@agent-native/core 0.121.1 → 0.122.0

package/dist/server/credential-provider.d.ts

@@ -104,10 +104,39 @@ export declare function resolveHasCompleteBuilderConnection(): Promise<boolean>;
  * status UIs don't report a mixed user/org credential set as connected.
  */
 export declare function resolveBuilderCredentialSource(): Promise<BuilderCredentialSource | null>;
+export interface BuilderCredentialsDetailed {
+    privateKey: string | null;
+    publicKey: string | null;
+    userId: string | null;
+    orgName: string | null;
+    orgKind: string | null;
+    subscription: string | null;
+    subscriptionLevel: string | null;
+    subscriptionName: string | null;
+    isEnterprise: boolean | null;
+    isFreeAccount: boolean | null;
+    /** Which scope answered, or null when nothing did. */
+    source: BuilderCredentialSource | null;
+    /**
+     * True when reading the credential store itself failed (db timeout, etc).
+     * Callers must report this as retryable rather than "not configured".
+     */
+    lookupFailed: boolean;
+}
+/**
+ * Resolve the Builder assistant credential bundle from one complete scope,
+ * plus where it came from and whether the credential-store read itself
+ * failed. A partial user row is treated as a miss so the org-shared
+ * connection can still power the assistant for teammates.
+ *
+ * Callers that only need the plain credential bundle (the historical shape)
+ * should use `resolveBuilderCredentials()` instead.
+ */
+export declare function resolveBuilderCredentialsDetailed(): Promise<BuilderCredentialsDetailed>;
 /**
  * Resolve the Builder assistant credential bundle from one complete scope.
- * A partial user row is treated as a miss so the org-shared connection can
- * still power the assistant for teammates.
+ * Kept to its original return shape (no `source`/`lookupFailed`) for existing
+ * callers; use `resolveBuilderCredentialsDetailed()` for those fields.
  */
 export declare function resolveBuilderCredentials(): Promise<{
     privateKey: string | null;
@@ -121,6 +150,13 @@ export declare function resolveBuilderCredentials(): Promise<{
     isEnterprise: boolean | null;
     isFreeAccount: boolean | null;
 }>;
+/**
+ * Stale markers expire so a rejected model or a transient gateway failure
+ * cannot pin a signed-in user to "Builder not connected" forever. Only a
+ * successful gateway call clears the marker early, and that call never happens
+ * while the marker is what makes the connection look broken.
+ */
+export declare const BUILDER_AUTH_FAILURE_TTL_MS: number;
 export interface BuilderCredentialAuthFailure {
     fingerprint: string;
     message: string;

package/dist/server/credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-provider.d.ts","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAK5C;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,YAAY,IAAI,EAAE;QAChB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,EASA;CACF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEvE;AAwBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iCAAiC,IAAI,OAAO,CAG3D;AAED,wBAAgB,wCAAwC,CACtD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAOT;AA2GD,KAAK,uBAAuB,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,CAAC;AA0BpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAoMD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvE;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvE;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,OAAO,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC,OAAO,CAAC,CAG5E;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAO9F;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B,CAAC,CA0ED;AAID,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,4BAA4B,CAC1C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,GAAG,IAAI,CAQf;AAMD,wBAAsB,+BAA+B,CACnD,KAAK,GAAE;IACL,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACL,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CA0B9C;AAED,wBAAsB,kCAAkC,CAAC,OAAO,CAAC,EAAE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAGD,4FAA4F;AAC5F,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAE3D,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,MAAM,GAAG,IAAI,CAUf;AAMD,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAqChD;AAED,wBAAsB,mCAAmC,CAAC,IAAI,EAAE;IAC9D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAED,wBAAsB,kCAAkC,CAAC,IAAI,EAAE;IAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAChC,EACD,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA+FrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrD;AAcD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyGvE;AAOD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,IAAI,MAAM,CAO9C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAKjD;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAKzD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAKnD;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAGpD"}
+{"version":3,"file":"credential-provider.d.ts","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAK5C;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,YAAY,IAAI,EAAE;QAChB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,EASA;CACF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEvE;AAwBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iCAAiC,IAAI,OAAO,CAG3D;AAED,wBAAgB,wCAAwC,CACtD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAOT;AA2GD,KAAK,uBAAuB,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,CAAC;AA0BpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAuQD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvE;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvE;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,OAAO,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC,OAAO,CAAC,CAG5E;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAG9F;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,sDAAsD;IACtD,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACvC;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAiF7F;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B,CAAC,CAyBD;AAGD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAE1D,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,4BAA4B,CAC1C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,GAAG,IAAI,CAQf;AAMD,wBAAsB,+BAA+B,CACnD,KAAK,GAAE;IACL,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACL,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAkC9C;AAED,wBAAsB,kCAAkC,CAAC,OAAO,CAAC,EAAE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAGD,4FAA4F;AAC5F,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAE3D,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,MAAM,GAAG,IAAI,CAUf;AAMD,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAqChD;AAED,wBAAsB,mCAAmC,CAAC,IAAI,EAAE;IAC9D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAED,wBAAsB,kCAAkC,CAAC,IAAI,EAAE;IAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAChC,EACD,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA+FrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrD;AAcD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyGvE;AAOD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,IAAI,MAAM,CAO9C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAKjD;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAKzD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAKnD;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAGpD"}

package/dist/server/credential-provider.js

@@ -212,6 +212,21 @@ async function readBuilderCredentialScope(readAppSecrets, scope, scopeId) {
         source: scope === "workspace" ? "workspace" : scope,
     };
 }
+/**
+ * A transient org_members read failure makes getOrgContext report no org, which
+ * would otherwise hide an org-scoped Builder connection behind a permanent-
+ * sounding "not configured" error. resolveOrgIdForEmail honors an explicit
+ * Personal selection, so this cannot promote a user into an org they left.
+ */
+async function resolveOrgIdForRequestEmail(email) {
+    try {
+        const { resolveOrgIdForEmail } = await import("../org/context.js");
+        return await resolveOrgIdForEmail(email);
+    }
+    catch {
+        return null;
+    }
+}
 async function resolveScopedBuilderCredential(key) {
     const email = getRequestUserEmail();
     if (!email)
@@ -235,12 +250,20 @@ async function resolveScopedBuilderCredential(key) {
             }
             return { value: userSecret.value, source: "user" };
         }
+        let orgId = getRequestOrgId();
+        let orgSource = orgId
+            ? "request"
+            : "none";
+        if (!orgId) {
+            orgId = await resolveOrgIdForRequestEmail(email);
+            if (orgId)
+                orgSource = "email-fallback";
+        }
         // 2. Per-org shared credential: when one teammate connects Builder
         //    as an owner/admin we write the OAuth result at org scope so
         //    every member of that org gets the AI chat working without
         //    re-running the connect flow. Resolution falls back here
         //    silently — the caller never has to know which scope answered.
-        const orgId = getRequestOrgId();
         if (orgId) {
             scopeAttempted = "org";
             const orgSecret = await readAppSecret({
@@ -250,7 +273,7 @@ async function resolveScopedBuilderCredential(key) {
             });
             if (orgSecret) {
                 if (traceLookup) {
-                    console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId} scope=org hit=true`);
+                    console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} scope=org hit=true`);
                 }
                 return { value: orgSecret.value, source: "org" };
             }
@@ -265,30 +288,32 @@ async function resolveScopedBuilderCredential(key) {
             });
             if (workspaceSecret) {
                 if (traceLookup) {
-                    console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId} scope=workspace hit=true`);
+                    console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} scope=workspace hit=true`);
                 }
                 return { value: workspaceSecret.value, source: "workspace" };
             }
             if (traceLookup) {
-                console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId} miss tried=user,org,workspace`);
+                console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} miss tried=user,org,workspace`);
             }
         }
-        else {
-            scopeAttempted = "workspace-solo";
-            const soloWorkspaceSecret = await readAppSecret({
-                key,
-                scope: "workspace",
-                scopeId: `solo:${email}`,
-            });
-            if (soloWorkspaceSecret) {
-                if (traceLookup) {
-                    console.log(`[builder-credential] key=${key} email=${email} scope=workspace-solo hit=true`);
-                }
-                return { value: soloWorkspaceSecret.value, source: "workspace" };
-            }
+        // 3. Solo-workspace fallback: always checked, even when an org id was
+        //    found above. Older no-org connect flows wrote here, so a credential
+        //    written before the user joined/created an org must not become
+        //    unreachable once that org exists.
+        scopeAttempted = "workspace-solo";
+        const soloWorkspaceSecret = await readAppSecret({
+            key,
+            scope: "workspace",
+            scopeId: `solo:${email}`,
+        });
+        if (soloWorkspaceSecret) {
             if (traceLookup) {
-                console.log(`[builder-credential] key=${key} email=${email} orgId=(none) miss tried=user,workspace-solo`);
+                console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId ?? "(none)"} orgSource=${orgSource} scope=workspace-solo hit=true`);
             }
+            return { value: soloWorkspaceSecret.value, source: "workspace" };
+        }
+        if (traceLookup) {
+            console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId ?? "(none)"} orgSource=${orgSource} miss tried=${orgId ? "user,org,workspace,workspace-solo" : "user,workspace-solo"}`);
         }
     }
     catch (err) {
@@ -302,48 +327,62 @@ async function resolveScopedBuilderCredential(key) {
 async function resolveScopedBuilderCredentials() {
     const email = getRequestUserEmail();
     if (!email)
-        return null;
+        return { creds: null, lookupFailed: false };
     const traceLookup = shouldTraceCredentialResolve();
     let scopeAttempted = "user";
     try {
         const { readAppSecrets } = await import("../secrets/storage.js");
-        const traceScope = (creds, scopeId) => {
+        const traceScope = (creds, scopeId, extra = "") => {
             if (!traceLookup)
                 return;
-            console.log(`[builder-credential] scope=${creds.source} scopeId=${scopeId} email=${email} complete=${isCompleteBuilderConnection(creds)} private=${Boolean(creds.privateKey)} public=${Boolean(creds.publicKey)}`);
+            console.log(`[builder-credential] scope=${creds.source} scopeId=${scopeId} email=${email}${extra} complete=${isCompleteBuilderConnection(creds)} private=${Boolean(creds.privateKey)} public=${Boolean(creds.publicKey)}`);
         };
         const userCreds = await readBuilderCredentialScope(readAppSecrets, "user", email);
         traceScope(userCreds, email);
-        if (isCompleteBuilderConnection(userCreds))
-            return userCreds;
-        const orgId = getRequestOrgId();
+        if (isCompleteBuilderConnection(userCreds)) {
+            return { creds: userCreds, lookupFailed: false };
+        }
+        let orgId = getRequestOrgId();
+        let orgSource = orgId
+            ? "request"
+            : "none";
+        if (!orgId) {
+            orgId = await resolveOrgIdForRequestEmail(email);
+            if (orgId)
+                orgSource = "email-fallback";
+        }
         if (orgId) {
             scopeAttempted = "org";
             const orgCreds = await readBuilderCredentialScope(readAppSecrets, "org", orgId);
-            traceScope(orgCreds, orgId);
-            if (isCompleteBuilderConnection(orgCreds))
-                return orgCreds;
+            traceScope(orgCreds, orgId, ` orgSource=${orgSource}`);
+            if (isCompleteBuilderConnection(orgCreds)) {
+                return { creds: orgCreds, lookupFailed: false };
+            }
             scopeAttempted = "workspace";
             const workspaceCreds = await readBuilderCredentialScope(readAppSecrets, "workspace", orgId);
-            traceScope(workspaceCreds, orgId);
-            if (isCompleteBuilderConnection(workspaceCreds))
-                return workspaceCreds;
+            traceScope(workspaceCreds, orgId, ` orgSource=${orgSource}`);
+            if (isCompleteBuilderConnection(workspaceCreds)) {
+                return { creds: workspaceCreds, lookupFailed: false };
+            }
         }
-        else {
-            scopeAttempted = "workspace-solo";
-            const scopeId = `solo:${email}`;
-            const workspaceCreds = await readBuilderCredentialScope(readAppSecrets, "workspace", scopeId);
-            traceScope(workspaceCreds, scopeId);
-            if (isCompleteBuilderConnection(workspaceCreds))
-                return workspaceCreds;
+        // Solo-workspace fallback: always checked, even when an org id was found
+        // above. See resolveScopedBuilderCredential for why this must not be
+        // gated behind "no org".
+        scopeAttempted = "workspace-solo";
+        const soloScopeId = `solo:${email}`;
+        const soloCreds = await readBuilderCredentialScope(readAppSecrets, "workspace", soloScopeId);
+        traceScope(soloCreds, soloScopeId, ` orgId=${orgId ?? "(none)"} orgSource=${orgSource}`);
+        if (isCompleteBuilderConnection(soloCreds)) {
+            return { creds: soloCreds, lookupFailed: false };
         }
     }
     catch (err) {
         if (traceLookup) {
             console.log(`[builder-credential] email=${email} scope=${scopeAttempted} credentials error=${err?.message ?? err}`);
         }
+        return { creds: null, lookupFailed: true };
     }
-    return null;
+    return { creds: null, lookupFailed: false };
 }
 /**
  * Resolve a Builder credential for the current request. User/org credentials
@@ -402,23 +441,22 @@ export async function resolveHasCompleteBuilderConnection() {
  * status UIs don't report a mixed user/org credential set as connected.
  */
 export async function resolveBuilderCredentialSource() {
-    const scoped = await resolveScopedBuilderCredentials();
-    if (scoped)
-        return scoped.source;
-    return canUseBuilderDeployCredentialFallbackForRequest() &&
-        process.env.BUILDER_PRIVATE_KEY
-        ? "env"
-        : null;
+    const detailed = await resolveBuilderCredentialsDetailed();
+    return detailed.source;
 }
 /**
- * Resolve the Builder assistant credential bundle from one complete scope.
- * A partial user row is treated as a miss so the org-shared connection can
- * still power the assistant for teammates.
+ * Resolve the Builder assistant credential bundle from one complete scope,
+ * plus where it came from and whether the credential-store read itself
+ * failed. A partial user row is treated as a miss so the org-shared
+ * connection can still power the assistant for teammates.
+ *
+ * Callers that only need the plain credential bundle (the historical shape)
+ * should use `resolveBuilderCredentials()` instead.
  */
-export async function resolveBuilderCredentials() {
-    const scoped = await resolveScopedBuilderCredentials();
+export async function resolveBuilderCredentialsDetailed() {
+    const { creds: scoped, lookupFailed } = await resolveScopedBuilderCredentials();
     if (scoped) {
-        const { privateKey, publicKey, userId, orgName, orgKind, subscription, subscriptionLevel, subscriptionName, isEnterprise, isFreeAccount, } = scoped;
+        const { privateKey, publicKey, userId, orgName, orgKind, subscription, subscriptionLevel, subscriptionName, isEnterprise, isFreeAccount, source, } = scoped;
         return {
             privateKey,
             publicKey,
@@ -430,38 +468,63 @@ export async function resolveBuilderCredentials() {
             subscriptionName,
             isEnterprise,
             isFreeAccount,
+            source,
+            lookupFailed: false,
         };
     }
-    const privateKey = canUseBuilderDeployCredentialFallbackForRequest()
+    const canUseEnv = canUseBuilderDeployCredentialFallbackForRequest();
+    const privateKey = canUseEnv
         ? (readDeployCredentialEnv("BUILDER_PRIVATE_KEY") ?? null)
         : null;
-    const publicKey = canUseBuilderDeployCredentialFallbackForRequest()
+    const publicKey = canUseEnv
         ? (readDeployCredentialEnv("BUILDER_PUBLIC_KEY") ?? null)
         : null;
-    const userId = canUseBuilderDeployCredentialFallbackForRequest()
+    const userId = canUseEnv
         ? (readDeployCredentialEnv("BUILDER_USER_ID") ?? null)
         : null;
-    const orgName = canUseBuilderDeployCredentialFallbackForRequest()
+    const orgName = canUseEnv
         ? (readDeployCredentialEnv("BUILDER_ORG_NAME") ?? null)
         : null;
-    const orgKind = canUseBuilderDeployCredentialFallbackForRequest()
+    const orgKind = canUseEnv
         ? (readDeployCredentialEnv("BUILDER_ORG_KIND") ?? null)
         : null;
-    const subscription = canUseBuilderDeployCredentialFallbackForRequest()
+    const subscription = canUseEnv
         ? (readDeployCredentialEnv("BUILDER_SUBSCRIPTION") ?? null)
         : null;
-    const subscriptionLevel = canUseBuilderDeployCredentialFallbackForRequest()
+    const subscriptionLevel = canUseEnv
         ? (readDeployCredentialEnv("BUILDER_SUBSCRIPTION_LEVEL") ?? null)
         : null;
-    const subscriptionName = canUseBuilderDeployCredentialFallbackForRequest()
+    const subscriptionName = canUseEnv
         ? (readDeployCredentialEnv("BUILDER_SUBSCRIPTION_NAME") ?? null)
         : null;
-    const isEnterprise = canUseBuilderDeployCredentialFallbackForRequest()
+    const isEnterprise = canUseEnv
         ? readOptionalBuilderBoolean(readDeployCredentialEnv("BUILDER_IS_ENTERPRISE"))
         : null;
-    const isFreeAccount = canUseBuilderDeployCredentialFallbackForRequest()
+    const isFreeAccount = canUseEnv
         ? readOptionalBuilderBoolean(readDeployCredentialEnv("BUILDER_IS_FREE_ACCOUNT"))
         : null;
+    return {
+        privateKey,
+        publicKey,
+        userId,
+        orgName,
+        orgKind,
+        subscription,
+        subscriptionLevel,
+        subscriptionName,
+        isEnterprise,
+        isFreeAccount,
+        source: canUseEnv && privateKey ? "env" : null,
+        lookupFailed,
+    };
+}
+/**
+ * Resolve the Builder assistant credential bundle from one complete scope.
+ * Kept to its original return shape (no `source`/`lookupFailed`) for existing
+ * callers; use `resolveBuilderCredentialsDetailed()` for those fields.
+ */
+export async function resolveBuilderCredentials() {
+    const { privateKey, publicKey, userId, orgName, orgKind, subscription, subscriptionLevel, subscriptionName, isEnterprise, isFreeAccount, } = await resolveBuilderCredentialsDetailed();
     return {
         privateKey,
         publicKey,
@@ -476,6 +539,13 @@ export async function resolveBuilderCredentials() {
     };
 }
 const BUILDER_AUTH_FAILURE_SETTING_PREFIX = "builder-auth-failure:";
+/**
+ * Stale markers expire so a rejected model or a transient gateway failure
+ * cannot pin a signed-in user to "Builder not connected" forever. Only a
+ * successful gateway call clears the marker early, and that call never happens
+ * while the marker is what makes the connection look broken.
+ */
+export const BUILDER_AUTH_FAILURE_TTL_MS = 15 * 60 * 1000;
 export function builderCredentialFingerprint(privateKey, publicKey) {
     if (!privateKey || !publicKey)
         return null;
@@ -494,10 +564,18 @@ export async function getBuilderCredentialAuthFailure(creds = {}) {
     if (!fingerprint)
         return null;
     try {
-        const { getSetting } = await import("../settings/store.js");
-        const row = await getSetting(builderAuthFailureSettingKey(fingerprint));
+        const settings = await import("../settings/store.js");
+        const settingKey = builderAuthFailureSettingKey(fingerprint);
+        const row = await settings.getSetting(settingKey);
         if (!row)
             return null;
+        const at = typeof row.at === "number" ? row.at : Date.now();
+        if (Date.now() - at > BUILDER_AUTH_FAILURE_TTL_MS) {
+            if (typeof settings.deleteSetting === "function") {
+                await settings.deleteSetting(settingKey).catch(() => { });
+            }
+            return null;
+        }
         return {
             fingerprint,
             message: typeof row.message === "string" && row.message
@@ -505,7 +583,7 @@ export async function getBuilderCredentialAuthFailure(creds = {}) {
                 : "Builder rejected the connected credentials. Reconnect Builder.io.",
             status: typeof row.status === "number" ? row.status : undefined,
             code: typeof row.code === "string" ? row.code : undefined,
-            at: typeof row.at === "number" ? row.at : Date.now(),
+            at,
             ownerEmail: typeof row.ownerEmail === "string" ? row.ownerEmail : undefined,
             orgId: typeof row.orgId === "string" ? row.orgId : undefined,
         };