@agent-native/core 0.147.0 → 0.148.1

package/dist/observability/routes.d.ts

@@ -41,14 +41,14 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
 } | {
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;

package/dist/onboarding/app-profile.js

@@ -3,7 +3,7 @@ const LLM_CAPABILITY = {
     label: "AI model",
     required: true,
     builderIncluded: true,
-    keySummary: "One model key: Anthropic, OpenAI, Gemini, Groq, Mistral, or Cohere",
+    keySummary: "One model key or local connection: Anthropic, OpenAI, OpenRouter, Gemini, Groq, Mistral, Cohere, or Ollama",
     why: "The agent uses a language model to understand requests and produce answers.",
 };
 const DESIGN_SYSTEM_INTELLIGENCE_CAPABILITY = {

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,8 +75,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    deleted?: undefined;
     id?: undefined;
+    provider?: undefined;
+    deleted?: undefined;
     providers: {
         id: string;
         label: string;
@@ -87,15 +88,14 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    provider?: undefined;
     found?: undefined;
     registered?: undefined;
     label?: undefined;
     message?: undefined;
 } | {
-    deleted?: undefined;
     count?: undefined;
     id?: undefined;
+    deleted?: undefined;
     providers?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
@@ -103,10 +103,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     label?: undefined;
     message?: undefined;
 } | {
-    deleted?: undefined;
     count?: undefined;
-    providers?: undefined;
     provider?: undefined;
+    deleted?: undefined;
+    providers?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
@@ -114,8 +114,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     message?: undefined;
 } | {
     count?: undefined;
-    providers?: undefined;
     provider?: undefined;
+    providers?: undefined;
     found?: undefined;
     deleted: boolean;
     id: string;
@@ -123,10 +123,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     label?: undefined;
     message?: undefined;
 } | {
-    deleted?: undefined;
     count?: undefined;
-    providers?: undefined;
     provider?: undefined;
+    deleted?: undefined;
+    providers?: undefined;
     found?: undefined;
     registered: boolean;
     id: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -312,8 +312,6 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         scope?: "org" | "user" | undefined;
     }, {
         id?: undefined;
-        message?: undefined;
-        provider?: undefined;
         deleted?: undefined;
         providers: {
             id: string;
@@ -325,44 +323,46 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
+        provider?: undefined;
         found?: undefined;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
         id?: undefined;
-        message?: undefined;
-        count?: undefined;
         deleted?: undefined;
+        count?: undefined;
         providers?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        count?: undefined;
-        provider?: undefined;
+    } | {
         deleted?: undefined;
+        count?: undefined;
         providers?: undefined;
+        provider?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
+    } | {
         count?: undefined;
-        provider?: undefined;
         providers?: undefined;
+        provider?: undefined;
         found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        count?: undefined;
-        provider?: undefined;
         deleted?: undefined;
+        count?: undefined;
         providers?: undefined;
+        provider?: undefined;
         found?: undefined;
         registered: boolean;
         id: string;

package/dist/scripts/agent-engines/test-agent-engine.js

@@ -2,7 +2,8 @@
  * test-agent-engine — sends a trivial prompt to verify the engine is working.
  */
 import { getAgentEngineEntry, registerBuiltinEngines, } from "../../agent/engine/index.js";
-import { normalizeOpenAiBaseUrl, OPENAI_BASE_URL_ENV_VAR, } from "../../agent/engine/openai-compatible-endpoint.js";
+import { OLLAMA_BASE_URL_ENV_VAR, OPENAI_BASE_URL_ENV_VAR, } from "../../agent/engine/openai-compatible-endpoint.js";
+import { validateProviderBaseUrl } from "../../agent/engine/provider-endpoint-validation.js";
 import { canUseDeployCredentialFallbackForRequest, readDeployCredentialEnv, resolveSecret, } from "../../server/credential-provider.js";
 export const tool = {
     description: "Test an agent engine by sending a trivial prompt and measuring latency. Useful for verifying API keys and connectivity before switching engines.",
@@ -31,13 +32,30 @@ async function resolveAgentEngineSecret(key) {
         if (value)
             return value;
     }
-    catch {
-        // Fall through to deploy env when this request is allowed to use it.
+    catch (error) {
+        if (!canUseDeployCredentialFallbackForRequest(key))
+            throw error;
+        console.warn("[test-agent-engine] Saved provider secret unavailable; using deploy configuration.", { key, error });
     }
     return canUseDeployCredentialFallbackForRequest(key)
         ? readDeployCredentialEnv(key)
         : undefined;
 }
+async function resolveAgentEngineEndpoint(key) {
+    const value = await resolveSecret(key);
+    if (value) {
+        return validateProviderBaseUrl(value, {
+            allowLocalOllama: key === OLLAMA_BASE_URL_ENV_VAR &&
+                process.env.NODE_ENV === "development",
+        });
+    }
+    if (!canUseDeployCredentialFallbackForRequest(key))
+        return undefined;
+    const deployValue = readDeployCredentialEnv(key);
+    return deployValue
+        ? validateProviderBaseUrl(deployValue, { allowPrivate: true })
+        : undefined;
+}
 function canUseDeployEnvForEntry(entry) {
     if (entry.requiredEnvVars.length === 0)
         return true;
@@ -50,13 +68,19 @@ async function createEngineConfig(entry, args) {
             : undefined,
         allowEnvFallback: canUseDeployEnvForEntry(entry),
     };
-    if (entry.name === "ai-sdk:openai") {
-        const rawBaseUrl = args.baseUrl?.trim()
-            ? args.baseUrl
-            : await resolveAgentEngineSecret(OPENAI_BASE_URL_ENV_VAR);
-        if (rawBaseUrl) {
-            config.baseUrl = normalizeOpenAiBaseUrl(rawBaseUrl);
-        }
+    if (entry.name === "ai-sdk:openai" || entry.name === "ai-sdk:ollama") {
+        const endpointKey = entry.name === "ai-sdk:ollama"
+            ? OLLAMA_BASE_URL_ENV_VAR
+            : OPENAI_BASE_URL_ENV_VAR;
+        const explicitBaseUrl = args.baseUrl?.trim();
+        const baseUrl = explicitBaseUrl
+            ? await validateProviderBaseUrl(explicitBaseUrl, {
+                allowLocalOllama: entry.name === "ai-sdk:ollama" &&
+                    process.env.NODE_ENV === "development",
+            })
+            : await resolveAgentEngineEndpoint(endpointKey);
+        if (baseUrl)
+            config.baseUrl = baseUrl;
     }
     return config;
 }

package/dist/server/agent-chat/run-code-tools.d.ts

@@ -1,7 +1,7 @@
 import type { ActionEntry } from "../../agent/production-agent.js";
 /**
  * Load the sandboxed code-execution tool entries for one action registry:
- * `run-code` plus its `get-code-execution` poll companion. The poll tool is
+ * `run-code`, bounded `tool-orchestration`, plus its `get-code-execution` poll companion. The poll tool is
  * registered ALONGSIDE run-code everywhere run-code appears, so the durable
  * background-execution guidance run-code emits ("check it with
  * get-code-execution") always points at a callable tool. Returns an empty

package/dist/server/agent-chat/run-code-tools.js

@@ -1,6 +1,6 @@
 /**
  * Load the sandboxed code-execution tool entries for one action registry:
- * `run-code` plus its `get-code-execution` poll companion. The poll tool is
+ * `run-code`, bounded `tool-orchestration`, plus its `get-code-execution` poll companion. The poll tool is
  * registered ALONGSIDE run-code everywhere run-code appears, so the durable
  * background-execution guidance run-code emits ("check it with
  * get-code-execution") always points at a callable tool. Returns an empty
@@ -13,8 +13,10 @@
 export async function loadRunCodeToolEntries(supplier, runCodeOptions) {
     try {
         const { createRunCodeEntry, createGetCodeExecutionEntry } = await import("../../coding-tools/run-code.js");
+        const { createToolOrchestrationEntry } = await import("../../coding-tools/tool-orchestration.js");
         const entries = {
             "run-code": createRunCodeEntry(supplier, runCodeOptions),
+            "tool-orchestration": createToolOrchestrationEntry(supplier),
             "get-code-execution": createGetCodeExecutionEntry(),
         };
         // Data programs: stored JS scripts executed through this same run-code

package/dist/server/agent-chat-plugin.js

@@ -876,11 +876,11 @@ export function createAgentChatPlugin(options) {
                     : rawEnvCodeExec === "off"
                         ? "off"
                         : (options?.codeExecution?.production ?? "off");
-            // Forward-declaration for the production run-code bridge supplier.
-            // Must come before createRunCodeEntry so the closure can capture it.
+            // Forward-declaration for the production code-execution bridge supplier.
+            // Must come before the code entries are created so their closures can capture it.
             let prodRunCodeToolActions = {};
             let leanRunCodeToolActions = {};
-            // Sandboxed run-code tool (+ its get-code-execution poll companion):
+            // Sandboxed run-code, bounded tool-orchestration, and get-code-execution:
             // available in "sandboxed" or "trusted" prod modes and always in dev
             // mode. See loadRunCodeToolEntries for the registration contract.
             const runCodeTool = await loadRunCodeToolEntries(
@@ -914,7 +914,7 @@ export function createAgentChatPlugin(options) {
             // Forward-declaration: populated after devActions is assembled below.
             // Must be declared before devRunCodeTool so the closure can close over it.
             let devRunCodeToolActions = {};
-            // Always register run-code (+ get-code-execution) in dev mode (when the
+            // Always register code execution (+ get-code-execution) in dev mode (when the
             // coding module loads). devActions is not yet defined at this point; we
             // use a late-binding supplier so devRunCodeTool can reference the
             // devActions registry once it is built below (see devHandler block).
@@ -2551,8 +2551,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // System-prompt note appended when production code execution is enabled.
             const prodCodeExecPromptNote = !canToggle && resolvedProdCodeExec !== "off"
                 ? resolvedProdCodeExec === "trusted"
-                    ? "\n\n<code-execution-mode>Full shell access is enabled (trusted mode). You have bash, read, edit, write, and run-code tools available. Use bash for file discovery, running tests and builds, and project CLIs. Use run-code for sandboxed JavaScript data processing: provider/API pagination, joins, classification, aggregation, and large-response reduction. Use `pnpm action <name>` in bash to invoke registered app actions from the shell.</code-execution-mode>"
-                    : "\n\n<code-execution-mode>Sandboxed code execution is enabled. The run-code tool lets you execute isolated JavaScript (ESM, top-level await) to fetch, aggregate, and reduce data. Use providerFetch(), providerFetchAll(), providerRequest(), webRead(), and webFetch() inside run-code for authenticated provider calls and compact web/document reduction.</code-execution-mode>"
+                    ? "\n\n<code-execution-mode>Full shell access is enabled (trusted mode). You have bash, read, edit, write, and run-code tools available. Use bash for file discovery, running tests and builds, and project CLIs. Use run-code for sandboxed JavaScript data processing: provider/API pagination, joins, classification, aggregation, and large-response reduction. Use tool-orchestration for short bounded fan-out or reduction over read-only tools. Use `pnpm action <name>` in bash to invoke registered app actions from the shell.</code-execution-mode>"
+                    : "\n\n<code-execution-mode>Sandboxed code execution is enabled. Use tool-orchestration for short bounded fan-out, joins, and reduction over read-only tools. Use run-code when you need its broader provider/web helpers, workspace staging, or durable background execution. In either tool, authenticated calls go through the provided host globals and results should be reduced before printing.</code-execution-mode>"
                 : "";
             const prodHandler = createProductionAgentHandler({
                 actions: leanPrompt ? leanActions : prodActions,

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-api-key-route.js

@@ -1,6 +1,7 @@
 import { defineEventHandler, getMethod, setResponseStatus, } from "h3";
 import { normalizeOpenAiBaseUrl } from "../agent/engine/openai-compatible-endpoint.js";
-import { OPENAI_BASE_URL_ENV_VAR, PROVIDER_ENV_META, } from "../agent/engine/provider-env-vars.js";
+import { validateProviderBaseUrl } from "../agent/engine/provider-endpoint-validation.js";
+import { OLLAMA_BASE_URL_ENV_VAR, OPENAI_BASE_URL_ENV_VAR, PROVIDER_ENV_META, } from "../agent/engine/provider-env-vars.js";
 import { getOrgContext } from "../org/context.js";
 import { deleteAppSecret, writeAppSecret } from "../secrets/storage.js";
 import { getSession } from "./auth.js";
@@ -11,15 +12,23 @@ const PROVIDER_TO_ENV_VAR = new Map(Object.entries(PROVIDER_ENV_META).map(([prov
     meta.envVar,
 ]));
 const PROVIDER_ENV_VAR_KEYS = new Set(PROVIDER_TO_ENV_VAR.values());
+const BASE_URL_KEYS = new Set([
+    OPENAI_BASE_URL_ENV_VAR,
+    OLLAMA_BASE_URL_ENV_VAR,
+]);
+const OPENAI_PROVIDER_KEY = PROVIDER_TO_ENV_VAR.get("openai") ?? "";
 export function normalizeAgentEngineApiKeyPayload(body) {
     const payload = body && typeof body === "object" ? body : {};
     const raw = payload;
+    const provider = typeof raw.provider === "string" ? raw.provider.trim() : "";
     const key = typeof raw.key === "string"
         ? raw.key.trim()
-        : typeof raw.provider === "string"
-            ? (PROVIDER_TO_ENV_VAR.get(raw.provider.trim()) ?? "")
-            : "";
-    if (!key || !PROVIDER_ENV_VAR_KEYS.has(key)) {
+        : provider === "ollama"
+            ? OLLAMA_BASE_URL_ENV_VAR
+            : provider
+                ? (PROVIDER_TO_ENV_VAR.get(provider) ?? "")
+                : "";
+    if (!key || (!PROVIDER_ENV_VAR_KEYS.has(key) && !BASE_URL_KEYS.has(key))) {
         return {
             ok: false,
             statusCode: 400,
@@ -38,11 +47,11 @@ export function normalizeAgentEngineApiKeyPayload(body) {
             : "";
     let baseUrl;
     if (rawBaseUrl.trim()) {
-        if (key !== PROVIDER_TO_ENV_VAR.get("openai")) {
+        if (key !== OPENAI_PROVIDER_KEY && !BASE_URL_KEYS.has(key)) {
             return {
                 ok: false,
                 statusCode: 400,
-                error: "Endpoint URL is only supported for OpenAI.",
+                error: "Endpoint URL is only supported for OpenAI or Ollama.",
             };
         }
         try {
@@ -57,11 +66,11 @@ export function normalizeAgentEngineApiKeyPayload(body) {
         }
     }
     const clearBaseUrl = raw.clearBaseUrl === true && baseUrl == null;
-    if (clearBaseUrl && key !== PROVIDER_TO_ENV_VAR.get("openai")) {
+    if (clearBaseUrl && key !== OPENAI_PROVIDER_KEY && !BASE_URL_KEYS.has(key)) {
         return {
             ok: false,
             statusCode: 400,
-            error: "Endpoint URL is only supported for OpenAI.",
+            error: "Endpoint URL is only supported for OpenAI or Ollama.",
         };
     }
     if (!value && !baseUrl && !clearBaseUrl) {
@@ -130,6 +139,20 @@ export function createAgentEngineApiKeyHandler() {
             setResponseStatus(event, resolved.statusCode);
             return { error: resolved.error };
         }
+        if (payload.baseUrl) {
+            try {
+                await validateProviderBaseUrl(payload.baseUrl, {
+                    allowLocalOllama: payload.key === OLLAMA_BASE_URL_ENV_VAR &&
+                        process.env.NODE_ENV === "development",
+                });
+            }
+            catch (err) {
+                setResponseStatus(event, 400);
+                return {
+                    error: err instanceof Error ? err.message : String(err),
+                };
+            }
+        }
         if (payload.value) {
             await writeAppSecret({
                 key: payload.key,
@@ -144,7 +167,9 @@ export function createAgentEngineApiKeyHandler() {
         }
         if (payload.baseUrl) {
             await writeAppSecret({
-                key: OPENAI_BASE_URL_ENV_VAR,
+                key: payload.key === OLLAMA_BASE_URL_ENV_VAR
+                    ? OLLAMA_BASE_URL_ENV_VAR
+                    : OPENAI_BASE_URL_ENV_VAR,
                 value: payload.baseUrl,
                 scope: resolved.target.scope,
                 scopeId: resolved.target.scopeId,
@@ -152,7 +177,9 @@ export function createAgentEngineApiKeyHandler() {
         }
         else if (payload.clearBaseUrl) {
             await deleteAppSecret({
-                key: OPENAI_BASE_URL_ENV_VAR,
+                key: payload.key === OLLAMA_BASE_URL_ENV_VAR
+                    ? OLLAMA_BASE_URL_ENV_VAR
+                    : OPENAI_BASE_URL_ENV_VAR,
                 scope: resolved.target.scope,
                 scopeId: resolved.target.scopeId,
             });
@@ -161,7 +188,11 @@ export function createAgentEngineApiKeyHandler() {
             ok: true,
             key: payload.key,
             ...(payload.baseUrl || payload.clearBaseUrl
-                ? { baseUrlKey: OPENAI_BASE_URL_ENV_VAR }
+                ? {
+                    baseUrlKey: payload.key === OLLAMA_BASE_URL_ENV_VAR
+                        ? OLLAMA_BASE_URL_ENV_VAR
+                        : OPENAI_BASE_URL_ENV_VAR,
+                }
                 : {}),
             scope: resolved.target.scope,
         };

package/dist/server/agents-bundle.js

@@ -293,8 +293,9 @@ export function readAgentsBundleFromFs(cwd, workspaceSource = null, options = {}
         try {
             readNestedSkillsDir(skillsDir, cwd, skills);
         }
-        catch {
+        catch (error) {
             // Optional host-provided skills must not make the coding session fail.
+            console.warn("[agents-bundle] Failed to load optional host-provided skills", { skillsDir, error });
         }
     }
     return {

package/dist/server/auth.js

@@ -1678,11 +1678,27 @@ async function createAutoDevAccountForSession(auth, db) {
 function isHostedPreviewRequest(event) {
     const host = getRequestHost(event)?.split(",")[0]?.trim().toLowerCase() ?? "";
     return (host.endsWith(".agent-native.com") ||
-        host.endsWith(".builderio.xyz") ||
+        isBuilderPreviewHost(host) ||
+        host.includes("deploy-preview"));
+}
+const BUILDER_PREVIEW_LOCAL_DEV_ENV = "AGENT_NATIVE_ALLOW_BUILDER_PREVIEW_LOCAL_DEV";
+function isBuilderPreviewHost(host) {
+    return (host.endsWith(".builderio.xyz") ||
         host.endsWith(".builderio.dev") ||
         host.endsWith(".builder.codes") ||
-        host.endsWith(".builder.my") ||
-        host.includes("deploy-preview"));
+        host.endsWith(".builder.my"));
+}
+function isBuilderPreviewLocalDevEnabled() {
+    const value = process.env[BUILDER_PREVIEW_LOCAL_DEV_ENV]
+        ?.trim()
+        .toLowerCase();
+    return value === "1" || value === "true";
+}
+function isBuilderPreviewLocalDevRequest(event) {
+    if (!isBuilderPreviewLocalDevEnabled())
+        return false;
+    const host = getRequestHost(event)?.split(",")[0]?.trim().toLowerCase() ?? "";
+    return isBuilderPreviewHost(host);
 }
 export function isLocalDevAuthAllowed(event) {
     const deployPreview = typeof isDeployPreview === "function" && isDeployPreview();
@@ -1690,8 +1706,8 @@ export function isLocalDevAuthAllowed(event) {
         !deployPreview &&
         !isAuthDisabled() &&
         process.env.AGENT_NATIVE_DISABLE_AUTO_DEV_ACCOUNT !== "1" &&
-        !isHostedPreviewRequest(event) &&
-        isLoopbackRequest(event));
+        ((!isHostedPreviewRequest(event) && isLoopbackRequest(event)) ||
+            isBuilderPreviewLocalDevRequest(event)));
 }
 async function createOrReuseAutoDevSession(auth, config) {
     let session = await createBetterAuthSessionForEmail(AUTO_DEV_ACCOUNT_EMAIL, config);

package/dist/server/credential-provider.js

@@ -134,6 +134,7 @@ const APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([
     "EMAIL_AGENT_ADDRESS",
     "OPENAI_API_KEY",
     "OPENAI_BASE_URL",
+    "OLLAMA_BASE_URL",
     "OPENROUTER_API_KEY",
     "GOOGLE_CLIENT_ID",
     "GOOGLE_CLIENT_SECRET",

package/dist/server/design-token-utils.d.ts

@@ -22,6 +22,22 @@ export declare const SECONDARY_PATHS: string[];
 export declare const CODE_MAX_FILES = 20;
 /** Maximum total bytes accepted in import-code. */
 export declare const CODE_MAX_TOTAL_BYTES: number;
+export interface CodeAnalysisFile {
+    filename: string;
+    content: string;
+}
+export interface CodeAnalysisResult {
+    source: "code";
+    fileCount: number;
+    filesAnalyzed: string[];
+    colors: Record<string, string>;
+    cssCustomProperties: Record<string, string>;
+    fonts: CodeAnalysisState["fonts"];
+    spacing: CodeAnalysisState["spacing"];
+    borderRadius: CodeAnalysisState["borderRadius"];
+    stylingFramework: CodeAnalysisState["stylingFramework"];
+    rawExtracts: CodeAnalysisState["rawExtracts"];
+}
 /** Regex for hex colors (3-8 digit, including alpha). */
 export declare const HEX_COLOR_RE: RegExp;
 /** Regex for well-known named CSS colors. */
@@ -140,6 +156,8 @@ export declare function analyzePackageJson(state: CodeAnalysisState, content: st
 export declare function analyzeThemeSourceFile(state: CodeAnalysisState, content: string, filename: string): void;
 /** Route a file to the correct analyzer based on filename. */
 export declare function analyzeCodeFile(state: CodeAnalysisState, filename: string, content: string): void;
+/** Analyze the bounded code-file payload accepted by the import-code actions. */
+export declare function analyzeCodeFiles(files: CodeAnalysisFile[]): CodeAnalysisResult;
 /** Deduplicate and trim an array of strings. */
 export declare function unique(arr: string[]): string[];
 /** Extract hex and named colors from plain text. */

package/dist/server/design-token-utils.js

@@ -595,6 +595,37 @@ export function analyzeCodeFile(state, filename, content) {
         }
     }
 }
+/** Analyze the bounded code-file payload accepted by the import-code actions. */
+export function analyzeCodeFiles(files) {
+    const truncated = files.slice(0, CODE_MAX_FILES);
+    let totalBytes = 0;
+    const accepted = [];
+    for (const file of truncated) {
+        const size = new TextEncoder().encode(file.content).byteLength;
+        if (totalBytes + size > CODE_MAX_TOTAL_BYTES)
+            break;
+        totalBytes += size;
+        accepted.push(file);
+    }
+    const state = createCodeAnalysisState();
+    const filesAnalyzed = [];
+    for (const file of accepted) {
+        filesAnalyzed.push(file.filename);
+        analyzeCodeFile(state, file.filename, file.content);
+    }
+    return {
+        source: "code",
+        fileCount: accepted.length,
+        filesAnalyzed,
+        colors: Object.fromEntries(Object.entries(state.colors).slice(0, 60)),
+        cssCustomProperties: Object.fromEntries(Object.entries(state.cssCustomProperties).slice(0, 80)),
+        fonts: state.fonts.slice(0, 20),
+        spacing: state.spacing,
+        borderRadius: state.borderRadius,
+        stylingFramework: state.stylingFramework,
+        rawExtracts: state.rawExtracts,
+    };
+}
 // ---------------------------------------------------------------------------
 // Document analysis helpers (import-document)
 // ---------------------------------------------------------------------------

package/dist/server/onboarding-html.js

@@ -47,6 +47,17 @@ function withAppBasePath(path) {
 }
 const AGENT_NATIVE_TERMS_URL = "https://www.agent-native.com/terms";
 const AGENT_NATIVE_PRIVACY_URL = "https://www.agent-native.com/privacy";
+const BUILDER_PREVIEW_LOCAL_DEV_ENV = "AGENT_NATIVE_ALLOW_BUILDER_PREVIEW_LOCAL_DEV";
+function isBuilderPreviewLocalDevEnabled() {
+    if (process.env.NODE_ENV !== "development" &&
+        process.env.NODE_ENV !== "test") {
+        return false;
+    }
+    const value = process.env[BUILDER_PREVIEW_LOCAL_DEV_ENV]
+        ?.trim()
+        .toLowerCase();
+    return value === "1" || value === "true";
+}
 const EN_AUTH_COPY = {
     languageLabel: "Language",
     systemLanguage: "System",
@@ -1296,6 +1307,7 @@ export function getOnboardingHtml(opts = {}) {
     const publicOAuthOrigin = getPublicOAuthOrigin();
     const workspaceGatewayReturnOrigin = getWorkspaceGatewayReturnOrigin();
     const googleAuthMode = resolveGoogleAuthMode(opts.googleAuthMode);
+    const builderPreviewLocalDevEnabled = isBuilderPreviewLocalDevEnabled();
     const localeInitScript = getLocaleInitScript();
     const marketing = opts.marketing ??
         resolveBuiltInAuthMarketing({
@@ -2828,6 +2840,7 @@ ${signInJourneyInlineScript()}
     var __AN_PUBLIC_OAUTH_ORIGIN = ${JSON.stringify(publicOAuthOrigin)};
     var __AN_WORKSPACE_GATEWAY_RETURN_ORIGIN = ${JSON.stringify(workspaceGatewayReturnOrigin)};
     var __AN_GOOGLE_AUTH_MODE = ${JSON.stringify(googleAuthMode)};
+    var __AN_BUILDER_PREVIEW_LOCAL_DEV_ENABLED = ${JSON.stringify(builderPreviewLocalDevEnabled)};
     function __anConfiguredOAuthOrigin() {
       if (!__AN_PUBLIC_OAUTH_ORIGIN) return '';
       try {
@@ -2957,8 +2970,15 @@ ${signInJourneyInlineScript()}
       var hostname = (window.location.hostname || '').toLowerCase();
       return hostname === 'localhost' || hostname === '::1' || hostname === '127.0.0.1' || hostname.indexOf('127.') === 0;
     }
+    function __anIsBuilderPreviewHost() {
+      var hostname = (window.location.hostname || '').toLowerCase();
+      return hostname.endsWith('.builderio.xyz') || hostname.endsWith('.builderio.dev') || hostname.endsWith('.builder.codes') || hostname.endsWith('.builder.my');
+    }
+    function __anCanUseLocalDevSignin() {
+      return __anIsLoopbackHostname() || (__AN_BUILDER_PREVIEW_LOCAL_DEV_ENABLED && __anIsBuilderPreviewHost());
+    }
     function __anShouldStartWithLocalDev() {
-      if (!__anIsLoopbackHostname()) return false;
+      if (!__anCanUseLocalDevSignin()) return false;
       var params = new URLSearchParams(window.location.search);
       var explicitTab = params.get('tab');
       var verifiedRedirect = typeof __anIsVerifiedRedirectSuccess === 'function' && __anIsVerifiedRedirectSuccess();
@@ -2981,7 +3001,7 @@ ${signInJourneyInlineScript()}
       var button = document.getElementById('local-dev-btn');
       var fullOptionsButton = document.getElementById('local-dev-full-options');
       var message = document.getElementById('local-dev-msg');
-      if (!container || !button || !__anIsLoopbackHostname()) return;
+      if (!container || !button || !__anCanUseLocalDevSignin()) return;
       container.hidden = false;
       var startWithLocalDev = __anShouldStartWithLocalDev();
       __anSetFullAuthOptionsVisible(!startWithLocalDev);

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;