@agent-native/core 0.92.12 → 0.94.0

package/corpus/core/src/jobs/scheduler.ts

@@ -1,3 +1,4 @@
+import { collectFinalResponseTextFromAgentEvents } from "../a2a/response-text.js";
 import {
   getStoredModelForEngine,
   normalizeModelForEngine,
@@ -13,6 +14,7 @@ import {
 import { startRun, resolveRunSoftTimeoutMs } from "../agent/run-manager.js";
 import { createThread } from "../chat-threads/store.js";
 import {
+  organizationIdFromResourceOwner,
   resourceListAllOwners,
   resourcePut,
   type Resource,
@@ -32,6 +34,12 @@ export interface JobFrontmatter {
   lastStatus?: "success" | "error" | "running" | "skipped";
   lastError?: string;
   nextRun?: string;
+  originScopeId?: string;
+  deliveryPlatform?: string;
+  deliveryDestination?: string;
+  deliveryThreadRef?: string;
+  deliveryTenantId?: string;
+  model?: string;
 }
 
 const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/;
@@ -101,6 +109,24 @@ export function parseJobFrontmatter(content: string): {
       case "nextRun":
         meta.nextRun = value;
         break;
+      case "originScopeId":
+        meta.originScopeId = value;
+        break;
+      case "deliveryPlatform":
+        meta.deliveryPlatform = value;
+        break;
+      case "deliveryDestination":
+        meta.deliveryDestination = value;
+        break;
+      case "deliveryThreadRef":
+        meta.deliveryThreadRef = value;
+        break;
+      case "deliveryTenantId":
+        meta.deliveryTenantId = value;
+        break;
+      case "model":
+        meta.model = value;
+        break;
     }
   }
 
@@ -128,6 +154,16 @@ export function buildJobContent(meta: JobFrontmatter, body: string): string {
     lines.push(`lastError: "${escaped}"`);
   }
   if (meta.nextRun) lines.push(`nextRun: ${meta.nextRun}`);
+  if (meta.originScopeId) lines.push(`originScopeId: ${meta.originScopeId}`);
+  if (meta.deliveryPlatform)
+    lines.push(`deliveryPlatform: ${meta.deliveryPlatform}`);
+  if (meta.deliveryDestination)
+    lines.push(`deliveryDestination: ${meta.deliveryDestination}`);
+  if (meta.deliveryThreadRef)
+    lines.push(`deliveryThreadRef: ${meta.deliveryThreadRef}`);
+  if (meta.deliveryTenantId)
+    lines.push(`deliveryTenantId: ${meta.deliveryTenantId}`);
+  if (meta.model) lines.push(`model: ${meta.model}`);
   lines.push(`---`);
   lines.push("");
   lines.push(body);
@@ -297,7 +333,12 @@ async function isJobRunAsStillValid(
 ): Promise<{ ok: boolean; reason?: string }> {
   // Shared-owner sentinel isn't a real user (used by jobs run as the
   // workspace identity).
-  if (jobUserEmail === "__shared__") return { ok: true };
+  if (
+    jobUserEmail === "__shared__" ||
+    organizationIdFromResourceOwner(jobUserEmail)
+  ) {
+    return { ok: true };
+  }
   try {
     const { getDbExec } = await import("../db/client.js");
     const db = getDbExec();
@@ -390,7 +431,36 @@ async function executeJob(
   await updateResource(resource, meta, body);
 
