@agent-native/core 0.170.0 → 0.171.0

package/dist/app-config/auth.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
 export declare const authConfig: z.ZodObject<{
     disableDesktopSsoFallbackInDevelopment: z.ZodDefault<z.ZodBoolean>;
+    requireEmailVerification: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;

package/dist/app-config/auth.js

@@ -4,4 +4,11 @@ export const authConfig = z.object({
         env: "AGENT_NATIVE_DISABLE_DESKTOP_SSO_FALLBACK",
         doc: "Disable the loopback Desktop SSO fallback in development so isolated acceptance runs can use their configured local identity. Ignored in production.",
     }),
+    // Deliberately optional rather than defaulted: unset means "derive from the
+    // deployment", which is not a boolean. A default here would erase the
+    // difference between an operator who chose a policy and one who never spoke.
+    requireEmailVerification: z.boolean().optional().meta({
+        env: "AUTH_REQUIRE_EMAIL_VERIFICATION",
+        doc: "Whether password signup must verify the email address before it gets a session. Unset derives it: hosted deployments require it, local development skips it. Setting it false accepts an unverified email as a login credential, including in production.",
+    }),
 });

package/dist/app-config/schema.d.ts

@@ -38,6 +38,7 @@ export declare const appConfigSchema: z.ZodObject<{
     }, z.core.$strip>>;
     auth: z.ZodPrefault<z.ZodObject<{
         disableDesktopSsoFallbackInDevelopment: z.ZodDefault<z.ZodBoolean>;
+        requireEmailVerification: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     integrations: z.ZodPrefault<z.ZodObject<{
         allowUnverifiedWebhooks: z.ZodDefault<z.ZodBoolean>;

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
+    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
 }>;
 export default _default;

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
+    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,9 +59,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;

package/dist/resources/handlers.d.ts

@@ -51,8 +51,8 @@ export declare function handleDeleteResource(event: any): Promise<{
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,10 +73,10 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
-    error?: undefined;
     url: string;
     provider: string;
     storageSetupRequired?: undefined;
+    error?: undefined;
 } | {
     error: string;
     storageSetupRequired: boolean;

package/dist/server/better-auth-instance.js

@@ -14,6 +14,7 @@ import { jwt } from "better-auth/plugins/jwt";
 import { magicLink } from "better-auth/plugins/magic-link";
 import { pgTable, text as pgText, timestamp as pgTimestamp, boolean as pgBoolean, } from "drizzle-orm/pg-core";
 import { sqliteTable, text as sqliteText, integer as sqliteInteger, } from "drizzle-orm/sqlite-core";
+import { getAppConfig } from "../app-config/index.js";
 import { TEMPLATES } from "../cli/templates-meta.js";
 import { getDbExec, isPostgres } from "../db/client.js";
 import { getDialect, getCloudflareD1Binding, getDatabaseUrl, getDatabaseAuthToken, closePgliteClients, getPgliteClient, isPgliteUrl, loadPgliteDrizzle, pgPoolOptions, neonPoolOptions, guardNeonPool, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, prepareLocalSqliteUrl, sqliteFilenameFromUrl, retrySqliteBusy, } from "../db/client.js";
@@ -266,6 +267,19 @@ export function isDeployPreview() {
     return deployContext === "deploy-preview";
 }
 export function resolveEmailPasswordAuthPolicy(emailConfigured) {
+    const declared = getAppConfig().auth.requireEmailVerification;
+    if (declared !== undefined) {
+        // A declared policy is the whole policy — it outranks both the hosted
+        // derivation below and AUTH_SKIP_EMAIL_VERIFICATION. Choosing `false` is
+        // choosing to accept an unverified email as a login credential, so the
+        // signup lock that exists to prevent exactly that comes off with it.
+        return {
+            requireEmailVerification: declared && emailConfigured,
+            // Verification that no provider can deliver would strand every new
+            // account on an unverifiable signup, so refuse the signup instead.
+            disableSignUp: declared && !emailConfigured,
+        };
+    }
     const hosted = process.env.NODE_ENV === "production" || isDeployPreview();
     return {
         requireEmailVerification: emailConfigured && (hosted || !shouldSkipEmailVerification()),

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;

package/dist/vite/client.js

@@ -2924,6 +2924,13 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
     const forcePollingWatch = process.env.CHOKIDAR_USEPOLLING === "1";
     const pollingWatchInterval = Number(process.env.CHOKIDAR_INTERVAL ?? 1000);
     const userWatch = userConfig.server?.watch ?? {};
+    // Vite 8 defines `rollupOptions` on `build`/`optimizeDeps` as a getter alias
+    // of `rolldownOptions`. Spreading the section copies the alias as a plain own
+    // property, so returning our own `rolldownOptions` alongside it makes the two
+    // diverge and Vite warns that this plugin set both — then ignores the
+    // `rollupOptions` half regardless. Drop the alias from what we spread back.
+    const { rollupOptions: _buildRollupOptionsAlias, ...userBuild } = userConfig.build ?? {};
+    const { rollupOptions: _depsRollupOptionsAlias, ...userOptimizeDeps } = userConfig.optimizeDeps ?? {};
     return {
         logLevel: options.logLevel ??
             userConfig.logLevel ??
@@ -3013,7 +3020,7 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
             },
         },
         build: {
-            ...(userConfig.build ?? {}),
+            ...userBuild,
             outDir: options.outDir ?? userConfig.build?.outDir ?? "dist/spa",
             // Vite 8 defaults CSS minification to Lightning CSS, which collapses a
             // `backdrop-filter` + `-webkit-backdrop-filter` pair down to only the
@@ -3096,7 +3103,7 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
                 ],
             },
         optimizeDeps: {
-            ...(userConfig.optimizeDeps ?? {}),
+            ...userOptimizeDeps,
             include: [
                 ...getDefaultOptimizeDeps(cwd),
                 ...(hasDep("@agent-native/pinpoint", cwd)

package/docs/content/authentication.mdx

@@ -210,6 +210,24 @@ verification and the signup verification email is not sent. It does not change
 magic-link delivery. Use it only for QA or preview environments, and name test accounts with a `+qa` address
 (`name+qa@example.com`) so they are easy to identify.
 
+## Email Verification Policy {#email-verification-policy}
+
+`AUTH_SKIP_EMAIL_VERIFICATION` is a local and QA convenience — a hosted
+deployment ignores it. To state the policy for any environment, production
+included, declare it in config:
+
+```ts
+defineAppConfig({ auth: { requireEmailVerification: false } });
+```
+
+The deployment alias is `AUTH_REQUIRE_EMAIL_VERIFICATION=0`. A declared value
+outranks both `AUTH_SKIP_EMAIL_VERIFICATION` and the per-environment default.
+
+`false` accepts an unverified address as a login credential — anyone can claim
+any email — so use it only where signup is already restricted another way.
+`true` on a deployment with no email provider disables password signup instead,
+because the verification could never be delivered.
+
 ## Social Providers {#social-providers}
 
 Set environment variables to enable social login. Better Auth auto-detects them:
@@ -477,27 +495,28 @@ The default `/_agent-native/google/auth-url` route does this automatically — o
 
