@agent-native/core 0.164.4 → 0.164.12

package/dist/server/embed-session.d.ts

@@ -66,6 +66,7 @@ export type ResolvedEmbedSession = {
  */
 export declare function isEmbedCapabilityScope(scope: string | undefined | null): boolean;
 export declare function resolvedEmbedCapabilityScope(session: ResolvedEmbedSession | null): string | undefined;
+export declare function ensureTable(): Promise<void>;
 export declare function requestMatchesEmbedTarget(event: H3Event, targetPath: string): boolean;
 export declare function normalizeEmbedTargetPath(raw: string | undefined | null, requestOrigin?: string): string | null;
 export declare function createEmbedSessionTicket(input: EmbedSessionTicketInput): Promise<EmbedSessionTicket>;

package/dist/server/embed-session.js

@@ -69,7 +69,7 @@ export function resolvedEmbedCapabilityScope(session) {
     }
     return scope;
 }
-async function ensureTable() {
+export async function ensureTable() {
     if (!_initPromise) {
         _initPromise = (async () => {
             // Build the CREATE SQL here (not at module scope) so intType() runs at

package/dist/server/google-auth-plugin.js

@@ -32,7 +32,9 @@ export function createGoogleAuthPlugin(options) {
         // `window.location.href = ret || '/'` where `ret` was the sign-in page
         // itself — sign in, land back on the sign-in page, click sign in again.
         // Every anti-loop fix ever shipped landed on whichever copy the ticket
-        // named. Do not reintroduce a second producer of `loginHtml`.
+        // named. Do not reintroduce a second producer of `loginHtml`. Keeping this
+        // producer shared also keeps the verifier-bound desktop OAuth POST
+        // bootstrap in Google-only plugin pages.
         loginHtml: getOnboardingHtml({
             googleOnly: true,
             googleAuthMode: options?.googleAuthMode,

package/dist/server/google-oauth.d.ts

@@ -106,6 +106,12 @@ export interface OAuthStatePayload {
      */
     returnUrl?: string;
     flowId?: string;
+    /** Hash of the client-held verifier binding a desktop exchange to its initiator. */
+    desktopVerifierHash?: string;
+    /** Hash of the initiating browser binding for a desktop OAuth exchange. */
+    desktopBrowserBindingHash?: string;
+    /** Complete the callback in the already-bound native WebView. */
+    desktopWebview?: boolean;
     signupAttribution?: Record<string, string | undefined>;
     signupAnonymousId?: string;
 }
@@ -125,6 +131,9 @@ export interface EncodeOAuthStateOptions {
     app?: string;
     returnUrl?: string;
     flowId?: string;
+    desktopVerifierHash?: string;
+    desktopBrowserBindingHash?: string;
+    desktopWebview?: boolean;
     signupAttribution?: Record<string, string | undefined>;
     signupAnonymousId?: string;
 }
@@ -202,6 +211,7 @@ export declare function oauthCallbackResponse(event: H3Event, email: string, opt
     returnUrl?: string;
     flowId?: string;
     appName?: string;
+    desktopWebview?: boolean;
 }): Response | string | unknown | Promise<Response | string | unknown>;
 /** HTML error page for OAuth failures. The message is HTML-escaped — most
  *  callers pass `error.message` from a token-exchange or userinfo failure,

package/dist/server/google-oauth.js

@@ -12,7 +12,7 @@ import { normalizeAnalyticsAnonymousId } from "../shared/analytics-anonymous-id.
 import { getAppBasePathFromViteEnv } from "./app-base-path.js";
 import { getAppName } from "./app-name.js";
 import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
-import { addSession, getSession, getSessionMaxAge, hasLegacySessionForEmail, setFrameworkSessionCookie, } from "./auth.js";
+import { addSession, getSession, getSessionMaxAge, hasLegacySessionForEmail, safeReturnPath, setFrameworkSessionCookie, } from "./auth.js";
 import { hasBetterAuthUserEmail, trackSignupEvent, } from "./better-auth-instance.js";
 import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 import { writeDesktopSso } from "./desktop-sso.js";
@@ -463,6 +463,12 @@ export function encodeOAuthState(redirectUriOrOpts, owner, desktop, addAccount,
         payload.r2 = opts.returnUrl;
     if (opts.flowId)
         payload.f = opts.flowId;
+    if (opts.desktopVerifierHash)
+        payload.vh = opts.desktopVerifierHash;
+    if (opts.desktopBrowserBindingHash)
+        payload.bh = opts.desktopBrowserBindingHash;
+    if (opts.desktopWebview)
+        payload.dw = true;
     if (opts.signupAttribution)
         payload.ft = opts.signupAttribution;
     const signupAnonymousId = normalizeAnalyticsAnonymousId(opts.signupAnonymousId);
@@ -511,6 +517,9 @@ export function decodeOAuthState(stateParam, fallbackUri) {
                 // depth in case the signing key ever leaks.
                 returnUrl: typeof parsed.r2 === "string" ? parsed.r2 : undefined,
                 flowId: parsed.f || undefined,
+                desktopVerifierHash: typeof parsed.vh === "string" ? parsed.vh : undefined,
+                desktopBrowserBindingHash: typeof parsed.bh === "string" ? parsed.bh : undefined,
+                desktopWebview: parsed.dw === true,
                 signupAttribution: sanitizeStateAttribution(parsed.ft),
                 signupAnonymousId: sanitizeStateAnonymousId(parsed.ai),
             };
@@ -628,6 +637,21 @@ export function oauthCallbackResponse(event, email, opts) {
     if (opts.desktop && opts.flowId && isElectron(event) && opts.sessionToken) {
         return desktopSuccessPage(event, email, opts.sessionToken, callbackState);
     }
+    // A Tauri WebView cannot share cookies with the system browser or another
+    // Tauri WebviewWindow. When the callback stays in the initiating WebView,
+    // createOAuthSession has already staged its session cookie on this event;
+    // carry that cookie onto the HTML response before returning to the app.
+    if (opts.desktop && opts.flowId && opts.desktopWebview) {
+        const returnPath = safeReturnPath(opts.returnUrl);
+        const headers = new Headers({
+            "Content-Type": "text/html; charset=utf-8",
+            "Referrer-Policy": "no-referrer",
+        });
+        for (const cookie of event.res?.headers?.getSetCookie?.() ?? []) {
+            headers.append("set-cookie", cookie);
+        }
+        return new Response(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connected</title></head><body style="background:Canvas;color:CanvasText;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><p>Connected! Returning to Clips…</p><script>setTimeout(function(){window.location.replace(${JSON.stringify(returnPath)})},50)</script></body></html>`, { status: 200, headers });
+    }
     // Desktop exchange flow (non-Electron tray app): the tray app polls the
     // desktop-exchange endpoint for the token — no deep link needed.
     if (opts.desktop && opts.flowId) {

package/dist/server/identity-sso-store.d.ts

@@ -54,6 +54,7 @@ export interface SsoStateConsumeResult {
     ok: boolean;
     returnPath: string | null;
 }
+export declare function ensureTable(): Promise<void>;
 /** Mint and persist a bound, crypto-random state value. */
 export declare function createSsoState(input: CreateSsoStateInput): Promise<string>;
 /**

package/dist/server/identity-sso-store.js

@@ -188,7 +188,7 @@ function buildIdentitySsoJtiCreateSql() {
         )
       `;
 }
-async function ensureTable() {
+export async function ensureTable() {
     // Release migrations own schema in production serverless functions. A
     // request must not turn a missing migration into request-time DDL.
     if (isProductionServerlessFunctionRuntime())

