@agent-native/core 0.98.4 → 0.98.6

package/corpus/core/src/integrations/identity-links-store.ts

@@ -0,0 +1,210 @@
+/**
+ * Durable links between a verified provider identity and an Agent Native user.
+ * Provider credentials and raw provider payloads never belong in this table.
+ */
+
+import { randomUUID } from "node:crypto";
+
+import {
+  getDbExec,
+  intType,
+  isPostgres,
+  isUniqueViolation,
+  retryOnDdlRace,
+} from "../db/client.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
+
+const TABLE = "integration_identity_links";
+let _initPromise: Promise<void> | undefined;
+
+export interface IntegrationIdentityLink {
+  id: string;
+  platform: string;
+  tenantId: string;
+  externalUserId: string;
+  userEmail: string;
+  orgId: string;
+  createdAt: number;
+  updatedAt: number;
+}
+
+function createSql(): string {
+  const integer = intType();
+  return `CREATE TABLE IF NOT EXISTS ${TABLE} (
+    id TEXT PRIMARY KEY,
+    platform TEXT NOT NULL,
+    tenant_id TEXT NOT NULL,
+    external_user_id TEXT NOT NULL,
+    user_email TEXT NOT NULL,
+    org_id TEXT NOT NULL,
+    created_at ${integer} NOT NULL,
+    updated_at ${integer} NOT NULL
+  )`;
+}
+
+const INDEXES = [
+  [
+    "idx_integration_identity_links_external",
+    `CREATE UNIQUE INDEX IF NOT EXISTS idx_integration_identity_links_external
+      ON ${TABLE}(platform, tenant_id, external_user_id)`,
+  ],
+  [
+    "idx_integration_identity_links_account",
+    `CREATE INDEX IF NOT EXISTS idx_integration_identity_links_account
+      ON ${TABLE}(org_id, user_email)`,
+  ],
+] as const;
+
+async function ensureTable(): Promise<void> {
+  if (!_initPromise) {
+    _initPromise = (async () => {
+      const client = getDbExec();
+      if (isPostgres()) {
+        await ensureTableExists(TABLE, createSql());
+        for (const [name, sql] of INDEXES) {
+          await ensureIndexExists(name, sql);
+        }
+        return;
+      }
+      await retryOnDdlRace(() => client.execute(createSql()));
+      for (const [, sql] of INDEXES) {
+        await retryOnDdlRace(() => client.execute(sql));
+      }
+    })().catch((error) => {
+      _initPromise = undefined;
+      throw error;
+    });
+  }
+  return _initPromise;
+}
+
+function required(value: string, name: string): string {
+  const normalized = value.trim();
+  if (!normalized) throw new Error(`${name} is required`);
+  if (normalized.length > 512) throw new Error(`${name} is too long`);
+  return normalized;
+}
+
+function normalizePlatform(value: string): string {
+  return required(value, "platform").toLowerCase();
+}
+
+function normalizeEmail(value: string): string {
+  const normalized = required(value, "userEmail").toLowerCase();
+  if (!normalized.includes("@")) throw new Error("userEmail must be an email");
+  return normalized;
+}
+
+function rowToLink(row: Record<string, unknown>): IntegrationIdentityLink {
+  return {
+    id: String(row.id),
+    platform: String(row.platform),
+    tenantId: String(row.tenant_id),
