@agent-native/core 0.176.1 → 0.176.2-nightly-20260831184159

package/dist/server/builder-browser.js

@@ -29,6 +29,18 @@ const BUILDER_RELAY_TTL_MS = 10 * 60 * 1000;
 const BUILDER_RELAY_REQUEST_SKEW_MS = 2 * 60 * 1000;
 const IMMUTABLE_NETLIFY_RELAY_HOST = /^(?<deploy>[a-f0-9]{24})--(?<site>[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.netlify\.app$/;
 const NETLIFY_DEPLOY_PREVIEW_HOST = /^deploy-preview-\d+--(?<site>[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.netlify\.app$/;
+export class BuilderAccountProvisioningError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.name = "BuilderAccountProvisioningError";
+        this.code = code ?? null;
+    }
+}
+export function isBuilderAccountAlreadyExistsError(error) {
+    return (error instanceof BuilderAccountProvisioningError &&
+        (error.code === "account_incomplete" || error.code === "account_exists"));
+}
 function builderRelaySecret() {
     const secret = process.env[BUILDER_RELAY_SECRET_ENV]?.trim();
     if (!secret) {
@@ -443,6 +455,7 @@ export const BUILDER_AGENT_NATIVE_TEMPLATE_PARAM = "agentNativeTemplate";
 export const BUILDER_CONNECT_MODE_PARAM = "_an_mode";
 export const BUILDER_AGENT_NATIVE_PROVISION_MODE = "agent-native";
 export const BUILDER_PROVISIONING_TOKEN_PARAM = "_an_provision";
+export const BUILDER_CONNECT_ATTEMPT_PARAM = "_an_connect_attempt";
 const BUILDER_CONNECT_STATE_COOKIE_MAX_ENTRIES = 4;
 function parseBuilderConnectStateCookie(value) {
     if (!value)
@@ -1417,6 +1430,7 @@ function safeOriginFromUrl(value) {
 }
 export function createBuilderBrowserCallbackPage(previewUrl, opts = {}) {
     const escapedUrl = JSON.stringify(previewUrl);
+    const escapedAttemptId = JSON.stringify(opts.attemptId ?? null);
     const parentOrigin = safeOriginFromUrl(opts.parentOrigin) ?? safeOriginFromUrl(previewUrl);
     // postMessage requires a specific target origin for cross-origin opener
     // delivery; only fall back to "*" when we have no usable origin (the
@@ -1458,13 +1472,13 @@ export function createBuilderBrowserCallbackPage(previewUrl, opts = {}) {
       // mirror the parent-side listener in useBuilderStatus / useBuilderConnectUrl.
       try {
         var bc = new BroadcastChannel("builder-connect:" + window.location.host);
-        bc.postMessage({ type: "builder-connect-success" });
+        bc.postMessage({ type: "builder-connect-success", attemptId: ${escapedAttemptId} || undefined });
         bc.close();
       } catch (e) {}
       try {
         if (window.opener && !window.opener.closed) {
           window.opener.postMessage(
-            { type: "builder-connect-success" },
+            { type: "builder-connect-success", attemptId: ${escapedAttemptId} || undefined },
             ${escapedTargetOrigin},
           );
         }
@@ -1501,6 +1515,8 @@ export function createBuilderBrowserCallbackPage(previewUrl, opts = {}) {
  */
 export function createBuilderBrowserCallbackErrorPage(message, opts = {}) {
     const escapedMessage = JSON.stringify(message);
+    const escapedCode = JSON.stringify(opts.code ?? null);
+    const escapedAttemptId = JSON.stringify(opts.attemptId ?? null);
     const parentOrigin = safeOriginFromUrl(opts.parentOrigin);
     const escapedTargetOrigin = JSON.stringify(parentOrigin ?? "*");
     const title = opts.title ?? "Couldn't save Builder connection";
@@ -1532,6 +1548,7 @@ export function createBuilderBrowserCallbackErrorPage(message, opts = {}) {
     <script>
       try {
         var msg = ${escapedMessage};
+        var code = ${escapedCode};
         document.getElementById("msg").textContent = msg;
         // Notify the parent tab immediately so its polling loop stops
         // without waiting for the next /builder/status tick.
@@ -1544,13 +1561,13 @@ export function createBuilderBrowserCallbackErrorPage(message, opts = {}) {
         // fallback for non-BroadcastChannel environments.
         try {
           var bc = new BroadcastChannel("builder-connect:" + window.location.host);
-          bc.postMessage({ type: "builder-connect-error", message: msg });
+          bc.postMessage({ type: "builder-connect-error", message: msg, code: code || undefined, attemptId: ${escapedAttemptId} || undefined });
           bc.close();
         } catch (e) {}
         if (window.opener && !window.opener.closed) {
           try {
             window.opener.postMessage(
-              { type: "builder-connect-error", message: msg },
+              { type: "builder-connect-error", message: msg, code: code || undefined, attemptId: ${escapedAttemptId} || undefined },
               ${escapedTargetOrigin},
             );
           } catch (e) {}
@@ -1801,7 +1818,7 @@ export async function provisionBuilderAccount(input) {
     }, "account provisioning");
     const parsed = await readBuilderApiObject(response, "account provisioning");
     if (!response.ok) {
-        throw new Error(builderApiErrorMessage(parsed, `Builder account provisioning failed (${response.status})`));
+        throw new BuilderAccountProvisioningError(builderApiErrorMessage(parsed, `Builder account provisioning failed (${response.status})`), typeof parsed.code === "string" ? parsed.code : undefined);
     }
     return parseBuilderAccountProvisioningResponse(parsed);
 }

package/dist/server/builder-design-systems.d.ts

@@ -160,6 +160,17 @@ export interface BuilderDesignSystemGitHubFileCollection {
  */
 export declare function collectBuilderDesignSystemGitHubFiles(input: BuilderDesignSystemGitHubSource): Promise<BuilderDesignSystemGitHubFileCollection>;
 export declare function fetchBuilderDesignSystemDecodeJobStatus(jobId: string): Promise<BuilderDesignSystemDecodeJobStatus>;
+export interface BuilderDesignSystemRecord {
+    projectId?: string;
+    branchName?: string;
+}
+/**
+ * Looks up the project + branch a Builder-indexed design system lives on.
+ * `builderUrl` is frozen at index time and often falls back to the docs page
+ * because the Fusion branch isn't cut yet -- this lets a caller resolve the
+ * real project/branch preview link later, once it exists.
+ */
+export declare function fetchBuilderDesignSystemRecord(designSystemId: string): Promise<BuilderDesignSystemRecord | null>;
 export declare function getBuilderDesignSystemsBaseUrl(): string;
 export declare function mimeTypeForBuilderDesignSystemFilename(filename: string, explicit?: string): string;
 export declare function buildBuilderDesignSystemIndexFiles({ codeFiles, designMd, designMdFilename, maxCodeFiles, maxTotalCodeBytes, overflowBehavior, }: BuildBuilderDesignSystemIndexFilesOptions): BuilderDesignSystemIndexFile[];

