@agent-native/core 0.86.0 → 0.87.0

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,UAAU,EACV,2BAA2B,EAC3B,6BAA6B,EAC7B,gCAAgC,EAChC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAyB,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,GAQxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAA0B,MAAM,UAAU,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,GAIf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAA2B,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,GAIzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,4BAA4B,GAkB7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACb,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,YAAY,GAKb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,GAG7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uCAAuC,EACvC,oCAAoC,EACpC,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,GAKpC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,GAKf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,2CAA2C,EAC3C,2BAA2B,EAC3B,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uCAAuC,EACvC,0CAA0C,EAC1C,8BAA8B,EAC9B,kBAAkB,EAClB,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,GAE1B,MAAM,+BAA+B,CAAC;AAWvC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,SAAS,EACT,OAAO,EACP,eAAe,EACf,SAAS,EACT,UAAU,EACV,eAAe,GAGhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,yCAAyC,EACzC,gCAAgC,EAChC,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,QAAQ,EACR,cAAc,EACd,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,qCAAqC,EACrC,UAAU,EACV,yBAAyB,GAI1B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,YAAY,GAMb,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,SAAS,EACT,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,wBAAwB,GAIzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,mCAAmC,EACnC,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,6BAA6B,GAI9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,GAIpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,gBAAgB,GAIjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,WAAW,EACX,SAAS,GAIV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAGtB,MAAM,wBAAwB,CAAC;AAWhC,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["export {\n  createServer,\n  type CreateServerOptions,\n  type EnvKeyConfig,\n} from \"./create-server.js\";\n\nexport {\n  readBody,\n  readBodyWithSizeLimit,\n  streamFile,\n  DEFAULT_CHAT_MAX_BODY_BYTES,\n  DEFAULT_UPLOAD_MAX_FILE_BYTES,\n  MAX_CHAT_ATTACHMENTS_PER_MESSAGE,\n  isAllowedUploadMimeType,\n} from \"./h3-helpers.js\";\nexport {\n  buildDeepLink,\n  toAbsoluteOpenUrl,\n  toDesktopOpenUrl,\n  toVsCodeOpenUrl,\n  OPEN_ROUTE_SUBPATH,\n  DESKTOP_OPEN_URL,\n  VSCODE_OPEN_URL,\n  type DeepLinkInput,\n} from \"./deep-link.js\";\nexport { createOpenRouteHandler, type OpenRouteOptions } from \"./open-route.js\";\nexport {\n  createEmbedStartRouteHandler,\n  buildEmbedStartPath,\n  type EmbedStartRouteOptions,\n} from \"./embed-route.js\";\nexport {\n  createEmbedSessionTicket,\n  consumeEmbedSessionTicket,\n  normalizeEmbedTargetPath,\n  requestHasEmbedAuthMarker,\n  resolveEmbedSessionFromRequest,\n  setEmbedSessionCookie,\n  signEmbedSessionToken,\n  verifyEmbedSessionToken,\n  type ConsumedEmbedSessionTicket,\n  type ConsumeEmbedSessionTicketOptions,\n  type EmbedSessionTicket,\n  type EmbedSessionTicketInput,\n  type EmbedSessionTokenClaims,\n  type ResolvedEmbedSession,\n  type VerifyEmbedSessionTokenResult,\n} from \"./embed-session.js\";\nexport { createSSEHandler, type SSEHandlerOptions } from \"./sse.js\";\nexport {\n  mountAuthMiddleware,\n  autoMountAuth,\n  getSession,\n  COOKIE_NAME,\n  addSession,\n  removeSession,\n  getSessionEmail,\n  getFrameworkSessionCookieValues,\n  setFrameworkSessionCookie,\n  clearFrameworkSessionCookies,\n  runAuthGuard,\n  setDesktopExchange,\n  setDesktopExchangeError,\n  safeReturnPath,\n  type DesktopExchangeErrorPayload,\n  type AuthSession,\n  type AuthOptions,\n} from \"./auth.js\";\nexport {\n  handleIdentitySso,\n  getIdentityHubUrl,\n  isIdentitySsoEnabled,\n  isIdentitySsoBypassPath,\n  identitySsoLoginButtonHtml,\n  IDENTITY_SSO_PROVIDER_ID,\n  IDENTITY_SSO_SCOPE,\n} from \"./identity-sso.js\";\nexport { requireEnvKey, type MissingKeyResponse } from \"./missing-key.js\";\nexport { verifyCaptcha, type CaptchaVerifyResult } from \"./captcha.js\";\nexport {\n  getLocaleInitScript,\n  parseAcceptLanguage,\n  resolveLocaleFromRequest,\n  type LocaleInitScriptOptions,\n  type ResolveLocaleFromRequestOptions,\n  type ResolvedRequestLocale,\n} from \"../localization/server.js\";\nexport {\n  createProductionAgentHandler,\n  type ActionEntry,\n  type ScriptEntry,\n  type ProductionAgentOptions,\n  type ActionTool,\n  type ScriptTool,\n  type AgentMessage,\n  type AgentChatRequest,\n  type AgentChatEvent,\n  type AgentChatAttachment,\n  type AgentChatReference,\n  type MentionProvider,\n  type MentionProviderItem,\n  type AgentLoopFinalResponseGuard,\n  type AgentLoopFinalResponseGuardContext,\n  type AgentLoopFinalResponseGuardResult,\n  type AgentLoopToolCallSummary,\n  type AgentLoopToolResultSummary,\n} from \"../agent/index.js\";\nexport {\n  actionsToEngineTools,\n  getOwnerActiveApiKey,\n  runAgentLoop,\n} from \"../agent/production-agent.js\";\nexport {\n  getStoredModelForEngine,\n  resolveEngine,\n} from \"../agent/engine/index.js\";\nexport {\n  completeText,\n  type CompleteTextMessage,\n  type CompleteTextOptions,\n  type CompleteTextResult,\n  type CompleteTextUsage,\n} from \"./complete-text.js\";\nexport { createDevScriptRegistry } from \"../scripts/dev/index.js\";\n\nexport {\n  createPollHandler,\n  recordChange,\n  getVersion,\n  getChangesSince,\n  getPollEmitter,\n  canSeeChangeForUser,\n  POLL_CHANGE_EVENT,\n} from \"./poll.js\";\nexport { createPollEventsHandler } from \"./poll-events.js\";\nexport { createAuthPlugin, defaultAuthPlugin } from \"./auth-plugin.js\";\nexport {\n  initServerSentry,\n  isServerSentryEnabled,\n  setSentryUserForRequest,\n  captureRouteError,\n  type RouteErrorContext,\n} from \"./sentry.js\";\nexport {\n  captureError,\n  captureServerError,\n  registerErrorCaptureProvider,\n  type CaptureErrorContext,\n  type CaptureErrorProvider,\n} from \"./capture-error.js\";\nexport { createSentryPlugin, defaultSentryPlugin } from \"./sentry-plugin.js\";\n// Re-export the org plugin so the auto-discovery's DEFAULT_PLUGIN_REGISTRY\n// (which references \"defaultOrgPlugin\" from @agent-native/core/server) can\n// resolve it during the deploy build worker-entry generation.\nexport { createOrgPlugin, defaultOrgPlugin } from \"../org/plugin.js\";\nexport {\n  createContextXrayPlugin,\n  defaultContextXrayPlugin,\n} from \"../agent/context-xray/plugin.js\";\nexport {\n  createObservationalMemoryPlugin,\n  defaultObservationalMemoryPlugin,\n} from \"../agent/observational-memory/plugin.js\";\nexport {\n  createGoogleAuthPlugin,\n  type GoogleAuthPluginOptions,\n} from \"./google-auth-plugin.js\";\nexport type { GoogleAuthMode } from \"./google-auth-mode.js\";\nexport {\n  createAgentChatPlugin,\n  defaultAgentChatPlugin,\n  refreshGlobalMcpManager,\n  type AgentChatPluginOptions,\n} from \"./agent-chat-plugin.js\";\nexport {\n  configureAgentNativeEmbeddedEnvironment,\n  createAgentNativeEmbeddedAuthOptions,\n  createAgentNativeEmbeddedPlugin,\n  mountAgentNativeEmbedded,\n  normalizeAgentNativeEmbeddedSession,\n  type AgentNativeEmbeddedAuthOptions,\n  type AgentNativeEmbeddedGetSession,\n  type AgentNativeEmbeddedHostSession,\n  type AgentNativeEmbeddedPluginOptions,\n} from \"./embedded.js\";\nexport {\n  createThread,\n  getThread,\n  listThreads,\n  updateThreadData,\n  deleteThread,\n  setThreadArchived,\n  setThreadPinned,\n  setThreadScope,\n  type ChatThread,\n  type ChatThreadScope,\n  type ChatThreadSummary,\n  type ListThreadsOptions,\n} from \"../chat-threads/store.js\";\nexport {\n  createResourcesPlugin,\n  defaultResourcesPlugin,\n} from \"./resources-plugin.js\";\nexport {\n  createCoreRoutesPlugin,\n  defaultCoreRoutesPlugin,\n  FRAMEWORK_ROUTE_PREFIX,\n  type CoreRoutesPluginOptions,\n} from \"./core-routes-plugin.js\";\nexport {\n  AGENT_NATIVE_OG_IMAGE_CACHE_CONTROL,\n  AGENT_NATIVE_OG_IMAGE_HEIGHT,\n  AGENT_NATIVE_OG_IMAGE_NETLIFY_CACHE_CONTROL,\n  AGENT_NATIVE_OG_IMAGE_WIDTH,\n  agentNativeOgImageResponseHeaders,\n  createAgentNativeOgImageHandler,\n  renderAgentNativeOgImagePng,\n  renderAgentNativeOgImageSvg,\n  type AgentNativeOgImageInput,\n} from \"./social-og-image.js\";\nexport {\n  createBrowserSessionActionEntries,\n  type CreateBrowserSessionActionEntriesOptions,\n} from \"../browser-sessions/actions.js\";\nexport {\n  DEFAULT_BROWSER_SESSION_REQUEST_POLL_MS,\n  DEFAULT_BROWSER_SESSION_REQUEST_TIMEOUT_MS,\n  DEFAULT_BROWSER_SESSION_TTL_MS,\n  callBrowserSession,\n  claimBrowserSessionRequest,\n  completeBrowserSessionRequest,\n  createBrowserSessionRequest,\n  disconnectBrowserSession,\n  getBrowserSession,\n  getBrowserSessionRequest,\n  listBrowserSessions,\n  registerBrowserSession,\n  waitForBrowserSessionRequest,\n} from \"../browser-sessions/store.js\";\nexport {\n  mountBrowserSessionRoutes,\n  type MountBrowserSessionRoutesOptions,\n} from \"../browser-sessions/routes.js\";\nexport type {\n  AgentNativeBrowserSession,\n  AgentNativeBrowserSessionAction,\n  AgentNativeBrowserSessionRecord,\n  AgentNativeBrowserSessionRequest,\n  AgentNativeBrowserSessionRequestStatus,\n  AgentNativeBrowserSessionRequestType,\n  CreateAgentNativeBrowserSessionRequestInput,\n  RegisterAgentNativeBrowserSessionInput,\n} from \"../browser-sessions/types.js\";\nexport {\n  createTerminalPlugin,\n  defaultTerminalPlugin,\n  type TerminalPluginOptions,\n} from \"../terminal/terminal-plugin.js\";\nexport {\n  createCollabPlugin,\n  type CollabPluginOptions,\n} from \"./collab-plugin.js\";\n\nexport {\n  spawnTask,\n  getTask,\n  getTaskByThread,\n  listTasks,\n  sendToTask,\n  markTaskErrored,\n  type AgentTask,\n  type SpawnTaskOptions,\n} from \"./agent-teams.js\";\nexport { isOAuthConnected, getOAuthAccounts } from \"./oauth-helpers.js\";\nexport {\n  hasGoogleSignInCredentials,\n  resolveGoogleLegacyProviderCredentials,\n  resolveGoogleProviderCredentialCandidates,\n  resolveGoogleProviderCredentials,\n  resolveGoogleSignInCredentials,\n  type GoogleOAuthCredentials,\n} from \"./google-oauth-credentials.js\";\nexport { wrapWithAnalytics } from \"./analytics.js\";\nexport {\n  getH3App,\n  awaitBootstrap,\n  markDefaultPluginProvided,\n  type H3AppShim,\n} from \"./framework-request-handler.js\";\nexport {\n  autoDiscoverActions,\n  autoDiscoverScripts,\n  loadActionsFromStaticRegistry,\n  mergeCoreSharingActions,\n  registerPackageActions,\n} from \"./action-discovery.js\";\nexport {\n  mountActionRoutes,\n  type MountActionRoutesOptions,\n} from \"./action-routes.js\";\nexport {\n  runWithRequestContext,\n  hasRequestContext,\n  getRequestContext,\n  getRequestUserEmail,\n  getRequestUserName,\n  getRequestOrgId,\n  getRequestTimezone,\n  getRequestRunContext,\n  getCredentialContext,\n  isIntegrationCallerRequest,\n  type RequestContext,\n  type RequestRunContext,\n} from \"./request-context.js\";\nexport { formatDateInTimezone, todayInTimezone } from \"./date-utils.js\";\n\nexport {\n  createOnboardingPlugin,\n  defaultOnboardingPlugin,\n} from \"../onboarding/plugin.js\";\n\nexport {\n  registerFileUploadProvider,\n  unregisterFileUploadProvider,\n  listFileUploadProviders,\n  getActiveFileUploadProvider,\n  getActiveFileUploadProviderForRequest,\n  uploadFile,\n  builderFileUploadProvider,\n  type FileUploadInput,\n  type FileUploadProvider,\n  type FileUploadResult,\n} from \"../file-upload/index.js\";\n\nexport {\n  createIntegrationsPlugin,\n  defaultIntegrationsPlugin,\n  enqueueRemoteCommand,\n  slackAdapter,\n  telegramAdapter,\n  whatsappAdapter,\n  emailAdapter,\n  type PlatformAdapter,\n  type IncomingMessage,\n  type OutgoingMessage,\n  type IntegrationStatus,\n  type IntegrationsPluginOptions,\n} from \"../integrations/index.js\";\n\nexport {\n  isElectron,\n  isMobile,\n  getOrigin,\n  getAppBasePath,\n  getAppUrl,\n  resolveOAuthRedirectUri,\n  isAllowedOAuthRedirectUri,\n  encodeOAuthState,\n  decodeOAuthState,\n  resolveOAuthOwner,\n  createOAuthSession,\n  oauthCallbackResponse,\n  oauthErrorPage,\n  oauthDesktopExchangePage,\n  type OAuthStatePayload,\n  type OAuthOwnerResult,\n  type OAuthSessionResult,\n} from \"./google-oauth.js\";\n\nexport {\n  FeatureNotConfiguredError,\n  hasBuilderPrivateKey,\n  isBuilderEnvManaged,\n  getBuilderProxyOrigin,\n  getBuilderImageGenerationBaseUrl,\n  getBuilderWebSearchBaseUrl,\n  getBuilderAuthHeader,\n  resolveBuilderPrivateKey,\n  resolveBuilderAuthHeader,\n  resolveHasBuilderPrivateKey,\n  resolveHasCompleteBuilderConnection,\n  resolveBuilderCredentials,\n  resolveBuilderCredential,\n  readDeployCredentialEnv,\n  writeBuilderCredentials,\n  deleteBuilderCredentials,\n  resolveSecret,\n} from \"./credential-provider.js\";\nexport {\n  builderDesignSystemUrl,\n  getBuilderDesignSystemsBaseUrl,\n  startBuilderDesignSystemIndex,\n  type BuilderDesignSystemIndexFile,\n  type BuilderDesignSystemIndexOptions,\n  type BuilderDesignSystemIndexResult,\n} from \"./builder-design-systems.js\";\nexport {\n  getBuilderBranchProjectId,\n  isBuilderBranchingEnabled,\n  resolveBuilderBranchProjectId,\n  resolveIsBuilderBranchingEnabled,\n  runBuilderAgent,\n  type RunBuilderAgentResult,\n} from \"./builder-browser.js\";\nexport {\n  ensureFusionContainer,\n  sendFusionBranchMessage,\n  pushFusionBranch,\n  reserveFusionHostingSlug,\n  deployFusionProject,\n  getFusionDeploys,\n  getFusionBranchEditorUrl,\n  getFusionHostingUrl,\n  type FusionBranchRef,\n  type EnsureFusionContainerResult,\n  type SendFusionMessageResult,\n} from \"./fusion-app.js\";\n\nexport {\n  sendEmail,\n  isEmailConfigured,\n  getEmailProvider,\n  type EmailAttachment,\n  type EmailProvider,\n  type SendEmailArgs,\n} from \"./email.js\";\nexport {\n  renderEmail,\n  emailStrong,\n  emailLink,\n  type RenderEmailArgs,\n  type RenderedEmail,\n  type EmailCta,\n} from \"./email-template.js\";\nexport { getAppProductionUrl, getFirstPartyProdUrl } from \"./app-url.js\";\nexport {\n  getConfiguredAppBasePath,\n  normalizeAppBasePath,\n  withConfiguredAppBasePath,\n} from \"./app-base-path.js\";\nexport {\n  signShortLivedToken,\n  verifyShortLivedToken,\n  type ShortLivedTokenClaims,\n  type VerifyResult as ShortLivedTokenVerifyResult,\n} from \"./short-lived-token.js\";\n\n// SSR handler is NOT re-exported here — it uses a virtual module\n// (virtual:react-router/server-build) that only exists at Vite dev/build time.\n// Including it in this barrel would break the esbuild CF Pages bundler.\n// Templates import directly: import { ssrHandler } from \"@agent-native/core/server/ssr-handler\"\n\n// Nitro plugin helper — re-exported so templates don't need nitro as a direct dependency.\n// defineNitroPlugin is an identity function; this typed wrapper lets templates use it\n// without resolving `nitro/runtime` (which requires Nitro's virtual modules at runtime).\nexport type NitroPluginDef = (nitroApp: any) => void | Promise<void>;\nexport function defineNitroPlugin(def: NitroPluginDef): NitroPluginDef {\n  return def;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,UAAU,EACV,2BAA2B,EAC3B,6BAA6B,EAC7B,gCAAgC,EAChC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAyB,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,GAQxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAA0B,MAAM,UAAU,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,GAIf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAA2B,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,GAIzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,4BAA4B,GAkB7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACb,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,YAAY,GAKb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,GAG7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uCAAuC,EACvC,oCAAoC,EACpC,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,GAKpC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,GAKf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,2CAA2C,EAC3C,2BAA2B,EAC3B,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uCAAuC,EACvC,0CAA0C,EAC1C,8BAA8B,EAC9B,kBAAkB,EAClB,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,GAE1B,MAAM,+BAA+B,CAAC;AAWvC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,SAAS,EACT,OAAO,EACP,eAAe,EACf,SAAS,EACT,UAAU,EACV,eAAe,GAGhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,yCAAyC,EACzC,gCAAgC,EAChC,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,QAAQ,EACR,cAAc,EACd,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,qCAAqC,EACrC,UAAU,EACV,yBAAyB,GAI1B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,YAAY,GAMb,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,SAAS,EACT,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,wBAAwB,GAIzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,mCAAmC,EACnC,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,sCAAsC,EACtC,sCAAsC,EACtC,6BAA6B,GAY9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,GAIpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,gBAAgB,GAIjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,WAAW,EACX,SAAS,GAIV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAGtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,GAM7B,MAAM,mBAAmB,CAAC;AAW3B,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["export {\n  createServer,\n  type CreateServerOptions,\n  type EnvKeyConfig,\n} from \"./create-server.js\";\n\nexport {\n  readBody,\n  readBodyWithSizeLimit,\n  streamFile,\n  DEFAULT_CHAT_MAX_BODY_BYTES,\n  DEFAULT_UPLOAD_MAX_FILE_BYTES,\n  MAX_CHAT_ATTACHMENTS_PER_MESSAGE,\n  isAllowedUploadMimeType,\n} from \"./h3-helpers.js\";\nexport {\n  buildDeepLink,\n  toAbsoluteOpenUrl,\n  toDesktopOpenUrl,\n  toVsCodeOpenUrl,\n  OPEN_ROUTE_SUBPATH,\n  DESKTOP_OPEN_URL,\n  VSCODE_OPEN_URL,\n  type DeepLinkInput,\n} from \"./deep-link.js\";\nexport { createOpenRouteHandler, type OpenRouteOptions } from \"./open-route.js\";\nexport {\n  createEmbedStartRouteHandler,\n  buildEmbedStartPath,\n  type EmbedStartRouteOptions,\n} from \"./embed-route.js\";\nexport {\n  createEmbedSessionTicket,\n  consumeEmbedSessionTicket,\n  normalizeEmbedTargetPath,\n  requestHasEmbedAuthMarker,\n  resolveEmbedSessionFromRequest,\n  setEmbedSessionCookie,\n  signEmbedSessionToken,\n  verifyEmbedSessionToken,\n  type ConsumedEmbedSessionTicket,\n  type ConsumeEmbedSessionTicketOptions,\n  type EmbedSessionTicket,\n  type EmbedSessionTicketInput,\n  type EmbedSessionTokenClaims,\n  type ResolvedEmbedSession,\n  type VerifyEmbedSessionTokenResult,\n} from \"./embed-session.js\";\nexport { createSSEHandler, type SSEHandlerOptions } from \"./sse.js\";\nexport {\n  mountAuthMiddleware,\n  autoMountAuth,\n  getSession,\n  COOKIE_NAME,\n  addSession,\n  removeSession,\n  getSessionEmail,\n  getFrameworkSessionCookieValues,\n  setFrameworkSessionCookie,\n  clearFrameworkSessionCookies,\n  runAuthGuard,\n  setDesktopExchange,\n  setDesktopExchangeError,\n  safeReturnPath,\n  type DesktopExchangeErrorPayload,\n  type AuthSession,\n  type AuthOptions,\n} from \"./auth.js\";\nexport {\n  handleIdentitySso,\n  getIdentityHubUrl,\n  isIdentitySsoEnabled,\n  isIdentitySsoBypassPath,\n  identitySsoLoginButtonHtml,\n  IDENTITY_SSO_PROVIDER_ID,\n  IDENTITY_SSO_SCOPE,\n} from \"./identity-sso.js\";\nexport { requireEnvKey, type MissingKeyResponse } from \"./missing-key.js\";\nexport { verifyCaptcha, type CaptchaVerifyResult } from \"./captcha.js\";\nexport {\n  getLocaleInitScript,\n  parseAcceptLanguage,\n  resolveLocaleFromRequest,\n  type LocaleInitScriptOptions,\n  type ResolveLocaleFromRequestOptions,\n  type ResolvedRequestLocale,\n} from \"../localization/server.js\";\nexport {\n  createProductionAgentHandler,\n  type ActionEntry,\n  type ScriptEntry,\n  type ProductionAgentOptions,\n  type ActionTool,\n  type ScriptTool,\n  type AgentMessage,\n  type AgentChatRequest,\n  type AgentChatEvent,\n  type AgentChatAttachment,\n  type AgentChatReference,\n  type MentionProvider,\n  type MentionProviderItem,\n  type AgentLoopFinalResponseGuard,\n  type AgentLoopFinalResponseGuardContext,\n  type AgentLoopFinalResponseGuardResult,\n  type AgentLoopToolCallSummary,\n  type AgentLoopToolResultSummary,\n} from \"../agent/index.js\";\nexport {\n  actionsToEngineTools,\n  getOwnerActiveApiKey,\n  runAgentLoop,\n} from \"../agent/production-agent.js\";\nexport {\n  getStoredModelForEngine,\n  resolveEngine,\n} from \"../agent/engine/index.js\";\nexport {\n  completeText,\n  type CompleteTextMessage,\n  type CompleteTextOptions,\n  type CompleteTextResult,\n  type CompleteTextUsage,\n} from \"./complete-text.js\";\nexport { createDevScriptRegistry } from \"../scripts/dev/index.js\";\n\nexport {\n  createPollHandler,\n  recordChange,\n  getVersion,\n  getChangesSince,\n  getPollEmitter,\n  canSeeChangeForUser,\n  POLL_CHANGE_EVENT,\n} from \"./poll.js\";\nexport { createPollEventsHandler } from \"./poll-events.js\";\nexport { createAuthPlugin, defaultAuthPlugin } from \"./auth-plugin.js\";\nexport {\n  initServerSentry,\n  isServerSentryEnabled,\n  setSentryUserForRequest,\n  captureRouteError,\n  type RouteErrorContext,\n} from \"./sentry.js\";\nexport {\n  captureError,\n  captureServerError,\n  registerErrorCaptureProvider,\n  type CaptureErrorContext,\n  type CaptureErrorProvider,\n} from \"./capture-error.js\";\nexport { createSentryPlugin, defaultSentryPlugin } from \"./sentry-plugin.js\";\n// Re-export the org plugin so the auto-discovery's DEFAULT_PLUGIN_REGISTRY\n// (which references \"defaultOrgPlugin\" from @agent-native/core/server) can\n// resolve it during the deploy build worker-entry generation.\nexport { createOrgPlugin, defaultOrgPlugin } from \"../org/plugin.js\";\nexport {\n  createContextXrayPlugin,\n  defaultContextXrayPlugin,\n} from \"../agent/context-xray/plugin.js\";\nexport {\n  createObservationalMemoryPlugin,\n  defaultObservationalMemoryPlugin,\n} from \"../agent/observational-memory/plugin.js\";\nexport {\n  createGoogleAuthPlugin,\n  type GoogleAuthPluginOptions,\n} from \"./google-auth-plugin.js\";\nexport type { GoogleAuthMode } from \"./google-auth-mode.js\";\nexport {\n  createAgentChatPlugin,\n  defaultAgentChatPlugin,\n  refreshGlobalMcpManager,\n  type AgentChatPluginOptions,\n} from \"./agent-chat-plugin.js\";\nexport {\n  configureAgentNativeEmbeddedEnvironment,\n  createAgentNativeEmbeddedAuthOptions,\n  createAgentNativeEmbeddedPlugin,\n  mountAgentNativeEmbedded,\n  normalizeAgentNativeEmbeddedSession,\n  type AgentNativeEmbeddedAuthOptions,\n  type AgentNativeEmbeddedGetSession,\n  type AgentNativeEmbeddedHostSession,\n  type AgentNativeEmbeddedPluginOptions,\n} from \"./embedded.js\";\nexport {\n  createThread,\n  getThread,\n  listThreads,\n  updateThreadData,\n  deleteThread,\n  setThreadArchived,\n  setThreadPinned,\n  setThreadScope,\n  type ChatThread,\n  type ChatThreadScope,\n  type ChatThreadSummary,\n  type ListThreadsOptions,\n} from \"../chat-threads/store.js\";\nexport {\n  createResourcesPlugin,\n  defaultResourcesPlugin,\n} from \"./resources-plugin.js\";\nexport {\n  createCoreRoutesPlugin,\n  defaultCoreRoutesPlugin,\n  FRAMEWORK_ROUTE_PREFIX,\n  type CoreRoutesPluginOptions,\n} from \"./core-routes-plugin.js\";\nexport {\n  AGENT_NATIVE_OG_IMAGE_CACHE_CONTROL,\n  AGENT_NATIVE_OG_IMAGE_HEIGHT,\n  AGENT_NATIVE_OG_IMAGE_NETLIFY_CACHE_CONTROL,\n  AGENT_NATIVE_OG_IMAGE_WIDTH,\n  agentNativeOgImageResponseHeaders,\n  createAgentNativeOgImageHandler,\n  renderAgentNativeOgImagePng,\n  renderAgentNativeOgImageSvg,\n  type AgentNativeOgImageInput,\n} from \"./social-og-image.js\";\nexport {\n  createBrowserSessionActionEntries,\n  type CreateBrowserSessionActionEntriesOptions,\n} from \"../browser-sessions/actions.js\";\nexport {\n  DEFAULT_BROWSER_SESSION_REQUEST_POLL_MS,\n  DEFAULT_BROWSER_SESSION_REQUEST_TIMEOUT_MS,\n  DEFAULT_BROWSER_SESSION_TTL_MS,\n  callBrowserSession,\n  claimBrowserSessionRequest,\n  completeBrowserSessionRequest,\n  createBrowserSessionRequest,\n  disconnectBrowserSession,\n  getBrowserSession,\n  getBrowserSessionRequest,\n  listBrowserSessions,\n  registerBrowserSession,\n  waitForBrowserSessionRequest,\n} from \"../browser-sessions/store.js\";\nexport {\n  mountBrowserSessionRoutes,\n  type MountBrowserSessionRoutesOptions,\n} from \"../browser-sessions/routes.js\";\nexport type {\n  AgentNativeBrowserSession,\n  AgentNativeBrowserSessionAction,\n  AgentNativeBrowserSessionRecord,\n  AgentNativeBrowserSessionRequest,\n  AgentNativeBrowserSessionRequestStatus,\n  AgentNativeBrowserSessionRequestType,\n  CreateAgentNativeBrowserSessionRequestInput,\n  RegisterAgentNativeBrowserSessionInput,\n} from \"../browser-sessions/types.js\";\nexport {\n  createTerminalPlugin,\n  defaultTerminalPlugin,\n  type TerminalPluginOptions,\n} from \"../terminal/terminal-plugin.js\";\nexport {\n  createCollabPlugin,\n  type CollabPluginOptions,\n} from \"./collab-plugin.js\";\n\nexport {\n  spawnTask,\n  getTask,\n  getTaskByThread,\n  listTasks,\n  sendToTask,\n  markTaskErrored,\n  type AgentTask,\n  type SpawnTaskOptions,\n} from \"./agent-teams.js\";\nexport { isOAuthConnected, getOAuthAccounts } from \"./oauth-helpers.js\";\nexport {\n  hasGoogleSignInCredentials,\n  resolveGoogleLegacyProviderCredentials,\n  resolveGoogleProviderCredentialCandidates,\n  resolveGoogleProviderCredentials,\n  resolveGoogleSignInCredentials,\n  type GoogleOAuthCredentials,\n} from \"./google-oauth-credentials.js\";\nexport { wrapWithAnalytics } from \"./analytics.js\";\nexport {\n  getH3App,\n  awaitBootstrap,\n  markDefaultPluginProvided,\n  type H3AppShim,\n} from \"./framework-request-handler.js\";\nexport {\n  autoDiscoverActions,\n  autoDiscoverScripts,\n  loadActionsFromStaticRegistry,\n  mergeCoreSharingActions,\n  registerPackageActions,\n} from \"./action-discovery.js\";\nexport {\n  mountActionRoutes,\n  type MountActionRoutesOptions,\n} from \"./action-routes.js\";\nexport {\n  runWithRequestContext,\n  hasRequestContext,\n  getRequestContext,\n  getRequestUserEmail,\n  getRequestUserName,\n  getRequestOrgId,\n  getRequestTimezone,\n  getRequestRunContext,\n  getCredentialContext,\n  isIntegrationCallerRequest,\n  type RequestContext,\n  type RequestRunContext,\n} from \"./request-context.js\";\nexport { formatDateInTimezone, todayInTimezone } from \"./date-utils.js\";\n\nexport {\n  createOnboardingPlugin,\n  defaultOnboardingPlugin,\n} from \"../onboarding/plugin.js\";\n\nexport {\n  registerFileUploadProvider,\n  unregisterFileUploadProvider,\n  listFileUploadProviders,\n  getActiveFileUploadProvider,\n  getActiveFileUploadProviderForRequest,\n  uploadFile,\n  builderFileUploadProvider,\n  type FileUploadInput,\n  type FileUploadProvider,\n  type FileUploadResult,\n} from \"../file-upload/index.js\";\n\nexport {\n  createIntegrationsPlugin,\n  defaultIntegrationsPlugin,\n  enqueueRemoteCommand,\n  slackAdapter,\n  telegramAdapter,\n  whatsappAdapter,\n  emailAdapter,\n  type PlatformAdapter,\n  type IncomingMessage,\n  type OutgoingMessage,\n  type IntegrationStatus,\n  type IntegrationsPluginOptions,\n} from \"../integrations/index.js\";\n\nexport {\n  isElectron,\n  isMobile,\n  getOrigin,\n  getAppBasePath,\n  getAppUrl,\n  resolveOAuthRedirectUri,\n  isAllowedOAuthRedirectUri,\n  encodeOAuthState,\n  decodeOAuthState,\n  resolveOAuthOwner,\n  createOAuthSession,\n  oauthCallbackResponse,\n  oauthErrorPage,\n  oauthDesktopExchangePage,\n  type OAuthStatePayload,\n  type OAuthOwnerResult,\n  type OAuthSessionResult,\n} from \"./google-oauth.js\";\n\nexport {\n  FeatureNotConfiguredError,\n  hasBuilderPrivateKey,\n  isBuilderEnvManaged,\n  getBuilderProxyOrigin,\n  getBuilderImageGenerationBaseUrl,\n  getBuilderWebSearchBaseUrl,\n  getBuilderAuthHeader,\n  resolveBuilderPrivateKey,\n  resolveBuilderAuthHeader,\n  resolveHasBuilderPrivateKey,\n  resolveHasCompleteBuilderConnection,\n  resolveBuilderCredentials,\n  resolveBuilderCredential,\n  readDeployCredentialEnv,\n  writeBuilderCredentials,\n  deleteBuilderCredentials,\n  resolveSecret,\n} from \"./credential-provider.js\";\nexport {\n  builderDesignSystemUrl,\n  buildBuilderDesignSystemIndexFiles,\n  createBuilderDesignSystemProxyFields,\n  fetchBuilderDesignSystemDocs,\n  getBuilderDesignSystemsBaseUrl,\n  hydrateBuilderDesignSystemReference,\n  localBuilderDesignSystemId,\n  mimeTypeForBuilderDesignSystemFilename,\n  parseBuilderDesignSystemProxyReference,\n  startBuilderDesignSystemIndex,\n  type BuildBuilderDesignSystemIndexFilesOptions,\n  type BuilderDesignSystemCodeFileInput,\n  type BuilderDesignSystemDocsOptions,\n  type BuilderDesignSystemDocument,\n  type BuilderDesignSystemHydratedReference,\n  type BuilderDesignSystemIndexFile,\n  type BuilderDesignSystemIndexOptions,\n  type BuilderDesignSystemIndexResult,\n  type BuilderDesignSystemProxyFields,\n  type BuilderDesignSystemProxyFieldsOptions,\n  type BuilderDesignSystemProxyReference,\n} from \"./builder-design-systems.js\";\nexport {\n  getBuilderBranchProjectId,\n  isBuilderBranchingEnabled,\n  resolveBuilderBranchProjectId,\n  resolveIsBuilderBranchingEnabled,\n  runBuilderAgent,\n  type RunBuilderAgentResult,\n} from \"./builder-browser.js\";\nexport {\n  ensureFusionContainer,\n  sendFusionBranchMessage,\n  pushFusionBranch,\n  reserveFusionHostingSlug,\n  deployFusionProject,\n  getFusionDeploys,\n  getFusionBranchEditorUrl,\n  getFusionHostingUrl,\n  type FusionBranchRef,\n  type EnsureFusionContainerResult,\n  type SendFusionMessageResult,\n} from \"./fusion-app.js\";\n\nexport {\n  sendEmail,\n  isEmailConfigured,\n  getEmailProvider,\n  type EmailAttachment,\n  type EmailProvider,\n  type SendEmailArgs,\n} from \"./email.js\";\nexport {\n  renderEmail,\n  emailStrong,\n  emailLink,\n  type RenderEmailArgs,\n  type RenderedEmail,\n  type EmailCta,\n} from \"./email-template.js\";\nexport { getAppProductionUrl, getFirstPartyProdUrl } from \"./app-url.js\";\nexport {\n  getConfiguredAppBasePath,\n  normalizeAppBasePath,\n  withConfiguredAppBasePath,\n} from \"./app-base-path.js\";\nexport {\n  signShortLivedToken,\n  verifyShortLivedToken,\n  type ShortLivedTokenClaims,\n  type VerifyResult as ShortLivedTokenVerifyResult,\n} from \"./short-lived-token.js\";\nexport {\n  AGENT_ACCESS_PARAM,\n  DEFAULT_AGENT_ACCESS_TTL_SECONDS,\n  appendAgentAccessParam,\n  buildAgentAccessApiUrl,\n  buildAgentAccessUrl,\n  createScopedAgentAccessGrant,\n  normalizeAgentAccessBasePath,\n  normalizeAgentAccessOrigin,\n  scopedAgentAccessResourceId,\n  signScopedAgentAccessToken,\n  toAgentAccessUrl,\n  verifyScopedAgentAccessToken,\n  type AgentAccessApiUrlOptions,\n  type AgentAccessResourceScope,\n  type AgentAccessUrlOptions,\n  type ScopedAgentAccessGrant,\n  type ScopedAgentAccessTokenOptions,\n} from \"./agent-access.js\";\n\n// SSR handler is NOT re-exported here — it uses a virtual module\n// (virtual:react-router/server-build) that only exists at Vite dev/build time.\n// Including it in this barrel would break the esbuild CF Pages bundler.\n// Templates import directly: import { ssrHandler } from \"@agent-native/core/server/ssr-handler\"\n\n// Nitro plugin helper — re-exported so templates don't need nitro as a direct dependency.\n// defineNitroPlugin is an identity function; this typed wrapper lets templates use it\n// without resolving `nitro/runtime` (which requires Nitro's virtual modules at runtime).\nexport type NitroPluginDef = (nitroApp: any) => void | Promise<void>;\nexport function defineNitroPlugin(def: NitroPluginDef): NitroPluginDef {\n  return def;\n}\n"]}

package/dist/server/request-context.d.ts

@@ -1,3 +1,20 @@
+/**
+ * Per-request context using AsyncLocalStorage.
+ *
+ * Replaces the unsafe pattern of mutating `process.env.AGENT_USER_EMAIL` /
+ * `process.env.AGENT_ORG_ID` on every request. On Node.js (Netlify, self-hosted)
+ * concurrent requests would overwrite each other's env vars. AsyncLocalStorage
+ * gives each async call-chain its own isolated context.
+ *
+ * Supported on all deployment targets:
+ * - Node.js (native)
+ * - Cloudflare Workers (via nodejs_compat flag)
+ * - Deno Deploy (via node:async_hooks compat)
+ *
+ * For CLI scripts that run outside a request context, the getters fall back to
+ * process.env so existing `AGENT_USER_EMAIL=x pnpm action foo` invocations
+ * continue to work.
+ */
 /**
  * Per-request agent-run state. Lives on `RequestContext.run` so the
  * agent-chat plugin can populate fields as the run progresses (owner,

package/dist/server/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;IACT,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,0BAA0B,EAAE,WAAW,CAAC;IACxD,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wDAAwD;IACxD,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpD,8DAA8D;IAC9D,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,OAAO,0BAA0B,EAAE,eAAe,CAAC;QAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;OAGG;IACH,GAAG,CAAC,EAAE,iBAAiB,CAAC;CACzB;AAID,KAAK,sBAAsB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;AAe5D;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,IAAI,CAMZ;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACvB,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAahB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAI9D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAOxD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAOvD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAOpD;AASD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,4BAA4B,IACxC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,GAC1C,SAAS,CAEZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,IAAI,CAIP;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,SAAS,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,GAAG,SAAS,CAKvE"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA0DH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;IACT,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,0BAA0B,EAAE,WAAW,CAAC;IACxD,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wDAAwD;IACxD,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpD,8DAA8D;IAC9D,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,OAAO,0BAA0B,EAAE,eAAe,CAAC;QAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;OAGG;IACH,GAAG,CAAC,EAAE,iBAAiB,CAAC;CACzB;AAID,KAAK,sBAAsB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;AAiB5D;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,IAAI,CAMZ;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACvB,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAahB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAI9D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAOxD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAOvD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAOpD;AASD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,4BAA4B,IACxC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,GAC1C,SAAS,CAEZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,IAAI,CAIP;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,SAAS,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,GAAG,SAAS,CAKvE"}

package/dist/server/request-context.js

@@ -15,12 +15,52 @@
  * process.env so existing `AGENT_USER_EMAIL=x pnpm action foo` invocations
  * continue to work.
  */
-import { AsyncLocalStorage } from "node:async_hooks";
+class StackAsyncLocalStorage {
+    stack = [];
+    getStore() {
+        return this.stack.at(-1);
+    }
+    run(store, callback) {
+        this.stack.push(store);
+        try {
+            const result = callback();
+            const maybePromise = result;
+            if (maybePromise && typeof maybePromise.finally === "function") {
+                return maybePromise.finally(() => {
+                    this.stack.pop();
+                });
+            }
+            this.stack.pop();
+            return result;
+        }
+        catch (error) {
+            this.stack.pop();
+            throw error;
+        }
+    }
+}
+function getAsyncLocalStorageCtor() {
+    if (typeof window !== "undefined" ||
+        typeof process === "undefined" ||
+        !process.versions?.node ||
+        typeof process.getBuiltinModule !== "function") {
+        return undefined;
+    }
+    return process.getBuiltinModule("node:async_hooks")?.AsyncLocalStorage;
+}
+const AsyncLocalStorageCtor = getAsyncLocalStorageCtor();
+function processEnv(name) {
+    if (typeof process === "undefined")
+        return undefined;
+    return process.env?.[name];
+}
 const GLOBAL_KEY = "__agentNativeRequestContextAls";
 const OBSERVERS_KEY = "__agentNativeRequestContextObservers";
 const globalRef = globalThis;
 if (!globalRef[GLOBAL_KEY]) {
-    globalRef[GLOBAL_KEY] = new AsyncLocalStorage();
+    globalRef[GLOBAL_KEY] = AsyncLocalStorageCtor
+        ? new AsyncLocalStorageCtor()
+        : new StackAsyncLocalStorage();
 }
 if (!globalRef[OBSERVERS_KEY]) {
     globalRef[OBSERVERS_KEY] = [];
@@ -105,7 +145,7 @@ export function getRequestUserEmail() {
             markAuthContextAccess(store);
         return store.userEmail;
     }
-    return process.env.AGENT_USER_EMAIL;
+    return processEnv("AGENT_USER_EMAIL");
 }
 /**
  * Get the current request's display name, when the auth provider supplied one.
@@ -121,7 +161,7 @@ export function getRequestUserName() {
             markAuthContextAccess(store);
         return store.userName;
     }
-    return process.env.AGENT_USER_NAME;
+    return processEnv("AGENT_USER_NAME");
 }
 /**
  * Get the current request's org ID.
@@ -137,7 +177,7 @@ export function getRequestOrgId() {
             markAuthContextAccess(store);
         return store.orgId;
     }
-    return process.env.AGENT_ORG_ID;
+    return processEnv("AGENT_ORG_ID");
 }
 function markAuthContextAccess(ctx) {
     if (!ctx)
@@ -160,7 +200,7 @@ export function getRequestTimezone() {
     const store = als.getStore();
     if (store !== undefined)
         return store.timezone;
-    return process.env.AGENT_USER_TIMEZONE;
+    return processEnv("AGENT_USER_TIMEZONE");
 }
 /**
  * Returns true when this request is on an integration-platform path (Slack,

package/dist/server/request-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA+FrD,MAAM,UAAU,GAAG,gCAAyC,CAAC;AAC7D,MAAM,aAAa,GAAG,sCAA+C,CAAC;AAMtE,MAAM,SAAS,GAAG,UAAsC,CAAC;AACzD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;IAC3B,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAClE,CAAC;AACD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9B,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;AAChC,CAAC;AACD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAE,CAAC;AACnC,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAE,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgC;IAEhC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAmB,EACnB,EAAwB;IAExB,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;QACvB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,GAAG,CAAC,GAAG,CAAC,CAAC;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACP,+CAA+C;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,QAAQ;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,KAAK;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;AAClC,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA+B;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC/C,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAA+B;IAClE,OAAO,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,mBAAmB,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,4BAA4B;IAG1C,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB;IAIlC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;IAC/B,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC","sourcesContent":["/**\n * Per-request context using AsyncLocalStorage.\n *\n * Replaces the unsafe pattern of mutating `process.env.AGENT_USER_EMAIL` /\n * `process.env.AGENT_ORG_ID` on every request. On Node.js (Netlify, self-hosted)\n * concurrent requests would overwrite each other's env vars. AsyncLocalStorage\n * gives each async call-chain its own isolated context.\n *\n * Supported on all deployment targets:\n * - Node.js (native)\n * - Cloudflare Workers (via nodejs_compat flag)\n * - Deno Deploy (via node:async_hooks compat)\n *\n * For CLI scripts that run outside a request context, the getters fall back to\n * process.env so existing `AGENT_USER_EMAIL=x pnpm action foo` invocations\n * continue to work.\n */\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\n/**\n * Per-request agent-run state. Lives on `RequestContext.run` so the\n * agent-chat plugin can populate fields as the run progresses (owner,\n * resolved API key, system prompt, engine, model, threadId) without\n * mutating module-scope `let` bindings — those leak across concurrent\n * requests on a single Node.js process.\n *\n * Mutated in-place by `prepareRun`, `onEngineResolved`, `onRunStart` so\n * tool factory closures (automation, fetch, team, builder-browser) read\n * the live per-request value via `getRequestRunContext()`.\n */\nexport interface RequestRunContext {\n  /** Origin of the current request (used by the builder-browser tool). */\n  requestOrigin?: string;\n  /** Stable browser tab id for tab-scoped app-state reads/writes. */\n  browserTabId?: string;\n  /** Resource scope for the current chat thread, e.g. the active deck. */\n  chatScope?: {\n    type: string;\n    id: string;\n    label?: string;\n  } | null;\n  /** Resolved owner email (set by prepareRun). */\n  owner?: string;\n  /** Owner's active Anthropic API key (set by prepareRun). */\n  userApiKey?: string;\n  /** Thread ID for the current run (set by onRunStart). */\n  threadId?: string;\n  /** System prompt actually sent to the model for this run. */\n  systemPrompt?: string;\n  /** Engine instance for this run (set by onEngineResolved). */\n  engine?: import(\"../agent/engine/types.js\").AgentEngine;\n  /** Model name for this run (set by onEngineResolved). */\n  model?: string;\n  /**\n   * True when this run is executing inside the durable background-function\n   * worker (the `_process-run` self-dispatch), not the synchronous foreground\n   * request. Template `extraContext` / system-prompt builders can read this to\n   * skip heavy, hang-prone enrichment (large data-dictionary DB reads, etc.)\n   * in the worker so it reliably claims its run within the setup budget.\n   */\n  isBackgroundWorker?: boolean;\n  /** Tool calls made so far in the current agent loop. */\n  toolCalls?: Array<{ name: string; input: unknown }>;\n  /** Tool results returned so far in the current agent loop. */\n  toolResults?: Array<{ name: string; content: string; isError: boolean }>;\n}\n\nexport interface RequestContext {\n  userEmail?: string;\n  userName?: string;\n  orgId?: string;\n  timezone?: string;\n  /**\n   * Set when code reads authenticated request context. Public SSR shell/data\n   * should not depend on this value; user/org-specific reads belong behind\n   * client-side actions/API after hydration.\n   */\n  authContextAccessed?: boolean;\n  /**\n   * Origin of the inbound request (e.g. `http://127.0.0.1:8100`). Set by the\n   * MCP mount from the request headers so actions that build externally\n   * fetchable URLs (e.g. design `export-coding-handoff`'s signed raw-code URL)\n   * resolve the real local-workspace origin instead of a prod/localhost\n   * fallback. Optional — absent on paths that don't populate it.\n   */\n  requestOrigin?: string;\n  /**\n   * True when this request is being processed by an integration-platform\n   * webhook (Slack, Telegram, etc.) where the function timeout is the\n   * binding constraint. Code that calls slow remote APIs can use this to apply\n   * tighter budgets on this path while leaving normal agent-chat callers\n   * (5+ min budget) unaffected.\n   */\n  isIntegrationCaller?: boolean;\n  /**\n   * Metadata for the currently-processing integration task. This lets tools\n   * that start long-running remote work persist a continuation that can update\n   * the originating platform thread after the current function budget ends.\n   */\n  integration?: {\n    taskId: string;\n    attempts?: number;\n    incoming: import(\"../integrations/types.js\").IncomingMessage;\n    placeholderRef?: string;\n  };\n  /**\n   * Mutable per-request agent-run state. Populated by the agent-chat plugin\n   * during a run; tool closures dereference it on each invocation.\n   */\n  run?: RequestRunContext;\n}\n\nconst GLOBAL_KEY = \"__agentNativeRequestContextAls\" as const;\nconst OBSERVERS_KEY = \"__agentNativeRequestContextObservers\" as const;\ntype RequestContextObserver = (ctx: RequestContext) => void;\ntype GlobalWithRequestContext = typeof globalThis & {\n  [GLOBAL_KEY]?: AsyncLocalStorage<RequestContext>;\n  [OBSERVERS_KEY]?: RequestContextObserver[];\n};\nconst globalRef = globalThis as GlobalWithRequestContext;\nif (!globalRef[GLOBAL_KEY]) {\n  globalRef[GLOBAL_KEY] = new AsyncLocalStorage<RequestContext>();\n}\nif (!globalRef[OBSERVERS_KEY]) {\n  globalRef[OBSERVERS_KEY] = [];\n}\nconst als = globalRef[GLOBAL_KEY]!;\nconst observers = globalRef[OBSERVERS_KEY]!;\n\n/**\n * Register a callback fired every time `runWithRequestContext` enters a new\n * scope. The hook runs INSIDE the AsyncLocalStorage scope, so observability\n * helpers that read the current isolation scope (e.g. Sentry) attach to the\n * right per-request context.\n *\n * Returned function unregisters the observer. Observers must never throw —\n * any error is swallowed so a misbehaving observer can't break the request\n * path.\n */\nexport function addRequestContextObserver(\n  observer: RequestContextObserver,\n): () => void {\n  observers.push(observer);\n  return () => {\n    const i = observers.indexOf(observer);\n    if (i !== -1) observers.splice(i, 1);\n  };\n}\n\n/**\n * Run a callback within a per-request context. The context is available to all\n * async operations spawned from `fn` via `getRequestUserEmail()` / `getRequestOrgId()`.\n *\n * Any registered `addRequestContextObserver` callbacks fire inside the new\n * scope before `fn` runs, so observability code can pin user/org info onto\n * isolation-scoped backends (Sentry, OpenTelemetry, etc.).\n */\nexport function runWithRequestContext<T>(\n  ctx: RequestContext,\n  fn: () => T | Promise<T>,\n): T | Promise<T> {\n  return als.run(ctx, () => {\n    if (observers.length > 0) {\n      for (const obs of observers) {\n        try {\n          obs(ctx);\n        } catch {\n          // Observers must never break the request path.\n        }\n      }\n    }\n    return fn();\n  });\n}\n\n/**\n * Return the active request context, if this call chain is running under one.\n *\n * This is intentionally distinct from `getRequestUserEmail()`: callers that\n * have an active context with no authenticated user must not fall through to\n * process-wide CLI fallbacks such as `AGENT_USER_EMAIL` or \"latest session\".\n */\nexport function getRequestContext(): RequestContext | undefined {\n  const store = als.getStore();\n  markAuthContextAccess(store);\n  return store;\n}\n\n/**\n * True when AsyncLocalStorage has an active context for this call chain.\n * Useful for helpers that support both HTTP requests and standalone CLI runs.\n */\nexport function hasRequestContext(): boolean {\n  return als.getStore() !== undefined;\n}\n\n/**\n * Get the current request's user email.\n *\n * - If a request context exists (HTTP/A2A path), returns its `userEmail` —\n *   even when that value is `undefined`. The env fallback MUST NOT fire here:\n *   a stale process-wide `AGENT_USER_EMAIL` from a CLI run or previous bug\n *   would leak into an unauthenticated A2A/API call (e.g. unsigned or API-key\n *   modes where `runWithRequestContext({ userEmail: undefined })` is used).\n * - Only when there is NO request context (CLI scripts) do we fall back to\n *   `process.env.AGENT_USER_EMAIL`.\n */\nexport function getRequestUserEmail(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.userEmail) markAuthContextAccess(store);\n    return store.userEmail;\n  }\n  return process.env.AGENT_USER_EMAIL;\n}\n\n/**\n * Get the current request's display name, when the auth provider supplied one.\n *\n * The same request-context fallback rules as `getRequestUserEmail()` apply:\n * HTTP/A2A calls only read AsyncLocalStorage, while CLI scripts may opt in via\n * `AGENT_USER_NAME`.\n */\nexport function getRequestUserName(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.userName) markAuthContextAccess(store);\n    return store.userName;\n  }\n  return process.env.AGENT_USER_NAME;\n}\n\n/**\n * Get the current request's org ID.\n *\n * Same store-aware semantics as `getRequestUserEmail()` — env fallback is\n * CLI-only, so a request that explicitly has no org doesn't inherit a stale\n * `process.env.AGENT_ORG_ID` from a prior request on the same Lambda instance.\n */\nexport function getRequestOrgId(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.orgId) markAuthContextAccess(store);\n    return store.orgId;\n  }\n  return process.env.AGENT_ORG_ID;\n}\n\nfunction markAuthContextAccess(ctx: RequestContext | undefined) {\n  if (!ctx) return;\n  if (ctx.userEmail || ctx.userName || ctx.orgId) {\n    ctx.authContextAccessed = true;\n  }\n}\n\nexport function hasAuthContextAccess(ctx: RequestContext | undefined): boolean {\n  return Boolean(ctx?.authContextAccessed);\n}\n\n/**\n * Get the current request's IANA timezone (e.g. \"America/Los_Angeles\").\n * The UI sends this via the `x-user-timezone` header on every action call, and\n * the agent chat plugin propagates it into the request context so that\n * agent-initiated tool calls also see the user's timezone. Falls back to\n * `process.env.AGENT_USER_TIMEZONE` only for CLI scripts (no request context).\n */\nexport function getRequestTimezone(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) return store.timezone;\n  return process.env.AGENT_USER_TIMEZONE;\n}\n\n/**\n * Returns true when this request is on an integration-platform path (Slack,\n * Telegram, etc.) — i.e. we're inside the integration plugin's processor\n * function and the platform's deliver-by deadline plus the host's function\n * timeout are the binding budget. Non-integration callers (CLI, normal\n * agent chat) should treat this as `false`.\n */\nexport function isIntegrationCallerRequest(): boolean {\n  return als.getStore()?.isIntegrationCaller === true;\n}\n\nexport function getIntegrationRequestContext():\n  | NonNullable<RequestContext[\"integration\"]>\n  | undefined {\n  return als.getStore()?.integration;\n}\n\n/**\n * Convenience: returns `{ userEmail, orgId }` from the active request context,\n * suitable for passing to `resolveCredential(key, ctx)`. Returns `null` when\n * no user is associated with the call (e.g. an unauthenticated public route).\n *\n * For framework actions auto-mounted at `/_agent-native/actions/...` this is\n * always populated because action-routes wraps every invocation in\n * `runWithRequestContext`. For hand-written `/api/*` routes the calling code\n * is responsible for setting up the context (see `runWithRequestContext`).\n */\nexport function getCredentialContext(): {\n  userEmail: string;\n  orgId: string | null;\n} | null {\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) return null;\n  return { userEmail, orgId: getRequestOrgId() ?? null };\n}\n\n/**\n * Get the active request's mutable agent-run state. Returns `undefined` when\n * called outside an agent run (e.g. before `prepareRun` or in a non-agent\n * code path). Callers must tolerate the field absence; use the helper\n * `requireRequestRunContext()` if missing context is a programming error.\n */\nexport function getRequestRunContext(): RequestRunContext | undefined {\n  const store = als.getStore();\n  if (!store) return undefined;\n  return store.run;\n}\n\n/**\n * Ensure a `RequestRunContext` exists on the active request store and\n * return it. Used by the agent-chat handler to attach run state once it\n * starts processing a chat request. Returns `undefined` if there is no\n * active request store (caller should not be invoking this outside ALS).\n */\nexport function ensureRequestRunContext(): RequestRunContext | undefined {\n  const store = als.getStore();\n  if (!store) return undefined;\n  if (!store.run) store.run = {};\n  return store.run;\n}\n"]}
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,MAAM,sBAAsB;IACT,KAAK,GAAQ,EAAE,CAAC;IAEjC,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,GAAG,CAAI,KAAQ,EAAE,QAAiB;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,MAER,CAAC;YACd,IAAI,YAAY,IAAI,OAAO,YAAY,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC/D,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBACnB,CAAC,CAAM,CAAC;YACV,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB;IAC/B,IACE,OAAO,MAAM,KAAK,WAAW;QAC7B,OAAO,OAAO,KAAK,WAAW;QAC9B,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI;QACvB,OAAO,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,iBAExC,CAAC;AAChB,CAAC;AAED,MAAM,qBAAqB,GAAG,wBAAwB,EAAE,CAAC;AAEzD,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AA+FD,MAAM,UAAU,GAAG,gCAAyC,CAAC;AAC7D,MAAM,aAAa,GAAG,sCAA+C,CAAC;AAMtE,MAAM,SAAS,GAAG,UAAsC,CAAC;AACzD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;IAC3B,SAAS,CAAC,UAAU,CAAC,GAAG,qBAAqB;QAC3C,CAAC,CAAC,IAAI,qBAAqB,EAAkB;QAC7C,CAAC,CAAC,IAAI,sBAAsB,EAAkB,CAAC;AACnD,CAAC;AACD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9B,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;AAChC,CAAC;AACD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAE,CAAC;AACnC,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAE,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgC;IAEhC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAmB,EACnB,EAAwB;IAExB,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;QACvB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,GAAG,CAAC,GAAG,CAAC,CAAC;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACP,+CAA+C;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,UAAU,CAAC,kBAAkB,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,QAAQ;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,OAAO,UAAU,CAAC,iBAAiB,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,KAAK;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA+B;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC/C,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAA+B;IAClE,OAAO,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IAC/C,OAAO,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,mBAAmB,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,4BAA4B;IAG1C,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB;IAIlC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;IAC/B,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC","sourcesContent":["/**\n * Per-request context using AsyncLocalStorage.\n *\n * Replaces the unsafe pattern of mutating `process.env.AGENT_USER_EMAIL` /\n * `process.env.AGENT_ORG_ID` on every request. On Node.js (Netlify, self-hosted)\n * concurrent requests would overwrite each other's env vars. AsyncLocalStorage\n * gives each async call-chain its own isolated context.\n *\n * Supported on all deployment targets:\n * - Node.js (native)\n * - Cloudflare Workers (via nodejs_compat flag)\n * - Deno Deploy (via node:async_hooks compat)\n *\n * For CLI scripts that run outside a request context, the getters fall back to\n * process.env so existing `AGENT_USER_EMAIL=x pnpm action foo` invocations\n * continue to work.\n */\n\ntype AsyncLocalStorageLike<T> = {\n  getStore(): T | undefined;\n  run<R>(store: T, callback: () => R): R;\n};\n\ntype AsyncLocalStorageCtor = new <T>() => AsyncLocalStorageLike<T>;\n\nclass StackAsyncLocalStorage<T> implements AsyncLocalStorageLike<T> {\n  private readonly stack: T[] = [];\n\n  getStore(): T | undefined {\n    return this.stack.at(-1);\n  }\n\n  run<R>(store: T, callback: () => R): R {\n    this.stack.push(store);\n    try {\n      const result = callback();\n      const maybePromise = result as unknown as\n        | { finally?: (callback: () => void) => unknown }\n        | undefined;\n      if (maybePromise && typeof maybePromise.finally === \"function\") {\n        return maybePromise.finally(() => {\n          this.stack.pop();\n        }) as R;\n      }\n      this.stack.pop();\n      return result;\n    } catch (error) {\n      this.stack.pop();\n      throw error;\n    }\n  }\n}\n\nfunction getAsyncLocalStorageCtor(): AsyncLocalStorageCtor | undefined {\n  if (\n    typeof window !== \"undefined\" ||\n    typeof process === \"undefined\" ||\n    !process.versions?.node ||\n    typeof process.getBuiltinModule !== \"function\"\n  ) {\n    return undefined;\n  }\n  return process.getBuiltinModule(\"node:async_hooks\")?.AsyncLocalStorage as\n    | AsyncLocalStorageCtor\n    | undefined;\n}\n\nconst AsyncLocalStorageCtor = getAsyncLocalStorageCtor();\n\nfunction processEnv(name: string): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return process.env?.[name];\n}\n\n/**\n * Per-request agent-run state. Lives on `RequestContext.run` so the\n * agent-chat plugin can populate fields as the run progresses (owner,\n * resolved API key, system prompt, engine, model, threadId) without\n * mutating module-scope `let` bindings — those leak across concurrent\n * requests on a single Node.js process.\n *\n * Mutated in-place by `prepareRun`, `onEngineResolved`, `onRunStart` so\n * tool factory closures (automation, fetch, team, builder-browser) read\n * the live per-request value via `getRequestRunContext()`.\n */\nexport interface RequestRunContext {\n  /** Origin of the current request (used by the builder-browser tool). */\n  requestOrigin?: string;\n  /** Stable browser tab id for tab-scoped app-state reads/writes. */\n  browserTabId?: string;\n  /** Resource scope for the current chat thread, e.g. the active deck. */\n  chatScope?: {\n    type: string;\n    id: string;\n    label?: string;\n  } | null;\n  /** Resolved owner email (set by prepareRun). */\n  owner?: string;\n  /** Owner's active Anthropic API key (set by prepareRun). */\n  userApiKey?: string;\n  /** Thread ID for the current run (set by onRunStart). */\n  threadId?: string;\n  /** System prompt actually sent to the model for this run. */\n  systemPrompt?: string;\n  /** Engine instance for this run (set by onEngineResolved). */\n  engine?: import(\"../agent/engine/types.js\").AgentEngine;\n  /** Model name for this run (set by onEngineResolved). */\n  model?: string;\n  /**\n   * True when this run is executing inside the durable background-function\n   * worker (the `_process-run` self-dispatch), not the synchronous foreground\n   * request. Template `extraContext` / system-prompt builders can read this to\n   * skip heavy, hang-prone enrichment (large data-dictionary DB reads, etc.)\n   * in the worker so it reliably claims its run within the setup budget.\n   */\n  isBackgroundWorker?: boolean;\n  /** Tool calls made so far in the current agent loop. */\n  toolCalls?: Array<{ name: string; input: unknown }>;\n  /** Tool results returned so far in the current agent loop. */\n  toolResults?: Array<{ name: string; content: string; isError: boolean }>;\n}\n\nexport interface RequestContext {\n  userEmail?: string;\n  userName?: string;\n  orgId?: string;\n  timezone?: string;\n  /**\n   * Set when code reads authenticated request context. Public SSR shell/data\n   * should not depend on this value; user/org-specific reads belong behind\n   * client-side actions/API after hydration.\n   */\n  authContextAccessed?: boolean;\n  /**\n   * Origin of the inbound request (e.g. `http://127.0.0.1:8100`). Set by the\n   * MCP mount from the request headers so actions that build externally\n   * fetchable URLs (e.g. design `export-coding-handoff`'s signed raw-code URL)\n   * resolve the real local-workspace origin instead of a prod/localhost\n   * fallback. Optional — absent on paths that don't populate it.\n   */\n  requestOrigin?: string;\n  /**\n   * True when this request is being processed by an integration-platform\n   * webhook (Slack, Telegram, etc.) where the function timeout is the\n   * binding constraint. Code that calls slow remote APIs can use this to apply\n   * tighter budgets on this path while leaving normal agent-chat callers\n   * (5+ min budget) unaffected.\n   */\n  isIntegrationCaller?: boolean;\n  /**\n   * Metadata for the currently-processing integration task. This lets tools\n   * that start long-running remote work persist a continuation that can update\n   * the originating platform thread after the current function budget ends.\n   */\n  integration?: {\n    taskId: string;\n    attempts?: number;\n    incoming: import(\"../integrations/types.js\").IncomingMessage;\n    placeholderRef?: string;\n  };\n  /**\n   * Mutable per-request agent-run state. Populated by the agent-chat plugin\n   * during a run; tool closures dereference it on each invocation.\n   */\n  run?: RequestRunContext;\n}\n\nconst GLOBAL_KEY = \"__agentNativeRequestContextAls\" as const;\nconst OBSERVERS_KEY = \"__agentNativeRequestContextObservers\" as const;\ntype RequestContextObserver = (ctx: RequestContext) => void;\ntype GlobalWithRequestContext = typeof globalThis & {\n  [GLOBAL_KEY]?: AsyncLocalStorageLike<RequestContext>;\n  [OBSERVERS_KEY]?: RequestContextObserver[];\n};\nconst globalRef = globalThis as GlobalWithRequestContext;\nif (!globalRef[GLOBAL_KEY]) {\n  globalRef[GLOBAL_KEY] = AsyncLocalStorageCtor\n    ? new AsyncLocalStorageCtor<RequestContext>()\n    : new StackAsyncLocalStorage<RequestContext>();\n}\nif (!globalRef[OBSERVERS_KEY]) {\n  globalRef[OBSERVERS_KEY] = [];\n}\nconst als = globalRef[GLOBAL_KEY]!;\nconst observers = globalRef[OBSERVERS_KEY]!;\n\n/**\n * Register a callback fired every time `runWithRequestContext` enters a new\n * scope. The hook runs INSIDE the AsyncLocalStorage scope, so observability\n * helpers that read the current isolation scope (e.g. Sentry) attach to the\n * right per-request context.\n *\n * Returned function unregisters the observer. Observers must never throw —\n * any error is swallowed so a misbehaving observer can't break the request\n * path.\n */\nexport function addRequestContextObserver(\n  observer: RequestContextObserver,\n): () => void {\n  observers.push(observer);\n  return () => {\n    const i = observers.indexOf(observer);\n    if (i !== -1) observers.splice(i, 1);\n  };\n}\n\n/**\n * Run a callback within a per-request context. The context is available to all\n * async operations spawned from `fn` via `getRequestUserEmail()` / `getRequestOrgId()`.\n *\n * Any registered `addRequestContextObserver` callbacks fire inside the new\n * scope before `fn` runs, so observability code can pin user/org info onto\n * isolation-scoped backends (Sentry, OpenTelemetry, etc.).\n */\nexport function runWithRequestContext<T>(\n  ctx: RequestContext,\n  fn: () => T | Promise<T>,\n): T | Promise<T> {\n  return als.run(ctx, () => {\n    if (observers.length > 0) {\n      for (const obs of observers) {\n        try {\n          obs(ctx);\n        } catch {\n          // Observers must never break the request path.\n        }\n      }\n    }\n    return fn();\n  });\n}\n\n/**\n * Return the active request context, if this call chain is running under one.\n *\n * This is intentionally distinct from `getRequestUserEmail()`: callers that\n * have an active context with no authenticated user must not fall through to\n * process-wide CLI fallbacks such as `AGENT_USER_EMAIL` or \"latest session\".\n */\nexport function getRequestContext(): RequestContext | undefined {\n  const store = als.getStore();\n  markAuthContextAccess(store);\n  return store;\n}\n\n/**\n * True when AsyncLocalStorage has an active context for this call chain.\n * Useful for helpers that support both HTTP requests and standalone CLI runs.\n */\nexport function hasRequestContext(): boolean {\n  return als.getStore() !== undefined;\n}\n\n/**\n * Get the current request's user email.\n *\n * - If a request context exists (HTTP/A2A path), returns its `userEmail` —\n *   even when that value is `undefined`. The env fallback MUST NOT fire here:\n *   a stale process-wide `AGENT_USER_EMAIL` from a CLI run or previous bug\n *   would leak into an unauthenticated A2A/API call (e.g. unsigned or API-key\n *   modes where `runWithRequestContext({ userEmail: undefined })` is used).\n * - Only when there is NO request context (CLI scripts) do we fall back to\n *   `process.env.AGENT_USER_EMAIL`.\n */\nexport function getRequestUserEmail(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.userEmail) markAuthContextAccess(store);\n    return store.userEmail;\n  }\n  return processEnv(\"AGENT_USER_EMAIL\");\n}\n\n/**\n * Get the current request's display name, when the auth provider supplied one.\n *\n * The same request-context fallback rules as `getRequestUserEmail()` apply:\n * HTTP/A2A calls only read AsyncLocalStorage, while CLI scripts may opt in via\n * `AGENT_USER_NAME`.\n */\nexport function getRequestUserName(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.userName) markAuthContextAccess(store);\n    return store.userName;\n  }\n  return processEnv(\"AGENT_USER_NAME\");\n}\n\n/**\n * Get the current request's org ID.\n *\n * Same store-aware semantics as `getRequestUserEmail()` — env fallback is\n * CLI-only, so a request that explicitly has no org doesn't inherit a stale\n * `process.env.AGENT_ORG_ID` from a prior request on the same Lambda instance.\n */\nexport function getRequestOrgId(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.orgId) markAuthContextAccess(store);\n    return store.orgId;\n  }\n  return processEnv(\"AGENT_ORG_ID\");\n}\n\nfunction markAuthContextAccess(ctx: RequestContext | undefined) {\n  if (!ctx) return;\n  if (ctx.userEmail || ctx.userName || ctx.orgId) {\n    ctx.authContextAccessed = true;\n  }\n}\n\nexport function hasAuthContextAccess(ctx: RequestContext | undefined): boolean {\n  return Boolean(ctx?.authContextAccessed);\n}\n\n/**\n * Get the current request's IANA timezone (e.g. \"America/Los_Angeles\").\n * The UI sends this via the `x-user-timezone` header on every action call, and\n * the agent chat plugin propagates it into the request context so that\n * agent-initiated tool calls also see the user's timezone. Falls back to\n * `process.env.AGENT_USER_TIMEZONE` only for CLI scripts (no request context).\n */\nexport function getRequestTimezone(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) return store.timezone;\n  return processEnv(\"AGENT_USER_TIMEZONE\");\n}\n\n/**\n * Returns true when this request is on an integration-platform path (Slack,\n * Telegram, etc.) — i.e. we're inside the integration plugin's processor\n * function and the platform's deliver-by deadline plus the host's function\n * timeout are the binding budget. Non-integration callers (CLI, normal\n * agent chat) should treat this as `false`.\n */\nexport function isIntegrationCallerRequest(): boolean {\n  return als.getStore()?.isIntegrationCaller === true;\n}\n\nexport function getIntegrationRequestContext():\n  | NonNullable<RequestContext[\"integration\"]>\n  | undefined {\n  return als.getStore()?.integration;\n}\n\n/**\n * Convenience: returns `{ userEmail, orgId }` from the active request context,\n * suitable for passing to `resolveCredential(key, ctx)`. Returns `null` when\n * no user is associated with the call (e.g. an unauthenticated public route).\n *\n * For framework actions auto-mounted at `/_agent-native/actions/...` this is\n * always populated because action-routes wraps every invocation in\n * `runWithRequestContext`. For hand-written `/api/*` routes the calling code\n * is responsible for setting up the context (see `runWithRequestContext`).\n */\nexport function getCredentialContext(): {\n  userEmail: string;\n  orgId: string | null;\n} | null {\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) return null;\n  return { userEmail, orgId: getRequestOrgId() ?? null };\n}\n\n/**\n * Get the active request's mutable agent-run state. Returns `undefined` when\n * called outside an agent run (e.g. before `prepareRun` or in a non-agent\n * code path). Callers must tolerate the field absence; use the helper\n * `requireRequestRunContext()` if missing context is a programming error.\n */\nexport function getRequestRunContext(): RequestRunContext | undefined {\n  const store = als.getStore();\n  if (!store) return undefined;\n  return store.run;\n}\n\n/**\n * Ensure a `RequestRunContext` exists on the active request store and\n * return it. Used by the agent-chat handler to attach run state once it\n * starts processing a chat request. Returns `undefined` if there is no\n * active request store (caller should not be invoking this outside ALS).\n */\nexport function ensureRequestRunContext(): RequestRunContext | undefined {\n  const store = als.getStore();\n  if (!store) return undefined;\n  if (!store.run) store.run = {};\n  return store.run;\n}\n"]}

package/dist/shared/agent-access.d.ts

@@ -0,0 +1,29 @@
+export declare const AGENT_ACCESS_PARAM = "agent_access";
+export declare const DEFAULT_AGENT_ACCESS_TTL_SECONDS: number;
+export interface AgentAccessResourceScope {
+    resourceKind: string;
+    resourceId: string;
+}
+export interface AgentAccessUrlOptions {
+    origin?: string;
+    basePath?: string;
+    tokenParam?: string;
+}
+export interface AgentAccessApiUrlOptions extends AgentAccessUrlOptions {
+    endpoint: string;
+    resourceId: string;
+    idParam?: string;
+    token?: string | null;
+    extraParams?: Array<[string, string | number | boolean | null | undefined]>;
+}
+export declare function scopedAgentAccessResourceId(resourceKind: string, resourceId: string): string;
+export declare function normalizeAgentAccessBasePath(basePath?: string): string;
+export declare function normalizeAgentAccessOrigin(origin?: string): string;
+export declare function toAgentAccessUrl(pathOrUrl: string, options?: Pick<AgentAccessUrlOptions, "origin" | "basePath">): string;
+export declare function appendAgentAccessParam(urlOrPath: string, token: string, param?: string): string;
+export declare function buildAgentAccessUrl({ path, token, origin, basePath, tokenParam, }: AgentAccessUrlOptions & {
+    path: string;
+    token: string;
+}): string;
+export declare function buildAgentAccessApiUrl({ endpoint, resourceId, idParam, token, tokenParam, extraParams, origin, basePath, }: AgentAccessApiUrlOptions): string;
+//# sourceMappingURL=agent-access.d.ts.map

package/dist/shared/agent-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access.d.ts","sourceRoot":"","sources":["../../src/shared/agent-access.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AACjD,eAAO,MAAM,gCAAgC,QAAc,CAAC;AAE5D,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAyB,SAAQ,qBAAqB;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC;CAC7E;AAQD,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAMD,wBAAgB,4BAA4B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAGtE;AAED,wBAAgB,0BAA0B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAGlE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,UAAU,CAAM,GAC/D,MAAM,CAIR;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,SAAqB,GACzB,MAAM,CAMR;AAED,wBAAgB,mBAAmB,CAAC,EAClC,IAAI,EACJ,KAAK,EACL,MAAM,EACN,QAAQ,EACR,UAA+B,GAChC,EAAE,qBAAqB,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAMT;AAED,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,UAAU,EACV,OAAc,EACd,KAAK,EACL,UAA+B,EAC/B,WAAW,EACX,MAAM,EACN,QAAQ,GACT,EAAE,wBAAwB,GAAG,MAAM,CAWnC"}

package/dist/shared/agent-access.js

@@ -0,0 +1,57 @@
+export const AGENT_ACCESS_PARAM = "agent_access";
+export const DEFAULT_AGENT_ACCESS_TTL_SECONDS = 2 * 60 * 60;
+function normalizeResourcePart(value, label) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        throw new Error(`${label} is required`);
+    return trimmed;
+}
+export function scopedAgentAccessResourceId(resourceKind, resourceId) {
+    return `${normalizeResourcePart(resourceKind, "resourceKind")}:${normalizeResourcePart(resourceId, "resourceId")}`;
+}
+function trimSlashes(value) {
+    return value.replace(/^\/+|\/+$/g, "");
+}
+export function normalizeAgentAccessBasePath(basePath) {
+    const trimmed = trimSlashes(basePath ?? "");
+    return trimmed ? `/${trimmed}` : "";
+}
+export function normalizeAgentAccessOrigin(origin) {
+    if (!origin)
+        return "";
+    return origin.replace(/\/+$/g, "");
+}
+function isAbsoluteUrl(value) {
+    return /^[a-z][a-z0-9+.-]*:\/\//i.test(value);
+}
+export function toAgentAccessUrl(pathOrUrl, options = {}) {
+    if (isAbsoluteUrl(pathOrUrl))
+        return pathOrUrl;
+    const path = pathOrUrl.startsWith("/") ? pathOrUrl : `/${pathOrUrl}`;
+    return `${normalizeAgentAccessOrigin(options.origin)}${normalizeAgentAccessBasePath(options.basePath)}${path}`;
+}
+export function appendAgentAccessParam(urlOrPath, token, param = AGENT_ACCESS_PARAM) {
+    const hashIndex = urlOrPath.indexOf("#");
+    const base = hashIndex >= 0 ? urlOrPath.slice(0, hashIndex) : urlOrPath;
+    const hash = hashIndex >= 0 ? urlOrPath.slice(hashIndex) : "";
+    const sep = base.includes("?") ? "&" : "?";
+    return `${base}${sep}${encodeURIComponent(param)}=${encodeURIComponent(token)}${hash}`;
+}
+export function buildAgentAccessUrl({ path, token, origin, basePath, tokenParam = AGENT_ACCESS_PARAM, }) {
+    return appendAgentAccessParam(toAgentAccessUrl(path, { origin, basePath }), token, tokenParam);
+}
+export function buildAgentAccessApiUrl({ endpoint, resourceId, idParam = "id", token, tokenParam = AGENT_ACCESS_PARAM, extraParams, origin, basePath, }) {
+    const params = new URLSearchParams({ [idParam]: resourceId });
+    if (token)
+        params.set(tokenParam, token);
+    for (const [key, value] of extraParams ?? []) {
+        if (value === undefined || value === null || value === "")
+            continue;
+        params.set(key, String(value));
+    }
+    return toAgentAccessUrl(`${endpoint}?${params.toString()}`, {
+        origin,
+        basePath,
+    });
+}
+//# sourceMappingURL=agent-access.js.map

package/dist/shared/agent-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access.js","sourceRoot":"","sources":["../../src/shared/agent-access.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AACjD,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAqB5D,SAAS,qBAAqB,CAAC,KAAa,EAAE,KAAa;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,YAAoB,EACpB,UAAkB;IAElB,OAAO,GAAG,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;AACrH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAAiB;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAe;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,OAAO,GAAuD,EAAE;IAEhE,IAAI,aAAa,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;IACrE,OAAO,GAAG,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;AACjH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,KAAa,EACb,KAAK,GAAG,kBAAkB;IAE1B,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,OAAO,GAAG,IAAI,GAAG,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,IAAI,EACJ,KAAK,EACL,MAAM,EACN,QAAQ,EACR,UAAU,GAAG,kBAAkB,GAIhC;IACC,OAAO,sBAAsB,CAC3B,gBAAgB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAC5C,KAAK,EACL,UAAU,CACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,QAAQ,EACR,UAAU,EACV,OAAO,GAAG,IAAI,EACd,KAAK,EACL,UAAU,GAAG,kBAAkB,EAC/B,WAAW,EACX,MAAM,EACN,QAAQ,GACiB;IACzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9D,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,SAAS;QACpE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE;QAC1D,MAAM;QACN,QAAQ;KACT,CAAC,CAAC;AACL,CAAC","sourcesContent":["export const AGENT_ACCESS_PARAM = \"agent_access\";\nexport const DEFAULT_AGENT_ACCESS_TTL_SECONDS = 2 * 60 * 60;\n\nexport interface AgentAccessResourceScope {\n  resourceKind: string;\n  resourceId: string;\n}\n\nexport interface AgentAccessUrlOptions {\n  origin?: string;\n  basePath?: string;\n  tokenParam?: string;\n}\n\nexport interface AgentAccessApiUrlOptions extends AgentAccessUrlOptions {\n  endpoint: string;\n  resourceId: string;\n  idParam?: string;\n  token?: string | null;\n  extraParams?: Array<[string, string | number | boolean | null | undefined]>;\n}\n\nfunction normalizeResourcePart(value: string, label: string): string {\n  const trimmed = value.trim();\n  if (!trimmed) throw new Error(`${label} is required`);\n  return trimmed;\n}\n\nexport function scopedAgentAccessResourceId(\n  resourceKind: string,\n  resourceId: string,\n): string {\n  return `${normalizeResourcePart(resourceKind, \"resourceKind\")}:${normalizeResourcePart(resourceId, \"resourceId\")}`;\n}\n\nfunction trimSlashes(value: string): string {\n  return value.replace(/^\\/+|\\/+$/g, \"\");\n}\n\nexport function normalizeAgentAccessBasePath(basePath?: string): string {\n  const trimmed = trimSlashes(basePath ?? \"\");\n  return trimmed ? `/${trimmed}` : \"\";\n}\n\nexport function normalizeAgentAccessOrigin(origin?: string): string {\n  if (!origin) return \"\";\n  return origin.replace(/\\/+$/g, \"\");\n}\n\nfunction isAbsoluteUrl(value: string): boolean {\n  return /^[a-z][a-z0-9+.-]*:\\/\\//i.test(value);\n}\n\nexport function toAgentAccessUrl(\n  pathOrUrl: string,\n  options: Pick<AgentAccessUrlOptions, \"origin\" | \"basePath\"> = {},\n): string {\n  if (isAbsoluteUrl(pathOrUrl)) return pathOrUrl;\n  const path = pathOrUrl.startsWith(\"/\") ? pathOrUrl : `/${pathOrUrl}`;\n  return `${normalizeAgentAccessOrigin(options.origin)}${normalizeAgentAccessBasePath(options.basePath)}${path}`;\n}\n\nexport function appendAgentAccessParam(\n  urlOrPath: string,\n  token: string,\n  param = AGENT_ACCESS_PARAM,\n): string {\n  const hashIndex = urlOrPath.indexOf(\"#\");\n  const base = hashIndex >= 0 ? urlOrPath.slice(0, hashIndex) : urlOrPath;\n  const hash = hashIndex >= 0 ? urlOrPath.slice(hashIndex) : \"\";\n  const sep = base.includes(\"?\") ? \"&\" : \"?\";\n  return `${base}${sep}${encodeURIComponent(param)}=${encodeURIComponent(token)}${hash}`;\n}\n\nexport function buildAgentAccessUrl({\n  path,\n  token,\n  origin,\n  basePath,\n  tokenParam = AGENT_ACCESS_PARAM,\n}: AgentAccessUrlOptions & {\n  path: string;\n  token: string;\n}): string {\n  return appendAgentAccessParam(\n    toAgentAccessUrl(path, { origin, basePath }),\n    token,\n    tokenParam,\n  );\n}\n\nexport function buildAgentAccessApiUrl({\n  endpoint,\n  resourceId,\n  idParam = \"id\",\n  token,\n  tokenParam = AGENT_ACCESS_PARAM,\n  extraParams,\n  origin,\n  basePath,\n}: AgentAccessApiUrlOptions): string {\n  const params = new URLSearchParams({ [idParam]: resourceId });\n  if (token) params.set(tokenParam, token);\n  for (const [key, value] of extraParams ?? []) {\n    if (value === undefined || value === null || value === \"\") continue;\n    params.set(key, String(value));\n  }\n  return toAgentAccessUrl(`${endpoint}?${params.toString()}`, {\n    origin,\n    basePath,\n  });\n}\n"]}

package/dist/shared/index.d.ts

@@ -8,4 +8,5 @@ export { DEFAULT_WORKSPACE_APP_AUDIENCE, WORKSPACE_APP_AUDIENCES, normalizeWorks
 export { AGENT_NATIVE_OPEN_PATH, AGENT_SIDEBAR_QUERY_PARAM, AGENT_SIDEBAR_QUERY_VALUE_CLOSED, isAgentNativeOpenDeepLink, withCollapsedAgentSidebarParam, } from "./agent-sidebar-url.js";
 export { AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE, AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER, AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, defaultSocialImageMeta, withAgentNativeSocialImageCacheBuster, withDefaultSocialImage, type SocialMetaDescriptor, } from "./social-meta.js";
 export { EMBED_MODE_QUERY_PARAM, EMBED_SESSION_COOKIE, EMBED_START_PATH, EMBED_TOKEN_QUERY_PARAM, } from "./embed-auth.js";
+export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, toAgentAccessUrl, type AgentAccessApiUrlOptions, type AgentAccessResourceScope, type AgentAccessUrlOptions, } from "./agent-access.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,mCAAmC,EACnC,8BAA8B,EAC9B,sCAAsC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,iCAAiC,EACtC,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iCAAiC,EACjC,sCAAsC,EACtC,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,sBAAsB,EACtB,qCAAqC,EACrC,sBAAsB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,mCAAmC,EACnC,8BAA8B,EAC9B,sCAAsC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,iCAAiC,EACtC,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iCAAiC,EACjC,sCAAsC,EACtC,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,sBAAsB,EACtB,qCAAqC,EACrC,sBAAsB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC"}

package/dist/shared/index.js

@@ -8,4 +8,5 @@ export { DEFAULT_WORKSPACE_APP_AUDIENCE, WORKSPACE_APP_AUDIENCES, normalizeWorks
 export { AGENT_NATIVE_OPEN_PATH, AGENT_SIDEBAR_QUERY_PARAM, AGENT_SIDEBAR_QUERY_VALUE_CLOSED, isAgentNativeOpenDeepLink, withCollapsedAgentSidebarParam, } from "./agent-sidebar-url.js";
 export { AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE, AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER, AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, defaultSocialImageMeta, withAgentNativeSocialImageCacheBuster, withDefaultSocialImage, } from "./social-meta.js";
 export { EMBED_MODE_QUERY_PARAM, EMBED_SESSION_COOKIE, EMBED_START_PATH, EMBED_TOKEN_QUERY_PARAM, } from "./embed-auth.js";
+export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, toAgentAccessUrl, } from "./agent-access.js";
 //# sourceMappingURL=index.js.map

package/dist/shared/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,GAIV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAe,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,mCAAmC,EACnC,8BAA8B,EAC9B,sCAAsC,GAIvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iCAAiC,EACjC,sCAAsC,EACtC,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,sBAAsB,EACtB,qCAAqC,EACrC,sBAAsB,GAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC","sourcesContent":["export {\n  agentChat,\n  type AgentChatMessage,\n  type AgentChatCallOptions,\n  type AgentChatResponse,\n} from \"./agent-chat.js\";\nexport { agentEnv, type EnvVar } from \"./agent-env.js\";\nexport { extractOAuthStateAppId } from \"./oauth-state.js\";\nexport { truncate } from \"./truncate.js\";\nexport {\n  llmConnectionTrackingProperties,\n  normalizeLlmConnection,\n  type LlmConnectionStatus,\n} from \"./llm-connection.js\";\nexport {\n  DISPATCH_WORKSPACE_ROOT_REDIRECTS,\n  RESERVED_WORKSPACE_APP_IDS,\n  assertValidWorkspaceAppId,\n  getWorkspaceAppIdValidationError,\n  isValidWorkspaceAppIdFormat,\n} from \"./workspace-app-id.js\";\nexport {\n  DEFAULT_WORKSPACE_APP_AUDIENCE,\n  WORKSPACE_APP_AUDIENCES,\n  normalizeWorkspaceAppAudience,\n  normalizeWorkspaceAppPathList,\n  workspaceAppAudienceFromEnv,\n  workspaceAppAudienceFromPackageJson,\n  workspaceAppRouteAccessFromEnv,\n  workspaceAppRouteAccessFromPackageJson,\n  type WorkspaceAppRouteAccess,\n  type WorkspaceAppRouteAccessFromConfig,\n  type WorkspaceAppAudience,\n} from \"./workspace-app-audience.js\";\nexport {\n  AGENT_NATIVE_OPEN_PATH,\n  AGENT_SIDEBAR_QUERY_PARAM,\n  AGENT_SIDEBAR_QUERY_VALUE_CLOSED,\n  isAgentNativeOpenDeepLink,\n  withCollapsedAgentSidebarParam,\n} from \"./agent-sidebar-url.js\";\nexport {\n  AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE,\n  AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER,\n  AGENT_NATIVE_SOCIAL_IMAGE_ALT,\n  AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,\n  AGENT_NATIVE_SOCIAL_IMAGE_PATH,\n  AGENT_NATIVE_SOCIAL_IMAGE_TYPE,\n  AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,\n  defaultSocialImageMeta,\n  withAgentNativeSocialImageCacheBuster,\n  withDefaultSocialImage,\n  type SocialMetaDescriptor,\n} from \"./social-meta.js\";\nexport {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_SESSION_COOKIE,\n  EMBED_START_PATH,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"./embed-auth.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,GAIV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAe,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,mCAAmC,EACnC,8BAA8B,EAC9B,sCAAsC,GAIvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iCAAiC,EACjC,sCAAsC,EACtC,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,sBAAsB,EACtB,qCAAqC,EACrC,sBAAsB,GAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAIjB,MAAM,mBAAmB,CAAC","sourcesContent":["export {\n  agentChat,\n  type AgentChatMessage,\n  type AgentChatCallOptions,\n  type AgentChatResponse,\n} from \"./agent-chat.js\";\nexport { agentEnv, type EnvVar } from \"./agent-env.js\";\nexport { extractOAuthStateAppId } from \"./oauth-state.js\";\nexport { truncate } from \"./truncate.js\";\nexport {\n  llmConnectionTrackingProperties,\n  normalizeLlmConnection,\n  type LlmConnectionStatus,\n} from \"./llm-connection.js\";\nexport {\n  DISPATCH_WORKSPACE_ROOT_REDIRECTS,\n  RESERVED_WORKSPACE_APP_IDS,\n  assertValidWorkspaceAppId,\n  getWorkspaceAppIdValidationError,\n  isValidWorkspaceAppIdFormat,\n} from \"./workspace-app-id.js\";\nexport {\n  DEFAULT_WORKSPACE_APP_AUDIENCE,\n  WORKSPACE_APP_AUDIENCES,\n  normalizeWorkspaceAppAudience,\n  normalizeWorkspaceAppPathList,\n  workspaceAppAudienceFromEnv,\n  workspaceAppAudienceFromPackageJson,\n  workspaceAppRouteAccessFromEnv,\n  workspaceAppRouteAccessFromPackageJson,\n  type WorkspaceAppRouteAccess,\n  type WorkspaceAppRouteAccessFromConfig,\n  type WorkspaceAppAudience,\n} from \"./workspace-app-audience.js\";\nexport {\n  AGENT_NATIVE_OPEN_PATH,\n  AGENT_SIDEBAR_QUERY_PARAM,\n  AGENT_SIDEBAR_QUERY_VALUE_CLOSED,\n  isAgentNativeOpenDeepLink,\n  withCollapsedAgentSidebarParam,\n} from \"./agent-sidebar-url.js\";\nexport {\n  AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE,\n  AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER,\n  AGENT_NATIVE_SOCIAL_IMAGE_ALT,\n  AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,\n  AGENT_NATIVE_SOCIAL_IMAGE_PATH,\n  AGENT_NATIVE_SOCIAL_IMAGE_TYPE,\n  AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,\n  defaultSocialImageMeta,\n  withAgentNativeSocialImageCacheBuster,\n  withDefaultSocialImage,\n  type SocialMetaDescriptor,\n} from \"./social-meta.js\";\nexport {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_SESSION_COOKIE,\n  EMBED_START_PATH,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"./embed-auth.js\";\nexport {\n  AGENT_ACCESS_PARAM,\n  DEFAULT_AGENT_ACCESS_TTL_SECONDS,\n  appendAgentAccessParam,\n  buildAgentAccessApiUrl,\n  buildAgentAccessUrl,\n  normalizeAgentAccessBasePath,\n  normalizeAgentAccessOrigin,\n  scopedAgentAccessResourceId,\n  toAgentAccessUrl,\n  type AgentAccessApiUrlOptions,\n  type AgentAccessResourceScope,\n  type AgentAccessUrlOptions,\n} from \"./agent-access.js\";\n"]}

package/dist/templates/default/app/root.tsx

@@ -1,6 +1,7 @@
 import { useDbSync } from "@agent-native/core/client";
 import {
   AppProviders,
+  ErrorReportActions,
   appPath,
   getLocaleInitScript,
   getThemeInitScript,
@@ -66,6 +67,9 @@ const ERROR_COPY = {
       "This page doesn't exist. It may have been moved or deleted.",
     statusTitle: (status: number) => `${status} Error`,
     goHome: "Go home",
+    sendFeedback: "Send feedback",
+    feedbackPlaceholder: "Describe what happened before this error appeared.",
+    openGitHubIssue: "Open GitHub issue",
   },
   "zh-CN": {
     genericTitle: "出了点问题",
@@ -74,6 +78,9 @@ const ERROR_COPY = {
     notFoundDetails: "此页面不存在。它可能已被移动或删除。",
     statusTitle: (status: number) => `${status} 错误`,
     goHome: "返回首页",
+    sendFeedback: "发送反馈",
+    feedbackPlaceholder: "描述此错误出现前发生了什么。",
+    openGitHubIssue: "打开 GitHub issue",
   },
   "zh-TW": {
     genericTitle: "發生錯誤",
@@ -82,6 +89,9 @@ const ERROR_COPY = {
     notFoundDetails: "此頁面不存在，可能已被移動或刪除。",
     statusTitle: (status: number) => `${status} 錯誤`,
     goHome: "返回首頁",
+    sendFeedback: "傳送意見回饋",
+    feedbackPlaceholder: "描述此錯誤出現前發生了什麼。",
+    openGitHubIssue: "開啟 GitHub issue",
   },
   "es-ES": {
     genericTitle: "Algo salió mal",
@@ -91,6 +101,10 @@ const ERROR_COPY = {
       "Esta página no existe. Puede que se haya movido o eliminado.",
     statusTitle: (status: number) => `Error ${status}`,
     goHome: "Ir al inicio",
+    sendFeedback: "Enviar comentarios",
+    feedbackPlaceholder:
+      "Describe qué pasó antes de que apareciera este error.",
+    openGitHubIssue: "Abrir issue en GitHub",
   },
   "fr-FR": {
     genericTitle: "Une erreur est survenue",
@@ -100,6 +114,9 @@ const ERROR_COPY = {
       "Cette page n'existe pas. Elle a peut-être été déplacée ou supprimée.",
     statusTitle: (status: number) => `Erreur ${status}`,
     goHome: "Retour à l'accueil",
+    sendFeedback: "Envoyer un retour",
+    feedbackPlaceholder: "Décrivez ce qui s'est passé avant cette erreur.",
+    openGitHubIssue: "Ouvrir une issue GitHub",
   },
   "de-DE": {
     genericTitle: "Etwas ist schiefgelaufen",
@@ -109,6 +126,9 @@ const ERROR_COPY = {
       "Diese Seite existiert nicht. Sie wurde möglicherweise verschoben oder gelöscht.",
     statusTitle: (status: number) => `${status} Fehler`,
     goHome: "Zur Startseite",
+    sendFeedback: "Feedback senden",
+    feedbackPlaceholder: "Beschreiben Sie, was vor diesem Fehler passiert ist.",
+    openGitHubIssue: "GitHub-Issue öffnen",
   },
   "ja-JP": {
     genericTitle: "問題が発生しました",
@@ -118,6 +138,9 @@ const ERROR_COPY = {
       "このページは存在しません。移動または削除された可能性があります。",
     statusTitle: (status: number) => `${status} エラー`,
     goHome: "ホームへ",
+    sendFeedback: "フィードバックを送信",
+    feedbackPlaceholder: "このエラーの直前に起きたことを説明してください。",
+    openGitHubIssue: "GitHub issue を開く",
   },
   "ko-KR": {
     genericTitle: "문제가 발생했습니다",
@@ -127,6 +150,10 @@ const ERROR_COPY = {
       "이 페이지는 존재하지 않습니다. 이동되었거나 삭제되었을 수 있습니다.",
     statusTitle: (status: number) => `${status} 오류`,
     goHome: "홈으로 이동",
+    sendFeedback: "피드백 보내기",
+    feedbackPlaceholder:
+      "이 오류가 나타나기 전에 무슨 일이 있었는지 적어 주세요.",
+    openGitHubIssue: "GitHub issue 열기",
   },
   "pt-BR": {
     genericTitle: "Algo deu errado",
@@ -136,6 +163,9 @@ const ERROR_COPY = {
       "Esta página não existe. Ela pode ter sido movida ou excluída.",
     statusTitle: (status: number) => `Erro ${status}`,
     goHome: "Ir para o início",
+    sendFeedback: "Enviar feedback",
+    feedbackPlaceholder: "Descreva o que aconteceu antes deste erro aparecer.",
+    openGitHubIssue: "Abrir issue no GitHub",
   },
   "hi-IN": {
     genericTitle: "कुछ गलत हुआ",
@@ -144,6 +174,9 @@ const ERROR_COPY = {
     notFoundDetails: "यह पेज मौजूद नहीं है। इसे स्थानांतरित या हटाया गया हो सकता है।",
     statusTitle: (status: number) => `${status} त्रुटि`,
     goHome: "होम जाएं",
+    sendFeedback: "फ़ीडबैक भेजें",
+    feedbackPlaceholder: "इस त्रुटि से पहले क्या हुआ, उसका वर्णन करें।",
+    openGitHubIssue: "GitHub issue खोलें",
   },
   "ar-SA": {
     genericTitle: "حدث خطأ",
@@ -152,6 +185,9 @@ const ERROR_COPY = {
     notFoundDetails: "هذه الصفحة غير موجودة. ربما تم نقلها أو حذفها.",
     statusTitle: (status: number) => `خطأ ${status}`,
     goHome: "الذهاب إلى الرئيسية",
+    sendFeedback: "إرسال الملاحظات",
+    feedbackPlaceholder: "صف ما حدث قبل ظهور هذا الخطأ.",
+    openGitHubIssue: "فتح مشكلة في GitHub",
   },
 };
 
@@ -285,6 +321,17 @@ export function ErrorBoundary() {
         >
           {copy.goHome}
         </Link>
+        <ErrorReportActions
+          appName="Agent Native"
+          title={title}
+          details={details}
+          status={status}
+          issueTitle={`Error screen: ${title}`}
+          feedbackLabel={copy.sendFeedback}
+          feedbackPlaceholder={copy.feedbackPlaceholder}
+          githubLabel={copy.openGitHubIssue}
+          className="mt-4"
+        />
         {stack && (
           <pre className="mt-6 w-full text-left text-xs overflow-auto p-4 bg-muted rounded">
             <code>{stack}</code>

package/docs/content/components.mdx

@@ -25,6 +25,19 @@ Avoid importing UI components from the bare `@agent-native/core` package. Use
 `@agent-native/core/client` or a focused `@agent-native/core/client/*` subpath
 so bundlers choose the browser-safe entry.
 
+Use `@agent-native/toolkit` for reusable app-building pieces that are not part
+of the foundational runtime contract: shadcn-style UI primitives, shared hooks,
+simple app shell helpers, and other template composition modules. Core keeps
+compatibility re-exports for migrated internals during the transition, but new
+template and app code should import toolkit modules directly:
+
+```tsx
+import { Button } from "@agent-native/toolkit/ui/button";
+import { Toaster } from "@agent-native/toolkit/ui/sonner";
+import { useToast } from "@agent-native/toolkit/hooks/use-toast";
+import { useSetHeaderActions } from "@agent-native/toolkit/app-shell";
+```
+
 <Diagram id="doc-block-u3yfqy" title="Drop down a layer, not out of the framework" summary={"Each layer keeps the same runtime — actions, thread state, and SQL-backed sync — while giving you more control over the chrome."}>
 
 ```html