@agent-native/core 0.145.5 → 0.145.7

package/dist/server/onboarding-html.js

@@ -97,6 +97,12 @@ const EN_AUTH_COPY = {
     backToSignIn: "Back to sign in",
     localNotePrefix: "Your account is stored in this app's own DB",
     localNoteSuffix: ", not a third-party service.",
+    localDevButton: "Continue as local dev",
+    localDevDescription: "Only works in local development on this computer.",
+    localDevHelp: "Learn about local development sign-in",
+    localDevSigningIn: "Signing in locally…",
+    localDevFailed: "Local development sign-in is unavailable.",
+    localDevFullOptions: "Show full sign in options",
     runLocally: "Run Locally",
     runLocallySentence: "Run locally",
     openSource: "100% free and open source",
@@ -193,6 +199,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "返回登录",
         localNotePrefix: "你的账户存储在此应用自己的数据库中",
         localNoteSuffix: "，而不是第三方服务。",
+        localDevButton: "以本地开发身份继续",
+        localDevDescription: "仅在此计算机的本地开发环境中有效。",
+        localDevHelp: "了解本地开发登录",
+        localDevSigningIn: "正在本地登录…",
+        localDevFailed: "本地开发登录不可用。",
+        localDevFullOptions: "显示完整登录选项",
         runLocally: "本地运行",
         runLocallySentence: "本地运行",
         openSource: "100% 免费且开源",
@@ -287,6 +299,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "返回登入",
         localNotePrefix: "你的帳號儲存在此應用程式自己的資料庫中",
         localNoteSuffix: "，而不是第三方服務。",
+        localDevButton: "以本機開發身分繼續",
+        localDevDescription: "僅在這台電腦的本機開發環境中有效。",
+        localDevHelp: "了解本機開發登入",
+        localDevSigningIn: "正在本機登入…",
+        localDevFailed: "本機開發登入無法使用。",
+        localDevFullOptions: "顯示完整登入選項",
         runLocally: "在本機執行",
         runLocallySentence: "在本機執行",
         openSource: "100% 免費且開源",
@@ -381,6 +399,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "Volver a iniciar sesión",
         localNotePrefix: "Tu cuenta se almacena en la propia base de datos de esta app",
         localNoteSuffix: ", no en un servicio de terceros.",
+        localDevButton: "Continuar como desarrollador local",
+        localDevDescription: "Solo funciona en el desarrollo local de este equipo.",
+        localDevHelp: "Más información sobre el inicio de sesión local",
+        localDevSigningIn: "Iniciando sesión localmente…",
+        localDevFailed: "El inicio de sesión de desarrollo local no está disponible.",
+        localDevFullOptions: "Mostrar todas las opciones de inicio de sesión",
         runLocally: "Ejecutar localmente",
         runLocallySentence: "Ejecutar localmente",
         openSource: "100% gratis y de código abierto",
@@ -475,6 +499,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "Retour à la connexion",
         localNotePrefix: "Votre compte est stocké dans la base de données propre à cette app",
         localNoteSuffix: ", pas dans un service tiers.",
+        localDevButton: "Continuer comme développeur local",
+        localDevDescription: "Fonctionne uniquement en développement local sur cet ordinateur.",
+        localDevHelp: "En savoir plus sur la connexion locale",
+        localDevSigningIn: "Connexion locale…",
+        localDevFailed: "La connexion de développement local est indisponible.",
+        localDevFullOptions: "Afficher toutes les options de connexion",
         runLocally: "Exécuter localement",
         runLocallySentence: "Exécuter localement",
         openSource: "100 % gratuit et open source",
@@ -569,6 +599,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "Zurück zur Anmeldung",
         localNotePrefix: "Dein Konto wird in der eigenen Datenbank dieser App gespeichert",
         localNoteSuffix: ", nicht bei einem Drittanbieter.",
+        localDevButton: "Als lokale Entwicklung fortfahren",
+        localDevDescription: "Funktioniert nur in der lokalen Entwicklung auf diesem Computer.",
+        localDevHelp: "Mehr über die lokale Anmeldung erfahren",
+        localDevSigningIn: "Lokale Anmeldung…",
+        localDevFailed: "Die lokale Entwicklungsanmeldung ist nicht verfügbar.",
+        localDevFullOptions: "Alle Anmeldeoptionen anzeigen",
         runLocally: "Lokal ausführen",
         runLocallySentence: "Lokal ausführen",
         openSource: "100 % kostenlos und Open Source",
@@ -663,6 +699,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "サインインに戻る",
         localNotePrefix: "アカウントはこのアプリ自身の DB に保存されます",
         localNoteSuffix: "。サードパーティサービスには保存されません。",
+        localDevButton: "ローカル開発として続行",
+        localDevDescription: "このコンピューターのローカル開発でのみ利用できます。",
+        localDevHelp: "ローカル開発サインインについて詳しく見る",
+        localDevSigningIn: "ローカルでサインイン中…",
+        localDevFailed: "ローカル開発のサインインは利用できません。",
+        localDevFullOptions: "完全なサインイン オプションを表示",
         runLocally: "ローカルで実行",
         runLocallySentence: "ローカルで実行",
         openSource: "100% 無料でオープンソース",
@@ -757,6 +799,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "로그인으로 돌아가기",
         localNotePrefix: "계정은 이 앱의 자체 DB에 저장됩니다",
         localNoteSuffix: ", 타사 서비스가 아닙니다.",
+        localDevButton: "로컬 개발자로 계속",
+        localDevDescription: "이 컴퓨터의 로컬 개발 환경에서만 작동합니다.",
+        localDevHelp: "로컬 개발 로그인 자세히 보기",
+        localDevSigningIn: "로컬로 로그인하는 중…",
+        localDevFailed: "로컬 개발 로그인을 사용할 수 없습니다.",
+        localDevFullOptions: "전체 로그인 옵션 보기",
         runLocally: "로컬에서 실행",
         runLocallySentence: "로컬에서 실행",
         openSource: "100% 무료 오픈 소스",
@@ -851,6 +899,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "Voltar para entrar",
         localNotePrefix: "Sua conta fica armazenada no banco de dados próprio deste app",
         localNoteSuffix: ", não em um serviço de terceiros.",
+        localDevButton: "Continuar como desenvolvedor local",
+        localDevDescription: "Funciona apenas no desenvolvimento local deste computador.",
+        localDevHelp: "Saiba mais sobre o login de desenvolvimento local",
+        localDevSigningIn: "Entrando localmente…",
+        localDevFailed: "O login de desenvolvimento local não está disponível.",
+        localDevFullOptions: "Mostrar todas as opções de login",
         runLocally: "Executar localmente",
         runLocallySentence: "Executar localmente",
         openSource: "100% grátis e open source",
@@ -945,6 +999,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "साइन इन पर वापस जाएं",
         localNotePrefix: "आपका खाता इस ऐप के अपने DB में संग्रहीत है",
         localNoteSuffix: ", किसी third-party सेवा में नहीं।",
+        localDevButton: "स्थानीय डेवलपर के रूप में जारी रखें",
+        localDevDescription: "यह केवल इस कंप्यूटर के स्थानीय विकास में काम करता है।",
+        localDevHelp: "स्थानीय विकास साइन-इन के बारे में जानें",
+        localDevSigningIn: "स्थानीय रूप से साइन इन हो रहा है…",
+        localDevFailed: "स्थानीय विकास साइन-इन उपलब्ध नहीं है।",
+        localDevFullOptions: "साइन-इन के सभी विकल्प दिखाएं",
         runLocally: "लोकल चलाएं",
         runLocallySentence: "लोकल चलाएं",
         openSource: "100% मुफ्त और open source",
@@ -1039,6 +1099,12 @@ const AUTH_LOCALE_COPY = {
         backToSignIn: "العودة إلى تسجيل الدخول",
         localNotePrefix: "يتم تخزين حسابك في قاعدة بيانات هذا التطبيق",
         localNoteSuffix: "، وليس في خدمة خارجية.",
+        localDevButton: "المتابعة كمطور محلي",
+        localDevDescription: "يعمل فقط أثناء التطوير المحلي على هذا الكمبيوتر.",
+        localDevHelp: "تعرف على تسجيل دخول التطوير المحلي",
+        localDevSigningIn: "جارٍ تسجيل الدخول محليًا…",
+        localDevFailed: "تسجيل دخول التطوير المحلي غير متاح.",
+        localDevFullOptions: "عرض خيارات تسجيل الدخول الكاملة",
         runLocally: "تشغيل محليًا",
         runLocallySentence: "تشغيل محليًا",
         openSource: "مجاني ومفتوح المصدر 100%",
@@ -1380,6 +1446,16 @@ ${googleNoticeRunLocalPanelHtml}
   </div>`
         : "";
     const identitySsoHtml = identitySsoLoginButtonHtml();
+    const localDevHtml = `
+  <div class="local-dev-signin" id="local-dev-signin" hidden>
+    <button type="button" class="btn-local-dev btn-primary" id="local-dev-btn" title="${esc(t("localDevDescription"))}"${i18nAttr("localDevButton")} data-i18n-title="localDevDescription" aria-describedby="local-dev-description">${esc(t("localDevButton"))}</button>
+    <p class="local-dev-description" id="local-dev-description">
+      <span${i18nAttr("localDevDescription")}>${esc(t("localDevDescription"))}</span>
+      <a class="local-dev-help" id="local-dev-help" href="https://www.agent-native.com/docs/authentication#local-development-sign-in" target="_blank" rel="noreferrer" aria-label="${esc(t("localDevHelp"))}" title="${esc(t("localDevHelp"))}" data-i18n-title="localDevHelp"${i18nAriaAttr("localDevHelp")}><span class="local-dev-help-glyph" aria-hidden="true">?</span></a>
+    </p>
+    <button type="button" class="local-dev-full-options" id="local-dev-full-options" hidden${i18nAttr("localDevFullOptions")}>${esc(t("localDevFullOptions"))}</button>
+    <p class="msg error" id="local-dev-msg" role="status" aria-live="polite"></p>
+  </div>`;
     const identitySsoMagicLinkSelector = identitySsoHtml
         ? "  .card.magic-link-complete #identity-sso-btn,\n"
         : "";
@@ -1993,6 +2069,70 @@ ${hasMarketing
     cursor: pointer;
   }
   .btn-secondary:hover { color: #bbb; border-color: rgba(255,255,255,0.2); }
+  .local-dev-signin {
+    margin: 1.25rem 0 0.25rem;
+    padding-top: 1rem;
+    border-top: 1px solid color-mix(in srgb, currentColor 12%, transparent);
+  }
+  .btn-local-dev {
+    margin-top: 0.25rem;
+  }
+  .btn-local-dev:disabled { opacity: 0.5; cursor: wait; }
+  .local-dev-description {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.35rem;
+    margin: 0.5rem 0 0;
+    color: color-mix(in srgb, currentColor 50%, transparent);
+    font-size: 0.6875rem;
+    line-height: 1.45;
+    text-align: center;
+  }
+  .local-dev-help {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    flex: 0 0 auto;
+    width: 1.5rem;
+    height: 1.5rem;
+    margin: -0.375rem;
+    color: inherit;
+    text-decoration: none;
+  }
+  .local-dev-help-glyph {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 0.625rem;
+    height: 0.625rem;
+    border: 1px solid currentColor;
+    border-radius: 50%;
+    font-size: 0.4375rem;
+    font-weight: 600;
+    line-height: 1;
+  }
+  .local-dev-help:hover { color: currentColor; }
+  .local-dev-help:focus-visible {
+    outline: 2px solid currentColor;
+    outline-offset: 2px;
+  }
+  .local-dev-full-options {
+    display: block;
+    margin: 0.75rem auto 0;
+    padding: 0;
+    background: transparent;
+    border: 0;
+    color: color-mix(in srgb, currentColor 62%, transparent);
+    font-size: 0.75rem;
+    cursor: pointer;
+    text-decoration: underline;
+    text-underline-offset: 2px;
+  }
+  .local-dev-full-options:hover { color: currentColor; }
+  .local-dev-full-options[hidden] { display: none; }
+  .full-auth-options { margin-top: 1rem; }
+  .full-auth-options[hidden] { display: none; }
   .legal-note {
     margin-top: 0.375rem;
     margin-bottom: 0.875rem;
@@ -2393,6 +2533,8 @@ ${marketingPanelHtml}
     ${i18nDataAttr("data-upgrade-copy", "upgradeCopy").trim()}
   ></p>
 ${identitySsoHtml}
+${localDevHtml}
+<div id="full-auth-options" class="full-auth-options">
 ${renderGoogleButton
         ? `
   <div class="google-signin" id="google-signin">
@@ -2469,6 +2611,7 @@ ${signupLocalModeNoteHtml}
     </p>
   </form>`}
 </div>
+</div>
 <p class="local-note" id="local-note">
   <span${i18nAttr("localNotePrefix")}>${esc(t("localNotePrefix"))}</span> (<strong>${getConnectionLabel()}</strong>)<span${i18nAttr("localNoteSuffix")}>${esc(t("localNoteSuffix"))}</span>
 </p>${marketingCloseHtml}
@@ -2810,6 +2953,66 @@ ${signInJourneyInlineScript()}
         return false;
       });
     }
+    function __anIsLoopbackHostname() {
+      var hostname = (window.location.hostname || '').toLowerCase();
+      return hostname === 'localhost' || hostname === '::1' || hostname === '127.0.0.1' || hostname.indexOf('127.') === 0;
+    }
+    function __anShouldStartWithLocalDev() {
+      if (!__anIsLoopbackHostname()) return false;
+      var params = new URLSearchParams(window.location.search);
+      var explicitTab = params.get('tab');
+      var verifiedRedirect = typeof __anIsVerifiedRedirectSuccess === 'function' && __anIsVerifiedRedirectSuccess();
+      return explicitTab !== 'login' && explicitTab !== 'signup' && !verifiedRedirect;
+    }
+    function __anSetFullAuthOptionsVisible(visible) {
+      var options = document.getElementById('full-auth-options');
+      var toggle = document.getElementById('local-dev-full-options');
+      if (!options) return;
+      if (visible) {
+        options.removeAttribute('hidden');
+        if (toggle) toggle.setAttribute('hidden', '');
+      } else {
+        options.setAttribute('hidden', '');
+        if (toggle) toggle.removeAttribute('hidden');
+      }
+    }
+    (function __anPrepareLocalDevButton() {
+      var container = document.getElementById('local-dev-signin');
+      var button = document.getElementById('local-dev-btn');
+      var fullOptionsButton = document.getElementById('local-dev-full-options');
+      var message = document.getElementById('local-dev-msg');
+      if (!container || !button || !__anIsLoopbackHostname()) return;
+      container.hidden = false;
+      var startWithLocalDev = __anShouldStartWithLocalDev();
+      __anSetFullAuthOptionsVisible(!startWithLocalDev);
+      if (startWithLocalDev) button.focus();
+      if (fullOptionsButton) fullOptionsButton.addEventListener('click', function() {
+        __anSetFullAuthOptionsVisible(true);
+        var firstInput = document.querySelector('#full-auth-options input, #full-auth-options button, #full-auth-options a');
+        if (firstInput) firstInput.focus();
+      });
+      button.addEventListener('click', function() {
+        button.disabled = true;
+        button.textContent = __anT('localDevSigningIn');
+        fetch(__anPath('/_agent-native/auth/local-dev'), {
+          method: 'POST',
+          credentials: 'include',
+          headers: { 'Accept': 'application/json' },
+        }).then(function(response) {
+          if (!response.ok) throw new Error('local-dev-auth-failed');
+        }).then(function() {
+          __anRedirectToSignedInApp(__anResumeHref());
+        }).catch(function() {
+          button.disabled = false;
+          button.textContent = __anT('localDevButton');
+          __anSetFullAuthOptionsVisible(true);
+          if (message) {
+            message.textContent = __anT('localDevFailed');
+            message.classList.add('show');
+          }
+        });
+      });
+    })();
 ${identitySsoScript}
 	    (function __anRedirectIfAlreadySignedIn() {
 	      __anMaybeRedirectSignedIn();
@@ -3498,7 +3701,7 @@ ${googleOnly
       }
     }
     (function initActiveTab() {
-    var initial = 'signup';
+    var initial = __AN_AUTH_MODE === 'magic-link' ? 'magicLink' : 'signup';
     try {
       var params = new URLSearchParams(location.search);
       var qp = params.get('tab');
@@ -3517,7 +3720,8 @@ ${googleOnly
         if (stored === 'login' || stored === 'signup') initial = stored;
       }
     } catch (e) {}
-    setActiveTab(initial, { persist: false });
+    if (initial === 'magicLink') showMagicLinkForm();
+    else setActiveTab(initial, { persist: false });
 	      try {
 	        if (__anIsVerifiedRedirectSuccess()) {
 	          var rememberedEmail = readRememberedPendingSignupEmail();

package/dist/server/poll.d.ts

@@ -147,6 +147,7 @@ export declare class AppSyncState {
     private readonly pollEmitter;
     private syncEventsInitPromise;
     private lastDurablePrune;
+    private durablePruneFailures;
     /**
      * Whether we've seeded `version` from the DB. In serverless (Netlify,
      * Vercel, etc.) each invocation starts fresh — without seeding, `version`
@@ -212,6 +213,31 @@ export declare class AppSyncState {
      */
     wireLocalEmitters(): void;
     ensureSyncEventsTable(): Promise<boolean>;
+    /**
+     * Drop events past the retention window, in bounded batches.
+     *
+     * Three things here are load-bearing, all of them learned from a 47 GB
+     * `sync_events` table on a live app:
+     *
+     *   - Prune by `created_at`, the actual retention timestamp, with the
+     *     additive `(created_at, id)` index created above. A version can move
+     *     ahead of the clock under bursty writes, so it is not a retention
+     *     timestamp and cannot define a 24-hour boundary safely.
+     *   - Batch it. One statement deleting an unbounded slice is a long
+     *     transaction, and a long transaction killed mid-flight by a serverless
+     *     worker shutdown is what leaves connections `idle in transaction`
+     *     holding locks — the shape of the 2026-08-06 outage.
+     *   - `ORDER BY version` inside the subquery. Without it the planner
+     *     prefers a sequential scan even with a LIMIT; with it, the existing
+     *     `sync_events_version_idx` drives the batch and the delete is a
+     *     bounded index range scan.
