@agent-native/core 0.169.1 → 0.171.0

package/dist/server/builder-oauth.js

@@ -1,58 +1,58 @@
-import { finishMcpOAuthAuthorization, getMcpOAuthAccessToken, readMcpOAuthCredentials, revokeMcpOAuthCredentials, saveMcpOAuthCredentials, startMcpOAuthAuthorization, validateMcpOAuthCallbackIssuer, } from "../mcp-client/oauth-client.js";
+import { createHash } from "node:crypto";
+import { finishMcpOAuthAuthorization, getMcpOAuthAccessToken, markMcpOAuthReconnectRequired, readMcpOAuthCredentials, revokeMcpOAuthCredentials, saveMcpOAuthCredentials, startMcpOAuthAuthorization, validateMcpOAuthCallbackIssuer, } from "../mcp-client/oauth-client.js";
 import { getOAuthTokens } from "../oauth-tokens/store.js";
-import { getSetting, mutateSetting, putSetting } from "../settings/store.js";
+import { resolveOrgIdForEmail } from "../org/context.js";
 export const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
 export const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
-export const BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA = "https://mcp.builder.io/.well-known/oauth-protected-resource/api";
-export const BUILDER_OAUTH_AUTHORIZATION_METADATA = "https://mcp.builder.io/.well-known/oauth-authorization-server";
-export const BUILDER_OAUTH_AUTHORIZATION_ENDPOINT = "https://mcp.builder.io/oauth/authorize";
-export const BUILDER_OAUTH_TOKEN_ENDPOINT = "https://mcp.builder.io/oauth/token";
-export const BUILDER_OAUTH_REGISTRATION_ENDPOINT = "https://mcp.builder.io/oauth/register";
-export const BUILDER_OAUTH_REVOCATION_ENDPOINT = "https://mcp.builder.io/oauth/revoke";
 export const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
 export const BUILDER_OAUTH_SCOPES = [BUILDER_OAUTH_SCOPE];
+// Folded with the owner so each owner gets their own (provider, account_id)
+// row; a bare shared key would let only the first connector hold a grant.
 const BUILDER_OAUTH_KEY = "builder-general-resource-v1";
-const REFRESH_SKEW_MS = 60_000;
-const REFRESH_LEASE_MS = 15_000;
-const REFRESH_WAIT_MS = 50;
-function ownerOptions(ownerEmail) {
-    const scopeId = ownerEmail.trim().toLowerCase();
-    if (!scopeId)
+// Builder's general AI resource metadata lives at a non-default path; the
+// default api.builder.io well-known describes its Figma integration instead.
+// Point discovery here so live metadata resolves to the api.builder.io resource
+// and the mcp.builder.io authorization server.
+const BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA = "https://mcp.builder.io/.well-known/oauth-protected-resource/api";
+// The Builder connection is shared by everyone in the caller's org: the
+// credential is scoped to the org so every member reads the same token. Every
+// user belongs to an org, so a missing org is a broken invariant, not a case
+// to fall back on.
+function normalizeOwnerEmail(ownerEmail) {
+    const email = ownerEmail.trim().toLowerCase();
+    if (!email)
         throw new Error("Builder OAuth owner email is required");
+    return email;
+}
+// Read paths use this: a caller with no org simply has no Builder session, so
+// engine detection and status checks get null instead of an exception.
+async function resolveOwnerOptions(ownerEmail) {
+    const email = normalizeOwnerEmail(ownerEmail);
+    const orgId = await resolveOrgIdForEmail(email);
+    if (!orgId)
+        return null;
+    return orgOwnerOptions(orgId);
+}
+// Write paths use this: storing a Builder credential without an org is a broken
+// invariant, so a missing org fails loudly rather than silently dropping it.
+async function ownerOptions(ownerEmail) {
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options) {
+        throw new Error(`Builder OAuth requires an organization for ${normalizeOwnerEmail(ownerEmail)}`);
+    }
+    return options;
+}
+function orgOwnerOptions(orgId) {
     return {
-        key: BUILDER_OAUTH_KEY,
-        scope: "user",
-        scopeId,
+        key: builderOAuthKey(orgId),
+        scope: "org",
+        scopeId: orgId,
         serverUrl: BUILDER_OAUTH_RESOURCE,
     };
 }
-function refreshLeaseKey(ownerEmail) {
-    return `builder-oauth-refresh:user:${ownerOptions(ownerEmail).scopeId}`;
-}
-function reconnectKey(ownerEmail) {
-    return `builder-oauth-reconnect:user:${ownerOptions(ownerEmail).scopeId}`;
-}
-function discoveryState() {
-    return {
-        authorizationServerUrl: BUILDER_OAUTH_ISSUER,
-        authorizationServerMetadata: {
-            issuer: BUILDER_OAUTH_ISSUER,
-            authorization_endpoint: BUILDER_OAUTH_AUTHORIZATION_ENDPOINT,
-            token_endpoint: BUILDER_OAUTH_TOKEN_ENDPOINT,
-            registration_endpoint: BUILDER_OAUTH_REGISTRATION_ENDPOINT,
-            revocation_endpoint: BUILDER_OAUTH_REVOCATION_ENDPOINT,
-            // MCP SDK auth() reads these from the provided discovery blob and throws
-            // if they are missing — do not omit them when skipping live metadata fetch.
-            response_types_supported: ["code"],
-            grant_types_supported: ["authorization_code", "refresh_token"],
-            code_challenge_methods_supported: ["S256"],
-        },
-        resourceMetadataUrl: BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA,
-        resourceMetadata: {
-            resource: BUILDER_OAUTH_RESOURCE,
-            authorization_servers: [BUILDER_OAUTH_ISSUER],
-        },
-    };
+function builderOAuthKey(orgId) {
+    const digest = createHash("sha256").update(orgId).digest("hex");
+    return `${BUILDER_OAUTH_KEY}:o:${digest}`;
 }
 function scopesFrom(credentials) {
     const declared = credentials.tokens.scope;
@@ -72,35 +72,11 @@ function isBuilderDiscoveryState(value) {
     if (!value || typeof value !== "object")
         return false;
     const discovery = value;
-    const authorizationServers = discovery.resourceMetadata?.authorization_servers;
-    const responseTypes = discovery.authorizationServerMetadata?.response_types_supported;
-    const grantTypes = discovery.authorizationServerMetadata?.grant_types_supported;
-    const challengeMethods = discovery.authorizationServerMetadata?.code_challenge_methods_supported;
-    const resource = typeof discovery.resourceMetadata?.resource === "string"
-        ? discovery.resourceMetadata.resource
-        : null;
-    return (discovery?.authorizationServerUrl === BUILDER_OAUTH_ISSUER &&
+    const resource = discovery.resourceMetadata?.resource;
+    return (discovery.authorizationServerUrl === BUILDER_OAUTH_ISSUER &&
         discovery.authorizationServerMetadata?.issuer === BUILDER_OAUTH_ISSUER &&
-        discovery.authorizationServerMetadata?.authorization_endpoint ===
-            BUILDER_OAUTH_AUTHORIZATION_ENDPOINT &&
-        discovery.authorizationServerMetadata?.token_endpoint ===
-            BUILDER_OAUTH_TOKEN_ENDPOINT &&
-        discovery.authorizationServerMetadata?.registration_endpoint ===
-            BUILDER_OAUTH_REGISTRATION_ENDPOINT &&
-        discovery.authorizationServerMetadata?.revocation_endpoint ===
-            BUILDER_OAUTH_REVOCATION_ENDPOINT &&
-        Array.isArray(responseTypes) &&
-        responseTypes.includes("code") &&
-        Array.isArray(grantTypes) &&
-        grantTypes.includes("authorization_code") &&
-        Array.isArray(challengeMethods) &&
-        challengeMethods.includes("S256") &&
-        discovery.resourceMetadataUrl ===
-            BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA &&
-        !!resource &&
-        resourceUrlsMatch(resource, BUILDER_OAUTH_RESOURCE) &&
-        Array.isArray(authorizationServers) &&
-        authorizationServers.includes(BUILDER_OAUTH_ISSUER));
+        typeof resource === "string" &&
+        resourceUrlsMatch(resource, BUILDER_OAUTH_RESOURCE));
 }
 function isBuilderCredential(credentials) {
     return (resourceUrlsMatch(credentials.serverUrl, BUILDER_OAUTH_RESOURCE) &&
@@ -108,26 +84,16 @@ function isBuilderCredential(credentials) {
         credentials.tokens.issuer === BUILDER_OAUTH_ISSUER &&
         isBuilderDiscoveryState(credentials.discoveryState));
 }
-function sessionFrom(credentials) {
-    if (!isBuilderCredential(credentials))
-        return null;
-    const accessToken = credentials.tokens.access_token;
-    if (typeof accessToken !== "string" || !accessToken)
-        return null;
-    return {
-        accessToken,
-        expiresAt: credentials.tokenExpiresAt,
-        scopes: scopesFrom(credentials),
-    };
-}
 export async function startBuilderOAuthAuthorization(input) {
-    ownerOptions(input.ownerEmail);
+    // Start scopes nothing, so it validates the email without an org lookup;
+    // the org scope is resolved when the grant is stored and read.
+    normalizeOwnerEmail(input.ownerEmail);
     const started = await startMcpOAuthAuthorization({
         serverUrl: BUILDER_OAUTH_RESOURCE,
         redirectUrl: input.redirectUri,
         state: input.state,
         scope: BUILDER_OAUTH_SCOPE,
-        discoveryState: discoveryState(),
+        resourceMetadataUrl: BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA,
     });
     return {
         authorizationUrl: started.authorizationUrl.toString(),
@@ -140,9 +106,6 @@ export async function startBuilderOAuthAuthorization(input) {
     };
 }
 export async function finishBuilderOAuthAuthorization(input) {
-    if (!isBuilderDiscoveryState(input.pending.discoveryState)) {
-        throw new Error("Builder OAuth pending flow has an invalid discovery binding");
-    }
     validateMcpOAuthCallbackIssuer(input.pending.discoveryState, input.iss);
     const result = await finishMcpOAuthAuthorization({
         serverUrl: BUILDER_OAUTH_RESOURCE,
@@ -158,40 +121,41 @@ export async function finishBuilderOAuthAuthorization(input) {
         throw new Error("Builder OAuth exchange returned credentials for another resource");
     }
     await saveMcpOAuthCredentials({
-        ...ownerOptions(input.ownerEmail),
+        ...(input.orgId
+            ? orgOwnerOptions(input.orgId)
