@agent-native/core 0.90.2 → 0.90.3

package/dist/navigation/index.js

@@ -0,0 +1,105 @@
+import { AGENT_NATIVE_OPEN_PATH, withCollapsedAgentSidebarParam, } from "../shared/agent-sidebar-url.js";
+export const STANDARD_APP_ROUTES = {
+    home: "/",
+    settings: "/settings",
+    team: "/team",
+};
+export const STANDARD_SETTINGS_TABS = {
+    general: "general",
+    agent: "agent",
+    providers: "providers",
+    connections: "connections",
+    secrets: "secrets",
+    team: "team",
+    usage: "usage",
+    language: "language",
+    whatsNew: "whats-new",
+};
+function normalizeLeadingPath(path) {
+    const trimmed = path.trim();
+    if (!trimmed || trimmed === "/")
+        return "/";
+    return `/${trimmed.replace(/^\/+/, "").replace(/\/+$/, "")}`;
+}
+function normalizeTabId(tab) {
+    return tab
+        .trim()
+        .replace(/^#/, "")
+        .toLowerCase()
+        .replace(/['"]/g, "")
+        .replace(/[\s_]+/g, "-");
+}
+function pathSegment(value) {
+    return encodeURIComponent(value.trim().replace(/^\/+|\/+$/g, ""));
+}
+function resolveOpenPathRoute(route, params) {
+    if (!route)
+        return null;
+    return typeof route === "function" ? route(params) : route;
+}
+export function buildSettingsRoute(tab, basePath = STANDARD_APP_ROUTES.settings) {
+    const path = normalizeLeadingPath(basePath);
+    const normalizedTab = tab ? normalizeTabId(tab) : null;
+    if (!normalizedTab || normalizedTab === STANDARD_SETTINGS_TABS.general) {
+        return path;
+    }
+    return `${path}#${encodeURIComponent(normalizedTab)}`;
+}
+export function buildTeamRoute(options = {}) {
+    return options.teamInSettings
+        ? buildSettingsRoute(STANDARD_SETTINGS_TABS.team)
+        : STANDARD_APP_ROUTES.team;
+}
+export function buildStandardAppRoute(route, options = {}) {
+    if (route === "settings")
+        return buildSettingsRoute(options.settingsTab);
+    if (route === "team")
+        return buildTeamRoute(options);
+    return STANDARD_APP_ROUTES[route];
+}
+export function buildResourceRoute(collection, resourceId, options = {}) {
+    const base = normalizeLeadingPath(options.basePath ?? "/");
+    const collectionPath = collection
+        .split("/")
+        .map((segment) => pathSegment(segment))
+        .filter(Boolean)
+        .join("/");
+    if (!collectionPath)
+        throw new Error("collection is required");
+    if (!resourceId.trim())
+        throw new Error("resourceId is required");
+    const prefix = base === "/" ? "" : base;
+    return `${prefix}/${collectionPath}/${pathSegment(resourceId)}`;
+}
+export function buildOpenRoutePath(input) {
+    const sp = new URLSearchParams();
+    if (input.app)
+        sp.set("app", input.app);
+    sp.set("view", input.view);
+    if (input.to)
+        sp.set("to", input.to);
+    for (const [key, value] of Object.entries(input.params ?? {})) {
+        if (value === undefined || value === null || value === "")
+            continue;
+        sp.set(key, String(value));
+    }
+    return withCollapsedAgentSidebarParam(`${AGENT_NATIVE_OPEN_PATH}?${sp}`);
+}
+export function buildOpenRouteLink(input) {
+    return {
+        ...input,
+        label: input.label ?? `Open ${input.view}`,
+        url: buildOpenRoutePath(input),
+    };
+}
+export function createStandardOpenPathResolver(routes, options = {}) {
+    return (input) => {
+        void input.app;
+        if (!input.view)
+            return resolveOpenPathRoute(options.fallback, input.params);
+        return (resolveOpenPathRoute(routes[input.view], input.params) ??
+            resolveOpenPathRoute(options.fallback, input.params) ??
+            `/${input.view}`);
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/navigation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/navigation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,WAAW;IACrB,IAAI,EAAE,OAAO;CACL,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,WAAW;CACb,CAAC;AAmCX,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG;SACP,IAAI,EAAE;SACN,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAwC,EACxC,MAA8B;IAE9B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAA2C,EAC3C,QAAQ,GAAG,mBAAmB,CAAC,QAAQ;IAEvC,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,sBAAsB,CAAC,OAAO,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAAO,GAAyD,EAAE;IAElE,OAAO,OAAO,CAAC,cAAc;QAC3B,CAAC,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAyB,EACzB,OAAO,GAAiC,EAAE;IAE1C,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzE,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,UAAkB,EAClB,OAAO,GAA8B,EAAE;IAEvC,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,UAAU;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;SACtC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,OAAO,GAAG,MAAM,IAAI,cAAc,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAuB;IACxD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,GAAG;QAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,EAAE;QAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,SAAS;QACpE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,8BAA8B,CAAC,GAAG,sBAAsB,IAAI,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAA4C;IAE5C,OAAO;QACL,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE;QAC1C,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAA6C,EAC7C,OAAO,GAAoC,EAAE;IAE7C,OAAO,CAAC,KAIP,EAA6B,EAAE;QAC9B,KAAK,KAAK,CAAC,GAAG,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,IAAI;YACb,OAAO,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,CACL,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC;YACtD,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,EAAE,CACjB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  AGENT_NATIVE_OPEN_PATH,\n  withCollapsedAgentSidebarParam,\n} from \"../shared/agent-sidebar-url.js\";\n\nexport const STANDARD_APP_ROUTES = {\n  home: \"/\",\n  settings: \"/settings\",\n  team: \"/team\",\n} as const;\n\nexport const STANDARD_SETTINGS_TABS = {\n  general: \"general\",\n  agent: \"agent\",\n  providers: \"providers\",\n  connections: \"connections\",\n  secrets: \"secrets\",\n  team: \"team\",\n  usage: \"usage\",\n  language: \"language\",\n  whatsNew: \"whats-new\",\n} as const;\n\nexport type StandardAppRouteId = keyof typeof STANDARD_APP_ROUTES;\nexport type StandardSettingsTabId =\n  (typeof STANDARD_SETTINGS_TABS)[keyof typeof STANDARD_SETTINGS_TABS];\n\nexport interface BuildStandardAppRouteOptions {\n  settingsTab?: StandardSettingsTabId | string | null;\n  teamInSettings?: boolean;\n}\n\nexport interface BuildResourceRouteOptions {\n  basePath?: string;\n}\n\nexport interface NavigationTarget {\n  app?: string;\n  view: string;\n  params?: Record<string, string | number | boolean | null | undefined>;\n  to?: string;\n}\n\nexport interface NavigationLink extends NavigationTarget {\n  label: string;\n  url: string;\n}\n\nexport type StandardOpenPathRoute =\n  | string\n  | ((params: Record<string, string>) => string | null | undefined);\n\nexport interface StandardOpenPathResolverOptions {\n  fallback?: StandardOpenPathRoute;\n}\n\nfunction normalizeLeadingPath(path: string): string {\n  const trimmed = path.trim();\n  if (!trimmed || trimmed === \"/\") return \"/\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\nfunction normalizeTabId(tab: string): string {\n  return tab\n    .trim()\n    .replace(/^#/, \"\")\n    .toLowerCase()\n    .replace(/['\"]/g, \"\")\n    .replace(/[\\s_]+/g, \"-\");\n}\n\nfunction pathSegment(value: string): string {\n  return encodeURIComponent(value.trim().replace(/^\\/+|\\/+$/g, \"\"));\n}\n\nfunction resolveOpenPathRoute(\n  route: StandardOpenPathRoute | undefined,\n  params: Record<string, string>,\n): string | null | undefined {\n  if (!route) return null;\n  return typeof route === \"function\" ? route(params) : route;\n}\n\nexport function buildSettingsRoute(\n  tab?: StandardSettingsTabId | string | null,\n  basePath = STANDARD_APP_ROUTES.settings,\n): string {\n  const path = normalizeLeadingPath(basePath);\n  const normalizedTab = tab ? normalizeTabId(tab) : null;\n  if (!normalizedTab || normalizedTab === STANDARD_SETTINGS_TABS.general) {\n    return path;\n  }\n  return `${path}#${encodeURIComponent(normalizedTab)}`;\n}\n\nexport function buildTeamRoute(\n  options: Pick<BuildStandardAppRouteOptions, \"teamInSettings\"> = {},\n): string {\n  return options.teamInSettings\n    ? buildSettingsRoute(STANDARD_SETTINGS_TABS.team)\n    : STANDARD_APP_ROUTES.team;\n}\n\nexport function buildStandardAppRoute(\n  route: StandardAppRouteId,\n  options: BuildStandardAppRouteOptions = {},\n): string {\n  if (route === \"settings\") return buildSettingsRoute(options.settingsTab);\n  if (route === \"team\") return buildTeamRoute(options);\n  return STANDARD_APP_ROUTES[route];\n}\n\nexport function buildResourceRoute(\n  collection: string,\n  resourceId: string,\n  options: BuildResourceRouteOptions = {},\n): string {\n  const base = normalizeLeadingPath(options.basePath ?? \"/\");\n  const collectionPath = collection\n    .split(\"/\")\n    .map((segment) => pathSegment(segment))\n    .filter(Boolean)\n    .join(\"/\");\n  if (!collectionPath) throw new Error(\"collection is required\");\n  if (!resourceId.trim()) throw new Error(\"resourceId is required\");\n  const prefix = base === \"/\" ? \"\" : base;\n  return `${prefix}/${collectionPath}/${pathSegment(resourceId)}`;\n}\n\nexport function buildOpenRoutePath(input: NavigationTarget): string {\n  const sp = new URLSearchParams();\n  if (input.app) sp.set(\"app\", input.app);\n  sp.set(\"view\", input.view);\n  if (input.to) sp.set(\"to\", input.to);\n  for (const [key, value] of Object.entries(input.params ?? {})) {\n    if (value === undefined || value === null || value === \"\") continue;\n    sp.set(key, String(value));\n  }\n  return withCollapsedAgentSidebarParam(`${AGENT_NATIVE_OPEN_PATH}?${sp}`);\n}\n\nexport function buildOpenRouteLink(\n  input: NavigationTarget & { label?: string },\n): NavigationLink {\n  return {\n    ...input,\n    label: input.label ?? `Open ${input.view}`,\n    url: buildOpenRoutePath(input),\n  };\n}\n\nexport function createStandardOpenPathResolver(\n  routes: Record<string, StandardOpenPathRoute>,\n  options: StandardOpenPathResolverOptions = {},\n) {\n  return (input: {\n    app?: string;\n    view?: string;\n    params: Record<string, string>;\n  }): string | null | undefined => {\n    void input.app;\n    if (!input.view)\n      return resolveOpenPathRoute(options.fallback, input.params);\n    return (\n      resolveOpenPathRoute(routes[input.view], input.params) ??\n      resolveOpenPathRoute(options.fallback, input.params) ??\n      `/${input.view}`\n    );\n  };\n}\n"]}

