@agent-native/core 0.161.2 → 0.161.4

package/dist/server/poll.d.ts

@@ -227,16 +227,16 @@ export declare class AppSyncState {
      *     transaction, and a long transaction killed mid-flight by a serverless
      *     worker shutdown is what leaves connections `idle in transaction`
      *     holding locks — the shape of the 2026-08-06 outage.
-     *   - `ORDER BY version` inside the subquery. Without it the planner
+     *   - `ORDER BY created_at, id` inside the subquery. Without it the planner
      *     prefers a sequential scan even with a LIMIT; with it, the existing
-     *     `sync_events_version_idx` drives the batch and the delete is a
+     *     `sync_events_created_at_id_idx` drives the batch and the delete is a
      *     bounded index range scan.
      *
      * The `lastDurablePrune` throttle below is per-process, so every serverless
      * worker prunes on its first poll. Postgres workers also take a
-     * transaction-scoped advisory lease for each batch: only one worker deletes
-     * at a time, but each batch still commits independently so a killed worker
-     * cannot hold a long transaction open.
+     * transaction-scoped advisory lease for each batch. The lease and delete
+     * are one bounded statement, so a serverless worker killed after the
+     * statement starts cannot leave an open transaction.
      */
     private pruneDurableEvents;
     persistSyncEvent(event: ChangeEvent, dedupeKey?: string, presetId?: string): Promise<void>;

package/dist/server/poll.js

@@ -455,16 +455,16 @@ export class AppSyncState {
      *     transaction, and a long transaction killed mid-flight by a serverless
      *     worker shutdown is what leaves connections `idle in transaction`
      *     holding locks — the shape of the 2026-08-06 outage.
-     *   - `ORDER BY version` inside the subquery. Without it the planner
+     *   - `ORDER BY created_at, id` inside the subquery. Without it the planner
      *     prefers a sequential scan even with a LIMIT; with it, the existing
-     *     `sync_events_version_idx` drives the batch and the delete is a
+     *     `sync_events_created_at_id_idx` drives the batch and the delete is a
      *     bounded index range scan.
      *
      * The `lastDurablePrune` throttle below is per-process, so every serverless
      * worker prunes on its first poll. Postgres workers also take a
-     * transaction-scoped advisory lease for each batch: only one worker deletes
-     * at a time, but each batch still commits independently so a killed worker
-     * cannot hold a long transaction open.
+     * transaction-scoped advisory lease for each batch. The lease and delete
+     * are one bounded statement, so a serverless worker killed after the
+     * statement starts cannot leave an open transaction.
      */
     async pruneDurableEvents(client) {
         const now = Date.now();
@@ -476,15 +476,6 @@ export class AppSyncState {
         try {
             for (let batch = 0; batch < DURABLE_PRUNE_MAX_BATCHES; batch++) {
                 const runBatch = async (tx) => {
-                    if (this.isPg()) {
-                        const lockResult = await tx.execute({
-                            sql: "SELECT pg_try_advisory_xact_lock(hashtextextended(?, 0::bigint)) AS acquired",
-                            args: [DURABLE_PRUNE_LOCK_KEY],
-                        });
-                        const acquired = lockResult.rows[0]?.acquired;
-                        if (acquired !== true && acquired !== "t")
-                            return null;
-                    }
                     // `id IN (...)` rather than ctid/rowid: both are dialect-specific,
                     // and the primary key is indexed on every dialect we ship.
                     const result = await tx.execute({
@@ -496,20 +487,22 @@ export class AppSyncState {
                     });
                     return result.rowsAffected;
                 };
-                // A Postgres advisory transaction lock is only useful when the lock
-                // and delete share a connection and transaction. Never fall back to
-                // an uncoordinated delete on a transactionless client.
                 const rowsAffected = this.isPg()
-                    ? client.transaction
-                        ? await client.transaction(runBatch)
-                        : null
+                    ? (await client.execute({
+                        sql: `WITH prune_lease AS MATERIALIZED (
+                       SELECT pg_try_advisory_xact_lock(hashtextextended(?, 0::bigint)) AS acquired
+                     ), prune_batch AS MATERIALIZED (
+                       SELECT sync_events.id
+                       FROM sync_events CROSS JOIN prune_lease
+                       WHERE prune_lease.acquired AND sync_events.created_at < ?
+                       ORDER BY sync_events.created_at, sync_events.id LIMIT ?
+                     )
+                     DELETE FROM sync_events WHERE id IN (
+                       SELECT id FROM prune_batch
+                     )`,
+                        args: [DURABLE_PRUNE_LOCK_KEY, cutoff, DURABLE_PRUNE_BATCH],
+                    })).rowsAffected
                     : await runBatch(client);
-                if (rowsAffected == null) {
-                    if (this.isPg() && !client.transaction) {
-                        throw new Error("Postgres prune requires a database transaction");
-                    }
-                    break;
-                }
                 deleted += rowsAffected;
                 if (rowsAffected < DURABLE_PRUNE_BATCH)
                     break;

package/dist/shared/auth-copy.d.ts

@@ -7,8 +7,15 @@ import { type LocaleCode } from "../localization/shared.js";
 export interface NativeAuthCopy {
     googleButton: string;
     dividerOr: string;
+    welcomeTitle: string;
+    welcomeSubtitle: string;
     email: string;
     emailPlaceholder: string;
+    legalPrefix: string;
+    legalTerms: string;
+    legalConnector: string;
+    legalPrivacy: string;
+    legalSuffix: string;
     password: string;
     confirmPassword: string;
     enterPasswordPlaceholder: string;

package/dist/shared/auth-copy.js

@@ -3,8 +3,15 @@ export const NATIVE_AUTH_COPY = {
     "en-US": {
         googleButton: "Sign in with Google",
         dividerOr: "or",
+        welcomeTitle: "Welcome",
+        welcomeSubtitle: "Create an account or sign in",
         email: "Email",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "By signing up, you accept our",
+        legalTerms: "Terms",
+        legalConnector: "and",
+        legalPrivacy: "Privacy Policy",
+        legalSuffix: ".",
         password: "Password",
         confirmPassword: "Confirm password",
         enterPasswordPlaceholder: "Enter password",
@@ -29,8 +36,15 @@ export const NATIVE_AUTH_COPY = {
     "zh-CN": {
         googleButton: "使用 Google 登录",
         dividerOr: "或",
+        welcomeTitle: "欢迎",
+        welcomeSubtitle: "创建账户或登录",
         email: "电子邮箱",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "注册即表示你接受我们的",
+        legalTerms: "条款",
+        legalConnector: "和",
+        legalPrivacy: "隐私政策",
+        legalSuffix: "。",
         password: "密码",
         confirmPassword: "确认密码",
         enterPasswordPlaceholder: "输入密码",
@@ -55,8 +69,15 @@ export const NATIVE_AUTH_COPY = {
     "zh-TW": {
         googleButton: "使用 Google 登入",
         dividerOr: "或",
+        welcomeTitle: "歡迎",
+        welcomeSubtitle: "建立帳戶或登入",
         email: "電子郵件",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "註冊即表示你接受我們的",
+        legalTerms: "條款",
+        legalConnector: "和",
+        legalPrivacy: "隱私權政策",
+        legalSuffix: "。",
         password: "密碼",
         confirmPassword: "確認密碼",
         enterPasswordPlaceholder: "輸入密碼",
@@ -81,8 +102,15 @@ export const NATIVE_AUTH_COPY = {
     "es-ES": {
         googleButton: "Iniciar sesión con Google",
         dividerOr: "o",
+        welcomeTitle: "Bienvenido",
+        welcomeSubtitle: "Crea una cuenta o inicia sesión",
         email: "Email",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "Al registrarte, aceptas nuestros",
+        legalTerms: "Términos",
+        legalConnector: "y",
+        legalPrivacy: "Política de privacidad",
+        legalSuffix: ".",
         password: "Contraseña",
         confirmPassword: "Confirmar contraseña",
         enterPasswordPlaceholder: "Introduce la contraseña",
@@ -107,8 +135,15 @@ export const NATIVE_AUTH_COPY = {
     "fr-FR": {
         googleButton: "Se connecter avec Google",
         dividerOr: "ou",
+        welcomeTitle: "Bienvenue",
+        welcomeSubtitle: "Créez un compte ou connectez-vous",
         email: "E-mail",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "En vous inscrivant, vous acceptez nos",
+        legalTerms: "Conditions",
+        legalConnector: "et",
+        legalPrivacy: "Politique de confidentialité",
+        legalSuffix: ".",
         password: "Mot de passe",
         confirmPassword: "Confirmer le mot de passe",
         enterPasswordPlaceholder: "Saisir le mot de passe",
@@ -133,8 +168,15 @@ export const NATIVE_AUTH_COPY = {
     "de-DE": {
         googleButton: "Mit Google anmelden",
         dividerOr: "oder",
+        welcomeTitle: "Willkommen",
+        welcomeSubtitle: "Konto erstellen oder anmelden",
         email: "E-Mail",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "Mit der Registrierung akzeptierst du unsere",
+        legalTerms: "Bedingungen",
+        legalConnector: "und",
+        legalPrivacy: "Datenschutzrichtlinie",
+        legalSuffix: ".",
         password: "Passwort",
         confirmPassword: "Passwort bestätigen",
         enterPasswordPlaceholder: "Passwort eingeben",
@@ -159,8 +201,15 @@ export const NATIVE_AUTH_COPY = {
     "ja-JP": {
         googleButton: "Google でサインイン",
         dividerOr: "または",
+        welcomeTitle: "ようこそ",
+        welcomeSubtitle: "アカウントを作成するかサインインしてください",
         email: "メール",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "登録すると、以下に同意したものとみなされます:",
+        legalTerms: "利用規約",
+        legalConnector: "および",
+        legalPrivacy: "プライバシーポリシー",
+        legalSuffix: "。",
         password: "パスワード",
         confirmPassword: "パスワードを確認",
         enterPasswordPlaceholder: "パスワードを入力",
@@ -185,8 +234,15 @@ export const NATIVE_AUTH_COPY = {
     "ko-KR": {
         googleButton: "Google로 로그인",
         dividerOr: "또는",
+        welcomeTitle: "환영합니다",
+        welcomeSubtitle: "계정을 만들거나 로그인하세요",
         email: "이메일",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "가입하면 다음에 동의하게 됩니다:",
+        legalTerms: "약관",
+        legalConnector: "및",
+        legalPrivacy: "개인정보 처리방침",
+        legalSuffix: ".",
         password: "비밀번호",
         confirmPassword: "비밀번호 확인",
         enterPasswordPlaceholder: "비밀번호 입력",
@@ -211,8 +267,15 @@ export const NATIVE_AUTH_COPY = {
     "pt-BR": {
         googleButton: "Entrar com Google",
         dividerOr: "ou",
+        welcomeTitle: "Bem-vindo",
+        welcomeSubtitle: "Crie uma conta ou entre",
         email: "Email",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "Ao se cadastrar, você aceita nossos",
+        legalTerms: "Termos",
+        legalConnector: "e",
+        legalPrivacy: "Política de Privacidade",
+        legalSuffix: ".",
         password: "Senha",
         confirmPassword: "Confirmar senha",
         enterPasswordPlaceholder: "Digite a senha",
@@ -237,8 +300,15 @@ export const NATIVE_AUTH_COPY = {
     "hi-IN": {
         googleButton: "Google से साइन इन करें",
         dividerOr: "या",
+        welcomeTitle: "स्वागत है",
+        welcomeSubtitle: "खाता बनाएं या साइन इन करें",
         email: "ईमेल",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "साइन अप करके, आप हमारी",
+        legalTerms: "शर्तें",
+        legalConnector: "और",
+        legalPrivacy: "गोपनीयता नीति",
+        legalSuffix: "स्वीकार करते हैं।",
         password: "पासवर्ड",
         confirmPassword: "पासवर्ड की पुष्टि करें",
         enterPasswordPlaceholder: "पासवर्ड दर्ज करें",
@@ -263,8 +333,15 @@ export const NATIVE_AUTH_COPY = {
     "ar-SA": {
         googleButton: "تسجيل الدخول باستخدام Google",
         dividerOr: "أو",
+        welcomeTitle: "مرحبًا",
+        welcomeSubtitle: "أنشئ حسابًا أو سجّل الدخول",
         email: "البريد الإلكتروني",
         emailPlaceholder: "you@example.com",
+        legalPrefix: "بالتسجيل، فإنك توافق على",
+        legalTerms: "الشروط",
+        legalConnector: "و",
+        legalPrivacy: "سياسة الخصوصية",
+        legalSuffix: ".",
         password: "كلمة المرور",
         confirmPassword: "تأكيد كلمة المرور",
         enterPasswordPlaceholder: "أدخل كلمة المرور",

package/dist/shared/mcp-embed-headers.js

@@ -3,6 +3,13 @@ export const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 const CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\.claudemcpcontent\.com$/i;
 const CHATGPT_MCP_SANDBOX_HOST_RE = /^(?:[^.]+\.)?web-sandbox\.oaiusercontent\.com$/i;
 const AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX = ".agent-native.com";
+const BUILDER_EMBED_HOST_SUFFIXES = [
+    ".builder.io",
+    ".builder.my",
+    ".builderio.xyz",
+    ".builderio.dev",
+    ".builder.codes",
+];
 const MCP_PRODUCT_HOST_ORIGINS = new Set([
     "https://chat.openai.com",
     "https://chatgpt.com",
@@ -87,10 +94,7 @@ export function isBuilderIoEmbedOrigin(origin) {
         return (url.protocol === "https:" &&
             !url.username &&
             !url.password &&
-            (hostname === "builder.io" ||
-                hostname.endsWith(".builder.io") ||
-                hostname === "builder.my" ||
-                hostname.endsWith(".builder.my")));
+            BUILDER_EMBED_HOST_SUFFIXES.some((suffix) => hostname === suffix.slice(1) || hostname.endsWith(suffix)));
     }
     catch {
         return false;

package/dist/vite/client.js

@@ -1451,6 +1451,66 @@ const EMBED_DEV_STATIC_ASSET_PATHS = new Set([
     "/favicon.svg",
     "/manifest.json",
 ]);
+const VITE_RUNTIME_MODULE_QUERY_KEYS = new Set([
+    "commonjs-proxy",
+    "direct",
+    "html-proxy",
+    "import",
+    "inline",
+    "inline-css",
+    "no-inline",
+    "raw",
+    "sharedworker",
+    "style-attr",
+    "transform-only",
+    "url",
+    "worker",
+]);
+const VITE_STATIC_ASSET_EXTENSIONS = new Set([
+    ".aac",
+    ".apng",
+    ".avif",
+    ".bmp",
+    ".css",
+    ".cur",
+    ".eot",
+    ".flac",
+    ".gif",
+    ".ico",
+    ".jfif",
+    ".jpeg",
+    ".jpg",
+    ".jxl",
+    ".less",
+    ".m4a",
+    ".mp3",
+    ".mp4",
+    ".mov",
+    ".ogg",
+    ".otf",
+    ".pjp",
+    ".pjpeg",
+    ".pcss",
+    ".pdf",
+    ".png",
+    ".postcss",
+    ".opus",
+    ".sass",
+    ".scss",
+    ".svg",
+    ".styl",
+    ".stylus",
+    ".ttf",
+    ".txt",
+    ".vtt",
+    ".wasm",
+    ".wav",
+    ".webm",
+    ".webp",
+    ".webmanifest",
+    ".woff",
+    ".woff2",
+]);
 function mountedPathCandidates(reqUrl, base) {
     if (!reqUrl)
         return [];
@@ -1528,9 +1588,38 @@ function mountedEmbedRuntimeModuleUrl(reqUrl, base) {
     if (!VITE_RUNTIME_PATH_PREFIXES.some((prefix) => url.pathname.startsWith(prefix))) {
         return null;
     }
-    url.searchParams.delete(EMBED_TOKEN_QUERY_PARAM);
-    url.searchParams.delete(MCP_APP_CHAT_BRIDGE_QUERY_PARAM);
-    return `${url.pathname}${url.search}${url.hash}`;
+    // Vite distinguishes valueless module flags such as `?url` from `?url=`.
+    // Strip only the embed controls so those flags reach Vite byte-for-byte.
+    const hashStart = runtimeUrl.indexOf("#");
+    const searchStart = runtimeUrl.indexOf("?");
+    const search = searchStart >= 0 && (hashStart < 0 || searchStart < hashStart)
+        ? runtimeUrl.slice(searchStart, hashStart < 0 ? undefined : hashStart)
+        : "";
+    return `${url.pathname}${stripMountedEmbedRuntimeQueryParams(search)}${url.hash}`;
+}
+function stripMountedEmbedRuntimeQueryParams(search) {
+    if (!search)
+        return "";
+    const kept = search
+        .slice(1)
+        .split("&")
+        .filter((pair) => {
+        const key = pair.split("=", 1)[0];
+        return (key !== EMBED_TOKEN_QUERY_PARAM &&
+            key !== MCP_APP_CHAT_BRIDGE_QUERY_PARAM);
+    });
+    return kept.length > 0 ? `?${kept.join("&")}` : "";
+}
+function isMountedEmbedStaticAssetRequest(req, runtimeUrl) {
+    const url = new URL(runtimeUrl, "http://agent-native.local");
+    const isViteModuleQuery = [...url.searchParams.keys()].some((key) => VITE_RUNTIME_MODULE_QUERY_KEYS.has(key));
+    if (isViteModuleQuery)
+        return false;
+    const fetchDestination = String(req.headers["sec-fetch-dest"] ?? "").toLowerCase();
+    if (["audio", "font", "image", "style", "track", "video"].includes(fetchDestination)) {
+        return true;
+    }
+    return VITE_STATIC_ASSET_EXTENSIONS.has(path.extname(url.pathname).toLowerCase());
 }
 function virtualModuleIdFromRuntimeUrl(runtimeUrl) {
     try {
@@ -1564,6 +1653,8 @@ function serveMountedEmbedRuntimeModule(server, req, res, base) {
     const runtimeUrl = mountedEmbedRuntimeModuleUrl(req.url, base);
     if (!runtimeUrl)
         return false;
+    if (isMountedEmbedStaticAssetRequest(req, runtimeUrl))
+        return false;
     void loadMountedEmbedRuntimeModule(server, runtimeUrl)
         .then((code) => {
         if (!code) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.161.2",
+  "version": "0.161.4",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -427,8 +427,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "^0.16.4",
-    "@agent-native/recap-cli": "0.5.4"
+    "@agent-native/recap-cli": "0.5.4",
+    "@agent-native/toolkit": "^0.16.4"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",