@agent-native/core 0.174.1 → 0.174.2-nightly-20260825204701

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 8614
+- template files: 8615

package/corpus/templates/forms/.agents/skills/form-building/SKILL.md

@@ -68,6 +68,10 @@ Each field is a JSON object:
 - `label` — display label
 - `required` — boolean
 
+Always pass fields as these complete objects. Never encode a field as shorthand
+text such as `text: Enter a name`; `patch-form-fields` upserts also require the
+field `id` so they cannot be ambiguous.
+
 ### Optional properties
 - `placeholder` — input placeholder text
 - `description` — help text below the field

package/corpus/templates/forms/actions/create-form.ts

@@ -49,7 +49,9 @@ export default defineAction({
     fields: z
       .union([z.string(), z.array(z.any())])
       .optional()
-      .describe("Array of form fields (or JSON string of the same)"),
+      .describe(
+        "Array of complete field objects with id, type, label, and required (or JSON string of the same); never use shorthand strings such as 'text: Enter a name'.",
+      ),
     settings: z
       .union([z.string(), z.record(z.string(), z.any())])
       .optional()

package/corpus/templates/forms/actions/patch-form-fields.ts

@@ -24,7 +24,10 @@ import { z } from "zod";
 import { getDb, schema } from "../server/db/index.js";
 import { applyFieldOps } from "../server/lib/merge-fields.js";
 import { invalidatePublicFormCache } from "../server/lib/public-form-ssr.js";
-import { assertValidFields } from "../server/lib/validate-fields.js";
+import {
+  assertValidFields,
+  normalizePersistedFields,
+} from "../server/lib/validate-fields.js";
 import type { FormField } from "../shared/types.js";
 import { assertPublishableForm } from "./lib/assert-publishable-form.js";
 
@@ -61,7 +64,11 @@ export function withFormLock<T>(
 const fieldOpSchema = z.union([
   z.object({
     op: z.literal("upsert"),
-    field: z.record(z.string(), z.any()),
+    field: z
+      .record(z.string(), z.any())
+      .describe(
+        "Complete field object with id, type, label, and required; never use shorthand strings.",
+      ),
   }),
   z.object({
     op: z.literal("remove"),
@@ -117,7 +124,9 @@ export default defineAction({
       // Parse current fields from the DB row.
       let currentFields: FormField[] = [];
       try {
-        currentFields = JSON.parse(existing.fields) as FormField[];
+        currentFields = normalizePersistedFields(
+          JSON.parse(existing.fields),
+        ) as FormField[];
       } catch {
         currentFields = [];
       }

package/corpus/templates/forms/actions/update-form.ts

@@ -35,7 +35,9 @@ export default defineAction({
     fields: z
       .union([z.string(), z.array(z.any())])
       .optional()
-      .describe("Array of form fields (or JSON string of the same)"),
+      .describe(
+        "Array of complete field objects with id, type, label, and required (or JSON string of the same); never use shorthand strings such as 'text: Enter a name'.",
+      ),
     settings: z
       .union([z.string(), z.record(z.string(), z.any())])
       .optional()

package/corpus/templates/forms/changelog/2026-08-25-forms-agents-retry-invalid-field-edits.md

@@ -0,0 +1,5 @@
+---
+type: fixed
+date: 2026-08-25
+---
+Forms agents now retry rejected field edits with valid field objects.

package/corpus/templates/forms/server/lib/validate-fields.ts

@@ -4,6 +4,19 @@
 // runtime — an unrestricted id like `x" onfocus="alert(1)` would otherwise
 // stored-XSS every anonymous submitter of a published form.
 export const FIELD_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+const FIELD_TYPES = new Set([
+  "text",
+  "email",
+  "number",
+  "textarea",
+  "select",
+  "multiselect",
+  "checkbox",
+  "radio",
+  "date",
+  "rating",
+  "scale",
+]);
 const CONDITIONAL_OPERATORS = new Set(["equals", "not_equals", "contains"]);
 
 /**
@@ -49,6 +62,28 @@ export function normalizeFieldIds(fields: unknown): unknown {
   });
 }
 
+/**
+ * Keeps granular edits compatible with fields written before the current
+ * schema. The UI already renders unknown types as text and treats a missing
+ * required flag as false, so patch reads must make the same repair before the
+ * strict persistence check runs.
+ */
+export function normalizePersistedFields(fields: unknown): unknown {
+  if (!Array.isArray(fields)) return fields;
+  return fields.map((field) => {
+    if (field == null || typeof field !== "object" || Array.isArray(field)) {
+      return field;
+    }
+    const f = field as Record<string, unknown>;
+    return {
+      ...f,
+      type:
+        typeof f.type === "string" && FIELD_TYPES.has(f.type) ? f.type : "text",
+      required: f.required === undefined ? false : f.required,
+    };
+  });
+}
+
 export function assertValidFields(fields: unknown): void {
   if (!Array.isArray(fields)) {
     throw new Error("fields must be an array");
@@ -71,6 +106,18 @@ export function assertValidFields(fields: unknown): void {
     }
     seenIds.add(id);
 
+    if (typeof f.type !== "string" || !FIELD_TYPES.has(f.type)) {
+      throw new Error(
+        `field #${idx + 1} has an invalid type ${JSON.stringify(f.type)}`,
+      );
+    }
+    if (typeof f.label !== "string") {
+      throw new Error(`field #${idx + 1} label must be a string`);
+    }
+    if (typeof f.required !== "boolean") {
+      throw new Error(`field #${idx + 1} required must be a boolean`);
+    }
+
     const cond = f.conditional;
     if (cond !== undefined) {
       if (cond == null || typeof cond !== "object") {

package/corpus/templates/forms/server/plugins/agent-chat.ts

@@ -11,6 +11,7 @@ export const FORMS_SYSTEM_PROMPT = `## Agent-Native Forms
 You are the in-app agent for Agent-Native Forms, a chat-first form builder and response workspace. Help users create, edit, publish, share, and analyze forms through the registered actions. The actions are the source of truth for database access, validation, permissions, UI sync, and business logic.
 
 Core rules:
+- Build every field as a complete object with id, type, label, and required; never send shorthand strings such as "text: Enter a name". If a form or field action rejects its payload, correct the arguments and retry in the same turn, then verify the saved fields. If a draft was created before the failure, repair that draft instead of explaining the fix and stopping.
 - Use Forms actions instead of raw database access. Raw database tools are not available in this app.
 - Never hardcode API keys, tokens, webhook URLs, signing secrets, customer data, or credential-looking literals. Use placeholders or configured integrations.
 - Inspect the current state when it matters. Use \`view-screen\` when the active form, selected field, publish state, response table, or current route is unclear.

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,9 +59,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -34,10 +34,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/onboarding-html.js

@@ -2593,7 +2593,10 @@ ${signInJourneyInlineScript()}
       }
     }
     function __anFinishOAuthExchange(ret, flowId, sessionToken) {
+      __anStopOAuthPopupWatch();
+      __anStopNativeOAuthAbandonment();
       __anGoogleSignInInFlight = false;
+      __anClearGoogleSignInFlow();
       __anMagicLinkInFlight = false;
       if (__anIsBuilderPreview()) {
         if (sessionToken) {
@@ -2863,8 +2866,18 @@ ${identitySsoScript}
       return __anIsAgentNativeDesktop() ? 'redirect' : 'popup';
     }
     var __anOAuthPollTimer = null;
+    var __anOAuthPopupWatchTimer = null;
+    var __anOAuthPopupCloseGraceTimer = null;
+    var __anOAuthPopupCloseGraceMs = 5000;
+    var __anNativeOAuthFlowId = null;
+    var __anNativeOAuthRequestPending = false;
+    var __anNativeOAuthReturnObserved = false;
+    var __anNativeOAuthAbandonGraceTimer = null;
+    var __anNativeOAuthAbandonGraceMs = 5000;
     var __anOAuthPollCount = 0;
     var __anGoogleSignInInFlight = false;
+    var __anGoogleSignInFlowId = null;
+    var __anGoogleSignInRecoveryFlowId = null;
     var __anMagicLinkInFlight = false;
     var __anGoogleRecoverBound = false;
     function __anNewOAuthFlowId() {
@@ -2921,8 +2934,139 @@ ${identitySsoScript}
         __anOAuthPollTimer = null;
       }
     }
+    function __anStopOAuthPopupWatch() {
+      if (__anOAuthPopupWatchTimer) {
+        clearInterval(__anOAuthPopupWatchTimer);
+        __anOAuthPopupWatchTimer = null;
+      }
+      if (__anOAuthPopupCloseGraceTimer) {
+        clearTimeout(__anOAuthPopupCloseGraceTimer);
+        __anOAuthPopupCloseGraceTimer = null;
+      }
+    }
+    function __anStopNativeOAuthAbandonment() {
+      __anCancelNativeOAuthAbandonment();
+      __anNativeOAuthFlowId = null;
+      __anNativeOAuthRequestPending = false;
+    }
+    function __anCancelNativeOAuthAbandonment() {
+      if (__anNativeOAuthAbandonGraceTimer) {
+        clearTimeout(__anNativeOAuthAbandonGraceTimer);
+        __anNativeOAuthAbandonGraceTimer = null;
+      }
+      __anNativeOAuthReturnObserved = false;
+    }
+    function __anBeginNativeOAuth(flowId) {
+      __anStopNativeOAuthAbandonment();
+      __anNativeOAuthFlowId = flowId;
+      __anNativeOAuthRequestPending = true;
+      __anNativeOAuthReturnObserved = false;
+    }
+    function __anMarkNativeOAuthPolling(flowId) {
+      if (__anNativeOAuthFlowId !== flowId) return;
+      __anNativeOAuthRequestPending = false;
+    }
+    function __anIsCurrentNativeOAuth(flowId) {
+      return __anNativeOAuthFlowId === flowId && __anIsCurrentGoogleSignInFlow(flowId);
+    }
+    function __anFinalizeNativeOAuthAbandonment(flowId) {
+      if (!__anIsCurrentNativeOAuth(flowId) || !__anOAuthPollTimer) return;
+      if (document.visibilityState === 'hidden') {
+        __anCancelNativeOAuthAbandonment();
+        return;
+      }
+      __anStopNativeOAuthAbandonment();
+      if (__anInvalidateGoogleSignInFlow(flowId)) {
+        __anStopOAuthExchangePolling();
+        __anRecoverGoogleSignInAfterReturn(flowId);
+      }
+    }
+    function __anScheduleNativeOAuthAbandonment(flowId) {
+      // Returning focus is the only signal that the system-browser ceremony was
+      // abandoned. Preserve the exchange poll briefly for a late deep-link.
+      if (
+        !__anIsCurrentNativeOAuth(flowId) ||
+        __anNativeOAuthRequestPending ||
+        !__anNativeOAuthReturnObserved ||
+        !__anOAuthPollTimer ||
+        __anNativeOAuthAbandonGraceTimer
+      ) return;
+      __anNativeOAuthAbandonGraceTimer = setTimeout(function() {
+        __anNativeOAuthAbandonGraceTimer = null;
+        __anFinalizeNativeOAuthAbandonment(flowId);
+      }, __anNativeOAuthAbandonGraceMs);
+    }
+    function __anBeginGoogleSignInFlow(flowId) {
+      __anGoogleSignInFlowId = flowId;
+      __anGoogleSignInRecoveryFlowId = null;
+      __anGoogleSignInInFlight = true;
+    }
+    function __anIsCurrentGoogleSignInFlow(flowId) {
+      return __anGoogleSignInInFlight && __anGoogleSignInFlowId === flowId;
+    }
+    function __anClearGoogleSignInFlow() {
+      __anGoogleSignInFlowId = null;
+      __anGoogleSignInRecoveryFlowId = null;
+    }
+    function __anInvalidateGoogleSignInFlow(flowId) {
+      if (!__anIsCurrentGoogleSignInFlow(flowId)) return false;
+      __anGoogleSignInFlowId = null;
+      __anGoogleSignInRecoveryFlowId = flowId;
+      return true;
+    }
+    function __anCanRecoverGoogleSignInFlow(flowId, expectedFlowId) {
+      // Focus can return while either the system-browser exchange or the popup
+      // exchange is still active. Let that exchange finish before recovering.
+      if (!flowId && (__anNativeOAuthFlowId || __anOAuthPollTimer || __anOAuthPopupWatchTimer)) return false;
+      if (flowId) {
+        return __anGoogleSignInInFlight &&
+          !__anGoogleSignInFlowId &&
+          __anGoogleSignInRecoveryFlowId === flowId;
+      }
+      return __anGoogleSignInInFlight && __anGoogleSignInFlowId === expectedFlowId;
+    }
+    function __anFinalizeOAuthPopupClose(flowId) {
+      if (!__anIsCurrentGoogleSignInFlow(flowId)) return;
+      __anOAuthPopupCloseGraceTimer = null;
+      if (__anInvalidateGoogleSignInFlow(flowId)) {
+        __anStopOAuthExchangePolling();
+        __anRecoverGoogleSignInAfterReturn(flowId);
+      }
+    }
+    function __anHandleOAuthPopupClosed(flowId) {
+      __anStopOAuthPopupWatch();
+      // The success callback closes its tab 250ms after staging the token, but
+      // the opener polls once per second. Let an active exchange win that race.
+      if (__anOAuthPollTimer) {
+        __anOAuthPopupCloseGraceTimer = setTimeout(function() {
+          __anFinalizeOAuthPopupClose(flowId);
+        }, __anOAuthPopupCloseGraceMs);
+        return;
+      }
+      __anFinalizeOAuthPopupClose(flowId);
+    }
+    function __anWatchOAuthPopupClose(popup, flowId) {
+      __anStopOAuthPopupWatch();
+      __anOAuthPopupWatchTimer = setInterval(function() {
+        if (!__anIsCurrentGoogleSignInFlow(flowId)) {
+          __anStopOAuthPopupWatch();
+          return;
+        }
+        var closed = false;
+        try {
+          closed = popup.closed === true;
+        } catch(e) {
+          __anHandleOAuthPopupClosed(flowId);
+          return;
+        }
+        if (!closed) return;
+        __anHandleOAuthPopupClosed(flowId);
+      }, 500);
+    }
     function __anShowAuthExchangeError(err, btn, message, kind) {
       __anStopOAuthExchangePolling();
+      __anStopOAuthPopupWatch();
+      __anStopNativeOAuthAbandonment();
       err.textContent = message;
       err.classList.add('show', 'error');
       btn.disabled = false;
@@ -2931,22 +3075,30 @@ ${identitySsoScript}
         showMagicLinkForm();
       } else {
         __anGoogleSignInInFlight = false;
+        __anClearGoogleSignInFlow();
       }
     }
     function __anShowOAuthError(err, btn, message) {
       __anShowAuthExchangeError(err, btn, message, 'google');
     }
-    function __anRecoverGoogleSignInAfterReturn() {
+    function __anRecoverGoogleSignInAfterReturn(flowId) {
       // The user left for the Google sign-in window and came back. If the flow
       // never completed (e.g. they closed the window to switch profiles), the
       // button is stuck disabled with no error path firing for up to 5 minutes.
       // Re-enable it so they can retry. Wait briefly first so a genuinely
       // in-flight exchange can still finish and navigate without a flicker.
-      if (!__anGoogleSignInInFlight) return;
+      if (!flowId && __anNativeOAuthFlowId) {
+        __anNativeOAuthReturnObserved = true;
+        __anScheduleNativeOAuthAbandonment(__anNativeOAuthFlowId);
+        return;
+      }
+      var expectedFlowId = flowId || __anGoogleSignInFlowId;
+      if (!__anCanRecoverGoogleSignInFlow(flowId, expectedFlowId)) return;
       setTimeout(function() {
+        if (!__anCanRecoverGoogleSignInFlow(flowId, expectedFlowId)) return;
         __anMaybeRedirectSignedIn(__anResumeHref()).then(function(redirected) {
+          if (!__anCanRecoverGoogleSignInFlow(flowId, expectedFlowId)) return;
           if (redirected) return;
-          if (!__anGoogleSignInInFlight) return;
           var btn = document.getElementById('google-btn');
           if (!btn || !btn.disabled) return;
           // Keep the desktop-exchange poll alive. Agent Native Desktop opens
@@ -2954,15 +3106,25 @@ ${identitySsoScript}
           // callback has stored the session token.
           btn.disabled = false;
           __anGoogleSignInInFlight = false;
+          __anClearGoogleSignInFlow();
         });
       }, 1200);
     }
     function __anBindGoogleRecover() {
       if (__anGoogleRecoverBound) return;
       __anGoogleRecoverBound = true;
-      window.addEventListener('focus', __anRecoverGoogleSignInAfterReturn);
+      window.addEventListener('focus', function() {
+        __anRecoverGoogleSignInAfterReturn();
+      });
+      window.addEventListener('blur', function() {
+        __anCancelNativeOAuthAbandonment();
+      });
       document.addEventListener('visibilitychange', function() {
-        if (document.visibilityState === 'visible') __anRecoverGoogleSignInAfterReturn();
+        if (document.visibilityState === 'visible') {
+          __anRecoverGoogleSignInAfterReturn();
+        } else {
+          __anCancelNativeOAuthAbandonment();
+        }
       });
     }
     function __anHandlePopupOAuthFailure(ret, btn, err, flowId, redirectReason, builderFrameMessage) {
@@ -2990,6 +3152,7 @@ ${identitySsoScript}
       var isMagicLink = kind === 'magic-link';
       __anOAuthPollCount = 0;
       async function check() {
+        if (!isMagicLink && !__anIsCurrentGoogleSignInFlow(flowId)) return;
         __anOAuthPollCount++;
         try {
           var exchangeParams = '?flow_id=' + encodeURIComponent(flowId);
@@ -2999,6 +3162,7 @@ ${identitySsoScript}
           }
           var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + exchangeParams, exchangeOptions);
           var data = await res.json().catch(function() { return {}; });
+          if (!isMagicLink && !__anIsCurrentGoogleSignInFlow(flowId)) return;
           if (data && (data.email || data.token)) {
             if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);
             __anOAuthPollTimer = null;
@@ -3062,8 +3226,7 @@ ${identitySsoScript}
       }
       return data.url;
     }
-    function __anStartPopupOAuth(ret, btn, err) {
-      var flowId = __anNewOAuthFlowId();
+    function __anStartPopupOAuth(ret, btn, err, flowId) {
       var verifier = __anNewOAuthVerifier();
       if (!verifier) {
         __anShowOAuthError(err, btn, __anT('failedToConnect'));
@@ -3080,11 +3243,13 @@ ${identitySsoScript}
           return;
         }
         try { popup.opener = null; } catch(e) {}
+        __anWatchOAuthPopupClose(popup, flowId);
       } catch(e) {
         __anHandlePopupOAuthFailure(ret, btn, err, flowId, 'Could not open Google popup; falling back to redirect', 'Could not open Google popup.');
         return;
       }
       __anRequestDesktopOAuthUrl(flowId, verifier, oauthReturn).then(function(url) {
+        if (!__anIsCurrentGoogleSignInFlow(flowId)) return;
         try {
           popup.location.href = url;
           __anSetOAuthDebug('Google popup opened; waiting for callback', flowId);
@@ -3093,24 +3258,29 @@ ${identitySsoScript}
           throw e;
         }
       }).catch(function(e) {
+        if (!__anIsCurrentGoogleSignInFlow(flowId)) return;
         try { popup.close(); } catch(closeErr) {}
         __anShowOAuthError(err, btn, e && e.message ? e.message : __anT('failedToConnect'));
       });
     }
-    function __anStartNativeDesktopOAuth(ret, btn, err) {
-      var flowId = __anNewOAuthFlowId();
+    function __anStartNativeDesktopOAuth(ret, btn, err, flowId) {
       var verifier = __anNewOAuthVerifier();
       if (!verifier) {
         __anShowOAuthError(err, btn, __anT('failedToConnect'));
         return;
       }
       var oauthReturn = ret;
+      __anBeginNativeOAuth(flowId);
       __anSetOAuthDebug('Preparing Google sign-in in system browser', flowId);
       __anRequestDesktopOAuthUrl(flowId, verifier, oauthReturn).then(function(url) {
+        if (!__anIsCurrentGoogleSignInFlow(flowId)) return;
+        __anMarkNativeOAuthPolling(flowId);
         __anSetOAuthDebug('Opening Google sign-in in system browser', flowId);
         __anOpenOAuthUrl(url);
         __anWaitForOAuthExchange(flowId, ret, btn, err, 'google', verifier);
+        __anScheduleNativeOAuthAbandonment(flowId);
       }).catch(function(e) {
+        if (!__anIsCurrentGoogleSignInFlow(flowId)) return;
         __anShowOAuthError(err, btn, e && e.message ? e.message : __anT('failedToConnect'));
       });
     }
@@ -3831,20 +4001,20 @@ ${renderGoogleButton
     var btn = document.getElementById('google-btn');
     var err = document.getElementById('google-err');
     var ret = __anResumeHref();
+    var flowId = __anNewOAuthFlowId();
     btn.disabled = true;
-    __anGoogleSignInInFlight = true;
+    __anBeginGoogleSignInFlow(flowId);
     __anBindGoogleRecover();
     err.classList.remove('show');
     if (__anResolveAuthFlow() === 'popup') {
-      __anStartPopupOAuth(ret, btn, err);
+      __anStartPopupOAuth(ret, btn, err, flowId);
       return;
     }
     if (__anIsAgentNativeDesktop()) {
-      __anStartNativeDesktopOAuth(ret, btn, err);
+      __anStartNativeDesktopOAuth(ret, btn, err, flowId);
       return;
     }
     if (__anIsBuilderPreview()) {
-      var flowId = __anNewOAuthFlowId();
       __anStartRedirectOAuth(ret, btn, err, flowId, 'Opening Google sign-in redirect from Builder preview');
       return;
     }
@@ -3852,6 +4022,7 @@ ${renderGoogleButton
       var authUrl = __anGoogleAuthUrlPath() + '?return=' + encodeURIComponent(ret);
       var res = await fetch(authUrl);
       var data = await res.json();
+      if (!__anIsCurrentGoogleSignInFlow(flowId)) return;
       if (data.url) {
         __anOpenOAuthUrl(data.url);
       } else {
@@ -3859,12 +4030,14 @@ ${renderGoogleButton
         err.classList.add('show');
         btn.disabled = false;
         __anGoogleSignInInFlight = false;
+        __anClearGoogleSignInFlow();
       }
     } catch (e) {
       err.textContent = __anT('failedToConnect');
       err.classList.add('show');
       btn.disabled = false;
       __anGoogleSignInInFlight = false;
+      __anClearGoogleSignInFlow();
     }
   }`
         : ""}

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;

package/dist/vite/client.js

@@ -2254,7 +2254,11 @@ function isNitroEnvironmentUnavailable(error) {
         typeof candidate.message === "string" &&
         /Vite environment .+ is unavailable/.test(candidate.message));
 }
-const NITRO_STARTUP_SETTLE_MS = 1_000;
+// Nitro's worker can expose a transformed module graph before its entry
+// module has finished importing. Keep the recovery page up for the same
+// cold-start window instead of letting the first poll render a 500 error.
+const NITRO_STARTUP_SETTLE_MS = 3_000;
+const NITRO_STARTUP_POLL_INTERVAL_MS = 100;
 const NITRO_STARTUP_TIMEOUT_MS = 30_000;
 const NITRO_STARTUP_RETRY_DELAY_MS = 1_000;
 const NITRO_STARTUP_RETRY_MAX_DELAY_MS = 3_000;
@@ -2366,15 +2370,24 @@ function nitroStartupGate(options = {}) {
             let graphSignature = null;
             let graphStableAt;
             let startupComplete = false;
-            server.middlewares.use((req, res, next) => {
-                if (startupComplete || !isHtmlDocumentRequest(req)) {
-                    next();
-                    return;
+            let readinessTimer;
+            const completeStartup = () => {
+                startupComplete = true;
+                if (readinessTimer) {
+                    clearInterval(readinessTimer);
+                    readinessTimer = undefined;
                 }
+            };
+            // Observe the graph independently of the first document request. A
+            // server can finish compiling while the shell is still on its loading
+            // screen; measuring stability only from the first request adds the full
+            // settle window to an otherwise-ready server.
+            const observeStartup = () => {
+                if (startupComplete)
+                    return;
                 const timestamp = now();
                 if (timestamp - startedAt >= timeoutMs) {
-                    startupComplete = true;
-                    next();
+                    completeStartup();
                     return;
                 }
                 const nextGraphSignature = nitroModuleGraphSignature(server.environments?.nitro);
@@ -2385,15 +2398,43 @@ function nitroStartupGate(options = {}) {
                     }
                     else if (graphStableAt !== undefined &&
                         timestamp - graphStableAt >= settleMs) {
-                        startupComplete = true;
-                        next();
-                        return;
+                        completeStartup();
                     }
                 }
                 else {
                     graphSignature = null;
                     graphStableAt = undefined;
                 }
+            };
+            // Start watching before any HTML request arrives so readiness time is
+            // measured from server startup, not from the user's first navigation.
+            observeStartup();
+            if (!startupComplete) {
+                readinessTimer = setInterval(observeStartup, NITRO_STARTUP_POLL_INTERVAL_MS);
+                readinessTimer.unref?.();
+                server.httpServer?.once("close", () => {
+                    if (readinessTimer) {
+                        clearInterval(readinessTimer);
+                        readinessTimer = undefined;
+                    }
+                });
+            }
+            server.middlewares.use((req, res, next) => {
+                if (startupComplete || !isHtmlDocumentRequest(req)) {
+                    next();
+                    return;
+                }
+                const timestamp = now();
+                if (timestamp - startedAt >= timeoutMs) {
+                    completeStartup();
+                    next();
+                    return;
+                }
+                observeStartup();
+                if (startupComplete) {
+                    next();
+                    return;
+                }
                 sendNitroStartingResponse(req, res);
             });
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.174.1",
+  "version": "0.174.2-nightly-20260825204701",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {