@agent-native/core 0.152.1 → 0.153.1

package/dist/server/builder-browser.js

@@ -1,13 +1,16 @@
 import { createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
 import { getHeader } from "h3";
+import { getSetting } from "../settings/store.js";
 import { applyBuilderUtmTrackingParams } from "../shared/builder-link-tracking.js";
 import { getAuthSecret, resolveSignupTrackingIdentity, } from "./better-auth-instance.js";
 import { getAppBasePath, getOrigin } from "./google-oauth.js";
+import { getRequestOrgId, getRequestUserEmail } from "./request-context.js";
 const DEFAULT_BUILDER_APP_HOST = "https://builder.io";
 const DEFAULT_BUILDER_API_HOST = "https://api.builder.io";
 const BUILDER_API_REQUEST_TIMEOUT_MS = 30_000;
 const BUILDER_BROWSER_HOST = "agent-native-browser";
 const BUILDER_BROWSER_CLIENT_ID = "Agent Native Browser";
+const DISPATCH_APP_CREATION_SETTINGS_KEY = "dispatch-app-creation-settings";
 export const BUILDER_CALLBACK_PATH = "/_agent-native/builder/callback";
 export const BUILDER_RELAY_PATH = "/_agent-native/builder/relay";
 export const BUILDER_RELAY_STATE_PARAM = "_an_relay";
@@ -565,7 +568,35 @@ export function getBuilderBranchProjectId() {
 export function isBuilderBranchingEnabled() {
     return !!getConfiguredBuilderBranchProjectId();
 }
+async function resolveDispatchBuilderProjectId() {
+    const orgId = getRequestOrgId()?.trim();
+    const userEmail = orgId ? undefined : getRequestUserEmail()?.trim();
+    const scopedKey = orgId
+        ? `${DISPATCH_APP_CREATION_SETTINGS_KEY}:org:${orgId}`
+        : userEmail
+            ? `${DISPATCH_APP_CREATION_SETTINGS_KEY}:user:${userEmail}`
+            : null;
+    if (!scopedKey)
+        return { status: "absent" };
+    try {
+        const setting = await getSetting(scopedKey);
+        if (setting === null)
+            return { status: "absent" };
+        const projectId = typeof setting.builderProjectId === "string"
+            ? setting.builderProjectId.trim()
+            : "";
+        return { status: "present", projectId: projectId || null };
+    }
+    catch {
+        return { status: "unreadable" };
+    }
+}
 export async function resolveBuilderBranchProjectId() {
+    const dispatchProject = await resolveDispatchBuilderProjectId();
+    if (dispatchProject.status === "unreadable")
+        return "";
+    if (dispatchProject.status === "present")
+        return dispatchProject.projectId ?? "";
     const envProjectId = getConfiguredBuilderBranchProjectId();
     if (envProjectId)
         return envProjectId;

package/dist/server/magic-link-attribution.d.ts

@@ -0,0 +1,21 @@
+/** Query parameter carried by Better Auth's new-user callback URL. */
+export declare const MAGIC_LINK_ATTRIBUTION_PARAM = "signup_attribution";
+export interface MagicLinkSignupAttribution {
+    attribution?: Record<string, string>;
+    anonymousId?: string;
+}
+/**
+ * Sign the attribution captured when a magic link is requested. The token is
+ * analytics context only; it never authorizes the user or changes the return
+ * URL. The Better Auth secret keeps the callback from accepting forged data.
+ */
+export declare function encodeMagicLinkSignupAttribution(value: MagicLinkSignupAttribution, secret: string, now?: number): string | undefined;
+/** Verify and decode a token previously produced by
+ * {@link encodeMagicLinkSignupAttribution}. */
+export declare function decodeMagicLinkSignupAttribution(token: string | null | undefined, secret: string, now?: number): MagicLinkSignupAttribution | null | undefined;
+/**
+ * Read the signed handoff from Better Auth's magic-link verification request.
+ * Better Auth copies `newUserCallbackURL` into the verification URL, so this
+ * remains available even when the link is opened on another device.
+ */
+export declare function readMagicLinkSignupAttribution(requestUrl: string | undefined, secret: string, now?: number): MagicLinkSignupAttribution | null | undefined;

package/dist/server/magic-link-attribution.js

@@ -0,0 +1,115 @@
+import crypto from "node:crypto";
+import { normalizeAnalyticsAnonymousId } from "../shared/analytics-anonymous-id.js";
+/** Query parameter carried by Better Auth's new-user callback URL. */
+export const MAGIC_LINK_ATTRIBUTION_PARAM = "signup_attribution";
+/** Better Auth's magic-link token is valid for five minutes; keep this handoff
+ * slightly longer so clock skew does not discard a still-valid link. */
+const MAGIC_LINK_ATTRIBUTION_TTL_SECONDS = 10 * 60;
+const MAX_ATTRIBUTION_FIELDS = 32;
+const MAX_ATTRIBUTION_VALUE_LENGTH = 200;
+function sanitizeAttribution(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    const out = {};
+    for (const [key, raw] of Object.entries(value).slice(0, MAX_ATTRIBUTION_FIELDS)) {
+        if (!/^[a-z][a-z0-9_]{0,63}$/.test(key) ||
+            typeof raw !== "string" ||
+            raw.length === 0) {
+            continue;
+        }
+        out[key] = raw.slice(0, MAX_ATTRIBUTION_VALUE_LENGTH);
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function encodePayload(payload) {
+    return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+/**
+ * Sign the attribution captured when a magic link is requested. The token is
+ * analytics context only; it never authorizes the user or changes the return
+ * URL. The Better Auth secret keeps the callback from accepting forged data.
+ */
+export function encodeMagicLinkSignupAttribution(value, secret, now = Date.now()) {
+    if (!secret)
+        return undefined;
+    const attribution = sanitizeAttribution(value.attribution);
+    const anonymousId = normalizeAnalyticsAnonymousId(value.anonymousId);
+    if (!attribution && !anonymousId)
+        return undefined;
+    const payload = {
+        exp: Math.floor(now / 1000) + MAGIC_LINK_ATTRIBUTION_TTL_SECONDS,
+        ...(attribution ? { attribution } : {}),
+        ...(anonymousId ? { anonymousId } : {}),
+    };
+    const data = encodePayload(payload);
+    const signature = crypto
+        .createHmac("sha256", secret)
+        .update(data)
+        .digest("base64url");
+    return `${data}.${signature}`;
+}
+/** Verify and decode a token previously produced by
+ * {@link encodeMagicLinkSignupAttribution}. */
+export function decodeMagicLinkSignupAttribution(token, secret, now = Date.now()) {
+    if (token === null || token === undefined)
+        return undefined;
+    if (!token || !secret)
+        return null;
+    try {
+        const dotIndex = token.lastIndexOf(".");
+        if (dotIndex <= 0 || dotIndex === token.length - 1)
+            return null;
+        const data = token.slice(0, dotIndex);
+        const signature = token.slice(dotIndex + 1);
+        const expected = crypto
+            .createHmac("sha256", secret)
+            .update(data)
+            .digest("base64url");
+        if (signature.length !== expected.length ||
+            !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
+            return null;
+        }
+        const payload = JSON.parse(Buffer.from(data, "base64url").toString("utf8"));
+        if (typeof payload.exp !== "number" ||
+            payload.exp < Math.floor(now / 1000)) {
+            return null;
+        }
+        const attribution = sanitizeAttribution(payload.attribution);
+        const anonymousId = normalizeAnalyticsAnonymousId(payload.anonymousId);
+        if (!attribution && !anonymousId)
+            return undefined;
+        return {
+            ...(attribution ? { attribution } : {}),
+            ...(anonymousId ? { anonymousId } : {}),
+        };
+    }
+    catch {
+        // coercion-ok: malformed signed input is distinct from absent context.
+        return null;
+    }
+}
+/**
+ * Read the signed handoff from Better Auth's magic-link verification request.
+ * Better Auth copies `newUserCallbackURL` into the verification URL, so this
+ * remains available even when the link is opened on another device.
+ */
+export function readMagicLinkSignupAttribution(requestUrl, secret, now = Date.now()) {
+    if (!requestUrl)
+        return undefined;
+    try {
+        const verificationUrl = new URL(requestUrl, "http://localhost");
+        if (!verificationUrl.pathname.endsWith("/magic-link/verify")) {
+            return undefined;
+        }
+        const callback = verificationUrl.searchParams.get("newUserCallbackURL");
+        if (!callback)
+            return undefined;
+        const callbackUrl = new URL(callback, verificationUrl.origin);
+        return decodeMagicLinkSignupAttribution(callbackUrl.searchParams.get(MAGIC_LINK_ATTRIBUTION_PARAM), secret, now);
+    }
+    catch {
+        // coercion-ok: malformed request input is distinct from absent context.
+        return null;
+    }
+}

package/dist/server/onboarding-html.js

@@ -4058,7 +4058,7 @@ ${runLocalCommand || signupLocalModeNote
   function __anCopySignupLocalModeCommand() {
     __anCopyCommandFromPanel('signup-local-mode-note', 'copy-signup-local-mode');
   }
-  }`
+  `
         : ""}
 </script>
 </body>

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;

package/dist/server/workspace-provider-oauth.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import { deleteCookie, defineEventHandler, getCookie, getMethod, getQuery, setCookie, setResponseStatus, } from "h3";
 import { getWorkspaceConnectionProvider, } from "../connections/catalog.js";
 import { saveOAuthTokens, setOAuthDisplayName } from "../oauth-tokens/store.js";
+import { getRegisteredAppRoles, resolveAppRole } from "../org/app-roles.js";
 import { getOrgContext } from "../org/context.js";
 import { decryptSecretValue, encryptSecretValue } from "../secrets/crypto.js";
 import { listWorkspaceConnections, upsertWorkspaceConnection, upsertWorkspaceConnectionGrant, } from "../workspace-connections/store.js";
@@ -24,6 +25,7 @@ const PROVIDER_REQUEST_TIMEOUT_MS = 10_000;
 const PROVIDER_RESPONSE_MAX_BYTES = 256 * 1024;
 const SALESFORCE_PRODUCTION_LOGIN_URL = "https://login.salesforce.com";
 const SALESFORCE_SANDBOX_LOGIN_URL = "https://test.salesforce.com";
+const WORKSPACE_OAUTH_ADMIN_ERROR = "Only organization admins or the relevant app admin can connect shared OAuth accounts.";
 export function workspaceProviderOAuthPath(provider, phase) {
     return `/_agent-native/connections/oauth/${provider}/${phase}`;
 }
@@ -41,21 +43,21 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
     const session = await getSession(event).catch(() => null);
     if (!session?.email)
         return unauthorized(event);
-    const orgContext = await requireWorkspaceProviderOAuthAdmin(event);
+    const query = getQuery(event);
+    const appId = normalizeAppId(text(query.appId) ??
+        process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??
+        process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID ??
+        "creative-context");
+    const orgContext = await requireWorkspaceProviderOAuthAdmin(event, appId);
     if (!orgContext) {
-        return {
-            error: "Only organization owners and admins can connect shared OAuth accounts.",
-        };
+        return { error: WORKSPACE_OAUTH_ADMIN_ERROR };
     }
     const orgId = orgContext.orgId;
     if (!orgId) {
         setResponseStatus(event, 403);
-        return {
-            error: "Only organization owners and admins can connect shared OAuth accounts.",
-        };
+        return { error: WORKSPACE_OAUTH_ADMIN_ERROR };
     }
     const provider = requiredProvider(providerId);
-    const query = getQuery(event);
     const salesforceLoginUrl = providerId === "salesforce"
         ? resolveSalesforceOAuthLoginUrl(text(query.environment))
         : undefined;
@@ -63,10 +65,6 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
         setResponseStatus(event, 400);
         return { error: "Salesforce environment must be production or sandbox." };
     }
-    const appId = normalizeAppId(text(query.appId) ??
-        process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??
-        process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID ??
-        "creative-context");
     const redirectUri = resolveOAuthRedirectUri(event, workspaceProviderOAuthPath(providerId, "callback"));
     if (!redirectUri) {
         setResponseStatus(event, 400);
@@ -137,18 +135,15 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
     const session = await getSession(event).catch(() => null);
     if (!session?.email)
         return unauthorized(event);
-    const orgContext = await requireWorkspaceProviderOAuthAdmin(event);
+    const flow = readStoredFlow(event, providerId);
+    const orgContext = await requireWorkspaceProviderOAuthAdmin(event, flow?.appId);
     if (!orgContext) {
-        return {
-            error: "Only organization owners and admins can connect shared OAuth accounts.",
-        };
+        return { error: WORKSPACE_OAUTH_ADMIN_ERROR };
     }
     const orgId = orgContext.orgId;
     if (!orgId) {
         setResponseStatus(event, 403);
-        return {
-            error: "Only organization owners and admins can connect shared OAuth accounts.",
-        };
+        return { error: WORKSPACE_OAUTH_ADMIN_ERROR };
     }
     const query = getQuery(event);
     const code = text(query.code);
@@ -162,7 +157,6 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
         setResponseStatus(event, 400);
         return { error: "OAuth callback is missing code or state." };
     }
-    const flow = readStoredFlow(event, providerId);
     deleteCookie(event, flowCookieName(providerId), { path: "/" });
     const state = decodeOAuthState(stateParam, "");
     if (!flow ||
@@ -211,7 +205,9 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
             const accountId = scopedOAuthAccountId(providerId, session.email, identity.accountId);
             await saveOAuthTokens(provider.oauth.provider, accountId, tokens, session.email);
             await setOAuthDisplayName(provider.oauth.provider, accountId, identity.label);
-            const existing = existingConnections.find((connection) => connection.accountId === accountId);
+            const existing = existingConnections.find((connection) => connection.accountId === accountId &&
+                (orgContext.oauthScope === "organization" ||
+                    connection.allowedApps.some((allowedApp) => allowedApp.toLowerCase() === flow.appId.toLowerCase())));
             const scopes = mergeWorkspaceOAuthValues(existing?.scopes ?? [], identity.scopes ?? tokenScopes(tokens, provider.oauth.scopes));
             const connectionConfig = {
                 credentialMode: "oauth",
@@ -235,7 +231,8 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
                 accountLabel: identity.label,
                 status: "connected",
                 scopes,
-                allowedApps: existing?.allowedApps ?? [],
+                allowedApps: existing?.allowedApps ??
+                    (orgContext.oauthScope === "app" ? [flow.appId] : []),
                 config: connectionConfig,
                 lastCheckedAt: new Date(),
                 lastError: null,
@@ -822,12 +819,27 @@ function unauthorized(event) {
     setResponseStatus(event, 401);
     return { error: "Authentication required" };
 }
-async function requireWorkspaceProviderOAuthAdmin(event) {
+async function requireWorkspaceProviderOAuthAdmin(event, appId) {
     const context = await getOrgContext(event).catch(() => null);
-    if (!context ||
-        !canConnectWorkspaceProviderOAuth(context.orgId, context.role)) {
+    if (!context || !context.orgId) {
         setResponseStatus(event, 403);
         return null;
     }
-    return context;
+    if (canConnectWorkspaceProviderOAuth(context.orgId, context.role)) {
+        return { ...context, oauthScope: "organization" };
+    }
+    if (appId) {
+        const descriptor = getRegisteredAppRoles(appId);
+        if (descriptor?.roles.some((role) => role === "admin")) {
+            const role = await resolveAppRole(descriptor, {
+                userEmail: context.email,
+                orgId: context.orgId,
+            });
+            if (role.status === "assigned" && role.role === "admin") {
+                return { ...context, oauthScope: "app" };
+            }
+        }
+    }
+    setResponseStatus(event, 403);
+    return null;
 }

package/dist/setup-connections/index.d.ts

@@ -1,5 +1,5 @@
 export { registerOnboardingStep, listOnboardingSteps, createOnboardingPlugin, defaultOnboardingPlugin, registerDefaultOnboardingSteps, type OnboardingFormField, type OnboardingMethod, type OnboardingMethodBadge, type OnboardingPluginOptions, type OnboardingStep, type OnboardingStepStatus, } from "../onboarding/index.js";
 export { deleteAppSecret, getAppSecretMeta, getRequiredSecret, last4, listAppSecretsForScope, listRequiredSecrets, maybeRegisterSecretOnboardingStep, readAppSecret, readAppSecretMeta, registerRequiredSecret, resolveKeyReferences, validateUrlAllowlist, writeAppSecret, type ReadSecretResult, type RegisteredSecret, type SecretKind, type SecretMeta, type SecretRef, type SecretScope, type SecretValidator, type ValidatorResult, type WriteSecretArgs, } from "../secrets/index.js";
 export { WORKSPACE_CONNECTION_PROVIDERS, defineWorkspaceConnectionProvider, getWorkspaceConnectionProvider, isWorkspaceConnectionProviderId, listWorkspaceConnectionProviders, listWorkspaceConnectionProvidersForCapability, listWorkspaceConnectionProvidersForTemplate, mergeWorkspaceConnectionProviders, workspaceConnectionProviderSupports, type ListWorkspaceConnectionProvidersOptions, type WorkspaceConnectionCapability, type WorkspaceConnectionCredentialKey, type WorkspaceConnectionProvider, type WorkspaceConnectionProviderId, type WorkspaceConnectionTemplateUse, } from "../connections/index.js";
-export { deleteWorkspaceConnection, getWorkspaceConnection, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionCredentialForApp, resolveWorkspaceConnectionCredentialsForApp, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnection, upsertWorkspaceConnectionGrant, type ListWorkspaceConnectionProviderCatalogForAppOptions, type ResolvedWorkspaceConnectionForApp, type ResolveWorkspaceConnectionForAppOptions, type SerializedWorkspaceConnection, type SerializedWorkspaceConnectionGrant, type SummarizeWorkspaceConnectionProviderReadinessOptions, type UpsertWorkspaceConnectionGrantInput, type UpsertWorkspaceConnectionInput, type WorkspaceConnection, type WorkspaceConnectionForAppSummary, type WorkspaceConnectionGrant, type WorkspaceConnectionProviderCatalogForApp, type WorkspaceConnectionProviderCatalogForAppItem, type WorkspaceConnectionProviderReadiness, type WorkspaceConnectionProviderReadinessStatus, } from "../workspace-connections/index.js";
+export { deleteWorkspaceConnection, getWorkspaceConnection, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, normalizeWorkspaceConnectionAllowedUsers, resolveWorkspaceConnectionCredentialForApp, resolveWorkspaceConnectionCredentialsForApp, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnection, upsertWorkspaceConnectionGrant, type ListWorkspaceConnectionProviderCatalogForAppOptions, type ResolvedWorkspaceConnectionForApp, type ResolveWorkspaceConnectionForAppOptions, type SerializedWorkspaceConnection, type SerializedWorkspaceConnectionGrant, type SummarizeWorkspaceConnectionProviderReadinessOptions, type UpsertWorkspaceConnectionGrantInput, type UpsertWorkspaceConnectionInput, type WorkspaceConnection, type WorkspaceConnectionForAppSummary, type WorkspaceConnectionGrant, type WorkspaceConnectionProviderCatalogForApp, type WorkspaceConnectionProviderCatalogForAppItem, type WorkspaceConnectionProviderReadiness, type WorkspaceConnectionProviderReadinessStatus, } from "../workspace-connections/index.js";
 export { registerWorkspaceConnectionOnboardingStep, type RegisterWorkspaceConnectionOnboardingStepOptions, } from "./onboarding.js";

package/dist/setup-connections/index.js

@@ -1,5 +1,5 @@
 export { registerOnboardingStep, listOnboardingSteps, createOnboardingPlugin, defaultOnboardingPlugin, registerDefaultOnboardingSteps, } from "../onboarding/index.js";
 export { deleteAppSecret, getAppSecretMeta, getRequiredSecret, last4, listAppSecretsForScope, listRequiredSecrets, maybeRegisterSecretOnboardingStep, readAppSecret, readAppSecretMeta, registerRequiredSecret, resolveKeyReferences, validateUrlAllowlist, writeAppSecret, } from "../secrets/index.js";
 export { WORKSPACE_CONNECTION_PROVIDERS, defineWorkspaceConnectionProvider, getWorkspaceConnectionProvider, isWorkspaceConnectionProviderId, listWorkspaceConnectionProviders, listWorkspaceConnectionProvidersForCapability, listWorkspaceConnectionProvidersForTemplate, mergeWorkspaceConnectionProviders, workspaceConnectionProviderSupports, } from "../connections/index.js";
-export { deleteWorkspaceConnection, getWorkspaceConnection, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionCredentialForApp, resolveWorkspaceConnectionCredentialsForApp, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnection, upsertWorkspaceConnectionGrant, } from "../workspace-connections/index.js";
+export { deleteWorkspaceConnection, getWorkspaceConnection, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, normalizeWorkspaceConnectionAllowedUsers, resolveWorkspaceConnectionCredentialForApp, resolveWorkspaceConnectionCredentialsForApp, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnection, upsertWorkspaceConnectionGrant, } from "../workspace-connections/index.js";
 export { registerWorkspaceConnectionOnboardingStep, } from "./onboarding.js";

package/dist/shared/first-run-onboarding.d.ts

@@ -1,3 +1,9 @@
 export declare const FIRST_RUN_ONBOARDING_COOKIE = "agent-native-first-run";
 export declare const FIRST_RUN_ONBOARDING_MAX_AGE: number;
 export declare const FIRST_RUN_ONBOARDING_COMPLETED_KEY = "onboarding:first-run-completed";
+/**
+ * Set only when the framework provisions the user's first default
+ * organization. Membership in an existing organization must never qualify a
+ * user for the first-run flow, even if an old signup cookie is still present.
+ */
+export declare const FIRST_RUN_ONBOARDING_ELIGIBLE_KEY = "onboarding:first-run-eligible";

package/dist/shared/first-run-onboarding.js

@@ -1,3 +1,9 @@
 export const FIRST_RUN_ONBOARDING_COOKIE = "agent-native-first-run";
 export const FIRST_RUN_ONBOARDING_MAX_AGE = 24 * 60 * 60;
 export const FIRST_RUN_ONBOARDING_COMPLETED_KEY = "onboarding:first-run-completed";
+/**
+ * Set only when the framework provisions the user's first default
+ * organization. Membership in an existing organization must never qualify a
+ * user for the first-run flow, even if an old signup cookie is still present.
+ */
+export const FIRST_RUN_ONBOARDING_ELIGIBLE_KEY = "onboarding:first-run-eligible";

package/dist/sharing/access.d.ts

@@ -6,7 +6,7 @@
  * 2. Visibility — `'private' | 'org' | 'public'`. `org` grants read to anyone
  *    in the same org; `public` grants read to any authenticated user.
  * 3. Share rows — per-user or per-org grants in the `{type}_shares` table
- *    with a role (`viewer | editor | admin`).
+ *    with a role (`viewer | commenter | editor | admin`).
  *
  * Use `applyAccessFilter()` on list/read queries to filter rows the current
  * user can see. Use `assertAccess()` at the top of write actions to reject

package/dist/sharing/access.js

@@ -6,7 +6,7 @@
  * 2. Visibility — `'private' | 'org' | 'public'`. `org` grants read to anyone
  *    in the same org; `public` grants read to any authenticated user.
  * 3. Share rows — per-user or per-org grants in the `{type}_shares` table
- *    with a role (`viewer | editor | admin`).
+ *    with a role (`viewer | commenter | editor | admin`).
  *
  * Use `applyAccessFilter()` on list/read queries to filter rows the current
  * user can see. Use `assertAccess()` at the top of write actions to reject
@@ -166,6 +166,9 @@ function minRoleSql(minRole) {
         // any role satisfies viewer
         return sql `1=1`;
     }
+    if (minRole === "commenter") {
+        return sql `role in ('commenter','editor','admin')`;
+    }
     if (minRole === "editor") {
         return sql `role in ('editor','admin')`;
     }

package/dist/sharing/actions/share-resource.d.ts

@@ -5,7 +5,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceId: string;
     principalType: "org" | "user";
     principalId: string;
-    role?: "admin" | "editor" | "viewer";
+    role?: "admin" | "commenter" | "editor" | "viewer";
     notify?: boolean;
     resourceUrl?: string;
     message?: string;

package/dist/sharing/actions/share-resource.js

@@ -140,9 +140,9 @@ export default defineAction({
             .string()
             .describe("Email (user) or org id (org) of the principal."),
         role: z
-            .enum(["viewer", "editor", "admin"])
+            .enum(["viewer", "commenter", "editor", "admin"])
             .default("viewer")
-            .describe("Role to grant."),
+            .describe("Role to grant: viewer can only read; commenter can read and add comments; editor can edit; admin can edit and manage access."),
         notify: z
             .boolean()
             .default(true)

package/dist/sharing/registry.d.ts

@@ -151,11 +151,11 @@ export interface ShareableResourceRegistration {
      * registration and always loads the full row instead — a fixed role string
      * has no such requirement and is compatible with the projection.
      */
-    publicAccessRole?: "viewer" | "editor" | "admin" | ((resource: any, ctx: {
+    publicAccessRole?: "viewer" | "commenter" | "editor" | "admin" | ((resource: any, ctx: {
         userEmail?: string;
         orgId?: string;
         authCapability?: string;
-    }) => "viewer" | "editor" | "admin" | Promise<"viewer" | "editor" | "admin">);
+    }) => "viewer" | "commenter" | "editor" | "admin" | Promise<"viewer" | "commenter" | "editor" | "admin">);
     /**
      * When `true`, individual user shares (`principalType: "user"`) must target
      * an email that is already a member of the same org as the resource, OR has

package/dist/sharing/schema.d.ts

@@ -19,7 +19,7 @@
  *
  *   export const deckShares = createSharesTable("deck_shares");
  *
- * The share row `role` supports `viewer | editor | admin`. `admin` is a
+ * The share row `role` supports `viewer | commenter | editor | admin`. `admin` is a
  * share-level capability — it lets non-owners manage shares. The single
  * `owner_email` column on the resource remains the ground truth for ownership.
  */
@@ -44,7 +44,7 @@ export declare function ownableColumns(): {
  * - `resourceId`      — id of the parent resource
  * - `principalType`   — `'user' | 'org'`
  * - `principalId`     — email (for user) or org id (for org)
- * - `role`            — `'viewer' | 'editor' | 'admin'`
+ * - `role`            — `'viewer' | 'commenter' | 'editor' | 'admin'`
  * - `createdBy`       — email of the user who created the share
  * - `createdAt`       — ISO timestamp
  *
@@ -138,14 +138,14 @@ export declare function createSharesTable(tableName: string): import("drizzle-or
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "admin" | "editor" | "viewer";
+            data: "admin" | "commenter" | "editor" | "viewer";
             driverParam: string;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["viewer", "editor", "admin"];
+            enumValues: ["viewer", "commenter", "editor", "admin"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -194,7 +194,7 @@ export declare function createSharesTable(tableName: string): import("drizzle-or
     dialect: 'sqlite';
 }>;
 export type Visibility = "private" | "org" | "public";
-export type ShareRole = "viewer" | "editor" | "admin";
+export type ShareRole = "viewer" | "commenter" | "editor" | "admin";
 export type PrincipalType = "user" | "org";
 /** Role precedence — higher number = stronger capability. */
 export declare const ROLE_RANK: Record<ShareRole | "owner", number>;

package/dist/sharing/schema.js

@@ -19,7 +19,7 @@
  *
  *   export const deckShares = createSharesTable("deck_shares");
  *
- * The share row `role` supports `viewer | editor | admin`. `admin` is a
+ * The share row `role` supports `viewer | commenter | editor | admin`. `admin` is a
  * share-level capability — it lets non-owners manage shares. The single
  * `owner_email` column on the resource remains the ground truth for ownership.
  */
@@ -51,7 +51,7 @@ export function ownableColumns() {
  * - `resourceId`      — id of the parent resource
  * - `principalType`   — `'user' | 'org'`
  * - `principalId`     — email (for user) or org id (for org)
- * - `role`            — `'viewer' | 'editor' | 'admin'`
+ * - `role`            — `'viewer' | 'commenter' | 'editor' | 'admin'`
  * - `createdBy`       — email of the user who created the share
  * - `createdAt`       — ISO timestamp
  *
@@ -68,7 +68,9 @@ export function createSharesTable(tableName) {
             enum: ["user", "org"],
         }).notNull(),
         principalId: text("principal_id").notNull(),
-        role: text("role", { enum: ["viewer", "editor", "admin"] })
+        role: text("role", {
+            enum: ["viewer", "commenter", "editor", "admin"],
+        })
             .notNull()
             .default("viewer"),
         createdBy: text("created_by").notNull(),
@@ -78,9 +80,10 @@ export function createSharesTable(tableName) {
 /** Role precedence — higher number = stronger capability. */
 export const ROLE_RANK = {
     viewer: 1,
-    editor: 2,
-    admin: 3,
-    owner: 4,
+    commenter: 2,
+    editor: 3,
+    admin: 4,
+    owner: 5,
 };
 export function roleSatisfies(actual, minimum) {
     return ROLE_RANK[actual] >= ROLE_RANK[minimum];

package/dist/styles/agent-native.css

@@ -497,6 +497,27 @@
       transform: translateY(0);
     }
   }
+  /* Indeterminate: a route load has no percentage to report, so the bar
+     sweeps rather than pretending to know how far along it is. */
+  @keyframes route-transition-sweep {
+    0% {
+      transform: translateX(-100%);
+    }
+    100% {
+      transform: translateX(100%);
+    }
+  }
+}
+
+.route-transition-indicator-bar {
+  animation: route-transition-sweep 1.1s ease-in-out infinite;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .route-transition-indicator-bar {
+    animation: none;
+    opacity: 0.6;
+  }
 }
 
 /* Border-color compatibility shim:

package/dist/styles/chat-history-list.css

@@ -13,5 +13,5 @@ section[data-chat-first-chat-history]
   .an-chat-history-row__button {
   min-height: 28px;
   padding-block: 4px;
-  padding-inline: 8px 32px;
+  padding-inline: 8px;
 }

package/dist/templates/chat/.agents/skills/adding-a-feature/SKILL.md

@@ -101,8 +101,9 @@ placeholders such as `${keys.SLACK_WEBHOOK}` or `<SLACK_WEBHOOK>`. Do not paste
 real keys, internal data, or customer data into instructions as examples.
 
 If the feature adds or changes visible UI copy, prompts, toasts, labels, empty
-states, or formatting, read `internationalization` and update the app's i18n
-catalogs in the same change.
+states, or formatting, update the English source copy. Read the optional
+`internationalization` skill and update additional catalogs only when
+`translations.locales` in `agent-native.config.ts` includes them.
 
 For app-backed skills, declare skill visibility in the app-skill manifest: