@agent-native/core 0.90.2 → 0.90.4

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,+CAA+C;AAE/C,0BAA0B;AAC1B,OAAO,EACL,4BAA4B,EAU5B,aAAa;AACb,6DAA6D;AAC7D,QAAQ,GAIT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EAOtB,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,GAQ9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,iCAAiC,GAElC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,UAAU,GAKX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kCAAkC,EAClC,qCAAqC,EACrC,kCAAkC,EAClC,mCAAmC,EACnC,wCAAwC,GAEzC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,GAe1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAE9B,SAAS;AACT,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,GAKX,MAAM,mBAAmB,CAAC;AAE3B,SAAS;AACT,EAAE;AACF,8EAA8E;AAC9E,mFAAmF;AACnF,iFAAiF;AACjF,8EAA8E;AAC9E,wEAAwE;AACxE,6EAA6E;AAC7E,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,6BAA6B;AAC7B,EAAE;AACF,+DAA+D;AAE/D,sBAAsB;AACtB,OAAO,EACL,SAAS,GAGV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,qBAAqB;AACrB,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,gCAAgC,EAChC,WAAW,EACX,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,4BAA4B,EAC5B,eAAe,EACf,cAAc,EACd,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,GAY7B,MAAM,sBAAsB,CAAC;AAE9B,uBAAuB;AACvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,2BAA2B,EAC3B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,iBAAiB,GAQlB,MAAM,kBAAkB,CAAC;AAE1B,mDAAmD;AACnD,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,sBAAsB,EACtB,2BAA2B,EAC3B,4CAA4C,EAC5C,6BAA6B,EAC7B,wBAAwB,EACxB,0CAA0C,EAC1C,2CAA2C,EAC3C,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,0CAA0C,EAC1C,6CAA6C,EAC7C,8BAA8B,EAC9B,yBAAyB,EAmCzB,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAE1C,iDAAiD;AACjD,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,8BAA8B,EAC9B,2BAA2B,EAC3B,oBAAoB,EACpB,kCAAkC,EAClC,iCAAiC,EACjC,iBAAiB,EACjB,8BAA8B,EAC9B,+BAA+B,EAC/B,mBAAmB,EACnB,gCAAgC,EAChC,6CAA6C,EAC7C,2CAA2C,EAC3C,sBAAsB,EACtB,mCAAmC,GA2BpC,MAAM,wBAAwB,CAAC;AAEhC,UAAU;AACV,OAAO,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,IAAI,GACL,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,wEAAwE;AACxE,mCAAmC;AACnC,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAMhB,MAAM,oBAAoB,CAAC","sourcesContent":["// Framework for agent-native apps.\n// Import everything from \"@agent-native/core\".\n\n// Agent (production mode)\nexport {\n  createProductionAgentHandler,\n  type ActionEntry,\n  type ScriptEntry,\n  type ProductionAgentOptions,\n  type ActionTool,\n  type ScriptTool,\n  type AgentMessage,\n  type AgentChatRequest,\n  type AgentChatEvent,\n  type AgentChatAttachment,\n  DEFAULT_MODEL,\n  // In-loop processors (observers/guardrails for runAgentLoop)\n  TripWire,\n  type Processor,\n  type ProcessorState,\n  type ProcessorAbort,\n} from \"./agent/index.js\";\nexport {\n  defineAction,\n  AgentActionStopError,\n  isAgentActionStopError,\n  type ActionDefinition,\n  type ActionHttpConfig,\n  type AgentActionStopOptions,\n  type PublicAgentActionConfig,\n  type ActionDeepLink,\n  type ActionLinkBuilder,\n  MCP_APP_EXTENSION_ID,\n  MCP_APP_MIME_TYPE,\n  MCP_APP_RESOURCE_URI_META_KEY,\n  type ActionMcpAppConfig,\n  type ActionMcpAppCsp,\n  type ActionMcpAppCspBuilder,\n  type ActionMcpAppHtmlBuilder,\n  type ActionMcpAppPermissions,\n  type ActionMcpAppResourceConfig,\n  type ActionMcpAppResourceMeta,\n} from \"./action.js\";\nexport {\n  embedApp,\n  MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n  type EmbedAppOptions,\n} from \"./mcp/embed-app.js\";\nexport {\n  embedRoute,\n  type EmbedRouteContext,\n  type EmbedRouteOptions,\n  type EmbedRoutePathBuilder,\n  type EmbedRouteResult,\n} from \"./mcp/embed-route.js\";\nexport {\n  ACTION_CHAT_UI_DATA_CHART_RENDERER,\n  ACTION_CHAT_UI_DATA_INSIGHTS_RENDERER,\n  ACTION_CHAT_UI_DATA_TABLE_RENDERER,\n  ACTION_CHAT_UI_DATA_WIDGET_RENDERER,\n  ACTION_CHAT_UI_INLINE_EXTENSION_RENDERER,\n  type ActionChatUIConfig,\n} from \"./action-ui.js\";\nexport {\n  DATA_CHART_WIDGET,\n  DATA_INSIGHTS_WIDGET,\n  DATA_TABLE_WIDGET,\n  createDataChartWidgetResult,\n  createDataInsightsWidgetResult,\n  createDataTableWidgetResult,\n  dataChartWidgetResultSchema,\n  dataChartWidgetSchema,\n  dataInsightsWidgetResultSchema,\n  dataTableWidgetResultSchema,\n  dataTableWidgetSchema,\n  dataWidgetResultSchema,\n  isDataChartWidget,\n  isDataTableWidget,\n  isDataWidgetResult,\n  normalizeDataWidgetKind,\n  normalizeDataWidgetResult,\n  type DataChartSeriesDefinition,\n  type DataChartWidget,\n  type DataChartWidgetResult,\n  type DataChartWidgetResultInput,\n  type DataInsightsWidgetResult,\n  type DataInsightsWidgetResultInput,\n  type DataTableColumn,\n  type DataTableWidget,\n  type DataTableWidgetResult,\n  type DataTableWidgetResultInput,\n  type DataWidgetDisplay,\n  type DataWidgetKind,\n  type DataWidgetResult,\n  type DataWidgetResultMetadata,\n} from \"./data-widgets/index.js\";\nexport { createDevScriptRegistry } from \"./scripts/dev/index.js\";\nexport {\n  createAgentChatPlugin,\n  defaultAgentChatPlugin,\n  type AgentChatPluginOptions,\n} from \"./server/agent-chat-plugin.js\";\nexport {\n  createAgentNativeEmbeddedPlugin,\n  mountAgentNativeEmbedded,\n  type AgentNativeEmbeddedPluginOptions,\n} from \"./server/embedded.js\";\n\n// Server\nexport {\n  createServer,\n  createSSEHandler,\n  defineNitroPlugin,\n  autoMountAuth,\n  getSession,\n  type CreateServerOptions,\n  type SSEHandlerOptions,\n  type AuthSession,\n  type AuthOptions,\n} from \"./server/index.js\";\n\n// Client\n//\n// IMPORTANT: this top-level entry (the package `default`/Node condition) must\n// stay server-safe. It is what `import { defineAction } from \"@agent-native/core\"`\n// resolves to in a headless / Node / SSR context, where React, react-router, and\n// @tanstack/react-query are NOT installed. The React client surface therefore\n// lives behind the `@agent-native/core/client` subpath instead of being\n// re-exported here — re-exporting \"./client/index.js\" from this module would\n// eagerly pull route-state.ts → \"@tanstack/react-query\" into the load graph and\n// crash any headless app at module load.\n//\n// Browser bundlers resolve \"@agent-native/core\" to the `browser` condition\n// (./index.browser.ts), which re-exports the client surface, so UI code that\n// imports client helpers from the bare specifier keeps working in the browser.\n// Code that runs through the Node entry (SSR, scripts, headless) must import\n// client helpers explicitly:\n//\n//   import { useDbSync, cn } from \"@agent-native/core/client\";\n\n// Shared (isomorphic)\nexport {\n  agentChat,\n  type AgentChatCallOptions,\n  type AgentChatResponse,\n} from \"./shared/index.js\";\nexport {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_SESSION_COOKIE,\n  EMBED_START_PATH,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"./shared/embed-auth.js\";\n\n// Agent Web surfaces\nexport {\n  AGENT_WEB_CRAWLER_CATEGORIES,\n  AGENT_WEB_CRAWLER_USER_AGENTS,\n  DEFAULT_AGENT_WEB_CRAWLER_POLICY,\n  absoluteUrl,\n  agentWebConfigFromPackageJson,\n  buildAgentWebStaticFiles,\n  buildBaseJsonLd,\n  buildLlmsFullTxt,\n  buildLlmsTxt,\n  buildMarkdownResponseHeaders,\n  buildPageJsonLd,\n  buildRobotsTxt,\n  buildSitemapXml,\n  deriveAgentWebPublicRoutes,\n  estimateMarkdownTokens,\n  markdownFilePathForPage,\n  markdownUrlForPage,\n  normalizeAgentWebConfig,\n  pathPatternMatches,\n  resolveAgentWebCrawlerPolicy,\n  type AgentWebConfig,\n  type AgentWebCrawlerCategory,\n  type AgentWebCrawlerDecision,\n  type AgentWebCrawlerOverrides,\n  type AgentWebCrawlerPolicy,\n  type AgentWebInputConfig,\n  type AgentWebPage,\n  type AgentWebStaticFile,\n  type BuildAgentWebStaticFilesOptions,\n  type DeriveAgentWebPublicRoutesOptions,\n  type MarkdownResponseHeadersOptions,\n} from \"./agent-web/index.js\";\n\n// Token usage tracking\nexport {\n  recordUsage,\n  getUsageSummary,\n  getUserUsageCents,\n  calculateCost,\n  usageBillingForEngine,\n  builderCreditsFromCostCents,\n  BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER,\n  BUILDER_AGENT_CREDITS_PER_USD,\n  BUILDER_CREDIT_USAGE_BILLING,\n  USD_USAGE_BILLING,\n  type UsageRecord,\n  type UsageSummary,\n  type UsageBillingMode,\n  type UsageBillingUnit,\n  type UsageBucket,\n  type DailyBucket,\n  type UsageRecentEntry,\n} from \"./usage/store.js\";\n\n// Workspace-scoped third-party connection metadata\nexport {\n  deleteWorkspaceConnection,\n  getWorkspaceConnectionAppAccess,\n  getWorkspaceConnection,\n  getWorkspaceConnectionGrant,\n  listWorkspaceConnectionProviderCatalogForApp,\n  listWorkspaceConnectionGrants,\n  listWorkspaceConnections,\n  resolveWorkspaceConnectionCredentialForApp,\n  resolveWorkspaceConnectionCredentialsForApp,\n  revokeWorkspaceConnectionGrant,\n  serializeWorkspaceConnectionGrant,\n  serializeWorkspaceConnection,\n  summarizeWorkspaceConnectionProviderForApp,\n  summarizeWorkspaceConnectionProviderReadiness,\n  upsertWorkspaceConnectionGrant,\n  upsertWorkspaceConnection,\n  type ListWorkspaceConnectionProviderCatalogForAppOptions,\n  type ListWorkspaceConnectionGrantsOptions,\n  type ListWorkspaceConnectionsOptions,\n  type ResolveWorkspaceConnectionCredentialForAppOptions,\n  type ResolveWorkspaceConnectionCredentialsForAppOptions,\n  type SerializedWorkspaceConnectionGrant,\n  type SerializedWorkspaceConnection,\n  type SummarizeWorkspaceConnectionProviderForAppOptions,\n  type SummarizeWorkspaceConnectionProviderReadinessOptions,\n  type UpsertWorkspaceConnectionGrantInput,\n  type UpsertWorkspaceConnectionInput,\n  type WorkspaceConnectionAppAccess,\n  type WorkspaceConnectionAppAccessMode,\n  type WorkspaceConnection,\n  type WorkspaceConnectionCredentialBackend,\n  type WorkspaceConnectionCredentialProvenance,\n  type WorkspaceConnectionCredentialRef,\n  type WorkspaceConnectionCredentialResolution,\n  type WorkspaceConnectionCredentialResolutionCheck,\n  type WorkspaceConnectionCredentialResolutionStatus,\n  type WorkspaceConnectionCredentialsResolution,\n  type WorkspaceConnectionExplicitGrantSummary,\n  type WorkspaceConnectionForAppSummary,\n  type WorkspaceConnectionGrant,\n  type WorkspaceConnectionGrantAvailability,\n  type WorkspaceConnectionGrantState,\n  type WorkspaceConnectionProviderAppSummary,\n  type WorkspaceConnectionProviderLike,\n  type WorkspaceConnectionProviderCatalogForApp,\n  type WorkspaceConnectionProviderCatalogForAppItem,\n  type WorkspaceConnectionProviderReadiness,\n  type WorkspaceConnectionProviderReadinessStatus,\n  type WorkspaceConnectionPublicCredentialRef,\n  type WorkspaceConnectionStatus,\n  workspaceConnectionIsAvailableToApp,\n} from \"./workspace-connections/index.js\";\n\n// Reusable workspace connection provider catalog\nexport {\n  PROVIDER_READERS,\n  ProviderReaderRuntimeError,\n  WORKSPACE_CONNECTION_PROVIDERS,\n  createProviderReaderRuntime,\n  defineProviderReader,\n  defineProviderReaderImplementation,\n  defineWorkspaceConnectionProvider,\n  getProviderReader,\n  getWorkspaceConnectionProvider,\n  isWorkspaceConnectionProviderId,\n  listProviderReaders,\n  listWorkspaceConnectionProviders,\n  listWorkspaceConnectionProvidersForCapability,\n  listWorkspaceConnectionProvidersForTemplate,\n  providerReaderSupports,\n  workspaceConnectionProviderSupports,\n  type ListWorkspaceConnectionProvidersOptions,\n  type ListProviderReadersOptions,\n  type ProviderReaderCapability,\n  type ProviderReaderCredentialRequirement,\n  type ProviderReaderDefinition,\n  type ProviderReaderImplementationStatus,\n  type ProviderReaderOperation,\n  type ProviderReaderOperationDescriptor,\n  type ProviderReaderOperationParameter,\n  type ProviderReaderRequest,\n  type ProviderReaderRuntime,\n  type ProviderReaderRuntimeConnection,\n  type ProviderReaderRuntimeConnectionResolverOptions,\n  type ProviderReaderRuntimeContext,\n  type ProviderReaderRuntimeCredentialsResolverOptions,\n  type ProviderReaderRuntimeErrorCode,\n  type ProviderReaderRuntimeHandler,\n  type ProviderReaderRuntimeImplementation,\n  type ProviderReaderRuntimeItem,\n  type ProviderReaderRuntimeOptions,\n  type ProviderReaderRuntimeResponse,\n  type WorkspaceConnectionCapability,\n  type WorkspaceConnectionCredentialKey,\n  type WorkspaceConnectionProvider,\n  type WorkspaceConnectionProviderId,\n  type WorkspaceConnectionTemplateUse,\n} from \"./connections/index.js\";\n\n// Scripts\nexport {\n  runScript,\n  loadEnv,\n  parseArgs,\n  camelCaseArgs,\n  isValidPath,\n  isValidProjectPath,\n  ensureDir,\n  fail,\n} from \"./scripts/index.js\";\n\n// Secrets registry — import from \"@agent-native/core/secrets\" when possible\n// (the subpath keeps the top-level entry point lean), but re-export the\n// public API here for convenience.\nexport {\n  registerRequiredSecret,\n  listRequiredSecrets,\n  getRequiredSecret,\n  readAppSecret,\n  writeAppSecret,\n  deleteAppSecret,\n  type RegisteredSecret,\n  type SecretScope,\n  type SecretKind,\n  type SecretValidator,\n  type SecretRef,\n} from \"./secrets/index.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,+CAA+C;AAE/C,0BAA0B;AAC1B,OAAO,EACL,4BAA4B,EAU5B,aAAa;AACb,6DAA6D;AAC7D,QAAQ,GAIT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EAOtB,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,GAQ9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,iCAAiC,GAElC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,UAAU,GAKX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kCAAkC,EAClC,qCAAqC,EACrC,kCAAkC,EAClC,mCAAmC,EACnC,wCAAwC,GAEzC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,GAe1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAE9B,SAAS;AACT,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,GAKX,MAAM,mBAAmB,CAAC;AAE3B,SAAS;AACT,EAAE;AACF,8EAA8E;AAC9E,mFAAmF;AACnF,iFAAiF;AACjF,8EAA8E;AAC9E,wEAAwE;AACxE,6EAA6E;AAC7E,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,6BAA6B;AAC7B,EAAE;AACF,+DAA+D;AAE/D,sBAAsB;AACtB,OAAO,EACL,SAAS,GAGV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,qBAAqB;AACrB,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,gCAAgC,EAChC,WAAW,EACX,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,4BAA4B,EAC5B,eAAe,EACf,cAAc,EACd,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,GAY7B,MAAM,sBAAsB,CAAC;AAE9B,uBAAuB;AACvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,2BAA2B,EAC3B,sCAAsC,EACtC,6BAA6B,EAC7B,4BAA4B,EAC5B,iBAAiB,GAQlB,MAAM,kBAAkB,CAAC;AAE1B,mDAAmD;AACnD,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,sBAAsB,EACtB,2BAA2B,EAC3B,4CAA4C,EAC5C,6BAA6B,EAC7B,wBAAwB,EACxB,0CAA0C,EAC1C,2CAA2C,EAC3C,8BAA8B,EAC9B,iCAAiC,EACjC,4BAA4B,EAC5B,0CAA0C,EAC1C,6CAA6C,EAC7C,8BAA8B,EAC9B,yBAAyB,EAmCzB,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAE1C,iDAAiD;AACjD,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,8BAA8B,EAC9B,2BAA2B,EAC3B,oBAAoB,EACpB,kCAAkC,EAClC,iCAAiC,EACjC,iBAAiB,EACjB,8BAA8B,EAC9B,+BAA+B,EAC/B,mBAAmB,EACnB,gCAAgC,EAChC,6CAA6C,EAC7C,2CAA2C,EAC3C,sBAAsB,EACtB,mCAAmC,GA2BpC,MAAM,wBAAwB,CAAC;AAEhC,UAAU;AACV,OAAO,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,IAAI,GACL,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,wEAAwE;AACxE,mCAAmC;AACnC,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAMhB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,OAAO,EACL,yCAAyC,GAE1C,MAAM,8BAA8B,CAAC","sourcesContent":["// Framework for agent-native apps.\n// Import everything from \"@agent-native/core\".\n\n// Agent (production mode)\nexport {\n  createProductionAgentHandler,\n  type ActionEntry,\n  type ScriptEntry,\n  type ProductionAgentOptions,\n  type ActionTool,\n  type ScriptTool,\n  type AgentMessage,\n  type AgentChatRequest,\n  type AgentChatEvent,\n  type AgentChatAttachment,\n  DEFAULT_MODEL,\n  // In-loop processors (observers/guardrails for runAgentLoop)\n  TripWire,\n  type Processor,\n  type ProcessorState,\n  type ProcessorAbort,\n} from \"./agent/index.js\";\nexport {\n  defineAction,\n  AgentActionStopError,\n  isAgentActionStopError,\n  type ActionDefinition,\n  type ActionHttpConfig,\n  type AgentActionStopOptions,\n  type PublicAgentActionConfig,\n  type ActionDeepLink,\n  type ActionLinkBuilder,\n  MCP_APP_EXTENSION_ID,\n  MCP_APP_MIME_TYPE,\n  MCP_APP_RESOURCE_URI_META_KEY,\n  type ActionMcpAppConfig,\n  type ActionMcpAppCsp,\n  type ActionMcpAppCspBuilder,\n  type ActionMcpAppHtmlBuilder,\n  type ActionMcpAppPermissions,\n  type ActionMcpAppResourceConfig,\n  type ActionMcpAppResourceMeta,\n} from \"./action.js\";\nexport {\n  embedApp,\n  MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n  type EmbedAppOptions,\n} from \"./mcp/embed-app.js\";\nexport {\n  embedRoute,\n  type EmbedRouteContext,\n  type EmbedRouteOptions,\n  type EmbedRoutePathBuilder,\n  type EmbedRouteResult,\n} from \"./mcp/embed-route.js\";\nexport {\n  ACTION_CHAT_UI_DATA_CHART_RENDERER,\n  ACTION_CHAT_UI_DATA_INSIGHTS_RENDERER,\n  ACTION_CHAT_UI_DATA_TABLE_RENDERER,\n  ACTION_CHAT_UI_DATA_WIDGET_RENDERER,\n  ACTION_CHAT_UI_INLINE_EXTENSION_RENDERER,\n  type ActionChatUIConfig,\n} from \"./action-ui.js\";\nexport {\n  DATA_CHART_WIDGET,\n  DATA_INSIGHTS_WIDGET,\n  DATA_TABLE_WIDGET,\n  createDataChartWidgetResult,\n  createDataInsightsWidgetResult,\n  createDataTableWidgetResult,\n  dataChartWidgetResultSchema,\n  dataChartWidgetSchema,\n  dataInsightsWidgetResultSchema,\n  dataTableWidgetResultSchema,\n  dataTableWidgetSchema,\n  dataWidgetResultSchema,\n  isDataChartWidget,\n  isDataTableWidget,\n  isDataWidgetResult,\n  normalizeDataWidgetKind,\n  normalizeDataWidgetResult,\n  type DataChartSeriesDefinition,\n  type DataChartWidget,\n  type DataChartWidgetResult,\n  type DataChartWidgetResultInput,\n  type DataInsightsWidgetResult,\n  type DataInsightsWidgetResultInput,\n  type DataTableColumn,\n  type DataTableWidget,\n  type DataTableWidgetResult,\n  type DataTableWidgetResultInput,\n  type DataWidgetDisplay,\n  type DataWidgetKind,\n  type DataWidgetResult,\n  type DataWidgetResultMetadata,\n} from \"./data-widgets/index.js\";\nexport { createDevScriptRegistry } from \"./scripts/dev/index.js\";\nexport {\n  createAgentChatPlugin,\n  defaultAgentChatPlugin,\n  type AgentChatPluginOptions,\n} from \"./server/agent-chat-plugin.js\";\nexport {\n  createAgentNativeEmbeddedPlugin,\n  mountAgentNativeEmbedded,\n  type AgentNativeEmbeddedPluginOptions,\n} from \"./server/embedded.js\";\n\n// Server\nexport {\n  createServer,\n  createSSEHandler,\n  defineNitroPlugin,\n  autoMountAuth,\n  getSession,\n  type CreateServerOptions,\n  type SSEHandlerOptions,\n  type AuthSession,\n  type AuthOptions,\n} from \"./server/index.js\";\n\n// Client\n//\n// IMPORTANT: this top-level entry (the package `default`/Node condition) must\n// stay server-safe. It is what `import { defineAction } from \"@agent-native/core\"`\n// resolves to in a headless / Node / SSR context, where React, react-router, and\n// @tanstack/react-query are NOT installed. The React client surface therefore\n// lives behind the `@agent-native/core/client` subpath instead of being\n// re-exported here — re-exporting \"./client/index.js\" from this module would\n// eagerly pull route-state.ts → \"@tanstack/react-query\" into the load graph and\n// crash any headless app at module load.\n//\n// Browser bundlers resolve \"@agent-native/core\" to the `browser` condition\n// (./index.browser.ts), which re-exports the client surface, so UI code that\n// imports client helpers from the bare specifier keeps working in the browser.\n// Code that runs through the Node entry (SSR, scripts, headless) must import\n// client helpers explicitly:\n//\n//   import { useDbSync, cn } from \"@agent-native/core/client\";\n\n// Shared (isomorphic)\nexport {\n  agentChat,\n  type AgentChatCallOptions,\n  type AgentChatResponse,\n} from \"./shared/index.js\";\nexport {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_SESSION_COOKIE,\n  EMBED_START_PATH,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"./shared/embed-auth.js\";\n\n// Agent Web surfaces\nexport {\n  AGENT_WEB_CRAWLER_CATEGORIES,\n  AGENT_WEB_CRAWLER_USER_AGENTS,\n  DEFAULT_AGENT_WEB_CRAWLER_POLICY,\n  absoluteUrl,\n  agentWebConfigFromPackageJson,\n  buildAgentWebStaticFiles,\n  buildBaseJsonLd,\n  buildLlmsFullTxt,\n  buildLlmsTxt,\n  buildMarkdownResponseHeaders,\n  buildPageJsonLd,\n  buildRobotsTxt,\n  buildSitemapXml,\n  deriveAgentWebPublicRoutes,\n  estimateMarkdownTokens,\n  markdownFilePathForPage,\n  markdownUrlForPage,\n  normalizeAgentWebConfig,\n  pathPatternMatches,\n  resolveAgentWebCrawlerPolicy,\n  type AgentWebConfig,\n  type AgentWebCrawlerCategory,\n  type AgentWebCrawlerDecision,\n  type AgentWebCrawlerOverrides,\n  type AgentWebCrawlerPolicy,\n  type AgentWebInputConfig,\n  type AgentWebPage,\n  type AgentWebStaticFile,\n  type BuildAgentWebStaticFilesOptions,\n  type DeriveAgentWebPublicRoutesOptions,\n  type MarkdownResponseHeadersOptions,\n} from \"./agent-web/index.js\";\n\n// Token usage tracking\nexport {\n  recordUsage,\n  getUsageSummary,\n  getUserUsageCents,\n  calculateCost,\n  usageBillingForEngine,\n  builderCreditsFromCostCents,\n  BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER,\n  BUILDER_AGENT_CREDITS_PER_USD,\n  BUILDER_CREDIT_USAGE_BILLING,\n  USD_USAGE_BILLING,\n  type UsageRecord,\n  type UsageSummary,\n  type UsageBillingMode,\n  type UsageBillingUnit,\n  type UsageBucket,\n  type DailyBucket,\n  type UsageRecentEntry,\n} from \"./usage/store.js\";\n\n// Workspace-scoped third-party connection metadata\nexport {\n  deleteWorkspaceConnection,\n  getWorkspaceConnectionAppAccess,\n  getWorkspaceConnection,\n  getWorkspaceConnectionGrant,\n  listWorkspaceConnectionProviderCatalogForApp,\n  listWorkspaceConnectionGrants,\n  listWorkspaceConnections,\n  resolveWorkspaceConnectionCredentialForApp,\n  resolveWorkspaceConnectionCredentialsForApp,\n  revokeWorkspaceConnectionGrant,\n  serializeWorkspaceConnectionGrant,\n  serializeWorkspaceConnection,\n  summarizeWorkspaceConnectionProviderForApp,\n  summarizeWorkspaceConnectionProviderReadiness,\n  upsertWorkspaceConnectionGrant,\n  upsertWorkspaceConnection,\n  type ListWorkspaceConnectionProviderCatalogForAppOptions,\n  type ListWorkspaceConnectionGrantsOptions,\n  type ListWorkspaceConnectionsOptions,\n  type ResolveWorkspaceConnectionCredentialForAppOptions,\n  type ResolveWorkspaceConnectionCredentialsForAppOptions,\n  type SerializedWorkspaceConnectionGrant,\n  type SerializedWorkspaceConnection,\n  type SummarizeWorkspaceConnectionProviderForAppOptions,\n  type SummarizeWorkspaceConnectionProviderReadinessOptions,\n  type UpsertWorkspaceConnectionGrantInput,\n  type UpsertWorkspaceConnectionInput,\n  type WorkspaceConnectionAppAccess,\n  type WorkspaceConnectionAppAccessMode,\n  type WorkspaceConnection,\n  type WorkspaceConnectionCredentialBackend,\n  type WorkspaceConnectionCredentialProvenance,\n  type WorkspaceConnectionCredentialRef,\n  type WorkspaceConnectionCredentialResolution,\n  type WorkspaceConnectionCredentialResolutionCheck,\n  type WorkspaceConnectionCredentialResolutionStatus,\n  type WorkspaceConnectionCredentialsResolution,\n  type WorkspaceConnectionExplicitGrantSummary,\n  type WorkspaceConnectionForAppSummary,\n  type WorkspaceConnectionGrant,\n  type WorkspaceConnectionGrantAvailability,\n  type WorkspaceConnectionGrantState,\n  type WorkspaceConnectionProviderAppSummary,\n  type WorkspaceConnectionProviderLike,\n  type WorkspaceConnectionProviderCatalogForApp,\n  type WorkspaceConnectionProviderCatalogForAppItem,\n  type WorkspaceConnectionProviderReadiness,\n  type WorkspaceConnectionProviderReadinessStatus,\n  type WorkspaceConnectionPublicCredentialRef,\n  type WorkspaceConnectionStatus,\n  workspaceConnectionIsAvailableToApp,\n} from \"./workspace-connections/index.js\";\n\n// Reusable workspace connection provider catalog\nexport {\n  PROVIDER_READERS,\n  ProviderReaderRuntimeError,\n  WORKSPACE_CONNECTION_PROVIDERS,\n  createProviderReaderRuntime,\n  defineProviderReader,\n  defineProviderReaderImplementation,\n  defineWorkspaceConnectionProvider,\n  getProviderReader,\n  getWorkspaceConnectionProvider,\n  isWorkspaceConnectionProviderId,\n  listProviderReaders,\n  listWorkspaceConnectionProviders,\n  listWorkspaceConnectionProvidersForCapability,\n  listWorkspaceConnectionProvidersForTemplate,\n  providerReaderSupports,\n  workspaceConnectionProviderSupports,\n  type ListWorkspaceConnectionProvidersOptions,\n  type ListProviderReadersOptions,\n  type ProviderReaderCapability,\n  type ProviderReaderCredentialRequirement,\n  type ProviderReaderDefinition,\n  type ProviderReaderImplementationStatus,\n  type ProviderReaderOperation,\n  type ProviderReaderOperationDescriptor,\n  type ProviderReaderOperationParameter,\n  type ProviderReaderRequest,\n  type ProviderReaderRuntime,\n  type ProviderReaderRuntimeConnection,\n  type ProviderReaderRuntimeConnectionResolverOptions,\n  type ProviderReaderRuntimeContext,\n  type ProviderReaderRuntimeCredentialsResolverOptions,\n  type ProviderReaderRuntimeErrorCode,\n  type ProviderReaderRuntimeHandler,\n  type ProviderReaderRuntimeImplementation,\n  type ProviderReaderRuntimeItem,\n  type ProviderReaderRuntimeOptions,\n  type ProviderReaderRuntimeResponse,\n  type WorkspaceConnectionCapability,\n  type WorkspaceConnectionCredentialKey,\n  type WorkspaceConnectionProvider,\n  type WorkspaceConnectionProviderId,\n  type WorkspaceConnectionTemplateUse,\n} from \"./connections/index.js\";\n\n// Scripts\nexport {\n  runScript,\n  loadEnv,\n  parseArgs,\n  camelCaseArgs,\n  isValidPath,\n  isValidProjectPath,\n  ensureDir,\n  fail,\n} from \"./scripts/index.js\";\n\n// Secrets registry — import from \"@agent-native/core/secrets\" when possible\n// (the subpath keeps the top-level entry point lean), but re-export the\n// public API here for convenience.\nexport {\n  registerRequiredSecret,\n  listRequiredSecrets,\n  getRequiredSecret,\n  readAppSecret,\n  writeAppSecret,\n  deleteAppSecret,\n  type RegisteredSecret,\n  type SecretScope,\n  type SecretKind,\n  type SecretValidator,\n  type SecretRef,\n} from \"./secrets/index.js\";\n\nexport * from \"./history/index.js\";\nexport * from \"./review/index.js\";\nexport * from \"./org-team/index.js\";\nexport * from \"./navigation/index.js\";\nexport * from \"./command-navigation/index.js\";\nexport {\n  registerWorkspaceConnectionOnboardingStep,\n  type RegisterWorkspaceConnectionOnboardingStepOptions,\n} from \"./setup-connections/index.js\";\n"]}

package/dist/navigation/index.d.ts

@@ -0,0 +1,53 @@
+export declare const STANDARD_APP_ROUTES: {
+    readonly home: "/";
+    readonly settings: "/settings";
+    readonly team: "/team";
+};
+export declare const STANDARD_SETTINGS_TABS: {
+    readonly general: "general";
+    readonly agent: "agent";
+    readonly providers: "providers";
+    readonly connections: "connections";
+    readonly secrets: "secrets";
+    readonly team: "team";
+    readonly usage: "usage";
+    readonly language: "language";
+    readonly whatsNew: "whats-new";
+};
+export type StandardAppRouteId = keyof typeof STANDARD_APP_ROUTES;
+export type StandardSettingsTabId = (typeof STANDARD_SETTINGS_TABS)[keyof typeof STANDARD_SETTINGS_TABS];
+export interface BuildStandardAppRouteOptions {
+    settingsTab?: StandardSettingsTabId | string | null;
+    teamInSettings?: boolean;
+}
+export interface BuildResourceRouteOptions {
+    basePath?: string;
+}
+export interface NavigationTarget {
+    app?: string;
+    view: string;
+    params?: Record<string, string | number | boolean | null | undefined>;
+    to?: string;
+}
+export interface NavigationLink extends NavigationTarget {
+    label: string;
+    url: string;
+}
+export type StandardOpenPathRoute = string | ((params: Record<string, string>) => string | null | undefined);
+export interface StandardOpenPathResolverOptions {
+    fallback?: StandardOpenPathRoute;
+}
+export declare function buildSettingsRoute(tab?: StandardSettingsTabId | string | null, basePath?: "/settings"): string;
+export declare function buildTeamRoute(options?: Pick<BuildStandardAppRouteOptions, "teamInSettings">): string;
+export declare function buildStandardAppRoute(route: StandardAppRouteId, options?: BuildStandardAppRouteOptions): string;
+export declare function buildResourceRoute(collection: string, resourceId: string, options?: BuildResourceRouteOptions): string;
+export declare function buildOpenRoutePath(input: NavigationTarget): string;
+export declare function buildOpenRouteLink(input: NavigationTarget & {
+    label?: string;
+}): NavigationLink;
+export declare function createStandardOpenPathResolver(routes: Record<string, StandardOpenPathRoute>, options?: StandardOpenPathResolverOptions): (input: {
+    app?: string;
+    view?: string;
+    params: Record<string, string>;
+}) => string | null | undefined;
+//# sourceMappingURL=index.d.ts.map

package/dist/navigation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/navigation/index.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB;aAC9B,IAAI,EAAE,GAAG;aACT,QAAQ,EAAE,WAAW;aACrB,IAAI,EAAE,OAAO;CACL,CAAC;AAEX,eAAO,MAAM,sBAAsB;aACjC,OAAO,EAAE,SAAS;aAClB,KAAK,EAAE,OAAO;aACd,SAAS,EAAE,WAAW;aACtB,WAAW,EAAE,aAAa;aAC1B,OAAO,EAAE,SAAS;aAClB,IAAI,EAAE,MAAM;aACZ,KAAK,EAAE,OAAO;aACd,QAAQ,EAAE,UAAU;aACpB,QAAQ,EAAE,WAAW;CACb,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,OAAO,sBAAsB,CAAC,CAAC;AAEvE,MAAM,WAAW,4BAA4B;IAC3C,WAAW,CAAC,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAAC;IACpD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACtE,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,qBAAqB,GAC7B,MAAM,GACN,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEpE,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAClC;AA6BD,wBAAgB,kBAAkB,CAChC,GAAG,CAAC,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,EAC3C,QAAQ,cAA+B,GACtC,MAAM,CAOR;AAED,wBAAgB,cAAc,CAC5B,OAAO,GAAE,IAAI,CAAC,4BAA4B,EAAE,gBAAgB,CAAM,GACjE,MAAM,CAIR;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,4BAAiC,GACzC,MAAM,CAIR;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,yBAA8B,GACtC,MAAM,CAWR;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAUlE;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,gBAAgB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C,cAAc,CAMhB;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAC7C,OAAO,GAAE,+BAAoC,WAE9B;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,KAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAU9B"}

package/dist/navigation/index.js

@@ -0,0 +1,105 @@
+import { AGENT_NATIVE_OPEN_PATH, withCollapsedAgentSidebarParam, } from "../shared/agent-sidebar-url.js";
+export const STANDARD_APP_ROUTES = {
+    home: "/",
+    settings: "/settings",
+    team: "/team",
+};
+export const STANDARD_SETTINGS_TABS = {
+    general: "general",
+    agent: "agent",
+    providers: "providers",
+    connections: "connections",
+    secrets: "secrets",
+    team: "team",
+    usage: "usage",
+    language: "language",
+    whatsNew: "whats-new",
+};
+function normalizeLeadingPath(path) {
+    const trimmed = path.trim();
+    if (!trimmed || trimmed === "/")
+        return "/";
+    return `/${trimmed.replace(/^\/+/, "").replace(/\/+$/, "")}`;
+}
+function normalizeTabId(tab) {
+    return tab
+        .trim()
+        .replace(/^#/, "")
+        .toLowerCase()
+        .replace(/['"]/g, "")
+        .replace(/[\s_]+/g, "-");
+}
+function pathSegment(value) {
+    return encodeURIComponent(value.trim().replace(/^\/+|\/+$/g, ""));
+}
+function resolveOpenPathRoute(route, params) {
+    if (!route)
+        return null;
+    return typeof route === "function" ? route(params) : route;
+}
+export function buildSettingsRoute(tab, basePath = STANDARD_APP_ROUTES.settings) {
+    const path = normalizeLeadingPath(basePath);
+    const normalizedTab = tab ? normalizeTabId(tab) : null;
+    if (!normalizedTab || normalizedTab === STANDARD_SETTINGS_TABS.general) {
+        return path;
+    }
+    return `${path}#${encodeURIComponent(normalizedTab)}`;
+}
+export function buildTeamRoute(options = {}) {
+    return options.teamInSettings
+        ? buildSettingsRoute(STANDARD_SETTINGS_TABS.team)
+        : STANDARD_APP_ROUTES.team;
+}
+export function buildStandardAppRoute(route, options = {}) {
+    if (route === "settings")
+        return buildSettingsRoute(options.settingsTab);
+    if (route === "team")
+        return buildTeamRoute(options);
+    return STANDARD_APP_ROUTES[route];
+}
+export function buildResourceRoute(collection, resourceId, options = {}) {
+    const base = normalizeLeadingPath(options.basePath ?? "/");
+    const collectionPath = collection
+        .split("/")
+        .map((segment) => pathSegment(segment))
+        .filter(Boolean)
+        .join("/");
+    if (!collectionPath)
+        throw new Error("collection is required");
+    if (!resourceId.trim())
+        throw new Error("resourceId is required");
+    const prefix = base === "/" ? "" : base;
+    return `${prefix}/${collectionPath}/${pathSegment(resourceId)}`;
+}
+export function buildOpenRoutePath(input) {
+    const sp = new URLSearchParams();
+    if (input.app)
+        sp.set("app", input.app);
+    sp.set("view", input.view);
+    if (input.to)
+        sp.set("to", input.to);
+    for (const [key, value] of Object.entries(input.params ?? {})) {
+        if (value === undefined || value === null || value === "")
+            continue;
+        sp.set(key, String(value));
+    }
+    return withCollapsedAgentSidebarParam(`${AGENT_NATIVE_OPEN_PATH}?${sp}`);
+}
+export function buildOpenRouteLink(input) {
+    return {
+        ...input,
+        label: input.label ?? `Open ${input.view}`,
+        url: buildOpenRoutePath(input),
+    };
+}
+export function createStandardOpenPathResolver(routes, options = {}) {
+    return (input) => {
+        void input.app;
+        if (!input.view)
+            return resolveOpenPathRoute(options.fallback, input.params);
+        return (resolveOpenPathRoute(routes[input.view], input.params) ??
+            resolveOpenPathRoute(options.fallback, input.params) ??
+            `/${input.view}`);
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/navigation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/navigation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,WAAW;IACrB,IAAI,EAAE,OAAO;CACL,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,WAAW;CACb,CAAC;AAmCX,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG;SACP,IAAI,EAAE;SACN,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAwC,EACxC,MAA8B;IAE9B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAA2C,EAC3C,QAAQ,GAAG,mBAAmB,CAAC,QAAQ;IAEvC,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,sBAAsB,CAAC,OAAO,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAAO,GAAyD,EAAE;IAElE,OAAO,OAAO,CAAC,cAAc;QAC3B,CAAC,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAyB,EACzB,OAAO,GAAiC,EAAE;IAE1C,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzE,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,UAAkB,EAClB,OAAO,GAA8B,EAAE;IAEvC,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,UAAU;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;SACtC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,OAAO,GAAG,MAAM,IAAI,cAAc,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAuB;IACxD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,GAAG;QAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,EAAE;QAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,SAAS;QACpE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,8BAA8B,CAAC,GAAG,sBAAsB,IAAI,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAA4C;IAE5C,OAAO;QACL,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE;QAC1C,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAA6C,EAC7C,OAAO,GAAoC,EAAE;IAE7C,OAAO,CAAC,KAIP,EAA6B,EAAE;QAC9B,KAAK,KAAK,CAAC,GAAG,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,IAAI;YACb,OAAO,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,CACL,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC;YACtD,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,EAAE,CACjB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  AGENT_NATIVE_OPEN_PATH,\n  withCollapsedAgentSidebarParam,\n} from \"../shared/agent-sidebar-url.js\";\n\nexport const STANDARD_APP_ROUTES = {\n  home: \"/\",\n  settings: \"/settings\",\n  team: \"/team\",\n} as const;\n\nexport const STANDARD_SETTINGS_TABS = {\n  general: \"general\",\n  agent: \"agent\",\n  providers: \"providers\",\n  connections: \"connections\",\n  secrets: \"secrets\",\n  team: \"team\",\n  usage: \"usage\",\n  language: \"language\",\n  whatsNew: \"whats-new\",\n} as const;\n\nexport type StandardAppRouteId = keyof typeof STANDARD_APP_ROUTES;\nexport type StandardSettingsTabId =\n  (typeof STANDARD_SETTINGS_TABS)[keyof typeof STANDARD_SETTINGS_TABS];\n\nexport interface BuildStandardAppRouteOptions {\n  settingsTab?: StandardSettingsTabId | string | null;\n  teamInSettings?: boolean;\n}\n\nexport interface BuildResourceRouteOptions {\n  basePath?: string;\n}\n\nexport interface NavigationTarget {\n  app?: string;\n  view: string;\n  params?: Record<string, string | number | boolean | null | undefined>;\n  to?: string;\n}\n\nexport interface NavigationLink extends NavigationTarget {\n  label: string;\n  url: string;\n}\n\nexport type StandardOpenPathRoute =\n  | string\n  | ((params: Record<string, string>) => string | null | undefined);\n\nexport interface StandardOpenPathResolverOptions {\n  fallback?: StandardOpenPathRoute;\n}\n\nfunction normalizeLeadingPath(path: string): string {\n  const trimmed = path.trim();\n  if (!trimmed || trimmed === \"/\") return \"/\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\nfunction normalizeTabId(tab: string): string {\n  return tab\n    .trim()\n    .replace(/^#/, \"\")\n    .toLowerCase()\n    .replace(/['\"]/g, \"\")\n    .replace(/[\\s_]+/g, \"-\");\n}\n\nfunction pathSegment(value: string): string {\n  return encodeURIComponent(value.trim().replace(/^\\/+|\\/+$/g, \"\"));\n}\n\nfunction resolveOpenPathRoute(\n  route: StandardOpenPathRoute | undefined,\n  params: Record<string, string>,\n): string | null | undefined {\n  if (!route) return null;\n  return typeof route === \"function\" ? route(params) : route;\n}\n\nexport function buildSettingsRoute(\n  tab?: StandardSettingsTabId | string | null,\n  basePath = STANDARD_APP_ROUTES.settings,\n): string {\n  const path = normalizeLeadingPath(basePath);\n  const normalizedTab = tab ? normalizeTabId(tab) : null;\n  if (!normalizedTab || normalizedTab === STANDARD_SETTINGS_TABS.general) {\n    return path;\n  }\n  return `${path}#${encodeURIComponent(normalizedTab)}`;\n}\n\nexport function buildTeamRoute(\n  options: Pick<BuildStandardAppRouteOptions, \"teamInSettings\"> = {},\n): string {\n  return options.teamInSettings\n    ? buildSettingsRoute(STANDARD_SETTINGS_TABS.team)\n    : STANDARD_APP_ROUTES.team;\n}\n\nexport function buildStandardAppRoute(\n  route: StandardAppRouteId,\n  options: BuildStandardAppRouteOptions = {},\n): string {\n  if (route === \"settings\") return buildSettingsRoute(options.settingsTab);\n  if (route === \"team\") return buildTeamRoute(options);\n  return STANDARD_APP_ROUTES[route];\n}\n\nexport function buildResourceRoute(\n  collection: string,\n  resourceId: string,\n  options: BuildResourceRouteOptions = {},\n): string {\n  const base = normalizeLeadingPath(options.basePath ?? \"/\");\n  const collectionPath = collection\n    .split(\"/\")\n    .map((segment) => pathSegment(segment))\n    .filter(Boolean)\n    .join(\"/\");\n  if (!collectionPath) throw new Error(\"collection is required\");\n  if (!resourceId.trim()) throw new Error(\"resourceId is required\");\n  const prefix = base === \"/\" ? \"\" : base;\n  return `${prefix}/${collectionPath}/${pathSegment(resourceId)}`;\n}\n\nexport function buildOpenRoutePath(input: NavigationTarget): string {\n  const sp = new URLSearchParams();\n  if (input.app) sp.set(\"app\", input.app);\n  sp.set(\"view\", input.view);\n  if (input.to) sp.set(\"to\", input.to);\n  for (const [key, value] of Object.entries(input.params ?? {})) {\n    if (value === undefined || value === null || value === \"\") continue;\n    sp.set(key, String(value));\n  }\n  return withCollapsedAgentSidebarParam(`${AGENT_NATIVE_OPEN_PATH}?${sp}`);\n}\n\nexport function buildOpenRouteLink(\n  input: NavigationTarget & { label?: string },\n): NavigationLink {\n  return {\n    ...input,\n    label: input.label ?? `Open ${input.view}`,\n    url: buildOpenRoutePath(input),\n  };\n}\n\nexport function createStandardOpenPathResolver(\n  routes: Record<string, StandardOpenPathRoute>,\n  options: StandardOpenPathResolverOptions = {},\n) {\n  return (input: {\n    app?: string;\n    view?: string;\n    params: Record<string, string>;\n  }): string | null | undefined => {\n    void input.app;\n    if (!input.view)\n      return resolveOpenPathRoute(options.fallback, input.params);\n    return (\n      resolveOpenPathRoute(routes[input.view], input.params) ??\n      resolveOpenPathRoute(options.fallback, input.params) ??\n      `/${input.view}`\n    );\n  };\n}\n"]}

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
+    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,10 +59,10 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/org/index.d.ts

@@ -1,4 +1,5 @@
 export type { OrgRole, OrgContext, OrgSummary, OrgInvitationSummary, OrgInfo, OrgMember, OrgPendingInvitation, } from "./types.js";
+export { canInviteOrgMembers, canManageOrg, canManageOrgDomain, orgRoleAtLeast, orgRoleRank, } from "./permissions.js";
 export { getOrgContext, getOrgDomain, getOrgA2ASecret, getA2ASecretByDomain, resolveOrgByDomain, resolveOrgIdForEmail, createOrganization, } from "./context.js";
 export { acceptPendingInvitationsForEmail } from "./accept-pending.js";
 export type { AcceptPendingResult } from "./accept-pending.js";

package/dist/org/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIhE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIhE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/org/index.js

@@ -1,4 +1,5 @@
 // Public API for the org module.
+export { canInviteOrgMembers, canManageOrg, canManageOrgDomain, orgRoleAtLeast, orgRoleRank, } from "./permissions.js";
 export { getOrgContext, getOrgDomain, getOrgA2ASecret, getA2ASecretByDomain, resolveOrgByDomain, resolveOrgIdForEmail, createOrganization, } from "./context.js";
 export { acceptPendingInvitationsForEmail } from "./accept-pending.js";
 export { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";

package/dist/org/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAYjC,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEhE,2EAA2E;AAC3E,wDAAwD;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,8EAA8E;AAC9E,qDAAqD;AACrD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC","sourcesContent":["// Public API for the org module.\n\nexport type {\n  OrgRole,\n  OrgContext,\n  OrgSummary,\n  OrgInvitationSummary,\n  OrgInfo,\n  OrgMember,\n  OrgPendingInvitation,\n} from \"./types.js\";\n\nexport {\n  getOrgContext,\n  getOrgDomain,\n  getOrgA2ASecret,\n  getA2ASecretByDomain,\n  resolveOrgByDomain,\n  resolveOrgIdForEmail,\n  createOrganization,\n} from \"./context.js\";\n\nexport { acceptPendingInvitationsForEmail } from \"./accept-pending.js\";\nexport type { AcceptPendingResult } from \"./accept-pending.js\";\n\nexport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nexport type { AutoJoinDomainResult } from \"./auto-join-domain.js\";\n\nexport { ORG_MIGRATIONS } from \"./migrations.js\";\n\nexport { createOrgPlugin, defaultOrgPlugin } from \"./plugin.js\";\n\n// Drizzle schema (re-exported so templates can write typed queries against\n// org tables without redefining the schema themselves).\nexport { organizations, orgMembers, orgInvitations } from \"./schema.js\";\n\n// Individual handlers — exported so templates can compose a custom org plugin\n// while still using the framework-provided handlers.\nexport {\n  getMyOrgHandler,\n  createOrgHandler,\n  updateOrgHandler,\n  switchOrgHandler,\n  listMembersHandler,\n  removeMemberHandler,\n  changeMemberRoleHandler,\n  listInvitationsHandler,\n  createInvitationHandler,\n  acceptInvitationHandler,\n  setA2ASecretHandler,\n  syncA2ASecretHandler,\n  receiveA2ASecretHandler,\n} from \"./handlers.js\";\n\nexport { isFreeEmailProvider } from \"./free-email-providers.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAYjC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEhE,2EAA2E;AAC3E,wDAAwD;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,8EAA8E;AAC9E,qDAAqD;AACrD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC","sourcesContent":["// Public API for the org module.\n\nexport type {\n  OrgRole,\n  OrgContext,\n  OrgSummary,\n  OrgInvitationSummary,\n  OrgInfo,\n  OrgMember,\n  OrgPendingInvitation,\n} from \"./types.js\";\n\nexport {\n  canInviteOrgMembers,\n  canManageOrg,\n  canManageOrgDomain,\n  orgRoleAtLeast,\n  orgRoleRank,\n} from \"./permissions.js\";\n\nexport {\n  getOrgContext,\n  getOrgDomain,\n  getOrgA2ASecret,\n  getA2ASecretByDomain,\n  resolveOrgByDomain,\n  resolveOrgIdForEmail,\n  createOrganization,\n} from \"./context.js\";\n\nexport { acceptPendingInvitationsForEmail } from \"./accept-pending.js\";\nexport type { AcceptPendingResult } from \"./accept-pending.js\";\n\nexport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nexport type { AutoJoinDomainResult } from \"./auto-join-domain.js\";\n\nexport { ORG_MIGRATIONS } from \"./migrations.js\";\n\nexport { createOrgPlugin, defaultOrgPlugin } from \"./plugin.js\";\n\n// Drizzle schema (re-exported so templates can write typed queries against\n// org tables without redefining the schema themselves).\nexport { organizations, orgMembers, orgInvitations } from \"./schema.js\";\n\n// Individual handlers — exported so templates can compose a custom org plugin\n// while still using the framework-provided handlers.\nexport {\n  getMyOrgHandler,\n  createOrgHandler,\n  updateOrgHandler,\n  switchOrgHandler,\n  listMembersHandler,\n  removeMemberHandler,\n  changeMemberRoleHandler,\n  listInvitationsHandler,\n  createInvitationHandler,\n  acceptInvitationHandler,\n  setA2ASecretHandler,\n  syncA2ASecretHandler,\n  receiveA2ASecretHandler,\n} from \"./handlers.js\";\n\nexport { isFreeEmailProvider } from \"./free-email-providers.js\";\n"]}

package/dist/org/permissions.d.ts

@@ -0,0 +1,7 @@
+import type { OrgRole } from "./types.js";
+export declare function orgRoleRank(role: OrgRole | null | undefined): number;
+export declare function orgRoleAtLeast(role: OrgRole | null | undefined, minimum: OrgRole): boolean;
+export declare function canManageOrg(role: OrgRole | null | undefined): boolean;
+export declare function canInviteOrgMembers(role: OrgRole | null | undefined): boolean;
+export declare function canManageOrgDomain(role: OrgRole | null | undefined): boolean;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/org/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/org/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQ1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAEpE;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,OAAO,GACf,OAAO,CAET;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEtE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E"}

package/dist/org/permissions.js

@@ -0,0 +1,21 @@
+const ORG_ROLE_RANK = {
+    member: 1,
+    admin: 2,
+    owner: 3,
+};
+export function orgRoleRank(role) {
+    return role ? (ORG_ROLE_RANK[role] ?? 0) : 0;
+}
+export function orgRoleAtLeast(role, minimum) {
+    return orgRoleRank(role) >= orgRoleRank(minimum);
+}
+export function canManageOrg(role) {
+    return orgRoleAtLeast(role, "admin");
+}
+export function canInviteOrgMembers(role) {
+    return orgRoleAtLeast(role, "admin");
+}
+export function canManageOrgDomain(role) {
+    return role === "owner";
+}
+//# sourceMappingURL=permissions.js.map

package/dist/org/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/org/permissions.ts"],"names":[],"mappings":"AAEA,MAAM,aAAa,GAA4B;IAC7C,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,IAAgC;IAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAgC,EAChC,OAAgB;IAEhB,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAgC;IAC3D,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAgC;IACjE,OAAO,IAAI,KAAK,OAAO,CAAC;AAC1B,CAAC","sourcesContent":["import type { OrgRole } from \"./types.js\";\n\nconst ORG_ROLE_RANK: Record<OrgRole, number> = {\n  member: 1,\n  admin: 2,\n  owner: 3,\n};\n\nexport function orgRoleRank(role: OrgRole | null | undefined): number {\n  return role ? (ORG_ROLE_RANK[role] ?? 0) : 0;\n}\n\nexport function orgRoleAtLeast(\n  role: OrgRole | null | undefined,\n  minimum: OrgRole,\n): boolean {\n  return orgRoleRank(role) >= orgRoleRank(minimum);\n}\n\nexport function canManageOrg(role: OrgRole | null | undefined): boolean {\n  return orgRoleAtLeast(role, \"admin\");\n}\n\nexport function canInviteOrgMembers(role: OrgRole | null | undefined): boolean {\n  return orgRoleAtLeast(role, \"admin\");\n}\n\nexport function canManageOrgDomain(role: OrgRole | null | undefined): boolean {\n  return role === \"owner\";\n}\n"]}

package/dist/org-team/index.d.ts

@@ -0,0 +1,2 @@
+export * from "../org/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/org-team/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/org-team/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC"}

package/dist/org-team/index.js

@@ -0,0 +1,2 @@
+export * from "../org/index.js";
+//# sourceMappingURL=index.js.map

package/dist/org-team/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/org-team/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC","sourcesContent":["export * from \"../org/index.js\";\n"]}

package/dist/private-blob/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/private-blob/registry.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAkKpB,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,mBAAmB,GAC5B,IAAI,CAEN;AAED,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAgB,wBAAwB,IAAI,mBAAmB,EAAE,CAEhE;AAED,wBAAgB,4BAA4B,IAAI,mBAAmB,GAAG,IAAI,CAKzE;AAED,wBAAgB,yCAAyC,CACvD,OAAO,EAAE,OAAO,GACf,IAAI,CAEN;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAQnC;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAOhC;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,uBAAuB,CAAC,CAYlC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/private-blob/registry.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAmKpB,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,mBAAmB,GAC5B,IAAI,CAEN;AAED,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAgB,wBAAwB,IAAI,mBAAmB,EAAE,CAEhE;AAED,wBAAgB,4BAA4B,IAAI,mBAAmB,GAAG,IAAI,CAKzE;AAED,wBAAgB,yCAAyC,CACvD,OAAO,EAAE,OAAO,GACf,IAAI,CAEN;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAQnC;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAOhC;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,uBAAuB,CAAC,CAYlC"}

package/dist/private-blob/registry.js

@@ -55,6 +55,7 @@ async function putViaEncryptedPublicUpload(input) {
         filename: input.filename ?? input.key ?? "private-blob.bin",
         mimeType: "application/octet-stream",
         ownerEmail: input.ownerEmail,
+        recordAsset: false,
     });
     if (!uploaded)
         return null;

package/dist/private-blob/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/private-blob/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAsC9B,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;AACxD,MAAM,OAAO,GAAG,UAAoD,CAAC;AACrE,MAAM,SAAS,GACb,CAAC,OAAO,CAAC,iCAAiC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AAC5D,MAAM,uBAAuB,GAC3B,CAAC,OAAO,CAAC,4CAA4C,KAAK;IACxD,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEL,SAAS,OAAO,CAAC,IAAyB;IACxC,OAAO,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,IAAgB;IACpC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,UAAU,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC;QACtC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAwB,EACxB,UAAsB;IAEtB,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,sBAAsB,EAAE,EACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CACpC,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,UAAU,CACnB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAkC;IAElC,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAC3B,EAAE,CAAC;AACN,CAAC;AAED,SAAS,4BAA4B,CAAC,EAAU;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;IAC7D,IACE,UAAU,EAAE,IAAI,KAAK,yCAAyC;QAC9D,UAAU,CAAC,OAAO,KAAK,CAAC;QACxB,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAyB;IAC7D,OAAO,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAA0B;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;QACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,kBAAkB;QAC3D,QAAQ,EAAE,0BAA0B;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,UAAU,GAA2B;QACzC,IAAI,EAAE,yCAAyC;QAC/C,OAAO,EAAE,CAAC;QACV,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,cAAc,EAAE,QAAQ,CAAC,QAAQ;QACjC,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE;QACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,4BAA4B,CAAC,UAAU,CAAC;QAC5C,QAAQ,EAAE,iBAAiB,QAAQ,CAAC,QAAQ,EAAE;QAC9C,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAAyB;IAEzB,MAAM,UAAU,GAAG,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC;QACrD,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,QAA6B;IAE7B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,EAAU;IACtD,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,YAAY,EAAE;YAAE,OAAO,QAAQ,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,OAAgB;IAEhB,uBAAuB,CAAC,OAAO,GAAG,OAAO,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0B;IAE1B,MAAM,QAAQ,GAAG,4BAA4B,EAAE,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,uBAAuB,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,gDAAgD,KAAK,GAAG,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAyB;IAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAyB;IAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EACJ,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\n\nimport { uploadFile } from \"../file-upload/index.js\";\nimport {\n  decryptSecretValue,\n  encryptSecretValue,\n  getSecretEncryptionKey,\n} from \"../secrets/crypto.js\";\nimport type {\n  PrivateBlobDeleteResult,\n  PrivateBlobHandle,\n  PrivateBlobProvider,\n  PrivateBlobPutInput,\n  PrivateBlobReadResult,\n} from \"./types.js\";\n\ninterface PrivateBlobGlobals {\n  __agentNativePrivateBlobProviders?: Map<string, PrivateBlobProvider>;\n  __agentNativePrivateBlobPublicUploadFallback?: { enabled: boolean };\n}\n\ninterface EncryptedPayload {\n  iv: string;\n  tag: string;\n  ciphertext: Uint8Array;\n}\n\ninterface EncryptionParams {\n  iv: string;\n  tag: string;\n}\n\ninterface PublicUploadDescriptor {\n  kind: \"agent-native.private-blob.public-upload\";\n  version: 1;\n  url: string;\n  uploadProvider: string;\n  uploadId?: string;\n  encryption: EncryptionParams;\n  mimeType?: string;\n  metadata?: PrivateBlobHandle[\"metadata\"];\n  size: number;\n  createdAt: string;\n}\n\nconst PUBLIC_UPLOAD_HANDLE_PREFIX = \"public-upload:v1:\";\nconst globals = globalThis as typeof globalThis & PrivateBlobGlobals;\nconst providers: Map<string, PrivateBlobProvider> =\n  (globals.__agentNativePrivateBlobProviders ??= new Map());\nconst publicUploadFallbackRef: { enabled: boolean } =\n  (globals.__agentNativePrivateBlobPublicUploadFallback ??= {\n    enabled: true,\n  });\n\nfunction toBytes(data: Uint8Array | Buffer): Uint8Array {\n  return data instanceof Uint8Array ? data : new Uint8Array(data);\n}\n\nfunction encryptBytes(data: Uint8Array): EncryptedPayload {\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(\"aes-256-gcm\", getSecretEncryptionKey(), iv);\n  const ciphertext = Buffer.concat([\n    cipher.update(Buffer.from(data)),\n    cipher.final(),\n  ]);\n  return {\n    iv: iv.toString(\"base64url\"),\n    ciphertext: new Uint8Array(ciphertext),\n    tag: cipher.getAuthTag().toString(\"base64url\"),\n  };\n}\n\nfunction decryptBytes(\n  params: EncryptionParams,\n  ciphertext: Uint8Array,\n): Uint8Array {\n  const decipher = createDecipheriv(\n    \"aes-256-gcm\",\n    getSecretEncryptionKey(),\n    Buffer.from(params.iv, \"base64url\"),\n  );\n  decipher.setAuthTag(Buffer.from(params.tag, \"base64url\"));\n  return new Uint8Array(\n    Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]),\n  );\n}\n\nfunction encodePublicUploadDescriptor(\n  descriptor: PublicUploadDescriptor,\n): string {\n  return `${PUBLIC_UPLOAD_HANDLE_PREFIX}${encryptSecretValue(\n    JSON.stringify(descriptor),\n  )}`;\n}\n\nfunction decodePublicUploadDescriptor(id: string): PublicUploadDescriptor {\n  if (!id.startsWith(PUBLIC_UPLOAD_HANDLE_PREFIX)) {\n    throw new Error(\n      \"Private blob handle is not a public-upload fallback handle\",\n    );\n  }\n  const raw = decryptSecretValue(id.slice(PUBLIC_UPLOAD_HANDLE_PREFIX.length));\n  const descriptor = JSON.parse(raw) as PublicUploadDescriptor;\n  if (\n    descriptor?.kind !== \"agent-native.private-blob.public-upload\" ||\n    descriptor.version !== 1 ||\n    typeof descriptor.url !== \"string\"\n  ) {\n    throw new Error(\"Private blob handle descriptor is invalid\");\n  }\n  return descriptor;\n}\n\nfunction isPublicUploadFallbackHandle(handle: PrivateBlobHandle): boolean {\n  return handle.id.startsWith(PUBLIC_UPLOAD_HANDLE_PREFIX);\n}\n\nasync function putViaEncryptedPublicUpload(\n  input: PrivateBlobPutInput,\n): Promise<PrivateBlobHandle | null> {\n  const bytes = toBytes(input.data);\n  const encrypted = encryptBytes(bytes);\n  const uploaded = await uploadFile({\n    data: Buffer.from(encrypted.ciphertext),\n    filename: input.filename ?? input.key ?? \"private-blob.bin\",\n    mimeType: \"application/octet-stream\",\n    ownerEmail: input.ownerEmail,\n  });\n  if (!uploaded) return null;\n\n  const descriptor: PublicUploadDescriptor = {\n    kind: \"agent-native.private-blob.public-upload\",\n    version: 1,\n    url: uploaded.url,\n    uploadProvider: uploaded.provider,\n    uploadId: uploaded.id,\n    encryption: { iv: encrypted.iv, tag: encrypted.tag },\n    mimeType: input.mimeType,\n    metadata: input.metadata,\n    size: bytes.byteLength,\n    createdAt: new Date().toISOString(),\n  };\n\n  return {\n    id: encodePublicUploadDescriptor(descriptor),\n    provider: `public-upload:${uploaded.provider}`,\n    opaque: true,\n    encrypted: true,\n    mimeType: input.mimeType,\n    size: bytes.byteLength,\n    createdAt: descriptor.createdAt,\n    metadata: input.metadata,\n  };\n}\n\nasync function readViaEncryptedPublicUpload(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobReadResult> {\n  const descriptor = decodePublicUploadDescriptor(handle.id);\n  const response = await fetch(descriptor.url);\n  if (!response.ok) {\n    throw new Error(\n      `Private blob public-upload read failed (${response.status}): ${response.statusText}`,\n    );\n  }\n  // The uploaded ciphertext is intentionally opaque; the descriptor carries\n  // auth tag + IV separately so the backing public URL is useless by itself.\n  const ciphertext = new Uint8Array(await response.arrayBuffer());\n  return {\n    data: decryptBytes(descriptor.encryption, ciphertext),\n    mimeType: descriptor.mimeType,\n    metadata: descriptor.metadata,\n    handle,\n  };\n}\n\nexport function registerPrivateBlobProvider(\n  provider: PrivateBlobProvider,\n): void {\n  providers.set(provider.id, provider);\n}\n\nexport function unregisterPrivateBlobProvider(id: string): void {\n  providers.delete(id);\n}\n\nexport function listPrivateBlobProviders(): PrivateBlobProvider[] {\n  return [...providers.values()];\n}\n\nexport function getActivePrivateBlobProvider(): PrivateBlobProvider | null {\n  for (const provider of providers.values()) {\n    if (provider.isConfigured()) return provider;\n  }\n  return null;\n}\n\nexport function setPrivateBlobPublicUploadFallbackEnabled(\n  enabled: boolean,\n): void {\n  publicUploadFallbackRef.enabled = enabled;\n}\n\nexport async function putPrivateBlob(\n  input: PrivateBlobPutInput,\n): Promise<PrivateBlobHandle | null> {\n  const provider = getActivePrivateBlobProvider();\n  if (provider) return provider.put(input);\n  if (!publicUploadFallbackRef.enabled) return null;\n  if (process.env.AGENT_NATIVE_PRIVATE_BLOB_PUBLIC_UPLOAD_FALLBACK === \"0\") {\n    return null;\n  }\n  return putViaEncryptedPublicUpload(input);\n}\n\nexport async function readPrivateBlob(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobReadResult> {\n  const provider = providers.get(handle.provider);\n  if (provider) return provider.read(handle);\n  if (isPublicUploadFallbackHandle(handle)) {\n    return readViaEncryptedPublicUpload(handle);\n  }\n  throw new Error(`No private blob provider registered for ${handle.provider}`);\n}\n\nexport async function deletePrivateBlob(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobDeleteResult> {\n  const provider = providers.get(handle.provider);\n  if (provider) return provider.delete(handle);\n  if (isPublicUploadFallbackHandle(handle)) {\n    return {\n      deleted: false,\n      provider: handle.provider,\n      reason:\n        \"delete is not supported by the encrypted public-upload fallback provider\",\n    };\n  }\n  throw new Error(`No private blob provider registered for ${handle.provider}`);\n}\n"]}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/private-blob/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAsC9B,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;AACxD,MAAM,OAAO,GAAG,UAAoD,CAAC;AACrE,MAAM,SAAS,GACb,CAAC,OAAO,CAAC,iCAAiC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AAC5D,MAAM,uBAAuB,GAC3B,CAAC,OAAO,CAAC,4CAA4C,KAAK;IACxD,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEL,SAAS,OAAO,CAAC,IAAyB;IACxC,OAAO,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,IAAgB;IACpC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,UAAU,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC;QACtC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAwB,EACxB,UAAsB;IAEtB,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,sBAAsB,EAAE,EACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CACpC,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,UAAU,CACnB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAkC;IAElC,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAC3B,EAAE,CAAC;AACN,CAAC;AAED,SAAS,4BAA4B,CAAC,EAAU;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;IAC7D,IACE,UAAU,EAAE,IAAI,KAAK,yCAAyC;QAC9D,UAAU,CAAC,OAAO,KAAK,CAAC;QACxB,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAyB;IAC7D,OAAO,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAA0B;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;QACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,kBAAkB;QAC3D,QAAQ,EAAE,0BAA0B;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,UAAU,GAA2B;QACzC,IAAI,EAAE,yCAAyC;QAC/C,OAAO,EAAE,CAAC;QACV,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,cAAc,EAAE,QAAQ,CAAC,QAAQ;QACjC,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE;QACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,4BAA4B,CAAC,UAAU,CAAC;QAC5C,QAAQ,EAAE,iBAAiB,QAAQ,CAAC,QAAQ,EAAE;QAC9C,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,UAAU;QACtB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAAyB;IAEzB,MAAM,UAAU,GAAG,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC;QACrD,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,QAA6B;IAE7B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,EAAU;IACtD,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,YAAY,EAAE;YAAE,OAAO,QAAQ,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,OAAgB;IAEhB,uBAAuB,CAAC,OAAO,GAAG,OAAO,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0B;IAE1B,MAAM,QAAQ,GAAG,4BAA4B,EAAE,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,uBAAuB,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,gDAAgD,KAAK,GAAG,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAyB;IAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAyB;IAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EACJ,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\n\nimport { uploadFile } from \"../file-upload/index.js\";\nimport {\n  decryptSecretValue,\n  encryptSecretValue,\n  getSecretEncryptionKey,\n} from \"../secrets/crypto.js\";\nimport type {\n  PrivateBlobDeleteResult,\n  PrivateBlobHandle,\n  PrivateBlobProvider,\n  PrivateBlobPutInput,\n  PrivateBlobReadResult,\n} from \"./types.js\";\n\ninterface PrivateBlobGlobals {\n  __agentNativePrivateBlobProviders?: Map<string, PrivateBlobProvider>;\n  __agentNativePrivateBlobPublicUploadFallback?: { enabled: boolean };\n}\n\ninterface EncryptedPayload {\n  iv: string;\n  tag: string;\n  ciphertext: Uint8Array;\n}\n\ninterface EncryptionParams {\n  iv: string;\n  tag: string;\n}\n\ninterface PublicUploadDescriptor {\n  kind: \"agent-native.private-blob.public-upload\";\n  version: 1;\n  url: string;\n  uploadProvider: string;\n  uploadId?: string;\n  encryption: EncryptionParams;\n  mimeType?: string;\n  metadata?: PrivateBlobHandle[\"metadata\"];\n  size: number;\n  createdAt: string;\n}\n\nconst PUBLIC_UPLOAD_HANDLE_PREFIX = \"public-upload:v1:\";\nconst globals = globalThis as typeof globalThis & PrivateBlobGlobals;\nconst providers: Map<string, PrivateBlobProvider> =\n  (globals.__agentNativePrivateBlobProviders ??= new Map());\nconst publicUploadFallbackRef: { enabled: boolean } =\n  (globals.__agentNativePrivateBlobPublicUploadFallback ??= {\n    enabled: true,\n  });\n\nfunction toBytes(data: Uint8Array | Buffer): Uint8Array {\n  return data instanceof Uint8Array ? data : new Uint8Array(data);\n}\n\nfunction encryptBytes(data: Uint8Array): EncryptedPayload {\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(\"aes-256-gcm\", getSecretEncryptionKey(), iv);\n  const ciphertext = Buffer.concat([\n    cipher.update(Buffer.from(data)),\n    cipher.final(),\n  ]);\n  return {\n    iv: iv.toString(\"base64url\"),\n    ciphertext: new Uint8Array(ciphertext),\n    tag: cipher.getAuthTag().toString(\"base64url\"),\n  };\n}\n\nfunction decryptBytes(\n  params: EncryptionParams,\n  ciphertext: Uint8Array,\n): Uint8Array {\n  const decipher = createDecipheriv(\n    \"aes-256-gcm\",\n    getSecretEncryptionKey(),\n    Buffer.from(params.iv, \"base64url\"),\n  );\n  decipher.setAuthTag(Buffer.from(params.tag, \"base64url\"));\n  return new Uint8Array(\n    Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]),\n  );\n}\n\nfunction encodePublicUploadDescriptor(\n  descriptor: PublicUploadDescriptor,\n): string {\n  return `${PUBLIC_UPLOAD_HANDLE_PREFIX}${encryptSecretValue(\n    JSON.stringify(descriptor),\n  )}`;\n}\n\nfunction decodePublicUploadDescriptor(id: string): PublicUploadDescriptor {\n  if (!id.startsWith(PUBLIC_UPLOAD_HANDLE_PREFIX)) {\n    throw new Error(\n      \"Private blob handle is not a public-upload fallback handle\",\n    );\n  }\n  const raw = decryptSecretValue(id.slice(PUBLIC_UPLOAD_HANDLE_PREFIX.length));\n  const descriptor = JSON.parse(raw) as PublicUploadDescriptor;\n  if (\n    descriptor?.kind !== \"agent-native.private-blob.public-upload\" ||\n    descriptor.version !== 1 ||\n    typeof descriptor.url !== \"string\"\n  ) {\n    throw new Error(\"Private blob handle descriptor is invalid\");\n  }\n  return descriptor;\n}\n\nfunction isPublicUploadFallbackHandle(handle: PrivateBlobHandle): boolean {\n  return handle.id.startsWith(PUBLIC_UPLOAD_HANDLE_PREFIX);\n}\n\nasync function putViaEncryptedPublicUpload(\n  input: PrivateBlobPutInput,\n): Promise<PrivateBlobHandle | null> {\n  const bytes = toBytes(input.data);\n  const encrypted = encryptBytes(bytes);\n  const uploaded = await uploadFile({\n    data: Buffer.from(encrypted.ciphertext),\n    filename: input.filename ?? input.key ?? \"private-blob.bin\",\n    mimeType: \"application/octet-stream\",\n    ownerEmail: input.ownerEmail,\n    recordAsset: false,\n  });\n  if (!uploaded) return null;\n\n  const descriptor: PublicUploadDescriptor = {\n    kind: \"agent-native.private-blob.public-upload\",\n    version: 1,\n    url: uploaded.url,\n    uploadProvider: uploaded.provider,\n    uploadId: uploaded.id,\n    encryption: { iv: encrypted.iv, tag: encrypted.tag },\n    mimeType: input.mimeType,\n    metadata: input.metadata,\n    size: bytes.byteLength,\n    createdAt: new Date().toISOString(),\n  };\n\n  return {\n    id: encodePublicUploadDescriptor(descriptor),\n    provider: `public-upload:${uploaded.provider}`,\n    opaque: true,\n    encrypted: true,\n    mimeType: input.mimeType,\n    size: bytes.byteLength,\n    createdAt: descriptor.createdAt,\n    metadata: input.metadata,\n  };\n}\n\nasync function readViaEncryptedPublicUpload(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobReadResult> {\n  const descriptor = decodePublicUploadDescriptor(handle.id);\n  const response = await fetch(descriptor.url);\n  if (!response.ok) {\n    throw new Error(\n      `Private blob public-upload read failed (${response.status}): ${response.statusText}`,\n    );\n  }\n  // The uploaded ciphertext is intentionally opaque; the descriptor carries\n  // auth tag + IV separately so the backing public URL is useless by itself.\n  const ciphertext = new Uint8Array(await response.arrayBuffer());\n  return {\n    data: decryptBytes(descriptor.encryption, ciphertext),\n    mimeType: descriptor.mimeType,\n    metadata: descriptor.metadata,\n    handle,\n  };\n}\n\nexport function registerPrivateBlobProvider(\n  provider: PrivateBlobProvider,\n): void {\n  providers.set(provider.id, provider);\n}\n\nexport function unregisterPrivateBlobProvider(id: string): void {\n  providers.delete(id);\n}\n\nexport function listPrivateBlobProviders(): PrivateBlobProvider[] {\n  return [...providers.values()];\n}\n\nexport function getActivePrivateBlobProvider(): PrivateBlobProvider | null {\n  for (const provider of providers.values()) {\n    if (provider.isConfigured()) return provider;\n  }\n  return null;\n}\n\nexport function setPrivateBlobPublicUploadFallbackEnabled(\n  enabled: boolean,\n): void {\n  publicUploadFallbackRef.enabled = enabled;\n}\n\nexport async function putPrivateBlob(\n  input: PrivateBlobPutInput,\n): Promise<PrivateBlobHandle | null> {\n  const provider = getActivePrivateBlobProvider();\n  if (provider) return provider.put(input);\n  if (!publicUploadFallbackRef.enabled) return null;\n  if (process.env.AGENT_NATIVE_PRIVATE_BLOB_PUBLIC_UPLOAD_FALLBACK === \"0\") {\n    return null;\n  }\n  return putViaEncryptedPublicUpload(input);\n}\n\nexport async function readPrivateBlob(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobReadResult> {\n  const provider = providers.get(handle.provider);\n  if (provider) return provider.read(handle);\n  if (isPublicUploadFallbackHandle(handle)) {\n    return readViaEncryptedPublicUpload(handle);\n  }\n  throw new Error(`No private blob provider registered for ${handle.provider}`);\n}\n\nexport async function deletePrivateBlob(\n  handle: PrivateBlobHandle,\n): Promise<PrivateBlobDeleteResult> {\n  const provider = providers.get(handle.provider);\n  if (provider) return provider.delete(handle);\n  if (isPublicUploadFallbackHandle(handle)) {\n    return {\n      deleted: false,\n      provider: handle.provider,\n      reason:\n        \"delete is not supported by the encrypted public-upload fallback provider\",\n    };\n  }\n  throw new Error(`No private blob provider registered for ${handle.provider}`);\n}\n"]}

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/resources/handlers.d.ts

@@ -52,8 +52,8 @@ export declare function handleDeleteResource(event: any): Promise<{
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,9 +73,9 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
-    error?: undefined;
     url: string;
     provider: string;
+    error?: undefined;
 }>;
 export {};
 //# sourceMappingURL=handlers.d.ts.map

package/dist/review/actions/consume-review-feedback.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    resourceType: string;
+    resourceId: string;
+    commentIds: string[];
+}, {
+    consumedCommentIds: string[];
+    updatedCount: number;
+}>;
+export default _default;
+//# sourceMappingURL=consume-review-feedback.d.ts.map

package/dist/review/actions/consume-review-feedback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consume-review-feedback.d.ts","sourceRoot":"","sources":["../../../src/review/actions/consume-review-feedback.ts"],"names":[],"mappings":""}

package/dist/review/actions/consume-review-feedback.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { assertReviewableResourceAccess } from "../registry.js";
+import { consumeReviewFeedback } from "../store.js";
+const schema = z.object({
+    resourceType: z.string().min(1),
+    resourceId: z.string().min(1),
+    commentIds: z.array(z.string().min(1)).min(1),
+});
+export default defineAction({
+    description: "Mark review feedback as consumed by the agent or reviewer workflow.",
+    schema,
+    run: async (args, ctx) => {
+        const actionCtx = ctx;
+        await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "editor");
+        const updatedCount = await consumeReviewFeedback(args.commentIds, undefined, {
+            resourceType: args.resourceType,
+            resourceId: args.resourceId,
+        });
+        if (updatedCount < 1) {
+            throw new Error("No matching review comments to consume");
+        }
+        return {
+            consumedCommentIds: args.commentIds,
+            updatedCount,
+        };
+    },
+    audit: {
+        target: (args) => ({
+            type: args.resourceType,
+            id: args.resourceId,
+        }),
+    },
+});
+//# sourceMappingURL=consume-review-feedback.js.map

package/dist/review/actions/consume-review-feedback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consume-review-feedback.js","sourceRoot":"","sources":["../../../src/review/actions/consume-review-feedback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,qEAAqE;IACvE,MAAM;IACN,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,GAAwC,CAAC;QAC3D,MAAM,8BAA8B,CAClC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,SAAS,EACT,QAAQ,CACT,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAC9C,IAAI,CAAC,UAAU,EACf,SAAS,EACT;YACE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CACF,CAAC;QACF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO;YACL,kBAAkB,EAAE,IAAI,CAAC,UAAU;YACnC,YAAY;SACb,CAAC;IACJ,CAAC;IACD,KAAK,EAAE;QACL,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjB,IAAI,EAAE,IAAI,CAAC,YAAY;YACvB,EAAE,EAAE,IAAI,CAAC,UAAU;SACpB,CAAC;KACH;CACF,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport { assertReviewableResourceAccess } from \"../registry.js\";\nimport { consumeReviewFeedback } from \"../store.js\";\nimport type { ReviewResourceContext } from \"../types.js\";\n\nconst schema = z.object({\n  resourceType: z.string().min(1),\n  resourceId: z.string().min(1),\n  commentIds: z.array(z.string().min(1)).min(1),\n});\n\nexport default defineAction({\n  description:\n    \"Mark review feedback as consumed by the agent or reviewer workflow.\",\n  schema,\n  run: async (args, ctx) => {\n    const actionCtx = ctx as ReviewResourceContext | undefined;\n    await assertReviewableResourceAccess(\n      args.resourceType,\n      args.resourceId,\n      actionCtx,\n      \"editor\",\n    );\n    const updatedCount = await consumeReviewFeedback(\n      args.commentIds,\n      undefined,\n      {\n        resourceType: args.resourceType,\n        resourceId: args.resourceId,\n      },\n    );\n    if (updatedCount < 1) {\n      throw new Error(\"No matching review comments to consume\");\n    }\n    return {\n      consumedCommentIds: args.commentIds,\n      updatedCount,\n    };\n  },\n  audit: {\n    target: (args) => ({\n      type: args.resourceType,\n      id: args.resourceId,\n    }),\n  },\n});\n"]}

package/dist/review/actions/create-review-comment.d.ts

@@ -0,0 +1,18 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    resourceType: string;
+    resourceId: string;
+    targetId?: string;
+    kind?: "annotation" | "comment" | "correction" | "decision" | "question" | "review";
+    anchor?: unknown;
+    body: string;
+    authorName?: string;
+    resolutionTarget?: "agent" | "human";
+    mentions?: {
+        label: string;
+        email?: string;
+        id?: string;
+    }[];
+    metadata?: Record<string, unknown>;
+}, import("../types.js").ReviewComment>;
+export default _default;
+//# sourceMappingURL=create-review-comment.d.ts.map

package/dist/review/actions/create-review-comment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-review-comment.d.ts","sourceRoot":"","sources":["../../../src/review/actions/create-review-comment.ts"],"names":[],"mappings":""}