@agent-native/core 0.169.0 → 0.170.0

package/dist/server/builder-oauth.js

@@ -1,58 +1,58 @@
-import { finishMcpOAuthAuthorization, getMcpOAuthAccessToken, readMcpOAuthCredentials, revokeMcpOAuthCredentials, saveMcpOAuthCredentials, startMcpOAuthAuthorization, validateMcpOAuthCallbackIssuer, } from "../mcp-client/oauth-client.js";
+import { createHash } from "node:crypto";
+import { finishMcpOAuthAuthorization, getMcpOAuthAccessToken, markMcpOAuthReconnectRequired, readMcpOAuthCredentials, revokeMcpOAuthCredentials, saveMcpOAuthCredentials, startMcpOAuthAuthorization, validateMcpOAuthCallbackIssuer, } from "../mcp-client/oauth-client.js";
 import { getOAuthTokens } from "../oauth-tokens/store.js";
-import { getSetting, mutateSetting, putSetting } from "../settings/store.js";
+import { resolveOrgIdForEmail } from "../org/context.js";
 export const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
 export const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
-export const BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA = "https://mcp.builder.io/.well-known/oauth-protected-resource/api";
-export const BUILDER_OAUTH_AUTHORIZATION_METADATA = "https://mcp.builder.io/.well-known/oauth-authorization-server";
-export const BUILDER_OAUTH_AUTHORIZATION_ENDPOINT = "https://mcp.builder.io/oauth/authorize";
-export const BUILDER_OAUTH_TOKEN_ENDPOINT = "https://mcp.builder.io/oauth/token";
-export const BUILDER_OAUTH_REGISTRATION_ENDPOINT = "https://mcp.builder.io/oauth/register";
-export const BUILDER_OAUTH_REVOCATION_ENDPOINT = "https://mcp.builder.io/oauth/revoke";
 export const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
 export const BUILDER_OAUTH_SCOPES = [BUILDER_OAUTH_SCOPE];
+// Folded with the owner so each owner gets their own (provider, account_id)
+// row; a bare shared key would let only the first connector hold a grant.
 const BUILDER_OAUTH_KEY = "builder-general-resource-v1";
-const REFRESH_SKEW_MS = 60_000;
-const REFRESH_LEASE_MS = 15_000;
-const REFRESH_WAIT_MS = 50;
-function ownerOptions(ownerEmail) {
-    const scopeId = ownerEmail.trim().toLowerCase();
-    if (!scopeId)
+// Builder's general AI resource metadata lives at a non-default path; the
+// default api.builder.io well-known describes its Figma integration instead.
+// Point discovery here so live metadata resolves to the api.builder.io resource
+// and the mcp.builder.io authorization server.
+const BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA = "https://mcp.builder.io/.well-known/oauth-protected-resource/api";
+// The Builder connection is shared by everyone in the caller's org: the
+// credential is scoped to the org so every member reads the same token. Every
+// user belongs to an org, so a missing org is a broken invariant, not a case
+// to fall back on.
+function normalizeOwnerEmail(ownerEmail) {
+    const email = ownerEmail.trim().toLowerCase();
+    if (!email)
         throw new Error("Builder OAuth owner email is required");
+    return email;
+}
+// Read paths use this: a caller with no org simply has no Builder session, so
+// engine detection and status checks get null instead of an exception.
+async function resolveOwnerOptions(ownerEmail) {
+    const email = normalizeOwnerEmail(ownerEmail);
+    const orgId = await resolveOrgIdForEmail(email);
+    if (!orgId)
+        return null;
+    return orgOwnerOptions(orgId);
+}
+// Write paths use this: storing a Builder credential without an org is a broken
+// invariant, so a missing org fails loudly rather than silently dropping it.
+async function ownerOptions(ownerEmail) {
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options) {
+        throw new Error(`Builder OAuth requires an organization for ${normalizeOwnerEmail(ownerEmail)}`);
+    }
+    return options;
+}
+function orgOwnerOptions(orgId) {
     return {
-        key: BUILDER_OAUTH_KEY,
-        scope: "user",
-        scopeId,
+        key: builderOAuthKey(orgId),
+        scope: "org",
+        scopeId: orgId,
         serverUrl: BUILDER_OAUTH_RESOURCE,
     };
 }
-function refreshLeaseKey(ownerEmail) {
-    return `builder-oauth-refresh:user:${ownerOptions(ownerEmail).scopeId}`;
-}
-function reconnectKey(ownerEmail) {
-    return `builder-oauth-reconnect:user:${ownerOptions(ownerEmail).scopeId}`;
-}
-function discoveryState() {
-    return {
-        authorizationServerUrl: BUILDER_OAUTH_ISSUER,
-        authorizationServerMetadata: {
-            issuer: BUILDER_OAUTH_ISSUER,
-            authorization_endpoint: BUILDER_OAUTH_AUTHORIZATION_ENDPOINT,
-            token_endpoint: BUILDER_OAUTH_TOKEN_ENDPOINT,
-            registration_endpoint: BUILDER_OAUTH_REGISTRATION_ENDPOINT,
-            revocation_endpoint: BUILDER_OAUTH_REVOCATION_ENDPOINT,
-            // MCP SDK auth() reads these from the provided discovery blob and throws
-            // if they are missing — do not omit them when skipping live metadata fetch.
-            response_types_supported: ["code"],
-            grant_types_supported: ["authorization_code", "refresh_token"],
-            code_challenge_methods_supported: ["S256"],
-        },
-        resourceMetadataUrl: BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA,
-        resourceMetadata: {
-            resource: BUILDER_OAUTH_RESOURCE,
-            authorization_servers: [BUILDER_OAUTH_ISSUER],
-        },
-    };
+function builderOAuthKey(orgId) {
+    const digest = createHash("sha256").update(orgId).digest("hex");
+    return `${BUILDER_OAUTH_KEY}:o:${digest}`;
 }
 function scopesFrom(credentials) {
     const declared = credentials.tokens.scope;
@@ -72,35 +72,11 @@ function isBuilderDiscoveryState(value) {
     if (!value || typeof value !== "object")
         return false;
     const discovery = value;
-    const authorizationServers = discovery.resourceMetadata?.authorization_servers;
-    const responseTypes = discovery.authorizationServerMetadata?.response_types_supported;
-    const grantTypes = discovery.authorizationServerMetadata?.grant_types_supported;
-    const challengeMethods = discovery.authorizationServerMetadata?.code_challenge_methods_supported;
-    const resource = typeof discovery.resourceMetadata?.resource === "string"
-        ? discovery.resourceMetadata.resource
-        : null;
-    return (discovery?.authorizationServerUrl === BUILDER_OAUTH_ISSUER &&
+    const resource = discovery.resourceMetadata?.resource;
+    return (discovery.authorizationServerUrl === BUILDER_OAUTH_ISSUER &&
         discovery.authorizationServerMetadata?.issuer === BUILDER_OAUTH_ISSUER &&
-        discovery.authorizationServerMetadata?.authorization_endpoint ===
-            BUILDER_OAUTH_AUTHORIZATION_ENDPOINT &&
-        discovery.authorizationServerMetadata?.token_endpoint ===
-            BUILDER_OAUTH_TOKEN_ENDPOINT &&
-        discovery.authorizationServerMetadata?.registration_endpoint ===
-            BUILDER_OAUTH_REGISTRATION_ENDPOINT &&
-        discovery.authorizationServerMetadata?.revocation_endpoint ===
-            BUILDER_OAUTH_REVOCATION_ENDPOINT &&
-        Array.isArray(responseTypes) &&
-        responseTypes.includes("code") &&
-        Array.isArray(grantTypes) &&
-        grantTypes.includes("authorization_code") &&
-        Array.isArray(challengeMethods) &&
-        challengeMethods.includes("S256") &&
-        discovery.resourceMetadataUrl ===
-            BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA &&
-        !!resource &&
-        resourceUrlsMatch(resource, BUILDER_OAUTH_RESOURCE) &&
-        Array.isArray(authorizationServers) &&
-        authorizationServers.includes(BUILDER_OAUTH_ISSUER));
+        typeof resource === "string" &&
+        resourceUrlsMatch(resource, BUILDER_OAUTH_RESOURCE));
 }
 function isBuilderCredential(credentials) {
     return (resourceUrlsMatch(credentials.serverUrl, BUILDER_OAUTH_RESOURCE) &&
@@ -108,26 +84,16 @@ function isBuilderCredential(credentials) {
         credentials.tokens.issuer === BUILDER_OAUTH_ISSUER &&
         isBuilderDiscoveryState(credentials.discoveryState));
 }
-function sessionFrom(credentials) {
-    if (!isBuilderCredential(credentials))
-        return null;
-    const accessToken = credentials.tokens.access_token;
-    if (typeof accessToken !== "string" || !accessToken)
-        return null;
-    return {
-        accessToken,
-        expiresAt: credentials.tokenExpiresAt,
-        scopes: scopesFrom(credentials),
-    };
-}
 export async function startBuilderOAuthAuthorization(input) {
-    ownerOptions(input.ownerEmail);
+    // Start scopes nothing, so it validates the email without an org lookup;
+    // the org scope is resolved when the grant is stored and read.
+    normalizeOwnerEmail(input.ownerEmail);
     const started = await startMcpOAuthAuthorization({
         serverUrl: BUILDER_OAUTH_RESOURCE,
         redirectUrl: input.redirectUri,
         state: input.state,
         scope: BUILDER_OAUTH_SCOPE,
-        discoveryState: discoveryState(),
+        resourceMetadataUrl: BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA,
     });
     return {
         authorizationUrl: started.authorizationUrl.toString(),
@@ -140,9 +106,6 @@ export async function startBuilderOAuthAuthorization(input) {
     };
 }
 export async function finishBuilderOAuthAuthorization(input) {
-    if (!isBuilderDiscoveryState(input.pending.discoveryState)) {
-        throw new Error("Builder OAuth pending flow has an invalid discovery binding");
-    }
     validateMcpOAuthCallbackIssuer(input.pending.discoveryState, input.iss);
     const result = await finishMcpOAuthAuthorization({
         serverUrl: BUILDER_OAUTH_RESOURCE,
@@ -158,40 +121,41 @@ export async function finishBuilderOAuthAuthorization(input) {
         throw new Error("Builder OAuth exchange returned credentials for another resource");
     }
     await saveMcpOAuthCredentials({
-        ...ownerOptions(input.ownerEmail),
+        ...(input.orgId
+            ? orgOwnerOptions(input.orgId)
+            : await ownerOptions(input.ownerEmail)),
         credentials: result.credentials,
     });
-    await putSetting(reconnectKey(input.ownerEmail), {
-        required: false,
-        at: Date.now(),
-    }).catch(() => {
-        // coercion-ok: reconnect flag clear is best-effort after a successful grant.
-    });
 }
 export async function markBuilderOAuthReconnectRequired(ownerEmail) {
-    await putSetting(reconnectKey(ownerEmail), {
-        required: true,
-        at: Date.now(),
-    });
-}
-export async function builderOAuthReconnectRequired(ownerEmail) {
-    const row = await getSetting(reconnectKey(ownerEmail));
-    return row?.required === true;
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return;
+    await markMcpOAuthReconnectRequired(options);
 }
 export async function getBuilderOAuthSession(ownerEmail) {
-    if (await builderOAuthReconnectRequired(ownerEmail))
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return null;
+    // Delegates refresh single-flight and reconnect latching to the shared
+    // credential lifecycle; a null token covers missing, expired-unrefreshable,
+    // and reconnect_required alike.
+    const accessToken = await getMcpOAuthAccessToken(options);
+    if (!accessToken)
         return null;
-    const credentials = await readMcpOAuthCredentials(ownerOptions(ownerEmail));
+    const credentials = await readMcpOAuthCredentials(options);
     if (!credentials || !isBuilderCredential(credentials))
         return null;
-    if (typeof credentials.tokenExpiresAt === "number" &&
-        credentials.tokenExpiresAt - Date.now() <= REFRESH_SKEW_MS) {
-        return refreshBuilderOAuthSession(ownerEmail);
-    }
-    return sessionFrom(credentials);
+    return {
+        accessToken,
+        expiresAt: credentials.tokenExpiresAt,
+        scopes: scopesFrom(credentials),
+    };
 }
 export async function hasBuilderOAuthSession(ownerEmail) {
-    const options = ownerOptions(ownerEmail);
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return false;
     const stored = await getOAuthTokens("mcp", options.key, `${options.scope}:${options.scopeId}`);
     return stored !== null;
 }
@@ -202,60 +166,13 @@ export async function resolveBuilderOAuthRequestAccess(input) {
     if (!session.scopes.includes(input.requiredScope)) {
         throw new Error(`Builder OAuth connection does not grant ${input.requiredScope}`);
     }
-    return { ...session, ownerEmail: ownerOptions(input.ownerEmail).scopeId };
-}
-async function refreshBuilderOAuthSession(ownerEmail) {
-    const owner = crypto.randomUUID();
-    const leaseKey = refreshLeaseKey(ownerEmail);
-    const lease = await mutateSetting(leaseKey, (current) => {
-        if (typeof current?.expiresAt !== "number" ||
-            current.expiresAt <= Date.now()) {
-            return { owner, expiresAt: Date.now() + REFRESH_LEASE_MS };
-        }
-        return current;
-    });
-    if (lease.owner !== owner)
-        return waitForRefreshedSession(ownerEmail);
-    try {
-        const options = ownerOptions(ownerEmail);
-        const accessToken = await getMcpOAuthAccessToken(options);
-        const next = await readMcpOAuthCredentials(options);
-        if (!accessToken || !next || !isBuilderCredential(next)) {
-            throw new Error("Builder OAuth refresh failed");
-        }
-        return sessionFrom(next);
-    }
-    catch {
-        await markBuilderOAuthReconnectRequired(ownerEmail);
-        return null;
-    }
-    finally {
-        await mutateSetting(leaseKey, (current) => current?.owner === owner ? { owner: "", expiresAt: 0 } : (current ?? {}));
-    }
-}
-async function waitForRefreshedSession(ownerEmail) {
-    for (let waited = 0; waited < REFRESH_LEASE_MS; waited += REFRESH_WAIT_MS) {
-        await new Promise((resolve) => setTimeout(resolve, REFRESH_WAIT_MS));
-        const credentials = await readMcpOAuthCredentials(ownerOptions(ownerEmail));
-        if (!credentials || !isBuilderCredential(credentials))
-            return null;
-        if (typeof credentials.tokenExpiresAt !== "number" ||
-            credentials.tokenExpiresAt - Date.now() <= REFRESH_SKEW_MS) {
-            continue;
-        }
-        return sessionFrom(credentials);
-    }
-    return null;
+    return { ...session, ownerEmail: input.ownerEmail.trim().toLowerCase() };
 }
 export async function deleteBuilderOAuthSession(ownerEmail) {
-    const options = ownerOptions(ownerEmail);
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return { localDeleted: false, remoteRevoked: false };
     const result = await revokeMcpOAuthCredentials(options);
-    await putSetting(reconnectKey(ownerEmail), {
-        required: false,
-        at: Date.now(),
-    }).catch(() => {
-        // coercion-ok: reconnect flag clear is best-effort after local revoke.
-    });
     return {
         localDeleted: result.local === "deleted",
         remoteRevoked: result.remote === "succeeded",

package/dist/server/core-routes-plugin.d.ts

@@ -305,6 +305,35 @@ export declare function readLegacyCoreRouteInitSettings(readSetting?: CoreRouteS
  */
 export declare function shouldRunCoreRouteBootDatabaseWork(env?: NodeJS.ProcessEnv): boolean;
 export declare function ensureS3FileUploadProvider(): void;
+export interface OAuthCustodyBuilderKeyStatus {
+    privateKeyConfigured: boolean;
+    publicKeyConfigured: boolean;
+    orgName: string;
+    /**
+     * True when the key-pair lookup itself failed (credential store
+     * unreadable, org lookup error, a thrown import) rather than confirming
+     * no keys exist. privateKeyConfigured/publicKeyConfigured stay `false` in
+     * both cases — this is the only signal that tells "never configured"
+     * apart from "couldn't check right now", so a transient store blip can't
+     * read downstream as "the user never connected Builder keys".
+     */
+    keyLookupFailed: boolean;
+}
+/**
+ * Resolves the classic Builder key-pair status for a request that already
+ * has Builder MCP OAuth custody (the connection-status handler's `configured`
+ * is already `true` by the time this runs — OAuth alone proves the chat
+ * gateway). Exported so the connection-status route's OAuth-custody branch is
+ * unit-testable without standing up the full plugin.
+ */
+export declare function resolveOAuthCustodyBuilderKeyStatus(dependencies?: {
+    resolveCredentialsDetailed: () => Promise<{
+        privateKey: string | null;
+        publicKey: string | null;
+        orgName: string | null;
+        lookupFailed: boolean;
+    }>;
+}): Promise<OAuthCustodyBuilderKeyStatus>;
 export declare function createCoreRoutesPlugin(options?: CoreRoutesPluginOptions): NitroPluginDef;
 /**
  * Default core routes plugin — mount with no configuration needed.

package/dist/server/core-routes-plugin.js

@@ -42,7 +42,7 @@ import { readAnalyticsClientPlatformHeader, readBrowserSessionIdHeader, } from "
 import { getConfiguredAppBasePath, stripAppBasePath } from "./app-base-path.js";
 import { getAppName } from "./app-name.js";
 import { getSession } from "./auth.js";
-import { BUILDER_CONNECT_PARAM, BUILDER_ENV_KEYS, BUILDER_OPENER_PARAM, BUILDER_RELAY_FLOW_HEADER, BUILDER_RELAY_SIGNATURE_HEADER, BUILDER_RELAY_STATE_PARAM, BUILDER_RELAY_TIMESTAMP_HEADER, appendBuilderConnectToken, builderConnectTrackingProperties, createBuilderConnectState, createBuilderBrowserCallbackErrorPage, createBuilderBrowserCallbackPage, createBuilderRelayRequest, getBuilderConnectTrackingParams, getBuilderBrowserOriginForEvent, getBuilderBrowserStatusForEvent, isBuilderConnectCallbackUrlAllowed, isSignedBuilderConnectState, resolveBuilderBranchProjectId, resolveBuilderConnectCallbackUrl, resolveBuilderPreviewRelayParentOrigin, runBuilderAgent, verifyBuilderRelayRequest, verifyBuilderPreviewRelayStateForCallback, verifyBuilderConnectTokenAndGetOwner, } from "./builder-browser.js";
+import { BUILDER_CONNECT_PARAM, BUILDER_ENV_KEYS, BUILDER_OPENER_PARAM, BUILDER_RELAY_FLOW_HEADER, BUILDER_RELAY_SIGNATURE_HEADER, BUILDER_RELAY_STATE_PARAM, BUILDER_RELAY_TIMESTAMP_HEADER, appendBuilderConnectToken, builderConnectTrackingProperties, createBuilderConnectState, createBuilderBrowserCallbackErrorPage, createBuilderBrowserCallbackPage, createBuilderRelayRequest, getBuilderConnectTrackingParams, getBuilderBrowserOriginForEvent, getBuilderBrowserStatusForEvent, isBuilderConnectCallbackUrlAllowed, isSignedBuilderConnectState, normalizeBuilderAgentContext, resolveBuilderBranchProjectId, resolveBuilderConnectCallbackUrl, resolveBuilderPreviewRelayParentOrigin, runBuilderAgent, verifyBuilderRelayRequest, verifyBuilderPreviewRelayStateForCallback, verifyBuilderConnectTokenAndGetOwner, } from "./builder-browser.js";
 import { BUILDER_OAUTH_SCOPE, deleteBuilderOAuthSession, finishBuilderOAuthAuthorization, hasBuilderOAuthSession, resolveBuilderOAuthRequestAccess, startBuilderOAuthAuthorization, } from "./builder-oauth.js";
 import { captureError, registerErrorCaptureProvider } from "./capture-error.js";
 import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
@@ -222,6 +222,33 @@ async function resolveAgentEngineStatusIdentity(event) {
         return { userEmail, orgId: undefined };
     }
 }
+/**
+ * A Builder grant is shared by everyone in the caller's org, so establishing,
+ * overwriting, or revoking one requires org owner/admin authority. Returns the
+ * authorized org id and a denial message (null when allowed). The org id is
+ * captured at connect start so the grant is stored under the org that was
+ * authorized, not one re-resolved after the OAuth round trip. Fails closed: an
+ * unreadable owner/admin role is denied.
+ */
+async function resolveBuilderOrgMutation(event) {
+    let orgId = null;
+    let role = null;
+    try {
+        const orgCtx = await getOrgContext(event);
+        orgId = orgCtx.orgId ?? null;
+        role = orgCtx.role ?? null;
+    }
+    catch {
+        // coercion-ok: org is missing, it will fail closed
+    }
+    if (role !== "owner" && role !== "admin") {
+        return {
+            orgId,
+            deny: "Only an organization owner or admin can change the shared Builder connection.",
+        };
+    }
+    return { orgId, deny: null };
+}
 export function getFrameworkEnvKeys() {
     return [
         { key: "ENABLE_BUILDER", label: "Enable Builder.io features" },
@@ -927,6 +954,43 @@ export function ensureS3FileUploadProvider() {
     }
     registerFileUploadProvider(s3FileUploadProvider);
 }
+/**
+ * Resolves the classic Builder key-pair status for a request that already
+ * has Builder MCP OAuth custody (the connection-status handler's `configured`
+ * is already `true` by the time this runs — OAuth alone proves the chat
+ * gateway). Exported so the connection-status route's OAuth-custody branch is
+ * unit-testable without standing up the full plugin.
+ */
+export async function resolveOAuthCustodyBuilderKeyStatus(dependencies = {
+    resolveCredentialsDetailed: async () => {
+        const { resolveBuilderCredentialsDetailed } = await import("./credential-provider.js");
+        return resolveBuilderCredentialsDetailed();
+    },
+}) {
+    try {
+        const creds = await dependencies.resolveCredentialsDetailed();
+        return {
+            privateKeyConfigured: !!creds.privateKey,
+            publicKeyConfigured: !!creds.publicKey,
+            orgName: typeof creds.orgName === "string" && creds.orgName
+                ? creds.orgName
+                : "Builder OAuth",
+            keyLookupFailed: creds.lookupFailed,
+        };
+    }
+    catch {
+        // OAuth already proves the chat gateway, so a thrown key-pair lookup
+        // here must not abort the response — but it is unreadable, not
+        // confirmed-absent, so keyLookupFailed has to say so (see the field doc
+        // above) instead of silently landing on the same `false`s as a real miss.
+        return {
+            privateKeyConfigured: false,
+            publicKeyConfigured: false,
+            orgName: "Builder OAuth",
+            keyLookupFailed: true,
+        };
+    }
+}
 export function createCoreRoutesPlugin(options = {}) {
     return async (nitroApp) => {
         markDefaultPluginProvided(nitroApp, "core-routes");
@@ -1143,7 +1207,12 @@ export function createCoreRoutesPlugin(options = {}) {
             }
             for (const provider of [
                 "figma",
+                "gmail",
+                "google_calendar",
+                "google_docs",
                 "google_drive",
+                "google_sheets",
+                "google_slides",
                 "github",
                 "hubspot",
                 "salesforce",
@@ -1562,29 +1631,15 @@ export function createCoreRoutesPlugin(options = {}) {
                             }
                         }
                         if (oauthAccess) {
-                            let privateKeyConfigured = false;
-                            let publicKeyConfigured = false;
-                            let orgName = "Builder OAuth";
-                            try {
-                                const { resolveBuilderCredentials } = await import("./credential-provider.js");
-                                const creds = await resolveBuilderCredentials();
-                                privateKeyConfigured = !!creds.privateKey;
-                                publicKeyConfigured = !!creds.publicKey;
-                                if (typeof creds.orgName === "string" && creds.orgName) {
-                                    orgName = creds.orgName;
-                                }
-                            }
-                            catch {
-                                // coercion-ok: OAuth already proves the chat gateway; missing
-                                // key flags only hide code-change send until secrets are readable.
-                            }
+                            const keyStatus = await resolveOAuthCustodyBuilderKeyStatus();
                             return withConnectToken({
                                 ...requestStatus,
                                 configured: true,
                                 credentialSource: "user",
-                                privateKeyConfigured,
-                                publicKeyConfigured,
-                                orgName,
+                                privateKeyConfigured: keyStatus.privateKeyConfigured,
+                                publicKeyConfigured: keyStatus.publicKeyConfigured,
+                                keyLookupFailed: keyStatus.keyLookupFailed,
+                                orgName: keyStatus.orgName,
                                 spaces: [],
                             });
                         }
@@ -1870,6 +1925,21 @@ export function createCoreRoutesPlugin(options = {}) {
                         parentOrigin: getBuilderBrowserOriginForEvent(event),
                     });
                 }
+                const { orgId: connectOrgId, deny: orgConnectDenied } = await resolveBuilderOrgMutation(event);
+                if (orgConnectDenied) {
+                    await trackBuilderLifecycle(event, "builder connect failed", ownerEmail, {
+                        ...builderConnectTrackingProperties(connectTracking),
+                        reason: "org_authorization_required",
+                        stage: "connect",
+                    });
+                    setResponseStatus(event, 403);
+                    setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+                    return createBuilderBrowserCallbackErrorPage(orgConnectDenied, {
+                        title: "Not allowed to connect Builder for this organization",
+                        body: "Ask an organization owner or admin to connect Builder.",
+                        parentOrigin: getBuilderBrowserOriginForEvent(event),
+                    });
+                }
                 const state = createBuilderConnectState();
                 // The standard OAuth client discovers Builder's protected-resource
                 // metadata, dynamically registers, and creates its S256 verifier.
@@ -1886,7 +1956,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     authorizationUrl = started.authorizationUrl;
                     await putSetting(`builder-connect-pending:${state}`, {
                         ownerEmail,
-                        orgId: null,
+                        orgId: connectOrgId,
                         role: null,
                         encryptedOAuthFlow: encryptSecretValue(JSON.stringify(oauthFlow)),
                         redirectUri: callbackUrl,
@@ -1930,12 +2000,23 @@ export function createCoreRoutesPlugin(options = {}) {
                     setResponseStatus(event, 405);
                     return { error: "Method not allowed" };
                 }
+                await assertBodySize(event, 64 * 1024);
                 const body = await readBody(event).catch(() => ({}));
                 const prompt = typeof body?.prompt === "string" ? body.prompt : "";
                 if (!prompt.trim()) {
                     setResponseStatus(event, 400);
                     return { error: "prompt is required" };
                 }
+                let context;
+                try {
+                    context = normalizeBuilderAgentContext(body?.context);
+                }
+                catch (error) {
+                    setResponseStatus(event, 400);
+                    return {
+                        error: error instanceof Error ? error.message : "Invalid context",
+                    };
+                }
                 const session = await getSession(event).catch(() => null);
                 if (!session?.email) {
                     setResponseStatus(event, 401);
@@ -1973,6 +2054,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     try {
                         const result = await runBuilderAgent({
                             prompt,
+                            context,
                             projectId,
                             branchName: typeof body?.branchName === "string"
                                 ? body.branchName
@@ -2230,6 +2312,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     const oauthFlow = JSON.parse(decryptSecretValue(encryptedOAuthFlow));
                     await finishBuilderOAuthAuthorization({
                         ownerEmail,
+                        orgId: typeof consumed.orgId === "string" ? consumed.orgId : undefined,
                         code,
                         iss,
                         pending: oauthFlow,
@@ -2271,6 +2354,15 @@ export function createCoreRoutesPlugin(options = {}) {
                 }
                 try {
                     const hadOAuth = await hasBuilderOAuthSession(session.email);
+                    // Revoking an org-scoped grant takes the connection offline for
+                    // every member, so require org owner/admin before doing so.
+                    if (hadOAuth) {
+                        const { deny } = await resolveBuilderOrgMutation(event);
+                        if (deny) {
+                            setResponseStatus(event, 403);
+                            return { error: deny };
+                        }
+                    }
                     const oauthResult = hadOAuth
                         ? await deleteBuilderOAuthSession(session.email)
                         : { localDeleted: false, remoteRevoked: false };

package/dist/server/default-plugins.d.ts

@@ -0,0 +1,18 @@
+import type { DefaultPluginSlot } from "../app-config/plugins.js";
+/**
+ * Which default plugin slots this deployment refuses, from `plugins.disabled`.
+ *
+ * Read on every call rather than captured once: `getAppConfig()` already caches
+ * the parse and drops that cache when the environment layer changes, and the
+ * auto-mount decision runs before some apps have called `defineAppConfig()`, so
+ * a module-level snapshot would freeze an empty list for the process.
+ */
+export declare function getDisabledDefaultPlugins(): readonly DefaultPluginSlot[];
+/**
+ * Whether the framework should withhold its default implementation of `slot`.
+ *
+ * Only the framework's own defaults are gated. An app that ships
+ * `server/plugins/<slot>.ts` mounted its plugin deliberately, and this switch
+ * does not reach in and unmount it.
+ */
+export declare function isDefaultPluginDisabled(slot: string): boolean;

package/dist/server/default-plugins.js

@@ -0,0 +1,22 @@
+import { getAppConfig } from "../app-config/index.js";
+/**
+ * Which default plugin slots this deployment refuses, from `plugins.disabled`.
+ *
+ * Read on every call rather than captured once: `getAppConfig()` already caches
+ * the parse and drops that cache when the environment layer changes, and the
+ * auto-mount decision runs before some apps have called `defineAppConfig()`, so
+ * a module-level snapshot would freeze an empty list for the process.
+ */
+export function getDisabledDefaultPlugins() {
+    return getAppConfig().plugins.disabled;
+}
+/**
+ * Whether the framework should withhold its default implementation of `slot`.
+ *
+ * Only the framework's own defaults are gated. An app that ships
+ * `server/plugins/<slot>.ts` mounted its plugin deliberately, and this switch
+ * does not reach in and unmount it.
+ */
+export function isDefaultPluginDisabled(slot) {
+    return getDisabledDefaultPlugins().includes(slot);
+}

package/dist/server/edge.d.ts

@@ -1,4 +1,5 @@
 export { createAuthPlugin, defaultAuthPlugin } from "./auth-plugin.js";
+export { getDisabledDefaultPlugins, isDefaultPluginDisabled, } from "./default-plugins.js";
 export { BETTER_AUTH_MIGRATIONS, runBetterAuthMigrations, } from "./better-auth-migrations.js";
 export { runFrameworkReleaseMigrations } from "./release-migrations.js";
 export { createAgentChatPlugin, defaultAgentChatPlugin, refreshGlobalMcpManager, type AgentChatPluginOptions, } from "./agent-chat-plugin.js";

package/dist/server/edge.js

@@ -1,4 +1,5 @@
 export { createAuthPlugin, defaultAuthPlugin } from "./auth-plugin.js";
+export { getDisabledDefaultPlugins, isDefaultPluginDisabled, } from "./default-plugins.js";
 export { BETTER_AUTH_MIGRATIONS, runBetterAuthMigrations, } from "./better-auth-migrations.js";
 export { runFrameworkReleaseMigrations } from "./release-migrations.js";
 export { createAgentChatPlugin, defaultAgentChatPlugin, refreshGlobalMcpManager, } from "./agent-chat-plugin.js";