+            : await ownerOptions(input.ownerEmail)),
         credentials: result.credentials,
     });
-    await putSetting(reconnectKey(input.ownerEmail), {
-        required: false,
-        at: Date.now(),
-    }).catch(() => {
-        // coercion-ok: reconnect flag clear is best-effort after a successful grant.
-    });
 }
 export async function markBuilderOAuthReconnectRequired(ownerEmail) {
-    await putSetting(reconnectKey(ownerEmail), {
-        required: true,
-        at: Date.now(),
-    });
-}
-export async function builderOAuthReconnectRequired(ownerEmail) {
-    const row = await getSetting(reconnectKey(ownerEmail));
-    return row?.required === true;
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return;
+    await markMcpOAuthReconnectRequired(options);
 }
 export async function getBuilderOAuthSession(ownerEmail) {
-    if (await builderOAuthReconnectRequired(ownerEmail))
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return null;
+    // Delegates refresh single-flight and reconnect latching to the shared
+    // credential lifecycle; a null token covers missing, expired-unrefreshable,
+    // and reconnect_required alike.
+    const accessToken = await getMcpOAuthAccessToken(options);
+    if (!accessToken)
         return null;
-    const credentials = await readMcpOAuthCredentials(ownerOptions(ownerEmail));
+    const credentials = await readMcpOAuthCredentials(options);
     if (!credentials || !isBuilderCredential(credentials))
         return null;
-    if (typeof credentials.tokenExpiresAt === "number" &&
-        credentials.tokenExpiresAt - Date.now() <= REFRESH_SKEW_MS) {
-        return refreshBuilderOAuthSession(ownerEmail);
-    }
-    return sessionFrom(credentials);
+    return {
+        accessToken,
+        expiresAt: credentials.tokenExpiresAt,
+        scopes: scopesFrom(credentials),
+    };
 }
 export async function hasBuilderOAuthSession(ownerEmail) {
-    const options = ownerOptions(ownerEmail);
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return false;
     const stored = await getOAuthTokens("mcp", options.key, `${options.scope}:${options.scopeId}`);
     return stored !== null;
 }
@@ -202,60 +166,13 @@ export async function resolveBuilderOAuthRequestAccess(input) {
     if (!session.scopes.includes(input.requiredScope)) {
         throw new Error(`Builder OAuth connection does not grant ${input.requiredScope}`);
     }
-    return { ...session, ownerEmail: ownerOptions(input.ownerEmail).scopeId };
-}
-async function refreshBuilderOAuthSession(ownerEmail) {
-    const owner = crypto.randomUUID();
-    const leaseKey = refreshLeaseKey(ownerEmail);
-    const lease = await mutateSetting(leaseKey, (current) => {
-        if (typeof current?.expiresAt !== "number" ||
-            current.expiresAt <= Date.now()) {
-            return { owner, expiresAt: Date.now() + REFRESH_LEASE_MS };
-        }
-        return current;
-    });
-    if (lease.owner !== owner)
-        return waitForRefreshedSession(ownerEmail);
-    try {
-        const options = ownerOptions(ownerEmail);
-        const accessToken = await getMcpOAuthAccessToken(options);
-        const next = await readMcpOAuthCredentials(options);
-        if (!accessToken || !next || !isBuilderCredential(next)) {
-            throw new Error("Builder OAuth refresh failed");
-        }
-        return sessionFrom(next);
-    }
-    catch {
-        await markBuilderOAuthReconnectRequired(ownerEmail);
-        return null;
-    }
-    finally {
-        await mutateSetting(leaseKey, (current) => current?.owner === owner ? { owner: "", expiresAt: 0 } : (current ?? {}));
-    }
-}
-async function waitForRefreshedSession(ownerEmail) {
-    for (let waited = 0; waited < REFRESH_LEASE_MS; waited += REFRESH_WAIT_MS) {
-        await new Promise((resolve) => setTimeout(resolve, REFRESH_WAIT_MS));
-        const credentials = await readMcpOAuthCredentials(ownerOptions(ownerEmail));
-        if (!credentials || !isBuilderCredential(credentials))
-            return null;
-        if (typeof credentials.tokenExpiresAt !== "number" ||
-            credentials.tokenExpiresAt - Date.now() <= REFRESH_SKEW_MS) {
-            continue;
-        }
-        return sessionFrom(credentials);
-    }
-    return null;
+    return { ...session, ownerEmail: input.ownerEmail.trim().toLowerCase() };
 }
 export async function deleteBuilderOAuthSession(ownerEmail) {
-    const options = ownerOptions(ownerEmail);
+    const options = await resolveOwnerOptions(ownerEmail);
+    if (!options)
+        return { localDeleted: false, remoteRevoked: false };
     const result = await revokeMcpOAuthCredentials(options);
-    await putSetting(reconnectKey(ownerEmail), {
-        required: false,
-        at: Date.now(),
-    }).catch(() => {
-        // coercion-ok: reconnect flag clear is best-effort after local revoke.
-    });
     return {
         localDeleted: result.local === "deleted",
         remoteRevoked: result.remote === "succeeded",

package/dist/server/core-routes-plugin.d.ts

@@ -305,6 +305,35 @@ export declare function readLegacyCoreRouteInitSettings(readSetting?: CoreRouteS
  */
 export declare function shouldRunCoreRouteBootDatabaseWork(env?: NodeJS.ProcessEnv): boolean;
 export declare function ensureS3FileUploadProvider(): void;
+export interface OAuthCustodyBuilderKeyStatus {
+    privateKeyConfigured: boolean;
+    publicKeyConfigured: boolean;
+    orgName: string;
+    /**
+     * True when the key-pair lookup itself failed (credential store
+     * unreadable, org lookup error, a thrown import) rather than confirming
+     * no keys exist. privateKeyConfigured/publicKeyConfigured stay `false` in
+     * both cases — this is the only signal that tells "never configured"
+     * apart from "couldn't check right now", so a transient store blip can't
+     * read downstream as "the user never connected Builder keys".
+     */
+    keyLookupFailed: boolean;
+}
+/**
+ * Resolves the classic Builder key-pair status for a request that already
+ * has Builder MCP OAuth custody (the connection-status handler's `configured`
+ * is already `true` by the time this runs — OAuth alone proves the chat
+ * gateway). Exported so the connection-status route's OAuth-custody branch is
+ * unit-testable without standing up the full plugin.
+ */
+export declare function resolveOAuthCustodyBuilderKeyStatus(dependencies?: {
+    resolveCredentialsDetailed: () => Promise<{
+        privateKey: string | null;
+        publicKey: string | null;
+        orgName: string | null;
+        lookupFailed: boolean;
+    }>;
+}): Promise<OAuthCustodyBuilderKeyStatus>;
 export declare function createCoreRoutesPlugin(options?: CoreRoutesPluginOptions): NitroPluginDef;
 /**
  * Default core routes plugin — mount with no configuration needed.

