@meistrari/chat-nuxt 1.5.1 → 1.6.0

package/README.md

@@ -103,6 +103,15 @@ These never appear in module options — set them via `.env`, Infisical, etc. Wh
 
 Set `chatNuxt.validateConfig` to `'warn'` to log a warning when keys for an enabled feature are missing, or `'error'` to fail fast at module setup. The check is off by default since some deployments inject runtime config after build.
 
+### Auth modes
+
+`@meistrari/chat-nuxt` can run with either auth mode exposed by `@meistrari/auth-nuxt`:
+
+- Application auth (`telaAuth.application.enabled: true`) delegates chat identity and workspace state to `useTelaApplicationAuth()`.
+- First-party auth delegates chat identity to `useTelaSession()` and workspace state to `useTelaOrganization()`.
+
+The module chooses the bridge during Nuxt setup. Host apps should keep registering `@meistrari/auth-nuxt` before `@meistrari/chat-nuxt`.
+
 ### Local mode (no database)
 
 When `databaseUrl` is empty, chat-nuxt runs an embedded [pglite](https://pglite.dev) instance — Postgres compiled to WASM, in-process, file-backed at `<rootDir>/.data/chat-nuxt.db`. Migrations are applied automatically on first boot. Tables live under a dedicated `chat` Postgres schema so the database can be safely shared with the host app's own Drizzle setup.
@@ -256,8 +265,17 @@ runtimeConfig: {
 ```vue
 <script setup lang="ts">
 const { posthogPublicKey, posthogHost, posthogDefaults } = useRuntimeConfig().public
+
+// Application auth hosts:
 const { user, activeOrganization } = useTelaApplicationAuth()
 
+// First-party auth hosts can use this instead:
+// const session = useTelaSession()
+// const organization = useTelaOrganization()
+// const user = session.user
+// const activeOrganization = organization.activeOrganization
+// await organization.getActiveOrganization()
+
 onMounted(async () => {
     if (!posthogPublicKey || !posthogHost) return
     await initPosthog(posthogPublicKey, posthogHost, posthogDefaults)
@@ -335,6 +353,45 @@ export default async function resolveWorkspaceSettings(
 }
 ```
 
+## Optional: Agent API Environment Resolver
+
+When default chat mode starts a new Agent API session, `chat-nuxt` can attach `environmentVariables` to the Agent API create payload. Built-in workspace credentials still come from the `credentials` feature. Host apps can add server-only variables by creating `server/chat/resolve-agent-environment.ts`:
+
+```typescript
+import type { H3Event } from 'h3'
+
+export default async function resolveAgentEnvironment(
+    event: H3Event,
+    context: {
+        user: { id: string; email: string }
+        workspaceId: string
+        telaAgentId: string | null
+        conversationId: string
+        skills: readonly string[]
+    },
+) {
+    if (!context.skills.includes('github:meistrari/backoffice/skills/backoffice-admin')) {
+        return null
+    }
+
+    return {
+        BACKOFFICE_ADMIN_TOOL_URL: 'https://backoffice.example.com/api/admin-chat/tool',
+        BACKOFFICE_ADMIN_INVOCATION_GRANT: await mintInvocationGrant({
+            userId: context.user.id,
+            workspaceId: context.workspaceId,
+            conversationId: context.conversationId,
+            skills: context.skills,
+        }),
+    }
+}
+```
+
+The resolver runs on the server only. It is called for new default Agent API sessions, before `POST /v2/chat`. Continued sessions do not receive new environment variables.
+
+If the resolver returns the same environment variable name as a workspace credential, the resolver value wins.
+
+`chat-nuxt` only transports these variables to Agent API. A skill that calls a host backend must implement its own callback contract with the host backend. In short, callback authorization belongs to the skill and host backend, not `chat-nuxt`. The host backend remains responsible for validating invocation grants, allowed tools, schemas, replay protection, confirmation for writes, and audit logging.
+
 ## `<ChatConfigurationModal>`
 
 A reusable settings modal (system prompt, context files, Tela workstations, Tela skills, external skills, credentials) that any host app can open from any button. By default, the modal uses `useWorkspaceSettings()` to fetch and persist settings. If the host passes the `settings` prop, the host owns workspace settings state and persistence.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@meistrari/chat-nuxt",
   "configKey": "chatNuxt",
-  "version": "1.5.1",
+  "version": "1.6.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -1,7 +1,33 @@
 import { existsSync, readFileSync, mkdirSync, symlinkSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { join, dirname } from 'node:path';
-import { defineNuxtModule, createResolver, addPlugin, addImportsDir, addComponent, addComponentsDir } from 'nuxt/kit';
+import { defineNuxtModule, createResolver, addTemplate, addPlugin, addImportsDir, addComponent, addComponentsDir } from 'nuxt/kit';
+
+const agentEnvironmentResolverCandidates = [
+  "server/chat/resolve-agent-environment.ts",
+  "server/chat/resolve-agent-environment.mts",
+  "server/chat/resolve-agent-environment.mjs",
+  "server/chat/resolve-agent-environment.js"
+];
+const stubExtensions$1 = [".ts", ".mjs", ".js"];
+function resolveAgentEnvironmentResolverEntry(srcDir, fallbackResolverBase) {
+  for (const relativePath of agentEnvironmentResolverCandidates) {
+    const candidate = join(srcDir, relativePath);
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  for (const ext of stubExtensions$1) {
+    const candidate = fallbackResolverBase + ext;
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  const attempted = stubExtensions$1.map((ext) => fallbackResolverBase + ext).join(", ");
+  throw new Error(
+    `[@meistrari/chat-nuxt] Unable to resolve agent-environment stub. Tried: ${attempted}. This indicates a packaging bug - please report it.`
+  );
+}
 
 const localRequire = createRequire(import.meta.url);
 const runtimeAliasPackages = [
@@ -153,6 +179,74 @@ const DEFAULT_FEATURES = {
   generateTitle: false,
   credentials: false
 };
+function resolveChatAuthMode(runtimeConfig) {
+  const publicConfig = runtimeConfig.public;
+  const telaAuth = publicConfig?.telaAuth;
+  return telaAuth?.application?.enabled ? "application" : "first-party";
+}
+function buildChatAuthTemplate(mode) {
+  if (mode === "application") {
+    return `
+import { useTelaApplicationAuth } from '#imports'
+
+export function useChatAuth() {
+    const auth = useTelaApplicationAuth()
+
+    return {
+        user: auth.user,
+        activeOrganization: auth.activeOrganization,
+        getToken: auth.getToken,
+        getAvailableOrganizations: auth.getAvailableOrganizations,
+        switchOrganization: auth.switchOrganization,
+    }
+}
+`.trimStart();
+  }
+  return `
+import { useState, useTelaOrganization, useTelaSession, watch } from '#imports'
+
+export function useChatAuth() {
+    const session = useTelaSession()
+    const organization = useTelaOrganization()
+    const isHydratingActiveOrganization = useState('chat-nuxt:auth:is-hydrating-active-organization', () => false)
+    const hasHydratedActiveOrganization = useState('chat-nuxt:auth:has-hydrated-active-organization', () => false)
+
+    if (import.meta.client) {
+        watch(
+            () => session.user.value,
+            async (user) => {
+                if (!user) {
+                    hasHydratedActiveOrganization.value = false
+                    return
+                }
+
+                if (organization.activeOrganization.value || hasHydratedActiveOrganization.value || isHydratingActiveOrganization.value) {
+                    return
+                }
+
+                isHydratingActiveOrganization.value = true
+                try {
+                    await organization.getActiveOrganization()
+                    hasHydratedActiveOrganization.value = true
+                }
+                finally {
+                    isHydratingActiveOrganization.value = false
+                }
+            },
+            { immediate: true },
+        )
+    }
+
+    return {
+        user: session.user,
+        activeOrganization: organization.activeOrganization,
+        getToken: session.getToken,
+        getAvailableOrganizations: organization.listOrganizations,
+        switchOrganization: organization.setActiveOrganization,
+    }
+}
+`.trimStart();
+}
 const ALWAYS_REQUIRED_KEYS = [
   "telaApiUrl",
   "agentApiUrl",
@@ -225,7 +319,7 @@ const module$1 = defineNuxtModule({
     const hasAuthModule = (nuxt.options.modules ?? []).some(isAuthModuleEntry);
     if (!hasAuthModule) {
       throw new Error(
-        '[@meistrari/chat-nuxt] Missing required module "@meistrari/auth-nuxt". Install and enable it so useTelaApplicationAuth() and event.context.auth are available.'
+        '[@meistrari/chat-nuxt] Missing required module "@meistrari/auth-nuxt". Install and enable it so chat auth composables and event.context.auth are available.'
       );
     }
     ensureIconifyPackages(nuxt.options.rootDir);
@@ -237,14 +331,25 @@ const module$1 = defineNuxtModule({
       nuxt.options.srcDir,
       join(runtimeDir, "internal/workspace-settings-resolver.stub")
     );
+    const agentEnvironmentResolverEntry = resolveAgentEnvironmentResolverEntry(
+      nuxt.options.srcDir,
+      join(runtimeDir, "internal/agent-environment-resolver.stub")
+    );
     const telaBuildPath = resolveTelaBuildLayer();
     const runtimeAliases = resolveRuntimeAliases(telaBuildPath);
+    const chatAuthMode = resolveChatAuthMode(nuxt.options.runtimeConfig);
+    const chatAuthTemplate = addTemplate({
+      filename: "chat-nuxt/auth.mjs",
+      getContents: () => buildChatAuthTemplate(chatAuthMode)
+    });
     if (!Array.isArray(nuxt.options.extends)) {
       nuxt.options.extends = nuxt.options.extends ? [nuxt.options.extends] : [];
     }
     nuxt.options.extends.unshift(telaBuildPath);
     nuxt.options.alias = {
       ...nuxt.options.alias,
+      "#chat-auth": chatAuthTemplate.dst,
+      "#chat-agent-environment-resolver": agentEnvironmentResolverEntry,
       "#chat-workspace-settings-resolver": workspaceSettingsResolverEntry,
       "#chat-runtime": runtimeDir,
       "@iconify-json/ph": resolvePackageRoot("@iconify-json/ph")
@@ -349,6 +454,8 @@ export default globalThis.ELK;
       nitroConfig.scanDirs.push(serverDir);
       nitroConfig.alias = {
         ...nitroConfig.alias,
+        "#chat-auth": chatAuthTemplate.dst,
+        "#chat-agent-environment-resolver": agentEnvironmentResolverEntry,
         "#chat-runtime": runtimeDir,
         "#chat-workspace-settings-resolver": workspaceSettingsResolverEntry
       };

package/dist/runtime/components/chat/message-bubble.vue

@@ -1,11 +1,12 @@
 <script setup>
+import { useChatAuth } from "#chat-auth";
 import { parseContentWithFiles } from "../../utils/file";
 import ChatVaultLink from "./vault-link.vue";
 const props = defineProps({
   message: { type: Object, required: true }
 });
 const emit = defineEmits(["retry"]);
-const { user } = useTelaApplicationAuth();
+const { user } = useChatAuth();
 const { getMemberByEmail } = useWorkspaceMembers();
 const embedConfig = useEmbedConfig();
 const mergedCustomComponents = computed(() => ({

package/dist/runtime/composables/useChat.js

@@ -1,4 +1,5 @@
 import * as Sentry from "@sentry/nuxt";
+import { useChatAuth } from "#chat-auth";
 import { exportConversationToMarkdown } from "../utils/export-conversation.js";
 import { resolveChatStateScope } from "../utils/tela-chat.js";
 import { useConversationFileActions } from "./useConversationFiles.js";
@@ -150,7 +151,7 @@ function parseReasoningFromPolling(reasoning) {
 export function useChat() {
   const chatApi = useChatApi();
   const embedConfig = useEmbedConfig();
-  const { user: authUser, activeOrganization } = useTelaApplicationAuth();
+  const { user: authUser, activeOrganization } = useChatAuth();
   const { addFilesToConversation } = useConversationFileActions();
   const isTelaAgentMode = computed(() => !!embedConfig?.telaAgentId.value);
   const chatScope = computed(() => resolveChatStateScope(

package/dist/runtime/composables/useChatApi.js

@@ -1,6 +1,7 @@
+import { useChatAuth } from "#chat-auth";
 export function useChatApi() {
   const embedConfig = useEmbedConfig();
-  const { activeOrganization } = useTelaApplicationAuth();
+  const { activeOrganization } = useChatAuth();
   function buildHeaders(headers) {
     const mergedHeaders = {
       ...headers ?? {}

package/dist/runtime/composables/useConversations.js

@@ -1,4 +1,5 @@
 import * as Sentry from "@sentry/nuxt";
+import { useChatAuth } from "#chat-auth";
 import { resolveChatStateScope } from "../utils/tela-chat.js";
 function sortConversationsByUpdatedAt(conversations) {
   return [...conversations].sort(
@@ -26,7 +27,7 @@ export function mergeFetchedConversations(fetchedConversations, localConversatio
 export function useConversations() {
   const chatApi = useChatApi();
   const embedConfig = useEmbedConfig();
-  const { activeOrganization } = useTelaApplicationAuth();
+  const { activeOrganization } = useChatAuth();
   const conversationBuckets = useState("conversations", () => ({}));
   const loadingBuckets = useState("conversations-loading", () => ({}));
   const errorBuckets = useState("conversations-error", () => ({}));

package/dist/runtime/composables/useGitHubSkills.js

@@ -1,7 +1,8 @@
 import * as Sentry from "@sentry/nuxt";
+import { useChatAuth } from "#chat-auth";
 export function useGitHubSkills() {
   const config = useRuntimeConfig();
-  const { activeOrganization } = useTelaApplicationAuth();
+  const { activeOrganization } = useChatAuth();
   const { settings, updateSettings } = useWorkspaceSettings();
   const connection = useState("github-skills-connection", () => ({
     connected: false,

package/dist/runtime/composables/useWorkspaceExternalSkills.js

@@ -1,5 +1,6 @@
+import { useChatAuth } from "#chat-auth";
 export function useWorkspaceExternalSkills(currentExternalSkills, searchQuery) {
-  const { user } = useTelaApplicationAuth();
+  const { user } = useChatAuth();
   const { connection: skillsConnection, fetchConnection: fetchGitHubConnection, connect: connectGitHub } = useGitHubSkills();
   const pendingSkills = ref([]);
   const removedRefs = ref([]);

package/dist/runtime/composables/useWorkspaceMembers.js

@@ -1,5 +1,6 @@
+import { useChatAuth } from "#chat-auth";
 export function useWorkspaceMembers() {
-  const { activeOrganization } = useTelaApplicationAuth();
+  const { activeOrganization } = useChatAuth();
   const members = computed(() => activeOrganization.value?.members ?? []);
   const membersMap = computed(() => {
     const map = /* @__PURE__ */ new Map();

package/dist/runtime/composables/useWorkspaceSettings.js

@@ -1,4 +1,5 @@
 import * as Sentry from "@sentry/nuxt";
+import { useChatAuth } from "#chat-auth";
 function isNullableArray(value) {
   return value === null || Array.isArray(value);
 }
@@ -19,7 +20,7 @@ function assertWorkspaceSettingsResponse(value) {
 export function useWorkspaceSettings() {
   const chatApi = useChatApi();
   const embedConfig = useEmbedConfig();
-  const { activeOrganization } = useTelaApplicationAuth();
+  const { activeOrganization } = useChatAuth();
   const workspaceScope = computed(() => embedConfig?.workspaceId.value.trim() || activeOrganization.value?.id?.trim() || "default");
   const settingsBuckets = useState("workspace-settings", () => ({}));
   const loadingBuckets = useState("workspace-settings-loading", () => ({}));

package/dist/runtime/composables/useWorkspaces.js

@@ -1,5 +1,6 @@
+import { useChatAuth } from "#chat-auth";
 export function useWorkspaces() {
-  const { getAvailableOrganizations } = useTelaApplicationAuth();
+  const { getAvailableOrganizations } = useChatAuth();
   const { data: workspaces, status, refresh: refreshWorkspaces } = useAsyncData(
     "workspaces",
     () => getAvailableOrganizations(),

package/dist/runtime/embed/components/ChatEmbed.vue

@@ -1,4 +1,5 @@
 <script setup>
+import { useChatAuth } from "#chat-auth";
 import { provideEmbedConfig, useEmbedConfig } from "../../composables/useEmbedConfig";
 import { provideChatAction } from "../../composables/useChatAction";
 import { normalizeTelaAgentId } from "../../utils/tela-chat";
@@ -19,7 +20,7 @@ const props = defineProps({
 });
 const emit = defineEmits(["update:conversationId", "action"]);
 const parentEmbedConfig = useEmbedConfig();
-const { activeOrganization } = useTelaApplicationAuth();
+const { activeOrganization } = useChatAuth();
 const workspaceId = computed(() => activeOrganization.value?.id?.trim() ?? "");
 const normalizedTelaAgentId = computed(() => normalizeTelaAgentId(props.telaAgentId));
 const ignoredPropsWarningKey = ref(null);

package/dist/runtime/embed/components/ChatEmbedInner.vue

@@ -1,4 +1,5 @@
 <script setup>
+import { useChatAuth } from "#chat-auth";
 import { exportConversationToMarkdown } from "../../utils/export-conversation";
 import { conversationListSkeletonRows } from "../../utils/conversation-list-skeleton";
 import {
@@ -16,7 +17,7 @@ const props = defineProps({
 const emit = defineEmits(["update:conversationId"]);
 const chatApi = useChatApi();
 const embedConfig = useEmbedConfig();
-const { user: authUser } = useTelaApplicationAuth();
+const { user: authUser } = useChatAuth();
 const { getMember } = useWorkspaceMembers();
 const statusToast = useStatusToast();
 const { conversations, loading: conversationsLoading, fetchConversations, createConversation, deleteConversation, renameConversation, duplicateConversation, updateConversationInList } = useConversations();

package/dist/runtime/internal/agent-environment-resolver.stub.d.ts

@@ -0,0 +1,2 @@
+declare const _default: null;
+export default _default;

package/dist/runtime/internal/agent-environment-resolver.stub.js

@@ -0,0 +1 @@
+export default null;

package/dist/runtime/server/api/conversations/[id]/messages/[messageId]/retry.post.js

@@ -90,8 +90,12 @@ export default defineEventHandler(async (event) => {
         const environmentVariables = await resolveDefaultAgentEnvironmentVariables(
           event,
           context,
-          { conversationId, messageId },
-          "Failed to resolve workspace credentials on retry, proceeding without env vars"
+          {
+            conversationId,
+            skills: defaultAgentTurn.createPayload.skills ?? [],
+            logContext: { conversationId, messageId },
+            credentialsFailureMessage: "Failed to resolve workspace credentials on retry, proceeding without env vars"
+          }
         );
         const result = await createChatAgentSession(token, withEnvironmentVariables(defaultAgentTurn.createPayload, environmentVariables));
         if (result.success) {

package/dist/runtime/server/api/conversations/[id]/messages/index.post.js

@@ -115,8 +115,12 @@ export default defineEventHandler(async (event) => {
     const environmentVariables = await resolveDefaultAgentEnvironmentVariables(
       event,
       context,
-      { conversationId },
-      "Failed to resolve workspace credentials, proceeding without env vars"
+      {
+        conversationId,
+        skills: defaultAgentTurn.createPayload.skills ?? [],
+        logContext: { conversationId },
+        credentialsFailureMessage: "Failed to resolve workspace credentials, proceeding without env vars"
+      }
     );
     createChatAgentSession(token, withEnvironmentVariables(defaultAgentTurn.createPayload, environmentVariables)).then(async (result) => {
       if (result.success) {

package/dist/runtime/server/utils/agent-api.js

@@ -2,11 +2,12 @@ import { createError } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { agentApiQueryResponseSchema, agentApiSessionSchema } from "#chat-runtime/types/agent";
 import { logger } from "#chat-runtime/server/utils/logger";
+import { resolveAuthToken } from "#chat-runtime/server/utils/auth-token";
 const getConfig = () => useRuntimeConfig();
 export function getAgentDataToken(event) {
-  const cookieToken = event.context.auth?.token;
-  if (cookieToken) {
-    return cookieToken;
+  const token = resolveAuthToken(event);
+  if (token) {
+    return token;
   }
   throw createError({
     statusCode: 401,

package/dist/runtime/server/utils/agent-environment.d.ts

@@ -0,0 +1,8 @@
+import type { H3Event } from 'h3';
+import type { ChatRuntimeContext } from '#chat-runtime/server/utils/chat-context';
+export type AgentEnvironmentResolverContext = ChatRuntimeContext & {
+    conversationId: string;
+    skills: readonly string[];
+};
+export type AgentEnvironmentVariables = Record<string, string>;
+export declare function resolveHostAgentEnvironmentVariables(event: H3Event, context: AgentEnvironmentResolverContext, logContext: Record<string, unknown>): Promise<AgentEnvironmentVariables>;

package/dist/runtime/server/utils/agent-environment.js

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import registeredAgentEnvironmentResolver from "#chat-agent-environment-resolver";
+import { logger } from "#chat-runtime/server/utils/logger";
+const agentEnvironmentVariablesSchema = z.record(z.string(), z.string()).nullable().optional();
+function getRegisteredAgentEnvironmentResolver() {
+  const resolver = registeredAgentEnvironmentResolver;
+  return typeof resolver === "function" ? resolver : null;
+}
+function parseAgentEnvironmentVariables(value, logContext) {
+  const parsed = agentEnvironmentVariablesSchema.safeParse(value);
+  if (!parsed.success) {
+    logger.warn({
+      ...logContext,
+      issues: parsed.error.issues
+    }, "Agent environment resolver returned an invalid payload");
+    return {};
+  }
+  return parsed.data ?? {};
+}
+export async function resolveHostAgentEnvironmentVariables(event, context, logContext) {
+  const resolver = getRegisteredAgentEnvironmentResolver();
+  if (!resolver) {
+    return {};
+  }
+  try {
+    return parseAgentEnvironmentVariables(await resolver(event, context), logContext);
+  } catch (error) {
+    logger.warn({
+      ...logContext,
+      error
+    }, "Agent environment resolver failed, proceeding without host env vars");
+    return {};
+  }
+}

package/dist/runtime/server/utils/auth-token.d.ts

@@ -0,0 +1,2 @@
+import { type H3Event } from 'h3';
+export declare function resolveAuthToken(event: H3Event): string | undefined;

package/dist/runtime/server/utils/auth-token.js

@@ -0,0 +1,21 @@
+import { getCookie } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
+const DEFAULT_FIRST_PARTY_JWT_COOKIE_NAME = "tela-jwt";
+function resolveFirstPartyJwtCookieName(event) {
+  const config = useRuntimeConfig(event);
+  return config.public?.telaAuth?.jwtCookieName || DEFAULT_FIRST_PARTY_JWT_COOKIE_NAME;
+}
+export function resolveAuthToken(event) {
+  const auth = event.context.auth;
+  if (auth?.token) {
+    return auth.token;
+  }
+  if (!auth?.user || !auth.workspace) {
+    return void 0;
+  }
+  const token = getCookie(event, resolveFirstPartyJwtCookieName(event));
+  if (token) {
+    auth.token = token;
+  }
+  return token;
+}

package/dist/runtime/server/utils/conversation-agent-turn.d.ts

@@ -34,6 +34,11 @@ export declare function prepareDefaultAgentTurn(event: H3Event, db: DbInstance,
     requestedModel?: string;
     workspaceSettingsSnapshot?: unknown;
 }): Promise<PreparedDefaultAgentTurn>;
-export declare function resolveDefaultAgentEnvironmentVariables(event: H3Event, context: ChatRuntimeContext, logContext: Record<string, unknown>, failureMessage: string): Promise<Record<string, string>>;
+export declare function resolveDefaultAgentEnvironmentVariables(event: H3Event, context: ChatRuntimeContext, options: {
+    conversationId: string;
+    skills?: readonly string[];
+    logContext: Record<string, unknown>;
+    credentialsFailureMessage: string;
+}): Promise<Record<string, string>>;
 export declare function withEnvironmentVariables(payload: AgentApiChatPayload, environmentVariables: Record<string, string>): AgentApiChatPayload;
 export {};

package/dist/runtime/server/utils/conversation-agent-turn.js

@@ -2,6 +2,7 @@ import { and, eq, isNull } from "drizzle-orm";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { schema } from "#chat-runtime/server/db";
 import { buildMessageWithContext, renderSystemPrompt, truncateTitle } from "#chat-runtime/server/utils/chat-message-builder";
+import { resolveHostAgentEnvironmentVariables } from "#chat-runtime/server/utils/agent-environment";
 import {
   getConversationAppliedSettings,
   getWorkspaceSettingsUpdatedAt,
@@ -150,15 +151,33 @@ export async function prepareDefaultAgentTurn(event, db, context, options) {
     }
   };
 }
-export async function resolveDefaultAgentEnvironmentVariables(event, context, logContext, failureMessage) {
-  if (!resolveChatNuxtFeatures(useRuntimeConfig()).credentials)
-    return {};
-  try {
-    return await resolveWorkspaceCredentials(event, context.workspaceId);
-  } catch (error) {
-    logger.warn({ ...logContext, error }, failureMessage);
-    return {};
+export async function resolveDefaultAgentEnvironmentVariables(event, context, options) {
+  let credentialVariables = {};
+  const logContext = {
+    workspaceId: context.workspaceId,
+    conversationId: options.conversationId,
+    ...options.logContext
+  };
+  if (resolveChatNuxtFeatures(useRuntimeConfig()).credentials) {
+    try {
+      credentialVariables = await resolveWorkspaceCredentials(event, context.workspaceId);
+    } catch (error) {
+      logger.warn({ ...logContext, error }, options.credentialsFailureMessage);
+    }
   }
+  const hostVariables = await resolveHostAgentEnvironmentVariables(
+    event,
+    {
+      ...context,
+      conversationId: options.conversationId,
+      skills: options.skills ?? []
+    },
+    logContext
+  );
+  return {
+    ...credentialVariables,
+    ...hostVariables
+  };
 }
 export function withEnvironmentVariables(payload, environmentVariables) {
   if (Object.keys(environmentVariables).length === 0)

package/dist/runtime/server/utils/tela-api.js

@@ -1,9 +1,10 @@
 import { createError } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { logger } from "#chat-runtime/server/utils/logger";
+import { resolveAuthToken } from "#chat-runtime/server/utils/auth-token";
 export async function telaFetch(event, path, options) {
   const config = useRuntimeConfig();
-  const token = event.context.auth?.token;
+  const token = resolveAuthToken(event);
   if (!token) {
     throw createError({ statusCode: 401, statusMessage: "No auth token" });
   }

package/dist/runtime/server/utils/workspace.js

@@ -1,6 +1,7 @@
 import { useRuntimeConfig } from "nitropack/runtime";
 import { eq } from "drizzle-orm";
 import { schema } from "#chat-runtime/server/db";
+import { resolveAuthToken } from "#chat-runtime/server/utils/auth-token";
 import { telaFetch } from "#chat-runtime/server/utils/tela-api";
 export async function getWorkspaceSettings(db, workspaceId) {
   const [settings] = await db.select().from(schema.workspaceSettings).where(eq(schema.workspaceSettings.workspaceId, workspaceId));
@@ -8,6 +9,7 @@ export async function getWorkspaceSettings(db, workspaceId) {
 }
 export async function resolveWorkspaceCredentials(event, workspaceId) {
   const config = useRuntimeConfig();
+  const token = resolveAuthToken(event);
   return await telaFetch(
     event,
     `/workspaces/${workspaceId}/credentials/resolve`,
@@ -15,7 +17,7 @@ export async function resolveWorkspaceCredentials(event, workspaceId) {
       headers: {
         "X-Service-Name": "chat-app",
         "X-Service-Key": config.chatAppServiceKey,
-        "x-data-token": event.context.auth?.token ?? ""
+        "x-data-token": token ?? ""
       }
     }
   ) ?? {};

package/dist/runtime/types/chat-agent-environment-resolver.d.ts

@@ -0,0 +1,4 @@
+declare module '#chat-agent-environment-resolver' {
+    const resolver: unknown
+    export default resolver
+}

package/dist/runtime/types/chat-auth.d.ts

@@ -0,0 +1,35 @@
+import type { Ref } from 'vue'
+
+type ChatAuthUser = {
+    id: string
+    email?: string | null
+    name?: string | null
+    image?: string | null
+}
+
+type ChatAuthMemberUser = {
+    name: string
+    email: string
+    image?: string
+}
+
+type ChatAuthMember = {
+    id: string
+    userId: string
+    user: ChatAuthMemberUser
+}
+
+type ChatAuthOrganization = {
+    id: string
+    members?: ChatAuthMember[]
+}
+
+declare module '#chat-auth' {
+    export function useChatAuth(): {
+        user: Ref<ChatAuthUser | null>
+        activeOrganization: Ref<ChatAuthOrganization | null>
+        getToken: () => Promise<string | null | undefined>
+        getAvailableOrganizations: () => Promise<ChatAuthOrganization[]>
+        switchOrganization: (organizationId: string) => Promise<void>
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/chat-nuxt",
-  "version": "1.5.1",
+  "version": "1.6.0",
   "type": "module",
   "exports": {
     ".": {