package/dist/server/builder-design-systems.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { withBuilderUtmTrackingParams } from "../shared/builder-link-tracking.js";
 import { FeatureNotConfiguredError } from "./credential-provider.js";
 import { getBuilderProxyOrigin, resolveSecret, resolveBuilderCredentials, } from "./credential-provider.js";
@@ -8,6 +9,9 @@ const DEFAULT_TIMEOUT_MS = 120_000;
 // files off a single unbounded request body.
 const GCS_CHUNK_SIZE = 16 * 1024 * 1024;
 const MAX_CHUNK_RETRIES = 5;
+const RETRYABLE_INDEX_STATUSES = new Set([408, 429, 500, 502, 503, 504]);
+const INDEX_ATTEMPT_TIMEOUT_MS = 20_000;
+const INDEX_RETRY_DELAYS_MS = [600, 1800];
 const DEFAULT_MAX_CODE_FILES = 50;
 const DEFAULT_MAX_TOTAL_CODE_BYTES = 2 * 1024 * 1024;
 const DEFAULT_BUILDER_DOC_PAGE_SIZE = 40;
@@ -203,6 +207,28 @@ export async function fetchBuilderDesignSystemDecodeJobStatus(jobId) {
     await assertOk(response, "Builder design-system decode-job status failed");
     return (await response.json());
 }
+/**
+ * Looks up the project + branch a Builder-indexed design system lives on.
+ * `builderUrl` is frozen at index time and often falls back to the docs page
+ * because the Fusion branch isn't cut yet -- this lets a caller resolve the
+ * real project/branch preview link later, once it exists.
+ */
+export async function fetchBuilderDesignSystemRecord(designSystemId) {
+    const credentials = await resolveBuilderDesignSystemCredentials();
+    const url = makeBuilderDesignSystemUrl(encodeURIComponent(designSystemId), credentials);
+    const response = await fetchWithTimeout(url, {
+        method: "GET",
+        headers: makeBuilderHeaders(credentials),
+    });
+    if (response.status === 404)
+        return null;
+    await assertOk(response, "Builder design-system lookup failed");
+    const json = (await response.json());
+    return {
+        projectId: typeof json.projectId === "string" ? json.projectId : undefined,
+        branchName: typeof json.branchName === "string" ? json.branchName : undefined,
+    };
+}
 function trimTrailingSlash(value) {
     return value.replace(/\/+$/, "");
 }
@@ -363,6 +389,28 @@ async function queryCommittedOffset(sessionUrl, total) {
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+async function fetchBuilderDesignSystemIndex(url, init, idempotencyKey) {
+    const headers = new Headers(init.headers);
+    headers.set("Idempotency-Key", idempotencyKey);
+    const request = { ...init, headers };
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            const response = await fetchWithTimeout(url, request, INDEX_ATTEMPT_TIMEOUT_MS);
+            if (response.ok ||
+                !RETRYABLE_INDEX_STATUSES.has(response.status) ||
+                attempt >= INDEX_RETRY_DELAYS_MS.length) {
+                return response;
+            }
+            if (response.body)
+                await response.body.cancel();
+        }
+        catch (error) {
+            if (attempt >= INDEX_RETRY_DELAYS_MS.length)
+                throw error;
+        }
+        await delay(INDEX_RETRY_DELAYS_MS[attempt]);
+    }
+}
 async function uploadToResumableUrl(slot, file) {
     const mimeType = mimeTypeForFile(file);
     const bytes = file.data;
@@ -749,7 +797,7 @@ export async function hydrateBuilderDesignSystemReference(reference, options = {
         docs.push(...response.docs);
         completionConfirmed ||= response.completionConfirmed;
         builderStatus = response.status ?? builderStatus;
-        if (response.docs.length < pageSize)
+        if (response.docs.length < pageSize || options.minimal)
             break;
         page += 1;
         if (pageNumber === MAX_BUILDER_DOC_PAGES - 1) {
@@ -816,7 +864,8 @@ export async function indexBuilderDesignSystem(options) {
         throw new Error("Provide at least one .fig/code/text file or a GitHub repository URL to index with Builder.");
     }
     const credentials = await resolveBuilderDesignSystemCredentials();
-    const index = await fetchWithTimeout(makeBuilderDesignSystemUrl("index", credentials), {
+    const idempotencyKey = `agent-native-dsi-${randomUUID()}`;
+    const index = await fetchBuilderDesignSystemIndex(makeBuilderDesignSystemUrl("index", credentials), {
         method: "POST",
         headers: {
             ...makeBuilderHeaders(credentials),
@@ -831,7 +880,7 @@ export async function indexBuilderDesignSystem(options) {
                 ? { devToolsVersion: options.devToolsVersion.trim() }
                 : {}),
         }),
-    });
+    }, idempotencyKey);
     await assertOk(index, "Builder design-system indexing failed");
     const indexed = (await index.json());
     if (!indexed.designSystemId) {

package/dist/server/builder-oauth.d.ts

@@ -11,10 +11,12 @@ export type BuilderOAuthPendingFlow = {
     discoveryState?: unknown;
     redirectUri: string;
 };
+export type BuilderOAuthScope = "user" | "org";
 export type BuilderOAuthSession = {
     accessToken: string;
     expiresAt?: number;
     scopes: string[];
+    scope: BuilderOAuthScope;
 };
 export type BuilderOAuthRequestAccess = BuilderOAuthSession & {
     ownerEmail: string;
@@ -35,24 +37,29 @@ export declare function exchangeBuilderOAuthAuthorization(input: {
 }): Promise<McpOAuthCredentialBundle>;
 export declare function saveBuilderOAuthCredentials(input: {
     ownerEmail: string;
-    orgId?: string;
+    orgId?: string | null;
+    role?: string | null;
     credentials: McpOAuthCredentialBundle;
-}): Promise<void>;
+}): Promise<BuilderOAuthScope>;
 export declare function finishBuilderOAuthAuthorization(input: {
     ownerEmail: string;
-    orgId?: string;
+    orgId?: string | null;
+    role?: string | null;
     code: string;
     iss?: string;
     pending: BuilderOAuthPendingFlow;
 }): Promise<void>;
-export declare function markBuilderOAuthReconnectRequired(ownerEmail: string): Promise<void>;
-export declare function getBuilderOAuthSession(ownerEmail: string, orgId?: string | null): Promise<BuilderOAuthSession | null>;
+export declare function markBuilderOAuthReconnectRequired(ownerEmail: string, scope?: BuilderOAuthScope, orgId?: string | null): Promise<void>;
+export declare function getBuilderOAuthSession(ownerEmail: string, orgId?: string | null, requiredScope?: string): Promise<BuilderOAuthSession | null>;
 export declare function hasBuilderOAuthSession(ownerEmail: string, orgId?: string | null): Promise<boolean>;
+export declare function getBuilderOAuthConnectionScope(ownerEmail: string, orgId?: string | null): Promise<BuilderOAuthScope | null>;
+export declare function getBuilderOAuthStoredScope(ownerEmail: string, orgId?: string | null): Promise<BuilderOAuthScope | null>;
 export declare function resolveBuilderOAuthRequestAccess(input: {
     ownerEmail: string;
     requiredScope: string;
+    orgId?: string | null;
 }): Promise<BuilderOAuthRequestAccess | null>;
-export declare function deleteBuilderOAuthSession(ownerEmail: string): Promise<{
+export declare function deleteBuilderOAuthSession(ownerEmail: string, scope?: BuilderOAuthScope, orgId?: string | null): Promise<{
     localDeleted: boolean;
     remoteRevoked: boolean;
 }>;

package/dist/server/builder-oauth.js

@@ -19,38 +19,58 @@ const BUILDER_OAUTH_KEY = "builder-general-resource-v1";
 // Point discovery here so live metadata resolves to the api.builder.io resource
 // and the mcp.builder.io authorization server.
 const BUILDER_OAUTH_PROTECTED_RESOURCE_METADATA = "https://mcp.builder.io/.well-known/oauth-protected-resource/api";
-// The Builder connection is shared by everyone in the caller's org: the
-// credential is scoped to the org so every member reads the same token. Every
-// user belongs to an org, so a missing org is a broken invariant, not a case
-// to fall back on.
+// Builder connections follow the same scope policy as legacy Builder keys:
+// owner/admin writes are shared with the org, while a member's connection is
+// personal and cannot replace the org grant.
 function normalizeOwnerEmail(ownerEmail) {
     const email = ownerEmail.trim().toLowerCase();
     if (!email)
         throw new Error("Builder OAuth owner email is required");
     return email;
 }
-// Read paths use this: a caller with no org simply has no Builder session, so
-// engine detection and status checks get null instead of an exception.
-//
-// An explicit orgId wins over the user's active org. The grant is org-scoped,
-// so work that carries its own organization — a recording finalizing after the
-// user switched active org, a background run — must authorize against that org
-// rather than whichever one the user happens to be looking at now.
-async function resolveOwnerOptions(ownerEmail, orgId) {
+function userOAuthKey(ownerEmail) {
+    const digest = createHash("sha256")
+        .update(normalizeOwnerEmail(ownerEmail))
+        .digest("hex");
+    return `${BUILDER_OAUTH_KEY}:u:${digest}`;
+}
+function userOwnerOptions(ownerEmail) {
+    const scopeId = normalizeOwnerEmail(ownerEmail);
+    return {
+        key: userOAuthKey(scopeId),
+        scope: "user",
+        scopeId,
+        serverUrl: BUILDER_OAUTH_RESOURCE,
+    };
+}
+// Read paths try a member's personal grant first, then the org grant. An
+// explicit orgId wins over the user's active org so background work stays
+// bound to the organization that authorized it.
+async function resolveBuilderOAuthOptions(ownerEmail, orgId) {
     const email = normalizeOwnerEmail(ownerEmail);
-    const resolvedOrgId = orgId?.trim() || (await resolveOrgIdForEmail(email));
-    if (!resolvedOrgId)
-        return null;
-    return orgOwnerOptions(resolvedOrgId);
-}
-// Write paths use this: storing a Builder credential without an org is a broken
-// invariant, so a missing org fails loudly rather than silently dropping it.
-async function ownerOptions(ownerEmail) {
-    const options = await resolveOwnerOptions(ownerEmail);
-    if (!options) {
-        throw new Error(`Builder OAuth requires an organization for ${normalizeOwnerEmail(ownerEmail)}`);
+    const userOptions = userOwnerOptions(email);
+    const resolvedOrgId = orgId === undefined
+        ? await resolveOrgIdForEmail(email)
+        : orgId?.trim() || null;
+    return resolvedOrgId
+        ? [userOptions, orgOwnerOptions(resolvedOrgId)]
+        : [userOptions];
+}
+async function resolveBuilderOAuthOptionsForScope(ownerEmail, scope, orgId) {
+    if (scope === "user")
+        return [userOwnerOptions(ownerEmail)];
+    const resolvedOrgId = orgId === undefined
+        ? await resolveOrgIdForEmail(ownerEmail)
+        : orgId?.trim() || null;
+    return resolvedOrgId ? [orgOwnerOptions(resolvedOrgId)] : [];
+}
+async function writeBuilderOAuthOptions(input) {
+    if (input.role === "owner" || input.role === "admin") {
+        const orgId = input.orgId?.trim() || (await resolveOrgIdForEmail(input.ownerEmail));
+        if (orgId)
+            return orgOwnerOptions(orgId);
     }
-    return options;
+    return userOwnerOptions(input.ownerEmail);
 }
 function orgOwnerOptions(orgId) {
     return {
@@ -151,67 +171,105 @@ export async function exchangeBuilderOAuthAuthorization(input) {
     return withRecordedScopes(result.credentials);
 }
 export async function saveBuilderOAuthCredentials(input) {
+    const options = await writeBuilderOAuthOptions(input);
     await saveMcpOAuthCredentials({
-        ...(input.orgId
-            ? orgOwnerOptions(input.orgId)
-            : await ownerOptions(input.ownerEmail)),
+        ...options,
         credentials: input.credentials,
     });
+    return options.scope;
 }
 export async function finishBuilderOAuthAuthorization(input) {
     const credentials = await exchangeBuilderOAuthAuthorization(input);
     await saveBuilderOAuthCredentials({
         ownerEmail: input.ownerEmail,
         orgId: input.orgId,
+        role: input.role,
         credentials,
     });
 }
-export async function markBuilderOAuthReconnectRequired(ownerEmail) {
-    const options = await resolveOwnerOptions(ownerEmail);
-    if (!options)
-        return;
-    await markMcpOAuthReconnectRequired(options);
+export async function markBuilderOAuthReconnectRequired(ownerEmail, scope, orgId) {
+    const options = scope
+        ? await resolveBuilderOAuthOptionsForScope(ownerEmail, scope, orgId)
+        : await resolveBuilderOAuthOptions(ownerEmail, orgId);
+    for (const candidate of options) {
+        if ((await getOAuthTokens("mcp", candidate.key, `${candidate.scope}:${candidate.scopeId}`)) !== null) {
+            await markMcpOAuthReconnectRequired(candidate);
+            return;
+        }
+    }
 }
-export async function getBuilderOAuthSession(ownerEmail, orgId) {
-    const options = await resolveOwnerOptions(ownerEmail, orgId);
-    if (!options)
-        return null;
-    // Delegates refresh single-flight and reconnect latching to the shared
-    // credential lifecycle; a null token covers missing, expired-unrefreshable,
-    // and reconnect_required alike.
-    const accessToken = await getMcpOAuthAccessToken(options);
-    if (!accessToken)
-        return null;
-    const credentials = await readMcpOAuthCredentials(options);
-    if (!credentials || !isBuilderCredential(credentials))
-        return null;
-    return {
-        accessToken,
-        expiresAt: credentials.tokenExpiresAt,
-        scopes: scopesFrom(credentials),
-    };
+export async function getBuilderOAuthSession(ownerEmail, orgId, requiredScope) {
+    let missingRequiredScope = false;
+    for (const options of await resolveBuilderOAuthOptions(ownerEmail, orgId)) {
+        const stored = await getOAuthTokens("mcp", options.key, `${options.scope}:${options.scopeId}`);
+        if (stored === null)
+            continue;
+        // Delegates refresh single-flight and reconnect latching to the shared
+        // credential lifecycle; a null token covers expired-unrefreshable and
+        // reconnect_required alike, so an org fallback can still be used.
+        const accessToken = await getMcpOAuthAccessToken(options);
+        if (!accessToken)
+            continue;
+        const credentials = await readMcpOAuthCredentials(options);
+        if (!credentials || !isBuilderCredential(credentials))
+            continue;
+        const scopes = scopesFrom(credentials);
+        if (requiredScope && !scopes.includes(requiredScope)) {
+            missingRequiredScope = true;
+            continue;
+        }
+        return {
+            accessToken,
+            expiresAt: credentials.tokenExpiresAt,
+            scopes,
+            scope: options.scope,
+        };
+    }
+    if (requiredScope && missingRequiredScope) {
+        throw new Error(`Builder OAuth connection does not grant ${requiredScope}`);
+    }
+    return null;
 }
 export async function hasBuilderOAuthSession(ownerEmail, orgId) {
-    const options = await resolveOwnerOptions(ownerEmail, orgId);
-    if (!options)
-        return false;
-    const stored = await getOAuthTokens("mcp", options.key, `${options.scope}:${options.scopeId}`);
-    return stored !== null;
+    for (const options of await resolveBuilderOAuthOptions(ownerEmail, orgId)) {
+        const stored = await getOAuthTokens("mcp", options.key, `${options.scope}:${options.scopeId}`);
+        if (stored !== null)
+            return true;
+    }
+    return false;
+}
+export async function getBuilderOAuthConnectionScope(ownerEmail, orgId) {
+    const session = await getBuilderOAuthSession(ownerEmail, orgId);
+    return session?.scope ?? null;
+}
+export async function getBuilderOAuthStoredScope(ownerEmail, orgId) {
+    for (const options of await resolveBuilderOAuthOptions(ownerEmail, orgId)) {
+        const stored = await getOAuthTokens("mcp", options.key, `${options.scope}:${options.scopeId}`);
+        if (stored !== null)
+            return options.scope;
+    }
+    return null;
 }
 export async function resolveBuilderOAuthRequestAccess(input) {
-    const session = await getBuilderOAuthSession(input.ownerEmail);
+    const session = await getBuilderOAuthSession(input.ownerEmail, input.orgId, input.requiredScope);
     if (!session)
         return null;
-    if (!session.scopes.includes(input.requiredScope)) {
-        throw new Error(`Builder OAuth connection does not grant ${input.requiredScope}`);
-    }
     return { ...session, ownerEmail: input.ownerEmail.trim().toLowerCase() };
 }
-export async function deleteBuilderOAuthSession(ownerEmail) {
-    const options = await resolveOwnerOptions(ownerEmail);
-    if (!options)
+export async function deleteBuilderOAuthSession(ownerEmail, scope, orgId) {
+    const options = scope
+        ? await resolveBuilderOAuthOptionsForScope(ownerEmail, scope, orgId)
+        : await resolveBuilderOAuthOptions(ownerEmail, orgId);
+    let selected = null;
+    for (const candidate of options) {
+        if ((await getOAuthTokens("mcp", candidate.key, `${candidate.scope}:${candidate.scopeId}`)) !== null) {
+            selected = candidate;
+            break;
+        }
+    }
+    if (!selected)
         return { localDeleted: false, remoteRevoked: false };
-    const result = await revokeMcpOAuthCredentials(options);
+    const result = await revokeMcpOAuthCredentials(selected);
     return {
         localDeleted: result.local === "deleted",
         remoteRevoked: result.remote === "succeeded",

package/dist/server/capture-error.js

@@ -1,3 +1,4 @@
+import { getRequestContext } from "./request-context.js";
 const providers = new Map();
 /**
  * Register a backend for the framework-level `captureError()` utility.
@@ -19,6 +20,8 @@ export function registerErrorCaptureProvider(name, provider) {
  * is installed and never throws back into the application path.
  */
 export function captureError(error, context = {}) {
+    if (getRequestContext()?.isSyntheticTraffic)
+        return undefined;
     let eventId;
     for (const provider of providers.values()) {
         try {

package/dist/server/cookie-namespace.d.ts

@@ -10,4 +10,5 @@ export interface AuthCookieNamespace {
     isWorkspaceMode: boolean;
     isFirstPartyCookieDomain: boolean;
 }
+export declare function frameworkSessionHintCookieName(sessionCookieName: string): string;
 export declare function resolveAuthCookieNamespace(env?: Record<string, string | undefined>, cwd?: string): AuthCookieNamespace;

package/dist/server/cookie-namespace.js

@@ -3,6 +3,9 @@ import path from "node:path";
 import { getAppConfig } from "../app-config/index.js";
 import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
 const FIRST_PARTY_COOKIE_DOMAIN = "agent-native.com";
+export function frameworkSessionHintCookieName(sessionCookieName) {
+    return `${sessionCookieName}_hint`;
+}
 export function resolveAuthCookieNamespace(env = process.env, cwd = process.cwd()) {
     const isWorkspaceMode = env === process.env
         ? isConfiguredWorkspaceRuntime()

package/dist/server/core-routes-plugin.d.ts

@@ -54,16 +54,18 @@ export interface AgentEngineStatusDeps<E extends AgentEngineStatusEntry = AgentE
  */
 export declare function resolveAgentEngineStatus<E extends AgentEngineStatusEntry>(deps: AgentEngineStatusDeps<E>): Promise<AgentEngineStatusResult>;
 /**
- * Share one in-flight status resolution between concurrent probes of the same
- * identity. Several client surfaces probe this route on mount and the client
- * retries after its own timeout; without this each probe re-ran the whole
- * credential sweep. The entry is dropped as soon as the lookup settles, so a
- * joiner never sees an answer older than one lookup — no TTL, nothing to
- * invalidate when a provider is added or removed. The key carries the identity
- * that decides the answer, so no tenant can read another's result.
+ * Shared Builder grants stay org-scoped, but connect initiation can come from
+ * any authenticated member. Revocation still needs owner/admin authority.
+ * Capture the org id at connect start so the grant is stored under the org
+ * that was authorized, not one re-resolved after the OAuth round trip.
  */
-export declare function shareAgentEngineStatusLookup(identityKey: string, compute: () => Promise<AgentEngineStatusResult>): Promise<AgentEngineStatusResult>;
-export declare function agentEngineStatusIdentityKey(userEmail: string | undefined, orgId: string | undefined): string;
+export declare function resolveBuilderOrgMutation(event: H3Event, options?: {
+    allowMemberInitiation?: boolean;
+}): Promise<{
+    orgId: string | null;
+    role: string | null;
+    deny: string | null;
+}>;
 export declare function getFrameworkEnvKeys(): EnvKeyConfig[];
 export interface DbHealthProbeResult {
     /** The serverless function is live and served the request. */
@@ -255,6 +257,20 @@ export interface CoreRoutesPluginOptions {
     disablePing?: boolean;
     /** Disable the /_agent-native/health DB liveness + warmup probe. */
     disableHealth?: boolean;
+    /**
+     * Callback paths emitted by this app's Google OAuth health contract. The
+     * default is the shared framework callback; app-owned callbacks must opt in
+     * so fleet probes read the deployed app instead of guessing from a hostname.
+     */
+    googleOAuthCallbackPaths?: string[];
+    /** Whether the managed Google client is deployment- or user-scoped. */
+    googleOAuthCredentialMode?: "managed" | "user";
+    /**
+     * Whether this app exposes deployment-level Google workspace OAuth. Custom
+     * core-route plugins must declare this; the framework default declares that
+     * managed OAuth is not applicable.
+     */
+    googleOAuthManagedConnection?: "required" | "not_applicable";
     /** Disable the /_agent-native/application-state routes. */
     disableAppState?: boolean;
     /** Disable the /_agent-native/open deep-link route. */