@agent-native/core 0.145.4 → 0.145.6

package/dist/server/db-pressure.d.ts

@@ -0,0 +1,38 @@
+/** Counters taken in one shot from `pg_stat_activity`. */
+export interface DbPressureCounters {
+    connections: number;
+    idleInTxn: number;
+    oldestIdleTxnS: number;
+    maxSameQuery: number;
+    /** Round-trip of this statement on an already-open connection. */
+    trivialQueryMs: number;
+}
+/**
+ * Measured counters, or an explicit reason they could not be taken.
+ *
+ * A monitor must never read "not measured" as "healthy", so the two are
+ * different shapes rather than an empty warning list.
+ */
+export type DbPressure = ({
+    measured: true;
+    warnings: string[];
+} & DbPressureCounters) | {
+    measured: false;
+    reason: string;
+};
+export declare const MAX_IDLE_TXN_AGE_S = 60;
+export declare const MAX_TRIVIAL_QUERY_MS = 1000;
+export declare const MAX_SAME_QUERY_CONCURRENCY = 10;
+export declare const DB_PRESSURE_SQL = "\nSELECT\n  count(*)::int AS connections,\n  count(*) FILTER (WHERE state = 'idle in transaction')::int AS idle_in_txn,\n  coalesce(round(max(extract(epoch from (now() - state_change)))\n    FILTER (WHERE state = 'idle in transaction'))::int, 0) AS oldest_idle_txn_s,\n  coalesce((\n    SELECT max(c) FROM (\n      SELECT count(*)::int AS c FROM pg_stat_activity\n      WHERE pid <> pg_backend_pid()\n        AND state = 'active'\n        AND query <> ''\n      GROUP BY left(query, 60)\n    ) q\n  ), 0)::int AS max_same_query\nFROM pg_stat_activity\nWHERE pid <> pg_backend_pid()";
+/** Reasons this database looks pressured, or [] when it looks fine. */
+export declare function dbPressureWarnings(p: DbPressureCounters): string[];
+/**
+ * Read the pressure counters. Postgres-only: `pg_stat_activity` does not exist
+ * on SQLite/libSQL/D1, and a dialect that cannot answer reports `measured:
+ * false` rather than a clean-looking zero.
+ */
+export declare function probeDbPressure(exec: {
+    execute: (sql: string) => Promise<unknown>;
+}, dialect: string, options?: {
+    trivialQueryMs?: number;
+}): Promise<DbPressure>;

