@meistrari/chat-nuxt 1.5.0 → 1.6.0

package/README.md

@@ -103,6 +103,15 @@ These never appear in module options — set them via `.env`, Infisical, etc. Wh
 
 Set `chatNuxt.validateConfig` to `'warn'` to log a warning when keys for an enabled feature are missing, or `'error'` to fail fast at module setup. The check is off by default since some deployments inject runtime config after build.
 
+### Auth modes
+
+`@meistrari/chat-nuxt` can run with either auth mode exposed by `@meistrari/auth-nuxt`:
+
+- Application auth (`telaAuth.application.enabled: true`) delegates chat identity and workspace state to `useTelaApplicationAuth()`.
+- First-party auth delegates chat identity to `useTelaSession()` and workspace state to `useTelaOrganization()`.
+
+The module chooses the bridge during Nuxt setup. Host apps should keep registering `@meistrari/auth-nuxt` before `@meistrari/chat-nuxt`.
+
 ### Local mode (no database)
 
 When `databaseUrl` is empty, chat-nuxt runs an embedded [pglite](https://pglite.dev) instance — Postgres compiled to WASM, in-process, file-backed at `<rootDir>/.data/chat-nuxt.db`. Migrations are applied automatically on first boot. Tables live under a dedicated `chat` Postgres schema so the database can be safely shared with the host app's own Drizzle setup.
@@ -256,8 +265,17 @@ runtimeConfig: {
 ```vue
 <script setup lang="ts">
 const { posthogPublicKey, posthogHost, posthogDefaults } = useRuntimeConfig().public
+
+// Application auth hosts:
 const { user, activeOrganization } = useTelaApplicationAuth()
 
+// First-party auth hosts can use this instead:
+// const session = useTelaSession()
+// const organization = useTelaOrganization()
+// const user = session.user
+// const activeOrganization = organization.activeOrganization
+// await organization.getActiveOrganization()
+
 onMounted(async () => {
     if (!posthogPublicKey || !posthogHost) return
     await initPosthog(posthogPublicKey, posthogHost, posthogDefaults)
@@ -335,6 +353,45 @@ export default async function resolveWorkspaceSettings(
 }
 ```
 
+## Optional: Agent API Environment Resolver
+
+When default chat mode starts a new Agent API session, `chat-nuxt` can attach `environmentVariables` to the Agent API create payload. Built-in workspace credentials still come from the `credentials` feature. Host apps can add server-only variables by creating `server/chat/resolve-agent-environment.ts`:
+
+```typescript
+import type { H3Event } from 'h3'
+
+export default async function resolveAgentEnvironment(
+    event: H3Event,
+    context: {
+        user: { id: string; email: string }
+        workspaceId: string
+        telaAgentId: string | null
+        conversationId: string
+        skills: readonly string[]
+    },
+) {
+    if (!context.skills.includes('github:meistrari/backoffice/skills/backoffice-admin')) {
+        return null
+    }
+
+    return {
+        BACKOFFICE_ADMIN_TOOL_URL: 'https://backoffice.example.com/api/admin-chat/tool',
+        BACKOFFICE_ADMIN_INVOCATION_GRANT: await mintInvocationGrant({
+            userId: context.user.id,
+            workspaceId: context.workspaceId,
+            conversationId: context.conversationId,
+            skills: context.skills,
+        }),
+    }
+}
+```
+
+The resolver runs on the server only. It is called for new default Agent API sessions, before `POST /v2/chat`. Continued sessions do not receive new environment variables.
+
+If the resolver returns the same environment variable name as a workspace credential, the resolver value wins.
+
+`chat-nuxt` only transports these variables to Agent API. A skill that calls a host backend must implement its own callback contract with the host backend. In short, callback authorization belongs to the skill and host backend, not `chat-nuxt`. The host backend remains responsible for validating invocation grants, allowed tools, schemas, replay protection, confirmation for writes, and audit logging.
+
 ## `<ChatConfigurationModal>`
 
 A reusable settings modal (system prompt, context files, Tela workstations, Tela skills, external skills, credentials) that any host app can open from any button. By default, the modal uses `useWorkspaceSettings()` to fetch and persist settings. If the host passes the `settings` prop, the host owns workspace settings state and persistence.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@meistrari/chat-nuxt",
   "configKey": "chatNuxt",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -1,7 +1,33 @@
 import { existsSync, readFileSync, mkdirSync, symlinkSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { join, dirname } from 'node:path';
-import { defineNuxtModule, createResolver, addImportsDir, addComponent, addComponentsDir } from 'nuxt/kit';
+import { defineNuxtModule, createResolver, addTemplate, addPlugin, addImportsDir, addComponent, addComponentsDir } from 'nuxt/kit';
+
+const agentEnvironmentResolverCandidates = [
+  "server/chat/resolve-agent-environment.ts",
+  "server/chat/resolve-agent-environment.mts",
+  "server/chat/resolve-agent-environment.mjs",
+  "server/chat/resolve-agent-environment.js"
+];
+const stubExtensions$1 = [".ts", ".mjs", ".js"];
+function resolveAgentEnvironmentResolverEntry(srcDir, fallbackResolverBase) {
+  for (const relativePath of agentEnvironmentResolverCandidates) {
+    const candidate = join(srcDir, relativePath);
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  for (const ext of stubExtensions$1) {
+    const candidate = fallbackResolverBase + ext;
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  const attempted = stubExtensions$1.map((ext) => fallbackResolverBase + ext).join(", ");
+  throw new Error(
+    `[@meistrari/chat-nuxt] Unable to resolve agent-environment stub. Tried: ${attempted}. This indicates a packaging bug - please report it.`
+  );
+}
 
 const localRequire = createRequire(import.meta.url);
 const runtimeAliasPackages = [
@@ -153,6 +179,74 @@ const DEFAULT_FEATURES = {
   generateTitle: false,
   credentials: false
 };
+function resolveChatAuthMode(runtimeConfig) {
+  const publicConfig = runtimeConfig.public;
+  const telaAuth = publicConfig?.telaAuth;
+  return telaAuth?.application?.enabled ? "application" : "first-party";
+}
+function buildChatAuthTemplate(mode) {
+  if (mode === "application") {
+    return `
+import { useTelaApplicationAuth } from '#imports'
+
+export function useChatAuth() {
+    const auth = useTelaApplicationAuth()
+
+    return {
+        user: auth.user,
+        activeOrganization: auth.activeOrganization,
+        getToken: auth.getToken,
+        getAvailableOrganizations: auth.getAvailableOrganizations,
+        switchOrganization: auth.switchOrganization,
+    }
+}
+`.trimStart();
+  }
+  return `
+import { useState, useTelaOrganization, useTelaSession, watch } from '#imports'
+
+export function useChatAuth() {
+    const session = useTelaSession()
+    const organization = useTelaOrganization()
+    const isHydratingActiveOrganization = useState('chat-nuxt:auth:is-hydrating-active-organization', () => false)
+    const hasHydratedActiveOrganization = useState('chat-nuxt:auth:has-hydrated-active-organization', () => false)
+
+    if (import.meta.client) {
+        watch(
+            () => session.user.value,
+            async (user) => {
+                if (!user) {
+                    hasHydratedActiveOrganization.value = false
+                    return
+                }
+
+                if (organization.activeOrganization.value || hasHydratedActiveOrganization.value || isHydratingActiveOrganization.value) {
+                    return
+                }
+
+                isHydratingActiveOrganization.value = true
+                try {
+                    await organization.getActiveOrganization()
+                    hasHydratedActiveOrganization.value = true
+                }
+                finally {
+                    isHydratingActiveOrganization.value = false
+                }
+            },
+            { immediate: true },
+        )
+    }
+
+    return {
+        user: session.user,
+        activeOrganization: organization.activeOrganization,
+        getToken: session.getToken,
+        getAvailableOrganizations: organization.listOrganizations,
+        switchOrganization: organization.setActiveOrganization,
+    }
+}
+`.trimStart();
+}
 const ALWAYS_REQUIRED_KEYS = [
   "telaApiUrl",
   "agentApiUrl",
@@ -225,7 +319,7 @@ const module$1 = defineNuxtModule({
     const hasAuthModule = (nuxt.options.modules ?? []).some(isAuthModuleEntry);
     if (!hasAuthModule) {
       throw new Error(
-        '[@meistrari/chat-nuxt] Missing required module "@meistrari/auth-nuxt". Install and enable it so useTelaApplicationAuth() and event.context.auth are available.'
+        '[@meistrari/chat-nuxt] Missing required module "@meistrari/auth-nuxt". Install and enable it so chat auth composables and event.context.auth are available.'
       );
     }
     ensureIconifyPackages(nuxt.options.rootDir);
@@ -237,14 +331,25 @@ const module$1 = defineNuxtModule({
       nuxt.options.srcDir,
       join(runtimeDir, "internal/workspace-settings-resolver.stub")
     );
+    const agentEnvironmentResolverEntry = resolveAgentEnvironmentResolverEntry(
+      nuxt.options.srcDir,
+      join(runtimeDir, "internal/agent-environment-resolver.stub")
+    );
     const telaBuildPath = resolveTelaBuildLayer();
     const runtimeAliases = resolveRuntimeAliases(telaBuildPath);
+    const chatAuthMode = resolveChatAuthMode(nuxt.options.runtimeConfig);
+    const chatAuthTemplate = addTemplate({
+      filename: "chat-nuxt/auth.mjs",
+      getContents: () => buildChatAuthTemplate(chatAuthMode)
+    });
     if (!Array.isArray(nuxt.options.extends)) {
       nuxt.options.extends = nuxt.options.extends ? [nuxt.options.extends] : [];
     }
     nuxt.options.extends.unshift(telaBuildPath);
     nuxt.options.alias = {
       ...nuxt.options.alias,
+      "#chat-auth": chatAuthTemplate.dst,
+      "#chat-agent-environment-resolver": agentEnvironmentResolverEntry,
       "#chat-workspace-settings-resolver": workspaceSettingsResolverEntry,
       "#chat-runtime": runtimeDir,
       "@iconify-json/ph": resolvePackageRoot("@iconify-json/ph")
@@ -277,6 +382,17 @@ const module$1 = defineNuxtModule({
       features
     };
     validateRuntimeConfig(rc, options.validateConfig ?? false, features);
+    nuxt.options.css = nuxt.options.css || [];
+    for (const css of [
+      "markstream-vue/index.css",
+      join(runtimeDir, "assets/css/markstream.css"),
+      join(runtimeDir, "assets/css/code-theme.css")
+    ]) {
+      if (!nuxt.options.css.includes(css)) {
+        nuxt.options.css.push(css);
+      }
+    }
+    addPlugin(join(runtimeDir, "plugins/markstream"));
     addImportsDir(join(runtimeDir, "composables"));
     addImportsDir(join(runtimeDir, "utils"));
     addComponent({
@@ -338,6 +454,8 @@ export default globalThis.ELK;
       nitroConfig.scanDirs.push(serverDir);
       nitroConfig.alias = {
         ...nitroConfig.alias,
+        "#chat-auth": chatAuthTemplate.dst,
+        "#chat-agent-environment-resolver": agentEnvironmentResolverEntry,
         "#chat-runtime": runtimeDir,
         "#chat-workspace-settings-resolver": workspaceSettingsResolverEntry
       };

package/dist/runtime/components/chat/message-bubble.vue

@@ -1,11 +1,12 @@
 <script setup>
+import { useChatAuth } from "#chat-auth";
 import { parseContentWithFiles } from "../../utils/file";
 import ChatVaultLink from "./vault-link.vue";
 const props = defineProps({
   message: { type: Object, required: true }
 });
 const emit = defineEmits(["retry"]);
-const { user } = useTelaApplicationAuth();
+const { user } = useChatAuth();
 const { getMemberByEmail } = useWorkspaceMembers();
 const embedConfig = useEmbedConfig();
 const mergedCustomComponents = computed(() => ({

package/dist/runtime/components/chat/message-input.d.vue.ts

@@ -14,7 +14,7 @@ type __VLS_Props = {
     conversationFiles?: ConversationFile[];
     workspaceSettings?: DeepReadonly<WorkspaceSettings> | null;
     allowModelSelection?: boolean;
-    agentInputSchema?: DeepReadonly<TelaAgentInputVariable[]> | null;
+    agentInputSchema?: readonly TelaAgentInputVariable[] | null;
     agentInputSchemaLoading?: boolean;
     showModelSelector?: boolean;
     showCancelButton?: boolean;

package/dist/runtime/components/chat/message-input.vue

@@ -15,7 +15,7 @@ const props = defineProps({
   conversationFiles: { type: Array, required: false },
   workspaceSettings: { type: null, required: false },
   allowModelSelection: { type: Boolean, required: false },
-  agentInputSchema: { type: null, required: false },
+  agentInputSchema: { type: [Array, null], required: false },
   agentInputSchemaLoading: { type: Boolean, required: false },
   showModelSelector: { type: Boolean, required: false },
   showCancelButton: { type: Boolean, required: false }

package/dist/runtime/components/chat/message-input.vue.d.ts

@@ -14,7 +14,7 @@ type __VLS_Props = {
     conversationFiles?: ConversationFile[];
     workspaceSettings?: DeepReadonly<WorkspaceSettings> | null;
     allowModelSelection?: boolean;
-    agentInputSchema?: DeepReadonly<TelaAgentInputVariable[]> | null;
+    agentInputSchema?: readonly TelaAgentInputVariable[] | null;
     agentInputSchemaLoading?: boolean;
     showModelSelector?: boolean;
     showCancelButton?: boolean;

package/dist/runtime/composables/useChat.js

@@ -1,4 +1,5 @@
 import * as Sentry from "@sentry/nuxt";
+import { useChatAuth } from "#chat-auth";
 import { exportConversationToMarkdown } from "../utils/export-conversation.js";
 import { resolveChatStateScope } from "../utils/tela-chat.js";
 import { useConversationFileActions } from "./useConversationFiles.js";
@@ -150,7 +151,7 @@ function parseReasoningFromPolling(reasoning) {
 export function useChat() {
   const chatApi = useChatApi();
   const embedConfig = useEmbedConfig();
-  const { user: authUser, activeOrganization } = useTelaApplicationAuth();
+  const { user: authUser, activeOrganization } = useChatAuth();
   const { addFilesToConversation } = useConversationFileActions();
   const isTelaAgentMode = computed(() => !!embedConfig?.telaAgentId.value);
   const chatScope = computed(() => resolveChatStateScope(

package/dist/runtime/composables/useChatApi.js

@@ -1,6 +1,7 @@
+import { useChatAuth } from "#chat-auth";
 export function useChatApi() {
   const embedConfig = useEmbedConfig();
-  const { activeOrganization } = useTelaApplicationAuth();
+  const { activeOrganization } = useChatAuth();
   function buildHeaders(headers) {
     const mergedHeaders = {
       ...headers ?? {}

package/dist/runtime/composables/useConversations.js

@@ -1,4 +1,5 @@
 import * as Sentry from "@sentry/nuxt";
+import { useChatAuth } from "#chat-auth";
 import { resolveChatStateScope } from "../utils/tela-chat.js";
 function sortConversationsByUpdatedAt(conversations) {
   return [...conversations].sort(
@@ -26,7 +27,7 @@ export function mergeFetchedConversations(fetchedConversations, localConversatio
 export function useConversations() {
   const chatApi = useChatApi();
   const embedConfig = useEmbedConfig();
-  const { activeOrganization } = useTelaApplicationAuth();
+  const { activeOrganization } = useChatAuth();
   const conversationBuckets = useState("conversations", () => ({}));
   const loadingBuckets = useState("conversations-loading", () => ({}));
   const errorBuckets = useState("conversations-error", () => ({}));

package/dist/runtime/composables/useGitHubSkills.js

@@ -1,7 +1,8 @@
 import * as Sentry from "@sentry/nuxt";
+import { useChatAuth } from "#chat-auth";
 export function useGitHubSkills() {
   const config = useRuntimeConfig();
-  const { activeOrganization } = useTelaApplicationAuth();
+  const { activeOrganization } = useChatAuth();
   const { settings, updateSettings } = useWorkspaceSettings();
   const connection = useState("github-skills-connection", () => ({
     connected: false,

package/dist/runtime/composables/useWorkspaceExternalSkills.js

@@ -1,5 +1,6 @@
+import { useChatAuth } from "#chat-auth";
 export function useWorkspaceExternalSkills(currentExternalSkills, searchQuery) {
-  const { user } = useTelaApplicationAuth();
+  const { user } = useChatAuth();
   const { connection: skillsConnection, fetchConnection: fetchGitHubConnection, connect: connectGitHub } = useGitHubSkills();
   const pendingSkills = ref([]);
   const removedRefs = ref([]);

package/dist/runtime/composables/useWorkspaceMembers.js

@@ -1,5 +1,6 @@
+import { useChatAuth } from "#chat-auth";
 export function useWorkspaceMembers() {
-  const { activeOrganization } = useTelaApplicationAuth();
+  const { activeOrganization } = useChatAuth();
   const members = computed(() => activeOrganization.value?.members ?? []);
   const membersMap = computed(() => {
     const map = /* @__PURE__ */ new Map();

package/dist/runtime/composables/useWorkspaceSettings.js

@@ -1,8 +1,26 @@
 import * as Sentry from "@sentry/nuxt";
+import { useChatAuth } from "#chat-auth";
+function isNullableArray(value) {
+  return value === null || Array.isArray(value);
+}
+function assertWorkspaceSettingsResponse(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Invalid workspace settings response");
+  }
+  const settings = value;
+  const hasValidWorkspaceId = typeof settings.workspaceId === "string" && settings.workspaceId.length > 0;
+  const hasValidSystemMessage = settings.systemMessage === null || typeof settings.systemMessage === "string";
+  const hasValidUpdatedAt = settings.updatedAt instanceof Date || typeof settings.updatedAt === "string" && settings.updatedAt.length > 0;
+  const hasValidCollections = isNullableArray(settings.contextFiles) && isNullableArray(settings.canvasTools) && isNullableArray(settings.knowledgeSources) && isNullableArray(settings.externalSkills);
+  if (!hasValidWorkspaceId || !hasValidSystemMessage || !hasValidUpdatedAt || !hasValidCollections) {
+    throw new Error("Invalid workspace settings response");
+  }
+  return value;
+}
 export function useWorkspaceSettings() {
   const chatApi = useChatApi();
   const embedConfig = useEmbedConfig();
-  const { activeOrganization } = useTelaApplicationAuth();
+  const { activeOrganization } = useChatAuth();
   const workspaceScope = computed(() => embedConfig?.workspaceId.value.trim() || activeOrganization.value?.id?.trim() || "default");
   const settingsBuckets = useState("workspace-settings", () => ({}));
   const loadingBuckets = useState("workspace-settings-loading", () => ({}));
@@ -65,12 +83,14 @@ export function useWorkspaceSettings() {
       if (hasWorkspaceSettingsOverride.value) {
         return settings.value;
       } else if (embedConfig !== null) {
-        data = await $fetch(
-          chatApi.path("/workspace/settings"),
-          chatApi.withChatHeaders()
+        data = assertWorkspaceSettingsResponse(
+          await $fetch(
+            chatApi.path("/workspace/settings"),
+            chatApi.withChatHeaders()
+          )
         );
       } else {
-        data = await $fetch("/api/workspace/settings");
+        data = assertWorkspaceSettingsResponse(await $fetch("/api/workspace/settings"));
       }
       if (import.meta.dev && embedConfig !== null && currentSettings) {
         const hydratedSettings = {
@@ -109,7 +129,7 @@ export function useWorkspaceSettings() {
     try {
       const path = embedConfig !== null ? chatApi.path("/workspace/settings") : "/api/workspace/settings";
       const options = embedConfig !== null ? chatApi.withChatHeaders({ method: "PATCH", body: updates }) : { method: "PATCH", body: updates };
-      const data = await $fetch(path, options);
+      const data = assertWorkspaceSettingsResponse(await $fetch(path, options));
       settings.value = data;
       return data;
     } catch (e) {

package/dist/runtime/composables/useWorkspaces.js

@@ -1,5 +1,6 @@
+import { useChatAuth } from "#chat-auth";
 export function useWorkspaces() {
-  const { getAvailableOrganizations } = useTelaApplicationAuth();
+  const { getAvailableOrganizations } = useChatAuth();
   const { data: workspaces, status, refresh: refreshWorkspaces } = useAsyncData(
     "workspaces",
     () => getAvailableOrganizations(),

package/dist/runtime/embed/components/ChatEmbed.vue

@@ -1,4 +1,5 @@
 <script setup>
+import { useChatAuth } from "#chat-auth";
 import { provideEmbedConfig, useEmbedConfig } from "../../composables/useEmbedConfig";
 import { provideChatAction } from "../../composables/useChatAction";
 import { normalizeTelaAgentId } from "../../utils/tela-chat";
@@ -19,7 +20,7 @@ const props = defineProps({
 });
 const emit = defineEmits(["update:conversationId", "action"]);
 const parentEmbedConfig = useEmbedConfig();
-const { activeOrganization } = useTelaApplicationAuth();
+const { activeOrganization } = useChatAuth();
 const workspaceId = computed(() => activeOrganization.value?.id?.trim() ?? "");
 const normalizedTelaAgentId = computed(() => normalizeTelaAgentId(props.telaAgentId));
 const ignoredPropsWarningKey = ref(null);

package/dist/runtime/embed/components/ChatEmbedInner.vue

@@ -1,4 +1,5 @@
 <script setup>
+import { useChatAuth } from "#chat-auth";
 import { exportConversationToMarkdown } from "../../utils/export-conversation";
 import { conversationListSkeletonRows } from "../../utils/conversation-list-skeleton";
 import {
@@ -16,7 +17,7 @@ const props = defineProps({
 const emit = defineEmits(["update:conversationId"]);
 const chatApi = useChatApi();
 const embedConfig = useEmbedConfig();
-const { user: authUser } = useTelaApplicationAuth();
+const { user: authUser } = useChatAuth();
 const { getMember } = useWorkspaceMembers();
 const statusToast = useStatusToast();
 const { conversations, loading: conversationsLoading, fetchConversations, createConversation, deleteConversation, renameConversation, duplicateConversation, updateConversationInList } = useConversations();
@@ -34,6 +35,7 @@ const effectiveWorkspaceSettings = computed(() => {
   return embedConfig?.workspaceSettings.value !== void 0 ? embedConfig.workspaceSettings.value : workspaceSettingsState.value;
 });
 const { closePanel: closeFilesPanel } = useConversationFilesPanel();
+const { isOpen: isPreviewPanelOpen, panelWidth: previewPanelWidth, closePreview } = useFilePreviewPanel();
 const activeConversationId = ref(
   normalizeConversationId(props.conversationId) ?? normalizeConversationId(props.initialConversationId)
 );
@@ -119,6 +121,7 @@ function resetConversation(shouldEmit = true) {
   clearConversation();
   activeTab.value = "chat";
   closeFilesPanel();
+  closePreview();
   if (shouldEmit) {
     updateConversationId(null);
   } else {
@@ -130,6 +133,9 @@ async function openConversation(nextConversationId) {
   if (!normalizedConversationId) {
     return;
   }
+  if (activeConversationId.value !== normalizedConversationId) {
+    closePreview();
+  }
   updateConversationId(normalizedConversationId);
   await ensureConversationLoaded(normalizedConversationId);
 }
@@ -150,6 +156,7 @@ watch(() => props.conversationId, async (nextConversationId) => {
     return;
   }
   syncConversationId(normalizedConversationId);
+  closePreview();
   await ensureConversationLoaded(normalizedConversationId);
 });
 onMounted(async () => {
@@ -640,6 +647,14 @@ async function handleDelete() {
                 </div>
             </TelaModal>
         </div>
+
+        <div
+            v-if="isPreviewPanelOpen"
+            h-full flex-shrink-0 pt-64px
+            :style="{ width: `${previewPanelWidth}px` }"
+        >
+            <FilePreviewPanel />
+        </div>
     </div>
 </template>
 

package/dist/runtime/internal/agent-environment-resolver.stub.d.ts

@@ -0,0 +1,2 @@
+declare const _default: null;
+export default _default;

package/dist/runtime/internal/agent-environment-resolver.stub.js

@@ -0,0 +1 @@
+export default null;

package/dist/runtime/server/api/chat/workspace/settings.patch.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export default _default;

package/dist/runtime/server/api/chat/workspace/settings.patch.js

@@ -0,0 +1,8 @@
+import { defineEventHandler, readBody } from "h3";
+import { resolveChatContext } from "#chat-runtime/server/utils/chat-context";
+import { persistWorkspaceSettingsUpdate } from "#chat-runtime/server/utils/workspace-settings-update";
+export default defineEventHandler(async (event) => {
+  const context = resolveChatContext(event);
+  const body = await readBody(event);
+  return persistWorkspaceSettingsUpdate(context.workspaceId, context.user, body);
+});

package/dist/runtime/server/api/conversations/[id]/messages/[messageId]/retry.post.js

@@ -90,8 +90,12 @@ export default defineEventHandler(async (event) => {
         const environmentVariables = await resolveDefaultAgentEnvironmentVariables(
           event,
           context,
-          { conversationId, messageId },
-          "Failed to resolve workspace credentials on retry, proceeding without env vars"
+          {
+            conversationId,
+            skills: defaultAgentTurn.createPayload.skills ?? [],
+            logContext: { conversationId, messageId },
+            credentialsFailureMessage: "Failed to resolve workspace credentials on retry, proceeding without env vars"
+          }
         );
         const result = await createChatAgentSession(token, withEnvironmentVariables(defaultAgentTurn.createPayload, environmentVariables));
         if (result.success) {

package/dist/runtime/server/api/conversations/[id]/messages/index.post.js

@@ -115,8 +115,12 @@ export default defineEventHandler(async (event) => {
     const environmentVariables = await resolveDefaultAgentEnvironmentVariables(
       event,
       context,
-      { conversationId },
-      "Failed to resolve workspace credentials, proceeding without env vars"
+      {
+        conversationId,
+        skills: defaultAgentTurn.createPayload.skills ?? [],
+        logContext: { conversationId },
+        credentialsFailureMessage: "Failed to resolve workspace credentials, proceeding without env vars"
+      }
     );
     createChatAgentSession(token, withEnvironmentVariables(defaultAgentTurn.createPayload, environmentVariables)).then(async (result) => {
       if (result.success) {

package/dist/runtime/server/api/workspace/settings.patch.js

@@ -1,87 +1,8 @@
-import { createError, defineEventHandler, readBody } from "h3";
-import { eq, and, inArray } from "drizzle-orm";
-import { useDb, schema } from "#chat-runtime/server/db";
+import { defineEventHandler, readBody } from "h3";
 import { requireUser } from "#chat-runtime/server/utils/auth";
-import { rowToExternalSkill } from "#chat-runtime/server/utils/external-skills";
-import { logger } from "#chat-runtime/server/utils/logger";
+import { persistWorkspaceSettingsUpdate } from "#chat-runtime/server/utils/workspace-settings-update";
 export default defineEventHandler(async (event) => {
   const session = requireUser(event);
-  const db = useDb();
   const body = await readBody(event);
-  const hasSystemMessage = body.systemMessage !== void 0;
-  const hasContextFiles = body.contextFiles !== void 0;
-  const hasCanvasTools = body.canvasTools !== void 0;
-  const hasKnowledgeSources = body.knowledgeSources !== void 0;
-  const hasExternalSkills = body.externalSkills !== void 0;
-  if (!hasSystemMessage && !hasContextFiles && !hasCanvasTools && !hasKnowledgeSources && !hasExternalSkills) {
-    throw createError({
-      statusCode: 400,
-      statusMessage: "At least one field is required to update"
-    });
-  }
-  const updateData = {
-    updatedAt: /* @__PURE__ */ new Date()
-  };
-  if (hasSystemMessage) {
-    updateData.systemMessage = body.systemMessage?.trim() || null;
-  }
-  if (hasContextFiles) {
-    updateData.contextFiles = body.contextFiles && body.contextFiles.length > 0 ? body.contextFiles : null;
-  }
-  if (hasCanvasTools) {
-    updateData.canvasTools = body.canvasTools && body.canvasTools.length > 0 ? body.canvasTools : null;
-  }
-  if (hasKnowledgeSources) {
-    updateData.knowledgeSources = body.knowledgeSources && body.knowledgeSources.length > 0 ? body.knowledgeSources : null;
-  }
-  const [existing] = await db.select().from(schema.workspaceSettings).where(eq(schema.workspaceSettings.workspaceId, session.workspace.id));
-  if (hasExternalSkills) {
-    const existingSkillRows = await db.select().from(schema.externalSkills).where(eq(schema.externalSkills.workspaceId, session.workspace.id));
-    const existingRefs = new Set(existingSkillRows.map((s) => s.ref));
-    const newSkills = body.externalSkills ?? [];
-    const newRefs = new Set(newSkills.map((s) => s.ref));
-    const refsToDelete = existingSkillRows.filter((s) => !newRefs.has(s.ref)).map((s) => s.ref);
-    if (refsToDelete.length > 0) {
-      await db.delete(schema.externalSkills).where(
-        and(
-          eq(schema.externalSkills.workspaceId, session.workspace.id),
-          inArray(schema.externalSkills.ref, refsToDelete)
-        )
-      );
-    }
-    const skillsToInsert = newSkills.filter((s) => !existingRefs.has(s.ref)).map((skill) => ({
-      workspaceId: session.workspace.id,
-      ref: skill.ref,
-      name: skill.name,
-      description: skill.description,
-      runtime: skill.runtime,
-      allowedTools: [...skill.allowedTools],
-      isPublic: skill.isPublic,
-      addedByUserId: skill.addedBy?.userId || session.user.id,
-      addedByUsername: skill.addedBy?.username || session.user.name || "",
-      addedAt: skill.addedAt ? new Date(skill.addedAt) : /* @__PURE__ */ new Date()
-    }));
-    if (skillsToInsert.length > 0) {
-      await db.insert(schema.externalSkills).values(skillsToInsert);
-    }
-  }
-  logger.info({ workspaceId: session.workspace.id, fields: Object.keys(updateData) }, "Workspace settings updating");
-  let settings;
-  if (existing) {
-    const [updated] = await db.update(schema.workspaceSettings).set(updateData).where(eq(schema.workspaceSettings.workspaceId, session.workspace.id)).returning();
-    settings = updated;
-  } else {
-    const [created] = await db.insert(schema.workspaceSettings).values({
-      workspaceId: session.workspace.id,
-      ...updateData
-    }).returning();
-    settings = created;
-  }
-  const skillRows = await db.select().from(schema.externalSkills).where(eq(schema.externalSkills.workspaceId, session.workspace.id));
-  const externalSkills = skillRows.map(rowToExternalSkill);
-  logger.info({ workspaceId: session.workspace.id, externalSkillsCount: externalSkills.length }, "Workspace settings updated");
-  return {
-    ...settings,
-    externalSkills: externalSkills.length > 0 ? externalSkills : null
-  };
+  return persistWorkspaceSettingsUpdate(session.workspace.id, session.user, body);
 });

package/dist/runtime/server/utils/agent-api.js

@@ -2,11 +2,12 @@ import { createError } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { agentApiQueryResponseSchema, agentApiSessionSchema } from "#chat-runtime/types/agent";
 import { logger } from "#chat-runtime/server/utils/logger";
+import { resolveAuthToken } from "#chat-runtime/server/utils/auth-token";
 const getConfig = () => useRuntimeConfig();
 export function getAgentDataToken(event) {
-  const cookieToken = event.context.auth?.token;
-  if (cookieToken) {
-    return cookieToken;
+  const token = resolveAuthToken(event);
+  if (token) {
+    return token;
   }
   throw createError({
     statusCode: 401,

package/dist/runtime/server/utils/agent-environment.d.ts

@@ -0,0 +1,8 @@
+import type { H3Event } from 'h3';
+import type { ChatRuntimeContext } from '#chat-runtime/server/utils/chat-context';
+export type AgentEnvironmentResolverContext = ChatRuntimeContext & {
+    conversationId: string;
+    skills: readonly string[];
+};
+export type AgentEnvironmentVariables = Record<string, string>;
+export declare function resolveHostAgentEnvironmentVariables(event: H3Event, context: AgentEnvironmentResolverContext, logContext: Record<string, unknown>): Promise<AgentEnvironmentVariables>;

package/dist/runtime/server/utils/agent-environment.js

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import registeredAgentEnvironmentResolver from "#chat-agent-environment-resolver";
+import { logger } from "#chat-runtime/server/utils/logger";
+const agentEnvironmentVariablesSchema = z.record(z.string(), z.string()).nullable().optional();
+function getRegisteredAgentEnvironmentResolver() {
+  const resolver = registeredAgentEnvironmentResolver;
+  return typeof resolver === "function" ? resolver : null;
+}
+function parseAgentEnvironmentVariables(value, logContext) {
+  const parsed = agentEnvironmentVariablesSchema.safeParse(value);
+  if (!parsed.success) {
+    logger.warn({
+      ...logContext,
+      issues: parsed.error.issues
+    }, "Agent environment resolver returned an invalid payload");
+    return {};
+  }
+  return parsed.data ?? {};
+}
+export async function resolveHostAgentEnvironmentVariables(event, context, logContext) {
+  const resolver = getRegisteredAgentEnvironmentResolver();
+  if (!resolver) {
+    return {};
+  }
+  try {
+    return parseAgentEnvironmentVariables(await resolver(event, context), logContext);
+  } catch (error) {
+    logger.warn({
+      ...logContext,
+      error
+    }, "Agent environment resolver failed, proceeding without host env vars");
+    return {};
+  }
+}

package/dist/runtime/server/utils/auth-token.d.ts

@@ -0,0 +1,2 @@
+import { type H3Event } from 'h3';
+export declare function resolveAuthToken(event: H3Event): string | undefined;

package/dist/runtime/server/utils/auth-token.js

@@ -0,0 +1,21 @@
+import { getCookie } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
+const DEFAULT_FIRST_PARTY_JWT_COOKIE_NAME = "tela-jwt";
+function resolveFirstPartyJwtCookieName(event) {
+  const config = useRuntimeConfig(event);
+  return config.public?.telaAuth?.jwtCookieName || DEFAULT_FIRST_PARTY_JWT_COOKIE_NAME;
+}
+export function resolveAuthToken(event) {
+  const auth = event.context.auth;
+  if (auth?.token) {
+    return auth.token;
+  }
+  if (!auth?.user || !auth.workspace) {
+    return void 0;
+  }
+  const token = getCookie(event, resolveFirstPartyJwtCookieName(event));
+  if (token) {
+    auth.token = token;
+  }
+  return token;
+}

package/dist/runtime/server/utils/conversation-agent-turn.d.ts

@@ -34,6 +34,11 @@ export declare function prepareDefaultAgentTurn(event: H3Event, db: DbInstance,
     requestedModel?: string;
     workspaceSettingsSnapshot?: unknown;
 }): Promise<PreparedDefaultAgentTurn>;
-export declare function resolveDefaultAgentEnvironmentVariables(event: H3Event, context: ChatRuntimeContext, logContext: Record<string, unknown>, failureMessage: string): Promise<Record<string, string>>;
+export declare function resolveDefaultAgentEnvironmentVariables(event: H3Event, context: ChatRuntimeContext, options: {
+    conversationId: string;
+    skills?: readonly string[];
+    logContext: Record<string, unknown>;
+    credentialsFailureMessage: string;
+}): Promise<Record<string, string>>;
 export declare function withEnvironmentVariables(payload: AgentApiChatPayload, environmentVariables: Record<string, string>): AgentApiChatPayload;
 export {};

package/dist/runtime/server/utils/conversation-agent-turn.js

@@ -2,6 +2,7 @@ import { and, eq, isNull } from "drizzle-orm";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { schema } from "#chat-runtime/server/db";
 import { buildMessageWithContext, renderSystemPrompt, truncateTitle } from "#chat-runtime/server/utils/chat-message-builder";
+import { resolveHostAgentEnvironmentVariables } from "#chat-runtime/server/utils/agent-environment";
 import {
   getConversationAppliedSettings,
   getWorkspaceSettingsUpdatedAt,
@@ -150,15 +151,33 @@ export async function prepareDefaultAgentTurn(event, db, context, options) {
     }
   };
 }
-export async function resolveDefaultAgentEnvironmentVariables(event, context, logContext, failureMessage) {
-  if (!resolveChatNuxtFeatures(useRuntimeConfig()).credentials)
-    return {};
-  try {
-    return await resolveWorkspaceCredentials(event, context.workspaceId);
-  } catch (error) {
-    logger.warn({ ...logContext, error }, failureMessage);
-    return {};
+export async function resolveDefaultAgentEnvironmentVariables(event, context, options) {
+  let credentialVariables = {};
+  const logContext = {
+    workspaceId: context.workspaceId,
+    conversationId: options.conversationId,
+    ...options.logContext
+  };
+  if (resolveChatNuxtFeatures(useRuntimeConfig()).credentials) {
+    try {
+      credentialVariables = await resolveWorkspaceCredentials(event, context.workspaceId);
+    } catch (error) {
+      logger.warn({ ...logContext, error }, options.credentialsFailureMessage);
+    }
   }
+  const hostVariables = await resolveHostAgentEnvironmentVariables(
+    event,
+    {
+      ...context,
+      conversationId: options.conversationId,
+      skills: options.skills ?? []
+    },
+    logContext
+  );
+  return {
+    ...credentialVariables,
+    ...hostVariables
+  };
 }
 export function withEnvironmentVariables(payload, environmentVariables) {
   if (Object.keys(environmentVariables).length === 0)

package/dist/runtime/server/utils/tela-api.js

@@ -1,9 +1,10 @@
 import { createError } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { logger } from "#chat-runtime/server/utils/logger";
+import { resolveAuthToken } from "#chat-runtime/server/utils/auth-token";
 export async function telaFetch(event, path, options) {
   const config = useRuntimeConfig();
-  const token = event.context.auth?.token;
+  const token = resolveAuthToken(event);
   if (!token) {
     throw createError({ statusCode: 401, statusMessage: "No auth token" });
   }

package/dist/runtime/server/utils/workspace-settings-update.d.ts

@@ -0,0 +1,16 @@
+import { type ContextFile, type ExternalSkill } from '#chat-runtime/server/db';
+import type { CanvasTool } from '#chat-runtime/types/agent';
+import type { KnowledgeSource } from '#chat-runtime/types/chat';
+export type WorkspaceSettingsPatchBody = {
+    systemMessage?: string | null;
+    contextFiles?: ContextFile[] | null;
+    canvasTools?: CanvasTool[] | null;
+    knowledgeSources?: KnowledgeSource[] | null;
+    externalSkills?: ExternalSkill[] | null;
+};
+type WorkspaceSettingsUser = {
+    id: string;
+    name?: string | null;
+};
+export declare function persistWorkspaceSettingsUpdate(workspaceId: string, user: WorkspaceSettingsUser, body: WorkspaceSettingsPatchBody): Promise<any>;
+export {};

package/dist/runtime/server/utils/workspace-settings-update.js

@@ -0,0 +1,84 @@
+import { createError } from "h3";
+import { and, eq, inArray } from "drizzle-orm";
+import { schema, useDb } from "#chat-runtime/server/db";
+import { rowToExternalSkill } from "#chat-runtime/server/utils/external-skills";
+import { logger } from "#chat-runtime/server/utils/logger";
+export async function persistWorkspaceSettingsUpdate(workspaceId, user, body) {
+  const db = useDb();
+  const hasSystemMessage = body.systemMessage !== void 0;
+  const hasContextFiles = body.contextFiles !== void 0;
+  const hasCanvasTools = body.canvasTools !== void 0;
+  const hasKnowledgeSources = body.knowledgeSources !== void 0;
+  const hasExternalSkills = body.externalSkills !== void 0;
+  if (!hasSystemMessage && !hasContextFiles && !hasCanvasTools && !hasKnowledgeSources && !hasExternalSkills) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "At least one field is required to update"
+    });
+  }
+  const updateData = {
+    updatedAt: /* @__PURE__ */ new Date()
+  };
+  if (hasSystemMessage) {
+    updateData.systemMessage = body.systemMessage?.trim() || null;
+  }
+  if (hasContextFiles) {
+    updateData.contextFiles = body.contextFiles && body.contextFiles.length > 0 ? body.contextFiles : null;
+  }
+  if (hasCanvasTools) {
+    updateData.canvasTools = body.canvasTools && body.canvasTools.length > 0 ? body.canvasTools : null;
+  }
+  if (hasKnowledgeSources) {
+    updateData.knowledgeSources = body.knowledgeSources && body.knowledgeSources.length > 0 ? body.knowledgeSources : null;
+  }
+  const [existing] = await db.select().from(schema.workspaceSettings).where(eq(schema.workspaceSettings.workspaceId, workspaceId));
+  if (hasExternalSkills) {
+    const existingSkillRows = await db.select().from(schema.externalSkills).where(eq(schema.externalSkills.workspaceId, workspaceId));
+    const existingRefs = new Set(existingSkillRows.map((s) => s.ref));
+    const newSkills = body.externalSkills ?? [];
+    const newRefs = new Set(newSkills.map((s) => s.ref));
+    const refsToDelete = existingSkillRows.filter((s) => !newRefs.has(s.ref)).map((s) => s.ref);
+    if (refsToDelete.length > 0) {
+      await db.delete(schema.externalSkills).where(
+        and(
+          eq(schema.externalSkills.workspaceId, workspaceId),
+          inArray(schema.externalSkills.ref, refsToDelete)
+        )
+      );
+    }
+    const skillsToInsert = newSkills.filter((s) => !existingRefs.has(s.ref)).map((skill) => ({
+      workspaceId,
+      ref: skill.ref,
+      name: skill.name,
+      description: skill.description,
+      runtime: skill.runtime,
+      allowedTools: [...skill.allowedTools],
+      isPublic: skill.isPublic,
+      addedByUserId: skill.addedBy?.userId || user.id,
+      addedByUsername: skill.addedBy?.username || user.name || "",
+      addedAt: skill.addedAt ? new Date(skill.addedAt) : /* @__PURE__ */ new Date()
+    }));
+    if (skillsToInsert.length > 0) {
+      await db.insert(schema.externalSkills).values(skillsToInsert);
+    }
+  }
+  logger.info({ workspaceId, fields: Object.keys(updateData) }, "Workspace settings updating");
+  let settings;
+  if (existing) {
+    const [updated] = await db.update(schema.workspaceSettings).set(updateData).where(eq(schema.workspaceSettings.workspaceId, workspaceId)).returning();
+    settings = updated;
+  } else {
+    const [created] = await db.insert(schema.workspaceSettings).values({
+      workspaceId,
+      ...updateData
+    }).returning();
+    settings = created;
+  }
+  const skillRows = await db.select().from(schema.externalSkills).where(eq(schema.externalSkills.workspaceId, workspaceId));
+  const externalSkills = skillRows.map(rowToExternalSkill);
+  logger.info({ workspaceId, externalSkillsCount: externalSkills.length }, "Workspace settings updated");
+  return {
+    ...settings,
+    externalSkills: externalSkills.length > 0 ? externalSkills : null
+  };
+}

package/dist/runtime/server/utils/workspace.js

@@ -1,6 +1,7 @@
 import { useRuntimeConfig } from "nitropack/runtime";
 import { eq } from "drizzle-orm";
 import { schema } from "#chat-runtime/server/db";
+import { resolveAuthToken } from "#chat-runtime/server/utils/auth-token";
 import { telaFetch } from "#chat-runtime/server/utils/tela-api";
 export async function getWorkspaceSettings(db, workspaceId) {
   const [settings] = await db.select().from(schema.workspaceSettings).where(eq(schema.workspaceSettings.workspaceId, workspaceId));
@@ -8,6 +9,7 @@ export async function getWorkspaceSettings(db, workspaceId) {
 }
 export async function resolveWorkspaceCredentials(event, workspaceId) {
   const config = useRuntimeConfig();
+  const token = resolveAuthToken(event);
   return await telaFetch(
     event,
     `/workspaces/${workspaceId}/credentials/resolve`,
@@ -15,7 +17,7 @@ export async function resolveWorkspaceCredentials(event, workspaceId) {
       headers: {
         "X-Service-Name": "chat-app",
         "X-Service-Key": config.chatAppServiceKey,
-        "x-data-token": event.context.auth?.token ?? ""
+        "x-data-token": token ?? ""
       }
     }
   ) ?? {};

package/dist/runtime/types/chat-agent-environment-resolver.d.ts

@@ -0,0 +1,4 @@
+declare module '#chat-agent-environment-resolver' {
+    const resolver: unknown
+    export default resolver
+}

package/dist/runtime/types/chat-auth.d.ts

@@ -0,0 +1,35 @@
+import type { Ref } from 'vue'
+
+type ChatAuthUser = {
+    id: string
+    email?: string | null
+    name?: string | null
+    image?: string | null
+}
+
+type ChatAuthMemberUser = {
+    name: string
+    email: string
+    image?: string
+}
+
+type ChatAuthMember = {
+    id: string
+    userId: string
+    user: ChatAuthMemberUser
+}
+
+type ChatAuthOrganization = {
+    id: string
+    members?: ChatAuthMember[]
+}
+
+declare module '#chat-auth' {
+    export function useChatAuth(): {
+        user: Ref<ChatAuthUser | null>
+        activeOrganization: Ref<ChatAuthOrganization | null>
+        getToken: () => Promise<string | null | undefined>
+        getAvailableOrganizations: () => Promise<ChatAuthOrganization[]>
+        switchOrganization: (organizationId: string) => Promise<void>
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/chat-nuxt",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "type": "module",
   "exports": {
     ".": {