@agent-native/core 0.169.1 → 0.171.0

package/dist/server/auth.js

@@ -4056,6 +4056,24 @@ async function mountBetterAuthRoutes(app, options) {
             return { error: authError.message };
         }
     }));
+    // Better Auth redirects new magic-link users through this small public
+    // callback so first-run onboarding is marked only for newly created users.
+    // Keep this before the generic magic-link handler for runtimes whose
+    // app.use() middleware paths match descendants as prefixes.
+    app.use("/_agent-native/auth/magic-link/new-user", defineEventHandler(async (event) => {
+        if (!isReadMethod(event)) {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const query = getQuery(event);
+        const rawReturn = Array.isArray(query.return)
+            ? query.return[0]
+            : query.return;
+        if (await getSession(event)) {
+            setFirstRunOnboardingCookie(event);
+        }
+        return redirectWithStagedCookies(event, safeReturnPath(rawReturn), 302);
+    }));
     // Passwordless login via Better Auth's rate-limited magic-link plugin.
     app.use("/_agent-native/auth/magic-link", defineEventHandler(async (event) => {
         if (getMethod(event) === "GET") {
@@ -4313,22 +4331,6 @@ async function mountBetterAuthRoutes(app, options) {
             headers: { "Content-Type": "text/html; charset=utf-8" },
         });
     }));
-    // Better Auth redirects new magic-link users through this small public
-    // callback so first-run onboarding is marked only for newly created users.
-    app.use("/_agent-native/auth/magic-link/new-user", defineEventHandler(async (event) => {
-        if (!isReadMethod(event)) {
-            setResponseStatus(event, 405);
-            return { error: "Method not allowed" };
-        }
-        const query = getQuery(event);
-        const rawReturn = Array.isArray(query.return)
-            ? query.return[0]
-            : query.return;
-        if (await getSession(event)) {
-            setFirstRunOnboardingCookie(event);
-        }
-        return redirectWithStagedCookies(event, safeReturnPath(rawReturn), 302);
-    }));
     // Auth guard — stored both in framework middleware registry AND in
     // _authGuardFn so the server middleware can enforce it on ALL routes.
     const loginHtmlConfig = getOnboardingLoginHtmlConfig(options, authLoginMode);

package/dist/server/beta-opt-out-html.js

@@ -1,4 +1,4 @@
-import { BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, } from "../shared/environment-lanes.js";
+import { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, } from "../shared/environment-lanes.js";
 export const BETA_OPT_OUT_PERSISTENCE_MARKER = "Persist the beta opt-out before authentication";
 const ENVIRONMENT_SWITCHER_MARKER = 'data-agent-native-environment-switcher="1"';
 const ENVIRONMENT_SWITCHER_STYLE_MARKER = 'data-agent-native-environment-switcher-style="1"';
@@ -16,11 +16,16 @@ const environmentSwitcherMarkup = `<div class="environment-switcher" id="environ
     <div class="environment-popover-title" id="environment-popover-title">You're on Agent Native Beta</div>
     <div class="environment-popover-copy">Choose where you want to continue.</div>
     <a class="environment-production-link" id="environment-production-link" href="">Switch to production</a>
+    <button type="button" class="environment-hide-badge" id="environment-hide-badge">Hide badge</button>
   </div>
 </div>`;
 const environmentSwitcherStyles = `<style ${ENVIRONMENT_SWITCHER_STYLE_MARKER}>
-  color-scheme: dark;
   .environment-switcher {
+    /* Must stay inside a rule. A bare declaration at stylesheet top level does
+       not end at its semicolon: the next qualified rule's prelude swallows it,
+       taking this selector with it, so the badge loses position/left/bottom and
+       drops into normal flow at the bottom of the page. */
+    color-scheme: dark;
     position: fixed;
     left: max(0.75rem, env(safe-area-inset-left));
     bottom: max(0.75rem, env(safe-area-inset-bottom));
@@ -53,7 +58,8 @@ const environmentSwitcherStyles = `<style ${ENVIRONMENT_SWITCHER_STYLE_MARKER}>
     background: color-mix(in srgb, CanvasText 85%, Canvas);
   }
   .environment-badge:focus-visible,
-  .environment-production-link:focus-visible {
+  .environment-production-link:focus-visible,
+  .environment-hide-badge:focus-visible {
     outline: 2px solid LinkText;
     outline-offset: 2px;
   }
@@ -87,6 +93,23 @@ const environmentSwitcherStyles = `<style ${ENVIRONMENT_SWITCHER_STYLE_MARKER}>
   .environment-production-link:hover {
     background: color-mix(in srgb, CanvasText 12%, Canvas);
   }
+  .environment-hide-badge {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 100%;
+    min-height: 2rem;
+    margin-top: 0.5rem;
+    margin-bottom: -0.5rem;
+    padding: 0.375rem 0.75rem;
+    color: GrayText;
+    border: 0;
+    background: transparent;
+    font: inherit;
+    font-size: 0.8125rem;
+    cursor: pointer;
+  }
+  .environment-hide-badge:hover { color: CanvasText; }
 </style>`;
 const environmentSwitcherScript = `<script ${ENVIRONMENT_SWITCHER_SCRIPT_MARKER}>
 (function __anInitEnvironmentBadge() {
@@ -94,9 +117,19 @@ const environmentSwitcherScript = `<script ${ENVIRONMENT_SWITCHER_SCRIPT_MARKER}
   var button = document.getElementById('environment-badge');
   var popover = document.getElementById('environment-popover');
   var productionLink = document.getElementById('environment-production-link');
-  if (!switcher || !button || !popover || !productionLink) return;
+  var hideButton = document.getElementById('environment-hide-badge');
+  if (!switcher || !button || !popover || !productionLink || !hideButton) return;
   if (window.parent !== window) return;
 
