@agent-native/core 0.163.4 → 0.164.3

package/dist/server/credential-provider.d.ts

@@ -7,7 +7,7 @@
  * directly. That way the same feature can work in three modes:
  *
  *   1. User set their own key in .env              → use it directly
- *   2. User connected Builder via `/cli-auth`      → route through Builder proxy
+ *   2. User connected Builder via OAuth            → authorize managed Builder requests
  *   3. Neither                                      → throw FeatureNotConfigured
  *
  * Templates catch FeatureNotConfigured and show a "Connect Builder (1 click) /

package/dist/server/credential-provider.js

@@ -7,7 +7,7 @@
  * directly. That way the same feature can work in three modes:
  *
  *   1. User set their own key in .env              → use it directly
- *   2. User connected Builder via `/cli-auth`      → route through Builder proxy
+ *   2. User connected Builder via OAuth            → authorize managed Builder requests
  *   3. Neither                                      → throw FeatureNotConfigured
  *
  * Templates catch FeatureNotConfigured and show a "Connect Builder (1 click) /

package/dist/server/csrf.js

@@ -99,8 +99,8 @@ const CSRF_ALLOWLIST_PREFIXES = [
     // state token. Each callback handler is responsible for its own CSRF
     // check (signed state tokens).
     "/oauth/",
-    // Builder's CLI-auth callback — uses the BUILDER_STATE_PARAM signed token
-    // to authenticate the round-trip; framework CSRF check would block it.
+    // Builder's OAuth callback is a top-level GET whose route validates OAuth
+    // state and the signed-in owner before exchanging the code.
     "/builder/callback",
 ];
 const STATE_CHANGING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);

package/dist/server/onboarding-html.js

@@ -8,14 +8,15 @@
  */
 import { getAppConfig } from "../app-config/index.js";
 import { getLocaleInitScript } from "../localization/server.js";
-import { DEFAULT_LOCALE, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, } from "../localization/shared.js";
+import { DEFAULT_LOCALE, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, localeDisplayName, } from "../localization/shared.js";
 import { NATIVE_AUTH_COPY } from "../shared/auth-copy.js";
 import { docsUrl } from "../shared/docs-url.js";
 import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, } from "../shared/password-policy.js";
 import { signInJourneyInlineScript } from "../shared/sign-in-journey.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
 import { normalizeAppBasePath } from "./app-base-path.js";
-import { BUILT_IN_AUTH_MARKETING, resolveBuiltInAuthMarketing, } from "./auth-marketing.js";
+import { AUTH_MARKETING_LOCALE_COPY, } from "./auth-marketing-locales.js";
+import { BUILT_IN_AUTH_MARKETING, resolveBuiltInAuthMarketing, resolveBuiltInAuthMarketingSlug, } from "./auth-marketing.js";
 import { resolveGoogleAuthMode, } from "./google-auth-mode.js";
 import { hasGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import { identitySsoLoginButtonHtml } from "./identity-sso-store.js";
@@ -876,114 +877,27 @@ const AUTH_LOCALE_COPY = {
     },
 };
 const defaultAuthCopy = AUTH_LOCALE_COPY[DEFAULT_LOCALE];
-const AUTH_MARKETING_LOCALE_COPY = {
-    "zh-CN": {
-        forms: {
-            tagline: "你的 AI 代理与你一起构建、发布和分析表单。",
-            features: [
-                "用一句话创建完整表单",
-                "即时发布，生成可分享链接和验证码",
-                "按需获取回复摘要、导出和趋势分析",
-            ],
-        },
-    },
-    "zh-TW": {
-        forms: {
-            tagline: "你的 AI 代理會和你一起建立、發布與分析表單。",
-            features: [
-                "用一句話建立完整表單",
-                "立即發布，產生可分享連結與驗證碼",
-                "依需求取得回覆摘要、匯出與趨勢分析",
-            ],
-        },
-    },
-    "es-ES": {
-        forms: {
-            tagline: "Tu agente de IA crea, publica y analiza formularios contigo.",
-            features: [
-                "Crea formularios completos con una sola frase",
-                "Publicación instantánea con enlaces compartibles y captcha",
-                "Resúmenes de respuestas, exportaciones y análisis de tendencias al instante",
-            ],
-        },
-    },
-    "fr-FR": {
-        forms: {
-            tagline: "Votre agent IA crée, publie et analyse des formulaires avec vous.",
-            features: [
-                "Créez des formulaires complets à partir d'une seule phrase",
-                "Publication instantanée avec liens partageables et captcha",
-                "Résumés de réponses, exports et analyse des tendances à la demande",
-            ],
-        },
-    },
-    "de-DE": {
-        forms: {
-            tagline: "Dein KI-Agent erstellt, veröffentlicht und analysiert Formulare mit dir.",
-            features: [
-                "Erstelle vollständige Formulare aus einem einzigen Satz",
-                "Sofortige Veröffentlichung mit teilbaren Links und Captcha",
-                "Antwortzusammenfassungen, Exporte und Trendanalysen auf Abruf",
-            ],
-        },
-    },
-    "ja-JP": {
-        forms: {
-            tagline: "AI エージェントがフォームの作成、公開、分析を一緒に進めます。",
-            features: [
-                "一文から完全なフォームを作成",
-                "共有リンクと CAPTCHA 付きで即時公開",
-                "回答の要約、エクスポート、トレンド分析を必要なときに実行",
-            ],
-        },
-    },
-    "ko-KR": {
-        forms: {
-            tagline: "AI 에이전트가 양식 생성, 게시, 분석을 함께 도와줍니다.",
-            features: [
-                "한 문장으로 완성된 양식 만들기",
-                "공유 링크와 captcha로 즉시 게시",
-                "응답 요약, 내보내기, 추세 분석을 필요할 때 실행",
-            ],
-        },
-    },
-    "pt-BR": {
-        forms: {
-            tagline: "Seu agente de IA cria, publica e analisa formulários junto com você.",
-            features: [
-                "Crie formulários completos a partir de uma única frase",
-                "Publicação instantânea com links compartilháveis e captcha",
-                "Resumos de respostas, exportações e análise de tendências sob demanda",
-            ],
-        },
-    },
-    "hi-IN": {
-        forms: {
-            tagline: "आपका AI एजेंट आपके साथ फ़ॉर्म बनाता, प्रकाशित करता और उनका विश्लेषण करता है।",
-            features: [
-                "एक वाक्य से पूरे फ़ॉर्म बनाएं",
-                "शेयर करने योग्य लिंक और captcha के साथ तुरंत प्रकाशित करें",
-                "ज़रूरत पड़ने पर प्रतिक्रिया सारांश, exports और trend analysis पाएं",
-            ],
-        },
-    },
-    "ar-SA": {
-        forms: {
-            tagline: "يساعدك وكيل الذكاء الاصطناعي على إنشاء النماذج ونشرها وتحليلها.",
-            features: [
-                "أنشئ نماذج كاملة من جملة واحدة",
-                "نشر فوري مع روابط قابلة للمشاركة وcaptcha",
-                "ملخصات للإجابات وتصدير وتحليل اتجاهات عند الطلب",
-            ],
-        },
-    },
-};
-function resolveBuiltInMarketingSlug(marketing) {
+function resolveBuiltInMarketingSlug(marketing, opts = {}) {
     if (!marketing)
         return undefined;
+    const matchesBuiltInMarketing = (builtIn) => marketing.appName === builtIn.appName &&
+        marketing.tagline === builtIn.tagline &&
+        marketing.description === builtIn.description &&
+        JSON.stringify(marketing.features ?? []) ===
+            JSON.stringify(builtIn.features ?? []) &&
+        JSON.stringify(marketing.signupLocalModeNote ?? null) ===
+            JSON.stringify(builtIn.signupLocalModeNote ?? null);
+    const requestSlug = resolveBuiltInAuthMarketingSlug(opts);
+    if (requestSlug) {
+        const builtIn = BUILT_IN_AUTH_MARKETING[requestSlug];
+        if (builtIn && matchesBuiltInMarketing(builtIn))
+            return requestSlug;