   await runWithRequestContext(
-    { userEmail: jobUserEmail, orgId: jobOrgId },
+    {
+      userEmail: jobUserEmail,
+      orgId: jobOrgId,
+      ...(meta.originScopeId &&
+      meta.deliveryPlatform &&
+      meta.deliveryDestination
+        ? {
+            isIntegrationCaller: true,
+            integration: {
+              taskId: `job:${jobName}:${now.getTime()}`,
+              scopeId: meta.originScopeId,
+              principalType: "service" as const,
+              incoming: {
+                platform: meta.deliveryPlatform,
+                externalThreadId: `${meta.deliveryTenantId || "unknown"}:${meta.deliveryDestination}:${meta.deliveryThreadRef || "root"}`,
+                text: "",
+                tenantId: meta.deliveryTenantId,
+                integrationScopeId: meta.originScopeId,
+                platformContext: {
+                  channelId: meta.deliveryDestination,
+                  threadTs: meta.deliveryThreadRef,
+                  teamId: meta.deliveryTenantId,
+                },
+                threadRef: meta.deliveryThreadRef,
+                timestamp: now.getTime(),
+              },
+            },
+          }
+        : {}),
+    },
     async () => {
       try {
         const actions = deps.getActions();
@@ -408,6 +478,7 @@ async function executeJob(
             appId: deps.appId,
           }));
         const modelCandidate =
+          meta.model ??
           deps.model ??
           (await getStoredModelForEngine(engine, { appId: deps.appId })) ??
           engine.defaultModel;
@@ -454,6 +525,7 @@ async function executeJob(
         const jobUsageRef: {
           current: Awaited<ReturnType<typeof runAgentLoop>> | null;
         } = { current: null };
+        let responseText = "";
         await new Promise<void>((resolve, reject) => {
           const activeRun = startRun(
             runId,
@@ -482,6 +554,9 @@ async function executeJob(
                 hardAbortTimer = null;
               }
               if (run.status === "completed") {
+                responseText = collectFinalResponseTextFromAgentEvents(
+                  (run.events ?? []).map((event) => event.event),
+                );
                 resolve();
               } else {
                 reject(new Error(`Job run ended with status: ${run.status}`));
@@ -515,6 +590,29 @@ async function executeJob(
 
         if (jobError) throw jobError;
 
+        if (
+          responseText.trim() &&
+          meta.deliveryPlatform &&
+          meta.deliveryDestination
+        ) {
+          const { getDefaultAdapter } =
+            await import("../integrations/adapters/index.js");
+          const adapter = getDefaultAdapter(meta.deliveryPlatform);
+          if (!adapter?.sendMessageToTarget) {
+            throw new Error(
+              `Recurring job delivery is not supported for ${meta.deliveryPlatform}`,
+            );
+          }
+          await adapter.sendMessageToTarget(
+            adapter.formatAgentResponse(responseText),
+            {
+              destination: meta.deliveryDestination,
+              threadRef: meta.deliveryThreadRef ?? null,
+              tenantId: meta.deliveryTenantId,
+            },
+          );
+        }
+
         const jobUsage = jobUsageRef.current;
         if (
           jobUsage &&

package/corpus/core/src/jobs/tools.ts

@@ -5,11 +5,14 @@ import {
   resourceGetByPath,
   resourceList,
   resourceDelete,
+  organizationIdFromResourceOwner,
+  sharedResourceOwner,
   SHARED_OWNER,
 } from "../resources/store.js";
 import {
   getRequestUserEmail,
   getRequestOrgId,
+  getIntegrationRequestContext,
 } from "../server/request-context.js";
 import { isValidCron, nextOccurrence, describeCron } from "./cron.js";
 import {
@@ -24,6 +27,10 @@ function getOwner(): string {
   return email;
 }
 
+function getSharedOwner(): string {
+  return sharedResourceOwner(getRequestOrgId());
+}
+
 /**
  * Determine if the current request's user is an org owner/admin in the
  * given org. Used to allow privileged users to update or delete shared
@@ -65,7 +72,8 @@ async function authorizeJobMutation(
   resourceOwner: string,
   meta: JobFrontmatter,
 ): Promise<string | null> {
-  if (resourceOwner !== SHARED_OWNER) {
+  const resourceOrgId = organizationIdFromResourceOwner(resourceOwner);
+  if (resourceOwner !== SHARED_OWNER && !resourceOrgId) {
     // Personal-scope job — owner is the request's user. resourceGetByPath is
     // already scoped to the caller, so we know meta.createdBy must match.
     return null;
@@ -76,7 +84,7 @@ async function authorizeJobMutation(
 
   // Allow org owners/admins to manage shared jobs created by other members.
   const isAdmin = await isCurrentUserOrgAdmin(
-    meta.orgId ?? getRequestOrgId() ?? undefined,
+    resourceOrgId ?? meta.orgId ?? getRequestOrgId() ?? undefined,
   );
   if (isAdmin) return null;
 
@@ -84,7 +92,7 @@ async function authorizeJobMutation(
 }
 
 async function runCreate(args: Record<string, any>): Promise<string> {
-  const { name, schedule, instructions, scope, runAs } = args;
+  const { name, schedule, instructions, scope, runAs, model } = args;
 
   if (!name || !schedule || !instructions) {
     return JSON.stringify({
@@ -98,10 +106,13 @@ async function runCreate(args: Record<string, any>): Promise<string> {
     });
   }
 
-  const owner = scope === "personal" ? getOwner() : SHARED_OWNER;
+  const owner = scope === "personal" ? getOwner() : getSharedOwner();
   const path = `jobs/${name}.md`;
   const now = new Date();
   const next = nextOccurrence(schedule, now);
+  const integration = getIntegrationRequestContext();
+  const channelId = integration?.incoming.platformContext.channelId;
+  const threadRef = integration?.incoming.threadRef;
 
   const meta: JobFrontmatter = {
     schedule,
@@ -110,6 +121,20 @@ async function runCreate(args: Record<string, any>): Promise<string> {
     orgId: getRequestOrgId() || undefined,
     runAs: runAs === "shared" ? "shared" : "creator",
     nextRun: next.toISOString(),
+    ...(integration?.scopeId ? { originScopeId: integration.scopeId } : {}),
+    ...(integration?.incoming.platform
+      ? { deliveryPlatform: integration.incoming.platform }
+      : {}),
+    ...(typeof channelId === "string"
+      ? { deliveryDestination: channelId }
+      : {}),
+    ...(typeof threadRef === "string" ? { deliveryThreadRef: threadRef } : {}),
+    ...(integration?.incoming.tenantId
+      ? { deliveryTenantId: integration.incoming.tenantId }
+      : {}),
+    ...(typeof model === "string" && model.trim()
+      ? { model: model.trim() }
+      : {}),
   };
 
   const content = buildJobContent(meta, instructions);
@@ -128,10 +153,11 @@ async function runCreate(args: Record<string, any>): Promise<string> {
 
 async function runList(args: Record<string, any>): Promise<string> {
   const owner = getOwner();
+  const sharedOwner = getSharedOwner();
   // Fetch only current user's and shared jobs (not other users')
   const [personal, shared] = await Promise.all([
     resourceList(owner, "jobs/"),
-    resourceList(SHARED_OWNER, "jobs/"),
+    resourceList(sharedOwner, "jobs/"),
   ]);
   let resources = [...personal, ...shared];
   if (args.scope === "personal") resources = personal;
@@ -146,7 +172,7 @@ async function runList(args: Record<string, any>): Promise<string> {
       return {
         name: r.path.replace(/^jobs\//, "").replace(/\.md$/, ""),
         path: r.path,
-        scope: r.owner === SHARED_OWNER ? "shared" : "personal",
+        scope: r.owner === sharedOwner ? "shared" : "personal",
         schedule: meta.schedule,
         scheduleDescription: meta.schedule ? describeCron(meta.schedule) : "",
         enabled: meta.enabled,
@@ -154,6 +180,10 @@ async function runList(args: Record<string, any>): Promise<string> {
         lastStatus: meta.lastStatus || null,
         lastError: meta.lastError || null,
         nextRun: meta.nextRun || null,
+        originScopeId: meta.originScopeId || null,
+        deliveryPlatform: meta.deliveryPlatform || null,
+        deliveryDestination: meta.deliveryDestination || null,
+        model: meta.model || null,
       };
     }),
   );
@@ -166,11 +196,11 @@ async function runList(args: Record<string, any>): Promise<string> {
 }
 
 async function runUpdate(args: Record<string, any>): Promise<string> {
-  const { name, schedule, instructions, enabled, scope, runAs } = args;
+  const { name, schedule, instructions, enabled, scope, runAs, model } = args;
   const path = `jobs/${name}.md`;
 
   // Try to find the resource
-  let resource = await resourceGetByPath(SHARED_OWNER, path);
+  let resource = await resourceGetByPath(getSharedOwner(), path);
   if (!resource && scope !== "shared") {
     resource = await resourceGetByPath(getOwner(), path);
   }
@@ -211,6 +241,7 @@ async function runUpdate(args: Record<string, any>): Promise<string> {
   if (runAs === "creator" || runAs === "shared") {
     meta.runAs = runAs;
   }
+  if (typeof model === "string" && model.trim()) meta.model = model.trim();
 
   const newBody = instructions || body;
   const content = buildJobContent(meta, newBody);
@@ -230,7 +261,7 @@ async function runDelete(args: Record<string, any>): Promise<string> {
   const { name, scope } = args;
   const path = `jobs/${name}.md`;
 
-  let resource = await resourceGetByPath(SHARED_OWNER, path);
+  let resource = await resourceGetByPath(getSharedOwner(), path);
   if (!resource && scope !== "shared") {
     resource = await resourceGetByPath(getOwner(), path);
   }
@@ -306,6 +337,11 @@ Cron format is 5 fields: minute hour day-of-month month day-of-week. Common patt
                 "Who shared jobs execute as: creator or shared. Default: creator. Used with create and update.",
               enum: ["creator", "shared"],
             },
+            model: {
+              type: "string",
+              description:
+                "Optional model id for this routine. The channel/app/engine default is used when omitted.",
+            },
           },
           required: ["action"],
         },

package/corpus/core/src/localization/default-messages.ts

@@ -211,6 +211,34 @@ const messages = {
     cliRequiresDevModeDescription:
       "Run this app locally with pnpm dev or use Builder.io to access the CLI terminal.",
     toggleAgent: "Toggle agent",
+    voiceMode: {
+      entryButtonLabel: "Use microphone",
+      promptTitle: "Talk to your app",
+      promptDescription:
+        "Voice mode keeps listening while the agent navigates and takes actions.",
+      start: "Start voice mode",
+      keepDictating: "Keep dictating",
+      showChat: "Show chat",
+      hideChat: "Hide chat",
+      end: "End voice mode",
+      status: {
+        connecting: "Connecting",
+        listening: "Listening",
+        speaking: "Speaking",
+        working: "Working",
+        error: "Voice mode needs attention",
+        ending: "Ending voice mode",
+      },
+      errors: {
+        unsupported:
+          "This browser does not support realtime voice conversations.",
+        responseFailed: "OpenAI could not complete the voice response.",
+        sessionFailed: "The realtime voice session encountered an error.",
+        channelDisconnected: "The realtime voice control channel disconnected.",
+        connectionFailed: "The realtime voice connection failed.",
+        offerFailed: "The browser did not create an audio offer.",
+      },
+    },
   },
   share: {
     titleWithResource: 'Share "{{title}}"',

package/corpus/core/src/mcp-client/config.ts

@@ -71,6 +71,8 @@ export interface McpConfig {
   source?: string;
 }
 
+const DESKTOP_COMPUTER_SERVER_ID = "agent-native-desktop-computer";
+
 function isNode(): boolean {
   return (
     typeof process !== "undefined" &&
@@ -148,8 +150,52 @@ export function loadMcpConfig(startDir?: string): McpConfig | null {
     }
   }
 
-  if (fileConfig) return fileConfig;
-  return envConfig;
+  return mergeDesktopChildComputerConfig(fileConfig ?? envConfig);
+}
+
+/**
+ * The desktop process supplies this configuration only to a child it spawned
+ * for a specific Agent run. Raw MCP config cannot opt into this trust path:
+ * the explicit child gate, loopback URL, and strong per-run bearer are all
+ * required. Existing user servers always win on key collisions.
+ */
+function mergeDesktopChildComputerConfig(
+  base: McpConfig | null,
+): McpConfig | null {
+  if (process.env.AGENT_NATIVE_DESKTOP_CHILD !== "1") return base;
+  const url = process.env.AGENT_NATIVE_DESKTOP_COMPUTER_MCP_URL?.trim();
+  const token = process.env.AGENT_NATIVE_DESKTOP_COMPUTER_MCP_TOKEN?.trim();
+  if (!url || !token || !/^[A-Za-z0-9_-]{32,}$/.test(token)) return base;
+  try {
+    const parsed = new URL(url);
+    if (
+      parsed.protocol !== "http:" ||
+      parsed.hostname !== "127.0.0.1" ||
+      parsed.pathname !== "/mcp" ||
+      parsed.username ||
+      parsed.password
+    ) {
+      return base;
+    }
+  } catch {
+    return base;
+  }
+  const servers = { ...(base?.servers ?? {}) };
+  let serverId = DESKTOP_COMPUTER_SERVER_ID;
+  for (let suffix = 2; servers[serverId]; suffix += 1) {
+    serverId = `${DESKTOP_COMPUTER_SERVER_ID}-${suffix}`;
+  }
+  servers[serverId] = {
+    type: "http",
+    url,
+    headers: { Authorization: `Bearer ${token}` },
+    description:
+      "Authenticated computer control for this Agent Native desktop task",
+  };
+  return {
+    servers,
+    source: base?.source ? `${base.source}+desktop-child` : "desktop-child",
+  };
 }
 
 function readEnvConfig(): McpConfig | null {

package/corpus/core/src/mcp-client/index.ts

@@ -81,6 +81,15 @@ export { fetchHubServers } from "./hub-client.js";
 
 export { isMcpToolAllowedForRequest } from "./visibility.js";
 import { isMcpToolAllowedForRequest } from "./visibility.js";
+export {
+  classifyMcpToolCall,
+  evaluateMcpToolCallPolicy,
+  type McpToolCallClassification,
+  type McpToolEffect,
+  type McpToolFamily,
+  type McpToolInvocationPolicy,
+  type McpToolPolicyDecision,
+} from "./tool-policy.js";
 export {
   configureScreenMemory,
   queryScreenMemoryContext,
@@ -120,13 +129,22 @@ import {
   type McpActionResult,
 } from "./app-result.js";
 import type { McpClientManager, McpTool } from "./manager.js";
+import {
+  evaluateMcpToolCallPolicy,
+  type McpToolInvocationPolicy,
+} from "./tool-policy.js";
+
+export interface McpActionEntryOptions {
+  invocationPolicy?: McpToolInvocationPolicy;
+}
 
 export function mcpToolsToActionEntries(
   manager: McpClientManager,
+  options: McpActionEntryOptions = {},
 ): Record<string, ActionEntry> {
   const entries: Record<string, ActionEntry> = {};
   for (const tool of manager.getTools().filter(isVisibleToModel)) {
-    entries[tool.name] = mcpToolToActionEntry(manager, tool);
+    entries[tool.name] = mcpToolToActionEntry(manager, tool, options);
   }
   return entries;
 }
@@ -159,6 +177,7 @@ export function syncMcpActionEntries(
 function mcpToolToActionEntry(
   manager: McpClientManager,
   tool: McpTool,
+  options: McpActionEntryOptions = {},
 ): ActionEntry {
   return {
     tool: {
@@ -167,7 +186,7 @@ function mcpToolToActionEntry(
     },
     http: false,
     ...(tool.annotations?.readOnlyHint === true ? { readOnly: true } : {}),
-    run: async (args: Record<string, string>) => {
+    run: async (args: Record<string, unknown>) => {
       // Defense-in-depth: even if a cross-scope MCP tool somehow makes it
       // into the LLM's visible tool list, reject invocation here so we never
       // execute a user's credentials on behalf of another user.
@@ -178,6 +197,20 @@ function mcpToolToActionEntry(
           `Error: MCP tool ${tool.name} is not available in the current request scope.`,
         );
       }
+      if (options.invocationPolicy) {
+        const decision = evaluateMcpToolCallPolicy(
+          options.invocationPolicy,
+          tool,
+          args,
+        );
+        if (!decision.allowed) {
+          return buildMcpErrorActionResult(
+            tool,
+            args,
+            `Error: MCP tool ${tool.name} is unavailable in read-only mode: ${decision.reason}.`,
+          );
+        }
+      }
       try {
         const result = await manager.callTool(tool.name, args);
         return await buildMcpActionResult(manager, tool, args, result);

