@agent-native/core 0.163.4 → 0.164.3

package/dist/client/transcription/BuilderTranscriptionCta.js

@@ -31,7 +31,7 @@ export function BuilderTranscriptionCta() {
             // Env-managed mode counts as configured for the CTA — the deploy
             // already routes transcription through Builder, no per-user prompt.
             setConfigured(!!(s?.configured || s?.envManaged));
-            setConnectUrl(s?.cliAuthUrl || s?.connectUrl || null);
+            setConnectUrl(s?.connectUrl || null);
         })
             .catch(() => {
             if (mountedRef.current)

package/dist/code-agents/index.d.ts

@@ -6,3 +6,5 @@ export { escapePromptAttachmentAttribute, formatPromptWithAttachments, type Agen
 export { CODE_AGENT_PERMISSION_MODES, appendCodeAgentTranscriptEvent, codeAgentRunArtifactsDir, codeAgentRunTranscriptPath, codeAgentRunsDir, codeAgentStoreRoot, codeAgentTranscriptsDir, createCodeAgentRunRecord, getCodeAgentRunRecord, getLastCodeAgentRunRecord, isActiveCodeAgentRun, listCodeAgentRunRecords, listCodeAgentTranscriptEvents, normalizeCodeAgentPermissionMode, queueCodeAgentFollowUp, updateCodeAgentRunRecord, type AppendCodeAgentTranscriptEventInput, type CodeAgentPermissionMode, type CodeAgentRunDetail, type CodeAgentRunProgress, type CodeAgentRunRecord, type CodeAgentRunStatus, type CodeAgentTranscriptEvent, type CodeAgentTranscriptEventKind, type CreateCodeAgentRunInput, type CodeAgentFollowUpMode, type QueueCodeAgentFollowUpInput, } from "../cli/code-agent-runs.js";
 export { findProjectSlashCommand, isReservedProjectSlashCommandName, listProjectSkills, listProjectSlashCommands, listVisibleProjectSlashCommands, readProjectCodePack, renderProjectSlashCommandPrompt, type CodeAgentCodePack, type CodeAgentProjectCommand, type CodeAgentProjectSkill, type ReadProjectCodePackOptions, } from "../cli/code-agent-commands.js";
 export { executeCodeAgentRun, executeExistingCodeAgentRun, executePendingCodeAgentApproval, type ExecuteCodeAgentRunOptions, } from "../cli/code-agent-executor.js";
+export { codeAgentSchedulesPath, createCodeAgentSchedule, deleteCodeAgentSchedule, getCodeAgentSchedule, isCodeAgentScheduleDue, listCodeAgentSchedules, markCodeAgentScheduleRun, nextCodeAgentScheduleRunAt, updateCodeAgentSchedule, type CodeAgentScheduleRecord, type CodeAgentScheduleRunPatch, type CodeAgentScheduleScope, type CodeAgentScheduleStatus, type CreateCodeAgentScheduleInput, type UpdateCodeAgentScheduleInput, } from "../cli/code-agent-schedules.js";
+export { createCodeAgentThread, listCodeAgentThreadSummaries, messageCodeAgentThread, type CodeAgentThreadSummary, type CreateCodeAgentThreadInput, type CreateCodeAgentThreadResult, type MessageCodeAgentThreadInput, type MessageCodeAgentThreadResult, } from "../cli/code-agent-collaboration.js";

package/dist/code-agents/index.js

@@ -6,3 +6,5 @@ export { escapePromptAttachmentAttribute, formatPromptWithAttachments, } from ".
 export { CODE_AGENT_PERMISSION_MODES, appendCodeAgentTranscriptEvent, codeAgentRunArtifactsDir, codeAgentRunTranscriptPath, codeAgentRunsDir, codeAgentStoreRoot, codeAgentTranscriptsDir, createCodeAgentRunRecord, getCodeAgentRunRecord, getLastCodeAgentRunRecord, isActiveCodeAgentRun, listCodeAgentRunRecords, listCodeAgentTranscriptEvents, normalizeCodeAgentPermissionMode, queueCodeAgentFollowUp, updateCodeAgentRunRecord, } from "../cli/code-agent-runs.js";
 export { findProjectSlashCommand, isReservedProjectSlashCommandName, listProjectSkills, listProjectSlashCommands, listVisibleProjectSlashCommands, readProjectCodePack, renderProjectSlashCommandPrompt, } from "../cli/code-agent-commands.js";
 export { executeCodeAgentRun, executeExistingCodeAgentRun, executePendingCodeAgentApproval, } from "../cli/code-agent-executor.js";
+export { codeAgentSchedulesPath, createCodeAgentSchedule, deleteCodeAgentSchedule, getCodeAgentSchedule, isCodeAgentScheduleDue, listCodeAgentSchedules, markCodeAgentScheduleRun, nextCodeAgentScheduleRunAt, updateCodeAgentSchedule, } from "../cli/code-agent-schedules.js";
+export { createCodeAgentThread, listCodeAgentThreadSummaries, messageCodeAgentThread, } from "../cli/code-agent-collaboration.js";

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/deploy/build.js

@@ -23,7 +23,7 @@ import { INTEGRATION_RECOVERY_RUNTIME_MARKER, INTEGRATION_RETRY_SWEEP_PATH, INTE
 import { isValidCron } from "../jobs/cron.js";
 import { RECURRING_JOBS_SWEEP_PATH, RECURRING_JOBS_SWEEP_TOKEN_SUBJECT, } from "../jobs/scheduler-dispatch.js";
 import { normalizeAppBasePath } from "../server/app-base-path.js";
-import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, } from "../shared/cache-control.js";
+import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, SSR_QUERY_CACHE_KEY_HEADER, } from "../shared/cache-control.js";
 import { mcpEmbedStaticAssetRouteRules } from "../shared/mcp-embed-headers.js";
 import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, } from "../shared/social-meta.js";
@@ -1107,6 +1107,7 @@ function injectHeadScript(html, script) {
 // Resolved from AGENT_NATIVE_SSR_CACHE at build time.
 const SSR_CACHE_HEADERS = ${JSON.stringify(ssrCacheHeaders)};
 const SSR_CACHE_KEY_HEADERS = ${JSON.stringify(ssrCacheKeyHeaders)};
+const SSR_QUERY_CACHE_KEY_HEADER = ${JSON.stringify(SSR_QUERY_CACHE_KEY_HEADER)};
 const DEFAULT_SPECULATION_RULES_PATH = ${JSON.stringify(DEFAULT_SPECULATION_RULES_PATH)};
 const IMMUTABLE_ASSET_CACHE_CONTROL = ${JSON.stringify(IMMUTABLE_ASSET_CACHE_CONTROL)};
 const IMMUTABLE_ASSET_PATHS = new Set(${JSON.stringify([...new Set(immutableAssetPaths)].sort())});
@@ -1174,6 +1175,9 @@ function isSsrHtmlOrDataResponse(headers, status, pathname) {
  * from the canonical Nitro/Netlify handler or send normal pages to origin.
  */
 function applyDefaultSsrCacheHeader(headers, status, pathname) {
+  const varyByQuery =
+    (headers.get(SSR_QUERY_CACHE_KEY_HEADER) || "").trim().toLowerCase() === "query";
+  headers.delete(SSR_QUERY_CACHE_KEY_HEADER);
   if (!isSsrHtmlOrDataResponse(headers, status, pathname)) return;
 
   headers.delete("set-cookie");
@@ -1193,9 +1197,11 @@ function applyDefaultSsrCacheHeader(headers, status, pathname) {
   for (const [name, value] of Object.entries(SSR_CACHE_HEADERS)) {
     headers.set(name, value);
   }
-  for (const [name, value] of Object.entries(SSR_CACHE_KEY_HEADERS)) {
-    headers.set(name, value);
-  }
+  const netlifyVary = varyByQuery
+    ? SSR_CACHE_KEY_HEADERS["netlify-vary"] ? "query" : undefined
+    : SSR_CACHE_KEY_HEADERS["netlify-vary"];
+  if (netlifyVary) headers.set("netlify-vary", netlifyVary);
+  else headers.delete("netlify-vary");
 }
 
 function applyDefaultSpeculationRulesHeader(headers, status, basePath) {

package/dist/localization/shared.d.ts

@@ -29,6 +29,8 @@ export declare const LOCALIZATION_SETTING_KEY = "localization";
 export declare const LOCALE_STORAGE_KEY = "agent-native:locale-preference";
 export declare const LOCALE_HYDRATION_GLOBAL = "__AGENT_NATIVE_LOCALE__";
 export declare const LOCALE_METADATA: Record<LocaleCode, LocaleMetadata>;
+/** Return the short native language name used in compact locale pickers. */
+export declare function localeDisplayName(locale: LocaleCode): string;
 export declare function isLocaleCode(value: unknown): value is LocaleCode;
 export declare function normalizeLocaleCode(value: unknown): LocaleCode | null;
 export declare function normalizeLocalePreference(value: unknown): LocalePreference | null;

package/dist/localization/shared.js

@@ -83,6 +83,11 @@ export const LOCALE_METADATA = {
         dir: "rtl",
     },
 };
+/** Return the short native language name used in compact locale pickers. */
+export function localeDisplayName(locale) {
+    const nativeName = LOCALE_METADATA[locale]?.nativeName ?? locale;
+    return nativeName.split("(", 1)[0]?.trim() || nativeName;
+}
 const SUPPORTED_LOCALE_SET = new Set(SUPPORTED_LOCALES);
 const CHINESE_LOCALE_ALIASES = {
     "zh-cn": "zh-CN",

package/dist/mcp-client/oauth-client.d.ts

@@ -70,6 +70,7 @@ export declare class McpOAuthClientProvider implements OAuthClientProvider {
     get savedCodeVerifierValue(): string | undefined;
     get savedTokensValue(): OAuthTokens | undefined;
     get savedClientInformation(): StoredOAuthClientInformation | undefined;
+    validateResourceURL(defaultResource: string | URL, advertised?: string): Promise<URL | undefined>;
 }
 export declare function startMcpOAuthAuthorization(options: McpOAuthProviderOptions & {
     scope?: string;

package/dist/mcp-client/oauth-client.js

@@ -23,6 +23,44 @@ function checkedRemoteUrl(value, label) {
 function canonicalServerUrl(value) {
     return checkedRemoteUrl(value, "server").toString();
 }
+/**
+ * RFC 8707 resource identifiers are exact strings. WHATWG `URL` origin-only
+ * values stringify with a trailing slash (`https://api.builder.io/` vs
+ * `https://api.builder.io`), and the MCP SDK puts `resource.href` on authorize
+ * and token requests. Servers that registered the unsuffixed identifier reject
+ * the canonical form as unregistered.
+ */
+class Rfc8707ResourceUrl extends URL {
+    identifier;
+    constructor(identifier) {
+        super(identifier);
+        this.identifier = identifier;
+    }
+    get href() {
+        return this.identifier;
+    }
+    toString() {
+        return this.identifier;
+    }
+}
+function rfc8707ResourceUrl(identifier) {
+    checkedRemoteUrl(identifier, "resource");
+    return new Rfc8707ResourceUrl(identifier);
+}
+function resourceIsAllowed(requested, configured) {
+    const configuredUrl = new URL(configured);
+    if (requested.origin !== configuredUrl.origin)
+        return false;
+    if (requested.pathname.length < configuredUrl.pathname.length)
+        return false;
+    const requestedPath = requested.pathname.endsWith("/")
+        ? requested.pathname
+        : `${requested.pathname}/`;
+    const configuredPath = configuredUrl.pathname.endsWith("/")
+        ? configuredUrl.pathname
+        : `${configuredUrl.pathname}/`;
+    return requestedPath.startsWith(configuredPath);
+}
 function serverUrlsMatch(stored, canonical) {
     try {
         return canonicalServerUrl(stored) === canonical;
@@ -256,6 +294,17 @@ export class McpOAuthClientProvider {
     get savedClientInformation() {
         return this.clientInfo;
     }
+    async validateResourceURL(defaultResource, advertised) {
+        if (!advertised)
+            return undefined;
+        const requested = typeof defaultResource === "string"
+            ? new URL(defaultResource)
+            : defaultResource;
+        if (!resourceIsAllowed(requested, advertised)) {
+            throw new Error(`Protected resource ${advertised} does not match expected ${requested} (or origin)`);
+        }
+        return rfc8707ResourceUrl(advertised);
+    }
 }
 export async function startMcpOAuthAuthorization(options) {
     checkedRemoteUrl(options.serverUrl, "server");
@@ -435,7 +484,7 @@ export async function getMcpOAuthAccessToken(options) {
                 throw new Error("MCP OAuth refresh issuer binding is invalid.");
             }
             const resource = discovery.resourceMetadata?.resource
-                ? checkedRemoteUrl(discovery.resourceMetadata.resource, "resource")
+                ? rfc8707ResourceUrl(discovery.resourceMetadata.resource)
                 : undefined;
             const authorizationServerUrl = checkedRemoteUrl(discovery.authorizationServerUrl, "authorization server");
             const refreshed = await refreshAuthorization(authorizationServerUrl, {

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
-    error?: undefined;
     count: number;
     updated?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated: number;
+    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,8 +26,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -62,6 +62,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,8 +311,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        id?: undefined;
         deleted?: undefined;
+        id?: undefined;
         providers: {
             id: string;
             label: string;
@@ -329,8 +329,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        id?: undefined;
         deleted?: undefined;
+        id?: undefined;
         providers?: undefined;
         count?: undefined;
         found: boolean;

package/dist/server/auth-marketing-locales.d.ts

@@ -0,0 +1,7 @@
+import type { LocaleCode } from "../localization/shared.js";
+export interface AuthMarketingLocaleCopy {
+    tagline?: string;
+    description?: string;
+    features?: string[];
+}
+export declare const AUTH_MARKETING_LOCALE_COPY: Partial<Record<LocaleCode, Record<string, AuthMarketingLocaleCopy>>>;