+    }
     for (const [slug, builtIn] of Object.entries(BUILT_IN_AUTH_MARKETING)) {
-        if (marketing.appName === builtIn.appName &&
-            marketing.tagline === builtIn.tagline) {
+        // Caller-supplied marketing can reuse a built-in app name. Only an exact
+        // content match may claim a slug, or localized copy would overwrite the
+        // custom description/features.
+        if (matchesBuiltInMarketing(builtIn)) {
             return slug;
         }
     }
@@ -1041,7 +955,10 @@ export function getOnboardingHtml(opts = {}) {
             requestPath: opts.requestPath,
         });
     const hasMarketing = !!marketing && !simplifiedAuth;
-    const marketingSlug = resolveBuiltInMarketingSlug(marketing);
+    const marketingSlug = resolveBuiltInMarketingSlug(marketing, {
+        requestHost: opts.requestHost,
+        requestPath: opts.requestPath,
+    });
     const defaultMarketingCopy = marketing
         ? {
             tagline: marketing.tagline,
@@ -1049,6 +966,14 @@ export function getOnboardingHtml(opts = {}) {
             features: marketing.features,
         }
         : undefined;
+    const localizedMarketingCopy = {};
+    if (marketingSlug) {
+        for (const [locale, copyBySlug] of Object.entries(AUTH_MARKETING_LOCALE_COPY)) {
+            const copy = copyBySlug?.[marketingSlug];
+            if (copy)
+                localizedMarketingCopy[locale] = copy;
+        }
+    }
     const signupLocalModeNote = isAgentNativeHostedHost(opts.requestHost) &&
         marketing?.signupLocalModeNote?.command.trim()
         ? {
@@ -1076,13 +1001,10 @@ export function getOnboardingHtml(opts = {}) {
     const localeMenuItemsHtml = [
         `    <button type="button" class="locale-menu-item" role="menuitemradio" aria-checked="false" data-locale-value="system">
       <span class="locale-menu-check" aria-hidden="true">✓</span>
-      <span${i18nAttr("systemLanguage")}>${esc(t("systemLanguage"))}</span>
+      <span data-system-language>${esc(t("systemLanguage"))}</span>
     </button>`,
         ...SUPPORTED_LOCALES.map((locale) => {
-            const metadata = LOCALE_METADATA[locale];
-            const label = metadata.nativeName === metadata.englishName
-                ? `${metadata.nativeName} (${metadata.code})`
-                : `${metadata.nativeName} (${metadata.englishName})`;
+            const label = localeDisplayName(locale);
             return `    <button type="button" class="locale-menu-item" role="menuitemradio" aria-checked="false" data-locale-value="${esc(locale)}">
       <span class="locale-menu-check" aria-hidden="true">✓</span>
       <span>${esc(label)}</span>
@@ -2184,7 +2106,7 @@ ${signInJourneyInlineScript()}
     var __AN_AUTH_HAS_MARKETING = ${JSON.stringify(hasMarketing)};
     var __AN_AUTH_MARKETING_SLUG = ${JSON.stringify(marketingSlug ?? "")};
     var __AN_AUTH_MARKETING_DEFAULT = ${JSON.stringify(defaultMarketingCopy ?? {})};
-    var __AN_AUTH_MARKETING_LOCALES = ${JSON.stringify(AUTH_MARKETING_LOCALE_COPY)};
+    var __AN_AUTH_MARKETING_LOCALES = ${JSON.stringify(localizedMarketingCopy)};
     var __anAuthLocale = __AN_AUTH_DEFAULT_LOCALE;
     var __anAuthLocalePreference = 'system';
     var __AN_AUTH_MODE = ${JSON.stringify(authMode)};
@@ -2229,11 +2151,7 @@ ${signInJourneyInlineScript()}
       } catch(e) {}
       return [];
     }
-    function __anResolveAuthLocale(preference) {
-      var normalizedPreference = __anNormalizeAuthLocalePreference(preference) || 'system';
-      if (normalizedPreference !== 'system') return normalizedPreference;
-      var rootLocale = __anNormalizeAuthLocale(document.documentElement.getAttribute('data-locale'));
-      if (rootLocale) return rootLocale;
+    function __anResolveAuthSystemLocale() {
       var locales = __anBrowserAuthLocales();
       for (var i = 0; i < locales.length; i++) {
         var match = __anNormalizeAuthLocale(locales[i]);
@@ -2241,6 +2159,19 @@ ${signInJourneyInlineScript()}
       }
       return __AN_AUTH_DEFAULT_LOCALE;
     }
+    function __anResolveAuthLocale(preference) {
+      var normalizedPreference = __anNormalizeAuthLocalePreference(preference) || 'system';
+      return normalizedPreference === 'system'
+        ? __anResolveAuthSystemLocale()
+        : normalizedPreference;
+    }
+    function __anApplyAuthSystemLanguage() {
+      var systemLanguage = document.querySelector('[data-system-language]');
+      if (!systemLanguage) return;
+      var systemLocale = __anResolveAuthSystemLocale();
+      var localized = __AN_AUTH_LOCALES[systemLocale] || __AN_AUTH_LOCALES[__AN_AUTH_DEFAULT_LOCALE] || {};
+      systemLanguage.textContent = localized.systemLanguage || 'System';
+    }
     function __anT(key) {
       var localized = __AN_AUTH_LOCALES[__anAuthLocale] || __AN_AUTH_LOCALES[__AN_AUTH_DEFAULT_LOCALE] || {};
       var fallback = __AN_AUTH_LOCALES[__AN_AUTH_DEFAULT_LOCALE] || {};
@@ -2293,7 +2224,7 @@ ${signInJourneyInlineScript()}
     }
     function __anMarketingCopy() {
       if (!__AN_AUTH_MARKETING_SLUG) return __AN_AUTH_MARKETING_DEFAULT || {};
-      var localeMarketing = (__AN_AUTH_MARKETING_LOCALES[__anAuthLocale] || {})[__AN_AUTH_MARKETING_SLUG] || {};
+      var localeMarketing = __AN_AUTH_MARKETING_LOCALES[__anAuthLocale] || {};
       return {
         tagline: localeMarketing.tagline || __AN_AUTH_MARKETING_DEFAULT.tagline,
         description: localeMarketing.description || __AN_AUTH_MARKETING_DEFAULT.description,
@@ -2342,6 +2273,7 @@ ${signInJourneyInlineScript()}
       document.title = __AN_AUTH_HAS_MARKETING && __AN_AUTH_MARKETING_APP_NAME
         ? __AN_AUTH_MARKETING_APP_NAME + ' — ' + __anT('pageTitleSignIn')
         : __anT('pageTitleWelcome');
+      __anApplyAuthSystemLanguage();
       __anApplyAuthMarketingCopy();
       __anRefreshAuthViewCopy();
     }

package/dist/server/ssr-handler.js

@@ -18,7 +18,7 @@ import { defineEventHandler } from "h3";
  */
 import { createRequestHandler } from "react-router";
 import { isMcpPublicPath } from "../mcp/route-paths.js";
-import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, } from "../shared/cache-control.js";
+import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, SSR_QUERY_CACHE_KEY_HEADER, } from "../shared/cache-control.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
 import { getAppBasePathFromViteEnv, stripAppBasePath as canonicalStripAppBasePath, } from "./app-base-path.js";
 import { getAppOriginClientConfigScript } from "./app-origin-config.js";
@@ -204,6 +204,8 @@ function isSsrHtmlOrDataResponse(headers, status, pathname) {
  * that contradicts that.
  */
 function applyDefaultSsrCacheHeader(headers, status, pathname) {
+    const varyByQuery = headers.get(SSR_QUERY_CACHE_KEY_HEADER)?.trim().toLowerCase() === "query";
+    headers.delete(SSR_QUERY_CACHE_KEY_HEADER);
     if (!isSsrHtmlOrDataResponse(headers, status, pathname))
         return;
     // A public shell must never set a viewer cookie or vary by credentials.
@@ -234,9 +236,16 @@ function applyDefaultSsrCacheHeader(headers, status, pathname) {
     for (const [name, value] of Object.entries(resolveSsrCacheHeaders())) {
         headers.set(name, value);
     }
-    for (const [name, value] of Object.entries(resolveSsrCacheKeyHeaders())) {
-        headers.set(name, value);
-    }
+    const cacheKeyHeaders = resolveSsrCacheKeyHeaders();
+    const netlifyVary = varyByQuery
+        ? cacheKeyHeaders["netlify-vary"]
+            ? "query"
+            : undefined
+        : cacheKeyHeaders["netlify-vary"];
+    if (netlifyVary)
+        headers.set("netlify-vary", netlifyVary);
+    else
+        headers.delete("netlify-vary");
 }
 function applyDefaultSpeculationRulesHeader(headers, status, basePath) {
     if (status < 200 || status >= 400)

package/dist/settings/store.d.ts

@@ -21,4 +21,13 @@ export declare function deleteSetting(key: string, options?: StoreWriteOptions):
  * takes its `o:<orgId>:*` keys with it).
  */
 export declare function deleteSettingsByPrefix(prefix: string, options?: StoreWriteOptions): Promise<number>;
+/**
+ * Read every setting whose key starts with `prefix`. Callers that only need
+ * one namespace must not use {@link getAllSettings} — that loads the whole
+ * table.
+ */
+export declare function listSettingsByPrefix(prefix: string): Promise<Array<{
+    key: string;
+    value: Record<string, unknown>;
+}>>;
 export declare function getAllSettings(): Promise<Record<string, Record<string, unknown>>>;

package/dist/settings/store.js

@@ -247,6 +247,25 @@ export async function deleteSettingsByPrefix(prefix, options) {
     }
     return result.rowsAffected;
 }
+/**
+ * Read every setting whose key starts with `prefix`. Callers that only need
+ * one namespace must not use {@link getAllSettings} — that loads the whole
+ * table.
+ */
+export async function listSettingsByPrefix(prefix) {
+    await ensureTable();
+    const client = getDbExec();
+    const table = settingsTable();
+    const escaped = prefix.replace(/[!%_]/g, (c) => `!${c}`);
+    const { rows } = await client.execute({
+        sql: `SELECT key, value FROM ${table} WHERE key LIKE ? ESCAPE '!'`,
+        args: [`${escaped}%`],
+    });
+    return rows.map((row) => ({
+        key: String(row.key),
+        value: JSON.parse(String(row.value)),
+    }));
+}
 export async function getAllSettings() {
     const raw = await loadAllSettingsRaw();
     const result = {};

package/dist/shared/cache-control.d.ts

@@ -7,6 +7,28 @@ export declare const DEFAULT_SSR_CACHE_HEADERS: {
     readonly "cdn-cache-control": "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
     readonly "netlify-cdn-cache-control": "public, durable, s-maxage=31536000, stale-while-revalidate=604800, stale-if-error=3600";
 };
+/**
+ * Content type used by impersonal HTML redirects that should enter the
+ * deployment adapter's shared SSR cache path.
+ */
+export declare const SSR_HTML_CONTENT_TYPE = "text/html; charset=utf-8";
+/**
+ * Internal response marker for public HTML whose redirect target preserves
+ * request query parameters. The SSR adapters consume this marker and emit a
+ * provider-specific full-query cache key only where the provider supports it.
+ */
+export declare const SSR_QUERY_CACHE_KEY_HEADER = "x-agent-native-ssr-key";
+export type SsrHtmlContentTypeOptions = {
+    varyByQuery?: boolean;
+};
+/**
+ * Mark an already-built HTML response as HTML without changing its redirect
+ * status, location, or other headers. Only use this for redirects whose
+ * target is independent of the viewer and request credentials. Set
+ * `varyByQuery` when the target preserves request query parameters so the SSR
+ * adapter can request a full-query cache key on providers that support it.
+ */
+export declare function withSsrHtmlContentType<T extends Response>(response: T, options?: SsrHtmlContentTypeOptions): T;
 /**
  * Deployment-wide override for the SSR shell cache policy.
  *

package/dist/shared/cache-control.js

@@ -7,6 +7,31 @@ export const DEFAULT_SSR_CACHE_HEADERS = {
     "cdn-cache-control": DEFAULT_SSR_CDN_CACHE_CONTROL,
     "netlify-cdn-cache-control": DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL,
 };
+/**
+ * Content type used by impersonal HTML redirects that should enter the
+ * deployment adapter's shared SSR cache path.
+ */
+export const SSR_HTML_CONTENT_TYPE = "text/html; charset=utf-8";
+/**
+ * Internal response marker for public HTML whose redirect target preserves
+ * request query parameters. The SSR adapters consume this marker and emit a
+ * provider-specific full-query cache key only where the provider supports it.
+ */
+export const SSR_QUERY_CACHE_KEY_HEADER = "x-agent-native-ssr-key";
+/**
+ * Mark an already-built HTML response as HTML without changing its redirect
+ * status, location, or other headers. Only use this for redirects whose
+ * target is independent of the viewer and request credentials. Set
+ * `varyByQuery` when the target preserves request query parameters so the SSR
+ * adapter can request a full-query cache key on providers that support it.
+ */
+export function withSsrHtmlContentType(response, options = {}) {
+    response.headers.set("content-type", SSR_HTML_CONTENT_TYPE);
+    if (options.varyByQuery) {
+        response.headers.set(SSR_QUERY_CACHE_KEY_HEADER, "query");
+    }
+    return response;
+}
 /**
  * Deployment-wide override for the SSR shell cache policy.
  *

package/dist/shared/index.d.ts

@@ -6,6 +6,7 @@ export { truncate } from "./truncate.js";
 export { isHumanReadableDocumentTitle, normalizeDocumentTitle, } from "./document-title.js";
 export { injectDocumentMarkup } from "./html-document.js";
 export { withBuilderUtmTrackingParams } from "./builder-link-tracking.js";
+export { SSR_HTML_CONTENT_TYPE, SSR_QUERY_CACHE_KEY_HEADER, type SsrHtmlContentTypeOptions, withSsrHtmlContentType, } from "./cache-control.js";
 export { AGENT_NATIVE_DOCS_ORIGIN, docsUrl, type DocsUrlOptions, } from "./docs-url.js";
 export { buildRuntimeConfigPrompt, formatRuntimeConfigReport, getRuntimeConfigReport, parseRuntimeConfigReport, runtimeConfigRequirementsFromSearchParams, type RuntimeConfigEnvironment, type RuntimeConfigIssue, type RuntimeConfigIssueCode, type RuntimeConfigIssueSeverity, type RuntimeConfigPhase, type RuntimeConfigReport, type RuntimeConfigRequirements, } from "./runtime-config.js";
 export { llmConnectionTrackingProperties, normalizeLlmConnection, type LlmConnectionStatus, } from "./llm-connection.js";

package/dist/shared/index.js

@@ -6,6 +6,7 @@ export { truncate } from "./truncate.js";
 export { isHumanReadableDocumentTitle, normalizeDocumentTitle, } from "./document-title.js";
 export { injectDocumentMarkup } from "./html-document.js";
 export { withBuilderUtmTrackingParams } from "./builder-link-tracking.js";
+export { SSR_HTML_CONTENT_TYPE, SSR_QUERY_CACHE_KEY_HEADER, withSsrHtmlContentType, } from "./cache-control.js";
 export { AGENT_NATIVE_DOCS_ORIGIN, docsUrl, } from "./docs-url.js";
 export { buildRuntimeConfigPrompt, formatRuntimeConfigReport, getRuntimeConfigReport, parseRuntimeConfigReport, runtimeConfigRequirementsFromSearchParams, } from "./runtime-config.js";
 export { llmConnectionTrackingProperties, normalizeLlmConnection, } from "./llm-connection.js";

package/dist/templates/chat/netlify.toml

@@ -12,3 +12,5 @@ NPM_CONFIG_PRODUCTION = "false"
 
 [context.production.environment]
 AGENT_NATIVE_HOSTED_HARNESS = "true"
+AGENT_NATIVE_ENABLE_KEEP_WARM = "1"
+AGENT_NATIVE_DISABLE_KEEP_WARM_BACKGROUND = "1"

package/docs/content/deployment.mdx

@@ -820,6 +820,8 @@ In a standard production deployment with [production code execution](#production
 
 [Builder.io](https://www.builder.io?utm_source=agent-native&utm_medium=docs&utm_campaign=framework&utm_content=deployment) is a separate managed code-capable workflow where an agent can modify your app's UI in production. Connect your repo to Builder.io (free tier available) and prompt for UI changes directly — no redeploy needed.
 
+**Connect Builder** in Settings uses Builder OAuth (`builder:ai:invoke`) with a same-origin HTTPS callback under `/_agent-native/builder/callback`, so hosted origins such as Railway work without a domain allowlist. Legacy `BUILDER_*` private keys remain a runtime fallback for existing connections.
+
 **How it works:**
 
 1. Connect your agent-native repo to Builder.io (free tier available)

package/docs/content/multi-app-workspace.mdx

@@ -260,7 +260,7 @@ my-company-platform/
 
 A few onboarding flows are workspace-aware out of the box:
 
-- **Builder `/cli-auth`**: clicking "Connect Builder" (free tier available) from any app writes `BUILDER_PRIVATE_KEY` and friends to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Builder OAuth**: clicking "Connect Builder" authorizes the signed-in user with the least-privilege `builder:ai:invoke` scope and stores the token in encrypted per-user custody. Legacy Builder keys remain available only to existing uncovered integrations.
 - **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 This works because every app in the same workspace points at the same `DATABASE_URL` by default, so framework credential storage (`@agent-native/core/credentials`) makes a credential available to every app without per-app config. Add a thin helper in `packages/shared` if your workspace wants a stricter naming convention.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.163.4",
+  "version": "0.164.3",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -428,7 +428,7 @@
     "yjs": "^13.6.32",
     "zod": "^4.3.6",
     "@agent-native/recap-cli": "0.5.5",
-    "@agent-native/toolkit": "^0.16.5"
+    "@agent-native/toolkit": "^0.16.6"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",

package/src/templates/chat/netlify.toml

@@ -12,3 +12,5 @@ NPM_CONFIG_PRODUCTION = "false"
 
 [context.production.environment]
 AGENT_NATIVE_HOSTED_HARNESS = "true"
+AGENT_NATIVE_ENABLE_KEEP_WARM = "1"
+AGENT_NATIVE_DISABLE_KEEP_WARM_BACKGROUND = "1"