package/corpus/core/src/mcp-client/tool-policy.ts

@@ -0,0 +1,182 @@
+import type { McpTool } from "./manager.js";
+
+export type McpToolFamily = "browser" | "computer" | "other";
+export type McpToolEffect = "read" | "write" | "unknown";
+
+export interface McpToolCallClassification {
+  family: McpToolFamily;
+  effect: McpToolEffect;
+  reason: string;
+}
+
+export interface McpToolInvocationPolicy {
+  mode: "allow-all" | "read-only";
+}
+
+export interface McpToolPolicyDecision extends McpToolCallClassification {
+  allowed: boolean;
+}
+
+const READ_OPERATIONS = new Set([
+  "capture",
+  "fetch",
+  "get",
+  "inspect",
+  "list",
+  "lookup",
+  "observe",
+  "query",
+  "read",
+  "search",
+  "screenshot",
+  "snapshot",
+  "status",
+  "view",
+]);
+
+const WRITE_OPERATIONS = new Set([
+  "click",
+  "close",
+  "create",
+  "delete",
+  "drag",
+  "evaluate",
+  "execute",
+  "fill",
+  "focus",
+  "hover",
+  "key",
+  "move",
+  "navigate",
+  "open",
+  "press",
+  "reload",
+  "scroll",
+  "select",
+  "set",
+  "submit",
+  "type",
+  "upload",
+]);
+
+/**
+ * Classify an MCP call using both the declared tool and its runtime arguments.
+ * Runtime inspection is necessary for combined computer tools whose `action`
+ * selects between observation (for example `screenshot`) and mutation (for
+ * example `click`). Unknown computer/browser operations intentionally remain
+ * unknown so read-only callers can fail closed.
+ */
+export function classifyMcpToolCall(
+  tool: McpTool,
+  args: Record<string, unknown>,
+): McpToolCallClassification {
+  const family = classifyToolFamily(tool);
+  if (family === "other") {
+    if (tool.annotations?.readOnlyHint === true) {
+      return {
+        family,
+        effect: "read",
+        reason: "MCP readOnlyHint marks this tool as read-only",
+      };
+    }
+    if (tool.annotations?.readOnlyHint === false) {
+      return {
+        family,
+        effect: "write",
+        reason: "MCP readOnlyHint marks this tool as mutating",
+      };
+    }
+    return classifyKnownOperation(
+      family,
+      normalizedOperation(tool.originalName),
+      "unannotated tool name",
+    );
+  }
+
+  const runtimeAction = normalizedOperation(args.action);
+  if (runtimeAction) {
+    return classifyKnownOperation(family, runtimeAction, "runtime action");
+  }
+
+  const toolOperation = normalizedOperation(tool.originalName);
+  return classifyKnownOperation(family, toolOperation, "tool name");
+}
+
+export function evaluateMcpToolCallPolicy(
+  policy: McpToolInvocationPolicy,
+  tool: McpTool,
+  args: Record<string, unknown>,
+): McpToolPolicyDecision {
+  const classification = classifyMcpToolCall(tool, args);
+  if (policy.mode === "allow-all") {
+    return { ...classification, allowed: true };
+  }
+
+  // Plan mode is fail-closed. Unannotated tools remain available only when
+  // their declared operation name is an explicitly recognized read verb.
+  const allowed = classification.effect === "read";
+  return { ...classification, allowed };
+}
+
+function classifyToolFamily(tool: McpTool): McpToolFamily {
+  const source = normalizeIdentifier(tool.source);
+  const name = normalizeIdentifier(tool.originalName);
+  const combined = `${source} ${name}`;
+  if (/\b(browser|chrome|playwright|puppeteer)\b/.test(combined)) {
+    return "browser";
+  }
+  if (/\b(computer|desktop|screen|mouse|keyboard)\b/.test(combined)) {
+    return "computer";
+  }
+  return "other";
+}
+
+function classifyKnownOperation(
+  family: McpToolFamily,
+  value: string | undefined,
+  source: string,
+): McpToolCallClassification {
+  if (!value) {
+    return {
+      family,
+      effect: "unknown",
+      reason: `${family} ${source} is missing or ambiguous`,
+    };
+  }
+  const tokens = value.split(" ");
+  if (tokens.some((token) => WRITE_OPERATIONS.has(token))) {
+    return {
+      family,
+      effect: "write",
+      reason: `${family} ${source} selects a mutating operation`,
+    };
+  }
+  if (tokens.some((token) => READ_OPERATIONS.has(token))) {
+    return {
+      family,
+      effect: "read",
+      reason: `${family} ${source} selects an observation operation`,
+    };
+  }
+  return {
+    family,
+    effect: "unknown",
+    reason:
+      family === "other"
+        ? `${family} ${source} is not a recognized safe read operation`
+        : `${family} ${source} is not a recognized safe observation operation`,
+  };
+}
+
+function normalizedOperation(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const normalized = normalizeIdentifier(value);
+  return normalized || undefined;
+}
+
+function normalizeIdentifier(value: string): string {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, " ")
+    .trim();
+}