package/dist/server/db-pressure.js

@@ -0,0 +1,147 @@
+// Database pressure — the three signals that precede an outage, measured from
+// inside the app that owns the database.
+//
+// The analytics app degraded for hours on 2026-08-06 before it fell over, and
+// every check we had said UP until the moment it said DOWN. What was actually
+// true, and visible in `pg_stat_activity` the whole time:
+//
+//   - 11-20 connections stuck `idle in transaction` up to 283s, left behind by
+//     serverless workers killed mid-transaction. They hold locks; nothing
+//     reaped them.
+//   - `SELECT 1` drifting from ~0.2s to 6s as those locks accumulated.
+//   - 47-56 concurrent copies of one unprojected query, each dragging a JSON
+//     blob per row.
+//
+// None of that is "down". All of it is the hour before down. A monitor that
+// only distinguishes 200 from 500 cannot see any of it.
+//
+// This lives in core rather than in a workstation script because the numbers
+// require a database credential, and the app already has its own. Reading them
+// here means the scheduled fleet audit needs no production credentials at all.
+// `scripts/chat-health.mjs` measures the same three signals locally against
+// every app at once; `db-pressure.spec.ts` pins the two threshold sets equal.
+// Thresholds set from that outage, not intuition. Healthy analytics reads
+// 0 / 128ms / 1; at the point it went down it read 20 / 6000ms / 56.
+export const MAX_IDLE_TXN_AGE_S = 60;
+export const MAX_TRIVIAL_QUERY_MS = 1_000;
+export const MAX_SAME_QUERY_CONCURRENCY = 10;
+/**
+ * A hung probe must not hang the health route — that is the defect that took
+ * the docs site permanently cold. Short because this runs on a connection the
+ * liveness probe just proved is answering.
+ */
+const PRESSURE_PROBE_DEADLINE_MS = 3_000;
+export const DB_PRESSURE_SQL = `
+SELECT
+  count(*)::int AS connections,
+  count(*) FILTER (WHERE state = 'idle in transaction')::int AS idle_in_txn,
+  coalesce(round(max(extract(epoch from (now() - state_change)))
+    FILTER (WHERE state = 'idle in transaction'))::int, 0) AS oldest_idle_txn_s,
+  coalesce((
+    SELECT max(c) FROM (
+      SELECT count(*)::int AS c FROM pg_stat_activity
+      WHERE pid <> pg_backend_pid()
+        AND state = 'active'
+        AND query <> ''
+      GROUP BY left(query, 60)
+    ) q
+  ), 0)::int AS max_same_query
+FROM pg_stat_activity
+WHERE pid <> pg_backend_pid()`;
+/** Reasons this database looks pressured, or [] when it looks fine. */
+export function dbPressureWarnings(p) {
+    const out = [];
+    if (p.idleInTxn > 0 && p.oldestIdleTxnS > MAX_IDLE_TXN_AGE_S) {
+        out.push(`${p.idleInTxn} idle-in-transaction (oldest ${p.oldestIdleTxnS}s) — workers killed mid-transaction still holding locks`);
+    }
+    if (p.trivialQueryMs > MAX_TRIVIAL_QUERY_MS) {
+        out.push(`trivial query took ${p.trivialQueryMs}ms — the database itself is slow, not the app`);
+    }
+    if (p.maxSameQuery >= MAX_SAME_QUERY_CONCURRENCY) {
+        out.push(`${p.maxSameQuery} concurrent copies of one query — a hot path is stampeding`);
+    }
+    return out;
+}
+function readCount(row, key) {
+    const value = row[key];
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    // Some drivers hand back bigint-ish columns as strings.
+    if (typeof value === "string" && value.trim() !== "") {
+        const parsed = Number(value);
+        if (Number.isFinite(parsed))
+            return parsed;
+    }
+    return null;
+}
+/**
+ * Read the pressure counters. Postgres-only: `pg_stat_activity` does not exist
+ * on SQLite/libSQL/D1, and a dialect that cannot answer reports `measured:
+ * false` rather than a clean-looking zero.
+ */
+export async function probeDbPressure(exec, dialect, options = {}) {
+    if (dialect !== "postgres") {
+        return {
+            measured: false,
+            reason: `dialect ${dialect} has no pg_stat_activity`,
+        };
+    }
+    let timer;
+    try {
+        const trivialQueryMs = options.trivialQueryMs ?? (await measureTrivialQuery(exec));
+        const deadline = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error("pressure probe deadline")), PRESSURE_PROBE_DEADLINE_MS);
+        });
+        const result = (await Promise.race([
+            exec.execute(DB_PRESSURE_SQL),
+            deadline,
+        ]));
+        const row = result?.rows?.[0];
+        if (!row) {
+            return { measured: false, reason: "pressure query returned no rows" };
+        }
+        const counters = {
+            connections: readCount(row, "connections") ?? -1,
+            idleInTxn: readCount(row, "idle_in_txn") ?? -1,
+            oldestIdleTxnS: readCount(row, "oldest_idle_txn_s") ?? -1,
+            maxSameQuery: readCount(row, "max_same_query") ?? -1,
+            trivialQueryMs,
+        };
+        if (Object.values(counters).some((n) => n < 0)) {
+            return {
+                measured: false,
+                reason: "pressure query returned unreadable counters",
+            };
+        }
+        return {
+            measured: true,
+            ...counters,
+            warnings: dbPressureWarnings(counters),
+        };
+    }
+    catch (err) {
+        return {
+            measured: false,
+            reason: err instanceof Error ? err.message : String(err),
+        };
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function measureTrivialQuery(exec) {
+    let timer;
+    const startedAt = Date.now();
+    try {
+        const deadline = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error("trivial query deadline")), PRESSURE_PROBE_DEADLINE_MS);
+        });
+        await Promise.race([exec.execute("SELECT 1"), deadline]);
+        return Date.now() - startedAt;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}

package/dist/server/index.d.ts

@@ -37,6 +37,7 @@ export { configureAgentNativeEmbeddedEnvironment, createAgentNativeEmbeddedAuthO
 export { createThread, getThread, listThreads, updateThreadData, deleteThread, setThreadArchived, setThreadPinned, setThreadScope, type ChatThread, type ChatThreadScope, type ChatThreadSummary, type ListThreadsOptions, } from "../chat-threads/store.js";
 export { createResourcesPlugin, defaultResourcesPlugin, } from "./resources-plugin.js";
 export { createCoreRoutesPlugin, defaultCoreRoutesPlugin, FRAMEWORK_ROUTE_PREFIX, type CoreRoutesPluginOptions, } from "./core-routes-plugin.js";
+export { buildRuntimeConfigPrompt, formatRuntimeConfigReport, getRuntimeConfigReport, parseRuntimeConfigReport, runtimeConfigRequirementsFromSearchParams, type RuntimeConfigEnvironment, type RuntimeConfigIssue, type RuntimeConfigIssueCode, type RuntimeConfigIssueSeverity, type RuntimeConfigPhase, type RuntimeConfigReport, type RuntimeConfigRequirements, } from "../shared/runtime-config.js";
 export { AGENT_NATIVE_OG_IMAGE_CACHE_CONTROL, AGENT_NATIVE_OG_IMAGE_HEIGHT, AGENT_NATIVE_OG_IMAGE_NETLIFY_CACHE_CONTROL, AGENT_NATIVE_OG_IMAGE_WIDTH, agentNativeOgImageResponseHeaders, createAgentNativeOgImageHandler, renderAgentNativeOgImagePng, renderAgentNativeOgImageSvg, type AgentNativeOgImageInput, } from "./social-og-image.js";
 export { OG_FONT_FAMILY, resolveOgFontFiles } from "./og-fonts.js";
 export { createBrowserSessionActionEntries, type CreateBrowserSessionActionEntriesOptions, } from "../browser-sessions/actions.js";

package/dist/server/index.js

@@ -38,6 +38,7 @@ export { configureAgentNativeEmbeddedEnvironment, createAgentNativeEmbeddedAuthO
 export { createThread, getThread, listThreads, updateThreadData, deleteThread, setThreadArchived, setThreadPinned, setThreadScope, } from "../chat-threads/store.js";
 export { createResourcesPlugin, defaultResourcesPlugin, } from "./resources-plugin.js";
 export { createCoreRoutesPlugin, defaultCoreRoutesPlugin, FRAMEWORK_ROUTE_PREFIX, } from "./core-routes-plugin.js";
+export { buildRuntimeConfigPrompt, formatRuntimeConfigReport, getRuntimeConfigReport, parseRuntimeConfigReport, runtimeConfigRequirementsFromSearchParams, } from "../shared/runtime-config.js";
 export { AGENT_NATIVE_OG_IMAGE_CACHE_CONTROL, AGENT_NATIVE_OG_IMAGE_HEIGHT, AGENT_NATIVE_OG_IMAGE_NETLIFY_CACHE_CONTROL, AGENT_NATIVE_OG_IMAGE_WIDTH, agentNativeOgImageResponseHeaders, createAgentNativeOgImageHandler, renderAgentNativeOgImagePng, renderAgentNativeOgImageSvg, } from "./social-og-image.js";
 export { OG_FONT_FAMILY, resolveOgFontFiles } from "./og-fonts.js";
 export { createBrowserSessionActionEntries, } from "../browser-sessions/actions.js";

package/dist/server/legacy-auth-migration.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Backfill the canonical Better Auth user for a verified legacy session.
+ *
+ * Older OAuth sessions were keyed by email in the framework `sessions` table
+ * before every deployment required a Better Auth `user` row. Keep the legacy
+ * session as the authentication proof, and use Better Auth's adapter only to
+ * create the missing canonical user. Do not invent a provider account: the
+ * next provider sign-in owns that link.
+ */
+export declare function ensureCanonicalUserForLegacySession(email: string): Promise<boolean>;