+     *
+     * The `lastDurablePrune` throttle below is per-process, so every serverless
+     * worker prunes on its first poll. That was survivable only once the work
+     * itself became bounded and indexed; if concurrency is still a problem,
+     * the next step is a `pg_try_advisory_xact_lock` so one worker prunes at a
+     * time. Deliberately not done yet — measure before adding a lock.
+     */
     private pruneDurableEvents;
     persistSyncEvent(event: ChangeEvent, dedupeKey?: string, presetId?: string): Promise<void>;
     /**

package/dist/server/poll.js

@@ -25,7 +25,7 @@ import { defineEventHandler, getQuery, setResponseStatus } from "h3";
 import { ACTION_CHANGE_MARKER_KEY, parseActionChangeMarker, } from "../action-change-marker.js";
 import { getAppStateEmitter } from "../application-state/emitter.js";
 import { getDbExec, isPostgres } from "../db/client.js";
-import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
+import { ensureIndexExists, ensureIndexExistsConcurrently, ensureTableExists, } from "../db/ddl-guard.js";
 import { EXTENSION_CHANGE_MARKER_KEY, parseExtensionChangeMarker, } from "../extensions/change-marker.js";
 import { getSettingsEmitter } from "../settings/store.js";
 import { getSession } from "./auth.js";
@@ -34,6 +34,21 @@ import { getSession } from "./auth.js";
 const MAX_BUFFER = 200;
 const DURABLE_READ_LIMIT = 1000;
 const DURABLE_RETENTION_MS = 24 * 60 * 60 * 1000;
+/**
+ * Rows per prune statement, and the ceiling on statements per prune call.
+ * The product (400k) leaves headroom over one app's documented production of
+ * ~1k events/sec over the five-minute throttle, so a healthy app catches up;
+ * the cap still bounds how long a single call can run.
+ */
+const DURABLE_PRUNE_BATCH = 10_000;
+const DURABLE_PRUNE_MAX_BATCHES = 40;
+/**
+ * How far back a cold-started process replays durable action markers.
+ * Covers the gap between a separate action process writing its marker and this
+ * process's first poll — seconds in practice. Anything older is history, and
+ * replaying history is what produced 1,169 sync events/sec on one app.
+ */
+const ACTION_MARKER_REPLAY_WINDOW_MS = 60_000;
 const LEGACY_DB_CHECK_INTERVAL_MS = 1000;
 export const DURABLE_LEGACY_DB_CHECK_INTERVAL_MS = 30_000;
 export const POLL_CHANGE_EVENT = "poll-change";
@@ -243,6 +258,7 @@ export class AppSyncState {
     pollEmitter = new EventEmitter();
     syncEventsInitPromise;
     lastDurablePrune = 0;
+    durablePruneFailures = 0;
     /**
      * Whether we've seeded `version` from the DB. In serverless (Netlify,
      * Vercel, etc.) each invocation starts fresh — without seeding, `version`
@@ -388,6 +404,7 @@ export class AppSyncState {
                     await ensureIndexExists("sync_events_version_idx", "CREATE INDEX IF NOT EXISTS sync_events_version_idx ON sync_events (version)", guardOptions);
                     await ensureIndexExists("sync_events_owner_version_idx", "CREATE INDEX IF NOT EXISTS sync_events_owner_version_idx ON sync_events (owner, version)", guardOptions);
                     await ensureIndexExists("sync_events_org_version_idx", "CREATE INDEX IF NOT EXISTS sync_events_org_version_idx ON sync_events (org_id, version)", guardOptions);
+                    await ensureIndexExistsConcurrently("sync_events_created_at_id_idx", "CREATE INDEX CONCURRENTLY IF NOT EXISTS sync_events_created_at_id_idx ON sync_events (created_at, id)", guardOptions);
                     if (this.dbAssignedVersions) {
                         await ensureTableExists("sync_version", "CREATE TABLE IF NOT EXISTS sync_version (id INT PRIMARY KEY, v BIGINT NOT NULL)", guardOptions);
                         // Seed at/above both the existing durable max and wall clock, so
@@ -401,6 +418,7 @@ export class AppSyncState {
                     "CREATE INDEX IF NOT EXISTS sync_events_version_idx ON sync_events (version)",
                     "CREATE INDEX IF NOT EXISTS sync_events_owner_version_idx ON sync_events (owner, version)",
                     "CREATE INDEX IF NOT EXISTS sync_events_org_version_idx ON sync_events (org_id, version)",
+                    "CREATE INDEX IF NOT EXISTS sync_events_created_at_id_idx ON sync_events (created_at, id)",
                 ]) {
                     try {
                         await client.execute(ddl);
@@ -417,17 +435,66 @@ export class AppSyncState {
         }
         return this.syncEventsInitPromise;
     }
+    /**
+     * Drop events past the retention window, in bounded batches.
+     *
+     * Three things here are load-bearing, all of them learned from a 47 GB
+     * `sync_events` table on a live app:
+     *
+     *   - Prune by `created_at`, the actual retention timestamp, with the
+     *     additive `(created_at, id)` index created above. A version can move
+     *     ahead of the clock under bursty writes, so it is not a retention
+     *     timestamp and cannot define a 24-hour boundary safely.
+     *   - Batch it. One statement deleting an unbounded slice is a long
+     *     transaction, and a long transaction killed mid-flight by a serverless
+     *     worker shutdown is what leaves connections `idle in transaction`
+     *     holding locks — the shape of the 2026-08-06 outage.
+     *   - `ORDER BY version` inside the subquery. Without it the planner
+     *     prefers a sequential scan even with a LIMIT; with it, the existing
+     *     `sync_events_version_idx` drives the batch and the delete is a
+     *     bounded index range scan.
+     *
+     * The `lastDurablePrune` throttle below is per-process, so every serverless
+     * worker prunes on its first poll. That was survivable only once the work
+     * itself became bounded and indexed; if concurrency is still a problem,
+     * the next step is a `pg_try_advisory_xact_lock` so one worker prunes at a
+     * time. Deliberately not done yet — measure before adding a lock.
+     */
     async pruneDurableEvents(client) {
         const now = Date.now();
         if (now - this.lastDurablePrune < 5 * 60 * 1000)
             return;
         this.lastDurablePrune = now;
-        await client
-            .execute({
-            sql: "DELETE FROM sync_events WHERE created_at < ?",
-            args: [now - DURABLE_RETENTION_MS],
-        })
-            .catch(() => { });
+        const cutoff = now - DURABLE_RETENTION_MS;
+        let deleted = 0;
+        try {
+            for (let batch = 0; batch < DURABLE_PRUNE_MAX_BATCHES; batch++) {
+                const result = await client.execute({
+                    // `id IN (...)` rather than ctid/rowid: both are dialect-specific,
+                    // and the primary key is indexed on every dialect we ship.
+                    sql: `DELETE FROM sync_events WHERE id IN (
+                  SELECT id FROM sync_events WHERE created_at < ?
+                  ORDER BY created_at, id LIMIT ?
+                )`,
+                    args: [cutoff, DURABLE_PRUNE_BATCH],
+                });
+                deleted += result.rowsAffected;
+                if (result.rowsAffected < DURABLE_PRUNE_BATCH)
+                    break;
+            }
+            this.durablePruneFailures = 0;
+        }
+        catch (err) {
+            // This used to be `.catch(() => {})`. A prune that silently never
+            // succeeded is indistinguishable from one that had nothing to do, which
+            // is how the table reached 47 GB without anyone finding out. Warn once
+            // per failure streak so a persistently broken prune is visible without
+            // repeating every five minutes.
+            this.durablePruneFailures++;
+            if (this.durablePruneFailures === 1) {
+                console.warn(`[agent-native] sync_events prune failed after deleting ${deleted} row(s); the table will grow until this succeeds:`, err instanceof Error ? err.message : String(err));
+            }
+        }
     }
     async persistSyncEvent(event, dedupeKey, presetId) {
         if (!(await this.ensureSyncEventsTable()))
@@ -1025,7 +1092,17 @@ export class AppSyncState {
             // Action markers are durable specifically so a web server can observe work
             // performed by a separate action process. Do not baseline past an existing
             // marker on cold start, or the first poll after the action will miss it.
-            this.lastActionMarkerTs = 0;
+            //
+            // Bounded to a replay window rather than rewound to 0. At 0 the filter
+            // below (`updated_at > lastActionMarkerTs`) passes EVERY row, and the
+            // marker table is one never-pruned row per identity that has ever run a
+            // mutating action — so every cold start re-emitted the entire history.
+            // On one production app that was 2,188 rows replayed ~32 times a minute:
+            // 1,169 sync events/sec, none of it real traffic, against ~1.7/sec that
+            // was. A `> 0` first-run guard like the sibling detectors use would be
+            // wrong here — it would discard the cross-process wakeup this rewind
+            // exists for. Bounding the window keeps that and drops the history.
+            this.lastActionMarkerTs = Math.max(0, actionMarkerTs - ACTION_MARKER_REPLAY_WINDOW_MS);
             this.replayActionMarkerOnce = actionMarkerTs > 0;
             this.lastScreenRefreshTs = refreshTs;
             this.lastScreenRefreshTsBySession.clear();
@@ -1151,14 +1228,25 @@ export class AppSyncState {
             // serverless action invocations wake the web server's SSE/poll loop as a
             // first-class source:"action" event rather than a generic app-state bump.
             if (actionMarkerTs > this.lastActionMarkerTs) {
+                // Bounded by the same watermark the filter below applies, so a cold
+                // start reads its replay window instead of every marker ever written.
                 const actionMarkerResult = await db.execute({
-                    sql: "SELECT session_id, value, updated_at FROM application_state WHERE key = ? ORDER BY updated_at ASC",
-                    args: [ACTION_CHANGE_MARKER_KEY],
+                    sql: "SELECT session_id, value, updated_at FROM application_state WHERE key = ? AND updated_at > ? ORDER BY updated_at ASC",
+                    args: [ACTION_CHANGE_MARKER_KEY, this.lastActionMarkerTs],
                 });
                 const changedActionMarkers = actionMarkerResult.rows.filter((row) => timestampValue(row.updated_at) > this.lastActionMarkerTs);
-                this.recordActionChanges(changedActionMarkers
-                    .map((row) => parseActionChangeMarker(row.session_id, row.value))
-                    .filter((target) => !!target), `action|${actionMarkerTs}`);
+                for (const row of changedActionMarkers) {
+                    const target = parseActionChangeMarker(row.session_id, row.value);
+                    if (!target)
+                        continue;
+                    // Keyed on the ROW's own timestamp, not the table-wide max: every
+                    // process replaying the same marker must produce the same id so
+                    // `ON CONFLICT (id) DO NOTHING` collapses them. Keyed on the max,
+                    // two processes booting a moment apart hash the same row
+                    // differently and each writes its own copy. Matches the extension
+                    // marker path.
+                    this.recordActionChanges([target], `action|${timestampValue(row.updated_at)}`);
+                }
                 this.lastActionMarkerTs = actionMarkerTs;
             }
             // Check for screen-refresh requests from the agent. The `refresh-screen`
@@ -1290,6 +1378,13 @@ export function getDefaultAppSyncState() {
     if (!_defaultState) {
         _defaultState = new AppSyncState({
             dbAssignedVersions: hostedRealtimeTransportEnabled(),
+            // Only the out-of-band detectors (action markers, extensions, app-state)
+            // pass a dedupeKey, so this changes nothing for ordinary writes — they
+            // keep unique ids. It exists so N processes detecting the SAME external
+            // write collapse to one row via `ON CONFLICT (id) DO NOTHING`. Left off,
+            // it never once executed in production: every dedupeKey threaded through
+            // this file was inert, and each cold start wrote its own duplicate set.
+            deterministicEventIds: true,
         });
     }
     return _defaultState;

package/dist/server/ssr-handler.js

@@ -18,7 +18,7 @@ import { defineEventHandler } from "h3";
  */
 import { createRequestHandler } from "react-router";
 import { isMcpPublicPath } from "../mcp/route-paths.js";
-import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, } from "../shared/cache-control.js";
+import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, } from "../shared/cache-control.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
 import { getAppBasePathFromViteEnv, stripAppBasePath as canonicalStripAppBasePath, } from "./app-base-path.js";
 import { captureError } from "./capture-error.js";
@@ -225,6 +225,9 @@ function applyDefaultSsrCacheHeader(headers, status, pathname) {
     for (const [name, value] of Object.entries(resolveSsrCacheHeaders())) {
         headers.set(name, value);
     }
+    for (const [name, value] of Object.entries(resolveSsrCacheKeyHeaders())) {
+        headers.set(name, value);
+    }
 }
 function applyDefaultSpeculationRulesHeader(headers, status, basePath) {
     if (status < 200 || status >= 400)

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;

package/dist/shared/index.d.ts

@@ -5,6 +5,7 @@ export { SIGN_IN_CONTINUATION_MAX_LENGTH, SIGN_IN_CONTINUATION_PARAM, SIGN_IN_EN
 export { truncate } from "./truncate.js";
 export { injectDocumentMarkup } from "./html-document.js";
 export { withBuilderUtmTrackingParams } from "./builder-link-tracking.js";
+export { buildRuntimeConfigPrompt, formatRuntimeConfigReport, getRuntimeConfigReport, parseRuntimeConfigReport, runtimeConfigRequirementsFromSearchParams, type RuntimeConfigEnvironment, type RuntimeConfigIssue, type RuntimeConfigIssueCode, type RuntimeConfigIssueSeverity, type RuntimeConfigPhase, type RuntimeConfigReport, type RuntimeConfigRequirements, } from "./runtime-config.js";
 export { llmConnectionTrackingProperties, normalizeLlmConnection, type LlmConnectionStatus, } from "./llm-connection.js";
 export { DISPATCH_WORKSPACE_ROOT_REDIRECTS, RESERVED_WORKSPACE_APP_IDS, assertValidWorkspaceAppId, getWorkspaceAppIdValidationError, isValidWorkspaceAppIdFormat, } from "./workspace-app-id.js";
 export { DEFAULT_WORKSPACE_APP_AUDIENCE, WORKSPACE_APP_AUDIENCES, normalizeWorkspaceAppAudience, normalizeWorkspaceAppPathList, workspaceAppAudienceFromEnv, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromEnv, workspaceAppRouteAccessFromPackageJson, type WorkspaceAppRouteAccess, type WorkspaceAppRouteAccessFromConfig, type WorkspaceAppAudience, } from "./workspace-app-audience.js";

package/dist/shared/index.js

@@ -5,6 +5,7 @@ export { SIGN_IN_CONTINUATION_MAX_LENGTH, SIGN_IN_CONTINUATION_PARAM, SIGN_IN_EN
 export { truncate } from "./truncate.js";
 export { injectDocumentMarkup } from "./html-document.js";
 export { withBuilderUtmTrackingParams } from "./builder-link-tracking.js";
+export { buildRuntimeConfigPrompt, formatRuntimeConfigReport, getRuntimeConfigReport, parseRuntimeConfigReport, runtimeConfigRequirementsFromSearchParams, } from "./runtime-config.js";
 export { llmConnectionTrackingProperties, normalizeLlmConnection, } from "./llm-connection.js";
 export { DISPATCH_WORKSPACE_ROOT_REDIRECTS, RESERVED_WORKSPACE_APP_IDS, assertValidWorkspaceAppId, getWorkspaceAppIdValidationError, isValidWorkspaceAppIdFormat, } from "./workspace-app-id.js";
 export { DEFAULT_WORKSPACE_APP_AUDIENCE, WORKSPACE_APP_AUDIENCES, normalizeWorkspaceAppAudience, normalizeWorkspaceAppPathList, workspaceAppAudienceFromEnv, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromEnv, workspaceAppRouteAccessFromPackageJson, } from "./workspace-app-audience.js";

package/dist/shared/runtime-config.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Production configuration diagnostics.
+ *
+ * This module deliberately accepts an env-like record instead of reading
+ * process.env so the same rules can run during a Vite build, on the server,
+ * and in focused tests without ever exposing secret values to the browser.
+ */
+export type RuntimeConfigEnvironment = "development" | "production";
+export type RuntimeConfigPhase = "build" | "runtime";
+export type RuntimeConfigIssueSeverity = "warning" | "error";
+export type RuntimeConfigIssueCode = "auth-disabled-in-production" | "missing-auth-secret" | "weak-auth-secret" | "missing-a2a-secret" | "weak-a2a-secret" | "invalid-auth-url" | "missing-database-url" | "local-database-in-production" | "missing-required-env";
+export interface RuntimeConfigRequirements {
+    /** Whether the app's default or custom auth layer is expected to run. */
+    authEnabled?: boolean;
+    /** Whether the app needs a persistent database outside local development. */
+    databaseRequired?: boolean;
+    /** Additional non-secret keys the app declares as required. */
+    requiredEnv?: readonly string[];
+}
+export interface RuntimeConfigIssue {
+    code: RuntimeConfigIssueCode;
+    severity: RuntimeConfigIssueSeverity;
+    title: string;
+    message: string;
+    envKeys: string[];
+}
+export interface RuntimeConfigReport {
+    ok: boolean;
+    status: "ok" | "warning" | "error";
+    environment: RuntimeConfigEnvironment;
+    phase: RuntimeConfigPhase;
+    issues: RuntimeConfigIssue[];
+    prompt: string;
+}
+export interface RuntimeConfigReportOptions {
+    environment?: RuntimeConfigEnvironment;
+    phase?: RuntimeConfigPhase;
+    appName?: string;
+}
+export declare function runtimeConfigRequirementsFromSearchParams(searchParams: URLSearchParams): RuntimeConfigRequirements;
+export declare function buildRuntimeConfigPrompt(report: Pick<RuntimeConfigReport, "environment" | "phase" | "issues">, appName?: string): string;
+export declare function getRuntimeConfigReport(env: Record<string, string | undefined>, requirements?: RuntimeConfigRequirements, options?: RuntimeConfigReportOptions): RuntimeConfigReport;
+export declare function formatRuntimeConfigReport(report: RuntimeConfigReport): string;
+export declare function parseRuntimeConfigReport(value: unknown): RuntimeConfigReport | null;