@agent-native/core 0.146.0 → 0.146.2

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/builder-browser.d.ts

@@ -328,6 +328,40 @@ export interface RunBuilderAgentResult {
     url: string;
     status: string;
 }
+export interface BuilderProjectLookupArgs {
+    repoUrl: string;
+}
+export interface BuilderProjectResult {
+    projectId: string;
+    name: string;
+    repoUrl: string;
+    browserUrl: string;
+    created: boolean;
+}
+/**
+ * Find an existing Builder project connected to a repository. Dispatch uses
+ * this before provisioning so a first app request cannot create a duplicate
+ * workspace project when the project id has not been saved yet.
+ */
+export declare function findBuilderProjectForRepo(args: BuilderProjectLookupArgs): Promise<BuilderProjectResult | null>;
+/**
+ * Create a Builder project connected to a repository through the public
+ * projects API. This is the server-side bridge used by Dispatch; online
+ * Claude and ChatGPT hosts do not need a separate Builder CMS MCP connector.
+ */
+export declare function createBuilderProject(args: {
+    name: string;
+    repoUrl: string;
+}): Promise<BuilderProjectResult>;
+/**
+ * Reuse a connected Builder project or create it once when Dispatch is first
+ * used for a workspace. The lookup and create calls intentionally stay in
+ * this shared server helper so all callers use the same authenticated path.
+ */
+export declare function ensureBuilderProject(args: {
+    name: string;
+    repoUrl: string;
+}): Promise<BuilderProjectResult>;
 /**
  * POST a prompt to the Builder agents-run API. The Builder agent runs in a
  * cloud sandbox and writes code to a branch; the returned URL opens that

package/dist/server/builder-browser.js

@@ -1283,6 +1283,185 @@ function normalizeBuilderApiString(value, fieldName) {
     }
     return trimmed;
 }
+function normalizeBuilderProjectString(value, fieldName) {
+    if (typeof value !== "string" || !value.trim()) {
+        throw new Error(`Builder project response returned a blank ${fieldName}`);
+    }
+    const trimmed = value.trim();
+    if (/[\u0000-\u001f\u007f]/.test(trimmed)) {
+        throw new Error(`Builder project response returned a malformed ${fieldName}`);
+    }
+    return trimmed;
+}
+function normalizeBuilderRepoUrl(value) {
+    const trimmed = value.trim();
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        throw new Error("Builder project repository URL is malformed");
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new Error("Builder project repository URL must use HTTP or HTTPS");
+    }
+    return trimmed;
+}
+function comparableBuilderRepoUrl(value) {
+    try {
+        const parsed = new URL(value);
+        const pathname = parsed.pathname.replace(/\/+$/, "").replace(/\.git$/, "");
+        return `${parsed.hostname.toLowerCase()}${pathname.toLowerCase()}`;
+    }
+    catch {
+        return value
+            .trim()
+            .replace(/\/+$/, "")
+            .replace(/\.git$/, "")
+            .toLowerCase();
+    }
+}
+function builderProjectBrowserUrl(projectId) {
+    return `${getBuilderAppHost().replace(/\/$/, "")}/app/projects/${encodeURIComponent(projectId)}`;
+}
+function builderProjectFromRecord(value, fallbackRepoUrl, created) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    const projectId = typeof record.id === "string" && record.id.trim() ? record.id.trim() : null;
+    if (!projectId)
+        return null;
+    const name = typeof record.name === "string" && record.name.trim()
+        ? record.name.trim()
+        : "Agent-Native Workspace";
+    const repoUrl = typeof record.repoUrl === "string" && record.repoUrl.trim()
+        ? record.repoUrl.trim()
+        : fallbackRepoUrl;
+    if (!repoUrl)
+        return null;
+    return {
+        projectId: normalizeBuilderProjectString(projectId, "project id"),
+        name: normalizeBuilderProjectString(name, "project name"),
+        repoUrl: normalizeBuilderRepoUrl(repoUrl),
+        browserUrl: builderProjectBrowserUrl(projectId),
+        created,
+    };
+}
+async function resolveBuilderApiCredentials() {
+    const { resolveBuilderCredentials } = await import("./credential-provider.js");
+    const creds = await resolveBuilderCredentials();
+    if (!creds.privateKey || !creds.publicKey) {
+        throw new Error("Builder keys are not configured");
+    }
+    return {
+        ...creds,
+        privateKey: creds.privateKey,
+        publicKey: creds.publicKey,
+    };
+}
+async function readBuilderApiObject(response, operation) {
+    let parsed;
+    try {
+        parsed = await response.json();
+    }
+    catch (error) {
+        throw new Error("Builder " +
+            operation +
+            " returned an invalid JSON response (" +
+            response.status +
+            ")", { cause: error });
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("Builder " +
+            operation +
+            " returned an invalid JSON response (" +
+            response.status +
+            ")");
+    }
+    return parsed;
+}
+function builderApiErrorMessage(parsed, fallback) {
+    if (typeof parsed.error === "string" && parsed.error.trim()) {
+        return parsed.error.trim();
+    }
+    if (typeof parsed.message === "string" && parsed.message.trim()) {
+        return parsed.message.trim();
+    }
+    return fallback;
+}
+/**
+ * Find an existing Builder project connected to a repository. Dispatch uses
+ * this before provisioning so a first app request cannot create a duplicate
+ * workspace project when the project id has not been saved yet.
+ */
+export async function findBuilderProjectForRepo(args) {
+    const repoUrl = normalizeBuilderRepoUrl(args.repoUrl);
+    const creds = await resolveBuilderApiCredentials();
+    const url = new URL("/projects", getBuilderApiHost());
+    url.searchParams.set("apiKey", creds.publicKey);
+    url.searchParams.set("includeHidden", "true");
+    const response = await fetch(url, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${creds.privateKey}` },
+    });
+    const parsed = await readBuilderApiObject(response, "project lookup");
+    if (!response.ok) {
+        throw new Error(builderApiErrorMessage(parsed, `Builder project lookup failed (${response.status})`));
+    }
+    if (!Array.isArray(parsed.projects)) {
+        throw new Error("Builder project lookup returned no projects list");
+    }
+    const comparableRepoUrl = comparableBuilderRepoUrl(repoUrl);
+    for (const project of parsed.projects) {
+        const normalized = builderProjectFromRecord(project, null, false);
+        if (normalized &&
+            comparableBuilderRepoUrl(normalized.repoUrl) === comparableRepoUrl) {
+            return normalized;
+        }
+    }
+    return null;
+}
+/**
+ * Create a Builder project connected to a repository through the public
+ * projects API. This is the server-side bridge used by Dispatch; online
+ * Claude and ChatGPT hosts do not need a separate Builder CMS MCP connector.
+ */
+export async function createBuilderProject(args) {
+    const name = normalizeBuilderProjectString(args.name, "project name");
+    const repoUrl = normalizeBuilderRepoUrl(args.repoUrl);
+    const creds = await resolveBuilderApiCredentials();
+    const url = new URL("/projects/create", getBuilderApiHost());
+    url.searchParams.set("apiKey", creds.publicKey);
+    const response = await fetch(url, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${creds.privateKey}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            source: { kind: "repo", repoUrl },
+            name,
+        }),
+    });
+    const parsed = await readBuilderApiObject(response, "project creation");
+    if (!response.ok) {
+        throw new Error(builderApiErrorMessage(parsed, `Builder project creation failed (${response.status})`));
+    }
+    const project = builderProjectFromRecord(parsed.project, repoUrl, true);
+    if (!project) {
+        throw new Error("Builder project creation returned no project id");
+    }
+    return project;
+}
+/**
+ * Reuse a connected Builder project or create it once when Dispatch is first
+ * used for a workspace. The lookup and create calls intentionally stay in
+ * this shared server helper so all callers use the same authenticated path.
+ */
+export async function ensureBuilderProject(args) {
+    const existing = await findBuilderProjectForRepo({ repoUrl: args.repoUrl });
+    return existing ?? createBuilderProject(args);
+}
 function normalizeBuilderBranchUrl(value) {
     const urlString = normalizeBuilderApiString(value, "url");
     let parsed;

package/dist/server/core-routes-plugin.d.ts

@@ -288,6 +288,11 @@ interface LegacyCoreRouteInitSettings {
 }
 type CoreRouteSettingReader = (key: string) => Promise<Record<string, unknown> | null>;
 export declare function readLegacyCoreRouteInitSettings(readSetting?: CoreRouteSettingReader): Promise<LegacyCoreRouteInitSettings>;
+/**
+ * Production release jobs own schema setup. Request functions must not spend
+ * their cold-start budget on legacy cleanup or best-effort table warmups.
+ */
+export declare function shouldRunCoreRouteBootDatabaseWork(env?: NodeJS.ProcessEnv): boolean;
 export declare function createCoreRoutesPlugin(options?: CoreRoutesPluginOptions): NitroPluginDef;
 /**
  * Default core routes plugin — mount with no configuration needed.

package/dist/server/core-routes-plugin.js

@@ -8,7 +8,7 @@ import { canUpdateAgentLoopSettings, readAgentLoopSettings, resetAgentLoopSettin
 import { getState, putState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, getStateMany, } from "../application-state/handlers.js";
 import { mountBrowserSessionRoutes } from "../browser-sessions/routes.js";
 import { mountDbAdminRoutes } from "../db-admin/routes.js";
-import { getDbExec } from "../db/client.js";
+import { getDbExec, isProductionServerlessFunctionRuntime, } from "../db/client.js";
 import { getDatabaseRuntimeFingerprint, getRuntimeDebugFingerprint, runDatabaseSchemaHealthCheck, } from "../db/runtime-diagnostics.js";
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import { uploadFile, getActiveFileUploadProviderForRequest, listFileUploadProviders, } from "../file-upload/index.js";
@@ -814,6 +814,13 @@ export async function readLegacyCoreRouteInitSettings(readSetting = getSetting)
         builderDisconnected: builderDisconnected,
     };
 }
+/**
+ * Production release jobs own schema setup. Request functions must not spend
+ * their cold-start budget on legacy cleanup or best-effort table warmups.
+ */
+export function shouldRunCoreRouteBootDatabaseWork(env = process.env) {
+    return !isProductionServerlessFunctionRuntime(env);
+}
 /**
  * Creates a Nitro plugin that mounts all standard agent-native framework routes.
  *
@@ -913,7 +920,10 @@ export function createCoreRoutesPlugin(options = {}) {
                 return EMPTY_SPECULATION_RULES;
             }));
             await awaitBootstrap(nitroApp);
-            const { persistedEnvVars, builderDisconnected } = await readLegacyCoreRouteInitSettings();
+            const runBootDatabaseWork = shouldRunCoreRouteBootDatabaseWork();
+            const { persistedEnvVars, builderDisconnected } = runBootDatabaseWork
+                ? await readLegacyCoreRouteInitSettings()
+                : { persistedEnvVars: null, builderDisconnected: null };
             // Legacy cleanup: key saves now go to scoped app_secrets rows. Do not
             // rehydrate the old deployment-global `persisted-env-vars` row into
             // process.env; keep only the Builder scrub so stale leaked keys self-heal.
@@ -996,7 +1006,8 @@ export function createCoreRoutesPlugin(options = {}) {
             try {
                 const { createObservabilityHandler } = await import("../observability/routes.js");
                 const { ensureObservabilityTables } = await import("../observability/store.js");
-                ensureObservabilityTables().catch(() => { });
+                if (runBootDatabaseWork)
+                    ensureObservabilityTables().catch(() => { });
                 getH3App(nitroApp).use(`${FRAMEWORK_ROUTE_PREFIX}/observability`, createObservabilityHandler());
             }
             catch {
@@ -1009,8 +1020,10 @@ export function createCoreRoutesPlugin(options = {}) {
             try {
                 const { ensureAuditTables } = await import("../audit/store.js");
                 const { startAuditCleanupJob } = await import("../audit/cleanup-job.js");
-                ensureAuditTables().catch(() => { });
-                startAuditCleanupJob();
+                if (runBootDatabaseWork) {
+                    ensureAuditTables().catch(() => { });
+                    startAuditCleanupJob();
+                }
             }
             catch {
                 // Audit module not available — skip
@@ -2880,7 +2893,8 @@ export function createCoreRoutesPlugin(options = {}) {
             try {
                 const { ensureExtensionsTables, registerExtensionsShareable } = await import("../extensions/store.js");
                 const { createExtensionsHandler } = await import("../extensions/routes.js");
-                ensureExtensionsTables().catch(() => { });
+                if (runBootDatabaseWork)
+                    ensureExtensionsTables().catch(() => { });
                 registerExtensionsShareable();
                 const extensionsHandler = createExtensionsHandler({
                     extensionTools: options.extensionTools,
@@ -2893,7 +2907,8 @@ export function createCoreRoutesPlugin(options = {}) {
                 // Extension-point slots — sub-system of extensions.
                 const { ensureSlotTables } = await import("../extensions/slots/store.js");
                 const { createSlotsHandler } = await import("../extensions/slots/routes.js");
-                ensureSlotTables().catch(() => { });
+                if (runBootDatabaseWork)
+                    ensureSlotTables().catch(() => { });
                 getH3App(nitroApp).use(`${P}/slots`, createSlotsHandler());
             }
             catch {
@@ -2902,7 +2917,8 @@ export function createCoreRoutesPlugin(options = {}) {
             // ─── Data programs (stored server-side JS scripts + run cache) ─────
             try {
                 const { ensureDataProgramTables, registerDataProgramsShareable } = await import("../data-programs/store.js");
-                ensureDataProgramTables().catch(() => { });
+                if (runBootDatabaseWork)
+                    ensureDataProgramTables().catch(() => { });
                 registerDataProgramsShareable();
             }
             catch {

package/dist/server/index.d.ts

@@ -70,7 +70,7 @@ export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAut
 export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, type GenericWorkspaceOAuthProvider, type WorkspaceProviderOAuthFlow, } from "./workspace-provider-oauth.js";
 export { FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, type BuilderCredentialsDetailed, } from "./credential-provider.js";
 export { builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, createBuilderDesignSystemProxyFields, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, type BuildBuilderDesignSystemIndexFilesOptions, type BuilderDesignSystemCodeFileInput, type BuilderDesignSystemDecodeJobStatus, type BuilderDesignSystemDocsOptions, type BuilderDesignSystemDocument, type BuilderDesignSystemHydratedReference, type BuilderDesignSystemIndexFile, type BuilderDesignSystemIndexFromSourcesOptions, type BuilderDesignSystemIndexOptions, type BuilderDesignSystemIndexResult, type BuilderDesignSystemUploadAttachment, type BuilderDesignSystemUploadSlot, type BuilderDesignSystemProxyFields, type BuilderDesignSystemProxyFieldsOptions, type BuilderDesignSystemProxyReference, type BuilderDesignSystemSourceKind, } from "./builder-design-systems.js";
-export { getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, type RunBuilderAgentResult, } from "./builder-browser.js";
+export { createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, type BuilderProjectResult, type RunBuilderAgentResult, } from "./builder-browser.js";
 export { ensureFusionContainer, sendFusionBranchMessage, pushFusionBranch, reserveFusionHostingSlug, deployFusionProject, getFusionDeploys, getFusionBranchEditorUrl, getFusionHostingUrl, type FusionBranchRef, type EnsureFusionContainerResult, type SendFusionMessageResult, } from "./fusion-app.js";
 export { sendEmail, isEmailConfigured, getEmailReadiness, getEmailProvider, type EmailAttachment, type EmailReadiness, type EmailProvider, type SendEmailArgs, } from "./email.js";
 export { defineTransactionalEmail, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, type TransactionalEmailDefinition, type RegisteredTransactionalEmail, } from "../email-catalog/registry.js";

package/dist/server/index.js

@@ -75,7 +75,7 @@ export { isElectron, isMobile, getOrigin, getAppBasePath, getAppUrl, resolveOAut
 export { buildWorkspaceProviderAuthorizationUrl, createWorkspaceProviderOAuthHandler, exchangeWorkspaceProviderOAuthCode, handleWorkspaceProviderOAuthCallback, handleWorkspaceProviderOAuthStart, isWorkspaceProviderOAuthFlowValid, mergeWorkspaceOAuthValues, resolveWorkspaceProviderIdentity, workspaceProviderOAuthPath, } from "./workspace-provider-oauth.js";
 export { FeatureNotConfiguredError, hasBuilderPrivateKey, isBuilderEnvManaged, getBuilderProxyOrigin, getBuilderImageGenerationBaseUrl, getBuilderWebSearchBaseUrl, getBuilderAuthHeader, resolveBuilderPrivateKey, resolveBuilderAuthHeader, resolveHasBuilderPrivateKey, resolveHasCompleteBuilderConnection, resolveBuilderCredentials, resolveBuilderCredentialsDetailed, resolveBuilderCredentialSource, resolveBuilderCredential, readDeployCredentialEnv, writeBuilderCredentials, deleteBuilderCredentials, resolveSecret, } from "./credential-provider.js";
 export { builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, createBuilderDesignSystemProxyFields, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, } from "./builder-design-systems.js";
-export { getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, } from "./builder-browser.js";
+export { createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, runBuilderAgent, } from "./builder-browser.js";
 export { ensureFusionContainer, sendFusionBranchMessage, pushFusionBranch, reserveFusionHostingSlug, deployFusionProject, getFusionDeploys, getFusionBranchEditorUrl, getFusionHostingUrl, } from "./fusion-app.js";
 export { sendEmail, isEmailConfigured, getEmailReadiness, getEmailProvider, } from "./email.js";
 export { defineTransactionalEmail, listTransactionalEmails, getTransactionalEmail, renderTransactionalEmailPreview, } from "../email-catalog/registry.js";

package/dist/shared/cache-control.d.ts

@@ -1,11 +1,11 @@
 export declare const DEFAULT_PUBLIC_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export declare const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export declare const DEFAULT_SSR_CDN_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
-export declare const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
+export declare const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, s-maxage=31536000, stale-while-revalidate=604800, stale-if-error=3600";
 export declare const DEFAULT_SSR_CACHE_HEADERS: {
     readonly "cache-control": "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
     readonly "cdn-cache-control": "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
-    readonly "netlify-cdn-cache-control": "public, durable, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
+    readonly "netlify-cdn-cache-control": "public, durable, s-maxage=31536000, stale-while-revalidate=604800, stale-if-error=3600";
 };
 /**
  * Deployment-wide override for the SSR shell cache policy.

package/dist/shared/cache-control.js

@@ -1,7 +1,7 @@
 export const DEFAULT_PUBLIC_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export const DEFAULT_SSR_CACHE_CONTROL = DEFAULT_PUBLIC_CACHE_CONTROL;
 export const DEFAULT_SSR_CDN_CACHE_CONTROL = DEFAULT_SSR_CACHE_CONTROL;
-export const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
+export const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, s-maxage=31536000, stale-while-revalidate=604800, stale-if-error=3600";
 export const DEFAULT_SSR_CACHE_HEADERS = {
     "cache-control": DEFAULT_SSR_CACHE_CONTROL,
     "cdn-cache-control": DEFAULT_SSR_CDN_CACHE_CONTROL,
@@ -85,7 +85,7 @@ export function ssrCacheHeadersForPolicy(policy) {
     // the 7-day default SWR here would hand back the staleness they opted out of.
     const control = `public, max-age=${policy.seconds}, ` +
         `stale-while-revalidate=${policy.seconds}, stale-if-error=3600`;
-    const netlifyControl = `public, durable, max-age=${policy.seconds}, ` +
+    const netlifyControl = `public, durable, s-maxage=${policy.seconds}, ` +
         `stale-while-revalidate=${policy.seconds}, stale-if-error=3600`;
     return {
         "cache-control": control,

package/dist/templates/chat/.agents/skills/turn-into-app/SKILL.md

@@ -27,6 +27,10 @@ The build location depends on the host. Treat this as a hard routing rule:
   `resourceIds` when available. This is the Builder handoff.
 - Do not substitute the generic `create_workspace_app` MCP tool in an online
   host. That tool is a local workspace scaffolder, not the Builder handoff.
+- Connect the Agent-Native Dispatch MCP connector only. Dispatch uses the
+  authenticated Builder Projects API to reuse or provision the workspace
+  project before starting the Builder Cloud Agent; a separate Builder CMS MCP
+  connection is not required for this workflow.
 - If `start-workspace-app-creation` is not available or Dispatch is not
   authenticated, stop with the connector setup needed. Do not fall back to a
   local build or claim that the app exists.

package/dist/templates/chat/.agents/skills/turn-into-app/references/fresh-project.md

@@ -50,6 +50,14 @@ skills. For a ChatGPT Project or any host that exposes only the MCP connector,
 also place the skill instructions or this reference in the Project
 instructions/knowledge files. Then add and authenticate the Dispatch MCP
 connector from the packaged `adapters/chatgpt-mcp/connector.json`.
+This single connector is enough: Dispatch provisions or reuses the Builder
+project through the Builder Projects API, so do not ask the user to add a
+separate Builder CMS MCP for app creation.
+Builder's separate Fusion MCP is available as a custom remote connector at
+`https://mcp.builder.io/mcp/fusion` for direct Builder work. It can run an
+existing project, but it cannot provision the repo-backed Agent-Native
+workspace project, so it is optional and not a replacement for the Dispatch
+handoff in this skill. Do not add Builder's CMS MCP for this workflow.
 
 For Claude Web, ChatGPT Web, and their web Projects, the host is an
 orchestrator, not the build environment. After forming the source brief, call

package/dist/templates/default/.agents/skills/turn-into-app/SKILL.md

@@ -27,6 +27,10 @@ The build location depends on the host. Treat this as a hard routing rule:
   `resourceIds` when available. This is the Builder handoff.
 - Do not substitute the generic `create_workspace_app` MCP tool in an online
   host. That tool is a local workspace scaffolder, not the Builder handoff.
+- Connect the Agent-Native Dispatch MCP connector only. Dispatch uses the
+  authenticated Builder Projects API to reuse or provision the workspace
+  project before starting the Builder Cloud Agent; a separate Builder CMS MCP
+  connection is not required for this workflow.
 - If `start-workspace-app-creation` is not available or Dispatch is not
   authenticated, stop with the connector setup needed. Do not fall back to a
   local build or claim that the app exists.

package/dist/templates/default/.agents/skills/turn-into-app/references/fresh-project.md

@@ -50,6 +50,14 @@ skills. For a ChatGPT Project or any host that exposes only the MCP connector,
 also place the skill instructions or this reference in the Project
 instructions/knowledge files. Then add and authenticate the Dispatch MCP
 connector from the packaged `adapters/chatgpt-mcp/connector.json`.
+This single connector is enough: Dispatch provisions or reuses the Builder
+project through the Builder Projects API, so do not ask the user to add a
+separate Builder CMS MCP for app creation.
+Builder's separate Fusion MCP is available as a custom remote connector at
+`https://mcp.builder.io/mcp/fusion` for direct Builder work. It can run an
+existing project, but it cannot provision the repo-backed Agent-Native
+workspace project, so it is optional and not a replacement for the Dispatch
+handoff in this skill. Do not add Builder's CMS MCP for this workflow.
 
 For Claude Web, ChatGPT Web, and their web Projects, the host is an
 orchestrator, not the build environment. After forming the source brief, call

package/dist/templates/headless/.agents/skills/turn-into-app/SKILL.md

@@ -27,6 +27,10 @@ The build location depends on the host. Treat this as a hard routing rule:
   `resourceIds` when available. This is the Builder handoff.
 - Do not substitute the generic `create_workspace_app` MCP tool in an online
   host. That tool is a local workspace scaffolder, not the Builder handoff.
+- Connect the Agent-Native Dispatch MCP connector only. Dispatch uses the
+  authenticated Builder Projects API to reuse or provision the workspace
+  project before starting the Builder Cloud Agent; a separate Builder CMS MCP
+  connection is not required for this workflow.
 - If `start-workspace-app-creation` is not available or Dispatch is not
   authenticated, stop with the connector setup needed. Do not fall back to a
   local build or claim that the app exists.

package/dist/templates/headless/.agents/skills/turn-into-app/references/fresh-project.md

@@ -50,6 +50,14 @@ skills. For a ChatGPT Project or any host that exposes only the MCP connector,
 also place the skill instructions or this reference in the Project
 instructions/knowledge files. Then add and authenticate the Dispatch MCP
 connector from the packaged `adapters/chatgpt-mcp/connector.json`.
+This single connector is enough: Dispatch provisions or reuses the Builder
+project through the Builder Projects API, so do not ask the user to add a
+separate Builder CMS MCP for app creation.
+Builder's separate Fusion MCP is available as a custom remote connector at
+`https://mcp.builder.io/mcp/fusion` for direct Builder work. It can run an
+existing project, but it cannot provision the repo-backed Agent-Native
+workspace project, so it is optional and not a replacement for the Dispatch
+handoff in this skill. Do not add Builder's CMS MCP for this workflow.
 
 For Claude Web, ChatGPT Web, and their web Projects, the host is an
 orchestrator, not the build environment. After forming the source brief, call

package/dist/templates/workspace-core/.agents/skills/turn-into-app/SKILL.md

@@ -27,6 +27,10 @@ The build location depends on the host. Treat this as a hard routing rule:
   `resourceIds` when available. This is the Builder handoff.
 - Do not substitute the generic `create_workspace_app` MCP tool in an online
   host. That tool is a local workspace scaffolder, not the Builder handoff.
+- Connect the Agent-Native Dispatch MCP connector only. Dispatch uses the
+  authenticated Builder Projects API to reuse or provision the workspace
+  project before starting the Builder Cloud Agent; a separate Builder CMS MCP
+  connection is not required for this workflow.
 - If `start-workspace-app-creation` is not available or Dispatch is not
   authenticated, stop with the connector setup needed. Do not fall back to a
   local build or claim that the app exists.

package/dist/templates/workspace-core/.agents/skills/turn-into-app/references/fresh-project.md

@@ -50,6 +50,14 @@ skills. For a ChatGPT Project or any host that exposes only the MCP connector,
 also place the skill instructions or this reference in the Project
 instructions/knowledge files. Then add and authenticate the Dispatch MCP
 connector from the packaged `adapters/chatgpt-mcp/connector.json`.
+This single connector is enough: Dispatch provisions or reuses the Builder
+project through the Builder Projects API, so do not ask the user to add a
+separate Builder CMS MCP for app creation.
+Builder's separate Fusion MCP is available as a custom remote connector at
+`https://mcp.builder.io/mcp/fusion` for direct Builder work. It can run an
+existing project, but it cannot provision the repo-backed Agent-Native
+workspace project, so it is optional and not a replacement for the Dispatch
+handoff in this skill. Do not add Builder's CMS MCP for this workflow.
 
 For Claude Web, ChatGPT Web, and their web Projects, the host is an
 orchestrator, not the build environment. After forming the source brief, call

package/dist/vite/client.js

@@ -2406,9 +2406,17 @@ function getConfiguredAppBasePath() {
     return { appBasePath, base };
 }
 function createNitroDevPlugin(options, appBasePath) {
+    const nitroOptions = options.nitro ?? {};
     return nitroVitePlugin({
         serverDir: "./server",
-        ...(options.nitro ?? {}),
+        ...nitroOptions,
+        replace: {
+            ...nitroOptions.replace,
+            // Netlify's netlify.toml environment is available to the build but not
+            // injected into deployed Functions. Nitro is a separate server build,
+            // so it needs the release ownership decision in its own replacement map.
+            "process.env.AGENT_NATIVE_RELEASE_MIGRATIONS": JSON.stringify(process.env.AGENT_NATIVE_RELEASE_MIGRATIONS?.trim() || ""),
+        },
         // Never auto-load test files as server handlers/plugins/middleware.
         // Nitro scans server/{plugins,middleware,routes,api}/*; a co-located
         // *.spec.ts would otherwise be loaded at runtime and crash the server
@@ -2739,6 +2747,10 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
             __AGENT_NATIVE_APP_CONFIG__: JSON.stringify(appConfig),
             __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: JSON.stringify(process.env.GA_MEASUREMENT_ID?.trim() || ""),
             "process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID": JSON.stringify(process.env.GA_MEASUREMENT_ID?.trim() || ""),
+            // The release migration owner is configured at build time. Netlify's
+            // netlify.toml environment is available to the build but not injected
+            // into deployed Functions, so embed the decision in the server bundle.
+            "process.env.AGENT_NATIVE_RELEASE_MIGRATIONS": JSON.stringify(process.env.AGENT_NATIVE_RELEASE_MIGRATIONS?.trim() || ""),
             __AGENT_NATIVE_BUILD_GTM_CONTAINER_ID__: JSON.stringify(process.env.GTM_CONTAINER_ID?.trim() || ""),
             "process.env.AGENT_NATIVE_BUILD_GTM_CONTAINER_ID": JSON.stringify(process.env.GTM_CONTAINER_ID?.trim() || ""),
             // Framework route warmup controls how SSR `.data` routes are fetched:

package/docs/content/drop-in-agent.mdx

@@ -142,11 +142,11 @@ children stays in the main app area. The agent chat is the side panel.
   ]}
 />
 
-That's it. The user now has a toggleable agent on every page — with chat history, resources tab, CLI terminal, voice input, and a fullscreen mode. State persists across reloads via `localStorage`.
+That's it. The user now has a toggleable agent on every page — with chat history, resources tab, CLI terminal, voice input, and a wider drawer. State persists across reloads via `localStorage`.
 
 ### Props
 
-- **`children`** — your app's normal layout and routes. Rendered in the main area; the agent panel mounts beside it on desktop and over it on mobile/fullscreen.
+- **`children`** — your app's normal layout and routes. Rendered in the main area; the agent panel mounts beside it on desktop and over it on mobile.
 - **`emptyStateText`** — greeting shown when the chat has no messages. Default: `"How can I help you?"`.
 - **`suggestions`** — starter prompts rendered as clickable chips when empty.
 - **`dynamicSuggestions`** — context-aware prompt chips merged with `suggestions`. Enabled by default; pass `false` to show only static suggestions, or `{ max, includeStatic, getSuggestions }` to customize.
@@ -177,7 +177,7 @@ export default function AgentRoute() {
 - **`defaultMode`** — `"chat"` or `"cli"`. Default: `"chat"`.
 - **`className`** — CSS class for the outer container.
 - **`onCollapse`** — if provided, a collapse button appears in the header.
-- **`isFullscreen`** / **`onToggleFullscreen`** — wire up external fullscreen state if you want a Claude-style centered column.
+- **`isFullscreen`** — set this when you want a Claude-style centered column for a page-level or custom panel surface. The sidebar uses the wider drawer instead.
 - **`storageKey`** — namespace for `localStorage` keys. Useful when you render multiple panels (different app instances or workspaces) in the same page.
 
 Full props: `AgentPanelProps` in `@agent-native/core/client`.

package/docs/content/getting-started-actions.mdx

@@ -89,5 +89,4 @@ custom native components, see [Native Chat UI](/docs/native-chat-ui).
 ## Continue
 
 Continue with [Add a Page](/docs/getting-started-pages) to use the same action
-outside the transcript. When results need to survive conversations, return to
-[Persist Data in SQL](/docs/getting-started-database).
+outside the transcript.

package/docs/content/getting-started-pages.mdx

@@ -71,6 +71,5 @@ patterns, see [Context Awareness](/docs/context-awareness).
 ## Continue
 
 You've built a chat app with an action and a page that calls the same source of
-truth. Continue with [Persist Data in SQL](/docs/getting-started-database) when
-results need to persist, or explore [Key Concepts](/docs/key-concepts) and
+truth. Continue with [Key Concepts](/docs/key-concepts) or
 [Agent Surfaces](/docs/agent-surfaces).