package/dist/server/legacy-auth-migration.js

@@ -0,0 +1,37 @@
+import { getBetterAuthInternalAdapter } from "./better-auth-instance.js";
+/**
+ * Backfill the canonical Better Auth user for a verified legacy session.
+ *
+ * Older OAuth sessions were keyed by email in the framework `sessions` table
+ * before every deployment required a Better Auth `user` row. Keep the legacy
+ * session as the authentication proof, and use Better Auth's adapter only to
+ * create the missing canonical user. Do not invent a provider account: the
+ * next provider sign-in owns that link.
+ */
+export async function ensureCanonicalUserForLegacySession(email) {
+    const normalizedEmail = email.trim().toLowerCase();
+    if (!normalizedEmail || !normalizedEmail.includes("@"))
+        return false;
+    const adapter = await getBetterAuthInternalAdapter();
+    if (!adapter) {
+        throw new Error("Better Auth internal adapter is unavailable");
+    }
+    const findExisting = () => adapter.findUserByEmail(normalizedEmail, { includeAccounts: false });
+    if (await findExisting())
+        return false;
+    try {
+        await adapter.createUser({
+            email: normalizedEmail,
+            name: normalizedEmail.split("@")[0] || "User",
+            emailVerified: true,
+        });
+        return true;
+    }
+    catch (error) {
+        // A concurrent request may have created the same canonical user. Treat
+        // that race as success only after the adapter can read the winner.
+        if (await findExisting())
+            return false;
+        throw error;
+    }
+}

