@agent-native/core 0.141.6 → 0.144.0

package/dist/server/auth.js

@@ -48,11 +48,13 @@ import { readBody } from "../server/h3-helpers.js";
 import { putSetting } from "../settings/store.js";
 import { resolveSsrCacheHeaders } from "../shared/cache-control.js";
 import { extractOAuthStateAppId } from "../shared/oauth-state.js";
-import { SIGN_IN_CONTINUATION_PARAM, SIGN_IN_LEGACY_RETURN_PARAM, normalizeAppPath, signInJourney, } from "../shared/sign-in-journey.js";
+import { PASSWORD_MIN_LENGTH, PASSWORD_MIN_LENGTH_MESSAGE, } from "../shared/password-policy.js";
+import { SIGN_IN_CONTINUATION_PARAM, SIGN_IN_ENTRY_PATH, SIGN_IN_LEGACY_ENTRY_PATH, SIGN_IN_LEGACY_RETURN_PARAM, decodeContinuation, normalizeAppPath, signInJourney, } from "../shared/sign-in-journey.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
 import { normalizeWorkspaceAppAudience, workspaceAppAudienceFromEnv, workspaceAppRouteAccessFromEnv, } from "../shared/workspace-app-audience.js";
 import { isValidWorkspaceAppIdFormat } from "../shared/workspace-app-id.js";
 import { injectAnalyticsIntoHtml } from "./analytics.js";
+import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getAuthLoginMode } from "./auth-login-mode.js";
 import { ensureGoogleAuthIdentity, getBetterAuth, getBetterAuthSync, } from "./better-auth-instance.js";
@@ -792,6 +794,35 @@ function getRequestHost(event) {
         getHeader(event, "host") ??
         undefined);
 }
+function parseRequestUrl(rawUrl) {
+    if (!rawUrl)
+        return null;
+    try {
+        return new URL(rawUrl, "http://an.invalid");
+    }
+    catch {
+        // coercion-ok: an invalid request URL has no query context to classify.
+        return null;
+    }
+}
+function hasInitialPromptQuery(rawUrl) {
+    return !!parseRequestUrl(rawUrl)?.searchParams.get("initialPrompt")?.trim();
+}
+function requestHasInitialPrompt(event) {
+    const rawUrl = event.node?.req?.url ?? event.path ?? "/";
+    if (hasInitialPromptQuery(rawUrl))
+        return true;
+    const requestUrl = parseRequestUrl(rawUrl);
+    if (!requestUrl)
+        return false;
+    const continuation = requestUrl.searchParams.get(SIGN_IN_CONTINUATION_PARAM);
+    if (continuation &&
+        hasInitialPromptQuery(decodeContinuation(continuation, getConfiguredAppBasePath()) ?? undefined)) {
+        return true;
+    }
+    const legacyReturn = requestUrl.searchParams.get(SIGN_IN_LEGACY_RETURN_PARAM);
+    return legacyReturn ? hasInitialPromptQuery(legacyReturn) : false;
+}
 function getOnboardingHtmlOptions(options, event, rawPath, authMode) {
     return {
         authMode,
@@ -803,6 +834,7 @@ function getOnboardingHtmlOptions(options, event, rawPath, authMode) {
         requestHost: event ? getRequestHost(event) : undefined,
         requestPath: rawPath,
         requestOrigin: event ? getOrigin(event) : undefined,
+        initialPrompt: event ? requestHasInitialPrompt(event) : false,
     };
 }
 function getAuthOnboardingHtml(options, event, rawPath, authMode) {
@@ -1391,11 +1423,12 @@ function createAuthGuardFn() {
             return;
         }
         // Force-sign-in entrypoint. Templates send viewers from public pages
-        // (share links, embeds) here with a `?return=<path>` query. The cached
-        // login document validates that return path in the browser and redirects
-        // there after sign-in or when its client-side session check finds an
-        // existing session.
-        if (p === "/_agent-native/sign-in") {
+        // (share links, embeds) here with a `?return=<path>` query. The clean
+        // `/sign-in` path is canonical; keep the old framework path as a
+        // compatibility alias. The cached login document validates that return
+        // path in the browser and redirects there after sign-in or when its
+        // client-side session check finds an existing session.
+        if (p === SIGN_IN_ENTRY_PATH || p === SIGN_IN_LEGACY_ENTRY_PATH) {
             // Preserve the zero-setup localhost experience without putting a
             // session lookup back on the cacheable app-shell URL. The client gate
             // reaches this explicit entrypoint after discovering there is no
@@ -1403,7 +1436,8 @@ function createAuthGuardFn() {
             if (getMethod(event) === "GET") {
                 const query = new URLSearchParams(queryStart >= 0 ? url.slice(queryStart + 1) : "");
                 // `?return=` is read as a fallback FOREVER. Generated apps in the wild
-                // hand-write `/_agent-native/sign-in?return=…` and cannot be upgraded;
+                // hand-write the legacy `/_agent-native/sign-in?return=…` path and
+                // cannot be upgraded;
                 // dropping the fallback would send them all to "/" — a UX quirk no
                 // test would catch. New producers emit `c`; only NEW `?return=`
                 // producers are forbidden, never this consumer.
@@ -1451,12 +1485,12 @@ function createAuthGuardFn() {
             return;
         if (p === "/_agent-native/speculation-rules.json")
             return;
-        // Liveness probe: always public so uptime monitors and the keep-warm cron
-        // can reach the DB-warmup route without a session. It exposes no per-user
-        // data (just ok/db/ms) and runs a trivial `SELECT 1`. Without this bypass
-        // the gate below 401s anonymous /_agent-native/* requests before any DB
-        // query, so the database would never get warmed.
-        if (p === "/_agent-native/health")
+        // Liveness probes: always public so uptime monitors and the keep-warm cron
+        // can reach them without a session. Ping exposes only a static message;
+        // health exposes only aggregate readiness and a trivial `SELECT 1`.
+        // Without this bypass the gate below 401s anonymous /_agent-native/*
+        // requests before either probe can run.
+        if (p === "/_agent-native/ping" || p === "/_agent-native/health")
             return;
         if (getMethod(event) === "GET" && p.startsWith("/_agent-native/avatar/")) {
             return;
@@ -2803,9 +2837,11 @@ async function mountBetterAuthRoutes(app, options) {
             setResponseStatus(event, 400);
             return { error: VALID_AUTH_EMAIL_MESSAGE };
         }
-        if (!password || typeof password !== "string" || password.length < 8) {
+        if (!password ||
+            typeof password !== "string" ||
+            password.length < PASSWORD_MIN_LENGTH) {
             setResponseStatus(event, 400);
-            return { error: "Password must be at least 8 characters" };
+            return { error: PASSWORD_MIN_LENGTH_MESSAGE };
         }
         if (await isGoogleSignInRequiredForEmail(email)) {
             setResponseStatus(event, 403);
@@ -3047,9 +3083,11 @@ function mountAuthFallbackRoutes(app) {
             setResponseStatus(event, 400);
             return { error: VALID_AUTH_EMAIL_MESSAGE };
         }
-        if (!password || typeof password !== "string" || password.length < 8) {
+        if (!password ||
+            typeof password !== "string" ||
+            password.length < PASSWORD_MIN_LENGTH) {
             setResponseStatus(event, 400);
-            return { error: "Password must be at least 8 characters" };
+            return { error: PASSWORD_MIN_LENGTH_MESSAGE };
         }
         if (await isGoogleSignInRequiredForEmail(email)) {
             setResponseStatus(event, 403);

package/dist/server/better-auth-instance.js

@@ -16,13 +16,14 @@ import { pgTable, text as pgText, timestamp as pgTimestamp, boolean as pgBoolean
 import { sqliteTable, text as sqliteText, integer as sqliteInteger, } from "drizzle-orm/sqlite-core";
 import { TEMPLATES } from "../cli/templates-meta.js";
 import { getDbExec, isPostgres } from "../db/client.js";
-import { getDialect, getDatabaseUrl, getDatabaseAuthToken, closePgliteClients, getPgliteClient, isPgliteUrl, loadPgliteDrizzle, pgPoolOptions, neonPoolMax, attachNeonPoolErrorLogger, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, } from "../db/client.js";
+import { getDialect, getDatabaseUrl, getDatabaseAuthToken, closePgliteClients, getPgliteClient, isPgliteUrl, loadPgliteDrizzle, pgPoolOptions, neonPoolOptions, attachNeonPoolErrorLogger, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, } from "../db/client.js";
 import { ensureTableExists } from "../db/ddl-guard.js";
 import { CORE_RESET_PASSWORD_EMAIL_ID, CORE_VERIFY_SIGNUP_EMAIL_ID, } from "../email-catalog/system-emails.js";
 import { saveOAuthTokens } from "../oauth-tokens/store.js";
 import { acceptPendingInvitationsForEmail } from "../org/accept-pending.js";
 import { getAuthEmailForUserId, getRequiredAuthProviderForEmail, } from "../org/auth-policy.js";
 import { autoJoinDomainMatchingOrgs } from "../org/auto-join-domain.js";
+import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, } from "../shared/password-policy.js";
 import { flushTracking, identify, track } from "../tracking/index.js";
 import { getAppProductionUrl } from "./app-url.js";
 import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
@@ -903,7 +904,8 @@ async function createBetterAuthInstance(config) {
         emailAndPassword: {
             enabled: true,
             disableSignUp,
-            minPasswordLength: 8,
+            minPasswordLength: PASSWORD_MIN_LENGTH,
+            maxPasswordLength: PASSWORD_MAX_LENGTH,
             // Hosted deployments always require a working email provider before
             // password signup can create a session. Local dev/test retain the fast
             // path; hosted deployments without a provider disable password signup.
@@ -1195,7 +1197,7 @@ async function buildDatabaseConfig(dialect) {
             // un-capped pool here is a primary contributor to "Max client
             // connections reached" across concurrent serverless instances.
             resetAuthOnPoolClose("neon", url);
-            _neonAuthPool = sharedDbPool("neon", url, () => new Pool({ connectionString: url, max: neonPoolMax() }));
+            _neonAuthPool = sharedDbPool("neon", url, () => new Pool({ connectionString: url, ...neonPoolOptions() }));
             attachNeonPoolErrorLogger(_neonAuthPool, "db/neon-auth");
             const { drizzle } = await import("drizzle-orm/neon-serverless");
             const db = drizzle(buildResilientNeonPool(_neonAuthPool), {

package/dist/server/core-routes-plugin.d.ts

@@ -62,7 +62,6 @@ export declare function resolveAgentEngineStatus<E extends AgentEngineStatusEntr
 export declare function shareAgentEngineStatusLookup(identityKey: string, compute: () => Promise<AgentEngineStatusResult>): Promise<AgentEngineStatusResult>;
 export declare function agentEngineStatusIdentityKey(userEmail: string | undefined, orgId: string | undefined): string;
 export declare function getFrameworkEnvKeys(): EnvKeyConfig[];
-/** Result of the `/_agent-native/health` liveness + DB-warmup probe. */
 export interface DbHealthProbeResult {
     /** The serverless function is live and served the request. */
     ok: true;
@@ -70,6 +69,14 @@ export interface DbHealthProbeResult {
     ready: boolean;
     /** A trivial `SELECT 1` reached the database (false = no DB or unreachable). */
     db: boolean;
+    /**
+     * The probe hit its deadline instead of answering. Reported SEPARATELY from
+     * `db: false`, because "the database said no" and "the database never
+     * replied" are different failures and folding them together is exactly the
+     * coercion this repo bans — a monitor cannot tell an app with no database
+     * from one whose database is hanging.
+     */
+    dbTimedOut?: boolean;
     /** Round-trip time of the probe in milliseconds. */
     ms: number;
     /** Redacted database routing details useful for deploy/runtime checks. */

package/dist/server/core-routes-plugin.js

@@ -242,6 +242,13 @@ export function getFrameworkEnvKeys() {
         })),
     ];
 }
+/** Result of the `/_agent-native/health` liveness + DB-warmup probe. */
+/**
+ * Deliberately generous: a genuinely cold Neon compute can take seconds to
+ * accept its first connection, and reporting a slow-but-working database as
+ * timed out would flap. This is a ceiling on hanging, not a latency budget.
+ */
+const DB_HEALTH_PROBE_DEADLINE_MS = 5_000;
 /**
  * Run a trivial `SELECT 1` to confirm the database is reachable and, as a side
  * effect, keep a scale-to-zero serverless database (e.g. Neon) warm. Touching
@@ -257,12 +264,29 @@ export async function runDbHealthProbe(exec = getDbExec, options = {}) {
     let db = false;
     let schema;
     const dbExec = exec();
+    let dbTimedOut = false;
     try {
-        await dbExec.execute("SELECT 1");
-        db = true;
+        // An UNBOUNDED await here is what took the docs site down: the health route
+        // hung for 20-40s until the CDN returned 502, the keep-warm cron failed
+        // every minute, and the function stayed permanently cold — a ~10x penalty
+        // on every cache miss. This function's own contract says "Always
+        // resolves"; without a deadline it did not.
+        let timer;
+        const deadline = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error("db probe deadline")), DB_HEALTH_PROBE_DEADLINE_MS);
+        });
+        try {
+            await Promise.race([dbExec.execute("SELECT 1"), deadline]);
+            db = true;
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
     }
-    catch {
+    catch (err) {
         // Live even when the DB is unreachable or the app has no database.
+        dbTimedOut = err?.message === "db probe deadline";
     }
     if (db && options.schema) {
         schema = await runDatabaseSchemaHealthCheck({
@@ -274,6 +298,7 @@ export async function runDbHealthProbe(exec = getDbExec, options = {}) {
         ok: true,
         ready: db && (!schema || schema.ok),
         db,
+        ...(dbTimedOut ? { dbTimedOut: true } : {}),
         ms: Date.now() - startedAt,
         database: {
             configured: database.configured,

package/dist/server/credential-provider.d.ts

@@ -308,9 +308,9 @@ export declare function deleteBuilderCredentials(email: string, options?: {
 export declare function prefetchSecrets(keys: readonly string[]): Promise<void>;
 /**
  * Resolve a request-scoped secret. Reads from `app_secrets` first (current
- * user override, active org, workspace row for that org, then the solo
- * workspace row); falls back to `process.env` only when the deploy fallback
- * policy allows it.
+ * user override, active org, workspace row for that org, the solo workspace
+ * row, then the explicitly designated workspace vault organization); falls
+ * back to `process.env` only when the deploy fallback policy allows it.
  *
  * Resolving several keys in one request? Call `prefetchSecrets` first.
  */

package/dist/server/credential-provider.js

@@ -19,8 +19,56 @@
  */
 import { createHash } from "node:crypto";
 import { CREDENTIAL_STORE_UNAVAILABLE_ERROR_CODE } from "../agent/engine/credential-errors.js";
-import { isLocalDatabase, isTransientDatabaseError } from "../db/client.js";
+import { getDbExec, isLocalDatabase, isTransientDatabaseError, } from "../db/client.js";
+import { getOrgSetting } from "../settings/org-settings.js";
 import { getRequestUserEmail, getRequestOrgId } from "./request-context.js";
+const DISPATCH_VAULT_ACCESS_SETTINGS_KEY = "dispatch-vault-access-settings";
+/**
+ * The designated vault fallback is an all-apps compatibility path. Manual
+ * mode must use the per-app sync path instead, or a known key name would be
+ * enough to read the whole vault from an ungranted workspace app.
+ */
+async function canReadDesignatedVaultFallback(vaultOrgId, credentialKey) {
+    const access = await getOrgSetting(vaultOrgId, DISPATCH_VAULT_ACCESS_SETTINGS_KEY);
+    if (access?.mode !== "manual")
+        return { status: "allowed" };
+    // Manual mode is still usable across a Dispatch vault org and a separate
+    // app org, but only for this app's explicit active grant. The app identity
+    // comes from deployment configuration, never from request input.
+    const appId = [
+        process.env.AGENT_NATIVE_WORKSPACE_APP_ID,
+        process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID,
+        process.env.AGENT_NATIVE_APP_ID,
+        process.env.APP_NAME,
+    ]
+        .find((value) => value?.trim())
+        ?.trim();
+    if (!appId) {
+        return { status: "denied", reason: "missing-app-id" };
+    }
+    try {
+        const result = await getDbExec().execute({
+            sql: `SELECT 1
+        FROM vault_grants AS grants
+        INNER JOIN vault_secrets AS secrets ON secrets.id = grants.secret_id
+        WHERE grants.org_id = ?
+          AND grants.app_id = ?
+          AND grants.status = 'active'
+          AND secrets.org_id = grants.org_id
+          AND secrets.credential_key = ?
+        LIMIT 1`,
+            args: [vaultOrgId, appId, credentialKey],
+        });
+        return result.rows.length > 0
+            ? { status: "allowed" }
+            : { status: "denied", reason: "no-active-grant" };
+    }
+    catch (cause) {
+        // A missing/unreadable grant table must fail closed. The app can still
+        // resolve a locally scoped credential or retry after the store recovers.
+        return { status: "unavailable", cause };
+    }
+}
 /**
  * Decide which `app_secrets` scope a Builder/credential write should use.
  *
@@ -998,9 +1046,9 @@ export async function prefetchSecrets(keys) {
 }
 /**
  * Resolve a request-scoped secret. Reads from `app_secrets` first (current
- * user override, active org, workspace row for that org, then the solo
- * workspace row); falls back to `process.env` only when the deploy fallback
- * policy allows it.
+ * user override, active org, workspace row for that org, the solo workspace
+ * row, then the explicitly designated workspace vault organization); falls
+ * back to `process.env` only when the deploy fallback policy allows it.
  *
  * Resolving several keys in one request? Call `prefetchSecrets` first.
  */
@@ -1100,6 +1148,44 @@ export async function resolveSecretDetailed(key) {
                 }
                 return { value: soloWorkspaceSecret.value, lookupFailed: false };
             }
+            // Dispatch's workspace vault is stored under the organization that
+            // performed the sync. AGENT_VAULT_ORG_ID is an explicit single-workspace
+            // deployment assertion; without it, never guess which other tenant owns
+            // a shared key. This fallback keeps workspace apps from requiring every
+            // builder to copy a vault key into app-local settings.
+            const vaultOrgId = process.env.AGENT_VAULT_ORG_ID?.trim();
+            if (vaultOrgId && vaultOrgId !== orgId) {
+                const designatedVaultAccess = await canReadDesignatedVaultFallback(vaultOrgId, key);
+                if (designatedVaultAccess.status === "unavailable") {
+                    lookupFailed = true;
+                    cause = designatedVaultAccess.cause;
+                }
+                if (designatedVaultAccess.status === "allowed") {
+                    const [vaultOrgRead, vaultWorkspaceRead] = await Promise.allSettled([
+                        readAppSecret({ key, scope: "org", scopeId: vaultOrgId }),
+                        readAppSecret({ key, scope: "workspace", scopeId: vaultOrgId }),
+                    ]);
+                    const unwrap = (settled) => {
+                        if (settled.status === "rejected")
+                            throw settled.reason;
+                        return settled.value;
+                    };
+                    const vaultOrgSecret = unwrap(vaultOrgRead);
+                    if (vaultOrgSecret?.value) {
+                        if (traceLookup) {
+                            console.log(`[resolve-secret] key=${key} email=${email} vaultOrgId=${vaultOrgId} scope=org-vault hit=true`);
+                        }
+                        return { value: vaultOrgSecret.value, lookupFailed: false };
+                    }
+                    const vaultWorkspaceSecret = unwrap(vaultWorkspaceRead);
+                    if (vaultWorkspaceSecret?.value) {
+                        if (traceLookup) {
+                            console.log(`[resolve-secret] key=${key} email=${email} vaultOrgId=${vaultOrgId} scope=workspace-vault hit=true`);
+                        }
+                        return { value: vaultWorkspaceSecret.value, lookupFailed: false };
+                    }
+                }
+            }
         }
         catch (err) {
             if (traceLookup) {

package/dist/server/identity-sso.js

@@ -45,6 +45,7 @@ import { createHash } from "node:crypto";
 import { getMethod } from "h3";
 import * as jose from "jose";
 import { GOOGLE_AUTH_REQUIRED_MESSAGE, isGoogleSignInRequiredForEmail, } from "../org/auth-policy.js";
+import { SIGN_IN_ENTRY_PATH } from "../shared/sign-in-journey.js";
 import { getAppName } from "./app-name.js";
 import { getSession, safeReturnPath, isExpectedAuthFailure } from "./auth.js";
 import { getBetterAuth, getBetterAuthInternalAdapter, } from "./better-auth-instance.js";
@@ -310,7 +311,7 @@ export async function handleIdentitySso(event, subpath) {
     const method = getMethod(event);
     const sub = ("/" + subpath.replace(/^\/+/, "").replace(/\/+$/, "")).replace(/^\/$/, "");
     const origin = getOrigin(event);
-    const loginPath = "/_agent-native/sign-in";
+    const loginPath = SIGN_IN_ENTRY_PATH;
     // ---- GET /login → 302 to the hub authorize endpoint ------------------
     if (sub === "/login") {
         if (method !== "GET" && method !== "HEAD") {

package/dist/server/onboarding-html.d.ts

@@ -25,6 +25,8 @@ export interface OnboardingHtmlOptions {
     googleOnly?: boolean;
     /** Authentication surface to render. Defaults to the existing password flow. */
     authMode?: "magic-link" | "password";
+    /** Render the quiet, centered auth surface used when the app has an initial prompt. */
+    initialPrompt?: boolean;
     /**
      * Product marketing content shown alongside the sign-in form.
      * When provided, the page uses a split layout: marketing on the left,