@agent-native/core 0.141.3 → 0.141.4

package/corpus/templates/analytics/server/lib/first-party-analytics.ts

@@ -1,4 +1,4 @@
-import { getDbExec } from "@agent-native/core/db";
+import { getDbExec, isPostgres } from "@agent-native/core/db";
 import { and, eq, isNull, or } from "drizzle-orm";
 
 import { FIRST_PARTY_ANALYTICS_QUERY_TIMEOUT_MS } from "../../shared/dashboard-report-timeouts.js";
@@ -17,7 +17,11 @@ import {
   queryOutcomeFromError,
   recordFirstPartyAnalyticsQueryPressure,
 } from "./first-party-analytics-health.js";
-import { upsertFirstPartyAnalyticsRollups } from "./first-party-analytics-rollups.js";
+import {
+  FIRST_PARTY_ANALYTICS_ROLLUP_LOCK_KEY,
+  FIRST_PARTY_ANALYTICS_ROLLUP_LOCK_SQL,
+  upsertFirstPartyAnalyticsRollups,
+} from "./first-party-analytics-rollups.js";
 
 export interface AnalyticsScope {
   userEmail: string;
@@ -506,6 +510,16 @@ export async function recordAnalyticsEvents(
 
   if (rows.length) {
     await db.transaction(async (tx: any) => {
+      if (isPostgres()) {
+        // The historical backfill takes this lock before its raw-event
+        // snapshot. Holding it through ingest's rollup increment prevents the
+        // backfill's monotonic upsert from losing a concurrently committed
+        // event.
+        await tx.execute({
+          sql: FIRST_PARTY_ANALYTICS_ROLLUP_LOCK_SQL,
+          args: [FIRST_PARTY_ANALYTICS_ROLLUP_LOCK_KEY],
+        });
+      }
       await tx.insert(schema.analyticsEvents).values(rows);
       await tx
         .update(schema.analyticsPublicKeys)
@@ -579,6 +593,233 @@ function stripSqlLiterals(sql: string): string {
   return out;
 }
 
+interface AnalyticsSqlToken {
+  value: string;
+  quoted: boolean;
+  depth: number;
+}
+
+interface AnalyticsSqlSource {
+  ref: string;
+  quoted: boolean;
+  commaSeparated: boolean;
+}
+
+const SQL_SOURCE_CLAUSE_ENDS = new Set([
+  "where",
+  "group",
+  "order",
+  "limit",
+  "having",
+  "union",
+  "except",
+  "intersect",
+  "window",
+  "qualify",
+  "returning",
+]);
+
+function tokenizeAnalyticsSql(sql: string): AnalyticsSqlToken[] {
+  const tokens: AnalyticsSqlToken[] = [];
+  let depth = 0;
+
+  for (let i = 0; i < sql.length; ) {
+    const ch = sql[i];
+    const next = sql[i + 1];
+
+    if (ch === "-" && next === "-") {
+      i += 2;
+      while (i < sql.length && sql[i] !== "\n") i++;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < sql.length && !(sql[i] === "*" && sql[i + 1] === "/")) {
+        i++;
+      }
+      i += 2;
+      continue;
+    }
+    if (ch === "'") {
+      i++;
+      while (i < sql.length) {
+        if (sql[i] === "'" && sql[i + 1] === "'") {
+          i += 2;
+          continue;
+        }
+        if (sql[i] === "'") {
+          i++;
+          break;
+        }
+        i++;
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "`" || ch === "[") {
+      const closing = ch === "[" ? "]" : ch;
+      let value = "";
+      i++;
+      while (i < sql.length) {
+        if (sql[i] === closing && sql[i + 1] === closing) {
+          value += closing;
+          i += 2;
+          continue;
+        }
+        if (sql[i] === closing) {
+          i++;
+          break;
+        }
+        value += sql[i++];
+      }
+      tokens.push({ value, quoted: true, depth });
+      continue;
+    }
+    if (/[A-Za-z_]/.test(ch)) {
+      const start = i;
+      i++;
+      while (i < sql.length && /[A-Za-z0-9_$]/.test(sql[i])) i++;
+      tokens.push({ value: sql.slice(start, i), quoted: false, depth });
+      continue;
+    }
+    if (ch === "(") {
+      tokens.push({ value: ch, quoted: false, depth });
+      depth++;
+      i++;
+      continue;
+    }
+    if (ch === ")") {
+      depth = Math.max(0, depth - 1);
+      tokens.push({ value: ch, quoted: false, depth });
+      i++;
+      continue;
+    }
+    if (ch === "." || ch === ",") {
+      tokens.push({ value: ch, quoted: false, depth });
+    }
+    i++;
+  }
+
+  return tokens;
+}
+
+function isAnalyticsSqlKeyword(
+  token: AnalyticsSqlToken | undefined,
+  keyword: string,
+): boolean {
+  return Boolean(
+    token && !token.quoted && token.value.toLowerCase() === keyword,
+  );
+}
+
+function readAnalyticsSqlSource(
+  tokens: AnalyticsSqlToken[],
+  start: number,
+): { source: Omit<AnalyticsSqlSource, "commaSeparated"> | null; next: number } {
+  let index = start;
+  while (
+    isAnalyticsSqlKeyword(tokens[index], "only") ||
+    isAnalyticsSqlKeyword(tokens[index], "lateral")
+  ) {
+    index++;
+  }
+
+  const first = tokens[index];
+  if (!first) return { source: null, next: index };
+  if (first.value === "(") {
+    const groupDepth = first.depth;
+    index++;
+    while (
+      index < tokens.length &&
+      !(tokens[index].value === ")" && tokens[index].depth === groupDepth)
+    ) {
+      index++;
+    }
+    return { source: null, next: Math.min(index + 1, tokens.length) };
+  }
+  if (!first.quoted && !/^[A-Za-z_][A-Za-z0-9_$]*$/.test(first.value)) {
+    return { source: null, next: index + 1 };
+  }
+
+  let ref = first.value;
+  let quoted = first.quoted;
+  if (
+    tokens[index + 1]?.value === "." &&
+    tokens[index + 2] &&
+    (tokens[index + 2].quoted ||
+      /^[A-Za-z_][A-Za-z0-9_$]*$/.test(tokens[index + 2].value))
+  ) {
+    ref += `.${tokens[index + 2].value}`;
+    quoted ||= tokens[index + 2].quoted;
+    index += 2;
+  }
+  return { source: { ref, quoted }, next: index + 1 };
+}
+
+function collectAnalyticsSqlSources(sql: string): {
+  cteNames: Set<string>;
+  sources: AnalyticsSqlSource[];
+} {
+  const tokens = tokenizeAnalyticsSql(sql);
+  const cteNames = new Set<string>();
+  for (let i = 0; i + 2 < tokens.length; i++) {
+    if (
+      tokens[i].value &&
+      isAnalyticsSqlKeyword(tokens[i + 1], "as") &&
+      tokens[i + 2].value === "("
+    ) {
+      cteNames.add(tokens[i].value.toLowerCase());
+    }
+  }
+
+  const sources: AnalyticsSqlSource[] = [];
+  for (let i = 0; i < tokens.length; i++) {
+    if (!isAnalyticsSqlKeyword(tokens[i], "from")) continue;
+    const fromDepth = tokens[i].depth;
+    let expectSource = true;
+    let inJoinCondition = false;
+    let sourceAfterComma = false;
+
+    for (let j = i + 1; j < tokens.length; j++) {
+      const token = tokens[j];
+      if (token.depth < fromDepth) break;
+      if (token.depth > fromDepth) continue;
+
+      const word = token.quoted ? "" : token.value.toLowerCase();
+      if (SQL_SOURCE_CLAUSE_ENDS.has(word)) break;
+      if (word === "join") {
+        expectSource = true;
+        inJoinCondition = false;
+        sourceAfterComma = false;
+        continue;
+      }
+      if (word === "on" || word === "using") {
+        expectSource = false;
+        inJoinCondition = true;
+        continue;
+      }
+      if (token.value === "," && !inJoinCondition) {
+        expectSource = true;
+        sourceAfterComma = true;
+        continue;
+      }
+      if (!expectSource) continue;
+
+      const parsed = readAnalyticsSqlSource(tokens, j);
+      if (parsed.source) {
+        sources.push({
+          ...parsed.source,
+          commaSeparated: sourceAfterComma,
+        });
+      }
+      sourceAfterComma = false;
+      expectSource = false;
+      j = Math.max(j, parsed.next - 1);
+    }
+  }
+
+  return { cteNames, sources };
+}
+
 export function validateFirstPartyAnalyticsSql(sql: string): void {
   const stripped = stripSqlLiterals(sql).trim();
   const lowered = stripped.toLowerCase();
@@ -603,30 +844,38 @@ export function validateFirstPartyAnalyticsSql(sql: string): void {
   if (/\$\d+\b/.test(stripped)) {
     throw new Error("Bind placeholders are not supported in dashboard SQL");
   }
+  if (/\bonly\b/i.test(stripped)) {
+    throw new Error(
+      "ONLY-qualified table sources are not supported in first-party analytics queries",
+    );
+  }
   if (/\bsession_replay_chunks\b/i.test(stripped)) {
     throw new Error(
       "First-party analytics queries cannot read session replay chunks",
     );
   }
 
-  const cteNames = new Set<string>();
-  const cteRe = /\b([a-zA-Z_][a-zA-Z0-9_]*)\s+as\s*\(/gi;
-  for (const match of stripped.matchAll(cteRe)) {
-    cteNames.add(match[1].toLowerCase());
-  }
-
+  const { cteNames, sources } = collectAnalyticsSqlSources(sql);
   let usesAllowedTable = false;
-  const tableRe =
-    /\b(?:from|join)\s+([a-zA-Z_][a-zA-Z0-9_]*(?:\.[a-zA-Z_][a-zA-Z0-9_]*)?)/gi;
-  for (const match of stripped.matchAll(tableRe)) {
-    const ref = match[1].toLowerCase();
+  for (const source of sources) {
+    const ref = source.ref.toLowerCase();
+    if (source.commaSeparated) {
+      throw new Error(
+        "Comma-separated table sources are not supported in first-party analytics queries; use an explicit JOIN",
+      );
+    }
     if (FIRST_PARTY_QUERY_TABLES.has(ref)) {
+      if (source.quoted) {
+        throw new Error(
+          "Quoted table identifiers are not supported in first-party analytics queries",
+        );
+      }
       usesAllowedTable = true;
       continue;
     }
     if (cteNames.has(ref)) continue;
     throw new Error(
-      `First-party analytics queries can only read ${FIRST_PARTY_QUERY_TABLE_LIST} (found ${match[1]})`,
+      `First-party analytics queries can only read ${FIRST_PARTY_QUERY_TABLE_LIST} (found ${source.ref})`,
     );
   }
   if (!usesAllowedTable) {

package/corpus/templates/analytics/server/lib/gong.ts

@@ -17,6 +17,8 @@ const DEFAULT_API_BASE = "https://api.gong.io/v2";
 const MAX_GONG_SEARCH_PAGES = 50;
 const MAX_GONG_CALL_LIST_PAGES = 50;
 const MAX_GONG_EXHAUSTIVE_RECORDS = 500;
+const GONG_API_REQUEST_TIMEOUT_MS = 30_000;
+const MAX_GONG_EXHAUSTIVE_RUNTIME_MS = 60_000;
 
 const cache = new Map<string, { data: unknown; ts: number }>();
 const CACHE_TTL_MS = 10 * 60 * 1000;
@@ -38,7 +40,29 @@ async function getApiBase(): Promise<string> {
   return (configured || DEFAULT_API_BASE).replace(/\/+$/, "");
 }
 
-async function apiGet<T>(path: string, cacheKey?: string): Promise<T> {
+export interface GongRequestOptions {
+  signal?: AbortSignal;
+  deadlineAt?: number;
+}
+
+function requestSignal(options?: GongRequestOptions): AbortSignal {
+  const remainingMs = options?.deadlineAt
+    ? Math.max(
+        1,
+        Math.min(GONG_API_REQUEST_TIMEOUT_MS, options.deadlineAt - Date.now()),
+      )
+    : GONG_API_REQUEST_TIMEOUT_MS;
+  const timeoutSignal = AbortSignal.timeout(remainingMs);
+  return options?.signal
+    ? AbortSignal.any([options.signal, timeoutSignal])
+    : timeoutSignal;
+}
+
+async function apiGet<T>(
+  path: string,
+  cacheKey?: string,
+  options?: GongRequestOptions,
+): Promise<T> {
   const key = scopedCredentialCacheKey(cacheKey ?? path, "GONG_ACCESS_KEY");
   const cached = cache.get(key);
   if (cached && Date.now() - cached.ts < CACHE_TTL_MS) {
@@ -50,6 +74,7 @@ async function apiGet<T>(path: string, cacheKey?: string): Promise<T> {
       Authorization: await getAuthHeader(),
       "Content-Type": "application/json",
     },
+    signal: requestSignal(options),
   });
 
   if (!res.ok) {
@@ -72,6 +97,7 @@ async function apiPost<T>(
   path: string,
   body: unknown,
   cacheKey?: string,
+  options?: GongRequestOptions,
 ): Promise<T> {
   const key = scopedCredentialCacheKey(
     cacheKey ?? `POST:${path}:${JSON.stringify(body)}`,
@@ -89,6 +115,7 @@ async function apiPost<T>(
       "Content-Type": "application/json",
     },
     body: JSON.stringify(body),
+    signal: requestSignal(options),
   });
 
   if (!res.ok) {
@@ -159,11 +186,18 @@ export interface EnrichedTranscript {
   externalMonologues: EnrichedMonologue[];
 }
 
-export async function getCalls(filters?: {
-  fromDateTime?: string;
-  toDateTime?: string;
+export async function getCalls(
+  filters?: {
+    fromDateTime?: string;
+    toDateTime?: string;
+    cursor?: string;
+  },
+  options?: GongRequestOptions,
+): Promise<{
+  calls: GongCall[];
   cursor?: string;
-}): Promise<{ calls: GongCall[]; cursor?: string; totalRecords?: number }> {
+  totalRecords?: number;
+}> {
   const params = new URLSearchParams();
   if (filters?.fromDateTime) params.set("fromDateTime", filters.fromDateTime);
   if (filters?.toDateTime) params.set("toDateTime", filters.toDateTime);
@@ -174,7 +208,7 @@ export async function getCalls(filters?: {
   const data = await apiGet<{
     calls?: GongCall[];
     records?: { cursor?: string; totalRecords?: number };
-  }>(path);
+  }>(path, undefined, options);
   return {
     calls: data.calls ?? [],
     cursor: data.records?.cursor,
@@ -184,41 +218,62 @@ export async function getCalls(filters?: {
   };
 }
 
-export async function getAllCalls(filters?: {
-  fromDateTime?: string;
-  toDateTime?: string;
-}): Promise<{
+export async function getAllCalls(
+  filters?: {
+    fromDateTime?: string;
+    toDateTime?: string;
+  },
+  options: GongRequestOptions = {},
+): Promise<{
   calls: GongCall[];
   cursor?: string;
   pages: number;
   totalRecords?: number;
 }> {
+  const deadlineAt =
+    options.deadlineAt ?? Date.now() + MAX_GONG_EXHAUSTIVE_RUNTIME_MS;
   const calls: GongCall[] = [];
   let cursor: string | undefined;
   let pages = 0;
   let totalRecords: number | undefined;
 
   do {
-    const page = await getCalls({
-      ...filters,
-      ...(cursor ? { cursor } : {}),
-    });
+    if (Date.now() >= deadlineAt) {
+      throw new Error(
+        "Gong exhaustive call listing exceeded its 60-second runtime budget. " +
+          "Use provider-api-request with stageAs and pagination, followed by query-staged-dataset or a Data Program.",
+      );
+    }
+    const page = await getCalls(
+      {
+        ...filters,
+        ...(cursor ? { cursor } : {}),
+      },
+      { ...options, deadlineAt },
+    );
     pages += 1;
     if (typeof page.totalRecords === "number") {
       totalRecords = page.totalRecords;
     }
     if (
       typeof totalRecords === "number" &&
-      totalRecords > MAX_GONG_EXHAUSTIVE_RECORDS
+      totalRecords >= MAX_GONG_EXHAUSTIVE_RECORDS
     ) {
       throw new Error(
-        `Gong exhaustive call listing found ${totalRecords.toLocaleString()} records in the requested window. ` +
+        `Gong exhaustive call listing found ${totalRecords.toLocaleString()} records in the requested window; ` +
+          "Use provider-api-request with stageAs and pagination, followed by query-staged-dataset or a Data Program, instead of returning the full cohort through gong-calls.",
+      );
+    }
+    const nextCursor = page.cursor;
+    const nextCallCount = calls.length + page.calls.length;
+    if (nextCallCount >= MAX_GONG_EXHAUSTIVE_RECORDS) {
+      throw new Error(
+        `Gong exhaustive call listing reached ${MAX_GONG_EXHAUSTIVE_RECORDS.toLocaleString()} records before the cohort was safely returned. ` +
           "Use provider-api-request with stageAs and pagination, followed by query-staged-dataset or a Data Program, instead of returning the full cohort through gong-calls.",
       );
     }
     calls.push(...page.calls);
 
-    const nextCursor = page.cursor;
     if (!nextCursor || nextCursor === cursor) {
       cursor = nextCursor;
       break;
@@ -229,18 +284,23 @@ export async function getAllCalls(filters?: {
   return { calls, cursor, pages, totalRecords };
 }
 
-export async function getCall(callId: string): Promise<GongCall | null> {
+export async function getCall(
+  callId: string,
+  options?: GongRequestOptions,
+): Promise<GongCall | null> {
   const body = { filter: { callIds: [callId] } };
   const data = await apiPost<{ calls?: GongCall[] }>(
     "/calls",
     body,
     `call:${callId}`,
+    options,
   );
   return data.calls?.[0] ?? null;
 }
 
 export async function getCallDetail(
   callId: string,
+  options?: GongRequestOptions,
 ): Promise<GongCallDetail | null> {
   const body = {
     filter: { callIds: [callId] },
@@ -255,6 +315,7 @@ export async function getCallDetail(
     "/calls/extensive",
     body,
     `detail:${callId}`,
+    options,
   );
   const call = data.calls?.[0];
   if (!call) return null;
@@ -279,7 +340,10 @@ export async function getCallDetail(
   };
 }
 
-export async function getCallTranscripts(callIds: string[]): Promise<unknown> {
+export async function getCallTranscripts(
+  callIds: string[],
+  options?: GongRequestOptions,
+): Promise<unknown> {
   const ids = Array.from(
     new Set(
       callIds
@@ -289,11 +353,19 @@ export async function getCallTranscripts(callIds: string[]): Promise<unknown> {
   );
   if (!ids.length) return { callTranscripts: [] };
   const body = { filter: { callIds: ids } };
-  return apiPost("/calls/transcript", body, `transcripts:${ids.join(",")}`);
+  return apiPost(
+    "/calls/transcript",
+    body,
+    `transcripts:${ids.join(",")}`,
+    options,
+  );
 }
 
-export async function getCallTranscript(callId: string): Promise<unknown> {
-  return getCallTranscripts([callId]);
+export async function getCallTranscript(
+  callId: string,
+  options?: GongRequestOptions,
+): Promise<unknown> {
+  return getCallTranscripts([callId], options);
 }
 
 export async function getEnrichedTranscript(
@@ -502,6 +574,8 @@ export interface GongCallSearchOptions {
   fromDateTime?: string;
   toDateTime?: string;
   exhaustive?: boolean;
+  signal?: AbortSignal;
+  deadlineAt?: number;
 }
 
 function normalizedSearchQueries(queries: string[]): string[] {
@@ -591,32 +665,57 @@ export async function searchCallsForQueries(
 
   const matches = new Map<string, GongCall & { matchedQueries?: string[] }>();
   let searchedCallCount = 0;
+  let scannedCallCount = 0;
   let cursor: string | undefined;
   let pages = 0;
+  const deadlineAt =
+    options.deadlineAt ?? Date.now() + MAX_GONG_EXHAUSTIVE_RUNTIME_MS;
   do {
+    if (Date.now() >= deadlineAt) {
+      throw new Error(
+        "Gong call search exceeded its 60-second runtime budget. " +
+          "Use provider-api-request with stageAs and pagination, followed by query-staged-dataset or a Data Program.",
+      );
+    }
     const data = await apiPost<{
       calls?: unknown[];
       records?: { cursor?: string; totalRecords?: number };
-    }>("/calls/extensive", {
-      filter: {
-        fromDateTime,
-        ...(options.toDateTime ? { toDateTime: options.toDateTime } : {}),
+    }>(
+      "/calls/extensive",
+      {
+        filter: {
+          fromDateTime,
+          ...(options.toDateTime ? { toDateTime: options.toDateTime } : {}),
+        },
+        contentSelector: { exposedFields: { parties: true } },
+        ...(cursor ? { cursor } : {}),
       },
-      contentSelector: { exposedFields: { parties: true } },
-      ...(cursor ? { cursor } : {}),
-    });
+      undefined,
+      {
+        signal: options.signal,
+        deadlineAt,
+      },
+    );
     pages += 1;
     if (
       options.exhaustive &&
       typeof data.records?.totalRecords === "number" &&
-      data.records.totalRecords > MAX_GONG_EXHAUSTIVE_RECORDS
+      data.records.totalRecords >= MAX_GONG_EXHAUSTIVE_RECORDS
     ) {
       throw new Error(
-        `Gong exhaustive search found ${data.records.totalRecords.toLocaleString()} records in the requested window. ` +
-          "Use provider-corpus-job with staged call IDs for searches larger than 500 records so progress is checkpointed between batches.",
+        `Gong exhaustive search found ${data.records.totalRecords.toLocaleString()} records in the requested window; ` +
+          "Use provider-corpus-job with staged call IDs for searches with 500 or more records so progress is checkpointed between batches.",
+      );
+    }
+    const rawCalls = data.calls ?? [];
+    scannedCallCount += rawCalls.length;
+    if (options.exhaustive && scannedCallCount >= MAX_GONG_EXHAUSTIVE_RECORDS) {
+      throw new Error(
+        `Gong exhaustive search reached ${MAX_GONG_EXHAUSTIVE_RECORDS.toLocaleString()} records before the cohort was safely returned. ` +
+          "Use provider-corpus-job with staged call IDs for searches with 500 or more records so progress is checkpointed between batches.",
       );
     }
-    const calls = (data.calls ?? [])
+    const calls = rawCalls
       .map(normalizeExtensiveCall)
       .filter((call): call is GongCall => Boolean(call))
       .filter(isExternalCall);

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -656,7 +656,7 @@ export function realDataFinalGuard(
   ) {
     return {
       retryMessage:
-        "The user asked a coverage-sensitive provider question, but the draft only used bounded convenience data actions. Do not finalize an exhaustive, all-records, or absence-sensitive answer from shortcut actions alone. Use the broad provider API/MCP surface and a staged analysis workflow now: provider-api-catalog/provider-api-docs when needed; for Gong, use configured tracker results from /calls/extensive when they cover the term, otherwise use provider-api-request as raw ingestion with stageAs/saveToFile followed by query-staged-dataset or a Data Program; use provider-corpus-job for durable batched raw-transcript scans. Never loop per call from run-code or a delegated agent. For more than 500 Gong records, gong-calls is not the broad-search path. If full coverage is not possible in this turn, finalize with explicit partial-coverage wording, inspected counts, filters, and remaining gaps.",
+        "The user asked a coverage-sensitive provider question, but the draft only used bounded convenience data actions. Do not finalize an exhaustive, all-records, or absence-sensitive answer from shortcut actions alone. Use the broad provider API/MCP surface and a staged analysis workflow now: provider-api-catalog/provider-api-docs when needed; for Gong, use configured tracker results from /calls/extensive when they cover the term, otherwise use provider-api-request as raw ingestion with stageAs/saveToFile followed by query-staged-dataset or a Data Program; use provider-corpus-job for durable batched raw-transcript scans. Never loop per call from run-code or a delegated agent. For 500 or more Gong records, gong-calls is not the broad-search path. If full coverage is not possible in this turn, finalize with explicit partial-coverage wording, inspected counts, filters, and remaining gaps.",
       fallbackMessage:
         "I can't make a confident coverage-sensitive provider claim from bounded shortcut actions alone. I need a provider API/corpus workflow, or I need to label the answer as partial with exact inspected counts and gaps.",
     };

package/corpus/templates/analytics/server/plugins/auth.ts

@@ -1,6 +1,10 @@
-import { createAuthPlugin } from "@agent-native/core/server";
+import {
+  createAuthPlugin,
+  isInBackgroundFunctionRuntime,
+  markDefaultPluginProvided,
+} from "@agent-native/core/server";
 
-export default createAuthPlugin({
+const authPlugin = createAuthPlugin({
   publicPaths: [
     "/track",
     "/api/analytics/track",
@@ -23,3 +27,18 @@ export default createAuthPlugin({
     ],
   },
 });
+
+export default async (nitroApp: any): Promise<void> => {
+  // Keep the custom slot marked so runtime discovery cannot mount a second
+  // default auth plugin while this worker is registering its internal routes.
+  markDefaultPluginProvided(nitroApp, "auth");
+  if (isInBackgroundFunctionRuntime()) {
+    // Background functions authenticate their signed processor routes locally;
+    // Better Auth would perform an unnecessary database initialization here.
+    console.info(
+      "[auth] Skipping Better Auth setup in durable background runtime",
+    );
+    return;
+  }
+  await authPlugin(nitroApp);
+};