package/dist/server/onboarding-html.js

@@ -97,6 +97,12 @@ const EN_AUTH_COPY = {
     backToSignIn: "Back to sign in",
     localNotePrefix: "Your account is stored in this app's own DB",
     localNoteSuffix: ", not a third-party service.",
+    localDevButton: "Continue as local dev",
+    localDevDescription: "Only works in local development on this computer.",
+    localDevHelp: "Learn about local development sign-in",
+    localDevSigningIn: "Signing in locally…",
+    localDevFailed: "Local development sign-in is unavailable.",
+    localDevFullOptions: "Show full sign in options",
     runLocally: "Run Locally",
     runLocallySentence: "Run locally",
     openSource: "100% free and open source",
@@ -193,6 +199,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "返回登录",
         localNotePrefix: "你的账户存储在此应用自己的数据库中",
         localNoteSuffix: "，而不是第三方服务。",
+        localDevButton: "以本地开发身份继续",
+        localDevDescription: "仅在此计算机的本地开发环境中有效。",
+        localDevHelp: "了解本地开发登录",
+        localDevSigningIn: "正在本地登录…",
+        localDevFailed: "本地开发登录不可用。",
+        localDevFullOptions: "显示完整登录选项",
         runLocally: "本地运行",
         runLocallySentence: "本地运行",
         openSource: "100% 免费且开源",
@@ -287,6 +299,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "返回登入",
         localNotePrefix: "你的帳號儲存在此應用程式自己的資料庫中",
         localNoteSuffix: "，而不是第三方服務。",
+        localDevButton: "以本機開發身分繼續",
+        localDevDescription: "僅在這台電腦的本機開發環境中有效。",
+        localDevHelp: "了解本機開發登入",
+        localDevSigningIn: "正在本機登入…",
+        localDevFailed: "本機開發登入無法使用。",
+        localDevFullOptions: "顯示完整登入選項",
         runLocally: "在本機執行",
         runLocallySentence: "在本機執行",
         openSource: "100% 免費且開源",
@@ -381,6 +399,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "Volver a iniciar sesión",
         localNotePrefix: "Tu cuenta se almacena en la propia base de datos de esta app",
         localNoteSuffix: ", no en un servicio de terceros.",
+        localDevButton: "Continuar como desarrollador local",
+        localDevDescription: "Solo funciona en el desarrollo local de este equipo.",
+        localDevHelp: "Más información sobre el inicio de sesión local",
+        localDevSigningIn: "Iniciando sesión localmente…",
+        localDevFailed: "El inicio de sesión de desarrollo local no está disponible.",
+        localDevFullOptions: "Mostrar todas las opciones de inicio de sesión",
         runLocally: "Ejecutar localmente",
         runLocallySentence: "Ejecutar localmente",
         openSource: "100% gratis y de código abierto",
@@ -475,6 +499,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "Retour à la connexion",
         localNotePrefix: "Votre compte est stocké dans la base de données propre à cette app",
         localNoteSuffix: ", pas dans un service tiers.",
+        localDevButton: "Continuer comme développeur local",
+        localDevDescription: "Fonctionne uniquement en développement local sur cet ordinateur.",
+        localDevHelp: "En savoir plus sur la connexion locale",
+        localDevSigningIn: "Connexion locale…",
+        localDevFailed: "La connexion de développement local est indisponible.",
+        localDevFullOptions: "Afficher toutes les options de connexion",
         runLocally: "Exécuter localement",
         runLocallySentence: "Exécuter localement",
         openSource: "100 % gratuit et open source",
@@ -569,6 +599,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "Zurück zur Anmeldung",
         localNotePrefix: "Dein Konto wird in der eigenen Datenbank dieser App gespeichert",
         localNoteSuffix: ", nicht bei einem Drittanbieter.",
+        localDevButton: "Als lokale Entwicklung fortfahren",
+        localDevDescription: "Funktioniert nur in der lokalen Entwicklung auf diesem Computer.",
+        localDevHelp: "Mehr über die lokale Anmeldung erfahren",
+        localDevSigningIn: "Lokale Anmeldung…",
+        localDevFailed: "Die lokale Entwicklungsanmeldung ist nicht verfügbar.",
+        localDevFullOptions: "Alle Anmeldeoptionen anzeigen",
         runLocally: "Lokal ausführen",
         runLocallySentence: "Lokal ausführen",
         openSource: "100 % kostenlos und Open Source",
@@ -663,6 +699,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "サインインに戻る",
         localNotePrefix: "アカウントはこのアプリ自身の DB に保存されます",
         localNoteSuffix: "。サードパーティサービスには保存されません。",
+        localDevButton: "ローカル開発として続行",
+        localDevDescription: "このコンピューターのローカル開発でのみ利用できます。",
+        localDevHelp: "ローカル開発サインインについて詳しく見る",
+        localDevSigningIn: "ローカルでサインイン中…",
+        localDevFailed: "ローカル開発のサインインは利用できません。",
+        localDevFullOptions: "完全なサインイン オプションを表示",
         runLocally: "ローカルで実行",
         runLocallySentence: "ローカルで実行",
         openSource: "100% 無料でオープンソース",
@@ -757,6 +799,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "로그인으로 돌아가기",
         localNotePrefix: "계정은 이 앱의 자체 DB에 저장됩니다",
         localNoteSuffix: ", 타사 서비스가 아닙니다.",
+        localDevButton: "로컬 개발자로 계속",
+        localDevDescription: "이 컴퓨터의 로컬 개발 환경에서만 작동합니다.",
+        localDevHelp: "로컬 개발 로그인 자세히 보기",
+        localDevSigningIn: "로컬로 로그인하는 중…",
+        localDevFailed: "로컬 개발 로그인을 사용할 수 없습니다.",
+        localDevFullOptions: "전체 로그인 옵션 보기",
         runLocally: "로컬에서 실행",
         runLocallySentence: "로컬에서 실행",
         openSource: "100% 무료 오픈 소스",
@@ -851,6 +899,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "Voltar para entrar",
         localNotePrefix: "Sua conta fica armazenada no banco de dados próprio deste app",
         localNoteSuffix: ", não em um serviço de terceiros.",
+        localDevButton: "Continuar como desenvolvedor local",
+        localDevDescription: "Funciona apenas no desenvolvimento local deste computador.",
+        localDevHelp: "Saiba mais sobre o login de desenvolvimento local",
+        localDevSigningIn: "Entrando localmente…",
+        localDevFailed: "O login de desenvolvimento local não está disponível.",
+        localDevFullOptions: "Mostrar todas as opções de login",
         runLocally: "Executar localmente",
         runLocallySentence: "Executar localmente",
         openSource: "100% grátis e open source",
@@ -945,6 +999,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "साइन इन पर वापस जाएं",
         localNotePrefix: "आपका खाता इस ऐप के अपने DB में संग्रहीत है",
         localNoteSuffix: ", किसी third-party सेवा में नहीं।",
+        localDevButton: "स्थानीय डेवलपर के रूप में जारी रखें",
+        localDevDescription: "यह केवल इस कंप्यूटर के स्थानीय विकास में काम करता है।",
+        localDevHelp: "स्थानीय विकास साइन-इन के बारे में जानें",
+        localDevSigningIn: "स्थानीय रूप से साइन इन हो रहा है…",
+        localDevFailed: "स्थानीय विकास साइन-इन उपलब्ध नहीं है।",
+        localDevFullOptions: "साइन-इन के सभी विकल्प दिखाएं",
         runLocally: "लोकल चलाएं",
         runLocallySentence: "लोकल चलाएं",
         openSource: "100% मुफ्त और open source",
@@ -1039,6 +1099,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "العودة إلى تسجيل الدخول",
         localNotePrefix: "يتم تخزين حسابك في قاعدة بيانات هذا التطبيق",
         localNoteSuffix: "، وليس في خدمة خارجية.",
+        localDevButton: "المتابعة كمطور محلي",
+        localDevDescription: "يعمل فقط أثناء التطوير المحلي على هذا الكمبيوتر.",
+        localDevHelp: "تعرف على تسجيل دخول التطوير المحلي",
+        localDevSigningIn: "جارٍ تسجيل الدخول محليًا…",
+        localDevFailed: "تسجيل دخول التطوير المحلي غير متاح.",
+        localDevFullOptions: "عرض خيارات تسجيل الدخول الكاملة",
         runLocally: "تشغيل محليًا",
         runLocallySentence: "تشغيل محليًا",
         openSource: "مجاني ومفتوح المصدر 100%",
@@ -1380,6 +1446,16 @@ ${googleNoticeRunLocalPanelHtml}
   </div>`
         : "";
     const identitySsoHtml = identitySsoLoginButtonHtml();
+    const localDevHtml = `
+  <div class="local-dev-signin" id="local-dev-signin" hidden>
+    <button type="button" class="btn-local-dev btn-primary" id="local-dev-btn" title="${esc(t("localDevDescription"))}"${i18nAttr("localDevButton")} data-i18n-title="localDevDescription" aria-describedby="local-dev-description">${esc(t("localDevButton"))}</button>
+    <p class="local-dev-description" id="local-dev-description">
+      <span${i18nAttr("localDevDescription")}>${esc(t("localDevDescription"))}</span>
+      <a class="local-dev-help" id="local-dev-help" href="https://www.agent-native.com/docs/authentication#local-development-sign-in" target="_blank" rel="noreferrer" aria-label="${esc(t("localDevHelp"))}" title="${esc(t("localDevHelp"))}" data-i18n-title="localDevHelp"${i18nAriaAttr("localDevHelp")}><span class="local-dev-help-glyph" aria-hidden="true">?</span></a>
+    </p>
+    <button type="button" class="local-dev-full-options" id="local-dev-full-options" hidden${i18nAttr("localDevFullOptions")}>${esc(t("localDevFullOptions"))}</button>
+    <p class="msg error" id="local-dev-msg" role="status" aria-live="polite"></p>
+  </div>`;
     const identitySsoMagicLinkSelector = identitySsoHtml
         ? "  .card.magic-link-complete #identity-sso-btn,\n"
         : "";
@@ -1993,6 +2069,70 @@ ${hasMarketing
     cursor: pointer;
   }
   .btn-secondary:hover { color: #bbb; border-color: rgba(255,255,255,0.2); }
+  .local-dev-signin {
+    margin: 1.25rem 0 0.25rem;
+    padding-top: 1rem;
+    border-top: 1px solid color-mix(in srgb, currentColor 12%, transparent);
+  }
+  .btn-local-dev {
+    margin-top: 0.25rem;
+  }
+  .btn-local-dev:disabled { opacity: 0.5; cursor: wait; }
+  .local-dev-description {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.35rem;
+    margin: 0.5rem 0 0;
+    color: color-mix(in srgb, currentColor 50%, transparent);
+    font-size: 0.6875rem;
+    line-height: 1.45;
+    text-align: center;
+  }
+  .local-dev-help {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    flex: 0 0 auto;
+    width: 1.5rem;
+    height: 1.5rem;
+    margin: -0.375rem;
+    color: inherit;
+    text-decoration: none;
+  }
+  .local-dev-help-glyph {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 0.625rem;
+    height: 0.625rem;
+    border: 1px solid currentColor;
+    border-radius: 50%;
+    font-size: 0.4375rem;
+    font-weight: 600;
+    line-height: 1;
+  }
+  .local-dev-help:hover { color: currentColor; }
