@agent-native/core 0.161.8 → 0.161.9

package/corpus/templates/design/server/plugins/builder-host-embed-headers.ts

@@ -0,0 +1,37 @@
+/**
+ * `require-corp` would make the browser reject the containers this canvas frames,
+ * and they cannot opt in via CORP. `frame-ancestors` replaces the embed token as
+ * the limit on who may embed this route. A `response` hook, not middleware: core
+ * sets its security headers from a plugin, which runs later.
+ */
+import { getRequestURL, type H3Event } from "h3";
+
+import { SHELL_CANVAS_PATH } from "../../shared/shell-screens.js";
+
+const BUILDER_FRAME_ANCESTORS = [
+  "https://builder.io",
+  "https://*.builder.io",
+  "https://*.builder.my",
+  "http://localhost:*",
+  "http://127.0.0.1:*",
+].join(" ");
+
+export function isShellCanvasRequest(event: H3Event): boolean {
+  try {
+    return getRequestURL(event).pathname === SHELL_CANVAS_PATH;
+    // coercion-ok: an unparseable URL is not the shell route.
+  } catch {
+    return false;
+  }
+}
+
+export default (nitroApp: any): void => {
+  nitroApp.hooks.hook("response", (res: Response, event: H3Event) => {
+    if (!isShellCanvasRequest(event)) return;
+    res.headers.set("Cross-Origin-Embedder-Policy", "unsafe-none");
+    res.headers.set(
+      "Content-Security-Policy",
+      `frame-ancestors ${BUILDER_FRAME_ANCESTORS}`,
+    );
+  });
+};

package/corpus/templates/design/server/routes/[...page].get.ts

@@ -10,6 +10,7 @@ import {
 } from "@agent-native/core/shared";
 import {
   defineEventHandler,
+  getHeader,
   getQuery,
   getRequestURL,
   setResponseHeader,

package/corpus/templates/design/shared/builder-preview-url.ts

@@ -0,0 +1,113 @@
+/**
+ * Validation for Builder Fusion container preview URLs. Stops the seam becoming
+ * an open embed primitive pointed at an internal address. Mirrors
+ * builder-internal's list (`packages/app/models/fusion.model.tsx` —
+ * search `builderio.xyz`); keep the two in sync.
+ */
+
+const BUILDER_PREVIEW_HOST_SUFFIXES = [
+  ".fly.dev",
+  ".builderio.xyz",
+  ".builderio.dev",
+  ".builder.codes",
+  ".builder.my",
+  ".builder.live",
+] as const;
+
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+
+/**
+ * Development only, and fail closed: the proxy fetches this URL from the
+ * server, so in production a loopback host means scanning the Design host
+ * itself on a caller's behalf.
+ */
+export function isLoopbackPreviewAllowed(): boolean {
+  const nodeEnv =
+    typeof process === "undefined" ? undefined : process.env?.NODE_ENV;
+  // Wins over the bundler flag: a dev-mode bundle served by a production
+  // process is still production.
+  if (nodeEnv === "production") return false;
+  if (nodeEnv === "development" || nodeEnv === "test") return true;
+  const viteEnv = (import.meta as { env?: { DEV?: boolean } }).env;
+  return viteEnv?.DEV === true;
+}
+
+export class InvalidBuilderPreviewUrlError extends Error {
+  constructor(reason: string) {
+    super(`Invalid Builder preview URL: ${reason}`);
+    this.name = "InvalidBuilderPreviewUrlError";
+  }
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  return LOOPBACK_HOSTNAMES.has(hostname);
+}
+
+/**
+ * Parse and validate a preview URL, returning its normalized form. Throws
+ * rather than returning null so a rejected URL is never indistinguishable from
+ * an absent one — a bad init must not quietly place zero screens and read as an
+ * empty design.
+ */
+export function parseBuilderPreviewUrl(raw: unknown): URL {
+  if (typeof raw !== "string" || !raw.trim()) {
+    throw new InvalidBuilderPreviewUrlError("must be a non-empty string");
+  }
+
+  let url: URL;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    throw new InvalidBuilderPreviewUrlError(`could not parse "${raw}"`);
+  }
+
+  // Credentials would be replayed by the iframe on every request.
+  if (url.username || url.password) {
+    throw new InvalidBuilderPreviewUrlError("must not embed credentials");
+  }
+
+  const hostname = url.hostname.toLowerCase();
+  if (isLoopbackHostname(hostname) && !isLoopbackPreviewAllowed()) {
+    throw new InvalidBuilderPreviewUrlError(
+      "loopback hosts are only allowed in development",
+    );
+  }
+  const loopback = isLoopbackHostname(hostname);
+
+  if (url.protocol !== "https:" && !(loopback && url.protocol === "http:")) {
+    throw new InvalidBuilderPreviewUrlError(
+      `must use https (got "${url.protocol}")`,
+    );
+  }
+
+  if (
+    !loopback &&
+    !BUILDER_PREVIEW_HOST_SUFFIXES.some((suffix) => hostname.endsWith(suffix))
+  ) {
+    throw new InvalidBuilderPreviewUrlError(
+      `host "${hostname}" is not a recognized Builder preview host`,
+    );
+  }
+
+  return url;
+}
+
+/** Non-throwing form, for UI that wants to branch instead of failing. */
+/**
+ * Origin only. `interactiveFrameUrl` carries whatever route the user is
+ * previewing, and resolving screen paths against that base nests them under it
+ * (`/app.html` + `/about` → `/app.html/about`).
+ */
+export function builderPreviewOrigin(raw: unknown): string {
+  return parseBuilderPreviewUrl(raw).origin;
+}
+
+export function isBuilderPreviewUrl(raw: unknown): boolean {
+  try {
+    parseBuilderPreviewUrl(raw);
+    return true;
+    // coercion-ok: "does not parse" is what this predicate reports as false.
+  } catch {
+    return false;
+  }
+}

