@agent-native/core 0.146.0 → 0.146.1

package/dist/deploy/build.js

@@ -23,7 +23,7 @@ import { INTEGRATION_RECOVERY_RUNTIME_MARKER, INTEGRATION_RETRY_SWEEP_PATH, INTE
 import { isValidCron } from "../jobs/cron.js";
 import { RECURRING_JOBS_SWEEP_PATH, RECURRING_JOBS_SWEEP_TOKEN_SUBJECT, } from "../jobs/scheduler-dispatch.js";
 import { normalizeAppBasePath } from "../server/app-base-path.js";
-import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, } from "../shared/cache-control.js";
+import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, } from "../shared/cache-control.js";
 import { mcpEmbedStaticAssetRouteRules } from "../shared/mcp-embed-headers.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, } from "../shared/social-meta.js";
 import { generateActionRegistryForProject } from "../vite/action-types-plugin.js";
@@ -652,6 +652,7 @@ export function generateWorkerEntry(routes, pluginPaths, defaultPluginStems = []
     // The worker ships as a static bundle with no access to runtime env, so the
     // deployment-wide SSR cache policy is baked in from this build's env.
     const ssrCacheHeaders = resolveSsrCacheHeaders();
+    const ssrCacheKeyHeaders = resolveSsrCacheKeyHeaders();
     const routeImports = [];
     const routeRegistrations = [];
     for (let i = 0; i < routes.length; i++) {
@@ -971,9 +972,8 @@ function injectHeadScript(html, script) {
 }
 
 // Resolved from AGENT_NATIVE_SSR_CACHE at build time.
-const SSR_CACHE_CONTROL = ${JSON.stringify(ssrCacheHeaders["cache-control"])};
-const SSR_CDN_CACHE_CONTROL = ${JSON.stringify(ssrCacheHeaders["cdn-cache-control"])};
-const SSR_NETLIFY_CDN_CACHE_CONTROL = ${JSON.stringify(ssrCacheHeaders["netlify-cdn-cache-control"])};
+const SSR_CACHE_HEADERS = ${JSON.stringify(ssrCacheHeaders)};
+const SSR_CACHE_KEY_HEADERS = ${JSON.stringify(ssrCacheKeyHeaders)};
 const DEFAULT_SPECULATION_RULES_PATH = ${JSON.stringify(DEFAULT_SPECULATION_RULES_PATH)};
 const IMMUTABLE_ASSET_CACHE_CONTROL = ${JSON.stringify(IMMUTABLE_ASSET_CACHE_CONTROL)};
 const IMMUTABLE_ASSET_PATHS = new Set(${JSON.stringify([...new Set(immutableAssetPaths)].sort())});
@@ -1057,13 +1057,12 @@ function applyDefaultSsrCacheHeader(headers, status, pathname) {
     else headers.delete("vary");
   }
 
-  headers.set("cache-control", SSR_CACHE_CONTROL);
-  headers.set("cdn-cache-control", SSR_CDN_CACHE_CONTROL);
-  // Netlify function responses are dynamic by default and can otherwise show
-  // Cache-Status fwd=bypass even with Cache-Control: public. Keep this
-  // Netlify-specific header so SSR HTML/.data are served from the shared
-  // durable CDN cache instead of stampeding origin — for every visitor.
-  headers.set("netlify-cdn-cache-control", SSR_NETLIFY_CDN_CACHE_CONTROL);
+  for (const [name, value] of Object.entries(SSR_CACHE_HEADERS)) {
+    headers.set(name, value);
+  }
+  for (const [name, value] of Object.entries(SSR_CACHE_KEY_HEADERS)) {
+    headers.set(name, value);
+  }
 }
 
 function applyDefaultSpeculationRulesHeader(headers, status, basePath) {
@@ -3464,6 +3463,22 @@ function createBrowserOnlyServerStubPlugin() {
         },
     };
 }
+export function resolveNitroBuildReplacements(env = process.env) {
+    return {
+        // Netlify exposes DEPLOY_ID only while building. Embed it into the Nitro
+        // function so preview OAuth relays can target this immutable deployment
+        // even though the value is unavailable in the function runtime.
+        "process.env.AGENT_NATIVE_BUILD_ID": JSON.stringify(env.DEPLOY_ID?.trim() || env.AGENT_NATIVE_BUILD_ID?.trim() || ""),
+        "process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID": JSON.stringify(env.GA_MEASUREMENT_ID?.trim() || ""),
+        "process.env.AGENT_NATIVE_BUILD_GTM_CONTAINER_ID": JSON.stringify(env.GTM_CONTAINER_ID?.trim() || ""),
+        // Netlify's netlify.toml environment is available while this deploy
+        // build runs, but is not injected into the deployed Function. Nitro is
+        // a separate server build, so embed release migration ownership here as
+        // well as in the Vite server bundle.
+        "process.env.AGENT_NATIVE_RELEASE_MIGRATIONS": JSON.stringify(env.AGENT_NATIVE_RELEASE_MIGRATIONS?.trim() || ""),
+        "process.env.AGENT_NATIVE_BUILD_DEPLOY_CONTEXT": JSON.stringify(env.CONTEXT?.trim() || ""),
+    };
+}
 async function buildWithNitro() {
     console.log(`[deploy] Building for preset "${preset}" via Nitro...`);
     const appBasePath = normalizeConfiguredAppBasePath();
@@ -3547,17 +3562,7 @@ export default bundle;
         virtual: {
             "virtual:agents-bundle": agentsBundleModuleSource,
         },
-        replace: {
-            // Netlify exposes DEPLOY_ID only while building. Embed it into the Nitro
-            // function so preview OAuth relays can target this immutable deployment
-            // even though the value is unavailable in the function runtime.
-            "process.env.AGENT_NATIVE_BUILD_ID": JSON.stringify(process.env.DEPLOY_ID?.trim() ||
-                process.env.AGENT_NATIVE_BUILD_ID?.trim() ||
-                ""),
-            "process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID": JSON.stringify(process.env.GA_MEASUREMENT_ID?.trim() || ""),
-            "process.env.AGENT_NATIVE_BUILD_GTM_CONTAINER_ID": JSON.stringify(process.env.GTM_CONTAINER_ID?.trim() || ""),
-            "process.env.AGENT_NATIVE_BUILD_DEPLOY_CONTEXT": JSON.stringify(process.env.CONTEXT?.trim() || ""),
-        },
+        replace: resolveNitroBuildReplacements(),
         // Replace browser-only renderers (Excalidraw/Mermaid) with an inert proxy in
         // the server bundle. Without this, Nitro's Rolldown build pulls the real
         // Excalidraw into a shared vendor chunk imported statically by the SSR render

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
+    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
 }>;
 export default _default;

package/dist/notifications/routes.d.ts

@@ -28,6 +28,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -62,6 +62,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/builder-browser.d.ts

@@ -328,6 +328,40 @@ export interface RunBuilderAgentResult {
     url: string;
     status: string;
 }
+export interface BuilderProjectLookupArgs {
+    repoUrl: string;
+}
+export interface BuilderProjectResult {
+    projectId: string;
+    name: string;
+    repoUrl: string;
+    browserUrl: string;
+    created: boolean;
+}
+/**
+ * Find an existing Builder project connected to a repository. Dispatch uses
+ * this before provisioning so a first app request cannot create a duplicate
+ * workspace project when the project id has not been saved yet.
+ */
+export declare function findBuilderProjectForRepo(args: BuilderProjectLookupArgs): Promise<BuilderProjectResult | null>;
+/**
+ * Create a Builder project connected to a repository through the public
+ * projects API. This is the server-side bridge used by Dispatch; online
+ * Claude and ChatGPT hosts do not need a separate Builder CMS MCP connector.
+ */
+export declare function createBuilderProject(args: {
+    name: string;
+    repoUrl: string;
+}): Promise<BuilderProjectResult>;
+/**
+ * Reuse a connected Builder project or create it once when Dispatch is first
+ * used for a workspace. The lookup and create calls intentionally stay in
+ * this shared server helper so all callers use the same authenticated path.
+ */
+export declare function ensureBuilderProject(args: {
+    name: string;
+    repoUrl: string;
+}): Promise<BuilderProjectResult>;
 /**
  * POST a prompt to the Builder agents-run API. The Builder agent runs in a
  * cloud sandbox and writes code to a branch; the returned URL opens that

package/dist/server/builder-browser.js

@@ -1283,6 +1283,185 @@ function normalizeBuilderApiString(value, fieldName) {
     }
     return trimmed;
 }
+function normalizeBuilderProjectString(value, fieldName) {
+    if (typeof value !== "string" || !value.trim()) {
+        throw new Error(`Builder project response returned a blank ${fieldName}`);
+    }
+    const trimmed = value.trim();
+    if (/[\u0000-\u001f\u007f]/.test(trimmed)) {
+        throw new Error(`Builder project response returned a malformed ${fieldName}`);
+    }
+    return trimmed;
+}
+function normalizeBuilderRepoUrl(value) {
+    const trimmed = value.trim();
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        throw new Error("Builder project repository URL is malformed");
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new Error("Builder project repository URL must use HTTP or HTTPS");
+    }
+    return trimmed;
+}
+function comparableBuilderRepoUrl(value) {
+    try {
+        const parsed = new URL(value);
+        const pathname = parsed.pathname.replace(/\/+$/, "").replace(/\.git$/, "");
+        return `${parsed.hostname.toLowerCase()}${pathname.toLowerCase()}`;
+    }
+    catch {
+        return value
+            .trim()
+            .replace(/\/+$/, "")
+            .replace(/\.git$/, "")
+            .toLowerCase();
+    }
+}
+function builderProjectBrowserUrl(projectId) {
+    return `${getBuilderAppHost().replace(/\/$/, "")}/app/projects/${encodeURIComponent(projectId)}`;
+}
+function builderProjectFromRecord(value, fallbackRepoUrl, created) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    const projectId = typeof record.id === "string" && record.id.trim() ? record.id.trim() : null;
+    if (!projectId)
+        return null;
+    const name = typeof record.name === "string" && record.name.trim()
+        ? record.name.trim()
+        : "Agent-Native Workspace";
+    const repoUrl = typeof record.repoUrl === "string" && record.repoUrl.trim()
+        ? record.repoUrl.trim()
+        : fallbackRepoUrl;
+    if (!repoUrl)
+        return null;
+    return {
+        projectId: normalizeBuilderProjectString(projectId, "project id"),
+        name: normalizeBuilderProjectString(name, "project name"),
+        repoUrl: normalizeBuilderRepoUrl(repoUrl),
+        browserUrl: builderProjectBrowserUrl(projectId),
+        created,
+    };
+}
+async function resolveBuilderApiCredentials() {
+    const { resolveBuilderCredentials } = await import("./credential-provider.js");
+    const creds = await resolveBuilderCredentials();
+    if (!creds.privateKey || !creds.publicKey) {
+        throw new Error("Builder keys are not configured");
+    }
+    return {
+        ...creds,
+        privateKey: creds.privateKey,
+        publicKey: creds.publicKey,
+    };
+}
+async function readBuilderApiObject(response, operation) {
+    let parsed;
+    try {
+        parsed = await response.json();
+    }
+    catch (error) {
+        throw new Error("Builder " +
+            operation +
+            " returned an invalid JSON response (" +
+            response.status +
+            ")", { cause: error });
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("Builder " +
+            operation +
+            " returned an invalid JSON response (" +
+            response.status +
+            ")");
+    }
+    return parsed;
+}
+function builderApiErrorMessage(parsed, fallback) {
+    if (typeof parsed.error === "string" && parsed.error.trim()) {
+        return parsed.error.trim();
+    }
+    if (typeof parsed.message === "string" && parsed.message.trim()) {
+        return parsed.message.trim();
+    }
+    return fallback;
+}
+/**
+ * Find an existing Builder project connected to a repository. Dispatch uses
+ * this before provisioning so a first app request cannot create a duplicate
+ * workspace project when the project id has not been saved yet.
+ */
+export async function findBuilderProjectForRepo(args) {
+    const repoUrl = normalizeBuilderRepoUrl(args.repoUrl);
+    const creds = await resolveBuilderApiCredentials();
+    const url = new URL("/projects", getBuilderApiHost());
+    url.searchParams.set("apiKey", creds.publicKey);
+    url.searchParams.set("includeHidden", "true");
+    const response = await fetch(url, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${creds.privateKey}` },
+    });
+    const parsed = await readBuilderApiObject(response, "project lookup");
+    if (!response.ok) {
+        throw new Error(builderApiErrorMessage(parsed, `Builder project lookup failed (${response.status})`));
+    }
+    if (!Array.isArray(parsed.projects)) {
+        throw new Error("Builder project lookup returned no projects list");
+    }
+    const comparableRepoUrl = comparableBuilderRepoUrl(repoUrl);
+    for (const project of parsed.projects) {
+        const normalized = builderProjectFromRecord(project, null, false);
+        if (normalized &&
+            comparableBuilderRepoUrl(normalized.repoUrl) === comparableRepoUrl) {
+            return normalized;
+        }
+    }
+    return null;
+}
+/**
+ * Create a Builder project connected to a repository through the public
+ * projects API. This is the server-side bridge used by Dispatch; online
+ * Claude and ChatGPT hosts do not need a separate Builder CMS MCP connector.
+ */
+export async function createBuilderProject(args) {
+    const name = normalizeBuilderProjectString(args.name, "project name");
+    const repoUrl = normalizeBuilderRepoUrl(args.repoUrl);
+    const creds = await resolveBuilderApiCredentials();
+    const url = new URL("/projects/create", getBuilderApiHost());
+    url.searchParams.set("apiKey", creds.publicKey);
+    const response = await fetch(url, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${creds.privateKey}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            source: { kind: "repo", repoUrl },
+            name,
+        }),
+    });
+    const parsed = await readBuilderApiObject(response, "project creation");
+    if (!response.ok) {
+        throw new Error(builderApiErrorMessage(parsed, `Builder project creation failed (${response.status})`));
+    }
+    const project = builderProjectFromRecord(parsed.project, repoUrl, true);
+    if (!project) {
+        throw new Error("Builder project creation returned no project id");
+    }
+    return project;
+}
+/**
+ * Reuse a connected Builder project or create it once when Dispatch is first
+ * used for a workspace. The lookup and create calls intentionally stay in
+ * this shared server helper so all callers use the same authenticated path.
+ */
+export async function ensureBuilderProject(args) {
+    const existing = await findBuilderProjectForRepo({ repoUrl: args.repoUrl });
+    return existing ?? createBuilderProject(args);
+}
 function normalizeBuilderBranchUrl(value) {
     const urlString = normalizeBuilderApiString(value, "url");
     let parsed;

package/dist/server/core-routes-plugin.d.ts

@@ -288,6 +288,11 @@ interface LegacyCoreRouteInitSettings {
 }
 type CoreRouteSettingReader = (key: string) => Promise<Record<string, unknown> | null>;
 export declare function readLegacyCoreRouteInitSettings(readSetting?: CoreRouteSettingReader): Promise<LegacyCoreRouteInitSettings>;
+/**
+ * Production release jobs own schema setup. Request functions must not spend
+ * their cold-start budget on legacy cleanup or best-effort table warmups.
+ */
+export declare function shouldRunCoreRouteBootDatabaseWork(env?: NodeJS.ProcessEnv): boolean;
 export declare function createCoreRoutesPlugin(options?: CoreRoutesPluginOptions): NitroPluginDef;
 /**
  * Default core routes plugin — mount with no configuration needed.

package/dist/server/core-routes-plugin.js

@@ -8,7 +8,7 @@ import { canUpdateAgentLoopSettings, readAgentLoopSettings, resetAgentLoopSettin
 import { getState, putState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, getStateMany, } from "../application-state/handlers.js";
 import { mountBrowserSessionRoutes } from "../browser-sessions/routes.js";
 import { mountDbAdminRoutes } from "../db-admin/routes.js";
-import { getDbExec } from "../db/client.js";
+import { getDbExec, isProductionServerlessFunctionRuntime, } from "../db/client.js";
 import { getDatabaseRuntimeFingerprint, getRuntimeDebugFingerprint, runDatabaseSchemaHealthCheck, } from "../db/runtime-diagnostics.js";
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import { uploadFile, getActiveFileUploadProviderForRequest, listFileUploadProviders, } from "../file-upload/index.js";
@@ -814,6 +814,13 @@ export async function readLegacyCoreRouteInitSettings(readSetting = getSetting)
         builderDisconnected: builderDisconnected,
     };
 }
+/**
+ * Production release jobs own schema setup. Request functions must not spend
+ * their cold-start budget on legacy cleanup or best-effort table warmups.
+ */
+export function shouldRunCoreRouteBootDatabaseWork(env = process.env) {
+    return !isProductionServerlessFunctionRuntime(env);
+}
 /**
  * Creates a Nitro plugin that mounts all standard agent-native framework routes.
  *
@@ -913,7 +920,10 @@ export function createCoreRoutesPlugin(options = {}) {
                 return EMPTY_SPECULATION_RULES;
             }));
             await awaitBootstrap(nitroApp);
-            const { persistedEnvVars, builderDisconnected } = await readLegacyCoreRouteInitSettings();
+            const runBootDatabaseWork = shouldRunCoreRouteBootDatabaseWork();
+            const { persistedEnvVars, builderDisconnected } = runBootDatabaseWork
+                ? await readLegacyCoreRouteInitSettings()
+                : { persistedEnvVars: null, builderDisconnected: null };
             // Legacy cleanup: key saves now go to scoped app_secrets rows. Do not
             // rehydrate the old deployment-global `persisted-env-vars` row into
             // process.env; keep only the Builder scrub so stale leaked keys self-heal.
@@ -996,7 +1006,8 @@ export function createCoreRoutesPlugin(options = {}) {
             try {
                 const { createObservabilityHandler } = await import("../observability/routes.js");
                 const { ensureObservabilityTables } = await import("../observability/store.js");
-                ensureObservabilityTables().catch(() => { });
+                if (runBootDatabaseWork)
+                    ensureObservabilityTables().catch(() => { });
                 getH3App(nitroApp).use(`${FRAMEWORK_ROUTE_PREFIX}/observability`, createObservabilityHandler());
             }
             catch {
@@ -1009,8 +1020,10 @@ export function createCoreRoutesPlugin(options = {}) {
             try {
                 const { ensureAuditTables } = await import("../audit/store.js");
                 const { startAuditCleanupJob } = await import("../audit/cleanup-job.js");
-                ensureAuditTables().catch(() => { });
-                startAuditCleanupJob();
+                if (runBootDatabaseWork) {
+                    ensureAuditTables().catch(() => { });
+                    startAuditCleanupJob();
+                }
             }
             catch {
                 // Audit module not available — skip
@@ -2880,7 +2893,8 @@ export function createCoreRoutesPlugin(options = {}) {
             try {
                 const { ensureExtensionsTables, registerExtensionsShareable } = await import("../extensions/store.js");
                 const { createExtensionsHandler } = await import("../extensions/routes.js");
-                ensureExtensionsTables().catch(() => { });
+                if (runBootDatabaseWork)
+                    ensureExtensionsTables().catch(() => { });
                 registerExtensionsShareable();
                 const extensionsHandler = createExtensionsHandler({
                     extensionTools: options.extensionTools,
@@ -2893,7 +2907,8 @@ export function createCoreRoutesPlugin(options = {}) {
                 // Extension-point slots — sub-system of extensions.
                 const { ensureSlotTables } = await import("../extensions/slots/store.js");
                 const { createSlotsHandler } = await import("../extensions/slots/routes.js");
-                ensureSlotTables().catch(() => { });
+                if (runBootDatabaseWork)
+                    ensureSlotTables().catch(() => { });
                 getH3App(nitroApp).use(`${P}/slots`, createSlotsHandler());
             }
             catch {
@@ -2902,7 +2917,8 @@ export function createCoreRoutesPlugin(options = {}) {
             // ─── Data programs (stored server-side JS scripts + run cache) ─────
             try {
                 const { ensureDataProgramTables, registerDataProgramsShareable } = await import("../data-programs/store.js");
-                ensureDataProgramTables().catch(() => { });
+                if (runBootDatabaseWork)
+                    ensureDataProgramTables().catch(() => { });
                 registerDataProgramsShareable();
             }
             catch {

package/dist/server/index.d.ts

@@ -70,7 +70,7 @@ export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAut
 export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, type GenericWorkspaceOAuthProvider, type WorkspaceProviderOAuthFlow, } from "./workspace-provider-oauth.js";
 export { FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, type BuilderCredentialsDetailed, } from "./credential-provider.js";
 export { builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, createBuilderDesignSystemProxyFields, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, type BuildBuilderDesignSystemIndexFilesOptions, type BuilderDesignSystemCodeFileInput, type BuilderDesignSystemDecodeJobStatus, type BuilderDesignSystemDocsOptions, type BuilderDesignSystemDocument, type BuilderDesignSystemHydratedReference, type BuilderDesignSystemIndexFile, type BuilderDesignSystemIndexFromSourcesOptions, type BuilderDesignSystemIndexOptions, type BuilderDesignSystemIndexResult, type BuilderDesignSystemUploadAttachment, type BuilderDesignSystemUploadSlot, type BuilderDesignSystemProxyFields, type BuilderDesignSystemProxyFieldsOptions, type BuilderDesignSystemProxyReference, type BuilderDesignSystemSourceKind, } from "./builder-design-systems.js";
-export { getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, type RunBuilderAgentResult, } from "./builder-browser.js";
+export { createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, type BuilderProjectResult, type RunBuilderAgentResult, } from "./builder-browser.js";
 export { ensureFusionContainer, sendFusionBranchMessage, pushFusionBranch, reserveFusionHostingSlug, deployFusionProject, getFusionDeploys, getFusionBranchEditorUrl, getFusionHostingUrl, type FusionBranchRef, type EnsureFusionContainerResult, type SendFusionMessageResult, } from "./fusion-app.js";
 export { sendEmail, isEmailConfigured, getEmailReadiness, getEmailProvider, type EmailAttachment, type EmailReadiness, type EmailProvider, type SendEmailArgs, } from "./email.js";
 export { defineTransactionalEmail, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, type TransactionalEmailDefinition, type RegisteredTransactionalEmail, } from "../email-catalog/registry.js";

package/dist/server/index.js

@@ -75,7 +75,7 @@ export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAut
 export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, } from "./workspace-provider-oauth.js";
 export { FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, } from "./credential-provider.js";
 export { builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, createBuilderDesignSystemProxyFields, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, } from "./builder-design-systems.js";
-export { getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, } from "./builder-browser.js";
+export { createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, } from "./builder-browser.js";
 export { ensureFusionContainer, sendFusionBranchMessage, pushFusionBranch, reserveFusionHostingSlug, deployFusionProject, getFusionDeploys, getFusionBranchEditorUrl, getFusionHostingUrl, } from "./fusion-app.js";
 export { sendEmail, isEmailConfigured, getEmailReadiness, getEmailProvider, } from "./email.js";
 export { defineTransactionalEmail, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, } from "../email-catalog/registry.js";

package/dist/shared/cache-control.d.ts

@@ -1,11 +1,11 @@
 export declare const DEFAULT_PUBLIC_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export declare const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export declare const DEFAULT_SSR_CDN_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
-export declare const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
+export declare const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, s-maxage=31536000, stale-while-revalidate=604800, stale-if-error=3600";
 export declare const DEFAULT_SSR_CACHE_HEADERS: {
     readonly "cache-control": "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
     readonly "cdn-cache-control": "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
-    readonly "netlify-cdn-cache-control": "public, durable, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
+    readonly "netlify-cdn-cache-control": "public, durable, s-maxage=31536000, stale-while-revalidate=604800, stale-if-error=3600";
 };
 /**
  * Deployment-wide override for the SSR shell cache policy.

package/dist/shared/cache-control.js

@@ -1,7 +1,7 @@
 export const DEFAULT_PUBLIC_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export const DEFAULT_SSR_CACHE_CONTROL = DEFAULT_PUBLIC_CACHE_CONTROL;
 export const DEFAULT_SSR_CDN_CACHE_CONTROL = DEFAULT_SSR_CACHE_CONTROL;
-export const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
+export const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, s-maxage=31536000, stale-while-revalidate=604800, stale-if-error=3600";
 export const DEFAULT_SSR_CACHE_HEADERS = {
     "cache-control": DEFAULT_SSR_CACHE_CONTROL,
     "cdn-cache-control": DEFAULT_SSR_CDN_CACHE_CONTROL,
@@ -85,7 +85,7 @@ export function ssrCacheHeadersForPolicy(policy) {
     // the 7-day default SWR here would hand back the staleness they opted out of.
     const control = `public, max-age=${policy.seconds}, ` +
         `stale-while-revalidate=${policy.seconds}, stale-if-error=3600`;
-    const netlifyControl = `public, durable, max-age=${policy.seconds}, ` +
+    const netlifyControl = `public, durable, s-maxage=${policy.seconds}, ` +
         `stale-while-revalidate=${policy.seconds}, stale-if-error=3600`;
     return {
         "cache-control": control,

package/dist/templates/chat/.agents/skills/turn-into-app/SKILL.md

@@ -27,6 +27,10 @@ The build location depends on the host. Treat this as a hard routing rule:
   `resourceIds` when available. This is the Builder handoff.
 - Do not substitute the generic `create_workspace_app` MCP tool in an online
   host. That tool is a local workspace scaffolder, not the Builder handoff.
+- Connect the Agent-Native Dispatch MCP connector only. Dispatch uses the
+  authenticated Builder Projects API to reuse or provision the workspace
+  project before starting the Builder Cloud Agent; a separate Builder CMS MCP
+  connection is not required for this workflow.
 - If `start-workspace-app-creation` is not available or Dispatch is not
   authenticated, stop with the connector setup needed. Do not fall back to a
   local build or claim that the app exists.

package/dist/templates/chat/.agents/skills/turn-into-app/references/fresh-project.md

@@ -50,6 +50,14 @@ skills. For a ChatGPT Project or any host that exposes only the MCP connector,
 also place the skill instructions or this reference in the Project
 instructions/knowledge files. Then add and authenticate the Dispatch MCP
 connector from the packaged `adapters/chatgpt-mcp/connector.json`.
+This single connector is enough: Dispatch provisions or reuses the Builder
+project through the Builder Projects API, so do not ask the user to add a
+separate Builder CMS MCP for app creation.
+Builder's separate Fusion MCP is available as a custom remote connector at
+`https://mcp.builder.io/mcp/fusion` for direct Builder work. It can run an
+existing project, but it cannot provision the repo-backed Agent-Native
+workspace project, so it is optional and not a replacement for the Dispatch
+handoff in this skill. Do not add Builder's CMS MCP for this workflow.
 
 For Claude Web, ChatGPT Web, and their web Projects, the host is an
 orchestrator, not the build environment. After forming the source brief, call

package/dist/templates/default/.agents/skills/turn-into-app/SKILL.md

@@ -27,6 +27,10 @@ The build location depends on the host. Treat this as a hard routing rule:
   `resourceIds` when available. This is the Builder handoff.
 - Do not substitute the generic `create_workspace_app` MCP tool in an online
   host. That tool is a local workspace scaffolder, not the Builder handoff.
+- Connect the Agent-Native Dispatch MCP connector only. Dispatch uses the
+  authenticated Builder Projects API to reuse or provision the workspace
+  project before starting the Builder Cloud Agent; a separate Builder CMS MCP
+  connection is not required for this workflow.
 - If `start-workspace-app-creation` is not available or Dispatch is not
   authenticated, stop with the connector setup needed. Do not fall back to a
   local build or claim that the app exists.

package/dist/templates/default/.agents/skills/turn-into-app/references/fresh-project.md

@@ -50,6 +50,14 @@ skills. For a ChatGPT Project or any host that exposes only the MCP connector,
 also place the skill instructions or this reference in the Project
 instructions/knowledge files. Then add and authenticate the Dispatch MCP
 connector from the packaged `adapters/chatgpt-mcp/connector.json`.
+This single connector is enough: Dispatch provisions or reuses the Builder
+project through the Builder Projects API, so do not ask the user to add a
+separate Builder CMS MCP for app creation.
+Builder's separate Fusion MCP is available as a custom remote connector at
+`https://mcp.builder.io/mcp/fusion` for direct Builder work. It can run an
+existing project, but it cannot provision the repo-backed Agent-Native
+workspace project, so it is optional and not a replacement for the Dispatch
+handoff in this skill. Do not add Builder's CMS MCP for this workflow.
 
 For Claude Web, ChatGPT Web, and their web Projects, the host is an
 orchestrator, not the build environment. After forming the source brief, call

package/dist/templates/headless/.agents/skills/turn-into-app/SKILL.md

@@ -27,6 +27,10 @@ The build location depends on the host. Treat this as a hard routing rule:
   `resourceIds` when available. This is the Builder handoff.
 - Do not substitute the generic `create_workspace_app` MCP tool in an online
   host. That tool is a local workspace scaffolder, not the Builder handoff.
+- Connect the Agent-Native Dispatch MCP connector only. Dispatch uses the
+  authenticated Builder Projects API to reuse or provision the workspace
+  project before starting the Builder Cloud Agent; a separate Builder CMS MCP
+  connection is not required for this workflow.
 - If `start-workspace-app-creation` is not available or Dispatch is not
   authenticated, stop with the connector setup needed. Do not fall back to a
   local build or claim that the app exists.

package/dist/templates/headless/.agents/skills/turn-into-app/references/fresh-project.md

@@ -50,6 +50,14 @@ skills. For a ChatGPT Project or any host that exposes only the MCP connector,
 also place the skill instructions or this reference in the Project
 instructions/knowledge files. Then add and authenticate the Dispatch MCP
 connector from the packaged `adapters/chatgpt-mcp/connector.json`.
+This single connector is enough: Dispatch provisions or reuses the Builder
+project through the Builder Projects API, so do not ask the user to add a
+separate Builder CMS MCP for app creation.
+Builder's separate Fusion MCP is available as a custom remote connector at
+`https://mcp.builder.io/mcp/fusion` for direct Builder work. It can run an
+existing project, but it cannot provision the repo-backed Agent-Native
+workspace project, so it is optional and not a replacement for the Dispatch
+handoff in this skill. Do not add Builder's CMS MCP for this workflow.
 
 For Claude Web, ChatGPT Web, and their web Projects, the host is an
 orchestrator, not the build environment. After forming the source brief, call

package/dist/templates/workspace-core/.agents/skills/turn-into-app/SKILL.md

@@ -27,6 +27,10 @@ The build location depends on the host. Treat this as a hard routing rule:
   `resourceIds` when available. This is the Builder handoff.
 - Do not substitute the generic `create_workspace_app` MCP tool in an online
   host. That tool is a local workspace scaffolder, not the Builder handoff.
+- Connect the Agent-Native Dispatch MCP connector only. Dispatch uses the
+  authenticated Builder Projects API to reuse or provision the workspace
+  project before starting the Builder Cloud Agent; a separate Builder CMS MCP
+  connection is not required for this workflow.
 - If `start-workspace-app-creation` is not available or Dispatch is not
   authenticated, stop with the connector setup needed. Do not fall back to a
   local build or claim that the app exists.

package/dist/templates/workspace-core/.agents/skills/turn-into-app/references/fresh-project.md

@@ -50,6 +50,14 @@ skills. For a ChatGPT Project or any host that exposes only the MCP connector,
 also place the skill instructions or this reference in the Project
 instructions/knowledge files. Then add and authenticate the Dispatch MCP
 connector from the packaged `adapters/chatgpt-mcp/connector.json`.
+This single connector is enough: Dispatch provisions or reuses the Builder
+project through the Builder Projects API, so do not ask the user to add a
+separate Builder CMS MCP for app creation.
+Builder's separate Fusion MCP is available as a custom remote connector at
+`https://mcp.builder.io/mcp/fusion` for direct Builder work. It can run an
+existing project, but it cannot provision the repo-backed Agent-Native
+workspace project, so it is optional and not a replacement for the Dispatch
+handoff in this skill. Do not add Builder's CMS MCP for this workflow.
 
 For Claude Web, ChatGPT Web, and their web Projects, the host is an
 orchestrator, not the build environment. After forming the source brief, call