package/dist/org/index.d.ts

@@ -1,4 +1,5 @@
 export type { OrgRole, OrgContext, OrgSummary, OrgInvitationSummary, OrgInfo, OrgMember, OrgPendingInvitation, } from "./types.js";
+export { canInviteOrgMembers, canManageOrg, canManageOrgDomain, orgRoleAtLeast, orgRoleRank, } from "./permissions.js";
 export { getOrgContext, getOrgDomain, getOrgA2ASecret, getA2ASecretByDomain, resolveOrgByDomain, resolveOrgIdForEmail, createOrganization, } from "./context.js";
 export { acceptPendingInvitationsForEmail } from "./accept-pending.js";
 export type { AcceptPendingResult } from "./accept-pending.js";

package/dist/org/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIhE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIhE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/org/index.js

@@ -1,4 +1,5 @@
 // Public API for the org module.
+export { canInviteOrgMembers, canManageOrg, canManageOrgDomain, orgRoleAtLeast, orgRoleRank, } from "./permissions.js";
 export { getOrgContext, getOrgDomain, getOrgA2ASecret, getA2ASecretByDomain, resolveOrgByDomain, resolveOrgIdForEmail, createOrganization, } from "./context.js";
 export { acceptPendingInvitationsForEmail } from "./accept-pending.js";
 export { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";

package/dist/org/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAYjC,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEhE,2EAA2E;AAC3E,wDAAwD;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,8EAA8E;AAC9E,qDAAqD;AACrD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC","sourcesContent":["// Public API for the org module.\n\nexport type {\n  OrgRole,\n  OrgContext,\n  OrgSummary,\n  OrgInvitationSummary,\n  OrgInfo,\n  OrgMember,\n  OrgPendingInvitation,\n} from \"./types.js\";\n\nexport {\n  getOrgContext,\n  getOrgDomain,\n  getOrgA2ASecret,\n  getA2ASecretByDomain,\n  resolveOrgByDomain,\n  resolveOrgIdForEmail,\n  createOrganization,\n} from \"./context.js\";\n\nexport { acceptPendingInvitationsForEmail } from \"./accept-pending.js\";\nexport type { AcceptPendingResult } from \"./accept-pending.js\";\n\nexport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nexport type { AutoJoinDomainResult } from \"./auto-join-domain.js\";\n\nexport { ORG_MIGRATIONS } from \"./migrations.js\";\n\nexport { createOrgPlugin, defaultOrgPlugin } from \"./plugin.js\";\n\n// Drizzle schema (re-exported so templates can write typed queries against\n// org tables without redefining the schema themselves).\nexport { organizations, orgMembers, orgInvitations } from \"./schema.js\";\n\n// Individual handlers — exported so templates can compose a custom org plugin\n// while still using the framework-provided handlers.\nexport {\n  getMyOrgHandler,\n  createOrgHandler,\n  updateOrgHandler,\n  switchOrgHandler,\n  listMembersHandler,\n  removeMemberHandler,\n  changeMemberRoleHandler,\n  listInvitationsHandler,\n  createInvitationHandler,\n  acceptInvitationHandler,\n  setA2ASecretHandler,\n  syncA2ASecretHandler,\n  receiveA2ASecretHandler,\n} from \"./handlers.js\";\n\nexport { isFreeEmailProvider } from \"./free-email-providers.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAYjC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEhE,2EAA2E;AAC3E,wDAAwD;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,8EAA8E;AAC9E,qDAAqD;AACrD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC","sourcesContent":["// Public API for the org module.\n\nexport type {\n  OrgRole,\n  OrgContext,\n  OrgSummary,\n  OrgInvitationSummary,\n  OrgInfo,\n  OrgMember,\n  OrgPendingInvitation,\n} from \"./types.js\";\n\nexport {\n  canInviteOrgMembers,\n  canManageOrg,\n  canManageOrgDomain,\n  orgRoleAtLeast,\n  orgRoleRank,\n} from \"./permissions.js\";\n\nexport {\n  getOrgContext,\n  getOrgDomain,\n  getOrgA2ASecret,\n  getA2ASecretByDomain,\n  resolveOrgByDomain,\n  resolveOrgIdForEmail,\n  createOrganization,\n} from \"./context.js\";\n\nexport { acceptPendingInvitationsForEmail } from \"./accept-pending.js\";\nexport type { AcceptPendingResult } from \"./accept-pending.js\";\n\nexport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nexport type { AutoJoinDomainResult } from \"./auto-join-domain.js\";\n\nexport { ORG_MIGRATIONS } from \"./migrations.js\";\n\nexport { createOrgPlugin, defaultOrgPlugin } from \"./plugin.js\";\n\n// Drizzle schema (re-exported so templates can write typed queries against\n// org tables without redefining the schema themselves).\nexport { organizations, orgMembers, orgInvitations } from \"./schema.js\";\n\n// Individual handlers — exported so templates can compose a custom org plugin\n// while still using the framework-provided handlers.\nexport {\n  getMyOrgHandler,\n  createOrgHandler,\n  updateOrgHandler,\n  switchOrgHandler,\n  listMembersHandler,\n  removeMemberHandler,\n  changeMemberRoleHandler,\n  listInvitationsHandler,\n  createInvitationHandler,\n  acceptInvitationHandler,\n  setA2ASecretHandler,\n  syncA2ASecretHandler,\n  receiveA2ASecretHandler,\n} from \"./handlers.js\";\n\nexport { isFreeEmailProvider } from \"./free-email-providers.js\";\n"]}

package/dist/org/permissions.d.ts

@@ -0,0 +1,7 @@
+import type { OrgRole } from "./types.js";
+export declare function orgRoleRank(role: OrgRole | null | undefined): number;
+export declare function orgRoleAtLeast(role: OrgRole | null | undefined, minimum: OrgRole): boolean;
+export declare function canManageOrg(role: OrgRole | null | undefined): boolean;
+export declare function canInviteOrgMembers(role: OrgRole | null | undefined): boolean;
+export declare function canManageOrgDomain(role: OrgRole | null | undefined): boolean;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/org/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/org/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQ1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAEpE;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,OAAO,GACf,OAAO,CAET;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEtE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E"}

package/dist/org/permissions.js

@@ -0,0 +1,21 @@
+const ORG_ROLE_RANK = {
+    member: 1,
+    admin: 2,
+    owner: 3,
+};
+export function orgRoleRank(role) {
+    return role ? (ORG_ROLE_RANK[role] ?? 0) : 0;
+}
+export function orgRoleAtLeast(role, minimum) {
+    return orgRoleRank(role) >= orgRoleRank(minimum);
+}
+export function canManageOrg(role) {
+    return orgRoleAtLeast(role, "admin");
+}
+export function canInviteOrgMembers(role) {
+    return orgRoleAtLeast(role, "admin");
+}
+export function canManageOrgDomain(role) {
+    return role === "owner";
+}
+//# sourceMappingURL=permissions.js.map

package/dist/org/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/org/permissions.ts"],"names":[],"mappings":"AAEA,MAAM,aAAa,GAA4B;IAC7C,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,IAAgC;IAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAgC,EAChC,OAAgB;IAEhB,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAgC;IAC3D,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAgC;IACjE,OAAO,IAAI,KAAK,OAAO,CAAC;AAC1B,CAAC","sourcesContent":["import type { OrgRole } from \"./types.js\";\n\nconst ORG_ROLE_RANK: Record<OrgRole, number> = {\n  member: 1,\n  admin: 2,\n  owner: 3,\n};\n\nexport function orgRoleRank(role: OrgRole | null | undefined): number {\n  return role ? (ORG_ROLE_RANK[role] ?? 0) : 0;\n}\n\nexport function orgRoleAtLeast(\n  role: OrgRole | null | undefined,\n  minimum: OrgRole,\n): boolean {\n  return orgRoleRank(role) >= orgRoleRank(minimum);\n}\n\nexport function canManageOrg(role: OrgRole | null | undefined): boolean {\n  return orgRoleAtLeast(role, \"admin\");\n}\n\nexport function canInviteOrgMembers(role: OrgRole | null | undefined): boolean {\n  return orgRoleAtLeast(role, \"admin\");\n}\n\nexport function canManageOrgDomain(role: OrgRole | null | undefined): boolean {\n  return role === \"owner\";\n}\n"]}

package/dist/org-team/index.d.ts

@@ -0,0 +1,2 @@
+export * from "../org/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/org-team/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/org-team/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC"}

package/dist/org-team/index.js

@@ -0,0 +1,2 @@
+export * from "../org/index.js";
+//# sourceMappingURL=index.js.map

package/dist/org-team/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/org-team/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC","sourcesContent":["export * from \"../org/index.js\";\n"]}

package/dist/private-blob/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/private-blob/registry.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAkKpB,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,mBAAmB,GAC5B,IAAI,CAEN;AAED,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAgB,wBAAwB,IAAI,mBAAmB,EAAE,CAEhE;AAED,wBAAgB,4BAA4B,IAAI,mBAAmB,GAAG,IAAI,CAKzE;AAED,wBAAgB,yCAAyC,CACvD,OAAO,EAAE,OAAO,GACf,IAAI,CAEN;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAQnC;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAOhC;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,uBAAuB,CAAC,CAYlC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/private-blob/registry.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAmKpB,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,mBAAmB,GAC5B,IAAI,CAEN;AAED,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAgB,wBAAwB,IAAI,mBAAmB,EAAE,CAEhE;AAED,wBAAgB,4BAA4B,IAAI,mBAAmB,GAAG,IAAI,CAKzE;AAED,wBAAgB,yCAAyC,CACvD,OAAO,EAAE,OAAO,GACf,IAAI,CAEN;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAQnC;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAOhC;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,uBAAuB,CAAC,CAYlC"}

package/dist/private-blob/registry.js

@@ -55,6 +55,7 @@ async function putViaEncryptedPublicUpload(input) {
         filename: input.filename ?? input.key ?? "private-blob.bin",
         mimeType: "application/octet-stream",
         ownerEmail: input.ownerEmail,
+        recordAsset: false,
     });
     if (!uploaded)
         return null;

package/dist/private-blob/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/private-blob/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAsC9B,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;AACxD,MAAM,OAAO,GAAG,UAAoD,CAAC;AACrE,MAAM,SAAS,GACb,CAAC,OAAO,CAAC,iCAAiC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AAC5D,MAAM,uBAAuB,GAC3B,CAAC,OAAO,CAAC,4CAA4C,KAAK;IACxD,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEL,SAAS,OAAO,CAAC,IAAyB;IACxC,OAAO,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,IAAgB;IACpC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,UAAU,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC;QACtC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAwB,EACxB,UAAsB;IAEtB,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,sBAAsB,EAAE,EACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CACpC,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,UAAU,CACnB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAkC;IAElC,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAC3B,EAAE,CAAC;AACN,CAAC;AAED,SAAS,4BAA4B,CAAC,EAAU;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;IAC7D,IACE,UAAU,EAAE,IAAI,KAAK,yCAAyC;QAC9D,UAAU,CAAC,OAAO,KAAK,CAAC;QACxB,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAyB;IAC7D,OAAO,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAA0B;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;QACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,kBAAkB;QAC3D,QAAQ,EAAE,0BAA0B;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,UAAU,GAA2B;QACzC,IAAI,EAAE,yCAAyC;QAC/C,OAAO,EAAE,CAAC;QACV,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,cAAc,EAAE,QAAQ,CAAC,QAAQ;QACjC,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE;QACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,4BAA4B,CAAC,UAAU,CAAC;QAC5C,QAAQ,EAAE,iBAAiB,QAAQ,CAAC,QAAQ,EAAE;QAC9C,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAAyB;IAEzB,MAAM,UAAU,GAAG,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC;QACrD,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,QAA6B;IAE7B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,EAAU;IACtD,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,YAAY,EAAE;YAAE,OAAO,QAAQ,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,OAAgB;IAEhB,uBAAuB,CAAC,OAAO,GAAG,OAAO,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0B;IAE1B,MAAM,QAAQ,GAAG,4BAA4B,EAAE,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,uBAAuB,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,gDAAgD,KAAK,GAAG,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAyB;IAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAyB;IAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EACJ,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\n\nimport { uploadFile } from \"../file-upload/index.js\";\nimport {\n  decryptSecretValue,\n  encryptSecretValue,\n  getSecretEncryptionKey,\n} from \"../secrets/crypto.js\";\nimport type {\n  PrivateBlobDeleteResult,\n  PrivateBlobHandle,\n  PrivateBlobProvider,\n  PrivateBlobPutInput,\n  PrivateBlobReadResult,\n} from \"./types.js\";\n\ninterface PrivateBlobGlobals {\n  __agentNativePrivateBlobProviders?: Map<string, PrivateBlobProvider>;\n  __agentNativePrivateBlobPublicUploadFallback?: { enabled: boolean };\n}\n\ninterface EncryptedPayload {\n  iv: string;\n  tag: string;\n  ciphertext: Uint8Array;\n}\n\ninterface EncryptionParams {\n  iv: string;\n  tag: string;\n}\n\ninterface PublicUploadDescriptor {\n  kind: \"agent-native.private-blob.public-upload\";\n  version: 1;\n  url: string;\n  uploadProvider: string;\n  uploadId?: string;\n  encryption: EncryptionParams;\n  mimeType?: string;\n  metadata?: PrivateBlobHandle[\"metadata\"];\n  size: number;\n  createdAt: string;\n}\n\nconst PUBLIC_UPLOAD_HANDLE_PREFIX = \"public-upload:v1:\";\nconst globals = globalThis as typeof globalThis & PrivateBlobGlobals;\nconst providers: Map<string, PrivateBlobProvider> =\n  (globals.__agentNativePrivateBlobProviders ??= new Map());\nconst publicUploadFallbackRef: { enabled: boolean } =\n  (globals.__agentNativePrivateBlobPublicUploadFallback ??= {\n    enabled: true,\n  });\n\nfunction toBytes(data: Uint8Array | Buffer): Uint8Array {\n  return data instanceof Uint8Array ? data : new Uint8Array(data);\n}\n\nfunction encryptBytes(data: Uint8Array): EncryptedPayload {\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(\"aes-256-gcm\", getSecretEncryptionKey(), iv);\n  const ciphertext = Buffer.concat([\n    cipher.update(Buffer.from(data)),\n    cipher.final(),\n  ]);\n  return {\n    iv: iv.toString(\"base64url\"),\n    ciphertext: new Uint8Array(ciphertext),\n    tag: cipher.getAuthTag().toString(\"base64url\"),\n  };\n}\n\nfunction decryptBytes(\n  params: EncryptionParams,\n  ciphertext: Uint8Array,\n): Uint8Array {\n  const decipher = createDecipheriv(\n    \"aes-256-gcm\",\n    getSecretEncryptionKey(),\n    Buffer.from(params.iv, \"base64url\"),\n  );\n  decipher.setAuthTag(Buffer.from(params.tag, \"base64url\"));\n  return new Uint8Array(\n    Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]),\n  );\n}\n\nfunction encodePublicUploadDescriptor(\n  descriptor: PublicUploadDescriptor,\n): string {\n  return `${PUBLIC_UPLOAD_HANDLE_PREFIX}${encryptSecretValue(\n    JSON.stringify(descriptor),\n  )}`;\n}\n\nfunction decodePublicUploadDescriptor(id: string): PublicUploadDescriptor {\n  if (!id.startsWith(PUBLIC_UPLOAD_HANDLE_PREFIX)) {\n    throw new Error(\n      \"Private blob handle is not a public-upload fallback handle\",\n    );\n  }\n  const raw = decryptSecretValue(id.slice(PUBLIC_UPLOAD_HANDLE_PREFIX.length));\n  const descriptor = JSON.parse(raw) as PublicUploadDescriptor;\n  if (\n    descriptor?.kind !== \"agent-native.private-blob.public-upload\" ||\n    descriptor.version !== 1 ||\n    typeof descriptor.url !== \"string\"\n  ) {\n    throw new Error(\"Private blob handle descriptor is invalid\");\n  }\n  return descriptor;\n}\n\nfunction isPublicUploadFallbackHandle(handle: PrivateBlobHandle): boolean {\n  return handle.id.startsWith(PUBLIC_UPLOAD_HANDLE_PREFIX);\n}\n\nasync function putViaEncryptedPublicUpload(\n  input: PrivateBlobPutInput,\n): Promise<PrivateBlobHandle | null> {\n  const bytes = toBytes(input.data);\n  const encrypted = encryptBytes(bytes);\n  const uploaded = await uploadFile({\n    data: Buffer.from(encrypted.ciphertext),\n    filename: input.filename ?? input.key ?? \"private-blob.bin\",\n    mimeType: \"application/octet-stream\",\n    ownerEmail: input.ownerEmail,\n  });\n  if (!uploaded) return null;\n\n  const descriptor: PublicUploadDescriptor = {\n    kind: \"agent-native.private-blob.public-upload\",\n    version: 1,\n    url: uploaded.url,\n    uploadProvider: uploaded.provider,\n    uploadId: uploaded.id,\n    encryption: { iv: encrypted.iv, tag: encrypted.tag },\n    mimeType: input.mimeType,\n    metadata: input.metadata,\n    size: bytes.byteLength,\n    createdAt: new Date().toISOString(),\n  };\n\n  return {\n    id: encodePublicUploadDescriptor(descriptor),\n    provider: `public-upload:${uploaded.provider}`,\n    opaque: true,\n    encrypted: true,\n    mimeType: input.mimeType,\n    size: bytes.byteLength,\n    createdAt: descriptor.createdAt,\n    metadata: input.metadata,\n  };\n}\n\nasync function readViaEncryptedPublicUpload(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobReadResult> {\n  const descriptor = decodePublicUploadDescriptor(handle.id);\n  const response = await fetch(descriptor.url);\n  if (!response.ok) {\n    throw new Error(\n      `Private blob public-upload read failed (${response.status}): ${response.statusText}`,\n    );\n  }\n  // The uploaded ciphertext is intentionally opaque; the descriptor carries\n  // auth tag + IV separately so the backing public URL is useless by itself.\n  const ciphertext = new Uint8Array(await response.arrayBuffer());\n  return {\n    data: decryptBytes(descriptor.encryption, ciphertext),\n    mimeType: descriptor.mimeType,\n    metadata: descriptor.metadata,\n    handle,\n  };\n}\n\nexport function registerPrivateBlobProvider(\n  provider: PrivateBlobProvider,\n): void {\n  providers.set(provider.id, provider);\n}\n\nexport function unregisterPrivateBlobProvider(id: string): void {\n  providers.delete(id);\n}\n\nexport function listPrivateBlobProviders(): PrivateBlobProvider[] {\n  return [...providers.values()];\n}\n\nexport function getActivePrivateBlobProvider(): PrivateBlobProvider | null {\n  for (const provider of providers.values()) {\n    if (provider.isConfigured()) return provider;\n  }\n  return null;\n}\n\nexport function setPrivateBlobPublicUploadFallbackEnabled(\n  enabled: boolean,\n): void {\n  publicUploadFallbackRef.enabled = enabled;\n}\n\nexport async function putPrivateBlob(\n  input: PrivateBlobPutInput,\n): Promise<PrivateBlobHandle | null> {\n  const provider = getActivePrivateBlobProvider();\n  if (provider) return provider.put(input);\n  if (!publicUploadFallbackRef.enabled) return null;\n  if (process.env.AGENT_NATIVE_PRIVATE_BLOB_PUBLIC_UPLOAD_FALLBACK === \"0\") {\n    return null;\n  }\n  return putViaEncryptedPublicUpload(input);\n}\n\nexport async function readPrivateBlob(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobReadResult> {\n  const provider = providers.get(handle.provider);\n  if (provider) return provider.read(handle);\n  if (isPublicUploadFallbackHandle(handle)) {\n    return readViaEncryptedPublicUpload(handle);\n  }\n  throw new Error(`No private blob provider registered for ${handle.provider}`);\n}\n\nexport async function deletePrivateBlob(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobDeleteResult> {\n  const provider = providers.get(handle.provider);\n  if (provider) return provider.delete(handle);\n  if (isPublicUploadFallbackHandle(handle)) {\n    return {\n      deleted: false,\n      provider: handle.provider,\n      reason:\n        \"delete is not supported by the encrypted public-upload fallback provider\",\n    };\n  }\n  throw new Error(`No private blob provider registered for ${handle.provider}`);\n}\n"]}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/private-blob/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAsC9B,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;AACxD,MAAM,OAAO,GAAG,UAAoD,CAAC;AACrE,MAAM,SAAS,GACb,CAAC,OAAO,CAAC,iCAAiC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AAC5D,MAAM,uBAAuB,GAC3B,CAAC,OAAO,CAAC,4CAA4C,KAAK;IACxD,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEL,SAAS,OAAO,CAAC,IAAyB;IACxC,OAAO,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,IAAgB;IACpC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,UAAU,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC;QACtC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAwB,EACxB,UAAsB;IAEtB,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,sBAAsB,EAAE,EACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CACpC,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,UAAU,CACnB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAkC;IAElC,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAC3B,EAAE,CAAC;AACN,CAAC;AAED,SAAS,4BAA4B,CAAC,EAAU;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;IAC7D,IACE,UAAU,EAAE,IAAI,KAAK,yCAAyC;QAC9D,UAAU,CAAC,OAAO,KAAK,CAAC;QACxB,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAyB;IAC7D,OAAO,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAA0B;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;QACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,kBAAkB;QAC3D,QAAQ,EAAE,0BAA0B;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,UAAU,GAA2B;QACzC,IAAI,EAAE,yCAAyC;QAC/C,OAAO,EAAE,CAAC;QACV,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,cAAc,EAAE,QAAQ,CAAC,QAAQ;QACjC,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE;QACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,4BAA4B,CAAC,UAAU,CAAC;QAC5C,QAAQ,EAAE,iBAAiB,QAAQ,CAAC,QAAQ,EAAE;QAC9C,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAAyB;IAEzB,MAAM,UAAU,GAAG,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC;QACrD,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,QAA6B;IAE7B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,EAAU;IACtD,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,YAAY,EAAE;YAAE,OAAO,QAAQ,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,OAAgB;IAEhB,uBAAuB,CAAC,OAAO,GAAG,OAAO,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0B;IAE1B,MAAM,QAAQ,GAAG,4BAA4B,EAAE,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,uBAAuB,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,gDAAgD,KAAK,GAAG,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAyB;IAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAyB;IAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EACJ,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\n\nimport { uploadFile } from \"../file-upload/index.js\";\nimport {\n  decryptSecretValue,\n  encryptSecretValue,\n  getSecretEncryptionKey,\n} from \"../secrets/crypto.js\";\nimport type {\n  PrivateBlobDeleteResult,\n  PrivateBlobHandle,\n  PrivateBlobProvider,\n  PrivateBlobPutInput,\n  PrivateBlobReadResult,\n} from \"./types.js\";\n\ninterface PrivateBlobGlobals {\n  __agentNativePrivateBlobProviders?: Map<string, PrivateBlobProvider>;\n  __agentNativePrivateBlobPublicUploadFallback?: { enabled: boolean };\n}\n\ninterface EncryptedPayload {\n  iv: string;\n  tag: string;\n  ciphertext: Uint8Array;\n}\n\ninterface EncryptionParams {\n  iv: string;\n  tag: string;\n}\n\ninterface PublicUploadDescriptor {\n  kind: \"agent-native.private-blob.public-upload\";\n  version: 1;\n  url: string;\n  uploadProvider: string;\n  uploadId?: string;\n  encryption: EncryptionParams;\n  mimeType?: string;\n  metadata?: PrivateBlobHandle[\"metadata\"];\n  size: number;\n  createdAt: string;\n}\n\nconst PUBLIC_UPLOAD_HANDLE_PREFIX = \"public-upload:v1:\";\nconst globals = globalThis as typeof globalThis & PrivateBlobGlobals;\nconst providers: Map<string, PrivateBlobProvider> =\n  (globals.__agentNativePrivateBlobProviders ??= new Map());\nconst publicUploadFallbackRef: { enabled: boolean } =\n  (globals.__agentNativePrivateBlobPublicUploadFallback ??= {\n    enabled: true,\n  });\n\nfunction toBytes(data: Uint8Array | Buffer): Uint8Array {\n  return data instanceof Uint8Array ? data : new Uint8Array(data);\n}\n\nfunction encryptBytes(data: Uint8Array): EncryptedPayload {\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(\"aes-256-gcm\", getSecretEncryptionKey(), iv);\n  const ciphertext = Buffer.concat([\n    cipher.update(Buffer.from(data)),\n    cipher.final(),\n  ]);\n  return {\n    iv: iv.toString(\"base64url\"),\n    ciphertext: new Uint8Array(ciphertext),\n    tag: cipher.getAuthTag().toString(\"base64url\"),\n  };\n}\n\nfunction decryptBytes(\n  params: EncryptionParams,\n  ciphertext: Uint8Array,\n): Uint8Array {\n  const decipher = createDecipheriv(\n    \"aes-256-gcm\",\n    getSecretEncryptionKey(),\n    Buffer.from(params.iv, \"base64url\"),\n  );\n  decipher.setAuthTag(Buffer.from(params.tag, \"base64url\"));\n  return new Uint8Array(\n    Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]),\n  );\n}\n\nfunction encodePublicUploadDescriptor(\n  descriptor: PublicUploadDescriptor,\n): string {\n  return `${PUBLIC_UPLOAD_HANDLE_PREFIX}${encryptSecretValue(\n    JSON.stringify(descriptor),\n  )}`;\n}\n\nfunction decodePublicUploadDescriptor(id: string): PublicUploadDescriptor {\n  if (!id.startsWith(PUBLIC_UPLOAD_HANDLE_PREFIX)) {\n    throw new Error(\n      \"Private blob handle is not a public-upload fallback handle\",\n    );\n  }\n  const raw = decryptSecretValue(id.slice(PUBLIC_UPLOAD_HANDLE_PREFIX.length));\n  const descriptor = JSON.parse(raw) as PublicUploadDescriptor;\n  if (\n    descriptor?.kind !== \"agent-native.private-blob.public-upload\" ||\n    descriptor.version !== 1 ||\n    typeof descriptor.url !== \"string\"\n  ) {\n    throw new Error(\"Private blob handle descriptor is invalid\");\n  }\n  return descriptor;\n}\n\nfunction isPublicUploadFallbackHandle(handle: PrivateBlobHandle): boolean {\n  return handle.id.startsWith(PUBLIC_UPLOAD_HANDLE_PREFIX);\n}\n\nasync function putViaEncryptedPublicUpload(\n  input: PrivateBlobPutInput,\n): Promise<PrivateBlobHandle | null> {\n  const bytes = toBytes(input.data);\n  const encrypted = encryptBytes(bytes);\n  const uploaded = await uploadFile({\n    data: Buffer.from(encrypted.ciphertext),\n    filename: input.filename ?? input.key ?? \"private-blob.bin\",\n    mimeType: \"application/octet-stream\",\n    ownerEmail: input.ownerEmail,\n    recordAsset: false,\n  });\n  if (!uploaded) return null;\n\n  const descriptor: PublicUploadDescriptor = {\n    kind: \"agent-native.private-blob.public-upload\",\n    version: 1,\n    url: uploaded.url,\n    uploadProvider: uploaded.provider,\n    uploadId: uploaded.id,\n    encryption: { iv: encrypted.iv, tag: encrypted.tag },\n    mimeType: input.mimeType,\n    metadata: input.metadata,\n    size: bytes.byteLength,\n    createdAt: new Date().toISOString(),\n  };\n\n  return {\n    id: encodePublicUploadDescriptor(descriptor),\n    provider: `public-upload:${uploaded.provider}`,\n    opaque: true,\n    encrypted: true,\n    mimeType: input.mimeType,\n    size: bytes.byteLength,\n    createdAt: descriptor.createdAt,\n    metadata: input.metadata,\n  };\n}\n\nasync function readViaEncryptedPublicUpload(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobReadResult> {\n  const descriptor = decodePublicUploadDescriptor(handle.id);\n  const response = await fetch(descriptor.url);\n  if (!response.ok) {\n    throw new Error(\n      `Private blob public-upload read failed (${response.status}): ${response.statusText}`,\n    );\n  }\n  // The uploaded ciphertext is intentionally opaque; the descriptor carries\n  // auth tag + IV separately so the backing public URL is useless by itself.\n  const ciphertext = new Uint8Array(await response.arrayBuffer());\n  return {\n    data: decryptBytes(descriptor.encryption, ciphertext),\n    mimeType: descriptor.mimeType,\n    metadata: descriptor.metadata,\n    handle,\n  };\n}\n\nexport function registerPrivateBlobProvider(\n  provider: PrivateBlobProvider,\n): void {\n  providers.set(provider.id, provider);\n}\n\nexport function unregisterPrivateBlobProvider(id: string): void {\n  providers.delete(id);\n}\n\nexport function listPrivateBlobProviders(): PrivateBlobProvider[] {\n  return [...providers.values()];\n}\n\nexport function getActivePrivateBlobProvider(): PrivateBlobProvider | null {\n  for (const provider of providers.values()) {\n    if (provider.isConfigured()) return provider;\n  }\n  return null;\n}\n\nexport function setPrivateBlobPublicUploadFallbackEnabled(\n  enabled: boolean,\n): void {\n  publicUploadFallbackRef.enabled = enabled;\n}\n\nexport async function putPrivateBlob(\n  input: PrivateBlobPutInput,\n): Promise<PrivateBlobHandle | null> {\n  const provider = getActivePrivateBlobProvider();\n  if (provider) return provider.put(input);\n  if (!publicUploadFallbackRef.enabled) return null;\n  if (process.env.AGENT_NATIVE_PRIVATE_BLOB_PUBLIC_UPLOAD_FALLBACK === \"0\") {\n    return null;\n  }\n  return putViaEncryptedPublicUpload(input);\n}\n\nexport async function readPrivateBlob(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobReadResult> {\n  const provider = providers.get(handle.provider);\n  if (provider) return provider.read(handle);\n  if (isPublicUploadFallbackHandle(handle)) {\n    return readViaEncryptedPublicUpload(handle);\n  }\n  throw new Error(`No private blob provider registered for ${handle.provider}`);\n}\n\nexport async function deletePrivateBlob(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobDeleteResult> {\n  const provider = providers.get(handle.provider);\n  if (provider) return provider.delete(handle);\n  if (isPublicUploadFallbackHandle(handle)) {\n    return {\n      deleted: false,\n      provider: handle.provider,\n      reason:\n        \"delete is not supported by the encrypted public-upload fallback provider\",\n    };\n  }\n  throw new Error(`No private blob provider registered for ${handle.provider}`);\n}\n"]}