package/corpus/templates/design/shared/full-app.ts

@@ -29,11 +29,23 @@ export const FULL_APP_BUILDING = defineFeatureFlag({
 
 export type DesignFusionAppStatus = "building" | "ready" | "error";
 
+/**
+ * How the linkage was established. `builder-host` (opened from builder.io's
+ * embedded Design tab) never provisions or deploys the container — Builder owns
+ * it, and Builder's chat session drives it. Absent means `design-app`.
+ */
+export type DesignFusionAppSource = "design-app" | "builder-host";
+
 export interface DesignFusionApp {
   /** Builder project id the app branch lives in. */
   projectId: string;
   /** Branch backing this design (one branch per design). */
   branchName: string;
+  source?: DesignFusionAppSource;
+  /** Builder organization owning the project. Set for `builder-host` designs. */
+  builderOrgId?: string;
+  /** Builder content id the tab was opened from, when there is one. */
+  contentId?: string;
   /** Builder visual-editor URL for the branch (progress/debugging). */
   editorUrl?: string;
   /** Container dev-server URL once the container is ready; iframe-able. */
@@ -94,10 +106,17 @@ export function readFusionApp(data: unknown): DesignFusionApp | null {
     app.status === "ready" || app.status === "error" ? app.status : "building";
   const str = (value: unknown): string | undefined =>
     typeof value === "string" && value ? value : undefined;
+  const source: DesignFusionAppSource | undefined =
+    app.source === "builder-host" || app.source === "design-app"
+      ? app.source
+      : undefined;
   return {
     projectId,
     branchName,
     status,
+    source,
+    builderOrgId: str(app.builderOrgId),
+    contentId: str(app.contentId),
     editorUrl: str(app.editorUrl),
     previewUrl: str(app.previewUrl),
     statusMessage: str(app.statusMessage),

package/corpus/templates/design/shared/shell-screens.ts

@@ -0,0 +1,139 @@
+/**
+ * Builds the same `{ screens, placedFrames }` shape as `upsertFusionScreens`,
+ * but in memory and without a database, for a canvas the host drives entirely
+ * over postMessage. Keep the derivations here identical to the server version:
+ * a screen that changes shape between the two paths changes fileIds, and the
+ * canvas keys selection and frame geometry on those.
+ */
+
+import type { CanvasFramePlacement } from "./canvas-frames.js";
+
+/** The host-driven canvas route: no design row, no session, no server writes. */
+export const SHELL_CANVAS_PATH = "/visual-edit/shell";
+
+/** Mirrors add-localhost-screens' defaults, as the server builder does. */
+export const DEFAULT_SHELL_SCREEN_WIDTH = 1280;
+export const DEFAULT_SHELL_SCREEN_HEIGHT = 900;
+const DEFAULT_SHELL_GAP = 160;
+export const MAX_SHELL_SCREENS = 100;
+
+export interface ShellScreen {
+  fileId: string;
+  filename: string;
+  path: string;
+  url: string;
+  title: string;
+  width: number;
+  height: number;
+}
+
+export interface ShellScreensResult {
+  screens: ShellScreen[];
+  placedFrames: Array<{
+    fileId: string;
+    filename?: string;
+    frame: CanvasFramePlacement;
+  }>;
+}
+
+function slugForPath(path: string): string {
+  const slug = path
+    .replace(/^\/+/, "")
+    .replace(/[^a-zA-Z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .toLowerCase();
+  return (slug || "home").slice(0, 80);
+}
+
+function titleFromPath(path: string): string {
+  const trimmed = path.replace(/^\/+|\/+$/g, "");
+  if (!trimmed) return "Home";
+  const last = trimmed.split("/").pop() ?? trimmed;
+  return last.replace(/[-_]+/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+}
+
+function uniqueFilename(path: string, used: Set<string>): string {
+  const base = `fusion-${slugForPath(path)}.html`;
+  let filename = base;
+  let suffix = 2;
+  while (used.has(filename)) {
+    filename = `${base.replace(/\.html$/, "")}-${suffix}.html`;
+    suffix += 1;
+  }
+  used.add(filename);
+  return filename;
+}
+
+/**
+ * Derived from the filename rather than random: a remount must produce the same
+ * ids or the canvas loses selection and frame geometry on every reload.
+ */
+function shellFileId(filename: string): string {
+  return `shell-${filename.replace(/\.html$/, "")}`;
+}
+
+export function buildShellScreens(args: {
+  previewOrigin: string;
+  paths: string[];
+  width?: number;
+  height?: number;
+  startX?: number;
+  startY?: number;
+  gap?: number;
+}): ShellScreensResult {
+  const {
+    previewOrigin,
+    paths,
+    width = DEFAULT_SHELL_SCREEN_WIDTH,
+    height = DEFAULT_SHELL_SCREEN_HEIGHT,
+    startX = 0,
+    startY = 0,
+    gap = DEFAULT_SHELL_GAP,
+  } = args;
+
+  const baseWithSlash = previewOrigin.endsWith("/")
+    ? previewOrigin
+    : `${previewOrigin}/`;
+  const baseOrigin = new URL(baseWithSlash).origin;
+
+  const used = new Set<string>();
+  const screens: ShellScreen[] = [];
+  const placedFrames: ShellScreensResult["placedFrames"] = [];
+  const seenPaths = new Set<string>();
+  let nextX = startX;
+
+  // The host assembles this list from a repo parse plus visited URLs, so a bad
+  // parse must not mount hundreds of live iframes. Well above any real route
+  // count, so it only ever trips on pathological input.
+  for (const rawPath of paths.slice(0, MAX_SHELL_SCREENS)) {
+    const path = rawPath.startsWith("/") ? rawPath : `/${rawPath}`;
+    // A duplicate path would otherwise get a second frame stacked on the first.
+    if (seenPaths.has(path)) continue;
+    seenPaths.add(path);
+
+    // `\\host` survives the leading-slash strip and resolves protocol-relative,
+    // so a route from the host could otherwise place a frame on another origin.
+    const resolved = new URL(path.replace(/^\/+/, ""), baseWithSlash);
+    if (resolved.origin !== baseOrigin) continue;
+
+    const filename = uniqueFilename(path, used);
+    const fileId = shellFileId(filename);
+    screens.push({
+      fileId,
+      filename,
+      path,
+      url: resolved.toString(),
+      title: titleFromPath(path),
+      width,
+      height,
+    });
+    placedFrames.push({
+      fileId,
+      filename,
+      frame: { fileId, filename, x: nextX, y: startY, width, height },
+    });
+    nextX += width + gap;
+  }
+
+  return { screens, placedFrames };
+}

package/corpus/templates/design/shared/source-mode.ts

@@ -420,6 +420,16 @@ export function isDesignSourceType(value: unknown): value is DesignSourceType {
   );
 }
 
+/**
+ * Screens whose content is a URL into a running app. Their markup lives in the
+ * app's source, so every edit is a handoff, never a design-file write — the
+ * distinction the editor keeps having to make, and keeps making per-call-site.
+ */
+export function isRunningAppSourceType(value: unknown): boolean {
+  const sourceType = normalizeDesignSourceType(value);
+  return sourceType === "localhost" || sourceType === "fusion";
+}
+
 export function normalizeDesignSourceType(
   value: unknown,
 ): DesignSourceType | null {

package/dist/client/RuntimeConfigNotice.js

@@ -3,6 +3,7 @@ import { IconAlertCircle, IconAlertTriangle, IconCheck, IconChevronDown, IconChe
 import { useEffect, useMemo, useState } from "react";
 import { parseRuntimeConfigReport, } from "../shared/runtime-config.js";
 import { agentNativePath } from "./api-path.js";
+import { agentNativeApiDisabledReason } from "./api-surface.js";
 import { writeClipboardText } from "./clipboard.js";
 import { useT } from "./i18n.js";
 function injectedAppConfig() {
@@ -31,6 +32,8 @@ export function RuntimeConfigNotice() {
     useEffect(() => {
         if (typeof window.fetch !== "function")
             return;
+        if (agentNativeApiDisabledReason())
+            return;
         const controller = new AbortController();
         let active = true;
         const timeout = window.setTimeout(() => controller.abort(), 5000);

package/dist/client/api-surface.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Some surfaces are framed by a host and carry no agent-native session at all —
+ * Builder's Design tab frames a canvas that owns no design row and holds no
+ * credential. Every `/_agent-native/*` call from one is unauthenticated by
+ * construction, so the client must not make them: a 401 per poll buries real
+ * failures, and a write can never land.
+ */
+/** Pass `null` to re-enable, so a surface can be entered and left. */
+export declare function setAgentNativeApiDisabled(reason: string | null): void;
+export declare function agentNativeApiDisabledReason(): string | null;
+/**
+ * Thrown rather than resolved: a caller that cannot tell "no backend" from
+ * "empty result" reports success for work that never happened.
+ */
+export declare class AgentNativeApiDisabledError extends Error {
+    readonly reason: string;
+    constructor(detail: string);
+}
+export declare function assertAgentNativeApiEnabled(detail: string): void;

package/dist/client/api-surface.js

@@ -0,0 +1,32 @@
+/**
+ * Some surfaces are framed by a host and carry no agent-native session at all —
+ * Builder's Design tab frames a canvas that owns no design row and holds no
+ * credential. Every `/_agent-native/*` call from one is unauthenticated by
+ * construction, so the client must not make them: a 401 per poll buries real
+ * failures, and a write can never land.
+ */
+let disabledReason = null;
+/** Pass `null` to re-enable, so a surface can be entered and left. */
+export function setAgentNativeApiDisabled(reason) {
+    disabledReason = reason?.trim() ? reason.trim() : null;
+}
+export function agentNativeApiDisabledReason() {
+    return disabledReason;
+}
+/**
+ * Thrown rather than resolved: a caller that cannot tell "no backend" from
+ * "empty result" reports success for work that never happened.
+ */
+export class AgentNativeApiDisabledError extends Error {
+    reason;
+    constructor(detail) {
+        const reason = disabledReason ?? "unknown surface";
+        super(`agent-native API is disabled on this surface (${reason}): ${detail}`);
+        this.name = "AgentNativeApiDisabledError";
+        this.reason = reason;
+    }
+}
+export function assertAgentNativeApiEnabled(detail) {
+    if (disabledReason)
+        throw new AgentNativeApiDisabledError(detail);
+}

package/dist/client/application-state.js

@@ -1,4 +1,5 @@
 import { agentNativePath } from "./api-path.js";
+import { assertAgentNativeApiEnabled } from "./api-surface.js";
 const APP_STATE_KEY_PATTERN = /^[a-zA-Z0-9_:-]+$/;
 function appStateUrl(key) {
     if (!APP_STATE_KEY_PATTERN.test(key)) {
@@ -63,6 +64,7 @@ function jsonBody(value) {
 /** Server caps a batch at 100 keys; stay under it when splitting. */
 const MAX_BATCH_KEYS = 100;
 export async function readClientAppStateMany(keys, options = {}) {
+    assertAgentNativeApiEnabled(`read application state [${keys.join(", ")}]`);
     const unique = [...new Set(keys)];
     for (const key of unique)
         appStateUrl(key); // validates the key shape
@@ -142,6 +144,7 @@ export async function readClientAppState(key, options = {}) {
     return (batch.values[key] ?? null);
 }
 export async function writeClientAppState(key, value, options = {}) {
+    assertAgentNativeApiEnabled(`write application state "${key}"`);
     const response = await fetch(appStateUrl(key), {
         method: "PUT",
         headers: buildHeaders(options.requestSource),
@@ -152,6 +155,7 @@ export async function writeClientAppState(key, value, options = {}) {
     return parseAppStateResponse(response, `Write application state "${key}"`);
 }
 export async function deleteClientAppState(key, options = {}) {
+    assertAgentNativeApiEnabled(`delete application state "${key}"`);
     const response = await fetch(appStateUrl(key), {
         method: "DELETE",
         // DELETE carries no JSON body, so this custom header is the only

package/dist/client/builder-frame.d.ts

@@ -19,6 +19,12 @@ export interface BuilderChatMessage {
     submit?: boolean;
     mode?: "act" | "plan";
     requestMode?: "act" | "plan";
+    /**
+     * Origin an embedder already verified for itself. `getBuilderParentOrigin()`
+     * needs `?builder.*` params to trust a loopback parent, which a handshake-based
+     * embed never carries — without this the message falls back to `"*"`.
+     */
+    targetOrigin?: string;
 }
 export declare function sendToBuilderChat(opts: BuilderChatMessage): boolean;
 /**

package/dist/client/builder-frame.js

@@ -116,7 +116,7 @@ export function sendToBuilderChat(opts) {
     if (typeof window === "undefined" || !opts.message?.trim())
         return false;
     const hasParentFrame = window.parent !== window;
-    const targetOrigin = getBuilderParentOrigin() ?? "*";
+    const targetOrigin = opts.targetOrigin ?? getBuilderParentOrigin() ?? "*";
     const payload = {
         type: "builder.submitChat",
         data: {

package/dist/client/client-status-requests.js

@@ -1,4 +1,5 @@
 import { agentNativePath } from "./api-path.js";
+import { agentNativeApiDisabledReason } from "./api-surface.js";
 const RESULT_TTL_MS = 500;
 const REQUEST_TIMEOUT_MS = 15_000;
 const cache = new Map();
@@ -31,6 +32,10 @@ function installInvalidationListeners() {
     }
 }
 async function fetchClientStatus(path) {
+    // "unavailable" rather than a fabricated payload: callers already treat it as
+    // "could not read", and there is genuinely nothing to read here.
+    if (agentNativeApiDisabledReason())
+        return { state: "unavailable" };
     installInvalidationListeners();
     const url = agentNativePath(path);
     const cached = cache.get(url);

package/dist/client/host/index.d.ts

@@ -1,4 +1,5 @@
 export { initializeAgentNativeClient } from "../client-bootstrap.js";
+export { agentNativeApiDisabledReason, AgentNativeApiDisabledError, setAgentNativeApiDisabled, } from "../api-surface.js";
 export { ensureEmbedAuthFetchInterceptor, getEmbedAuthToken, isEmbedAuthActive, isEmbedMcpChatBridgeActive, } from "../embed-auth.js";
 export { sendToFrame, onFrameMessage, requestUserInfo, getFrameOrigin, getFramePostMessageTargetOrigin, getCallbackOrigin, oauthRedirectUri, isInFrame, enterStyleEditing, enterTextEditing, exitSelectionMode, type UserInfo, } from "../frame.js";
 export { getBuilderParentOrigin, isInBuilderFrame, sendToBuilderChat, type BuilderChatMessage, } from "../builder-frame.js";

package/dist/client/host/index.js

@@ -1,4 +1,5 @@
 export { initializeAgentNativeClient } from "../client-bootstrap.js";
+export { agentNativeApiDisabledReason, AgentNativeApiDisabledError, setAgentNativeApiDisabled, } from "../api-surface.js";
 export { ensureEmbedAuthFetchInterceptor, getEmbedAuthToken, isEmbedAuthActive, isEmbedMcpChatBridgeActive, } from "../embed-auth.js";
 export { sendToFrame, onFrameMessage, requestUserInfo, getFrameOrigin, getFramePostMessageTargetOrigin, getCallbackOrigin, oauthRedirectUri, isInFrame, enterStyleEditing, enterTextEditing, exitSelectionMode, } from "../frame.js";
 export { getBuilderParentOrigin, isInBuilderFrame, sendToBuilderChat, } from "../builder-frame.js";

package/dist/client/use-action.d.ts

@@ -73,7 +73,7 @@ export declare const ACTION_KEEPALIVE_BODY_BUDGET_BYTES = 48000;
  * `/_agent-native/actions/*` in components.
  */
 export declare function callAction<TResult = undefined, TName extends ActionName = ActionName>(actionName: TName, params?: ActionParams<TName>, options?: ClientActionCallOptions): Promise<TResult extends undefined ? ActionResult<TName> : TResult>;
-export type KeepaliveActionCallRejectionReason = "body-too-large" | "budget-exhausted";
+export type KeepaliveActionCallRejectionReason = "body-too-large" | "budget-exhausted" | "api-disabled";
 export type KeepaliveActionCallResult<TResult> = {
     accepted: true;
     bodyBytes: number;

package/dist/client/use-action.js

@@ -27,6 +27,7 @@ import { getAnalyticsClientPlatform } from "./analytics-platform.js";
 import { getOrCreateAnalyticsSessionId } from "./analytics-session.js";
 import { trackEvent } from "./analytics.js";
 import { agentNativePath } from "./api-path.js";
+import { agentNativeApiDisabledReason, assertAgentNativeApiEnabled, } from "./api-surface.js";
 import { getBrowserTabId } from "./browser-tab-id.js";
 import { clientBuildId, clientCompatibilityVersion, reloadForClientCompatibilityMismatch, } from "./build-compatibility.js";
 import { ensureEmbedAuthFetchInterceptor } from "./embed-auth.js";
@@ -398,6 +399,7 @@ function shouldTrackActionResponse(error, durationMs, response) {
     return Math.random() < rate;
 }
 async function actionFetch(name, method, params, options) {
+    assertAgentNativeApiEnabled(`${method} ${name}`);
     const startedAt = actionTelemetryNow();
     let response;
     let responseAt;
@@ -501,6 +503,16 @@ export function callAction(actionName, params, options = {}) {
 export function tryCallActionKeepalive(actionName, params, options = {}) {
     const serializedBody = JSON.stringify(params ?? {});
     const bodyBytes = utf8ByteLength(serializedBody);
+    // Reported as a refusal rather than thrown: callers keep the work queued on
+    // `accepted: false`, which is the honest outcome for a surface with no backend.
+    if (agentNativeApiDisabledReason()) {
+        return {
+            accepted: false,
+            bodyBytes,
+            reason: "api-disabled",
+            completion: null,
+        };
+    }
     if (bodyBytes > ACTION_KEEPALIVE_BODY_BUDGET_BYTES) {
         return {
             accepted: false,
@@ -547,6 +559,10 @@ export function tryCallActionKeepalive(actionName, params, options = {}) {
  * ```
  */
 export function useActionQuery(actionName, params, options) {
+    // Not `enabled: false` via options: a disabled surface must win over whatever
+    // the caller asked for, and an unfired query reads as "no data" rather than
+    // as an error the UI has to special-case.
+    const apiDisabled = Boolean(agentNativeApiDisabledReason());
     return useQuery({
         queryKey: ["action", actionName, params],
         // Thread React Query's per-fetch AbortSignal into the network request so
@@ -556,6 +572,7 @@ export function useActionQuery(actionName, params, options) {
         retry: defaultActionQueryRetry,
         retryDelay: defaultActionQueryRetryDelay,
         ...options,
+        ...(apiDisabled ? { enabled: false } : {}),
     });
 }
 // ---------------------------------------------------------------------------

package/dist/client/use-session.js

@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useState } from "react";
 import { setSentryUser, trackSessionStatus } from "./analytics.js";
+import { agentNativeApiDisabledReason } from "./api-surface.js";
 import { fetchAuthSessionStatus, invalidateClientStatusRequest, } from "./client-status-requests.js";
 import { getFrameOrigin, getFramePostMessageTargetOrigin } from "./frame.js";
 const SESSION_CACHE_TTL_MS = 30_000;
@@ -98,6 +99,10 @@ export function notifySessionInvalidated() {
     }
 }
 function fetchSharedSession() {
+    // A surface with no agent-native backend is genuinely signed out. `undefined`
+    // would read as "unavailable" and retry until it gave up with an error.
+    if (agentNativeApiDisabledReason())
+        return Promise.resolve(null);
     if (hasFreshSessionCache())
         return Promise.resolve(cachedSession ?? null);
     if (sessionRequest)

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;

package/dist/observability/routes.d.ts

@@ -62,6 +62,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;