package/dist/server/core-routes-plugin.js

@@ -222,6 +222,33 @@ async function resolveAgentEngineStatusIdentity(event) {
         return { userEmail, orgId: undefined };
     }
 }
+/**
+ * A Builder grant is shared by everyone in the caller's org, so establishing,
+ * overwriting, or revoking one requires org owner/admin authority. Returns the
+ * authorized org id and a denial message (null when allowed). The org id is
+ * captured at connect start so the grant is stored under the org that was
+ * authorized, not one re-resolved after the OAuth round trip. Fails closed: an
+ * unreadable owner/admin role is denied.
+ */
+async function resolveBuilderOrgMutation(event) {
+    let orgId = null;
+    let role = null;
+    try {
+        const orgCtx = await getOrgContext(event);
+        orgId = orgCtx.orgId ?? null;
+        role = orgCtx.role ?? null;
+    }
+    catch {
+        // coercion-ok: org is missing, it will fail closed
+    }
+    if (role !== "owner" && role !== "admin") {
+        return {
+            orgId,
+            deny: "Only an organization owner or admin can change the shared Builder connection.",
+        };
+    }
+    return { orgId, deny: null };
+}
 export function getFrameworkEnvKeys() {
     return [
         { key: "ENABLE_BUILDER", label: "Enable Builder.io features" },
@@ -927,6 +954,43 @@ export function ensureS3FileUploadProvider() {
     }
     registerFileUploadProvider(s3FileUploadProvider);
 }
+/**
+ * Resolves the classic Builder key-pair status for a request that already
+ * has Builder MCP OAuth custody (the connection-status handler's `configured`
+ * is already `true` by the time this runs — OAuth alone proves the chat
+ * gateway). Exported so the connection-status route's OAuth-custody branch is
+ * unit-testable without standing up the full plugin.
+ */
+export async function resolveOAuthCustodyBuilderKeyStatus(dependencies = {
+    resolveCredentialsDetailed: async () => {
+        const { resolveBuilderCredentialsDetailed } = await import("./credential-provider.js");
+        return resolveBuilderCredentialsDetailed();
+    },
+}) {
+    try {
+        const creds = await dependencies.resolveCredentialsDetailed();
+        return {
+            privateKeyConfigured: !!creds.privateKey,
+            publicKeyConfigured: !!creds.publicKey,
+            orgName: typeof creds.orgName === "string" && creds.orgName
+                ? creds.orgName
+                : "Builder OAuth",
+            keyLookupFailed: creds.lookupFailed,
+        };
+    }
+    catch {
+        // OAuth already proves the chat gateway, so a thrown key-pair lookup
+        // here must not abort the response — but it is unreadable, not
+        // confirmed-absent, so keyLookupFailed has to say so (see the field doc
+        // above) instead of silently landing on the same `false`s as a real miss.
+        return {
+            privateKeyConfigured: false,
+            publicKeyConfigured: false,
+            orgName: "Builder OAuth",
+            keyLookupFailed: true,
+        };
+    }
+}
 export function createCoreRoutesPlugin(options = {}) {
     return async (nitroApp) => {
         markDefaultPluginProvided(nitroApp, "core-routes");
@@ -1143,7 +1207,12 @@ export function createCoreRoutesPlugin(options = {}) {
             }
             for (const provider of [
                 "figma",
+                "gmail",
+                "google_calendar",
+                "google_docs",
                 "google_drive",
+                "google_sheets",
+                "google_slides",
                 "github",
                 "hubspot",
                 "salesforce",
@@ -1562,29 +1631,15 @@ export function createCoreRoutesPlugin(options = {}) {
                             }
                         }
                         if (oauthAccess) {
-                            let privateKeyConfigured = false;
-                            let publicKeyConfigured = false;
-                            let orgName = "Builder OAuth";
-                            try {
-                                const { resolveBuilderCredentials } = await import("./credential-provider.js");
-                                const creds = await resolveBuilderCredentials();
-                                privateKeyConfigured = !!creds.privateKey;
-                                publicKeyConfigured = !!creds.publicKey;
-                                if (typeof creds.orgName === "string" && creds.orgName) {
-                                    orgName = creds.orgName;
-                                }
-                            }
-                            catch {
-                                // coercion-ok: OAuth already proves the chat gateway; missing
-                                // key flags only hide code-change send until secrets are readable.
-                            }
+                            const keyStatus = await resolveOAuthCustodyBuilderKeyStatus();
                             return withConnectToken({
                                 ...requestStatus,
                                 configured: true,
                                 credentialSource: "user",
-                                privateKeyConfigured,
-                                publicKeyConfigured,
-                                orgName,
+                                privateKeyConfigured: keyStatus.privateKeyConfigured,
+                                publicKeyConfigured: keyStatus.publicKeyConfigured,
+                                keyLookupFailed: keyStatus.keyLookupFailed,
+                                orgName: keyStatus.orgName,
                                 spaces: [],
                             });
                         }
@@ -1870,6 +1925,21 @@ export function createCoreRoutesPlugin(options = {}) {
                         parentOrigin: getBuilderBrowserOriginForEvent(event),
                     });
                 }
+                const { orgId: connectOrgId, deny: orgConnectDenied } = await resolveBuilderOrgMutation(event);
+                if (orgConnectDenied) {
+                    await trackBuilderLifecycle(event, "builder connect failed", ownerEmail, {
+                        ...builderConnectTrackingProperties(connectTracking),
+                        reason: "org_authorization_required",
+                        stage: "connect",
+                    });
+                    setResponseStatus(event, 403);
+                    setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+                    return createBuilderBrowserCallbackErrorPage(orgConnectDenied, {
+                        title: "Not allowed to connect Builder for this organization",
+                        body: "Ask an organization owner or admin to connect Builder.",
+                        parentOrigin: getBuilderBrowserOriginForEvent(event),
+                    });
+                }
                 const state = createBuilderConnectState();
                 // The standard OAuth client discovers Builder's protected-resource
                 // metadata, dynamically registers, and creates its S256 verifier.
@@ -1886,7 +1956,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     authorizationUrl = started.authorizationUrl;
                     await putSetting(`builder-connect-pending:${state}`, {
                         ownerEmail,
-                        orgId: null,
+                        orgId: connectOrgId,
                         role: null,
                         encryptedOAuthFlow: encryptSecretValue(JSON.stringify(oauthFlow)),
                         redirectUri: callbackUrl,
@@ -2242,6 +2312,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     const oauthFlow = JSON.parse(decryptSecretValue(encryptedOAuthFlow));
                     await finishBuilderOAuthAuthorization({
                         ownerEmail,
+                        orgId: typeof consumed.orgId === "string" ? consumed.orgId : undefined,
                         code,
                         iss,
                         pending: oauthFlow,
@@ -2283,6 +2354,15 @@ export function createCoreRoutesPlugin(options = {}) {
                 }
                 try {
                     const hadOAuth = await hasBuilderOAuthSession(session.email);
+                    // Revoking an org-scoped grant takes the connection offline for
+                    // every member, so require org owner/admin before doing so.
+                    if (hadOAuth) {
+                        const { deny } = await resolveBuilderOrgMutation(event);
+                        if (deny) {
+                            setResponseStatus(event, 403);
+                            return { error: deny };
+                        }
+                    }
                     const oauthResult = hadOAuth
                         ? await deleteBuilderOAuthSession(session.email)
                         : { localDeleted: false, remoteRevoked: false };

