, {
+    id?: undefined;
     error: string;
     configured?: undefined;
     connectPath?: undefined;
     url?: undefined;
-    id?: undefined;
     provider?: undefined;
 } | {
+    id?: undefined;
     error: string;
     configured: boolean;
     connectPath: string;
     url?: undefined;
-    id?: undefined;
     provider?: undefined;
 } | {
     error?: undefined;

package/dist/notifications/routes.d.ts

@@ -28,7 +28,7 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/observability/routes.d.ts

@@ -41,28 +41,28 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
-    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-} | {
     error?: undefined;
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
+    error?: undefined;
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
-    error: any;
     id?: undefined;
+    error: any;
+    ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
-    ok: boolean;
     id?: undefined;
+    error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/resources/handlers.d.ts

@@ -49,11 +49,11 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,9 +73,9 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
+    error?: undefined;
     url: string;
     provider: string;
-    error?: undefined;
 }>;
 export {};
 //# sourceMappingURL=handlers.d.ts.map

package/dist/server/action-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-routes.d.ts","sourceRoot":"","sources":["../../src/server/action-routes.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAwBhE,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,eAAe,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMrB;AA2HD,MAAM,WAAW,wBAAwB;IACvC,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,CACrB,KAAK,EAAE,GAAG,KACP,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD,0DAA0D;IAC1D,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACvE;AAsBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,EACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACpC,OAAO,CAAC,EAAE,wBAAwB,QA8MnC"}
+{"version":3,"file":"action-routes.d.ts","sourceRoot":"","sources":["../../src/server/action-routes.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAwBhE,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,eAAe,GAC5B,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMrB;AA2HD,MAAM,WAAW,wBAAwB;IACvC,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,CACrB,KAAK,EAAE,GAAG,KACP,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD,0DAA0D;IAC1D,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACvE;AAsBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,GAAG,EACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACpC,OAAO,CAAC,EAAE,wBAAwB,QAkNnC"}

package/dist/server/action-routes.js

@@ -275,13 +275,17 @@ export function mountActionRoutes(nitroApp, actions, options) {
                             // ignore
                         }
                     }
-                    // If the action returned a string, try to parse as JSON for a clean response
+                    // If the action returned a string, try to parse as JSON for a
+                    // clean response. Plain strings still need to go over the HTTP
+                    // action transport as JSON, otherwise H3 sends text/plain and the
+                    // browser action client rejects the successful 2xx response.
                     if (typeof result === "string") {
                         try {
                             return JSON.parse(result);
                         }
                         catch {
-                            return result;
+                            setResponseHeader(event, "Content-Type", "application/json");
+                            return JSON.stringify(result);
                         }
                     }
                     return result;

package/dist/server/action-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-routes.js","sourceRoot":"","sources":["../../src/server/action-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,SAAS,GACV,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,oBAAoB,IAAI,wBAAwB,EAChD,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAE9C,MAAM,UAAU,uBAAuB,CACrC,YAA6B;IAE7B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA8B;IAE9B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,IAAI,IAAI;gBAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA2B,EAC3B,MAAc,EACd,KAAU;IAEV,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7C,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAU;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,KAAU;IACzC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC,KAAK,GAAG,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAOD,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACrD,cAAc,EAAE,sBAAsB,EAAE;QACxC,sEAAsE;QACtE,8DAA8D;KAC/D,CAAC,CAAC;IACH,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,8BAA8B,CAAC,MAAM,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAU;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,oBAAoB,CAC/B,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;IAEF,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,iBAAiB,CAAC,KAAK,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QACD,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;QACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,IAAI,CAAC,WAAW;YACd,CAAC,CAAC,8KAA8K,mBAAmB,EAAE;YACrM,CAAC,CAAC,GAAG,4BAA4B,4EAA4E,CAChH,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,WAAW,GAAG,KAInB,CAAC;IACF,MAAM,MAAM,GACV,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ;QACxC,CAAC,CAAC,WAAW,CAAC,UAAU;QACxB,CAAC,CAAC,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ;YACtC,CAAC,CAAC,WAAW,CAAC,MAAM;YACpB,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CACL,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ;QAC7C,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAa,EACb,OAAoC,EACpC,OAAkC;IAElC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,0BAA0B;QAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAEnC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;QAE5C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,SAAS,EACT,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,eAAe,GACnB,SAAS,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAE/D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YAEtD,4BAA4B;YAC5B,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,MAAM,GAAG,EAAE,CAAC;YACzD,CAAC;YAED,oEAAoE;YACpE,0DAA0D;YAC1D,qEAAqE;YACrE,8DAA8D;YAC9D,kDAAkD;YAClD,gEAAgE;YAChE,mEAAmE;YACnE,gEAAgE;YAChE,uCAAuC;YACvC,+DAA+D;YAC/D,oEAAoE;YACpE,+BAA+B;YAC/B,MAAM,cAAc,GAClB,SAAS,CAAC,KAAK,EAAE,4BAA4B,CAAC,KAAK,GAAG,CAAC;YACzD,IAAI,cAAc,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,WAAW,IAAI,+BAA+B;iBACtD,CAAC;YACJ,CAAC;YAED,+CAA+C;YAC/C,IAAI,SAA6B,CAAC;YAClC,IAAI,QAA4B,CAAC;YACjC,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;oBACnD,QAAQ,GAAG,OAAO,EAAE,oBAAoB;wBACtC,CAAC,CAAC,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,SAAS,CAAC;gBAChB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IACE,KAAK,CAAC,YAAY,KAAK,KAAK;wBAC5B,uBAAuB,CAAC,KAAK,CAAC,EAC9B,CAAC;wBACD,SAAS,GAAG,SAAS,CAAC;wBACtB,QAAQ,GAAG,SAAS,CAAC;oBACvB,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,EAAE,YAAY;gBACjC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAE3C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EACxC,KAAK,IAAI,EAAE;gBACT,kEAAkE;gBAClE,qEAAqE;gBACrE,qEAAqE;gBACrE,sCAAsC;gBACtC,IAAI,MAA2B,CAAC;gBAChC,IAAI,CAAC;oBACH,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,sDAAsD;wBACtD,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC;4BAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;4BAChC,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;wBACrD,CAAC;6BAAM,CAAC;4BACN,MAAM,GAAG,sBAAsB,CAC7B,QAAQ,CAAC,KAAK,CAAwB,CACvC,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;4BAChD,6DAA6D;4BAC7D,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzD,CAAC;6BAAM,CAAC;4BACN,wCAAwC;4BACxC,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBAED,kEAAkE;gBAClE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,qEAAqE;gBACrE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,MAAM,CAAC;oBACX,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;wBACrC,SAAS;wBACT,KAAK,EAAE,KAAK,IAAI,IAAI;wBACpB,MAAM;wBACN,UAAU,EAAE,IAAI;qBACjB,CAAC,CAAC;oBAEH,8DAA8D;oBAC9D,+DAA+D;oBAC/D,gEAAgE;oBAChE,8DAA8D;oBAC9D,6DAA6D;oBAC7D,qDAAqD;oBACrD,+DAA+D;oBAC/D,mEAAmE;oBACnE,gEAAgE;oBAChE,6DAA6D;oBAC7D,MAAM,UAAU,GACd,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;wBACjC,CAAC,CAAC,KAAK,CAAC,QAAQ;wBAChB,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;oBACvB,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,IAAI,CAAC;4BACH,MAAM,kBAAkB,CAAC;gCACvB,UAAU,EAAE,IAAI;gCAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC3C,CAAC,CAAC;wBACL,CAAC;wBAAC,MAAM,CAAC;4BACP,SAAS;wBACX,CAAC;oBACH,CAAC;oBAED,6EAA6E;oBAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBAC/B,IAAI,CAAC;4BACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC5B,CAAC;wBAAC,MAAM,CAAC;4BACP,OAAO,MAAM,CAAC;wBAChB,CAAC;oBACH,CAAC;oBAED,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxC,MAAM,iBAAiB,GAAG,GAAG,CAAC,UAAU,CACtC,2BAA2B,CAC5B,CAAC;oBACF,MAAM,cAAc,GAClB,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ;wBACjC,CAAC,CAAC,GAAG,CAAC,UAAU;wBAChB,CAAC,CAAC,SAAS,CAAC;oBAChB,+DAA+D;oBAC/D,sBAAsB;oBACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;oBACjE,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAEjC,kDAAkD;oBAClD,6DAA6D;oBAC7D,iEAAiE;oBACjE,8DAA8D;oBAC9D,gEAAgE;oBAChE,2DAA2D;oBAC3D,kDAAkD;oBAClD,MAAM,YAAY,GAChB,iBAAiB;wBACjB,sBAAsB,CAAC,GAAG,CAAC;wBAC3B,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC;oBACzD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;oBACxB,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC;oBAC9D,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC,CACF,CAAC,CAAC,4BAA4B;QACjC,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;QACzC,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,CAAC,MAAM,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;AACN,CAAC","sourcesContent":["import {\n  defineEventHandler,\n  setResponseStatus,\n  setResponseHeader,\n  getMethod,\n  getQuery,\n  getHeader,\n} from \"h3\";\n\nimport { isAgentActionStopError } from \"../action.js\";\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { EMBED_TARGET_HEADER } from \"../shared/embed-auth.js\";\nimport {\n  isMcpEmbedCorsOrigin,\n  MCP_EMBED_CORS_ALLOW_HEADERS,\n  shouldAllowMcpEmbedCredentials,\n} from \"../shared/mcp-embed-headers.js\";\nimport { notifyActionChange } from \"./action-change.js\";\nimport {\n  getAllowedCorsOrigin as resolveAllowedCorsOrigin,\n  readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\n/**\n * Auto-mount actions as HTTP endpoints under /_agent-native/actions/:name.\n *\n * Actions are exposed as POST by default. Use `http: { method: \"GET\" }` in\n * defineAction to expose as GET. Use `http: false` to mark as agent-only.\n */\nimport { getH3App } from \"./framework-request-handler.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nconst ROUTE_PREFIX = \"/_agent-native/actions\";\n\nexport function parseActionSearchParams(\n  searchParams: URLSearchParams,\n): Record<string, any> {\n  const params: Record<string, any> = {};\n  for (const [rawKey, value] of searchParams.entries()) {\n    appendActionParam(params, rawKey, value);\n  }\n  return params;\n}\n\nfunction parseActionQueryObject(\n  query: Record<string, unknown>,\n): Record<string, any> {\n  const params: Record<string, any> = {};\n  for (const [rawKey, rawValue] of Object.entries(query)) {\n    const values = Array.isArray(rawValue) ? rawValue : [rawValue];\n    for (const value of values) {\n      if (value != null) appendActionParam(params, rawKey, String(value));\n    }\n  }\n  return params;\n}\n\nfunction appendActionParam(\n  params: Record<string, any>,\n  rawKey: string,\n  value: any,\n) {\n  const isArrayKey = rawKey.endsWith(\"[]\");\n  // The core client serializes arrays as `key[]=value` so even a single\n  // value can validate against z.array() action schemas.\n  const key = isArrayKey ? rawKey.slice(0, -2) : rawKey;\n  const current = params[key];\n  if (current === undefined) {\n    params[key] = isArrayKey ? [value] : value;\n  } else if (Array.isArray(current)) {\n    current.push(value);\n  } else {\n    params[key] = [current, value];\n  }\n}\n\n/**\n * Read the caller's IANA timezone from the `x-user-timezone` header. The core\n * client sends this on every action request so server-side \"today\" fallbacks\n * can honor the user's local day.\n */\nfunction readTimezoneHeader(event: any): string | undefined {\n  try {\n    const raw = getHeader(event, \"x-user-timezone\");\n    if (!raw || typeof raw !== \"string\") return undefined;\n    const trimmed = raw.trim();\n    return trimmed.length > 0 && trimmed.length < 64 ? trimmed : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * True when the request originated from the browser action client\n * (`useActionQuery` / `useActionMutation` / `callAction`), which tags every\n * call with `X-Agent-Native-Frontend: 1`. Used to set `ctx.caller` to\n * `\"frontend\"` vs a bare programmatic `\"http\"` POST. The header carries no\n * auth weight — it only narrows the caller tag for tracking/branching.\n */\nfunction isFrontendActionRequest(event: any): boolean {\n  try {\n    return getHeader(event, \"x-agent-native-frontend\") === \"1\";\n  } catch {\n    return false;\n  }\n}\n\ntype CorsOrigin = {\n  origin: string;\n  credentials: boolean;\n};\n\nfunction getAllowedCorsOrigin(origin: string | undefined): CorsOrigin | null {\n  const allowedOrigin = resolveAllowedCorsOrigin(origin, {\n    allowedOrigins: readCorsAllowedOrigins(),\n    // Let the cors-origins default apply (dev-only). Omitting this option\n    // keeps production from trusting arbitrary localhost callers.\n  });\n  if (allowedOrigin) {\n    return { origin: allowedOrigin, credentials: true };\n  }\n  if (origin && isMcpEmbedCorsOrigin(origin)) {\n    return {\n      origin,\n      credentials: shouldAllowMcpEmbedCredentials(origin),\n    };\n  }\n  return null;\n}\n\nfunction handleOptionsRequest(event: any): string {\n  const origin = getHeader(event, \"origin\");\n  const cors = getAllowedCorsOrigin(\n    typeof origin === \"string\" ? origin : undefined,\n  );\n\n  if (origin && !cors) {\n    setResponseStatus(event, 403);\n    return \"\";\n  }\n\n  if (cors) {\n    setResponseHeader(event, \"Access-Control-Allow-Origin\", cors.origin);\n    setResponseHeader(event, \"Vary\", \"Origin\");\n    if (cors.credentials) {\n      setResponseHeader(event, \"Access-Control-Allow-Credentials\", \"true\");\n    }\n    setResponseHeader(\n      event,\n      \"Access-Control-Allow-Methods\",\n      \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n    );\n    setResponseHeader(\n      event,\n      \"Access-Control-Allow-Headers\",\n      cors.credentials\n        ? `Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,${EMBED_TARGET_HEADER}`\n        : `${MCP_EMBED_CORS_ALLOW_HEADERS},X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend`,\n    );\n  }\n\n  setResponseStatus(event, 204);\n  return \"\";\n}\n\nexport interface MountActionRoutesOptions {\n  /** Resolve owner email from the H3 event (for data scoping). */\n  getOwnerFromEvent?: (event: any) => string | Promise<string>;\n  /** Resolve display name from the H3 event, when available. */\n  getUserNameFromEvent?: (\n    event: any,\n  ) => string | undefined | Promise<string | undefined>;\n  /** Resolve org ID from the H3 event (for org scoping). */\n  resolveOrgId?: (event: any) => string | null | Promise<string | null>;\n}\n\nfunction isAuthResolutionFailure(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") return false;\n  const maybeStatus = error as {\n    status?: unknown;\n    statusCode?: unknown;\n    statusMessage?: unknown;\n  };\n  const status =\n    typeof maybeStatus.statusCode === \"number\"\n      ? maybeStatus.statusCode\n      : typeof maybeStatus.status === \"number\"\n        ? maybeStatus.status\n        : undefined;\n  if (status === 401 || status === 403) return true;\n  return (\n    typeof maybeStatus.statusMessage === \"string\" &&\n    /unauthenticated|forbidden/i.test(maybeStatus.statusMessage)\n  );\n}\n\n/**\n * Mount discovered actions as HTTP endpoints.\n *\n * Only actions from `autoDiscoverActions` (template actions) are mounted.\n * Built-in actions (resource-*, chat-*, shell, etc.) are NOT passed here.\n */\nexport function mountActionRoutes(\n  nitroApp: any,\n  actions: Record<string, ActionEntry>,\n  options?: MountActionRoutesOptions,\n) {\n  const mounted: string[] = [];\n\n  for (const [name, entry] of Object.entries(actions)) {\n    // Skip agent-only actions\n    if (entry.http === false) continue;\n\n    const method = entry.http?.method ?? \"POST\";\n    const path = entry.http?.path ?? name;\n    const routePath = `${ROUTE_PREFIX}/${path}`;\n\n    getH3App(nitroApp).use(\n      routePath,\n      defineEventHandler(async (event) => {\n        const reqMethod = getMethod(event);\n        const effectiveMethod =\n          reqMethod === \"HEAD\" && method === \"GET\" ? \"GET\" : reqMethod;\n\n        if (reqMethod === \"OPTIONS\") {\n          return handleOptionsRequest(event);\n        }\n\n        setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n        // Allow the declared method\n        if (effectiveMethod !== method) {\n          setResponseStatus(event, 405);\n          return { error: `Method not allowed. Use ${method}.` };\n        }\n\n        // (audit H5) Per-action `toolCallable` opt-out for the tools-iframe\n        // bridge. The bridge tags every outbound action call with\n        // X-Agent-Native-Tool-Bridge: 1. When that header is present and the\n        // action declares `toolCallable: false`, we 403 — used by the\n        // framework's share-resource / unshare-resource /\n        // set-resource-visibility for defense-in-depth on auth-adjacent\n        // operations. Undefined defaults to allow: tools are intra-org and\n        // typically authored by trusted teammates, so the default is to\n        // trust the org-level access controls.\n        // The header is set by the parent (the React host), not by the\n        // iframe's user-authored content; sanitizeToolRequestOptions strips\n        // iframe attempts to spoof it.\n        const fromToolBridge =\n          getHeader(event, \"x-agent-native-tool-bridge\") === \"1\";\n        if (fromToolBridge && entry.toolCallable === false) {\n          setResponseStatus(event, 403);\n          return {\n            error: `Action '${name}' is not callable from tools.`,\n          };\n        }\n\n        // Resolve auth context for per-request scoping\n        let userEmail: string | undefined;\n        let userName: string | undefined;\n        if (options?.getOwnerFromEvent) {\n          try {\n            userEmail = await options.getOwnerFromEvent(event);\n            userName = options?.getUserNameFromEvent\n              ? await options.getUserNameFromEvent(event)\n              : undefined;\n          } catch (error) {\n            if (\n              entry.requiresAuth === false &&\n              isAuthResolutionFailure(error)\n            ) {\n              userEmail = undefined;\n              userName = undefined;\n            } else {\n              throw error;\n            }\n          }\n        }\n        const orgId = options?.resolveOrgId\n          ? ((await options.resolveOrgId(event)) ?? undefined)\n          : undefined;\n        const timezone = readTimezoneHeader(event);\n\n        return runWithRequestContext(\n          { userEmail, userName, orgId, timezone },\n          async () => {\n            // Parse params based on method. On web-standard runtimes (Netlify\n            // Functions, CF Workers), event.req IS the web Request — use .json()\n            // directly. H3's readBody fails on those runtimes because it expects\n            // a Node.js stream on event.node.req.\n            let params: Record<string, any>;\n            try {\n              if (method === \"GET\") {\n                // H3 v2: prefer web Request URL, fallback to getQuery\n                const webReq = (event as any).req;\n                if (webReq?.url) {\n                  const url = new URL(webReq.url);\n                  params = parseActionSearchParams(url.searchParams);\n                } else {\n                  params = parseActionQueryObject(\n                    getQuery(event) as Record<string, any>,\n                  );\n                }\n              } else {\n                const webReq = (event as any).req;\n                if (webReq && typeof webReq.json === \"function\") {\n                  // H3 v2: event.req is the web Request — use .json() directly\n                  params = (await webReq.json().catch(() => null)) ?? {};\n                } else {\n                  // Fallback: H3's readBody (Node.js dev)\n                  params = (await readBody(event)) ?? {};\n                }\n              }\n            } catch {\n              params = {};\n            }\n\n            // Run the action. Tag the caller: browser calls (useActionQuery /\n            // useActionMutation / callAction) send X-Agent-Native-Frontend: 1,\n            // so they become \"frontend\"; bare programmatic POSTs are \"http\".\n            // userEmail / orgId mirror the request context resolved above (do\n            // NOT inject a dev identity — leave undefined when unauthenticated).\n            try {\n              const caller = isFrontendActionRequest(event)\n                ? \"frontend\"\n                : \"http\";\n              const result = await entry.run(params, {\n                userEmail,\n                orgId: orgId ?? null,\n                caller,\n                actionName: name,\n              });\n\n              // Auto-refresh the UI after a successful mutating action. GET\n              // actions and actions explicitly flagged readOnly are skipped.\n              // Other tabs' useDbSync will see source:\"action\" and invalidate\n              // their action queries. The calling tab already refetches via\n              // useActionMutation's onSuccess, so this is mainly cross-tab\n              // sync (and parity with the agent's tool-call path).\n              // Explicit entry.readOnly (true OR false) wins over the method\n              // heuristic. defineAction already auto-infers GET → readOnly=true,\n              // so for actions registered through that path entry.readOnly is\n              // always set and the fallback just guards legacy wrap paths.\n              const isReadOnly =\n                typeof entry.readOnly === \"boolean\"\n                  ? entry.readOnly\n                  : method === \"GET\";\n              if (!isReadOnly) {\n                try {\n                  await notifyActionChange({\n                    actionName: name,\n                    ...(userEmail ? { owner: userEmail } : {}),\n                  });\n                } catch {\n                  // ignore\n                }\n              }\n\n              // If the action returned a string, try to parse as JSON for a clean response\n              if (typeof result === \"string\") {\n                try {\n                  return JSON.parse(result);\n                } catch {\n                  return result;\n                }\n              }\n\n              return result;\n            } catch (err: any) {\n              const msg = err?.message ?? String(err);\n              const isValidationError = msg.startsWith(\n                \"Invalid action parameters\",\n              );\n              const explicitStatus =\n                typeof err?.statusCode === \"number\"\n                  ? err.statusCode\n                  : undefined;\n              // Return 400 for validation errors, the explicit statusCode if\n              // set, otherwise 500.\n              const status = isValidationError ? 400 : (explicitStatus ?? 500);\n              setResponseStatus(event, status);\n\n              // Only echo the raw message for known-safe cases:\n              //  - validation errors (deterministic, parameter-shape only)\n              //  - explicit user-facing errors (AgentActionStopError / fail())\n              //  - errors with an explicit statusCode < 500 (client errors)\n              // For uncategorized 500s, return a generic message and keep the\n              // real detail server-side only — it can contain DB/driver/\n              // upstream text we must not leak to HTTP callers.\n              const isUserFacing =\n                isValidationError ||\n                isAgentActionStopError(err) ||\n                (explicitStatus !== undefined && explicitStatus < 500);\n              if (isUserFacing) {\n                return { error: msg };\n              }\n              console.error(`[agent-native] action '${name}' failed:`, err);\n              return { error: \"Internal server error\" };\n            }\n          },\n        ); // end runWithRequestContext\n      }),\n    );\n\n    mounted.push(`${method} ${routePath}`);\n  }\n\n  if (mounted.length > 0 && process.env.DEBUG)\n    console.log(\n      `[action-routes] Mounted ${mounted.length} action route(s): ${mounted.join(\", \")}`,\n    );\n}\n"]}
+{"version":3,"file":"action-routes.js","sourceRoot":"","sources":["../../src/server/action-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,SAAS,GACV,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,oBAAoB,IAAI,wBAAwB,EAChD,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAE9C,MAAM,UAAU,uBAAuB,CACrC,YAA6B;IAE7B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA8B;IAE9B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,IAAI,IAAI;gBAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA2B,EAC3B,MAAc,EACd,KAAU;IAEV,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7C,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAU;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,KAAU;IACzC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC,KAAK,GAAG,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAOD,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACrD,cAAc,EAAE,sBAAsB,EAAE;QACxC,sEAAsE;QACtE,8DAA8D;KAC/D,CAAC,CAAC;IACH,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM;YACN,WAAW,EAAE,8BAA8B,CAAC,MAAM,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAU;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,oBAAoB,CAC/B,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;IAEF,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,iBAAiB,CAAC,KAAK,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QACD,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;QACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,IAAI,CAAC,WAAW;YACd,CAAC,CAAC,8KAA8K,mBAAmB,EAAE;YACrM,CAAC,CAAC,GAAG,4BAA4B,4EAA4E,CAChH,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,WAAW,GAAG,KAInB,CAAC;IACF,MAAM,MAAM,GACV,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ;QACxC,CAAC,CAAC,WAAW,CAAC,UAAU;QACxB,CAAC,CAAC,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ;YACtC,CAAC,CAAC,WAAW,CAAC,MAAM;YACpB,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CACL,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ;QAC7C,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAa,EACb,OAAoC,EACpC,OAAkC;IAElC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,0BAA0B;QAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAEnC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;QAE5C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,SAAS,EACT,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,eAAe,GACnB,SAAS,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAE/D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YAEtD,4BAA4B;YAC5B,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,MAAM,GAAG,EAAE,CAAC;YACzD,CAAC;YAED,oEAAoE;YACpE,0DAA0D;YAC1D,qEAAqE;YACrE,8DAA8D;YAC9D,kDAAkD;YAClD,gEAAgE;YAChE,mEAAmE;YACnE,gEAAgE;YAChE,uCAAuC;YACvC,+DAA+D;YAC/D,oEAAoE;YACpE,+BAA+B;YAC/B,MAAM,cAAc,GAClB,SAAS,CAAC,KAAK,EAAE,4BAA4B,CAAC,KAAK,GAAG,CAAC;YACzD,IAAI,cAAc,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,WAAW,IAAI,+BAA+B;iBACtD,CAAC;YACJ,CAAC;YAED,+CAA+C;YAC/C,IAAI,SAA6B,CAAC;YAClC,IAAI,QAA4B,CAAC;YACjC,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;oBACnD,QAAQ,GAAG,OAAO,EAAE,oBAAoB;wBACtC,CAAC,CAAC,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,SAAS,CAAC;gBAChB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IACE,KAAK,CAAC,YAAY,KAAK,KAAK;wBAC5B,uBAAuB,CAAC,KAAK,CAAC,EAC9B,CAAC;wBACD,SAAS,GAAG,SAAS,CAAC;wBACtB,QAAQ,GAAG,SAAS,CAAC;oBACvB,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,EAAE,YAAY;gBACjC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAE3C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EACxC,KAAK,IAAI,EAAE;gBACT,kEAAkE;gBAClE,qEAAqE;gBACrE,qEAAqE;gBACrE,sCAAsC;gBACtC,IAAI,MAA2B,CAAC;gBAChC,IAAI,CAAC;oBACH,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,sDAAsD;wBACtD,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC;4BAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;4BAChC,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;wBACrD,CAAC;6BAAM,CAAC;4BACN,MAAM,GAAG,sBAAsB,CAC7B,QAAQ,CAAC,KAAK,CAAwB,CACvC,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAI,KAAa,CAAC,GAAG,CAAC;wBAClC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;4BAChD,6DAA6D;4BAC7D,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzD,CAAC;6BAAM,CAAC;4BACN,wCAAwC;4BACxC,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;wBACzC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBAED,kEAAkE;gBAClE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,qEAAqE;gBACrE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC;wBAC3C,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,MAAM,CAAC;oBACX,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;wBACrC,SAAS;wBACT,KAAK,EAAE,KAAK,IAAI,IAAI;wBACpB,MAAM;wBACN,UAAU,EAAE,IAAI;qBACjB,CAAC,CAAC;oBAEH,8DAA8D;oBAC9D,+DAA+D;oBAC/D,gEAAgE;oBAChE,8DAA8D;oBAC9D,6DAA6D;oBAC7D,qDAAqD;oBACrD,+DAA+D;oBAC/D,mEAAmE;oBACnE,gEAAgE;oBAChE,6DAA6D;oBAC7D,MAAM,UAAU,GACd,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;wBACjC,CAAC,CAAC,KAAK,CAAC,QAAQ;wBAChB,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;oBACvB,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,IAAI,CAAC;4BACH,MAAM,kBAAkB,CAAC;gCACvB,UAAU,EAAE,IAAI;gCAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC3C,CAAC,CAAC;wBACL,CAAC;wBAAC,MAAM,CAAC;4BACP,SAAS;wBACX,CAAC;oBACH,CAAC;oBAED,8DAA8D;oBAC9D,+DAA+D;oBAC/D,kEAAkE;oBAClE,6DAA6D;oBAC7D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBAC/B,IAAI,CAAC;4BACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC5B,CAAC;wBAAC,MAAM,CAAC;4BACP,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;4BAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;wBAChC,CAAC;oBACH,CAAC;oBAED,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxC,MAAM,iBAAiB,GAAG,GAAG,CAAC,UAAU,CACtC,2BAA2B,CAC5B,CAAC;oBACF,MAAM,cAAc,GAClB,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ;wBACjC,CAAC,CAAC,GAAG,CAAC,UAAU;wBAChB,CAAC,CAAC,SAAS,CAAC;oBAChB,+DAA+D;oBAC/D,sBAAsB;oBACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;oBACjE,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAEjC,kDAAkD;oBAClD,6DAA6D;oBAC7D,iEAAiE;oBACjE,8DAA8D;oBAC9D,gEAAgE;oBAChE,2DAA2D;oBAC3D,kDAAkD;oBAClD,MAAM,YAAY,GAChB,iBAAiB;wBACjB,sBAAsB,CAAC,GAAG,CAAC;wBAC3B,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC;oBACzD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;oBACxB,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC;oBAC9D,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC,CACF,CAAC,CAAC,4BAA4B;QACjC,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;QACzC,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,CAAC,MAAM,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;AACN,CAAC","sourcesContent":["import {\n  defineEventHandler,\n  setResponseStatus,\n  setResponseHeader,\n  getMethod,\n  getQuery,\n  getHeader,\n} from \"h3\";\n\nimport { isAgentActionStopError } from \"../action.js\";\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { EMBED_TARGET_HEADER } from \"../shared/embed-auth.js\";\nimport {\n  isMcpEmbedCorsOrigin,\n  MCP_EMBED_CORS_ALLOW_HEADERS,\n  shouldAllowMcpEmbedCredentials,\n} from \"../shared/mcp-embed-headers.js\";\nimport { notifyActionChange } from \"./action-change.js\";\nimport {\n  getAllowedCorsOrigin as resolveAllowedCorsOrigin,\n  readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\n/**\n * Auto-mount actions as HTTP endpoints under /_agent-native/actions/:name.\n *\n * Actions are exposed as POST by default. Use `http: { method: \"GET\" }` in\n * defineAction to expose as GET. Use `http: false` to mark as agent-only.\n */\nimport { getH3App } from \"./framework-request-handler.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nconst ROUTE_PREFIX = \"/_agent-native/actions\";\n\nexport function parseActionSearchParams(\n  searchParams: URLSearchParams,\n): Record<string, any> {\n  const params: Record<string, any> = {};\n  for (const [rawKey, value] of searchParams.entries()) {\n    appendActionParam(params, rawKey, value);\n  }\n  return params;\n}\n\nfunction parseActionQueryObject(\n  query: Record<string, unknown>,\n): Record<string, any> {\n  const params: Record<string, any> = {};\n  for (const [rawKey, rawValue] of Object.entries(query)) {\n    const values = Array.isArray(rawValue) ? rawValue : [rawValue];\n    for (const value of values) {\n      if (value != null) appendActionParam(params, rawKey, String(value));\n    }\n  }\n  return params;\n}\n\nfunction appendActionParam(\n  params: Record<string, any>,\n  rawKey: string,\n  value: any,\n) {\n  const isArrayKey = rawKey.endsWith(\"[]\");\n  // The core client serializes arrays as `key[]=value` so even a single\n  // value can validate against z.array() action schemas.\n  const key = isArrayKey ? rawKey.slice(0, -2) : rawKey;\n  const current = params[key];\n  if (current === undefined) {\n    params[key] = isArrayKey ? [value] : value;\n  } else if (Array.isArray(current)) {\n    current.push(value);\n  } else {\n    params[key] = [current, value];\n  }\n}\n\n/**\n * Read the caller's IANA timezone from the `x-user-timezone` header. The core\n * client sends this on every action request so server-side \"today\" fallbacks\n * can honor the user's local day.\n */\nfunction readTimezoneHeader(event: any): string | undefined {\n  try {\n    const raw = getHeader(event, \"x-user-timezone\");\n    if (!raw || typeof raw !== \"string\") return undefined;\n    const trimmed = raw.trim();\n    return trimmed.length > 0 && trimmed.length < 64 ? trimmed : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * True when the request originated from the browser action client\n * (`useActionQuery` / `useActionMutation` / `callAction`), which tags every\n * call with `X-Agent-Native-Frontend: 1`. Used to set `ctx.caller` to\n * `\"frontend\"` vs a bare programmatic `\"http\"` POST. The header carries no\n * auth weight — it only narrows the caller tag for tracking/branching.\n */\nfunction isFrontendActionRequest(event: any): boolean {\n  try {\n    return getHeader(event, \"x-agent-native-frontend\") === \"1\";\n  } catch {\n    return false;\n  }\n}\n\ntype CorsOrigin = {\n  origin: string;\n  credentials: boolean;\n};\n\nfunction getAllowedCorsOrigin(origin: string | undefined): CorsOrigin | null {\n  const allowedOrigin = resolveAllowedCorsOrigin(origin, {\n    allowedOrigins: readCorsAllowedOrigins(),\n    // Let the cors-origins default apply (dev-only). Omitting this option\n    // keeps production from trusting arbitrary localhost callers.\n  });\n  if (allowedOrigin) {\n    return { origin: allowedOrigin, credentials: true };\n  }\n  if (origin && isMcpEmbedCorsOrigin(origin)) {\n    return {\n      origin,\n      credentials: shouldAllowMcpEmbedCredentials(origin),\n    };\n  }\n  return null;\n}\n\nfunction handleOptionsRequest(event: any): string {\n  const origin = getHeader(event, \"origin\");\n  const cors = getAllowedCorsOrigin(\n    typeof origin === \"string\" ? origin : undefined,\n  );\n\n  if (origin && !cors) {\n    setResponseStatus(event, 403);\n    return \"\";\n  }\n\n  if (cors) {\n    setResponseHeader(event, \"Access-Control-Allow-Origin\", cors.origin);\n    setResponseHeader(event, \"Vary\", \"Origin\");\n    if (cors.credentials) {\n      setResponseHeader(event, \"Access-Control-Allow-Credentials\", \"true\");\n    }\n    setResponseHeader(\n      event,\n      \"Access-Control-Allow-Methods\",\n      \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n    );\n    setResponseHeader(\n      event,\n      \"Access-Control-Allow-Headers\",\n      cors.credentials\n        ? `Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,${EMBED_TARGET_HEADER}`\n        : `${MCP_EMBED_CORS_ALLOW_HEADERS},X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend`,\n    );\n  }\n\n  setResponseStatus(event, 204);\n  return \"\";\n}\n\nexport interface MountActionRoutesOptions {\n  /** Resolve owner email from the H3 event (for data scoping). */\n  getOwnerFromEvent?: (event: any) => string | Promise<string>;\n  /** Resolve display name from the H3 event, when available. */\n  getUserNameFromEvent?: (\n    event: any,\n  ) => string | undefined | Promise<string | undefined>;\n  /** Resolve org ID from the H3 event (for org scoping). */\n  resolveOrgId?: (event: any) => string | null | Promise<string | null>;\n}\n\nfunction isAuthResolutionFailure(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") return false;\n  const maybeStatus = error as {\n    status?: unknown;\n    statusCode?: unknown;\n    statusMessage?: unknown;\n  };\n  const status =\n    typeof maybeStatus.statusCode === \"number\"\n      ? maybeStatus.statusCode\n      : typeof maybeStatus.status === \"number\"\n        ? maybeStatus.status\n        : undefined;\n  if (status === 401 || status === 403) return true;\n  return (\n    typeof maybeStatus.statusMessage === \"string\" &&\n    /unauthenticated|forbidden/i.test(maybeStatus.statusMessage)\n  );\n}\n\n/**\n * Mount discovered actions as HTTP endpoints.\n *\n * Only actions from `autoDiscoverActions` (template actions) are mounted.\n * Built-in actions (resource-*, chat-*, shell, etc.) are NOT passed here.\n */\nexport function mountActionRoutes(\n  nitroApp: any,\n  actions: Record<string, ActionEntry>,\n  options?: MountActionRoutesOptions,\n) {\n  const mounted: string[] = [];\n\n  for (const [name, entry] of Object.entries(actions)) {\n    // Skip agent-only actions\n    if (entry.http === false) continue;\n\n    const method = entry.http?.method ?? \"POST\";\n    const path = entry.http?.path ?? name;\n    const routePath = `${ROUTE_PREFIX}/${path}`;\n\n    getH3App(nitroApp).use(\n      routePath,\n      defineEventHandler(async (event) => {\n        const reqMethod = getMethod(event);\n        const effectiveMethod =\n          reqMethod === \"HEAD\" && method === \"GET\" ? \"GET\" : reqMethod;\n\n        if (reqMethod === \"OPTIONS\") {\n          return handleOptionsRequest(event);\n        }\n\n        setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n        // Allow the declared method\n        if (effectiveMethod !== method) {\n          setResponseStatus(event, 405);\n          return { error: `Method not allowed. Use ${method}.` };\n        }\n\n        // (audit H5) Per-action `toolCallable` opt-out for the tools-iframe\n        // bridge. The bridge tags every outbound action call with\n        // X-Agent-Native-Tool-Bridge: 1. When that header is present and the\n        // action declares `toolCallable: false`, we 403 — used by the\n        // framework's share-resource / unshare-resource /\n        // set-resource-visibility for defense-in-depth on auth-adjacent\n        // operations. Undefined defaults to allow: tools are intra-org and\n        // typically authored by trusted teammates, so the default is to\n        // trust the org-level access controls.\n        // The header is set by the parent (the React host), not by the\n        // iframe's user-authored content; sanitizeToolRequestOptions strips\n        // iframe attempts to spoof it.\n        const fromToolBridge =\n          getHeader(event, \"x-agent-native-tool-bridge\") === \"1\";\n        if (fromToolBridge && entry.toolCallable === false) {\n          setResponseStatus(event, 403);\n          return {\n            error: `Action '${name}' is not callable from tools.`,\n          };\n        }\n\n        // Resolve auth context for per-request scoping\n        let userEmail: string | undefined;\n        let userName: string | undefined;\n        if (options?.getOwnerFromEvent) {\n          try {\n            userEmail = await options.getOwnerFromEvent(event);\n            userName = options?.getUserNameFromEvent\n              ? await options.getUserNameFromEvent(event)\n              : undefined;\n          } catch (error) {\n            if (\n              entry.requiresAuth === false &&\n              isAuthResolutionFailure(error)\n            ) {\n              userEmail = undefined;\n              userName = undefined;\n            } else {\n              throw error;\n            }\n          }\n        }\n        const orgId = options?.resolveOrgId\n          ? ((await options.resolveOrgId(event)) ?? undefined)\n          : undefined;\n        const timezone = readTimezoneHeader(event);\n\n        return runWithRequestContext(\n          { userEmail, userName, orgId, timezone },\n          async () => {\n            // Parse params based on method. On web-standard runtimes (Netlify\n            // Functions, CF Workers), event.req IS the web Request — use .json()\n            // directly. H3's readBody fails on those runtimes because it expects\n            // a Node.js stream on event.node.req.\n            let params: Record<string, any>;\n            try {\n              if (method === \"GET\") {\n                // H3 v2: prefer web Request URL, fallback to getQuery\n                const webReq = (event as any).req;\n                if (webReq?.url) {\n                  const url = new URL(webReq.url);\n                  params = parseActionSearchParams(url.searchParams);\n                } else {\n                  params = parseActionQueryObject(\n                    getQuery(event) as Record<string, any>,\n                  );\n                }\n              } else {\n                const webReq = (event as any).req;\n                if (webReq && typeof webReq.json === \"function\") {\n                  // H3 v2: event.req is the web Request — use .json() directly\n                  params = (await webReq.json().catch(() => null)) ?? {};\n                } else {\n                  // Fallback: H3's readBody (Node.js dev)\n                  params = (await readBody(event)) ?? {};\n                }\n              }\n            } catch {\n              params = {};\n            }\n\n            // Run the action. Tag the caller: browser calls (useActionQuery /\n            // useActionMutation / callAction) send X-Agent-Native-Frontend: 1,\n            // so they become \"frontend\"; bare programmatic POSTs are \"http\".\n            // userEmail / orgId mirror the request context resolved above (do\n            // NOT inject a dev identity — leave undefined when unauthenticated).\n            try {\n              const caller = isFrontendActionRequest(event)\n                ? \"frontend\"\n                : \"http\";\n              const result = await entry.run(params, {\n                userEmail,\n                orgId: orgId ?? null,\n                caller,\n                actionName: name,\n              });\n\n              // Auto-refresh the UI after a successful mutating action. GET\n              // actions and actions explicitly flagged readOnly are skipped.\n              // Other tabs' useDbSync will see source:\"action\" and invalidate\n              // their action queries. The calling tab already refetches via\n              // useActionMutation's onSuccess, so this is mainly cross-tab\n              // sync (and parity with the agent's tool-call path).\n              // Explicit entry.readOnly (true OR false) wins over the method\n              // heuristic. defineAction already auto-infers GET → readOnly=true,\n              // so for actions registered through that path entry.readOnly is\n              // always set and the fallback just guards legacy wrap paths.\n              const isReadOnly =\n                typeof entry.readOnly === \"boolean\"\n                  ? entry.readOnly\n                  : method === \"GET\";\n              if (!isReadOnly) {\n                try {\n                  await notifyActionChange({\n                    actionName: name,\n                    ...(userEmail ? { owner: userEmail } : {}),\n                  });\n                } catch {\n                  // ignore\n                }\n              }\n\n              // If the action returned a string, try to parse as JSON for a\n              // clean response. Plain strings still need to go over the HTTP\n              // action transport as JSON, otherwise H3 sends text/plain and the\n              // browser action client rejects the successful 2xx response.\n              if (typeof result === \"string\") {\n                try {\n                  return JSON.parse(result);\n                } catch {\n                  setResponseHeader(event, \"Content-Type\", \"application/json\");\n                  return JSON.stringify(result);\n                }\n              }\n\n              return result;\n            } catch (err: any) {\n              const msg = err?.message ?? String(err);\n              const isValidationError = msg.startsWith(\n                \"Invalid action parameters\",\n              );\n              const explicitStatus =\n                typeof err?.statusCode === \"number\"\n                  ? err.statusCode\n                  : undefined;\n              // Return 400 for validation errors, the explicit statusCode if\n              // set, otherwise 500.\n              const status = isValidationError ? 400 : (explicitStatus ?? 500);\n              setResponseStatus(event, status);\n\n              // Only echo the raw message for known-safe cases:\n              //  - validation errors (deterministic, parameter-shape only)\n              //  - explicit user-facing errors (AgentActionStopError / fail())\n              //  - errors with an explicit statusCode < 500 (client errors)\n              // For uncategorized 500s, return a generic message and keep the\n              // real detail server-side only — it can contain DB/driver/\n              // upstream text we must not leak to HTTP callers.\n              const isUserFacing =\n                isValidationError ||\n                isAgentActionStopError(err) ||\n                (explicitStatus !== undefined && explicitStatus < 500);\n              if (isUserFacing) {\n                return { error: msg };\n              }\n              console.error(`[agent-native] action '${name}' failed:`, err);\n              return { error: \"Internal server error\" };\n            }\n          },\n        ); // end runWithRequestContext\n      }),\n    );\n\n    mounted.push(`${method} ${routePath}`);\n  }\n\n  if (mounted.length > 0 && process.env.DEBUG)\n    console.log(\n      `[action-routes] Mounted ${mounted.length} action route(s): ${mounted.join(\", \")}`,\n    );\n}\n"]}

package/dist/server/agent-engine-api-key-route.d.ts

@@ -23,15 +23,15 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
     error: string;
 }>;
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: any;
     key?: undefined;
     scope?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};
 //# sourceMappingURL=agent-engine-api-key-route.d.ts.map

package/dist/server/transcribe-voice.d.ts

@@ -20,7 +20,7 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;
 //# sourceMappingURL=transcribe-voice.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.79.9",
+  "version": "0.79.10",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {