@agent-native/core 0.159.3 → 0.160.0

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/realtime-voice.js

@@ -5,7 +5,7 @@ import { redactSensitiveFields, sanitizeToolErrorText, sanitizeToolErrorValue, }
 import { TOOL_SEARCH_ACTION_NAME } from "../agent/tool-search.js";
 import { parseAcceptLanguage } from "../localization/server.js";
 import { getSession } from "./auth.js";
-import { getBuilderGatewayBaseUrl, resolveBuilderCredentials, resolveSecret, } from "./credential-provider.js";
+import { gatewayLaneUnavailableMessage, getBuilderGatewayBaseUrl, resolveBuilderGatewayCredentials, resolveSecret, } from "./credential-provider.js";
 import { getH3App } from "./framework-request-handler.js";
 import { runWithRequestContext } from "./request-context.js";
 import { isSameOriginRequest } from "./request-origin.js";
@@ -379,7 +379,7 @@ function createSessionHandler(tools, options) {
                 ? { browserTabId: auth.browserTabId }
                 : undefined,
         }, async () => {
-            const builderCredentials = await resolveBuilderCredentials();
+            const builderCredentials = await resolveBuilderGatewayCredentials();
             const builderConfigured = Boolean(builderCredentials.privateKey?.trim() &&
                 builderCredentials.publicKey?.trim());
             const apiKey = builderConfigured
@@ -388,7 +388,7 @@ function createSessionHandler(tools, options) {
             if (!builderConfigured && !apiKey) {
                 setResponseStatus(event, 409);
                 return {
-                    error: "Connect Builder (free tier available) or configure an OpenAI API key to use realtime voice.",
+                    error: gatewayLaneUnavailableMessage("Connect Builder (free tier available) or configure an OpenAI API key to use realtime voice."),
                     code: "realtime_voice_setup_required",
                 };
             }
@@ -466,22 +466,28 @@ function createSessionHandler(tools, options) {
                 setResponseStatus(event, 502);
                 return {
                     error: builderConfigured
-                        ? "Could not reach the Builder realtime voice gateway"
+                        ? gatewayLaneUnavailableMessage("Could not reach the Builder realtime voice gateway")
                         : "Could not reach the OpenAI Realtime API",
                 };
             }
             if (!upstream.ok) {
                 const detail = await safeOpenAiErrorDetail(upstream, builderConfigured ? builderCredentials.privateKey : apiKey);
                 setResponseStatus(event, builderConfigured ? upstream.status : 502);
+                const rejection = `${builderConfigured ? "Builder" : "OpenAI"} rejected the realtime session (${upstream.status})${detail ? `: ${detail}` : ""}`;
                 return {
-                    error: `${builderConfigured ? "Builder" : "OpenAI"} rejected the realtime session (${upstream.status})${detail ? `: ${detail}` : ""}`,
+                    error: builderConfigured
+                        ? gatewayLaneUnavailableMessage(rejection)
+                        : rejection,
                 };
             }
             const answerSdp = await upstream.text().catch(() => "");
             if (!answerSdp.trim()) {
                 setResponseStatus(event, 502);
+                const emptyAnswer = `${builderConfigured ? "Builder" : "OpenAI"} returned an empty realtime session answer`;
                 return {
-                    error: `${builderConfigured ? "Builder" : "OpenAI"} returned an empty realtime session answer`,
+                    error: builderConfigured
+                        ? gatewayLaneUnavailableMessage(emptyAnswer)
+                        : emptyAnswer,
                 };
             }
             setResponseStatus(event, upstream.status);

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;

package/dist/server/transcribe-voice.js

@@ -23,7 +23,7 @@ import { getOrgContext } from "../org/context.js";
 import { transcribeWithBuilder } from "../transcription/builder-transcription.js";
 import { applyVoiceContextReplacements, buildVoiceGuidanceBlock, parseVoiceContextPack, voiceContextTermsOnly, } from "../voice/index.js";
 import { getSession } from "./auth.js";
-import { resolveHasBuilderPrivateKey, resolveSecret, } from "./credential-provider.js";
+import { gatewayLaneUnavailableMessage, resolveHasBuilderGatewayCredential, resolveSecret, } from "./credential-provider.js";
 import { runWithRequestContext } from "./request-context.js";
 import { isSameOriginRequest } from "./request-origin.js";
 const WHISPER_URL = "https://api.openai.com/v1/audio/transcriptions";
@@ -149,7 +149,7 @@ export function createTranscribeVoiceHandler() {
         const withRequestContext = async (fn) => requestContext.userEmail
             ? runWithRequestContext(requestContext, fn)
             : fn();
-        const hasBuilderPrivateKey = async () => withRequestContext(() => resolveHasBuilderPrivateKey());
+        const hasBuilderCredential = async () => withRequestContext(() => resolveHasBuilderGatewayCredential());
         const transcribeWithBuilderForRequest = (opts) => withRequestContext(() => transcribeWithBuilder(opts));
         const sessionId = session?.email ?? "local";
         let providerPref;
@@ -212,7 +212,7 @@ export function createTranscribeVoiceHandler() {
                 instructions: voiceGuidance,
                 contextPack: voiceContext,
                 providerPref,
-                hasBuilderPrivateKey,
+                hasBuilderCredential,
                 withRequestContext,
                 resolveApiKey,
                 clientAbortSignal: clientAbort,
@@ -266,10 +266,10 @@ export function createTranscribeVoiceHandler() {
             const label = providerPref === "builder-gemini"
                 ? "Builder Gemini Flash-Lite"
                 : "Builder";
-            if (!(await hasBuilderPrivateKey())) {
+            if (!(await hasBuilderCredential())) {
                 setResponseStatus(event, 400);
                 return {
-                    error: `${label} is selected but Builder.io is not connected. Connect Builder.io (free tier available) in Settings, or change the provider preference.`,
+                    error: gatewayLaneUnavailableMessage(`${label} is selected but Builder.io is not connected. Connect Builder.io (free tier available) in Settings, or change the provider preference.`),
                 };
             }
             try {
@@ -288,10 +288,12 @@ export function createTranscribeVoiceHandler() {
                 const message = err?.message ?? String(err);
                 if (message.includes("credits exhausted")) {
                     setResponseStatus(event, 402);
-                    return { error: message };
+                    return { error: gatewayLaneUnavailableMessage(message) };
                 }
                 setResponseStatus(event, 502);
-                return { error: `${label} transcription failed: ${message}` };
+                return {
+                    error: gatewayLaneUnavailableMessage(`${label} transcription failed: ${message}`),
+                };
             }
         }
         if (providerPref === "groq") {
@@ -322,7 +324,7 @@ export function createTranscribeVoiceHandler() {
         // ── Builder Gemini Flash-Lite path ─────────────────────────────────
         // First-priority in auto mode when Builder is connected. This lets users
         // try Gemini 3.1 Flash-Lite without bringing their own Google key.
-        if (providerPref !== "openai" && (await hasBuilderPrivateKey())) {
+        if (providerPref !== "openai" && (await hasBuilderCredential())) {
             try {
                 const result = await transcribeWithBuilderForRequest({
                     audioBytes,
@@ -339,7 +341,7 @@ export function createTranscribeVoiceHandler() {
                 // a specific upgrade prompt.
                 if (message.includes("credits exhausted")) {
                     setResponseStatus(event, 402);
-                    return { error: message };
+                    return { error: gatewayLaneUnavailableMessage(message) };
                 }
                 builderError = message;
             }
@@ -401,9 +403,9 @@ export function createTranscribeVoiceHandler() {
         if (!provider) {
             setResponseStatus(event, builderError ? 502 : 400);
             return {
-                error: builderError
+                error: gatewayLaneUnavailableMessage(builderError
                     ? `Builder transcription failed: ${builderError}. Add GEMINI_API_KEY, GROQ_API_KEY, or OPENAI_API_KEY in Settings → API Keys to enable a fallback provider.`
-                    : "No voice transcription provider configured. Connect Builder.io (free tier available) or add GEMINI_API_KEY / GROQ_API_KEY / OPENAI_API_KEY in Settings → API Keys.",
+                    : "No voice transcription provider configured. Connect Builder.io (free tier available) or add GEMINI_API_KEY / GROQ_API_KEY / OPENAI_API_KEY in Settings → API Keys."),
             };
         }
         return await callWhisperCompat({
@@ -477,7 +479,7 @@ async function callWhisperCompat({ event, provider, audioBytes, mime, language,
         clearTimeout(timeout);
     }
 }
-async function cleanupTranscriptText({ event, text, instructions, contextPack, providerPref, hasBuilderPrivateKey, withRequestContext, resolveApiKey, clientAbortSignal, }) {
+async function cleanupTranscriptText({ event, text, instructions, contextPack, providerPref, hasBuilderCredential, withRequestContext, resolveApiKey, clientAbortSignal, }) {
     const original = text.trim();
     if (!original)
         return { text: "" };
@@ -486,10 +488,10 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
         return { text: finalizeText(original) };
     }
     if (providerPref === "builder" || providerPref === "builder-gemini") {
-        if (!(await hasBuilderPrivateKey())) {
+        if (!(await hasBuilderCredential())) {
             setResponseStatus(event, 400);
             return {
-                error: "Builder.io cleanup is selected but Builder.io is not connected. Connect Builder.io (free tier available) in Settings, or change the provider preference.",
+                error: gatewayLaneUnavailableMessage("Builder.io cleanup is selected but Builder.io is not connected. Connect Builder.io (free tier available) in Settings, or change the provider preference."),
             };
         }
         try {
@@ -506,7 +508,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
         catch (err) {
             setResponseStatus(event, 502);
             return {
-                error: `Builder.io cleanup failed: ${err?.message ?? String(err)}`,
+                error: gatewayLaneUnavailableMessage(`Builder.io cleanup failed: ${err?.message ?? String(err)}`),
             };
         }
     }
@@ -560,7 +562,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
             };
         }
     }
-    if (await hasBuilderPrivateKey()) {
+    if (await hasBuilderCredential()) {
         try {
             const cleaned = await withRequestContext(() => cleanupWithBuilder({ text: original, instructions, clientAbortSignal }));
             if (cleaned)

package/dist/shared/auth-copy.d.ts

@@ -0,0 +1,34 @@
+import { type LocaleCode } from "../localization/shared.js";
+/**
+ * The native sign-in surfaces use the same copy keys as the hosted onboarding
+ * form. Keep this browser-safe subset here so Electron and mobile do not load
+ * the server HTML renderer or grow a second auth vocabulary.
+ */
+export interface NativeAuthCopy {
+    googleButton: string;
+    dividerOr: string;
+    email: string;
+    emailPlaceholder: string;
+    password: string;
+    confirmPassword: string;
+    enterPasswordPlaceholder: string;
+    forgotPassword: string;
+    sendMagicLink: string;
+    magicLinkSent: string;
+    magicLinkSentCopy: string;
+    magicLinkFailed: string;
+    usePasswordInstead: string;
+    backToMagicLink: string;
+    signIn: string;
+    back: string;
+    close: string;
+    sending: string;
+    signingIn: string;
+    invalidEmail: string;
+    invalidLogin: string;
+    failedToConnect: string;
+    googleNeverFinished: string;
+    checking: string;
+}
+export declare const NATIVE_AUTH_COPY: Record<LocaleCode, NativeAuthCopy>;
+export declare function resolveNativeAuthCopy(locale: unknown): NativeAuthCopy;

package/dist/shared/auth-copy.js

@@ -0,0 +1,293 @@
+import { DEFAULT_LOCALE, resolveLocaleFromCandidates, } from "../localization/shared.js";
+export const NATIVE_AUTH_COPY = {
+    "en-US": {
+        googleButton: "Sign in with Google",
+        dividerOr: "or",
+        email: "Email",
+        emailPlaceholder: "you@example.com",
+        password: "Password",
+        confirmPassword: "Confirm password",
+        enterPasswordPlaceholder: "Enter password",
+        forgotPassword: "Forgot password?",
+        sendMagicLink: "Continue",
+        magicLinkSent: "Check your email",
+        magicLinkSentCopy: "We sent a secure sign-in link to",
+        magicLinkFailed: "We couldn't send a sign-in link. Check your email and try again.",
+        usePasswordInstead: "Use a password instead",
+        backToMagicLink: "Use a sign-in link instead",
+        signIn: "Sign in",
+        back: "Back",
+        close: "Close",
+        sending: "Sending...",
+        signingIn: "Signing in…",
+        invalidEmail: "Enter a valid email address, like you@example.com.",
+        invalidLogin: "The email or password is incorrect.",
+        failedToConnect: "We couldn't connect. Please try again.",
+        googleNeverFinished: "Google sign-in did not finish. Check the Google OAuth redirect URI and server logs for [agent-native][google-oauth].",
+        checking: "Checking...",
+    },
+    "zh-CN": {
+        googleButton: "使用 Google 登录",
+        dividerOr: "或",
+        email: "电子邮箱",
+        emailPlaceholder: "you@example.com",
+        password: "密码",
+        confirmPassword: "确认密码",
+        enterPasswordPlaceholder: "输入密码",
+        forgotPassword: "忘记密码？",
+        sendMagicLink: "继续",
+        magicLinkSent: "检查你的邮箱",
+        magicLinkSentCopy: "我们已向以下邮箱发送安全登录链接：",
+        magicLinkFailed: "无法发送登录链接。",
+        usePasswordInstead: "改用密码",
+        backToMagicLink: "改用登录链接",
+        signIn: "登录",
+        back: "返回",
+        close: "关闭",
+        sending: "正在发送...",
+        signingIn: "正在登录…",
+        invalidEmail: "请输入有效邮箱地址，例如 you@example.com。",
+        invalidLogin: "邮箱或密码无效",
+        failedToConnect: "连接失败。请重试。",
+        googleNeverFinished: "Google 登录未完成。请检查 Google OAuth 重定向 URI 和服务器日志中的 [agent-native][google-oauth]。",
+        checking: "正在检查...",
+    },
+    "zh-TW": {
+        googleButton: "使用 Google 登入",
+        dividerOr: "或",
+        email: "電子郵件",
+        emailPlaceholder: "you@example.com",
+        password: "密碼",
+        confirmPassword: "確認密碼",
+        enterPasswordPlaceholder: "輸入密碼",
+        forgotPassword: "忘記密碼？",
+        sendMagicLink: "繼續",
+        magicLinkSent: "檢查你的電子郵件",
+        magicLinkSentCopy: "我們已向以下電子郵件寄送安全登入連結：",
+        magicLinkFailed: "無法寄送登入連結。",
+        usePasswordInstead: "改用密碼",
+        backToMagicLink: "改用登入連結",
+        signIn: "登入",
+        back: "返回",
+        close: "關閉",
+        sending: "正在寄送...",
+        signingIn: "正在登入...",
+        invalidEmail: "請輸入有效的電子郵件地址，例如 you@example.com。",
+        invalidLogin: "電子郵件或密碼無效",
+        failedToConnect: "連線失敗。請重試。",
+        googleNeverFinished: "Google 登入未完成。請檢查 Google OAuth 重新導向 URI，以及伺服器記錄中的 [agent-native][google-oauth]。",
+        checking: "正在檢查...",
+    },
+    "es-ES": {
+        googleButton: "Iniciar sesión con Google",
+        dividerOr: "o",
+        email: "Email",
+        emailPlaceholder: "you@example.com",
+        password: "Contraseña",
+        confirmPassword: "Confirmar contraseña",
+        enterPasswordPlaceholder: "Introduce la contraseña",
+        forgotPassword: "¿Olvidaste tu contraseña?",
+        sendMagicLink: "Continuar",
+        magicLinkSent: "Revisa tu email",
+        magicLinkSentCopy: "Enviamos un enlace seguro a",
+        magicLinkFailed: "No se pudo enviar el enlace de inicio de sesión.",
+        usePasswordInstead: "Usar una contraseña",
+        backToMagicLink: "Usar un enlace de inicio de sesión",
+        signIn: "Iniciar sesión",
+        back: "Volver",
+        close: "Cerrar",
+        sending: "Enviando...",
+        signingIn: "Iniciando sesión…",
+        invalidEmail: "Introduce un email válido, como you@example.com.",
+        invalidLogin: "Email o contraseña no válidos",
+        failedToConnect: "No se pudo conectar. Inténtalo de nuevo.",
+        googleNeverFinished: "El inicio de sesión con Google no terminó. Comprueba el URI de redirección de Google OAuth y los logs del servidor para [agent-native][google-oauth].",
+        checking: "Comprobando...",
+    },
+    "fr-FR": {
+        googleButton: "Se connecter avec Google",
+        dividerOr: "ou",
+        email: "E-mail",
+        emailPlaceholder: "you@example.com",
+        password: "Mot de passe",
+        confirmPassword: "Confirmer le mot de passe",
+        enterPasswordPlaceholder: "Saisir le mot de passe",
+        forgotPassword: "Mot de passe oublié ?",
+        sendMagicLink: "Continuer",
+        magicLinkSent: "Vérifiez votre e-mail",
+        magicLinkSentCopy: "Nous avons envoyé un lien sécurisé à",
+        magicLinkFailed: "Impossible d'envoyer le lien de connexion.",
+        usePasswordInstead: "Utiliser un mot de passe",
+        backToMagicLink: "Utiliser un lien de connexion",
+        signIn: "Connexion",
+        back: "Retour",
+        close: "Fermer",
+        sending: "Envoi...",
+        signingIn: "Connexion…",
+        invalidEmail: "Saisissez une adresse e-mail valide, comme you@example.com.",
+        invalidLogin: "E-mail ou mot de passe invalide",
+        failedToConnect: "Connexion impossible. Veuillez réessayer.",
+        googleNeverFinished: "La connexion Google n'a pas abouti. Vérifiez l'URI de redirection Google OAuth et les logs serveur pour [agent-native][google-oauth].",
+        checking: "Vérification...",
+    },
+    "de-DE": {
+        googleButton: "Mit Google anmelden",
+        dividerOr: "oder",
+        email: "E-Mail",
+        emailPlaceholder: "you@example.com",
+        password: "Passwort",
+        confirmPassword: "Passwort bestätigen",
+        enterPasswordPlaceholder: "Passwort eingeben",
+        forgotPassword: "Passwort vergessen?",
+        sendMagicLink: "Weiter",
+        magicLinkSent: "Prüfe deine E-Mail",
+        magicLinkSentCopy: "Wir haben einen sicheren Anmeldelink gesendet an",
+        magicLinkFailed: "Anmeldelink konnte nicht gesendet werden.",
+        usePasswordInstead: "Stattdessen Passwort verwenden",
+        backToMagicLink: "Stattdessen Anmeldelink verwenden",
+        signIn: "Anmelden",
+        back: "Zurück",
+        close: "Schließen",
+        sending: "Senden...",
+        signingIn: "Anmeldung…",
+        invalidEmail: "Gib eine gültige E-Mail-Adresse ein, z. B. you@example.com.",
+        invalidLogin: "E-Mail oder Passwort ungültig",
+        failedToConnect: "Verbindung fehlgeschlagen. Bitte erneut versuchen.",
+        googleNeverFinished: "Die Google-Anmeldung wurde nicht abgeschlossen. Prüfe die Google-OAuth-Redirect-URI und Serverlogs für [agent-native][google-oauth].",
+        checking: "Prüfen...",
+    },
+    "ja-JP": {
+        googleButton: "Google でサインイン",
+        dividerOr: "または",
+        email: "メール",
+        emailPlaceholder: "you@example.com",
+        password: "パスワード",
+        confirmPassword: "パスワードを確認",
+        enterPasswordPlaceholder: "パスワードを入力",
+        forgotPassword: "パスワードをお忘れですか？",
+        sendMagicLink: "続行",
+        magicLinkSent: "メールを確認してください",
+        magicLinkSentCopy: "安全なサインインリンクを送信しました：",
+        magicLinkFailed: "サインインリンクを送信できませんでした。",
+        usePasswordInstead: "パスワードを使用する",
+        backToMagicLink: "サインインリンクを使用する",
+        signIn: "サインイン",
+        back: "戻る",
+        close: "閉じる",
+        sending: "送信中...",
+        signingIn: "サインイン中…",
+        invalidEmail: "you@example.com のような有効なメールアドレスを入力してください。",
+        invalidLogin: "メールまたはパスワードが正しくありません",
+        failedToConnect: "接続できませんでした。もう一度お試しください。",
+        googleNeverFinished: "Google サインインが完了しませんでした。Google OAuth リダイレクト URI と [agent-native][google-oauth] のサーバーログを確認してください。",
+        checking: "確認中...",
+    },
+    "ko-KR": {
+        googleButton: "Google로 로그인",
+        dividerOr: "또는",
+        email: "이메일",
+        emailPlaceholder: "you@example.com",
+        password: "비밀번호",
+        confirmPassword: "비밀번호 확인",
+        enterPasswordPlaceholder: "비밀번호 입력",
+        forgotPassword: "비밀번호를 잊으셨나요?",
+        sendMagicLink: "계속",
+        magicLinkSent: "이메일을 확인하세요",
+        magicLinkSentCopy: "안전한 로그인 링크를 보냈습니다:",
+        magicLinkFailed: "로그인 링크를 보낼 수 없습니다.",
+        usePasswordInstead: "비밀번호 사용",
+        backToMagicLink: "로그인 링크 사용",
+        signIn: "로그인",
+        back: "뒤로",
+        close: "닫기",
+        sending: "보내는 중...",
+        signingIn: "로그인 중…",
+        invalidEmail: "you@example.com 같은 올바른 이메일 주소를 입력하세요.",
+        invalidLogin: "이메일 또는 비밀번호가 올바르지 않습니다",
+        failedToConnect: "연결하지 못했습니다. 다시 시도하세요.",
+        googleNeverFinished: "Google 로그인이 완료되지 않았습니다. Google OAuth 리디렉션 URI와 [agent-native][google-oauth] 서버 로그를 확인하세요.",
+        checking: "확인 중...",
+    },
+    "pt-BR": {
+        googleButton: "Entrar com Google",
+        dividerOr: "ou",
+        email: "Email",
+        emailPlaceholder: "you@example.com",
+        password: "Senha",
+        confirmPassword: "Confirmar senha",
+        enterPasswordPlaceholder: "Digite a senha",
+        forgotPassword: "Esqueceu a senha?",
+        sendMagicLink: "Continuar",
+        magicLinkSent: "Confira seu email",
+        magicLinkSentCopy: "Enviamos um link seguro para",
+        magicLinkFailed: "Não foi possível enviar o link de acesso.",
+        usePasswordInstead: "Usar uma senha",
+        backToMagicLink: "Usar um link de acesso",
+        signIn: "Entrar",
+        back: "Voltar",
+        close: "Fechar",
+        sending: "Enviando...",
+        signingIn: "Entrando…",
+        invalidEmail: "Digite um email válido, como you@example.com.",
+        invalidLogin: "Email ou senha inválidos",
+        failedToConnect: "Não foi possível conectar. Tente novamente.",
+        googleNeverFinished: "O login com Google não terminou. Confira o URI de redirecionamento do Google OAuth e os logs do servidor para [agent-native][google-oauth].",
+        checking: "Verificando...",
+    },
+    "hi-IN": {
+        googleButton: "Google से साइन इन करें",
+        dividerOr: "या",
+        email: "ईमेल",
+        emailPlaceholder: "you@example.com",
+        password: "पासवर्ड",
+        confirmPassword: "पासवर्ड की पुष्टि करें",
+        enterPasswordPlaceholder: "पासवर्ड दर्ज करें",
+        forgotPassword: "पासवर्ड भूल गए?",
+        sendMagicLink: "जारी रखें",
+        magicLinkSent: "अपना ईमेल देखें",
+        magicLinkSentCopy: "हमने सुरक्षित साइन-इन लिंक यहां भेजा है:",
+        magicLinkFailed: "साइन-इन लिंक नहीं भेजा जा सका।",
+        usePasswordInstead: "पासवर्ड का उपयोग करें",
+        backToMagicLink: "साइन-इन लिंक का उपयोग करें",
+        signIn: "साइन इन",
+        back: "वापस",
+        close: "बंद करें",
+        sending: "भेजा जा रहा है...",
+        signingIn: "साइन इन हो रहा है…",
+        invalidEmail: "एक मान्य ईमेल पता दर्ज करें, जैसे you@example.com.",
+        invalidLogin: "ईमेल या पासवर्ड अमान्य है",
+        failedToConnect: "कनेक्ट नहीं हो सका। कृपया फिर कोशिश करें।",
+        googleNeverFinished: "Google साइन इन पूरा नहीं हुआ। Google OAuth redirect URI और [agent-native][google-oauth] के server logs देखें।",
+        checking: "जांच हो रही है...",
+    },
+    "ar-SA": {
+        googleButton: "تسجيل الدخول باستخدام Google",
+        dividerOr: "أو",
+        email: "البريد الإلكتروني",
+        emailPlaceholder: "you@example.com",
+        password: "كلمة المرور",
+        confirmPassword: "تأكيد كلمة المرور",
+        enterPasswordPlaceholder: "أدخل كلمة المرور",
+        forgotPassword: "هل نسيت كلمة المرور؟",
+        sendMagicLink: "متابعة",
+        magicLinkSent: "تحقق من بريدك الإلكتروني",
+        magicLinkSentCopy: "أرسلنا رابط تسجيل دخول آمنًا إلى",
+        magicLinkFailed: "تعذر إرسال رابط تسجيل الدخول.",
+        usePasswordInstead: "استخدام كلمة مرور بدلًا من ذلك",
+        backToMagicLink: "استخدام رابط تسجيل الدخول بدلًا من ذلك",
+        signIn: "تسجيل الدخول",
+        back: "رجوع",
+        close: "إغلاق",
+        sending: "جارٍ الإرسال...",
+        signingIn: "جارٍ تسجيل الدخول…",
+        invalidEmail: "أدخل بريدًا إلكترونيًا صالحًا، مثل you@example.com.",
+        invalidLogin: "البريد الإلكتروني أو كلمة المرور غير صحيحة",
+        failedToConnect: "تعذر الاتصال. حاول مرة أخرى.",
+        googleNeverFinished: "لم يكتمل تسجيل الدخول عبر Google. تحقق من URI إعادة التوجيه في Google OAuth وسجلات الخادم لـ [agent-native][google-oauth].",
+        checking: "جارٍ التحقق...",
+    },
+};
+export function resolveNativeAuthCopy(locale) {
+    const resolvedLocale = resolveLocaleFromCandidates([locale]);
+    return NATIVE_AUTH_COPY[resolvedLocale] ?? NATIVE_AUTH_COPY[DEFAULT_LOCALE];
+}

package/dist/shared/index.d.ts

@@ -13,6 +13,7 @@ export { DISPATCH_WORKSPACE_ROOT_REDIRECTS, RESERVED_WORKSPACE_APP_IDS, assertVa
 export { DEFAULT_WORKSPACE_APP_AUDIENCE, WORKSPACE_APP_AUDIENCES, normalizeWorkspaceAppAudience, normalizeWorkspaceAppPathList, workspaceAppAudienceFromEnv, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromEnv, workspaceAppRouteAccessFromPackageJson, type WorkspaceAppRouteAccess, type WorkspaceAppRouteAccessFromConfig, type WorkspaceAppAudience, } from "./workspace-app-audience.js";
 export { AGENT_NATIVE_OPEN_PATH, AGENT_SIDEBAR_QUERY_PARAM, AGENT_SIDEBAR_QUERY_VALUE_CLOSED, isAgentNativeOpenDeepLink, withCollapsedAgentSidebarParam, } from "./agent-sidebar-url.js";
 export { buildChatFirstAppCreationPrompt, titleFromChatFirstAppPrompt, type ChatFirstAppCreationPromptInput, type ChatFirstAppCreationResource, type ChatFirstAppCreationVaultAccessMode, } from "./chat-first-app-creation.js";
+export { NATIVE_AUTH_COPY, resolveNativeAuthCopy, type NativeAuthCopy, } from "./auth-copy.js";
 export { createPollEngine, type PollEngineOptions, type PollEngineHandle, } from "./poll-engine.js";
 export { AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE, AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER, AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, defaultSocialImageMeta, withAgentNativeSocialImageCacheBuster, withDefaultSocialImage, type SocialMetaDescriptor, } from "./social-meta.js";
 export { EMBED_MODE_QUERY_PARAM, EMBED_SESSION_COOKIE, EMBED_START_PATH, EMBED_TOKEN_QUERY_PARAM, } from "./embed-auth.js";

package/dist/shared/index.js

@@ -13,6 +13,7 @@ export { DISPATCH_WORKSPACE_ROOT_REDIRECTS, RESERVED_WORKSPACE_APP_IDS, assertVa
 export { DEFAULT_WORKSPACE_APP_AUDIENCE, WORKSPACE_APP_AUDIENCES, normalizeWorkspaceAppAudience, normalizeWorkspaceAppPathList, workspaceAppAudienceFromEnv, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromEnv, workspaceAppRouteAccessFromPackageJson, } from "./workspace-app-audience.js";
 export { AGENT_NATIVE_OPEN_PATH, AGENT_SIDEBAR_QUERY_PARAM, AGENT_SIDEBAR_QUERY_VALUE_CLOSED, isAgentNativeOpenDeepLink, withCollapsedAgentSidebarParam, } from "./agent-sidebar-url.js";
 export { buildChatFirstAppCreationPrompt, titleFromChatFirstAppPrompt, } from "./chat-first-app-creation.js";
+export { NATIVE_AUTH_COPY, resolveNativeAuthCopy, } from "./auth-copy.js";
 export { createPollEngine, } from "./poll-engine.js";
 export { AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE, AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER, AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, defaultSocialImageMeta, withAgentNativeSocialImageCacheBuster, withDefaultSocialImage, } from "./social-meta.js";
 export { EMBED_MODE_QUERY_PARAM, EMBED_SESSION_COOKIE, EMBED_START_PATH, EMBED_TOKEN_QUERY_PARAM, } from "./embed-auth.js";

package/dist/transcription/builder-transcription.js

@@ -1,4 +1,4 @@
-import { resolveBuilderAuthHeader, getBuilderProxyOrigin, } from "../server/credential-provider.js";
+import { resolveBuilderGatewayAuth, getBuilderProxyOrigin, } from "../server/credential-provider.js";
 function describeError(err) {
     if (!(err instanceof Error))
         return String(err);
@@ -7,8 +7,8 @@ function describeError(err) {
     return `${err.name}: ${err.message}${causeText}`;
 }
 export async function transcribeWithBuilder(opts) {
-    const authHeader = await resolveBuilderAuthHeader();
-    if (!authHeader) {
+    const auth = await resolveBuilderGatewayAuth();
+    if (!auth) {
         throw new Error("Builder private key not configured. Connect your Builder.io account (free tier available) in Settings.");
     }
     const params = new URLSearchParams();
@@ -39,8 +39,12 @@ export async function transcribeWithBuilder(opts) {
         res = await fetch(url, {
             method: "POST",
             headers: {
-                Authorization: authHeader,
+                Authorization: auth.authorization,
                 "Content-Type": "application/octet-stream",
+                // A gateway token without a space id is rejected before any route
+                // policy is consulted, so the space id travels with every call.
+                ...(auth.spaceId ? { "x-builder-api-key": auth.spaceId } : {}),
+                ...(auth.userId ? { "x-builder-user-id": auth.userId } : {}),
             },
             body,
             signal: controller.signal,

package/docs/content/actions-advanced.mdx

@@ -17,7 +17,7 @@ Declare the flag in a module both the server and the client can import, since th
 
 ```ts
 // shared/feature-flags.ts
-import { defineFeatureFlag } from "@agent-native/core/feature-flags";
+import { defineFeatureFlag } from "@agent-native/core/feature-flags/registry";
 
 export const FULL_APP_BUILDING = defineFeatureFlag({
   key: "full-app-building",

package/docs/content/portal.mdx

@@ -47,15 +47,28 @@ the device token was rotated or the workspace moved. If Cloud is unavailable,
 the run has not started - use Local or Computer instead of retrying a queued
 cloud request.
 
+If the connector runs and polls but every request returns `401`, and the queued
+run is never claimed, repairing the pairing will not help. A deployment only
+accepts device tokens minted against its own database, so a device paired
+against one origin polls a second origin forever without ever being recognized.
+Read `deviceId` and `relayUrl` from `~/.agent-native/remote-device.json`, then
+request the authenticated host list from the origin `relayUrl` names. An
+authenticated `200` whose `hosts` array does not contain that `deviceId` is the
+mismatch - pair again from the origin the connector actually polls. Restart the
+connector afterwards: it reads the token and relay URL once at startup and
+caches them for the life of the process, so a running connector keeps using the
+previous pairing.
+
 ## Environment variables
 
 Self-hosted deployments can customize the Portal connection with:
 
-| Variable                             | Purpose                                                              |
-| ------------------------------------ | -------------------------------------------------------------------- |
-| `WORKSPACE_GATEWAY_URL`              | Public workspace gateway used for device handoff.                    |
-| `AGENT_NATIVE_REMOTE_DEVICE_PATH`    | Override the local device registration file path.                    |
-| `AGENT_NATIVE_COMPUTER_BRIDGE_URL`   | Computer bridge URL used by remote execution.                        |
-| `AGENT_NATIVE_COMPUTER_BRIDGE_TOKEN` | Token used to authenticate with that bridge.                         |
-| `AGENT_NATIVE_REMOTE_ENGINES`        | Comma-separated remote execution engines available to the workspace. |
-| `AGENT_NATIVE_IDENTITY_HUB_URL`      | Optional Dispatch identity hub for self-hosted cross-app sign-in.    |
+| Variable                             | Purpose                                                                                                        |
+| ------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
+| `WORKSPACE_GATEWAY_URL`              | Public workspace gateway used for device handoff.                                                              |
+| `AGENT_NATIVE_REMOTE_DEVICE_PATH`    | Override the local device registration file path.                                                              |
+| `AGENT_NATIVE_COMPUTER_BRIDGE_URL`   | Computer bridge URL used by remote execution.                                                                  |
+| `AGENT_NATIVE_COMPUTER_BRIDGE_TOKEN` | Token used to authenticate with that bridge.                                                                   |
+| `AGENT_NATIVE_COMPUTER_CAPABILITIES` | Capabilities that bridge exposes. Required with the two above - the bridge stays off unless all three are set. |
+| `AGENT_NATIVE_REMOTE_ENGINES`        | Comma-separated remote execution engines available to the workspace.                                           |
+| `AGENT_NATIVE_IDENTITY_HUB_URL`      | Optional Dispatch identity hub for self-hosted cross-app sign-in.                                              |