+  try {
+    var forceUrl = new URL(window.location.href);
+    if (forceUrl.searchParams.get(${JSON.stringify(BETA_FORCE_QUERY_PARAM)}) === 'true') {
+      window.sessionStorage.setItem(${JSON.stringify(BETA_FORCE_SESSION_STORAGE_KEY)}, '1');
+    }
+  } catch (error) {
+    void error;
+  }
+
   var betaHosts = ${JSON.stringify(ENVIRONMENT_BETA_HOSTS)};
   var hostname = (window.location.hostname || '').toLowerCase().replace(/\\.$/, '');
   var productionHost = hostname.indexOf('beta.') === 0 ? hostname.slice(5) : '';
@@ -132,12 +165,20 @@ const environmentSwitcherScript = `<script ${ENVIRONMENT_SWITCHER_SCRIPT_MARKER}
   document.addEventListener('keydown', function(event) {
     if (event.key === 'Escape') setOpen(false);
   });
+  hideButton.addEventListener('click', function() {
+    setOpen(false);
+    switcher.hidden = true;
+  });
 })();
 </script>`;
 const betaOptOutPersistenceScript = `<script data-agent-native-beta-opt-out>
 // ${BETA_OPT_OUT_PERSISTENCE_MARKER}.
 (function __anPersistBetaOptOut() {
   try {
+    var forceUrl = new URL(window.location.href);
+    if (forceUrl.searchParams.get(${JSON.stringify(BETA_FORCE_QUERY_PARAM)}) === 'true') {
+      window.sessionStorage.setItem(${JSON.stringify(BETA_FORCE_SESSION_STORAGE_KEY)}, '1');
+    }
     var optOutUrl = new URL(window.location.href);
     var optOutValue = optOutUrl.searchParams.get(${JSON.stringify(BETA_OPT_OUT_QUERY_PARAM)});
     if (optOutValue === null) return;

package/dist/server/better-auth-instance.d.ts

@@ -265,5 +265,6 @@ export declare function resetBetterAuth(): Promise<void>;
  */
 export declare function configureLocalSqlite(sqlite: {
     pragma(statement: string): unknown;
-}): void;
+    close?(): void;
+}): Promise<void>;
 export declare function buildDatabaseConfig(dialect: string): Promise<BetterAuthOptions["database"]>;

package/dist/server/better-auth-instance.js

@@ -14,9 +14,10 @@ import { jwt } from "better-auth/plugins/jwt";
 import { magicLink } from "better-auth/plugins/magic-link";
 import { pgTable, text as pgText, timestamp as pgTimestamp, boolean as pgBoolean, } from "drizzle-orm/pg-core";
 import { sqliteTable, text as sqliteText, integer as sqliteInteger, } from "drizzle-orm/sqlite-core";
+import { getAppConfig } from "../app-config/index.js";
 import { TEMPLATES } from "../cli/templates-meta.js";
 import { getDbExec, isPostgres } from "../db/client.js";
-import { getDialect, getCloudflareD1Binding, getDatabaseUrl, getDatabaseAuthToken, closePgliteClients, getPgliteClient, isPgliteUrl, loadPgliteDrizzle, pgPoolOptions, neonPoolOptions, guardNeonPool, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, } from "../db/client.js";
+import { getDialect, getCloudflareD1Binding, getDatabaseUrl, getDatabaseAuthToken, closePgliteClients, getPgliteClient, isPgliteUrl, loadPgliteDrizzle, pgPoolOptions, neonPoolOptions, guardNeonPool, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, prepareLocalSqliteUrl, sqliteFilenameFromUrl, retrySqliteBusy, } from "../db/client.js";
 import { CORE_RESET_PASSWORD_EMAIL_ID, CORE_VERIFY_SIGNUP_EMAIL_ID, } from "../email-catalog/system-emails.js";
 import { saveOAuthTokens } from "../oauth-tokens/store.js";
 import { acceptPendingInvitationsForEmail } from "../org/accept-pending.js";
@@ -266,6 +267,19 @@ export function isDeployPreview() {
     return deployContext === "deploy-preview";
 }
 export function resolveEmailPasswordAuthPolicy(emailConfigured) {
+    const declared = getAppConfig().auth.requireEmailVerification;
+    if (declared !== undefined) {
+        // A declared policy is the whole policy — it outranks both the hosted
+        // derivation below and AUTH_SKIP_EMAIL_VERIFICATION. Choosing `false` is
+        // choosing to accept an unverified email as a login credential, so the
+        // signup lock that exists to prevent exactly that comes off with it.
+        return {
+            requireEmailVerification: declared && emailConfigured,
+            // Verification that no provider can deliver would strand every new
+            // account on an unverifiable signup, so refuse the signup instead.
+            disableSignUp: declared && !emailConfigured,
+        };
+    }
     const hosted = process.env.NODE_ENV === "production" || isDeployPreview();
     return {
         requireEmailVerification: emailConfigured && (hosted || !shouldSkipEmailVerification()),
@@ -539,7 +553,12 @@ export async function getBetterAuth(config) {
         return _auth;
     if (_initPromise)
         return _initPromise;
-    _initPromise = createBetterAuthInstance(config);
+    // A failed boot must not be cached: every later request would replay the same
+    // stale error with no way back short of restarting the process.
+    _initPromise = createBetterAuthInstance(config).catch((error) => {
+        _initPromise = undefined;
+        throw error;
+    });
     _auth = await _initPromise;
     return _auth;
 }
@@ -1247,9 +1266,20 @@ async function createBetterAuthInstance(config) {
  * as the shared app connection. Better Auth uses its own SQLite handle, so the
  * app connection's busy timeout does not protect first-run account creation.
  */
-export function configureLocalSqlite(sqlite) {
+export async function configureLocalSqlite(sqlite) {
     sqlite.pragma("busy_timeout = 10000");
-    sqlite.pragma("journal_mode = WAL");
+    try {
+        // Vite can start a replacement Nitro runtime while the previous instance is
+        // still releasing app.db, and the busy timeout can expire during that
+        // handoff, so retry the idempotent WAL negotiation.
+        await retrySqliteBusy(async () => sqlite.pragma("journal_mode = WAL"), {
+            rethrow: true,
+        });
+    }
+    catch (error) {
+        sqlite.close?.();
+        throw error;
+    }
 }
 export async function buildDatabaseConfig(dialect) {
     if (dialect === "postgres") {
@@ -1325,9 +1355,9 @@ export async function buildDatabaseConfig(dialect) {
     if (url.startsWith("file:") || !url.includes("://")) {
         // Local SQLite via better-sqlite3
         const { default: Database } = await import("better-sqlite3");
-        const filePath = url.replace(/^file:/, "");
-        const sqlite = new Database(filePath);
-        configureLocalSqlite(sqlite);
+        const sqliteUrl = await prepareLocalSqliteUrl(url.startsWith("file:") ? url : `file:${url}`);
+        const sqlite = new Database(sqliteFilenameFromUrl(sqliteUrl));
+        await configureLocalSqlite(sqlite);
         const { drizzle } = await import("drizzle-orm/better-sqlite3");
         const db = drizzle(sqlite, { schema: sqliteAuthSchema });
         const { drizzleAdapter } = await import("better-auth/adapters/drizzle");

package/dist/server/builder-design-systems.d.ts

@@ -81,6 +81,8 @@ export interface BuilderDesignSystemHydratedReference extends BuilderDesignSyste
     docs: BuilderDesignSystemDocument[];
     tokenValues: Record<string, string>;
     docCount: number;
+    /** True only when Builder explicitly confirms that indexing is complete. */
+    completionConfirmed?: boolean;
 }
 export interface BuilderDesignSystemIndexOptions {
     projectName?: string;
@@ -108,8 +110,9 @@ export interface BuilderDesignSystemIndexResult {
     designSystemId: string;
     suggestedTitle: string | null;
     builderUrl: string;
-    status: "in-progress";
+    status: BuilderDesignSystemStatus;
 }
+export type BuilderDesignSystemStatus = "in-progress" | "ready" | "complete" | "completed" | "error" | "failed" | "cancelled";
 export interface BuilderDesignSystemUploadAttachment {
     name: string;
     mimetype: string;

package/dist/server/builder-design-systems.js

@@ -10,6 +10,8 @@ const GCS_CHUNK_SIZE = 16 * 1024 * 1024;
 const MAX_CHUNK_RETRIES = 5;
 const DEFAULT_MAX_CODE_FILES = 50;
 const DEFAULT_MAX_TOTAL_CODE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_BUILDER_DOC_PAGE_SIZE = 40;
+const MAX_BUILDER_DOC_PAGES = 100;
 const MAX_DOC_CONTENT_CHARS = 4_000;
 const MAX_GITHUB_FILES = 50;
 const MAX_GITHUB_TOTAL_BYTES = 2 * 1024 * 1024;
@@ -654,7 +656,35 @@ function normalizeBuilderDesignSystemDocument(value) {
             : undefined,
     };
 }
-export async function fetchBuilderDesignSystemDocs(designSystemId, options = {}) {
+function normalizeBuilderDesignSystemStatus(value) {
+    if (typeof value !== "string")
+        return "in-progress";
+    switch (value.trim().toLowerCase()) {
+        case "ready":
+            return "ready";
+        case "complete":
+        case "done":
+        case "success":
+            return "complete";
+        case "completed":
+            return "completed";
+        case "error":
+            return "error";
+        case "failed":
+        case "failure":
+            return "failed";
+        case "cancelled":
+        case "canceled":
+            return "cancelled";
+        default:
+            return "in-progress";
+    }
+}
+function isConfirmedBuilderDesignSystemStatus(value) {
+    const status = normalizeBuilderDesignSystemStatus(value);
+    return status === "ready" || status === "complete" || status === "completed";
+}
+async function fetchBuilderDesignSystemDocsResponse(designSystemId, options) {
     const credentials = await resolveBuilderDesignSystemCredentials();
     const url = makeBuilderDesignSystemUrl(`${encodeURIComponent(designSystemId)}/docs`, credentials);
     if (options.page !== undefined)
@@ -671,13 +701,61 @@ export async function fetchBuilderDesignSystemDocs(designSystemId, options = {})
     });
     await assertOk(response, "Builder design-system docs fetch failed");
     const json = (await response.json());
-    if (!Array.isArray(json)) {
+    if (Array.isArray(json)) {
+        return {
+            docs: json.map(normalizeBuilderDesignSystemDocument),
+            completionConfirmed: false,
+        };
+    }
+    if (!json || typeof json !== "object") {
+        throw new Error("Builder design-system docs fetch returned an invalid response.");
+    }
+    const envelope = json;
+    const rawDocs = envelope.docs ?? envelope.items;
+    if (!Array.isArray(rawDocs)) {
         throw new Error("Builder design-system docs fetch returned an invalid response.");
     }
-    return json.map(normalizeBuilderDesignSystemDocument);
+    const rawStatus = envelope.status ?? envelope.builderStatus;
+    const status = typeof rawStatus === "string"
+        ? normalizeBuilderDesignSystemStatus(rawStatus)
+        : undefined;
+    const isTerminalFailure = status === "error" || status === "failed" || status === "cancelled";
+    return {
+        docs: rawDocs.map(normalizeBuilderDesignSystemDocument),
+        completionConfirmed: !isTerminalFailure &&
+            (envelope.complete === true ||
+                envelope.completed === true ||
+                isConfirmedBuilderDesignSystemStatus(status)),
+        ...(status ? { status } : {}),
+    };
 }
-export async function hydrateBuilderDesignSystemReference(reference, options = { page: 0, pageSize: 40 }) {
-    const docs = await fetchBuilderDesignSystemDocs(reference.builderDesignSystemId, options);
+export async function fetchBuilderDesignSystemDocs(designSystemId, options = {}) {
+    return (await fetchBuilderDesignSystemDocsResponse(designSystemId, options))
+        .docs;
+}
+export async function hydrateBuilderDesignSystemReference(reference, options = {
+    page: 0,
+    pageSize: DEFAULT_BUILDER_DOC_PAGE_SIZE,
+}) {
+    const pageSize = options.pageSize && options.pageSize > 0
+        ? options.pageSize
+        : DEFAULT_BUILDER_DOC_PAGE_SIZE;
+    const docs = [];
+    let page = Math.max(0, options.page ?? 0);
+    let completionConfirmed = false;
+    let builderStatus = reference.builderStatus;
+    for (let pageNumber = 0; pageNumber < MAX_BUILDER_DOC_PAGES; pageNumber++) {
+        const response = await fetchBuilderDesignSystemDocsResponse(reference.builderDesignSystemId, { ...options, page, pageSize });
+        docs.push(...response.docs);
+        completionConfirmed ||= response.completionConfirmed;
+        builderStatus = response.status ?? builderStatus;
+        if (response.docs.length < pageSize)
+            break;
+        page += 1;
+        if (pageNumber === MAX_BUILDER_DOC_PAGES - 1) {
+            throw new Error("Builder design-system docs fetch exceeded the safe pagination limit.");
+        }
+    }
     const tokenValues = {};
     for (const doc of docs) {
         if (!doc.tokenValues)
@@ -689,9 +767,12 @@ export async function hydrateBuilderDesignSystemReference(reference, options = {
     }
     return {
         ...reference,
+        ...(builderStatus ? { builderStatus } : {}),
         docs,
         tokenValues,
         docCount: docs.length,
+        completionConfirmed: completionConfirmed ||
+            isConfirmedBuilderDesignSystemStatus(builderStatus),
     };
 }
 /**
@@ -771,7 +852,7 @@ export async function indexBuilderDesignSystem(options) {
         builderUrl: branchUrl ||
             builderProjectBranchUrl(indexed.projectId, indexed.branchName) ||
             builderDesignSystemUrl(indexed.designSystemId),
-        status: "in-progress",
+        status: normalizeBuilderDesignSystemStatus(indexed.status),
     };
 }
 /**

package/dist/server/builder-oauth.d.ts

@@ -1,11 +1,5 @@
 export declare const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
 export declare const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
-export declare const BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA = "https://mcp.builder.io/.well-known/oauth-protected-resource/api";
-export declare const BUILDER_OAUTH_AUTHORIZATION_METADATA = "https://mcp.builder.io/.well-known/oauth-authorization-server";
-export declare const BUILDER_OAUTH_AUTHORIZATION_ENDPOINT = "https://mcp.builder.io/oauth/authorize";
-export declare const BUILDER_OAUTH_TOKEN_ENDPOINT = "https://mcp.builder.io/oauth/token";
-export declare const BUILDER_OAUTH_REGISTRATION_ENDPOINT = "https://mcp.builder.io/oauth/register";
-export declare const BUILDER_OAUTH_REVOCATION_ENDPOINT = "https://mcp.builder.io/oauth/revoke";
 export declare const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
 export declare const BUILDER_OAUTH_SCOPES: readonly ["builder:ai:invoke"];
 export type BuilderOAuthPendingFlow = {
@@ -32,12 +26,12 @@ export declare function startBuilderOAuthAuthorization(input: {
 }>;
 export declare function finishBuilderOAuthAuthorization(input: {
     ownerEmail: string;
+    orgId?: string;
     code: string;
     iss?: string;
     pending: BuilderOAuthPendingFlow;
 }): Promise<void>;
 export declare function markBuilderOAuthReconnectRequired(ownerEmail: string): Promise<void>;
-export declare function builderOAuthReconnectRequired(ownerEmail: string): Promise<boolean>;
 export declare function getBuilderOAuthSession(ownerEmail: string): Promise<BuilderOAuthSession | null>;
 export declare function hasBuilderOAuthSession(ownerEmail: string): Promise<boolean>;
 export declare function resolveBuilderOAuthRequestAccess(input: {