+    externalUserId: String(row.external_user_id),
+    userEmail: String(row.user_email),
+    orgId: String(row.org_id),
+    createdAt: Number(row.created_at ?? 0),
+    updatedAt: Number(row.updated_at ?? 0),
+  };
+}
+
+async function selectByExternalIdentity(
+  platform: string,
+  tenantId: string,
+  externalUserId: string,
+): Promise<IntegrationIdentityLink | null> {
+  await ensureTable();
+  const { rows } = await getDbExec().execute({
+    sql: `SELECT * FROM ${TABLE}
+      WHERE platform = ? AND tenant_id = ? AND external_user_id = ?
+      LIMIT 1`,
+    args: [platform, tenantId, externalUserId],
+  });
+  return rows[0] ? rowToLink(rows[0] as Record<string, unknown>) : null;
+}
+
+function matchesVerifiedLink(
+  row: IntegrationIdentityLink,
+  input: { userEmail: string; orgId: string },
+): boolean {
+  return row.userEmail === input.userEmail && row.orgId === input.orgId;
+}
+
+/** Persist a verified mapping and fail closed if it changes identity later. */
+export async function upsertVerifiedIntegrationIdentity(input: {
+  platform: string;
+  tenantId: string;
+  externalUserId: string;
+  userEmail: string;
+  orgId: string;
+}): Promise<IntegrationIdentityLink> {
+  const platform = normalizePlatform(input.platform);
+  const tenantId = required(input.tenantId, "tenantId");
+  const externalUserId = required(input.externalUserId, "externalUserId");
+  const userEmail = normalizeEmail(input.userEmail);
+  const orgId = required(input.orgId, "orgId");
+  const existing = await selectByExternalIdentity(
+    platform,
+    tenantId,
+    externalUserId,
+  );
+
+  if (existing) {
+    if (!matchesVerifiedLink(existing, { userEmail, orgId })) {
+      throw new Error(
+        "This provider identity is already linked to a different Agent Native account.",
+      );
+    }
+    const updatedAt = Date.now();
+    await getDbExec().execute({
+      sql: `UPDATE ${TABLE} SET updated_at = ? WHERE id = ?`,
+      args: [updatedAt, existing.id],
+    });
+    return { ...existing, updatedAt };
+  }
+
+  const id = randomUUID();
+  const now = Date.now();
+  try {
+    await getDbExec().execute({
+      sql: `INSERT INTO ${TABLE} (
+        id, platform, tenant_id, external_user_id, user_email, org_id,
+        created_at, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        id,
+        platform,
+        tenantId,
+        externalUserId,
+        userEmail,
+        orgId,
+        now,
+        now,
+      ],
+    });
+  } catch (error) {
+    if (!isUniqueViolation(error)) throw error;
+    const raced = await selectByExternalIdentity(
+      platform,
+      tenantId,
+      externalUserId,
+    );
+    if (!raced || !matchesVerifiedLink(raced, { userEmail, orgId })) {
+      throw new Error(
+        "This provider identity is already linked to a different Agent Native account.",
+      );
+    }
+    return raced;
+  }
+
+  return {
+    id,
+    platform,
+    tenantId,
+    externalUserId,
+    userEmail,
+    orgId,
+    createdAt: now,
+    updatedAt: now,
+  };
+}

package/corpus/core/src/integrations/identity.ts

@@ -0,0 +1,132 @@
+import { getDbExec } from "../db/client.js";
+import { upsertVerifiedIntegrationIdentity } from "./identity-links-store.js";
+import {
+  getActiveIntegrationInstallationByKey,
+  getActiveIntegrationInstallationForTenant,
+} from "./installations-store.js";
+import { slackInstallationKey } from "./slack-oauth.js";
+import type { IncomingMessage, IntegrationExecutionContext } from "./types.js";
+
+function serviceOwner(platform: string): string {
+  return `integration@${platform}`;
+}
+
+function normalizedEmail(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const email = value.trim().toLowerCase();
+  if (!email || email.length > 320 || !email.includes("@")) return null;
+  return email;
+}
+
+async function resolveSlackInstallation(incoming: IncomingMessage) {
+  const teamId =
+    typeof incoming.platformContext.teamId === "string"
+      ? incoming.platformContext.teamId
+      : incoming.tenantId;
+  const enterpriseId =
+    typeof incoming.platformContext.enterpriseId === "string"
+      ? incoming.platformContext.enterpriseId
+      : undefined;
+  const apiAppId =
+    typeof incoming.platformContext.apiAppId === "string"
+      ? incoming.platformContext.apiAppId
+      : undefined;
+  if (apiAppId && (teamId || enterpriseId)) {
+    const byKey = await getActiveIntegrationInstallationByKey(
+      "slack",
+      slackInstallationKey({ teamId, enterpriseId, apiAppId }),
+    );
+    if (byKey) return byKey;
+  }
+  return teamId || enterpriseId
+    ? getActiveIntegrationInstallationForTenant(
+        "slack",
+        teamId ?? enterpriseId!,
+      )
+    : null;
+}
+
+async function isMemberOfOrg(email: string, orgId: string): Promise<boolean> {
+  try {
+    const { rows } = await getDbExec().execute({
+      sql: `SELECT 1 FROM org_members
+        WHERE org_id = ? AND LOWER(email) = ?
+        LIMIT 1`,
+      args: [orgId, email],
+    });
+    return rows.length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Resolve the default integration principal.
+ *
+ * Slack DMs become a user principal only after the adapter has verified the
+ * sender email and the email is already a member of the managed installation's
+ * Agent Native organization. Shared channels deliberately stay service-scoped
+ * so a channel message cannot borrow one participant's private permissions.
+ */
+export async function resolveDefaultIntegrationExecutionContext(
+  incoming: IncomingMessage,
+): Promise<IntegrationExecutionContext> {
+  const installation =
+    incoming.platform === "slack"
+      ? await resolveSlackInstallation(incoming)
+      : null;
+
+  if (incoming.platform !== "slack" || incoming.conversationType !== "dm") {
+    return {
+      ownerEmail: serviceOwner(incoming.platform),
+      orgId: installation?.orgId ?? null,
+      principalType: "service",
+      ...(installation?.id ? { installationId: installation.id } : {}),
+    };
+  }
+
+  const email = normalizedEmail(incoming.senderEmail);
+  if (
+    !email ||
+    incoming.senderVerified !== true ||
+    !incoming.senderId ||
+    !incoming.tenantId
+  ) {
+    throw new Error(
+      "Slack DM sender identity could not be verified; refusing to run with a service principal.",
+    );
+  }
+  if (
+    incoming.actorTrust?.memberType === "guest" ||
+    incoming.actorTrust?.memberType === "external"
+  ) {
+    throw new Error(
+      "External or guest Slack members cannot use personal Agent Native permissions.",
+    );
+  }
+  if (!installation?.orgId) {
+    throw new Error(
+      "Slack workspace is not connected to an Agent Native organization.",
+    );
+  }
+
+  if (!(await isMemberOfOrg(email, installation.orgId))) {
+    throw new Error(
+      "Slack DM sender is not a member of the connected Agent Native organization.",
+    );
+  }
+
+  const link = await upsertVerifiedIntegrationIdentity({
+    platform: incoming.platform,
+    tenantId: incoming.tenantId,
+    externalUserId: incoming.senderId,
+    userEmail: email,
+    orgId: installation.orgId,
+  });
+  return {
+    ownerEmail: link.userEmail,
+    orgId: link.orgId,
+    principalType: "user",
+    installationId: installation.id,
+  };
+}

package/corpus/core/src/integrations/index.ts

@@ -18,6 +18,12 @@ export type {
 } from "./types.js";
 export { assertPlatformCapability } from "./types.js";
 
+export { resolveDefaultIntegrationExecutionContext } from "./identity.js";
+export {
+  upsertVerifiedIntegrationIdentity,
+  type IntegrationIdentityLink,
+} from "./identity-links-store.js";
+
 export {
   BUILT_IN_INTEGRATION_CATALOG,
   INTEGRATION_CATEGORIES,

package/corpus/core/src/integrations/plugin.ts

@@ -53,6 +53,7 @@ import {
   startGoogleDocsPoller,
   handlePushNotification,
 } from "./google-docs-poller.js";
+import { resolveDefaultIntegrationExecutionContext } from "./identity.js";
 import {
   disconnectIntegrationInstallation,
   listIntegrationInstallations,
@@ -2343,13 +2344,53 @@ export function createIntegrationsPlugin(
             return { error: `Integration ${platform} is not enabled` };
           }
 
-          const incoming = await withCredentialContext(credentialContext, () =>
+          let incoming = await withCredentialContext(credentialContext, () =>
             adapter.parseIncomingMessage(event),
           );
           if (!incoming) {
             setResponseStatus(event, 200);
             return "ok";
           }
+          if (adapter.hydrateIncomingIdentity) {
+            try {
+              incoming = await withCredentialContext(credentialContext, () =>
+                adapter.hydrateIncomingIdentity!(incoming!),
+              );
+            } catch (err) {
+              // Identity hydration is best-effort for platforms that have an
+              // app-specific resolver. Slack's default DM resolver below will
+              // still fail closed when the identity is absent or unverified.
+              console.warn(
+                `[integrations] Could not hydrate ${platform} sender identity:`,
+                err instanceof Error ? err.message : err,
+              );
+            }
+          }
+          let defaultExecutionContext: IntegrationExecutionContext | null =
+            null;
+          if (
+            incoming.platform === "slack" &&
+            incoming.conversationType === "dm"
+          ) {
+            try {
+              defaultExecutionContext = await withCredentialContext(
+                credentialContext,
+                () => resolveDefaultIntegrationExecutionContext(incoming!),
+              );
+            } catch (err) {
+              // An app-specific resolver may intentionally support a legacy
+              // Slack setup. When no override exists, the branch below fails
+              // closed instead of falling back to a service principal.
+              if (!options?.resolveExecutionContext && !options?.resolveOwner) {
+                console.error(
+                  `[integrations] default Slack DM identity denied message:`,
+                  err,
+                );
+                setResponseStatus(event, 200);
+                return "ok";
+              }
+            }
+          }
           let executionContext: IntegrationExecutionContext = {
             ownerEmail: `integration@${platform}`,
             orgId: null as string | null,
@@ -2370,6 +2411,8 @@ export function createIntegrationsPlugin(
               setResponseStatus(event, 200);
               return "ok";
             }
+          } else if (defaultExecutionContext) {
+            executionContext = defaultExecutionContext;
           } else if (options?.resolveOwner) {
             try {
               executionContext.ownerEmail = await withCredentialContext(
@@ -2382,6 +2425,20 @@ export function createIntegrationsPlugin(
                 err,
               );
             }
+          } else {
+            try {
+              executionContext = await withCredentialContext(
+                credentialContext,
+                () => resolveDefaultIntegrationExecutionContext(incoming!),
+              );
+            } catch (err) {
+              console.error(
+                `[integrations] default execution identity denied message:`,
+                err,
+              );
+              setResponseStatus(event, 200);
+              return "ok";
+            }
           }
           if (executionContext.scopeId) {
             incoming.integrationScopeId = executionContext.scopeId;

package/corpus/core/src/integrations/types.ts

@@ -274,6 +274,13 @@ export interface PlatformAdapter {
    */
   hydrateIncomingMessage?(incoming: IncomingMessage): Promise<IncomingMessage>;
 
+  /**
+   * Hydrate only verified sender identity before execution-context selection.
+   * This runs on the provider acknowledgement path and must avoid fetching
+   * conversation history or file bodies.
+   */
+  hydrateIncomingIdentity?(incoming: IncomingMessage): Promise<IncomingMessage>;
+
   /**
    * Provider-specific response returned only after a message is verified and
    * durably enqueued. Discord uses this to return a type-5 deferred response

package/corpus/core/src/mcp/build-server.ts

@@ -51,6 +51,7 @@ import {
   MCP_CONNECT_SCOPE,
 } from "./connect-store.js";
 import { MCP_APP_REQUEST_ORIGIN_CSP_SOURCE } from "./embed-app.js";
+import type { ExternalAgentPolicy } from "./external-agent-policy.js";
 import {
   MCP_OAUTH_SCOPES,
   hasMcpOAuthScope,
@@ -124,8 +125,9 @@ export interface MCPConfig {
    * from connectors. It is no longer gated behind an environment variable, and
    * the catalog is never inferred from the client name/user-agent.
    *
-   * `tool-search` stays available in the compact catalog so any trimmed tool is
-   * reachable on demand. Callers who need the full surface up front opt in
+   * `tool-search` stays available in the compact catalog for discovery. A
+   * searched action still needs the connector catalog or authenticated-read
+   * policy before `tools/call`; callers who need the full surface up front opt in
    * explicitly with `agent-native connect --full-catalog` (embeds a
    * `catalog_scope: "full"` claim in the connect-minted JWT) or the
    * deployment-wide `AGENT_NATIVE_MCP_FULL_CATALOG=1` env override.
@@ -134,6 +136,11 @@ export interface MCPConfig {
    * setting it on `MCPConfig` directly; the plugin copies it through.
    */
   connectorCatalog?: string[];
+  /**
+   * Optional policy for automatically exposing explicitly annotated,
+   * authenticated read actions to external MCP callers.
+   */
+  externalAgents?: ExternalAgentPolicy;
 }
 
 /**
@@ -281,7 +288,7 @@ function explicitlyRequestsFullMcpCatalog(
   // (100k+ tokens) into a context window just because a client called itself
   // "code"/"cursor"/"codex" was a recurring footgun. Everything else gets the
   // connector/compact catalog plus `tool-search`, which keeps every tool
-  // reachable on demand.
+  // discoverable; only permitted actions are callable without full opt-in.
   if (process.env.AGENT_NATIVE_MCP_FULL_CATALOG === "1") return true;
   return requestMeta?.fullCatalog === true;
 }
@@ -309,17 +316,101 @@ function warnFullCatalogServed(toolCount: number): void {
   );
 }
 
+function isAuthenticatedReadAction(entry: ActionEntry): boolean {
+  return (
+    entry.http !== false &&
+    entry.http?.method === "GET" &&
+    entry.readOnly === true &&
+    entry.publicAgent?.expose === true &&
+    entry.publicAgent.readOnly === true &&
+    entry.publicAgent.requiresAuth === true
+  );
+}
+
 /**
- * Returns true when the given action name is in the template's connector
- * catalog, OR is a builtin cross-app tool that is always included for
- * external connector clients. Builtin tool names from
- * `COMPACT_MCP_APP_CATALOG_BUILTINS` are always allowed since they are the
- * stable external-agent verb set.
+ * Hard exclusion list for the `authenticatedReads: "auto"` derivation ONLY
+ * (see `autoAuthenticatedReadNames` below). Explicit `connectorCatalog`
+ * entries are a deliberate, reviewed choice made by the app and are NOT
+ * affected by this list — an app can still list any of these names in
+ * `connectorCatalog` on purpose.
+ *
+ * These are the footgun families this file's other comments already call
+ * out ("removes footguns (db-exec, seed-*, extension tools, browser-session
+ * tools, etc.)" above, and "keeps db-exec / seed-* / extension /
+ * browser-session footguns off the external surface" near the connector
+ * tier below): generic core SQL access, template demo/seed data, the
+ * extension-management suite, live browser-session control, and Context
+ * X-Ray internals. `isAuthenticatedReadAction` only inspects action
+ * metadata (http/readOnly/publicAgent flags) — nothing stops a future
+ * change from mis-annotating one of these with that exact flag set again,
+ * the way `db-query`/`db-schema` were briefly (and accidentally) annotated
+ * before it was caught in review. These names can never be auto-derived
+ * from metadata alone; exposing one to external callers requires an
+ * explicit `connectorCatalog` entry.
  */
-function isActionInConnectorCatalog(name: string, config: MCPConfig): boolean {
-  if (COMPACT_MCP_APP_CATALOG_BUILTINS.has(name)) return true;
-  if (!Array.isArray(config.connectorCatalog)) return false;
-  return config.connectorCatalog.includes(name);
+const AUTO_READ_EXCLUDED_ACTION_NAMES = new Set([
+  "db-query",
+  "db-schema",
+  "db-exec",
+  "db-patch",
+  "context-manifest-get",
+  "context-pin",
+  "context-evict",
+  "context-restore",
+  "context-report",
+]);
+
+/**
+ * Substring/prefix patterns for excluded name *families* that aren't a
+ * fixed, enumerable set: `seed-*` varies per app/template, and the
+ * extension-management and browser-session tool suites use varying verb
+ * prefixes around a shared noun (e.g. `list-extensions`, `create-extension`,
+ * `hide-extension`; `list-browser-sessions`, `run-browser-session-action`) —
+ * so a leading-prefix match alone would miss most of them.
+ */
+const AUTO_READ_EXCLUDED_ACTION_PATTERNS: RegExp[] = [
+  /^seed-/,
+  /extension/,
+  /browser-session/,
+];
+
+function isAutoReadExcludedActionName(name: string): boolean {
+  return (
+    AUTO_READ_EXCLUDED_ACTION_NAMES.has(name) ||
+    AUTO_READ_EXCLUDED_ACTION_PATTERNS.some((pattern) => pattern.test(name))
+  );
+}
+
+function autoAuthenticatedReadNames(
+  actions: Record<string, ActionEntry>,
+  config: MCPConfig,
+): Set<string> {
+  if (config.externalAgents?.authenticatedReads !== "auto") return new Set();
+  return new Set(
+    Object.entries(actions)
+      .filter(
+        ([name, entry]) =>
+          isAuthenticatedReadAction(entry) &&
+          !isAutoReadExcludedActionName(name),
+      )
+      .map(([name]) => name),
+  );
+}
+
+function externalAgentDenySet(config: MCPConfig): Set<string> {
+  return new Set(
+    (config.externalAgents?.denyActions ?? [])
+      .map((name) => name.trim())
+      .filter(Boolean),
+  );
+}
+
+function externalAgentWritesAreAskAppOnly(config: MCPConfig): boolean {
+  return (
+    config.externalAgents?.writes === "ask_app_only" ||
+    (config.externalAgents?.authenticatedReads === "auto" &&
+      config.externalAgents?.writes !== "allowlisted")
+  );
 }
 
 interface ResolvedMcpAppResource {
@@ -1300,16 +1391,21 @@ export async function createMCPServerForRequest(
         ),
       )
     : visibleActions;
+  const autoReadNames = autoAuthenticatedReadNames(visibleActions, config);
+  const connectorNames = new Set([
+    ...(config.connectorCatalog ?? []),
+    ...autoReadNames,
+  ]);
+  const denyNames = externalAgentDenySet(config);
+  const automaticConnectorPolicyActive =
+    config.externalAgents?.authenticatedReads === "auto";
   // Connector-catalog tier: when a template declares a connector allow-list,
-  // serve exactly that curated surface (+ cross-app builtins + tool-search) to
-  // external callers unless they explicitly opted into the full catalog. This
-  // is active by default whenever a catalog is declared — no env flag required —
-  // so the ~105-tool full catalog can never leak just because a deployment
-  // forgot to set one. It also keeps db-exec / seed-* / extension /
+  // serve exactly that curated surface plus any explicitly annotated
+  // authenticated reads from `externalAgents.authenticatedReads: "auto"`.
+  // This stays compact by default and keeps db-exec / seed-* / extension /
   // browser-session footguns off the external surface.
   const connectorCatalogActive =
-    Array.isArray(config.connectorCatalog) &&
-    config.connectorCatalog.length > 0 &&
+    (connectorNames.size > 0 || automaticConnectorPolicyActive) &&
     !fullCatalogRequested;
   // When the connector catalog is active, filter directly from visibleActions
   // rather than advertisedActionsBeforeConnector. This ensures the connector
@@ -1318,9 +1414,18 @@ export async function createMCPServerForRequest(
   // would have activated the compact catalog for the same caller.
   const advertisedActions = connectorCatalogActive
     ? Object.fromEntries(
-        Object.entries(visibleActions).filter(([name]) =>
-          isActionInConnectorCatalog(name, config),
-        ),
+        Object.entries(visibleActions).filter(([name, entry]) => {
+          if (denyNames.has(name)) return false;
+          if (COMPACT_MCP_APP_CATALOG_BUILTINS.has(name)) return true;
+          if (!connectorNames.has(name)) return false;
+          if (
+            externalAgentWritesAreAskAppOnly(config) &&
+            entry.readOnly !== true
+          ) {
+            return false;
+          }
+          return true;
+        }),
       )
     : advertisedActionsBeforeConnector;
   if (fullCatalogRequested) {

package/corpus/core/src/mcp/external-agent-policy.ts

@@ -0,0 +1,18 @@
+/**
+ * Policy for the default authenticated external-agent connector surface.
+ *
+ * The policy is intentionally narrow: "auto" only discovers actions that
+ * explicitly opt into authenticated, read-only public-agent exposure. It
+ * never makes an unannotated action callable and never grants writes.
+ */
+export interface ExternalAgentPolicy {
+  /** Automatically advertise authenticated GET/read-only public-agent actions. */
+  authenticatedReads?: "off" | "auto";
+  /**
+   * Keep writes behind `ask_app` by default. `allowlisted` preserves explicit
+   * connectorCatalog write exposure for apps that intentionally need it.
+   */
+  writes?: "ask_app_only" | "allowlisted";
+  /** Explicit action names to remove from the derived connector surface. */
+  denyActions?: string[];
+}

package/corpus/core/src/mcp/index.ts

@@ -10,6 +10,7 @@ export {
   buildLinkArtifacts,
 } from "./build-server.js";
 export type { MCPCallerIdentity, MCPRequestMeta } from "./build-server.js";
+export type { ExternalAgentPolicy } from "./external-agent-policy.js";
 
 // stdio transport for `agent-native mcp serve` (Node-only).
 export { runMCPStdio } from "./stdio.js";