package/dist/resources/handlers.d.ts

@@ -52,8 +52,8 @@ export declare function handleDeleteResource(event: any): Promise<{
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,9 +73,9 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
-    error?: undefined;
     url: string;
     provider: string;
+    error?: undefined;
 }>;
 export {};
 //# sourceMappingURL=handlers.d.ts.map

package/dist/review/actions/consume-review-feedback.d.ts

@@ -0,0 +1,9 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    resourceType: string;
+    resourceId: string;
+    commentIds: string[];
+}, {
+    consumedCommentIds: string[];
+}>;
+export default _default;
+//# sourceMappingURL=consume-review-feedback.d.ts.map

package/dist/review/actions/consume-review-feedback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consume-review-feedback.d.ts","sourceRoot":"","sources":["../../../src/review/actions/consume-review-feedback.ts"],"names":[],"mappings":""}

package/dist/review/actions/consume-review-feedback.js

@@ -0,0 +1,29 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { assertReviewableResourceAccess } from "../registry.js";
+import { consumeReviewFeedback } from "../store.js";
+const schema = z.object({
+    resourceType: z.string().min(1),
+    resourceId: z.string().min(1),
+    commentIds: z.array(z.string().min(1)).min(1),
+});
+export default defineAction({
+    description: "Mark review feedback as consumed by the agent or reviewer workflow.",
+    schema,
+    run: async (args, ctx) => {
+        const actionCtx = ctx;
+        await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "editor");
+        await consumeReviewFeedback(args.commentIds, undefined, {
+            resourceType: args.resourceType,
+            resourceId: args.resourceId,
+        });
+        return { consumedCommentIds: args.commentIds };
+    },
+    audit: {
+        target: (args) => ({
+            type: args.resourceType,
+            id: args.resourceId,
+        }),
+    },
+});
+//# sourceMappingURL=consume-review-feedback.js.map

package/dist/review/actions/consume-review-feedback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consume-review-feedback.js","sourceRoot":"","sources":["../../../src/review/actions/consume-review-feedback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,qEAAqE;IACvE,MAAM;IACN,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,GAAwC,CAAC;QAC3D,MAAM,8BAA8B,CAClC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,SAAS,EACT,QAAQ,CACT,CAAC;QACF,MAAM,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE;YACtD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACjD,CAAC;IACD,KAAK,EAAE;QACL,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjB,IAAI,EAAE,IAAI,CAAC,YAAY;YACvB,EAAE,EAAE,IAAI,CAAC,UAAU;SACpB,CAAC;KACH;CACF,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport { assertReviewableResourceAccess } from \"../registry.js\";\nimport { consumeReviewFeedback } from \"../store.js\";\nimport type { ReviewResourceContext } from \"../types.js\";\n\nconst schema = z.object({\n  resourceType: z.string().min(1),\n  resourceId: z.string().min(1),\n  commentIds: z.array(z.string().min(1)).min(1),\n});\n\nexport default defineAction({\n  description:\n    \"Mark review feedback as consumed by the agent or reviewer workflow.\",\n  schema,\n  run: async (args, ctx) => {\n    const actionCtx = ctx as ReviewResourceContext | undefined;\n    await assertReviewableResourceAccess(\n      args.resourceType,\n      args.resourceId,\n      actionCtx,\n      \"editor\",\n    );\n    await consumeReviewFeedback(args.commentIds, undefined, {\n      resourceType: args.resourceType,\n      resourceId: args.resourceId,\n    });\n    return { consumedCommentIds: args.commentIds };\n  },\n  audit: {\n    target: (args) => ({\n      type: args.resourceType,\n      id: args.resourceId,\n    }),\n  },\n});\n"]}

package/dist/review/actions/create-review-comment.d.ts

@@ -0,0 +1,18 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    resourceType: string;
+    resourceId: string;
+    targetId?: string;
+    kind?: "annotation" | "comment" | "correction" | "decision" | "question" | "review";
+    anchor?: unknown;
+    body: string;
+    authorName?: string;
+    resolutionTarget?: "agent" | "human";
+    mentions?: {
+        label: string;
+        email?: string;
+        id?: string;
+    }[];
+    metadata?: Record<string, unknown>;
+}, import("../types.js").ReviewComment>;
+export default _default;
+//# sourceMappingURL=create-review-comment.d.ts.map

package/dist/review/actions/create-review-comment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-review-comment.d.ts","sourceRoot":"","sources":["../../../src/review/actions/create-review-comment.ts"],"names":[],"mappings":""}

package/dist/review/actions/create-review-comment.js

@@ -0,0 +1,81 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { extractReviewMentions, normalizeReviewMentions } from "../mentions.js";
+import { assertReviewableResourceAccess, normalizeReviewVisibility, } from "../registry.js";
+import { insertReviewComment } from "../store.js";
+const mentionSchema = z.object({
+    label: z.string().min(1),
+    email: z.string().email().nullable().optional(),
+    id: z.string().nullable().optional(),
+});
+const schema = z.object({
+    resourceType: z.string().min(1),
+    resourceId: z.string().min(1),
+    targetId: z.string().nullable().optional(),
+    kind: z
+        .enum([
+        "comment",
+        "annotation",
+        "correction",
+        "question",
+        "decision",
+        "review",
+    ])
+        .optional(),
+    anchor: z.unknown().nullable().optional(),
+    body: z.string().min(1),
+    authorName: z.string().nullable().optional(),
+    resolutionTarget: z.enum(["agent", "human"]).nullable().optional(),
+    mentions: z.array(mentionSchema).optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+});
+export default defineAction({
+    description: "Create an inline comment, annotation, or review thread for a resource.",
+    schema,
+    run: async (args, ctx) => {
+        const actionCtx = ctx;
+        const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "viewer");
+        const mentions = normalizeReviewMentions([
+            ...normalizeReviewMentions(args.mentions),
+            ...extractReviewMentions(args.body),
+        ]);
+        const resolutionTarget = args.resolutionTarget ?? (mentions.length > 0 ? "human" : "agent");
+        return insertReviewComment({
+            resourceType: args.resourceType,
+            resourceId: args.resourceId,
+            targetId: args.targetId ?? null,
+            kind: (args.kind ?? "comment"),
+            anchor: args.anchor ?? null,
+            body: args.body,
+            authorEmail: actionCtx?.userEmail ?? null,
+            authorName: args.authorName ?? actionCtx?.userEmail ?? null,
+            createdBy: actorKindFromContext(actionCtx),
+            resolutionTarget,
+            mentions,
+            ownerEmail: access.ownerEmail ?? actionCtx?.userEmail ?? null,
+            orgId: access.orgId ?? actionCtx?.orgId ?? null,
+            visibility: normalizeReviewVisibility(access.visibility),
+            metadata: args.metadata,
+        });
+    },
+    audit: {
+        target: (args, result) => {
+            const comment = result;
+            return {
+                type: args.resourceType,
+                id: args.resourceId,
+                ownerEmail: comment.ownerEmail,
+                orgId: comment.orgId,
+                visibility: comment.visibility,
+            };
+        },
+    },
+});
+function actorKindFromContext(ctx) {
+    const caller = typeof ctx?.caller === "string" ? ctx.caller : "";
+    if (caller === "agent" || caller === "tool") {
+        return "agent";
+    }
+    return ctx?.userEmail ? "human" : "system";
+}
+//# sourceMappingURL=create-review-comment.js.map

package/dist/review/actions/create-review-comment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-review-comment.js","sourceRoot":"","sources":["../../../src/review/actions/create-review-comment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAOlD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1C,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC;QACJ,SAAS;QACT,YAAY;QACZ,YAAY;QACZ,UAAU;QACV,UAAU;QACV,QAAQ;KACT,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,wEAAwE;IAC1E,MAAM;IACN,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,GAAwC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,SAAS,EACT,QAAQ,CACT,CAAC;QACF,MAAM,QAAQ,GAAG,uBAAuB,CAAC;YACvC,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzC,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,gBAAgB,GACpB,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAErE,OAAO,mBAAmB,CAAC;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAsB;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI;YACzC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE,SAAS,IAAI,IAAI;YAC3D,SAAS,EAAE,oBAAoB,CAAC,SAAS,CAAC;YAC1C,gBAAgB;YAChB,QAAQ;YACR,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS,EAAE,SAAS,IAAI,IAAI;YAC7D,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS,EAAE,KAAK,IAAI,IAAI;YAC/C,UAAU,EAAE,yBAAyB,CAAC,MAAM,CAAC,UAAU,CAAC;YACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,EAAE;QACL,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,OAAO,GAAG,MAIf,CAAC;YACF,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,EAAE,EAAE,IAAI,CAAC,UAAU;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC;QACJ,CAAC;KACF;CACF,CAAC,CAAC;AAEH,SAAS,oBAAoB,CAC3B,GAAsC;IAEtC,MAAM,MAAM,GAAG,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7C,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport { extractReviewMentions, normalizeReviewMentions } from \"../mentions.js\";\nimport {\n  assertReviewableResourceAccess,\n  normalizeReviewVisibility,\n} from \"../registry.js\";\nimport { insertReviewComment } from \"../store.js\";\nimport type {\n  ReviewActorKind,\n  ReviewCommentKind,\n  ReviewResourceContext,\n} from \"../types.js\";\n\nconst mentionSchema = z.object({\n  label: z.string().min(1),\n  email: z.string().email().nullable().optional(),\n  id: z.string().nullable().optional(),\n});\n\nconst schema = z.object({\n  resourceType: z.string().min(1),\n  resourceId: z.string().min(1),\n  targetId: z.string().nullable().optional(),\n  kind: z\n    .enum([\n      \"comment\",\n      \"annotation\",\n      \"correction\",\n      \"question\",\n      \"decision\",\n      \"review\",\n    ])\n    .optional(),\n  anchor: z.unknown().nullable().optional(),\n  body: z.string().min(1),\n  authorName: z.string().nullable().optional(),\n  resolutionTarget: z.enum([\"agent\", \"human\"]).nullable().optional(),\n  mentions: z.array(mentionSchema).optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport default defineAction({\n  description:\n    \"Create an inline comment, annotation, or review thread for a resource.\",\n  schema,\n  run: async (args, ctx) => {\n    const actionCtx = ctx as ReviewResourceContext | undefined;\n    const access = await assertReviewableResourceAccess(\n      args.resourceType,\n      args.resourceId,\n      actionCtx,\n      \"viewer\",\n    );\n    const mentions = normalizeReviewMentions([\n      ...normalizeReviewMentions(args.mentions),\n      ...extractReviewMentions(args.body),\n    ]);\n    const resolutionTarget =\n      args.resolutionTarget ?? (mentions.length > 0 ? \"human\" : \"agent\");\n\n    return insertReviewComment({\n      resourceType: args.resourceType,\n      resourceId: args.resourceId,\n      targetId: args.targetId ?? null,\n      kind: (args.kind ?? \"comment\") as ReviewCommentKind,\n      anchor: args.anchor ?? null,\n      body: args.body,\n      authorEmail: actionCtx?.userEmail ?? null,\n      authorName: args.authorName ?? actionCtx?.userEmail ?? null,\n      createdBy: actorKindFromContext(actionCtx),\n      resolutionTarget,\n      mentions,\n      ownerEmail: access.ownerEmail ?? actionCtx?.userEmail ?? null,\n      orgId: access.orgId ?? actionCtx?.orgId ?? null,\n      visibility: normalizeReviewVisibility(access.visibility),\n      metadata: args.metadata,\n    });\n  },\n  audit: {\n    target: (args, result) => {\n      const comment = result as {\n        ownerEmail?: string | null;\n        orgId?: string | null;\n        visibility?: \"private\" | \"org\" | \"public\";\n      };\n      return {\n        type: args.resourceType,\n        id: args.resourceId,\n        ownerEmail: comment.ownerEmail,\n        orgId: comment.orgId,\n        visibility: comment.visibility,\n      };\n    },\n  },\n});\n\nfunction actorKindFromContext(\n  ctx: ReviewResourceContext | undefined,\n): ReviewActorKind {\n  const caller = typeof ctx?.caller === \"string\" ? ctx.caller : \"\";\n  if (caller === \"agent\" || caller === \"tool\") {\n    return \"agent\";\n  }\n  return ctx?.userEmail ? \"human\" : \"system\";\n}\n"]}

package/dist/review/actions/delete-review-comment.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    resourceType: string;
+    resourceId: string;
+    commentId: string;
+}, {
+    commentId: string;
+    deleted: boolean;
+}>;
+export default _default;
+//# sourceMappingURL=delete-review-comment.d.ts.map

package/dist/review/actions/delete-review-comment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-review-comment.d.ts","sourceRoot":"","sources":["../../../src/review/actions/delete-review-comment.ts"],"names":[],"mappings":""}

package/dist/review/actions/delete-review-comment.js

@@ -0,0 +1,45 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { ForbiddenError } from "../../sharing/access.js";
+import { roleSatisfies } from "../../sharing/schema.js";
+import { resolveReviewableResourceAccess } from "../registry.js";
+import { deleteReviewComment, getReviewCommentById } from "../store.js";
+const schema = z.object({
+    resourceType: z.string().min(1),
+    resourceId: z.string().min(1),
+    commentId: z.string().min(1),
+});
+export default defineAction({
+    description: "Soft-delete a review comment.",
+    schema,
+    run: async (args, ctx) => {
+        const actionCtx = ctx;
+        const scope = {
+            userEmail: actionCtx?.userEmail ?? null,
+            orgId: actionCtx?.orgId ?? null,
+        };
+        const access = await resolveReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx);
+        const comment = await getReviewCommentById(args.commentId, scope, {
+            bypassScope: Boolean(access),
+        });
+        if (!comment ||
+            comment.resourceType !== args.resourceType ||
+            comment.resourceId !== args.resourceId) {
+            throw new Error("Review comment not found");
+        }
+        const isAuthor = Boolean(actionCtx?.userEmail) &&
+            comment.authorEmail === actionCtx?.userEmail;
+        if (!isAuthor && (!access || !roleSatisfies(access.role, "editor"))) {
+            throw new ForbiddenError("Not allowed to delete this review comment");
+        }
+        await deleteReviewComment(comment.id, actionCtx?.userEmail ?? null);
+        return { commentId: comment.id, deleted: true };
+    },
+    audit: {
+        target: (args) => ({
+            type: args.resourceType,
+            id: args.resourceId,
+        }),
+    },
+});
+//# sourceMappingURL=delete-review-comment.js.map

package/dist/review/actions/delete-review-comment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-review-comment.js","sourceRoot":"","sources":["../../../src/review/actions/delete-review-comment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGxE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,+BAA+B;IAC5C,MAAM;IACN,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,GAAwC,CAAC;QAC3D,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI;YACvC,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,IAAI;SAChC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAClD,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,SAAS,CACV,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE;YAChE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QACH,IACE,CAAC,OAAO;YACR,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YAC1C,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EACtC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,QAAQ,GACZ,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;YAC7B,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,SAAS,CAAC;QAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,cAAc,CAAC,2CAA2C,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;QACpE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,KAAK,EAAE;QACL,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjB,IAAI,EAAE,IAAI,CAAC,YAAY;YACvB,EAAE,EAAE,IAAI,CAAC,UAAU;SACpB,CAAC;KACH;CACF,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport { ForbiddenError } from \"../../sharing/access.js\";\nimport { roleSatisfies } from \"../../sharing/schema.js\";\nimport { resolveReviewableResourceAccess } from \"../registry.js\";\nimport { deleteReviewComment, getReviewCommentById } from \"../store.js\";\nimport type { ReviewResourceContext } from \"../types.js\";\n\nconst schema = z.object({\n  resourceType: z.string().min(1),\n  resourceId: z.string().min(1),\n  commentId: z.string().min(1),\n});\n\nexport default defineAction({\n  description: \"Soft-delete a review comment.\",\n  schema,\n  run: async (args, ctx) => {\n    const actionCtx = ctx as ReviewResourceContext | undefined;\n    const scope = {\n      userEmail: actionCtx?.userEmail ?? null,\n      orgId: actionCtx?.orgId ?? null,\n    };\n    const access = await resolveReviewableResourceAccess(\n      args.resourceType,\n      args.resourceId,\n      actionCtx,\n    );\n    const comment = await getReviewCommentById(args.commentId, scope, {\n      bypassScope: Boolean(access),\n    });\n    if (\n      !comment ||\n      comment.resourceType !== args.resourceType ||\n      comment.resourceId !== args.resourceId\n    ) {\n      throw new Error(\"Review comment not found\");\n    }\n    const isAuthor =\n      Boolean(actionCtx?.userEmail) &&\n      comment.authorEmail === actionCtx?.userEmail;\n    if (!isAuthor && (!access || !roleSatisfies(access.role, \"editor\"))) {\n      throw new ForbiddenError(\"Not allowed to delete this review comment\");\n    }\n    await deleteReviewComment(comment.id, actionCtx?.userEmail ?? null);\n    return { commentId: comment.id, deleted: true };\n  },\n  audit: {\n    target: (args) => ({\n      type: args.resourceType,\n      id: args.resourceId,\n    }),\n  },\n});\n"]}

package/dist/review/actions/get-review-feedback.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    resourceType: string;
+    resourceId: string;
+    includeHumanTargeted?: boolean;
+    limit?: number;
+}, {
+    comments: import("../types.js").ReviewComment[];
+}>;
+export default _default;
+//# sourceMappingURL=get-review-feedback.d.ts.map

package/dist/review/actions/get-review-feedback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-review-feedback.d.ts","sourceRoot":"","sources":["../../../src/review/actions/get-review-feedback.ts"],"names":[],"mappings":""}