package/dist/server/default-plugins.d.ts

@@ -0,0 +1,18 @@
+import type { DefaultPluginSlot } from "../app-config/plugins.js";
+/**
+ * Which default plugin slots this deployment refuses, from `plugins.disabled`.
+ *
+ * Read on every call rather than captured once: `getAppConfig()` already caches
+ * the parse and drops that cache when the environment layer changes, and the
+ * auto-mount decision runs before some apps have called `defineAppConfig()`, so
+ * a module-level snapshot would freeze an empty list for the process.
+ */
+export declare function getDisabledDefaultPlugins(): readonly DefaultPluginSlot[];
+/**
+ * Whether the framework should withhold its default implementation of `slot`.
+ *
+ * Only the framework's own defaults are gated. An app that ships
+ * `server/plugins/<slot>.ts` mounted its plugin deliberately, and this switch
+ * does not reach in and unmount it.
+ */
+export declare function isDefaultPluginDisabled(slot: string): boolean;

package/dist/server/default-plugins.js

@@ -0,0 +1,22 @@
+import { getAppConfig } from "../app-config/index.js";
+/**
+ * Which default plugin slots this deployment refuses, from `plugins.disabled`.
+ *
+ * Read on every call rather than captured once: `getAppConfig()` already caches
+ * the parse and drops that cache when the environment layer changes, and the
+ * auto-mount decision runs before some apps have called `defineAppConfig()`, so
+ * a module-level snapshot would freeze an empty list for the process.
+ */
+export function getDisabledDefaultPlugins() {
+    return getAppConfig().plugins.disabled;
+}
+/**
+ * Whether the framework should withhold its default implementation of `slot`.
+ *
+ * Only the framework's own defaults are gated. An app that ships
+ * `server/plugins/<slot>.ts` mounted its plugin deliberately, and this switch
+ * does not reach in and unmount it.
+ */
+export function isDefaultPluginDisabled(slot) {
+    return getDisabledDefaultPlugins().includes(slot);
+}

package/dist/server/edge.d.ts

@@ -1,4 +1,5 @@
 export { createAuthPlugin, defaultAuthPlugin } from "./auth-plugin.js";
+export { getDisabledDefaultPlugins, isDefaultPluginDisabled, } from "./default-plugins.js";
 export { BETTER_AUTH_MIGRATIONS, runBetterAuthMigrations, } from "./better-auth-migrations.js";
 export { runFrameworkReleaseMigrations } from "./release-migrations.js";
 export { createAgentChatPlugin, defaultAgentChatPlugin, refreshGlobalMcpManager, type AgentChatPluginOptions, } from "./agent-chat-plugin.js";

package/dist/server/edge.js

@@ -1,4 +1,5 @@
 export { createAuthPlugin, defaultAuthPlugin } from "./auth-plugin.js";
+export { getDisabledDefaultPlugins, isDefaultPluginDisabled, } from "./default-plugins.js";
 export { BETTER_AUTH_MIGRATIONS, runBetterAuthMigrations, } from "./better-auth-migrations.js";
 export { runFrameworkReleaseMigrations } from "./release-migrations.js";
 export { createAgentChatPlugin, defaultAgentChatPlugin, refreshGlobalMcpManager, } from "./agent-chat-plugin.js";

package/dist/server/framework-request-handler.js

@@ -1,10 +1,12 @@
 import { setResponseHeader, setResponseStatus } from "h3";
+import { AppConfigurationError } from "../app-config/index.js";
 import { getMissingDefaultPlugins } from "../deploy/route-discovery.js";
 import { MCP_PUBLIC_ROUTE_PREFIX } from "../mcp/route-paths.js";
 import { SIGN_IN_ENTRY_PATH, SIGN_IN_LEGACY_ENTRY_PATH, } from "../shared/sign-in-journey.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { captureError } from "./capture-error.js";
 import { createCsrfMiddleware } from "./csrf.js";
+import { getDisabledDefaultPlugins } from "./default-plugins.js";
 import { installHttpResponseTelemetryHooks, recordFrameworkReadyWait, } from "./http-response-telemetry.js";
 import { hasRequestContext, markRequestBoundaryInstalled, runWithRequestContext, } from "./request-context.js";
 const BOOTSTRAPPED = new WeakSet();
@@ -127,13 +129,28 @@ export function getH3App(nitroApp) {
     nitroApp[APP_SHIM_KEY] = shim;
     if (!BOOTSTRAPPED.has(nitroApp)) {
         BOOTSTRAPPED.add(nitroApp);
-        nitroApp[BOOTSTRAP_PROMISE_KEY] = bootstrapDefaultPlugins(nitroApp).catch((err) => {
+        // Parse now, decide later. An unknown slot name in `plugins.disabled` is
+        // an invalid deployment, not a plugin that failed to start, and the catch
+        // below would turn it into an app with every default route missing — so
+        // the value has to be read where it can still throw synchronously. The
+        // mount set is read again inside bootstrap: auto-mount can start before a
+        // server plugin has called `defineAppConfig()`, and this early read only
+        // sees the environment layer.
+        getDisabledDefaultPlugins();
+        const bootstrap = bootstrapDefaultPlugins(nitroApp).catch((err) => {
             console.warn("[agent-native] Failed to auto-mount default plugins:", err.message);
             captureError(err, {
                 route: "default-plugin-bootstrap",
                 tags: { phase: "default-plugin-bootstrap" },
             });
+            if (err instanceof AppConfigurationError)
+                throw err;
         });
+        // The readiness gate is what observes this rejection, and it only runs on
+        // a request. Without a handler attached now, Node exits on the unhandled
+        // rejection before anything can report the configuration error.
+        bootstrap.catch(() => { });
+        nitroApp[BOOTSTRAP_PROMISE_KEY] = bootstrap;
         // Readiness gate: Nitro v3 doesn't await async plugins, so routes
         // registered inside an async plugin may not exist when the first
         // request arrives. These middleware entries hold framework routes
@@ -688,9 +705,12 @@ async function bootstrapDefaultPlugins(nitroApp) {
         const cwd = process.cwd();
         const discoveredMissing = await getMissingDefaultPlugins(cwd);
         const provided = nitroApp[PROVIDED_PLUGIN_STEMS_KEY];
-        const missing = provided
+        const undiscovered = provided
             ? discoveredMissing.filter((stem) => !provided.has(stem))
             : discoveredMissing;
+        const disabled = getDisabledDefaultPlugins();
+        const missing = undiscovered.filter((stem) => !disabled.includes(stem));
+        const refused = undiscovered.filter((stem) => disabled.includes(stem));
         if (missing.length === 0)
             return;
         // Lazy import to avoid circular dependency at module load time
@@ -760,7 +780,10 @@ async function bootstrapDefaultPlugins(nitroApp) {
             // runtime without fs). Silently fall through to framework defaults.
         }
         if (process.env.DEBUG)
-            console.log(`[agent-native] Auto-mounting ${missing.length} default plugin(s): ${missing.join(", ")}`);
+            console.log(`[agent-native] Auto-mounting ${missing.length} default plugin(s): ${missing.join(", ")}` +
+                (refused.length > 0
+                    ? ` (refused by plugins.disabled: ${refused.join(", ")})`
+                    : ""));
         for (const stem of missing) {
             // Prefer workspace-core impl over framework default when both exist.
             const impl = workspaceImpls[stem] ?? frameworkImpls[stem];
@@ -774,6 +797,11 @@ async function bootstrapDefaultPlugins(nitroApp) {
                         route: "default-plugin-bootstrap",
                         tags: { phase: "default-plugin-bootstrap", plugin: stem },
                     });
+                    // A plugin that cannot start is optional; a plugin the deployment
+                    // configured wrongly is not. Skipping it leaves the operator with
+                    // routes that 404 and a deployment that reported success.
+                    if (e instanceof AppConfigurationError)
+                        throw e;
                 }
             }
         }