package/dist/server/index.d.ts

@@ -8,7 +8,7 @@ export { createOpenRouteHandler, type OpenRouteOptions } from "./open-route.js";
 export { createEmbedStartRouteHandler, buildEmbedStartPath, type EmbedStartRouteOptions, } from "./embed-route.js";
 export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTargetPath, requestHasEmbedAuthMarker, resolveEmbedSessionFromRequest, setEmbedSessionCookie, signEmbedSessionToken, verifyEmbedSessionToken, type ConsumedEmbedSessionTicket, type ConsumeEmbedSessionTicketOptions, type EmbedSessionTicket, type EmbedSessionTicketInput, type EmbedSessionTokenClaims, type ResolvedEmbedSession, type VerifyEmbedSessionTokenResult, } from "./embed-session.js";
 export { createSSEHandler, type SSEHandlerOptions } from "./sse.js";
-export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
+export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, registerDesktopExchange, prepareDesktopOAuthBrowserBinding, matchesDesktopOAuthBrowserBinding, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
 export { handleIdentitySso, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
 export { hasGoogleAuthIdentity } from "./better-auth-instance.js";
 export { requireEnvKey, type MissingKeyResponse } from "./missing-key.js";

package/dist/server/index.js

@@ -8,7 +8,7 @@ export { createOpenRouteHandler } from "./open-route.js";
 export { createEmbedStartRouteHandler, buildEmbedStartPath, } from "./embed-route.js";
 export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTargetPath, requestHasEmbedAuthMarker, resolveEmbedSessionFromRequest, setEmbedSessionCookie, signEmbedSessionToken, verifyEmbedSessionToken, } from "./embed-session.js";
 export { createSSEHandler } from "./sse.js";
-export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
+export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, registerDesktopExchange, prepareDesktopOAuthBrowserBinding, matchesDesktopOAuthBrowserBinding, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
 export { handleIdentitySso, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
 export { hasGoogleAuthIdentity } from "./better-auth-instance.js";
 export { requireEnvKey } from "./missing-key.js";

package/dist/server/onboarding-html.js

@@ -11,6 +11,7 @@ import { getLocaleInitScript } from "../localization/server.js";
 import { DEFAULT_LOCALE, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, localeDisplayName, } from "../localization/shared.js";
 import { NATIVE_AUTH_COPY } from "../shared/auth-copy.js";
 import { docsUrl } from "../shared/docs-url.js";
+import { BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, ENVIRONMENT_BETA_HOSTS, } from "../shared/environment-lanes.js";
 import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, } from "../shared/password-policy.js";
 import { signInJourneyInlineScript } from "../shared/sign-in-journey.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
@@ -1026,6 +1027,15 @@ export function getOnboardingHtml(opts = {}) {
   <div class="locale-menu" id="auth-locale-menu" role="menu" aria-labelledby="auth-locale-trigger" hidden>
 ${localeMenuItemsHtml}
   </div>
+</div>`;
+    const environmentBadgeHtml = `
+<div class="environment-switcher" id="environment-switcher" hidden>
+  <button type="button" class="environment-badge" id="environment-badge" aria-expanded="false" aria-controls="environment-popover">beta</button>
+  <div class="environment-popover" id="environment-popover" role="dialog" aria-labelledby="environment-popover-title" hidden>
+    <div class="environment-popover-title" id="environment-popover-title">You're on Agent Native Beta</div>
+    <div class="environment-popover-copy">Choose where you want to continue.</div>
+    <a class="environment-production-link" id="environment-production-link" href="">Switch to production</a>
+  </div>
 </div>`;
     const hostedSignupLegalNotice = opts.signupLegalNotice === undefined &&
         isAgentNativeHostedHost(opts.requestHost)
@@ -1412,8 +1422,53 @@ ${marketing.description ? `      <p class="app-desc" data-marketing-field="descr
       }
     }
     if (!reducedMotion) startAnimation();
-  })();`
+    })();`
         : "";
+    const environmentBadgeScript = `
+  (function __anInitEnvironmentBadge() {
+    var switcher = document.getElementById('environment-switcher');
+    var button = document.getElementById('environment-badge');
+    var popover = document.getElementById('environment-popover');
+    var productionLink = document.getElementById('environment-production-link');
+    if (!switcher || !button || !popover || !productionLink) return;
+    if (window.parent !== window) return;
+
+    var betaHosts = ${JSON.stringify(ENVIRONMENT_BETA_HOSTS)};
+    var hostname = (window.location.hostname || '').toLowerCase().replace(/\\.$/, '');
+    var productionHost = hostname.indexOf('beta.') === 0 ? hostname.slice(5) : '';
+    if (!productionHost || betaHosts[productionHost] !== hostname) return;
+
+    try {
+      var productionUrl = new URL(window.location.href);
+      productionUrl.protocol = 'https:';
+      productionUrl.hostname = productionHost;
+      productionUrl.port = '';
+      productionUrl.searchParams.set(
+        ${JSON.stringify(BETA_OPT_OUT_QUERY_PARAM)},
+        String(Date.now() + ${BETA_OPT_OUT_DURATION_MS}),
+      );
+      productionLink.href = productionUrl.toString();
+    } catch (error) {
+      void error;
+      return;
+    }
+
+    function setOpen(open) {
+      popover.hidden = !open;
+      button.setAttribute('aria-expanded', String(open));
+    }
+
+    switcher.hidden = false;
+    button.addEventListener('click', function() {
+      setOpen(popover.hidden);
+    });
+    document.addEventListener('click', function(event) {
+      if (!switcher.contains(event.target)) setOpen(false);
+    });
+    document.addEventListener('keydown', function(event) {
+      if (event.key === 'Escape') setOpen(false);
+    });
+  })();`;
     return `<!DOCTYPE html>
 <html lang="${DEFAULT_LOCALE}" dir="ltr">
 <head>
@@ -1553,6 +1608,69 @@ ${hasMarketing
   .locale-menu-item[aria-checked="true"] .locale-menu-check {
     opacity: 1;
   }
+  /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+  .environment-switcher {
+    position: fixed;
+    right: max(0.75rem, env(safe-area-inset-right));
+    bottom: max(0.75rem, env(safe-area-inset-bottom));
+    z-index: 100;
+  }
+  .environment-switcher[hidden],
+  .environment-popover[hidden] { display: none; }
+  .environment-badge {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    height: 1.5rem;
+    min-width: 0;
+    padding: 0 0.5rem;
+    background: #3a3a3a;
+    color: #fff;
+    border: 1px solid rgba(255,255,255,0.16);
+    border-radius: 0.75rem;
+    box-shadow: 0 2px 8px rgba(0,0,0,0.25);
+    font: inherit;
+    font-size: 0.6875rem;
+    font-weight: 600;
+    letter-spacing: 0.03125rem;
+    line-height: 1;
+    text-transform: uppercase;
+    cursor: pointer;
+  }
+  .environment-badge:hover,
+  .environment-badge[aria-expanded="true"] { background: #4a4a4a; }
+  .environment-badge:focus-visible,
+  .environment-production-link:focus-visible {
+    outline: 2px solid #33c4ff;
+    outline-offset: 2px;
+  }
+  .environment-popover {
+    position: absolute;
+    right: 0;
+    bottom: calc(100% + 0.5rem);
+    width: min(17.5rem, calc(100vw - 1.5rem));
+    padding: 1.25rem;
+    background: #141414;
+    color: #fff;
+    border: 1px solid rgba(255,255,255,0.12);
+    border-radius: 0.75rem;
+    box-shadow: 0 18px 50px rgba(0,0,0,0.42);
+  }
+  .environment-popover-title { margin-bottom: 0.25rem; font-size: 0.875rem; font-weight: 600; line-height: 1.25rem; }
+  .environment-popover-copy { margin-bottom: 1rem; color: #888; font-size: 0.875rem; line-height: 1.25rem; }
+  .environment-production-link {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    min-height: 2rem;
+    padding: 0.375rem 0.75rem;
+    color: #e5e5e5;
+    border: 1px solid rgba(255,255,255,0.16);
+    border-radius: 0.375rem;
+    font-size: 0.8125rem;
+    text-decoration: none;
+  }
+  .environment-production-link:hover { background: #242424; }
   .card {
     width: 100%;
     max-width: 400px;
@@ -1972,6 +2090,7 @@ ${embeddedAuthCss}
 </head>
 <body${simplifiedAuth ? ' class="simplified-auth"' : hasMarketing ? ' class="has-marketing"' : ""}>
 ${localePickerHtml}
+${environmentBadgeHtml}
 ${marketingPanelHtml}
 <div class="card">
   <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : "welcomeTitle"))}</h1>
@@ -2065,6 +2184,7 @@ ${signupLocalModeNoteHtml}
   <span${i18nAttr("localNotePrefix")}>${esc(t("localNotePrefix"))}</span> (<strong>${getConnectionLabel()}</strong>)<span${i18nAttr("localNoteSuffix")}>${esc(t("localNoteSuffix"))}</span>
 </p>${marketingCloseHtml}
 <script>
+${environmentBadgeScript}
   function __anBasePath() {
     var configured = ${JSON.stringify(appBasePath)};
     if (configured) return configured;
@@ -2672,10 +2792,8 @@ ${identitySsoScript}
       if (__anIsBuilderPreview()) return __anIsInFrame() ? 'popup' : 'redirect';
       // Per-session override for ad-hoc testing outside Builder: append
       // ?authMode=popup or ?authMode=redirect to the sign-in URL.
-      try {
-        var qp = new URLSearchParams(window.location.search).get('authMode');
-        if (qp === 'popup' || qp === 'redirect') return qp;
-      } catch(e) {}
+      var qp = new URLSearchParams(window.location.search).get('authMode');
+      if (qp === 'popup' || qp === 'redirect') return qp;
       var mode = __AN_GOOGLE_AUTH_MODE || 'auto';
       if (mode === 'popup') return 'popup';
       if (mode === 'redirect') return 'redirect';
@@ -2694,6 +2812,22 @@ ${identitySsoScript}
       } catch(e) {}
       return 'builder-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2);
     }
+    function __anNewOAuthVerifier() {
+      try {
+        if (window.crypto && typeof window.crypto.randomUUID === 'function') {
+          return window.crypto.randomUUID() + window.crypto.randomUUID();
+        }
+        if (window.crypto && typeof window.crypto.getRandomValues === 'function') {
+          var bytes = new Uint8Array(32);
+          window.crypto.getRandomValues(bytes);
+          var binary = '';
+          for (var i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+          return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');
+        }
+      } catch(e) { // coercion-ok: callers reject the empty verifier fallback.
+      }
+      return '';
+    }
     function __anFlowDebugId(flowId) {
       return flowId ? String(flowId).slice(-10) : '';
     }
@@ -2796,8 +2930,11 @@ ${identitySsoScript}
         __anOAuthPollCount++;
         try {
           var exchangeParams = '?flow_id=' + encodeURIComponent(flowId);
-          if (verifier) exchangeParams += '&verifier=' + encodeURIComponent(verifier);
-          var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + exchangeParams, { credentials: 'include' });
+          var exchangeOptions = { credentials: 'include' };
+          if (verifier) {
+            exchangeOptions.headers = { 'X-Agent-Native-Desktop-Verifier': verifier };
+          }
+          var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + exchangeParams, exchangeOptions);
           var data = await res.json().catch(function() { return {}; });
           if (data && (data.email || data.token)) {
             if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);
@@ -2838,49 +2975,81 @@ ${identitySsoScript}
       __anOAuthPollTimer = setInterval(check, 1000);
       setTimeout(check, 500);
     }
-    function __anStartPopupOAuth(ret, btn, err) {
-      var flowId = __anNewOAuthFlowId();
-      var oauthReturn = __anIsBuilderPreview() ? __anOAuthReturnTarget(ret) : ret;
+    async function __anRequestDesktopOAuthUrl(flowId, verifier, oauthReturn) {
       var params = new URLSearchParams();
       if (oauthReturn) params.set('return', oauthReturn);
       params.set('desktop', '1');
       params.set('flow_id', flowId);
-      params.set('redirect', '1');
-      var url = __anGoogleAuthUrlPath() + '?' + params.toString();
+      var res = await fetch(__anGoogleAuthUrlPath() + '?' + params.toString(), {
+        method: 'POST',
+        credentials: 'include',
+        headers: {
+          'Accept': 'application/json',
+          'X-Agent-Native-Desktop-Verifier': verifier
+        }
+      });
+      var data;
+      try {
+        data = await res.json();
+      } catch(e) {
+        throw new Error(__anT('failedToConnect'));
+      }
+      if (!res.ok || !data || typeof data.url !== 'string' || !data.url) {
+        throw new Error(__anAuthErrorText(data, __anT('failedToConnect')));
+      }
+      return data.url;
+    }
+    function __anStartPopupOAuth(ret, btn, err) {
+      var flowId = __anNewOAuthFlowId();
+      var verifier = __anNewOAuthVerifier();
+      if (!verifier) {
+        __anShowOAuthError(err, btn, __anT('failedToConnect'));
+        return;
+      }
+      var oauthReturn = __anIsBuilderPreview() ? __anOAuthReturnTarget(ret) : ret;
       try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}
       __anSetOAuthDebug('Opening Google sign-in popup', flowId);
+      var popup;
       try {
-        var popup = window.open('', '_blank', 'width=640,height=760');
+        popup = window.open('', '_blank', 'width=640,height=760');
         if (!popup) {
           __anHandlePopupOAuthFailure(ret, btn, err, flowId, 'Google popup was blocked; falling back to redirect', 'Google popup was blocked.');
           return;
         }
         try { popup.opener = null; } catch(e) {}
-        try {
-          popup.location.href = url;
-        } catch(e) {
-          try { popup.close(); } catch(closeErr) {}
-          __anHandlePopupOAuthFailure(ret, btn, err, flowId, 'Could not navigate Google popup; falling back to redirect', 'Could not navigate Google popup.');
-          return;
-        }
-        __anSetOAuthDebug('Google popup opened; waiting for callback', flowId);
       } catch(e) {
         __anHandlePopupOAuthFailure(ret, btn, err, flowId, 'Could not open Google popup; falling back to redirect', 'Could not open Google popup.');
         return;
       }
-      __anWaitForOAuthExchange(flowId, ret, btn, err);
+      __anRequestDesktopOAuthUrl(flowId, verifier, oauthReturn).then(function(url) {
+        try {
+          popup.location.href = url;
+          __anSetOAuthDebug('Google popup opened; waiting for callback', flowId);
+          __anWaitForOAuthExchange(flowId, ret, btn, err, 'google', verifier);
+        } catch(e) {
+          throw e;
+        }
+      }).catch(function(e) {
+        try { popup.close(); } catch(closeErr) {}
+        __anShowOAuthError(err, btn, e && e.message ? e.message : __anT('failedToConnect'));
+      });
     }
     function __anStartNativeDesktopOAuth(ret, btn, err) {
       var flowId = __anNewOAuthFlowId();
-      var params = new URLSearchParams();
-      if (ret) params.set('return', ret);
-      params.set('desktop', '1');
-      params.set('flow_id', flowId);
-      params.set('redirect', '1');
-      var url = __anGoogleAuthUrlPath() + '?' + params.toString();
-      __anSetOAuthDebug('Opening Google sign-in in system browser', flowId);
-      __anOpenOAuthUrl(url);
-      __anWaitForOAuthExchange(flowId, ret, btn, err);
+      var verifier = __anNewOAuthVerifier();
+      if (!verifier) {
+        __anShowOAuthError(err, btn, __anT('failedToConnect'));
+        return;
+      }
+      var oauthReturn = ret;
+      __anSetOAuthDebug('Preparing Google sign-in in system browser', flowId);
+      __anRequestDesktopOAuthUrl(flowId, verifier, oauthReturn).then(function(url) {
+        __anSetOAuthDebug('Opening Google sign-in in system browser', flowId);
+        __anOpenOAuthUrl(url);
+        __anWaitForOAuthExchange(flowId, ret, btn, err, 'google', verifier);
+      }).catch(function(e) {
+        __anShowOAuthError(err, btn, e && e.message ? e.message : __anT('failedToConnect'));
+      });
     }
     function __anOpenOAuthUrl(url) {
       try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}

package/dist/server/poll.d.ts

@@ -158,6 +158,7 @@ export declare class AppSyncState {
     private lastDurablePrune;
     private durablePruneFailures;
     private durableWriteFailures;
+    private allocatorReseedFailures;
     /**
      * Whether we've seeded `version` from the DB. In serverless (Netlify,
      * Vercel, etc.) each invocation starts fresh — without seeding, `version`
@@ -252,6 +253,7 @@ export declare class AppSyncState {
      */
     private pruneDurableEvents;
     private reportDurableWriteFailure;
+    private reportAllocatorReseedFailure;
     persistSyncEvent(event: ChangeEvent, dedupeKey?: string, presetId?: string): Promise<void>;
     /**
      * Persist with a DB-allocated version (see ALLOCATING_INSERT_SQL). Returns

package/dist/server/poll.js

@@ -302,6 +302,7 @@ export class AppSyncState {
     lastDurablePrune = Date.now();
     durablePruneFailures = 0;
     durableWriteFailures = 0;
+    allocatorReseedFailures = 0;
     /**
      * Whether we've seeded `version` from the DB. In serverless (Netlify,
      * Vercel, etc.) each invocation starts fresh — without seeding, `version`
@@ -566,6 +567,12 @@ export class AppSyncState {
             console.warn(`[agent-native] sync_events write failed for ${event.source}/${event.type}${event.key ? `/${event.key}` : ""}; durable replay is unavailable until the database recovers:`, error instanceof Error ? error.message : String(error));
         }
     }
+    reportAllocatorReseedFailure(error) {
+        this.allocatorReseedFailures++;
+        if (this.allocatorReseedFailures === 1) {
+            console.warn("[agent-native] sync version allocator reseed failed; retrying allocation:", error instanceof Error ? error.message : String(error));
+        }
+    }
     async persistSyncEvent(event, dedupeKey, presetId) {
         if (!(await this.ensureSyncEventsTable()))
             return;
@@ -628,9 +635,20 @@ export class AppSyncState {
         let result = await client.execute({ sql: ALLOCATING_INSERT_SQL, args });
         if (result.rows.length === 0) {
             // Allocator row missing (e.g. wiped after ensure): reseed, retry once.
-            await client.execute(SEED_SYNC_VERSION_SQL).catch(() => { });
+            try {
+                await client.execute(SEED_SYNC_VERSION_SQL);
+                this.allocatorReseedFailures = 0;
+            }
+            catch (error) {
+                // Keep the retry/fallback behavior, but do not hide the reason the
+                // allocator was unavailable. A missing warning here makes a broken
+                // allocator look like a normal retry until version ordering drifts.
+                this.reportAllocatorReseedFailure(error);
+            }
             result = await client.execute({ sql: ALLOCATING_INSERT_SQL, args });
         }
+        if (result.rows.length > 0)
+            this.allocatorReseedFailures = 0;
         const version = timestampValue(result.rows[0]?.version);
         await this.pruneDurableEvents(client);
         return version > 0 ? version : null;

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/server/release-migrations.js

@@ -14,6 +14,7 @@ import { USAGE_ALERT_MIGRATIONS, USAGE_ALERT_MIGRATIONS_TABLE, } from "../usage/
 import { WORKSPACE_CONNECTIONS_MIGRATIONS, WORKSPACE_CONNECTIONS_MIGRATIONS_TABLE, } from "../workspace-connections/migrations.js";
 import { runBetterAuthMigrations } from "./better-auth-migrations.js";
 import { IDENTITY_SSO_MIGRATIONS } from "./identity-sso-migrations.js";
+import { runFrameworkSchemaEnsures } from "./release-schema.js";
 /**
  * Apply framework-owned schema in one explicit release step.
  *
@@ -22,6 +23,10 @@ import { IDENTITY_SSO_MIGRATIONS } from "./identity-sso-migrations.js";
  * private schema from being silently coupled to every framework deployment.
  */
 export async function runFrameworkReleaseMigrations(nitroApp) {
+    // First: the versioned migration lists below only cover the tables that have
+    // one. Most framework tables are defined by their store's `ensureTable()`,
+    // which production serverless can never run — see `./release-schema.ts`.
+    await runFrameworkSchemaEnsures();
     await runBetterAuthMigrations(nitroApp);
     await runMigrations(AGENT_TOOL_APPROVAL_MIGRATIONS, {
         table: AGENT_TOOL_APPROVAL_MIGRATIONS_TABLE,

package/dist/server/release-schema.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Release-time creation of every framework-owned table that a store would
+ * otherwise create on first use.
+ *
+ * `ensureTable()` is the framework's schema definition: the DDL lives next to
+ * the store that owns it, and there is no second copy in a migration list. On a
+ * long-lived server that works, because the first request creates what is
+ * missing. On production serverless it does NOT: `schemaEnsureDisabled()` turns
+ * every probe into "already present" so a cold start never pays for ~390
+ * probes, which means nothing on the request path can create a table.
+ *
+ * So the release step has to run the same paths, and this module is the list
+ * that makes it complete. It is deliberately explicit rather than a
+ * side-effect-import registry: `package.json#sideEffects` is a narrow
+ * allow-list, so an import kept only for its registration is exactly what a
+ * bundler is entitled to drop — and the symptom would be a missing table in
+ * production, months later.
+ *
+ * The imports are dynamic on purpose. `server/index.ts` and `server/edge.ts`
+ * re-export `runFrameworkReleaseMigrations`, so a static list here would pull
+ * all 60 store modules into the graph of every server boot to serve a path
+ * that runs once, at release. Loading them inside the step keeps request cold
+ * starts unchanged.
+ *
+ * `guard:release-schema-complete` fails the build when a module defines schema
+ * and is not listed here.
+ */
+type SchemaEnsure = readonly [name: string, run: () => Promise<void>];
+/** Store names in release order. Exported for the guard and its tests. */
+export declare function frameworkSchemaEnsureNames(): string[];
+/**
+ * Create every framework-owned table, in one pass, before the app serves
+ * traffic. Callers must already hold migration duty via `withMigrationRuntime`;
+ * without it `schemaEnsureDisabled()` reports every table present and this
+ * whole pass silently creates nothing.
+ *
+ * Sequential on purpose: these run against one database at release time, where
+ * total wall clock does not matter and concurrent `CREATE TABLE` on a shared
+ * Neon instance contends for `ACCESS EXCLUSIVE` locks.
+ *
+ * A failure aborts the release rather than being collected and reported at the
+ * end. A half-created schema that reports success is the failure mode this
+ * module exists to remove.
+ */
+export declare function runFrameworkSchemaEnsures(ensures?: readonly SchemaEnsure[]): Promise<void>;
+export {};