@agent-native/core 0.169.1 → 0.170.0

package/dist/server/builder-design-systems.js

@@ -10,6 +10,8 @@ const GCS_CHUNK_SIZE = 16 * 1024 * 1024;
 const MAX_CHUNK_RETRIES = 5;
 const DEFAULT_MAX_CODE_FILES = 50;
 const DEFAULT_MAX_TOTAL_CODE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_BUILDER_DOC_PAGE_SIZE = 40;
+const MAX_BUILDER_DOC_PAGES = 100;
 const MAX_DOC_CONTENT_CHARS = 4_000;
 const MAX_GITHUB_FILES = 50;
 const MAX_GITHUB_TOTAL_BYTES = 2 * 1024 * 1024;
@@ -654,7 +656,35 @@ function normalizeBuilderDesignSystemDocument(value) {
             : undefined,
     };
 }
-export async function fetchBuilderDesignSystemDocs(designSystemId, options = {}) {
+function normalizeBuilderDesignSystemStatus(value) {
+    if (typeof value !== "string")
+        return "in-progress";
+    switch (value.trim().toLowerCase()) {
+        case "ready":
+            return "ready";
+        case "complete":
+        case "done":
+        case "success":
+            return "complete";
+        case "completed":
+            return "completed";
+        case "error":
+            return "error";
+        case "failed":
+        case "failure":
+            return "failed";
+        case "cancelled":
+        case "canceled":
+            return "cancelled";
+        default:
+            return "in-progress";
+    }
+}
+function isConfirmedBuilderDesignSystemStatus(value) {
+    const status = normalizeBuilderDesignSystemStatus(value);
+    return status === "ready" || status === "complete" || status === "completed";
+}
+async function fetchBuilderDesignSystemDocsResponse(designSystemId, options) {
     const credentials = await resolveBuilderDesignSystemCredentials();
     const url = makeBuilderDesignSystemUrl(`${encodeURIComponent(designSystemId)}/docs`, credentials);
     if (options.page !== undefined)
@@ -671,13 +701,61 @@ export async function fetchBuilderDesignSystemDocs(designSystemId, options = {})
     });
     await assertOk(response, "Builder design-system docs fetch failed");
     const json = (await response.json());
-    if (!Array.isArray(json)) {
+    if (Array.isArray(json)) {
+        return {
+            docs: json.map(normalizeBuilderDesignSystemDocument),
+            completionConfirmed: false,
+        };
+    }
+    if (!json || typeof json !== "object") {
+        throw new Error("Builder design-system docs fetch returned an invalid response.");
+    }
+    const envelope = json;
+    const rawDocs = envelope.docs ?? envelope.items;
+    if (!Array.isArray(rawDocs)) {
         throw new Error("Builder design-system docs fetch returned an invalid response.");
     }
-    return json.map(normalizeBuilderDesignSystemDocument);
+    const rawStatus = envelope.status ?? envelope.builderStatus;
+    const status = typeof rawStatus === "string"
+        ? normalizeBuilderDesignSystemStatus(rawStatus)
+        : undefined;
+    const isTerminalFailure = status === "error" || status === "failed" || status === "cancelled";
+    return {
+        docs: rawDocs.map(normalizeBuilderDesignSystemDocument),
+        completionConfirmed: !isTerminalFailure &&
+            (envelope.complete === true ||
+                envelope.completed === true ||
+                isConfirmedBuilderDesignSystemStatus(status)),
+        ...(status ? { status } : {}),
+    };
 }
-export async function hydrateBuilderDesignSystemReference(reference, options = { page: 0, pageSize: 40 }) {
-    const docs = await fetchBuilderDesignSystemDocs(reference.builderDesignSystemId, options);
+export async function fetchBuilderDesignSystemDocs(designSystemId, options = {}) {
+    return (await fetchBuilderDesignSystemDocsResponse(designSystemId, options))
+        .docs;
+}
+export async function hydrateBuilderDesignSystemReference(reference, options = {
+    page: 0,
+    pageSize: DEFAULT_BUILDER_DOC_PAGE_SIZE,
+}) {
+    const pageSize = options.pageSize && options.pageSize > 0
+        ? options.pageSize
+        : DEFAULT_BUILDER_DOC_PAGE_SIZE;
+    const docs = [];
+    let page = Math.max(0, options.page ?? 0);
+    let completionConfirmed = false;
+    let builderStatus = reference.builderStatus;
+    for (let pageNumber = 0; pageNumber < MAX_BUILDER_DOC_PAGES; pageNumber++) {
+        const response = await fetchBuilderDesignSystemDocsResponse(reference.builderDesignSystemId, { ...options, page, pageSize });
+        docs.push(...response.docs);
+        completionConfirmed ||= response.completionConfirmed;
+        builderStatus = response.status ?? builderStatus;
+        if (response.docs.length < pageSize)
+            break;
+        page += 1;
+        if (pageNumber === MAX_BUILDER_DOC_PAGES - 1) {
+            throw new Error("Builder design-system docs fetch exceeded the safe pagination limit.");
+        }
+    }
     const tokenValues = {};
     for (const doc of docs) {
         if (!doc.tokenValues)
@@ -689,9 +767,12 @@ export async function hydrateBuilderDesignSystemReference(reference, options = {
     }
     return {
         ...reference,
+        ...(builderStatus ? { builderStatus } : {}),
         docs,
         tokenValues,
         docCount: docs.length,
+        completionConfirmed: completionConfirmed ||
+            isConfirmedBuilderDesignSystemStatus(builderStatus),
     };
 }
 /**
@@ -771,7 +852,7 @@ export async function indexBuilderDesignSystem(options) {
         builderUrl: branchUrl ||
             builderProjectBranchUrl(indexed.projectId, indexed.branchName) ||
             builderDesignSystemUrl(indexed.designSystemId),
-        status: "in-progress",
+        status: normalizeBuilderDesignSystemStatus(indexed.status),
     };
 }
 /**

package/dist/server/builder-oauth.d.ts

@@ -1,11 +1,5 @@
 export declare const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
 export declare const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
-export declare const BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA = "https://mcp.builder.io/.well-known/oauth-protected-resource/api";
-export declare const BUILDER_OAUTH_AUTHORIZATION_METADATA = "https://mcp.builder.io/.well-known/oauth-authorization-server";
-export declare const BUILDER_OAUTH_AUTHORIZATION_ENDPOINT = "https://mcp.builder.io/oauth/authorize";
-export declare const BUILDER_OAUTH_TOKEN_ENDPOINT = "https://mcp.builder.io/oauth/token";
-export declare const BUILDER_OAUTH_REGISTRATION_ENDPOINT = "https://mcp.builder.io/oauth/register";
-export declare const BUILDER_OAUTH_REVOCATION_ENDPOINT = "https://mcp.builder.io/oauth/revoke";
 export declare const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
 export declare const BUILDER_OAUTH_SCOPES: readonly ["builder:ai:invoke"];
 export type BuilderOAuthPendingFlow = {
@@ -32,12 +26,12 @@ export declare function startBuilderOAuthAuthorization(input: {
 }>;
 export declare function finishBuilderOAuthAuthorization(input: {
     ownerEmail: string;
+    orgId?: string;
     code: string;
     iss?: string;
     pending: BuilderOAuthPendingFlow;
 }): Promise<void>;
 export declare function markBuilderOAuthReconnectRequired(ownerEmail: string): Promise<void>;
-export declare function builderOAuthReconnectRequired(ownerEmail: string): Promise<boolean>;
 export declare function getBuilderOAuthSession(ownerEmail: string): Promise<BuilderOAuthSession | null>;
 export declare function hasBuilderOAuthSession(ownerEmail: string): Promise<boolean>;
 export declare function resolveBuilderOAuthRequestAccess(input: {

package/dist/server/builder-oauth.js

@@ -1,58 +1,58 @@
-import { finishMcpOAuthAuthorization, getMcpOAuthAccessToken, readMcpOAuthCredentials, revokeMcpOAuthCredentials, saveMcpOAuthCredentials, startMcpOAuthAuthorization, validateMcpOAuthCallbackIssuer, } from "../mcp-client/oauth-client.js";
+import { createHash } from "node:crypto";
+import { finishMcpOAuthAuthorization, getMcpOAuthAccessToken, markMcpOAuthReconnectRequired, readMcpOAuthCredentials, revokeMcpOAuthCredentials, saveMcpOAuthCredentials, startMcpOAuthAuthorization, validateMcpOAuthCallbackIssuer, } from "../mcp-client/oauth-client.js";
 import { getOAuthTokens } from "../oauth-tokens/store.js";
-import { getSetting, mutateSetting, putSetting } from "../settings/store.js";
+import { resolveOrgIdForEmail } from "../org/context.js";
 export const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
 export const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
-export const BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA = "https://mcp.builder.io/.well-known/oauth-protected-resource/api";
-export const BUILDER_OAUTH_AUTHORIZATION_METADATA = "https://mcp.builder.io/.well-known/oauth-authorization-server";
-export const BUILDER_OAUTH_AUTHORIZATION_ENDPOINT = "https://mcp.builder.io/oauth/authorize";
-export const BUILDER_OAUTH_TOKEN_ENDPOINT = "https://mcp.builder.io/oauth/token";
-export const BUILDER_OAUTH_REGISTRATION_ENDPOINT = "https://mcp.builder.io/oauth/register";
-export const BUILDER_OAUTH_REVOCATION_ENDPOINT = "https://mcp.builder.io/oauth/revoke";
 export const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
 export const BUILDER_OAUTH_SCOPES = [BUILDER_OAUTH_SCOPE];
+// Folded with the owner so each owner gets their own (provider, account_id)
+// row; a bare shared key would let only the first connector hold a grant.
 const BUILDER_OAUTH_KEY = "builder-general-resource-v1";
-const REFRESH_SKEW_MS = 60_000;
-const REFRESH_LEASE_MS = 15_000;
-const REFRESH_WAIT_MS = 50;
-function ownerOptions(ownerEmail) {
-    const scopeId = ownerEmail.trim().toLowerCase();
-    if (!scopeId)
+// Builder's general AI resource metadata lives at a non-default path; the
+// default api.builder.io well-known describes its Figma integration instead.
+// Point discovery here so live metadata resolves to the api.builder.io resource
+// and the mcp.builder.io authorization server.
+const BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA = "https://mcp.builder.io/.well-known/oauth-protected-resource/api";
+// The Builder connection is shared by everyone in the caller's org: the
+// credential is scoped to the org so every member reads the same token. Every
+// user belongs to an org, so a missing org is a broken invariant, not a case
+// to fall back on.
+function normalizeOwnerEmail(ownerEmail) {
+    const email = ownerEmail.trim().toLowerCase();
+    if (!email)
         throw new Error("Builder OAuth owner email is required");
+    return email;
+}
+// Read paths use this: a caller with no org simply has no Builder session, so
+// engine detection and status checks get null instead of an exception.
+async function resolveOwnerOptions(ownerEmail) {
+    const email = normalizeOwnerEmail(ownerEmail);
+    const orgId = await resolveOrgIdForEmail(email);
+    if (!orgId)
+        return null;
+    return orgOwnerOptions(orgId);
+}
+// Write paths use this: storing a Builder credential without an org is a broken
+// invariant, so a missing org fails loudly rather than silently dropping it.
+async function ownerOptions(ownerEmail) {
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options) {
+        throw new Error(`Builder OAuth requires an organization for ${normalizeOwnerEmail(ownerEmail)}`);
+    }
+    return options;
+}
+function orgOwnerOptions(orgId) {
     return {
-        key: BUILDER_OAUTH_KEY,
-        scope: "user",
-        scopeId,
+        key: builderOAuthKey(orgId),
+        scope: "org",
+        scopeId: orgId,
         serverUrl: BUILDER_OAUTH_RESOURCE,
     };
 }
-function refreshLeaseKey(ownerEmail) {
-    return `builder-oauth-refresh:user:${ownerOptions(ownerEmail).scopeId}`;
-}
-function reconnectKey(ownerEmail) {
-    return `builder-oauth-reconnect:user:${ownerOptions(ownerEmail).scopeId}`;
-}
-function discoveryState() {
-    return {
-        authorizationServerUrl: BUILDER_OAUTH_ISSUER,
-        authorizationServerMetadata: {
-            issuer: BUILDER_OAUTH_ISSUER,
-            authorization_endpoint: BUILDER_OAUTH_AUTHORIZATION_ENDPOINT,
-            token_endpoint: BUILDER_OAUTH_TOKEN_ENDPOINT,
-            registration_endpoint: BUILDER_OAUTH_REGISTRATION_ENDPOINT,
-            revocation_endpoint: BUILDER_OAUTH_REVOCATION_ENDPOINT,
-            // MCP SDK auth() reads these from the provided discovery blob and throws
-            // if they are missing — do not omit them when skipping live metadata fetch.
-            response_types_supported: ["code"],
-            grant_types_supported: ["authorization_code", "refresh_token"],
-            code_challenge_methods_supported: ["S256"],
-        },
-        resourceMetadataUrl: BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA,
-        resourceMetadata: {
-            resource: BUILDER_OAUTH_RESOURCE,
-            authorization_servers: [BUILDER_OAUTH_ISSUER],
-        },
-    };
+function builderOAuthKey(orgId) {
+    const digest = createHash("sha256").update(orgId).digest("hex");
+    return `${BUILDER_OAUTH_KEY}:o:${digest}`;
 }
 function scopesFrom(credentials) {
     const declared = credentials.tokens.scope;
@@ -72,35 +72,11 @@ function isBuilderDiscoveryState(value) {
     if (!value || typeof value !== "object")
         return false;
     const discovery = value;
-    const authorizationServers = discovery.resourceMetadata?.authorization_servers;
-    const responseTypes = discovery.authorizationServerMetadata?.response_types_supported;
-    const grantTypes = discovery.authorizationServerMetadata?.grant_types_supported;
-    const challengeMethods = discovery.authorizationServerMetadata?.code_challenge_methods_supported;
-    const resource = typeof discovery.resourceMetadata?.resource === "string"
-        ? discovery.resourceMetadata.resource
-        : null;
-    return (discovery?.authorizationServerUrl === BUILDER_OAUTH_ISSUER &&
+    const resource = discovery.resourceMetadata?.resource;
+    return (discovery.authorizationServerUrl === BUILDER_OAUTH_ISSUER &&
         discovery.authorizationServerMetadata?.issuer === BUILDER_OAUTH_ISSUER &&
-        discovery.authorizationServerMetadata?.authorization_endpoint ===
-            BUILDER_OAUTH_AUTHORIZATION_ENDPOINT &&
-        discovery.authorizationServerMetadata?.token_endpoint ===
-            BUILDER_OAUTH_TOKEN_ENDPOINT &&
-        discovery.authorizationServerMetadata?.registration_endpoint ===
-            BUILDER_OAUTH_REGISTRATION_ENDPOINT &&
-        discovery.authorizationServerMetadata?.revocation_endpoint ===
-            BUILDER_OAUTH_REVOCATION_ENDPOINT &&
-        Array.isArray(responseTypes) &&
-        responseTypes.includes("code") &&
-        Array.isArray(grantTypes) &&
-        grantTypes.includes("authorization_code") &&
-        Array.isArray(challengeMethods) &&
-        challengeMethods.includes("S256") &&
-        discovery.resourceMetadataUrl ===
-            BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA &&
-        !!resource &&
-        resourceUrlsMatch(resource, BUILDER_OAUTH_RESOURCE) &&
-        Array.isArray(authorizationServers) &&
-        authorizationServers.includes(BUILDER_OAUTH_ISSUER));
+        typeof resource === "string" &&
+        resourceUrlsMatch(resource, BUILDER_OAUTH_RESOURCE));
 }
 function isBuilderCredential(credentials) {
     return (resourceUrlsMatch(credentials.serverUrl, BUILDER_OAUTH_RESOURCE) &&
@@ -108,26 +84,16 @@ function isBuilderCredential(credentials) {
         credentials.tokens.issuer === BUILDER_OAUTH_ISSUER &&
         isBuilderDiscoveryState(credentials.discoveryState));
 }
-function sessionFrom(credentials) {
-    if (!isBuilderCredential(credentials))
-        return null;
-    const accessToken = credentials.tokens.access_token;
-    if (typeof accessToken !== "string" || !accessToken)
-        return null;
-    return {
-        accessToken,
-        expiresAt: credentials.tokenExpiresAt,
-        scopes: scopesFrom(credentials),
-    };
-}
 export async function startBuilderOAuthAuthorization(input) {
-    ownerOptions(input.ownerEmail);
+    // Start scopes nothing, so it validates the email without an org lookup;
+    // the org scope is resolved when the grant is stored and read.
+    normalizeOwnerEmail(input.ownerEmail);
     const started = await startMcpOAuthAuthorization({
         serverUrl: BUILDER_OAUTH_RESOURCE,
         redirectUrl: input.redirectUri,
         state: input.state,
         scope: BUILDER_OAUTH_SCOPE,
-        discoveryState: discoveryState(),
+        resourceMetadataUrl: BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA,
     });
     return {
         authorizationUrl: started.authorizationUrl.toString(),
@@ -140,9 +106,6 @@ export async function startBuilderOAuthAuthorization(input) {
     };
 }
 export async function finishBuilderOAuthAuthorization(input) {
-    if (!isBuilderDiscoveryState(input.pending.discoveryState)) {
-        throw new Error("Builder OAuth pending flow has an invalid discovery binding");
-    }
     validateMcpOAuthCallbackIssuer(input.pending.discoveryState, input.iss);
     const result = await finishMcpOAuthAuthorization({
         serverUrl: BUILDER_OAUTH_RESOURCE,
@@ -158,40 +121,41 @@ export async function finishBuilderOAuthAuthorization(input) {
         throw new Error("Builder OAuth exchange returned credentials for another resource");
     }
     await saveMcpOAuthCredentials({
-        ...ownerOptions(input.ownerEmail),
+        ...(input.orgId
+            ? orgOwnerOptions(input.orgId)
+            : await ownerOptions(input.ownerEmail)),
         credentials: result.credentials,
     });
-    await putSetting(reconnectKey(input.ownerEmail), {
-        required: false,
-        at: Date.now(),
-    }).catch(() => {
-        // coercion-ok: reconnect flag clear is best-effort after a successful grant.
-    });
 }
 export async function markBuilderOAuthReconnectRequired(ownerEmail) {
-    await putSetting(reconnectKey(ownerEmail), {
-        required: true,
-        at: Date.now(),
-    });
-}
-export async function builderOAuthReconnectRequired(ownerEmail) {
-    const row = await getSetting(reconnectKey(ownerEmail));
-    return row?.required === true;
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return;
+    await markMcpOAuthReconnectRequired(options);
 }
 export async function getBuilderOAuthSession(ownerEmail) {
-    if (await builderOAuthReconnectRequired(ownerEmail))
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return null;
+    // Delegates refresh single-flight and reconnect latching to the shared
+    // credential lifecycle; a null token covers missing, expired-unrefreshable,
+    // and reconnect_required alike.
+    const accessToken = await getMcpOAuthAccessToken(options);
+    if (!accessToken)
         return null;
-    const credentials = await readMcpOAuthCredentials(ownerOptions(ownerEmail));
+    const credentials = await readMcpOAuthCredentials(options);
     if (!credentials || !isBuilderCredential(credentials))
         return null;
-    if (typeof credentials.tokenExpiresAt === "number" &&
-        credentials.tokenExpiresAt - Date.now() <= REFRESH_SKEW_MS) {
-        return refreshBuilderOAuthSession(ownerEmail);
-    }
-    return sessionFrom(credentials);
+    return {
+        accessToken,
+        expiresAt: credentials.tokenExpiresAt,
+        scopes: scopesFrom(credentials),
+    };
 }
 export async function hasBuilderOAuthSession(ownerEmail) {
-    const options = ownerOptions(ownerEmail);
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return false;
     const stored = await getOAuthTokens("mcp", options.key, `${options.scope}:${options.scopeId}`);
     return stored !== null;
 }
@@ -202,60 +166,13 @@ export async function resolveBuilderOAuthRequestAccess(input) {
     if (!session.scopes.includes(input.requiredScope)) {
         throw new Error(`Builder OAuth connection does not grant ${input.requiredScope}`);
     }
-    return { ...session, ownerEmail: ownerOptions(input.ownerEmail).scopeId };
-}
-async function refreshBuilderOAuthSession(ownerEmail) {
-    const owner = crypto.randomUUID();
-    const leaseKey = refreshLeaseKey(ownerEmail);
-    const lease = await mutateSetting(leaseKey, (current) => {
-        if (typeof current?.expiresAt !== "number" ||
-            current.expiresAt <= Date.now()) {
-            return { owner, expiresAt: Date.now() + REFRESH_LEASE_MS };
-        }
-        return current;
-    });
-    if (lease.owner !== owner)
-        return waitForRefreshedSession(ownerEmail);
-    try {
-        const options = ownerOptions(ownerEmail);
-        const accessToken = await getMcpOAuthAccessToken(options);
-        const next = await readMcpOAuthCredentials(options);
-        if (!accessToken || !next || !isBuilderCredential(next)) {
-            throw new Error("Builder OAuth refresh failed");
-        }
-        return sessionFrom(next);
-    }
-    catch {
-        await markBuilderOAuthReconnectRequired(ownerEmail);
-        return null;
-    }
-    finally {
-        await mutateSetting(leaseKey, (current) => current?.owner === owner ? { owner: "", expiresAt: 0 } : (current ?? {}));
-    }
-}
-async function waitForRefreshedSession(ownerEmail) {
-    for (let waited = 0; waited < REFRESH_LEASE_MS; waited += REFRESH_WAIT_MS) {
-        await new Promise((resolve) => setTimeout(resolve, REFRESH_WAIT_MS));
-        const credentials = await readMcpOAuthCredentials(ownerOptions(ownerEmail));
-        if (!credentials || !isBuilderCredential(credentials))
-            return null;
-        if (typeof credentials.tokenExpiresAt !== "number" ||
-            credentials.tokenExpiresAt - Date.now() <= REFRESH_SKEW_MS) {
-            continue;
-        }
-        return sessionFrom(credentials);
-    }
-    return null;
+    return { ...session, ownerEmail: input.ownerEmail.trim().toLowerCase() };
 }
 export async function deleteBuilderOAuthSession(ownerEmail) {
-    const options = ownerOptions(ownerEmail);
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return { localDeleted: false, remoteRevoked: false };
     const result = await revokeMcpOAuthCredentials(options);
-    await putSetting(reconnectKey(ownerEmail), {
-        required: false,
-        at: Date.now(),
-    }).catch(() => {
-        // coercion-ok: reconnect flag clear is best-effort after local revoke.
-    });
     return {
         localDeleted: result.local === "deleted",
         remoteRevoked: result.remote === "succeeded",

package/dist/server/core-routes-plugin.d.ts

@@ -305,6 +305,35 @@ export declare function readLegacyCoreRouteInitSettings(readSetting?: CoreRouteS
  */
 export declare function shouldRunCoreRouteBootDatabaseWork(env?: NodeJS.ProcessEnv): boolean;
 export declare function ensureS3FileUploadProvider(): void;
+export interface OAuthCustodyBuilderKeyStatus {
+    privateKeyConfigured: boolean;
+    publicKeyConfigured: boolean;
+    orgName: string;
+    /**
+     * True when the key-pair lookup itself failed (credential store
+     * unreadable, org lookup error, a thrown import) rather than confirming
+     * no keys exist. privateKeyConfigured/publicKeyConfigured stay `false` in
+     * both cases — this is the only signal that tells "never configured"
+     * apart from "couldn't check right now", so a transient store blip can't
+     * read downstream as "the user never connected Builder keys".
+     */
+    keyLookupFailed: boolean;
+}
+/**
+ * Resolves the classic Builder key-pair status for a request that already
+ * has Builder MCP OAuth custody (the connection-status handler's `configured`
+ * is already `true` by the time this runs — OAuth alone proves the chat
+ * gateway). Exported so the connection-status route's OAuth-custody branch is
+ * unit-testable without standing up the full plugin.
+ */
+export declare function resolveOAuthCustodyBuilderKeyStatus(dependencies?: {
+    resolveCredentialsDetailed: () => Promise<{
+        privateKey: string | null;
+        publicKey: string | null;
+        orgName: string | null;
+        lookupFailed: boolean;
+    }>;
+}): Promise<OAuthCustodyBuilderKeyStatus>;
 export declare function createCoreRoutesPlugin(options?: CoreRoutesPluginOptions): NitroPluginDef;
 /**
  * Default core routes plugin — mount with no configuration needed.