+  .local-dev-help:focus-visible {
+    outline: 2px solid currentColor;
+    outline-offset: 2px;
+  }
+  .local-dev-full-options {
+    display: block;
+    margin: 0.75rem auto 0;
+    padding: 0;
+    background: transparent;
+    border: 0;
+    color: color-mix(in srgb, currentColor 62%, transparent);
+    font-size: 0.75rem;
+    cursor: pointer;
+    text-decoration: underline;
+    text-underline-offset: 2px;
+  }
+  .local-dev-full-options:hover { color: currentColor; }
+  .local-dev-full-options[hidden] { display: none; }
+  .full-auth-options { margin-top: 1rem; }
+  .full-auth-options[hidden] { display: none; }
   .legal-note {
     margin-top: 0.375rem;
     margin-bottom: 0.875rem;
@@ -2393,6 +2533,8 @@ ${marketingPanelHtml}
     ${i18nDataAttr("data-upgrade-copy", "upgradeCopy").trim()}
   ></p>
 ${identitySsoHtml}
+${localDevHtml}
+<div id="full-auth-options" class="full-auth-options">
 ${renderGoogleButton
         ? `
   <div class="google-signin" id="google-signin">
@@ -2469,6 +2611,7 @@ ${signupLocalModeNoteHtml}
     </p>
   </form>`}
 </div>
+</div>
 <p class="local-note" id="local-note">
   <span${i18nAttr("localNotePrefix")}>${esc(t("localNotePrefix"))}</span> (<strong>${getConnectionLabel()}</strong>)<span${i18nAttr("localNoteSuffix")}>${esc(t("localNoteSuffix"))}</span>
 </p>${marketingCloseHtml}
@@ -2810,6 +2953,66 @@ ${signInJourneyInlineScript()}
         return false;
       });
     }
+    function __anIsLoopbackHostname() {
+      var hostname = (window.location.hostname || '').toLowerCase();
+      return hostname === 'localhost' || hostname === '::1' || hostname === '127.0.0.1' || hostname.indexOf('127.') === 0;
+    }
+    function __anShouldStartWithLocalDev() {
+      if (!__anIsLoopbackHostname()) return false;
+      var params = new URLSearchParams(window.location.search);
+      var explicitTab = params.get('tab');
+      var verifiedRedirect = typeof __anIsVerifiedRedirectSuccess === 'function' && __anIsVerifiedRedirectSuccess();
+      return explicitTab !== 'login' && explicitTab !== 'signup' && !verifiedRedirect;
+    }
+    function __anSetFullAuthOptionsVisible(visible) {
+      var options = document.getElementById('full-auth-options');
+      var toggle = document.getElementById('local-dev-full-options');
+      if (!options) return;
+      if (visible) {
+        options.removeAttribute('hidden');
+        if (toggle) toggle.setAttribute('hidden', '');
+      } else {
+        options.setAttribute('hidden', '');
+        if (toggle) toggle.removeAttribute('hidden');
+      }
+    }
+    (function __anPrepareLocalDevButton() {
+      var container = document.getElementById('local-dev-signin');
+      var button = document.getElementById('local-dev-btn');
+      var fullOptionsButton = document.getElementById('local-dev-full-options');
+      var message = document.getElementById('local-dev-msg');
+      if (!container || !button || !__anIsLoopbackHostname()) return;
+      container.hidden = false;
+      var startWithLocalDev = __anShouldStartWithLocalDev();
+      __anSetFullAuthOptionsVisible(!startWithLocalDev);
+      if (startWithLocalDev) button.focus();
+      if (fullOptionsButton) fullOptionsButton.addEventListener('click', function() {
+        __anSetFullAuthOptionsVisible(true);
+        var firstInput = document.querySelector('#full-auth-options input, #full-auth-options button, #full-auth-options a');
+        if (firstInput) firstInput.focus();
+      });
+      button.addEventListener('click', function() {
+        button.disabled = true;
+        button.textContent = __anT('localDevSigningIn');
+        fetch(__anPath('/_agent-native/auth/local-dev'), {
+          method: 'POST',
+          credentials: 'include',
+          headers: { 'Accept': 'application/json' },
+        }).then(function(response) {
+          if (!response.ok) throw new Error('local-dev-auth-failed');
+        }).then(function() {
+          __anRedirectToSignedInApp(__anResumeHref());
+        }).catch(function() {
+          button.disabled = false;
+          button.textContent = __anT('localDevButton');
+          __anSetFullAuthOptionsVisible(true);
+          if (message) {
+            message.textContent = __anT('localDevFailed');
+            message.classList.add('show');
+          }
+        });
+      });
+    })();
 ${identitySsoScript}
 	    (function __anRedirectIfAlreadySignedIn() {
 	      __anMaybeRedirectSignedIn();
@@ -3498,7 +3701,7 @@ ${googleOnly
       }
     }
     (function initActiveTab() {
-    var initial = 'signup';
+    var initial = __AN_AUTH_MODE === 'magic-link' ? 'magicLink' : 'signup';
     try {
       var params = new URLSearchParams(location.search);
       var qp = params.get('tab');
@@ -3517,7 +3720,8 @@ ${googleOnly
         if (stored === 'login' || stored === 'signup') initial = stored;
       }
     } catch (e) {}
-    setActiveTab(initial, { persist: false });
+    if (initial === 'magicLink') showMagicLinkForm();
+    else setActiveTab(initial, { persist: false });
 	      try {
 	        if (__anIsVerifiedRedirectSuccess()) {
 	          var rememberedEmail = readRememberedPendingSignupEmail();

package/dist/server/poll.d.ts

@@ -147,6 +147,7 @@ export declare class AppSyncState {
     private readonly pollEmitter;
     private syncEventsInitPromise;
     private lastDurablePrune;
+    private durablePruneFailures;
     /**
      * Whether we've seeded `version` from the DB. In serverless (Netlify,
      * Vercel, etc.) each invocation starts fresh — without seeding, `version`
@@ -212,6 +213,31 @@ export declare class AppSyncState {
      */
     wireLocalEmitters(): void;
     ensureSyncEventsTable(): Promise<boolean>;
+    /**
+     * Drop events past the retention window, in bounded batches.
+     *
+     * Three things here are load-bearing, all of them learned from a 47 GB
+     * `sync_events` table on a live app:
+     *
+     *   - Prune by `created_at`, the actual retention timestamp, with the
+     *     additive `(created_at, id)` index created above. A version can move
+     *     ahead of the clock under bursty writes, so it is not a retention
+     *     timestamp and cannot define a 24-hour boundary safely.
+     *   - Batch it. One statement deleting an unbounded slice is a long
+     *     transaction, and a long transaction killed mid-flight by a serverless
+     *     worker shutdown is what leaves connections `idle in transaction`
+     *     holding locks — the shape of the 2026-08-06 outage.
+     *   - `ORDER BY version` inside the subquery. Without it the planner
+     *     prefers a sequential scan even with a LIMIT; with it, the existing
+     *     `sync_events_version_idx` drives the batch and the delete is a
+     *     bounded index range scan.
+     *
+     * The `lastDurablePrune` throttle below is per-process, so every serverless
+     * worker prunes on its first poll. That was survivable only once the work
+     * itself became bounded and indexed; if concurrency is still a problem,
+     * the next step is a `pg_try_advisory_xact_lock` so one worker prunes at a
+     * time. Deliberately not done yet — measure before adding a lock.
+     */
     private pruneDurableEvents;
     persistSyncEvent(event: ChangeEvent, dedupeKey?: string, presetId?: string): Promise<void>;
     /**