 ## Environment Variables {#environment-variables}
 
-| Variable                                | Purpose                                                                                                                                      |
-| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
-| `BETTER_AUTH_SECRET`                    | Signing key for Better Auth (auto-generated if not set)                                                                                      |
-| `AUTH_SKIP_EMAIL_VERIFICATION`          | Set to `1` in QA/preview environments to let password-fallback signups proceed without verification; local dev/test skips by default         |
-| `AUTH_MAGIC_LINK`                       | Set to `0`, `false`, or `off` to force the email/password fallback even when outbound email is ready                                         |
-| `AUTH_DISABLED`                         | Set to `true` or `1` to skip login/signup; all requests run as one shared user (local dev/preview only — not for production with real users) |
-| `AGENT_NATIVE_DISABLE_AUTO_DEV_ACCOUNT` | Set to `1` to disable localhost auto-sign-in on a fresh dev database                                                                         |
-| `AUTH_MODE`                             | `local` resolves CLI/agent identity only (which dev user `pnpm action` runs as); never a browser login bypass                                |
-| `COOKIE_DOMAIN`                         | Opt into shared session cookies across same-database subdomains (see [Cookie Realms](#cookie-realms))                                        |
-| `AGENT_NATIVE_WORKSPACE`                | `1` runs in workspace mode — one shared session realm across workspace apps                                                                  |
-| `AGENT_NATIVE_SHARE_COOKIE_DOMAIN`      | Set with `COOKIE_DOMAIN` to share one auth database across first-party subdomains                                                            |
-| `OAUTH_STATE_SECRET`                    | Dedicated HMAC key for OAuth state envelopes (see [Security — OAuth State Signing](/docs/security#oauth-state))                              |
-| `GOOGLE_SIGN_IN_CLIENT_ID`              | Preferred low-scope Google OAuth client ID for app login                                                                                     |
-| `GOOGLE_SIGN_IN_CLIENT_SECRET`          | Preferred low-scope Google OAuth secret for app login                                                                                        |
-| `GOOGLE_CLIENT_ID`                      | Legacy Google login fallback, and provider OAuth client ID for Google API integrations                                                       |
-| `GOOGLE_CLIENT_SECRET`                  | Legacy Google login fallback, and provider OAuth secret for Google API integrations                                                          |
-| `GITHUB_CLIENT_ID`                      | Enable GitHub OAuth                                                                                                                          |
-| `GITHUB_CLIENT_SECRET`                  | GitHub OAuth secret                                                                                                                          |
-| `ACCESS_TOKEN`                          | Static bearer fallback for MCP/connect clients; not browser auth                                                                             |
-| `ACCESS_TOKENS`                         | Comma-separated static bearer fallbacks for MCP/connect clients; not browser auth                                                            |
-| `A2A_SECRET`                            | Shared secret for JWT-signed A2A cross-app identity verification and, when present, MCP OAuth access-token signing                           |
+| Variable                                | Purpose                                                                                                                                                |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `BETTER_AUTH_SECRET`                    | Signing key for Better Auth (auto-generated if not set)                                                                                                |
+| `AUTH_SKIP_EMAIL_VERIFICATION`          | Set to `1` in QA/preview environments to let password-fallback signups proceed without verification; local dev/test skips by default                   |
+| `AUTH_REQUIRE_EMAIL_VERIFICATION`       | Set to `0` or `1` to declare the password-signup verification policy for any environment, production included; outranks `AUTH_SKIP_EMAIL_VERIFICATION` |
+| `AUTH_MAGIC_LINK`                       | Set to `0`, `false`, or `off` to force the email/password fallback even when outbound email is ready                                                   |
+| `AUTH_DISABLED`                         | Set to `true` or `1` to skip login/signup; all requests run as one shared user (local dev/preview only — not for production with real users)           |
+| `AGENT_NATIVE_DISABLE_AUTO_DEV_ACCOUNT` | Set to `1` to disable localhost auto-sign-in on a fresh dev database                                                                                   |
+| `AUTH_MODE`                             | `local` resolves CLI/agent identity only (which dev user `pnpm action` runs as); never a browser login bypass                                          |
+| `COOKIE_DOMAIN`                         | Opt into shared session cookies across same-database subdomains (see [Cookie Realms](#cookie-realms))                                                  |
+| `AGENT_NATIVE_WORKSPACE`                | `1` runs in workspace mode — one shared session realm across workspace apps                                                                            |
+| `AGENT_NATIVE_SHARE_COOKIE_DOMAIN`      | Set with `COOKIE_DOMAIN` to share one auth database across first-party subdomains                                                                      |
+| `OAUTH_STATE_SECRET`                    | Dedicated HMAC key for OAuth state envelopes (see [Security — OAuth State Signing](/docs/security#oauth-state))                                        |
+| `GOOGLE_SIGN_IN_CLIENT_ID`              | Preferred low-scope Google OAuth client ID for app login                                                                                               |
+| `GOOGLE_SIGN_IN_CLIENT_SECRET`          | Preferred low-scope Google OAuth secret for app login                                                                                                  |
+| `GOOGLE_CLIENT_ID`                      | Legacy Google login fallback, and provider OAuth client ID for Google API integrations                                                                 |
+| `GOOGLE_CLIENT_SECRET`                  | Legacy Google login fallback, and provider OAuth secret for Google API integrations                                                                    |
+| `GITHUB_CLIENT_ID`                      | Enable GitHub OAuth                                                                                                                                    |
+| `GITHUB_CLIENT_SECRET`                  | GitHub OAuth secret                                                                                                                                    |
+| `ACCESS_TOKEN`                          | Static bearer fallback for MCP/connect clients; not browser auth                                                                                       |
+| `ACCESS_TOKENS`                         | Comma-separated static bearer fallbacks for MCP/connect clients; not browser auth                                                                      |
+| `A2A_SECRET`                            | Shared secret for JWT-signed A2A cross-app identity verification and, when present, MCP OAuth access-token signing                                     |
 
 ## What's next
 

package/docs/content/environment-variables.mdx

@@ -87,6 +87,7 @@ public app behavior, use the config paths above instead.
 | `AUTH_DISABLED`                                | Disables auth for local or preview-only work. Unset already means false.                                                                                                | `true` or `1`; never use on a public production app.                                                                    |
 | `AUTH_MAGIC_LINK`                              | Controls the password-first versus magic-link sign-in path.                                                                                                             | `0` keeps password-first sign-in; otherwise a configured email transport can enable magic links.                        |
 | `AUTH_SKIP_EMAIL_VERIFICATION`                 | Skips signup email verification for local QA or previews.                                                                                                               | `1`; never use it to weaken production auth.                                                                            |
+| `AUTH_REQUIRE_EMAIL_VERIFICATION`              | Declares whether password signup must verify the email address, in any environment.                                                                                     | `0` or `1`; outranks `AUTH_SKIP_EMAIL_VERIFICATION`. `0` accepts an unverified address as a login credential.           |
 | `ACCESS_TOKEN` / `ACCESS_TOKENS`               | Static bearer fallback for MCP and Connect clients.                                                                                                                     | One token or a delimited token list; these are not browser auth.                                                        |
 | `AGENT_PROD_CODE_EXECUTION`                    | Production code-execution policy.                                                                                                                                       | `off`, `sandboxed`, or `trusted`. See [Production Code Execution](/docs/actions-agent-tools#production-code-execution). |
 | `AGENT_NATIVE_SSR_CACHE`                       | Deployment-wide public SSR shell cache policy.                                                                                                                          | Unset/`on`, `off`, or a duration such as `30s` or `5m`. See [SSR Caching](/docs/ssr-caching).                           |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.170.0",
+  "version": "0.171.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {