@agent-native/core 0.176.1 → 0.176.2-nightly-20260831184159

package/dist/templates/workspace-core/.agents/skills/secrets/SKILL.md

@@ -31,6 +31,53 @@ standard workspace connections and org/workspace vault scopes; never put them
 in `.env` or deployment environment variables, and never add a provider-specific
 action or startup bootstrap just to write a credential for one organization.
 
+## Google OAuth triage
+
+| Observation | Meaning | Next action |
+| --- | --- | --- |
+| `invalid_grant` from a deliberately fake code | Google accepted the client pair and rejected only the code | Do not rotate credentials; check flow state and callback registration |
+| `invalid_client` | Google rejected the client id/secret pair | Verify the exact pair and deployment source before rotating |
+| `redirect_uri_mismatch` | The client, host, callback path, and Google registration disagree | Compare that exact tuple in Google Cloud Console; publish a new deploy if site-scoped or build-time configuration changes |
+
+Do not reason about this from memory. The probe checks both contracts: the
+unqualified `/health/google` endpoint reports the sign-in contract, while
+`/health/google?client=managed` reports deployment-level managed OAuth. It asks
+Google directly whether each live `(client_id, redirect_uri)` pair is
+registered:
+
+```bash
+pnpm check:google-redirect-uris -- --env all
+```
+
+The sign-in health path calls `checkGoogleSignInCredential()`, which prefers
+the active Better Auth pair and otherwise uses `resolveGoogleSignInCredentials()`
+from `packages/core/src/server/google-oauth-credentials.ts`. Managed health
+calls `checkGoogleManagedCredential()`, which resolves
+`["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]` through `resolveSecretPair()` in
+`packages/core/src/server/credential-provider.ts`. App provider handlers use
+`resolveGoogleProviderCredentialCandidatesWithReader()` with `resolveSecret`
+under request context. These are separate flows and can intentionally land on
+different Google clients, so a clean result for one says nothing about the
+other. Read both contracts before changing anything:
+
+```bash
+curl -s https://HOST/_agent-native/health/google | jq '{clientId,mismatchedPairs,credentialSource}'
+curl -s "https://HOST/_agent-native/health/google?client=managed" | jq '{clientId,mismatchedPairs,credentialSource}'
+```
+
+Different `clientId` values across those two, or `mismatchedPairs: true`, is a
+divergence to understand, not damage to undo. Never repair it by rotating a
+secret: writing a fresh value into whichever namespace the failing flow does
+not read verifies clean and changes nothing. Do not collapse the namespaces
+without first confirming which flow uses which client; separate sign-in and
+managed clients on one host can be deliberate. For prebuilt Netlify deploys,
+uploaded Functions read site-scoped secrets at runtime, and the health route
+resolves them per request. The build may receive masked placeholder values.
+After changing a site-scoped env var, publish a new deploy before verifying
+live behavior. Call it a rebuild when the changed value is baked into build
+output or static assets; a runtime-only secret does not need to be baked into
+the bundle.
+
 ## Credential Modeling Preflight
 
 Before registering a provider's fields, inspect the workspace/provider connection

package/dist/templates/workspace-root/.env.example

@@ -71,8 +71,9 @@ GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 
 # Optional workspace connectors. Register the matching callback URLs in each
-# provider using APP_URL as the origin:
-#   /_agent-native/connections/oauth/google_drive/callback
+# provider using APP_URL as the origin. Google sign-in and all managed Google
+# connections share the root callback; state selects the final provider route:
+#   /_agent-native/google/callback
 #   /_agent-native/connections/oauth/figma/callback
 #   /_agent-native/connections/oauth/notion/callback
 # Google reuses the client above. User access and refresh tokens are encrypted

package/dist/terminal/pty-server.d.ts

@@ -16,6 +16,8 @@ export interface PtyServerOptions {
     port?: number;
     /** Auth check for WebSocket upgrade requests. Return false to reject. */
     authCheck?: (req: IncomingMessage) => boolean | Promise<boolean>;
+    /** Trusted host arguments appended to each validated CLI command. */
+    getCommandArgs?: (command: string) => string[] | Promise<string[]>;
     /** Log prefix for console output. Defaults to '[terminal]' */
     logPrefix?: string;
 }

package/dist/terminal/pty-server.js

@@ -83,7 +83,7 @@ async function killProcessTree(pid, _logPrefix) {
     }, 500);
 }
 export async function createPtyWebSocketServer(options = {}) {
-    const { appDir = process.cwd(), command: defaultCommand = "claude", port = 0, authCheck, logPrefix = "[terminal]", } = options;
+    const { appDir = process.cwd(), command: defaultCommand = "claude", port = 0, authCheck, getCommandArgs, logPrefix = "[terminal]", } = options;
     // Dynamic imports for optional native dependencies
     const { WebSocketServer, WebSocket } = await import("ws");
     const pty = await import("node-pty");
@@ -171,14 +171,28 @@ export async function createPtyWebSocketServer(options = {}) {
                 return;
             }
         }
+        let commandArgs = [];
+        try {
+            if (getCommandArgs)
+                commandArgs = await getCommandArgs(command);
+        }
+        catch (error) {
+            sendStatus("failed", error instanceof Error
+                ? error.message
+                : "The terminal command could not be configured.");
+            if (ws.readyState === WebSocket.OPEN)
+                ws.close();
+            return;
+        }
         // Build the command — use npx if CLI not found locally
         const baseCommand = useNpx
             ? `npx --yes ${CLI_REGISTRY[command].installPackage}`
             : command;
-        const fullCommand = extraFlags
-            ? `${baseCommand} ${extraFlags}`
-            : baseCommand;
-        console.log(`${logPrefix} Spawning PTY: ${fullCommand}`);
+        const generatedFlags = commandArgs.map(shellQuote).join(" ");
+        const fullCommand = [baseCommand, generatedFlags, extraFlags]
+            .filter(Boolean)
+            .join(" ");
+        console.log(`${logPrefix} Spawning PTY for ${command}`);
         // Build env, stripping CLI-specific nesting vars
         const registry = CLI_REGISTRY[command];
         const env = {
@@ -298,3 +312,6 @@ export async function createPtyWebSocketServer(options = {}) {
         });
     });
 }
+function shellQuote(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}

package/dist/tracking/registry.d.ts

@@ -1,5 +1,6 @@
 import type { ActionRunContext } from "../action.js";
 import type { TrackingProvider } from "./types.js";
+export { isQaTestEmail } from "../shared/qa-test-email.js";
 export declare function registerTrackingProvider(provider: TrackingProvider): void;
 export declare function unregisterTrackingProvider(name: string): boolean;
 export declare function listTrackingProviders(): string[];

package/dist/tracking/registry.js

@@ -1,7 +1,15 @@
 import { resolveDeployEnvironment } from "../server/deploy-environment.js";
 import { getRequestContext } from "../server/request-context.js";
 import { ANALYTICS_CLIENT_PLATFORM_PROPERTY } from "../shared/analytics-platform.js";
+import { isQaTestEmail } from "../shared/qa-test-email.js";
+export { isQaTestEmail } from "../shared/qa-test-email.js";
 const REGISTRY_KEY = Symbol.for("@agent-native/core/tracking.registry");
+function isTrackingSuppressed(userId, properties) {
+    return (getRequestContext()?.isSyntheticTraffic === true ||
+        isQaTestEmail(userId) ||
+        isQaTestEmail(properties?.email) ||
+        isQaTestEmail(properties?.userEmail));
+}
 function getRegistry() {
     const g = globalThis;
     if (!g[REGISTRY_KEY])
@@ -47,6 +55,8 @@ function resolveTrackingSource(source) {
 }
 export function track(name, properties, source) {
     const { userId, anonymousId, sessionId, occurredAt } = resolveTrackingSource(source);
+    if (isTrackingSuppressed(userId, properties))
+        return;
     const clientPlatform = getRequestContext()?.clientPlatform;
     const trackedProperties = {
         ...(properties ?? {}),
@@ -80,6 +90,8 @@ export function track(name, properties, source) {
     }
 }
 export function identify(userId, traits) {
+    if (isTrackingSuppressed(userId, traits))
+        return;
     for (const provider of getRegistry().values()) {
         if (!provider.identify)
             continue;

package/dist/usage/store.d.ts

@@ -38,6 +38,7 @@ export interface UsageRecord {
     costCentsX100?: number;
     /** Whether cost is provider-reported, estimated, or unavailable. */
     costSource?: UsageCostSource;
+    /** Defaults to the active request organization when omitted. */
     orgId?: string;
     runId?: string;
     threadId?: string;

package/dist/usage/store.js

@@ -10,6 +10,7 @@
 import { getDbExec, intType, isPostgres } from "../db/client.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
+import { getRequestOrgId } from "../server/request-context.js";
 export const BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER = 1.25;
 export const BUILDER_AGENT_CREDITS_PER_USD = 20;
 export const USD_USAGE_BILLING = {
@@ -230,6 +231,7 @@ export async function ensureUsageTable() {
                 // creating the index, which then fails the verifying probe and blocks
                 // the whole release. The SHARE lock is the cost of a build that lands.
                 await ensureIndexExists("idx_token_usage_lower_owner_created", `CREATE INDEX IF NOT EXISTS idx_token_usage_lower_owner_created ON token_usage (LOWER(owner_email), created_at)`);
+                await ensureIndexExists("idx_token_usage_org_app_created", `CREATE INDEX IF NOT EXISTS idx_token_usage_org_app_created ON token_usage (org_id, LOWER(app), created_at)`);
                 return;
             }
             // SQLite (local dev): no lock problem — keep the original behaviour.
@@ -252,6 +254,7 @@ export async function ensureUsageTable() {
             for (const ddl of [
                 `CREATE INDEX IF NOT EXISTS idx_token_usage_owner_created ON token_usage (owner_email, created_at)`,
                 `CREATE INDEX IF NOT EXISTS idx_token_usage_lower_owner_created ON token_usage (LOWER(owner_email), created_at)`,
+                `CREATE INDEX IF NOT EXISTS idx_token_usage_org_app_created ON token_usage (org_id, LOWER(app), created_at)`,
             ]) {
                 try {
                     await client.execute(ddl);
@@ -317,13 +320,16 @@ export async function recordUsage(recordOrOwner, inputTokens, outputTokens, mode
     const resolvedApp = app ?? process.env.AGENT_APP ?? process.env.APP_NAME ?? "";
     const resolvedLabel = label ?? "chat";
     const resolvedRef = refId ?? "";
-    // Replace any prior usage for this (label, refId) so re-recording the same
-    // run — e.g. a recap regenerated on a PR re-push — overwrites instead of
-    // double-counting. No-op when refId is unset (the common per-call path).
+    const resolvedOrgId = orgId ?? getRequestOrgId() ?? null;
+    // Replace any prior usage for this (org, label, refId) so re-recording the
+    // same run — e.g. a recap regenerated on a PR re-push — overwrites instead
+    // of double-counting. No-op when refId is unset (the common per-call path).
     if (resolvedRef) {
         await client.execute({
-            sql: `DELETE FROM token_usage WHERE label = ? AND ref_id = ?`,
-            args: [resolvedLabel, resolvedRef],
+            sql: `DELETE FROM token_usage
+        WHERE label = ? AND ref_id = ?
+          AND (org_id IS NULL OR org_id = ?)`,
+            args: [resolvedLabel, resolvedRef, resolvedOrgId],
         });
     }
     // Prefer an explicit precomputed cost (e.g. a provider-reported dollar cost);
@@ -351,7 +357,7 @@ export async function recordUsage(recordOrOwner, inputTokens, outputTokens, mode
             resolvedLabel,
             resolvedApp,
             resolvedRef,
-            orgId ?? null,
+            resolvedOrgId,
             runId ?? null,
             threadId ?? null,
             taskId ?? null,
@@ -366,7 +372,10 @@ export async function recordUsage(recordOrOwner, inputTokens, outputTokens, mode
     // evaluator serializes its own work so the hot path stays one insert.
     void import("./alerts-store.js")
         .then(({ enqueueUsageAlertEvaluation }) => {
-        return enqueueUsageAlertEvaluation(record);
+        return enqueueUsageAlertEvaluation({
+            ...record,
+            orgId: resolvedOrgId,
+        });
     })
         .catch((error) => {
         console.error("[usage-alerts] could not enqueue evaluation:", error);

package/dist/vite/client.d.ts

@@ -81,7 +81,7 @@ declare function getReactRouterAliases(cwd: string): Array<{
 }>;
 declare function getDefaultOptimizeDeps(cwd: string): string[];
 export interface NitroOptions {
-    /** Nitro deployment preset (e.g. "node", "vercel", "netlify", "cloudflare_pages", "cloudflare_module"). Default: "node" */
+    /** Nitro deployment preset (e.g. "node", "vercel", "netlify", "aws_amplify", "cloudflare_pages", "cloudflare_module"). Default: "node" */
     preset?: string;
     /** Source directory for server files. Default: "./server" */
     srcDir?: string;

package/dist/vite/client.js

@@ -2784,6 +2784,64 @@ function nitroPresetMarkerPlugin(options) {
         },
     };
 }
+const AUTH_CLIENT_ASSET_PATH = "assets/auth-client.js";
+function authClientEntryPath() {
+    const sourceEntry = path.resolve(__dirname, "../client/auth/entry.tsx");
+    return fs.existsSync(sourceEntry)
+        ? sourceEntry
+        : path.resolve(__dirname, "../client/auth/entry.js");
+}
+function authClientAssetPlugin() {
+    const entry = authClientEntryPath();
+    let isBuild = false;
+    let hasReactRouterHmr = false;
+    return {
+        name: "agent-native-auth-client-asset",
+        applyToEnvironment(environment) {
+            return environment.name === "client";
+        },
+        configResolved(config) {
+            isBuild = config.command === "build";
+            hasReactRouterHmr = config.plugins.some((plugin) => plugin.name?.startsWith("react-router"));
+        },
+        buildStart() {
+            if (!isBuild)
+                return;
+            this.emitFile({
+                type: "chunk",
+                id: entry,
+                fileName: AUTH_CLIENT_ASSET_PATH,
+            });
+        },
+        configureServer(server) {
+            server.middlewares.use((req, res, next) => {
+                const pathname = new URL(req.url ?? "/", "http://agent-native.local")
+                    .pathname;
+                if (req.method !== "GET" ||
+                    !pathname.endsWith(`/${AUTH_CLIENT_ASSET_PATH}`)) {
+                    next();
+                    return;
+                }
+                void server
+                    .transformRequest(entry)
+                    .then((result) => {
+                    if (!result?.code) {
+                        res.statusCode = 500;
+                        res.end("Unable to transform the auth client asset.");
+                        return;
+                    }
+                    const authClientCode = hasReactRouterHmr
+                        ? `import ${JSON.stringify(`${server.config.base.replace(/\/+$/, "")}/@id/__x00__virtual:react-router/inject-hmr-runtime`)};\n${result.code}`
+                        : result.code;
+                    res.statusCode = 200;
+                    res.setHeader("Content-Type", "application/javascript");
+                    res.end(authClientCode);
+                })
+                    .catch(next);
+            });
+        },
+    };
+}
 function createAgentNativePlugins(options, { command, includeReactTransform, useServeOnlyNitroPlugin = false, userPlugins = [], }) {
     const { appBasePath } = getConfiguredAppBasePath();
     const nitroPlugin = createNitroDevPlugin(options, appBasePath);
@@ -2800,6 +2858,7 @@ function createAgentNativePlugins(options, { command, includeReactTransform, use
         appChangelogRawPlugin(),
         actionTypesPlugin(),
         agentsBundlePlugin({ agentNativeConfig: options.agentNativeConfig }),
+        authClientAssetPlugin(),
         autoReloadOnOptimizeDep(),
         fullReloadOnOptimizeDep504(),
         embedDevFrameHeaders(),

package/dist/workspace-connections/index.d.ts

@@ -1,5 +1,5 @@
 export { credentialKeyAliases, credentialKeyMatches, lookupKeysForRef, } from "./credential-key-aliases.js";
 export { assertWorkspaceUserGroupIds, assertWorkspaceUserGroupManager, deleteWorkspaceUserGroup, ensureWorkspaceUserGroupsTable, listWorkspaceUserGroups, listWorkspaceUserGroupsForOrg, normalizeWorkspaceUserGroupIds, updateWorkspaceUserGroupMembers, upsertWorkspaceUserGroup, workspaceUserGroupsIncludeUser, type UpsertWorkspaceUserGroupInput, type UpdateWorkspaceUserGroupMembersInput, type WorkspaceUserGroup, } from "./groups.js";
-export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, normalizeWorkspaceConnectionAllowedUsers, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, type ListWorkspaceConnectionProviderCatalogForAppOptions, type ListWorkspaceConnectionGrantsOptions, type ListWorkspaceConnectionsOptions, type ListWorkspaceConnectionsForAppOptions, type MarkWorkspaceConnectionUsedOptions, type MarkWorkspaceConnectionUsedResult, type ResolvedWorkspaceConnectionForApp, type ResolveWorkspaceConnectionForAppOptions, type SerializedWorkspaceConnectionGrant, type SerializedWorkspaceConnection, type SummarizeWorkspaceConnectionProviderForAppOptions, type SummarizeWorkspaceConnectionProviderReadinessOptions, type UpsertWorkspaceConnectionGrantInput, type UpsertWorkspaceConnectionInput, type WorkspaceConnectionAppAccess, type WorkspaceConnectionAppAccessMode, type WorkspaceConnection, type WorkspaceConnectionCredentialRef, type WorkspaceConnectionExplicitGrantSummary, type WorkspaceConnectionForApp, type WorkspaceConnectionForAppSummary, type WorkspaceConnectionGrant, type WorkspaceConnectionGrantAvailability, type WorkspaceConnectionGrantState, type WorkspaceConnectionProviderAppSummary, type WorkspaceConnectionProviderLike, type WorkspaceConnectionProviderCatalogForApp, type WorkspaceConnectionProviderCatalogForAppItem, type WorkspaceConnectionProviderReadiness, type WorkspaceConnectionProviderReadinessStatus, type WorkspaceConnectionPublicCredentialRef, type WorkspaceConnectionStatus, workspaceConnectionIsAvailableToApp, } from "./store.js";
+export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForUser, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, normalizeWorkspaceConnectionAllowedUsers, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, type ListWorkspaceConnectionProviderCatalogForAppOptions, type ListWorkspaceConnectionGrantsOptions, type ListWorkspaceConnectionsOptions, type ListWorkspaceConnectionsForAppOptions, type MarkWorkspaceConnectionUsedOptions, type MarkWorkspaceConnectionUsedResult, type ResolvedWorkspaceConnectionForApp, type ResolveWorkspaceConnectionForAppOptions, type SerializedWorkspaceConnectionGrant, type SerializedWorkspaceConnection, type SummarizeWorkspaceConnectionProviderForAppOptions, type SummarizeWorkspaceConnectionProviderReadinessOptions, type UpsertWorkspaceConnectionGrantInput, type UpsertWorkspaceConnectionInput, type WorkspaceConnectionAppAccess, type WorkspaceConnectionAppAccessMode, type WorkspaceConnection, type WorkspaceConnectionCredentialRef, type WorkspaceConnectionExplicitGrantSummary, type WorkspaceConnectionForApp, type WorkspaceConnectionForAppSummary, type WorkspaceConnectionGrant, type WorkspaceConnectionGrantAvailability, type WorkspaceConnectionGrantState, type WorkspaceConnectionProviderAppSummary, type WorkspaceConnectionProviderLike, type WorkspaceConnectionProviderCatalogForApp, type WorkspaceConnectionProviderCatalogForAppItem, type WorkspaceConnectionProviderReadiness, type WorkspaceConnectionProviderReadinessStatus, type WorkspaceConnectionPublicCredentialRef, type WorkspaceConnectionStatus, workspaceConnectionIsAvailableToApp, } from "./store.js";
 export { resolveWorkspaceConnectionCredentialForApp, resolveWorkspaceConnectionCredentialsForApp, type ResolveWorkspaceConnectionCredentialForAppOptions, type ResolveWorkspaceConnectionCredentialsForAppOptions, type WorkspaceConnectionCredentialBackend, type WorkspaceConnectionCredentialProvenance, type WorkspaceConnectionCredentialResolution, type WorkspaceConnectionCredentialResolutionCheck, type WorkspaceConnectionCredentialResolutionStatus, type WorkspaceConnectionCredentialsResolution, } from "./credentials.js";
 export { registerWorkspaceConnectionLifecycleListener, type WorkspaceConnectionLifecycleEvent, type WorkspaceConnectionLifecycleListener, } from "./lifecycle.js";

package/dist/workspace-connections/index.js

@@ -1,5 +1,5 @@
 export { credentialKeyAliases, credentialKeyMatches, lookupKeysForRef, } from "./credential-key-aliases.js";
 export { assertWorkspaceUserGroupIds, assertWorkspaceUserGroupManager, deleteWorkspaceUserGroup, ensureWorkspaceUserGroupsTable, listWorkspaceUserGroups, listWorkspaceUserGroupsForOrg, normalizeWorkspaceUserGroupIds, updateWorkspaceUserGroupMembers, upsertWorkspaceUserGroup, workspaceUserGroupsIncludeUser, } from "./groups.js";
-export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, normalizeWorkspaceConnectionAllowedUsers, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, workspaceConnectionIsAvailableToApp, } from "./store.js";
+export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForUser, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, normalizeWorkspaceConnectionAllowedUsers, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, workspaceConnectionIsAvailableToApp, } from "./store.js";
 export { resolveWorkspaceConnectionCredentialForApp, resolveWorkspaceConnectionCredentialsForApp, } from "./credentials.js";
 export { registerWorkspaceConnectionLifecycleListener, } from "./lifecycle.js";

package/dist/workspace-connections/store.d.ts

@@ -243,6 +243,7 @@ export declare function listWorkspaceConnectionProviderCatalogForApp({ appId, pr
 export declare function listWorkspaceConnectionsForApp({ appId, provider, includeDisabled, }: ListWorkspaceConnectionsForAppOptions): Promise<WorkspaceConnectionForApp[]>;
 export declare function resolveWorkspaceConnectionForApp({ appId, provider, includeDisabled, connectionId, requireConnected, }: ResolveWorkspaceConnectionForAppOptions): Promise<ResolvedWorkspaceConnectionForApp>;
 export declare function listWorkspaceConnections(options?: ListWorkspaceConnectionsOptions): Promise<SerializedWorkspaceConnection[]>;
+export declare function listWorkspaceConnectionsForUser(options?: ListWorkspaceConnectionsOptions): Promise<SerializedWorkspaceConnection[]>;
 export declare function getWorkspaceConnection(id: string): Promise<SerializedWorkspaceConnection | null>;
 export declare function upsertWorkspaceConnection(input: UpsertWorkspaceConnectionInput): Promise<SerializedWorkspaceConnection>;
 export declare function listWorkspaceConnectionGrants(options?: ListWorkspaceConnectionGrantsOptions): Promise<SerializedWorkspaceConnectionGrant[]>;

package/dist/workspace-connections/store.js

@@ -811,6 +811,10 @@ export async function listWorkspaceConnections(options = {}) {
         connection.allowedApps.includes(appId) ||
         grantedConnectionIds.has(connection.id));
 }
+export async function listWorkspaceConnectionsForUser(options = {}) {
+    const connections = await listWorkspaceConnections(options);
+    return filterWorkspaceConnectionsForUser(connections, requireWorkspaceConnectionScope());
+}
 export async function getWorkspaceConnection(id) {
     await ensureWorkspaceConnectionsTable();
     const client = getDbExec();

package/docs/content/aws-amplify.mdx

@@ -0,0 +1,179 @@
+---
+title: "AWS Amplify"
+description: "Deploy an Agent-Native SSR app to AWS Amplify Hosting with Nitro's aws_amplify preset."
+search: "AWS Amplify Hosting deployment Nitro aws_amplify SSR CloudFront"
+---
+
+# AWS Amplify
+
+AWS Amplify Hosting supports the Nitro deployment specification directly. Set
+Nitro's `aws_amplify` preset and publish the generated `.amplify-hosting`
+directory. The framework does not need an Amplify runtime package or an AWS
+SDK dependency.
+
+## Build with Nitro
+
+For a standalone app, add this `amplify.yml` at the project root:
+
+```yaml filename="amplify.yml"
+version: 1
+frontend:
+  phases:
+    preBuild:
+      commands:
+        - nvm use 24
+        - corepack enable
+        - pnpm install
+    build:
+      commands:
+        - NITRO_PRESET=aws_amplify pnpm build
+  artifacts:
+    baseDirectory: .amplify-hosting
+    files:
+      - "**/*"
+```
+
+The Nitro build produces the Amplify SSR deployment contract:
+
+- `.amplify-hosting/static` contains the browser assets.
+- `.amplify-hosting/compute/default/server.js` starts the Node server on
+  Amplify's port 3000.
+- `.amplify-hosting/deploy-manifest.json` routes static files to the static
+  primitive and all other requests to the compute primitive.
+
+For a monorepo, run the build from the repository root and point the artifact
+base directory at the app's output. For example, a calendar app under
+`templates/calendar` uses `NITRO_PRESET=aws_amplify pnpm --filter calendar build`
+and `templates/calendar/.amplify-hosting`. The matching Amplify environment
+variable is `AMPLIFY_MONOREPO_APP_ROOT=templates/calendar`.
+
+The framework sets Nitro's `awsAmplify.runtime` to `nodejs24.x`, matching the
+Node 24 build phase and the repository's server runtime requirements.
+
+## Runtime variables and CLI
+
+Amplify exposes environment variables to the build container but does not
+automatically expose them to every SSR runtime. The Agent-Native Amplify
+adapter writes only keys declared by the app's `.env.example` plus the core
+deployment keys into the Nitro compute bundle. Its generated `server.js` loads
+that file with Node's native `process.loadEnvFile()` before starting Nitro.
+
+The file is inside `compute/default`, not the public `static` directory. It
+still travels with the server artifact, so do not commit a populated `.env` or
+grant artifact access more broadly than necessary. Prefer Amplify secret
+management or an external secret store for production credentials.
+
+You can configure app-level variables with the AWS CLI. Amplify's update
+commands replace the complete environment-variable map, so retrieve the
+current map and merge overrides before updating. Keep these JSON files outside
+the repository and remove them after the update:
+
+```json filename="amplify-env-overrides.json"
+{
+  "APP_URL": "https://calendar.example.com",
+  "DATABASE_URL": "<persistent-database-url>",
+  "BETTER_AUTH_SECRET": "<stable-auth-secret>"
+}
+```
+
+```bash
+aws amplify get-app \
+  --app-id <app-id> \
+  --query 'app.environmentVariables' \
+  --output json > amplify-env-current.json
+jq -s '.[0] * .[1]' amplify-env-current.json amplify-env-overrides.json \
+  > amplify-env-next.json
+aws amplify update-app \
+  --app-id <app-id> \
+  --environment-variables file://amplify-env-next.json
+
+aws amplify get-branch \
+  --app-id <app-id> \
+  --branch-name <branch-name> \
+  --query 'branch.environmentVariables' \
+  --output json > amplify-branch-env-current.json
+jq -s '.[0] * .[1]' amplify-branch-env-current.json amplify-env-overrides.json \
+  > amplify-branch-env-next.json
+aws amplify update-branch \
+  --app-id <app-id> \
+  --branch-name <branch-name> \
+  --environment-variables file://amplify-branch-env-next.json
+aws amplify start-job \
+  --app-id <app-id> \
+  --branch-name <branch-name> \
+  --job-type RELEASE
+```
+
+App-level values apply to branches by default. Use `update-branch` when a
+branch needs an explicit override. The build must run again after an env
+change so Nitro can include the declared runtime values.
+
+## Configure the app
+
+Amplify Hosting compute is serverless. Configure a persistent SQL database and
+the production secrets in the Amplify environment variables:
+
+- `DATABASE_URL` for Postgres, Neon, Supabase, RDS, Turso, or another supported
+  SQL provider.
+- `BETTER_AUTH_SECRET` as a stable 32+ character secret.
+- `DATABASE_AUTH_TOKEN` when the database provider needs a separate token.
+- Any provider credentials required by the app.
+
+Enable SSR app logs in Amplify after connecting the repository. Run schema
+migrations in the release pipeline or as a separate controlled task. Do not
+use the local SQLite file as production storage.
+
+## CloudFront caching
+
+Amplify serves SSR applications through CloudFront. Nitro sets the standard
+`Cache-Control` header on the public SSR HTML and React Router `.data` shell:
+
+```txt
+public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600
+```
+
+Amplify honors that origin header, so no Amplify-specific header file is
+required. CloudFront uses the ten-minute freshness window, can serve the
+stale shell while revalidating, and can serve it during an origin error. The
+framework's client-side actions and private routes keep user-specific data out
+of that public shell.
+
+Amplify's static asset policy already gives static files a one-year maximum
+TTL. The hashed Vite assets are therefore edge-cacheable without adding a
+platform-specific rewrite or custom header. Continuous-deployment releases
+clear the Amplify cache.
+
+Keep Amplify's default **Remove cookies from cache key** setting enabled. The
+SSR handler strips cookies before rendering the public shell, so excluding
+cookies improves the shared cache hit rate without making the shell
+personalized. Do not add a global `Cache-Control` override in `customHttp.yml`:
+it can override `no-store` responses on private routes. Use
+`AGENT_NATIVE_SSR_CACHE` when a deployment needs a shorter or disabled SSR
+policy.
+
+See [SSR Caching](/docs/ssr-caching) for the shared policy and
+[Amplify's cache-key documentation](https://docs.aws.amazon.com/amplify/latest/userguide/cache-key-cookies.html)
+for the hosting setting.
+
+## Verify the deployment
+
+After the first build, check the public URL and confirm that:
+
+1. `/` returns the SSR shell and its `Cache-Control` header.
+2. A hashed `/assets/*` file returns successfully.
+3. Sign-in, database reads and writes, and any OAuth callbacks used by the app
+   work against the configured persistent database.
+
+Amplify's deployment output must contain the Nitro-generated
+`deploy-manifest.json`; a static-only upload is not an SSR deployment.
+
+See [AWS's SSR deployment specification](https://docs.aws.amazon.com/amplify/latest/userguide/ssr-deployment-specification.html)
+and [Nitro's AWS Amplify provider guide](https://nitro.build/deploy/providers/aws-amplify)
+for the platform contract.
+
+## What's next
+
+- [**Deploy an app**](/docs/deploy-an-app) - the complete app path
+- [**Deployment**](/docs/deployment) - database and hosting guidance
+- [**Deployment environment variables**](/docs/deployment-environment-variables) - production configuration
+- [**Calendar**](/docs/template-calendar) - the first-party calendar template

package/docs/content/client-agent-chat.mdx

@@ -234,7 +234,7 @@ If the current screen doesn't match anything the heuristic recognizes and nothin
 ## openAgentSettings(section?) {#openagentsettings}
 
 Use `openAgentSettings()` when an app settings page or setup card should open
-the agent sidebar's Settings tab. Pass a section id such as `"llm"`, `"secrets"`,
+the canonical `/settings` page. Pass a section id such as `"llm"`, `"secrets"`,
 `"automations"`, `"voice"`, or `"limits"` to open a specific section.
 
 ```ts

package/docs/content/deploy-an-app.mdx

@@ -1,7 +1,7 @@
 ---
 title: "Deploy an app"
 description: "Build and deploy one Agent-Native app to Node.js, Vercel, Netlify, Cloudflare, AWS, or Deno."
-search: "deploy app standalone build Nitro preset Node.js Docker Vercel Netlify Cloudflare AWS Lambda Deno Deploy Azure Koyeb Render"
+search: "deploy app standalone build Nitro preset Node.js Docker Vercel Netlify Cloudflare AWS Amplify AWS Lambda Deno Deploy Azure Koyeb Render"
 ---
 
 # Deploy an app
@@ -44,6 +44,7 @@ See the target page for the provider command and runtime details:
 - [**Netlify**](/docs/netlify)
 - [**Cloudflare Pages**](/docs/cloudflare#cloudflare-pages)
 - [**Cloudflare Workers**](/docs/cloudflare#cloudflare-workers)
+- [**AWS Amplify**](/docs/aws-amplify)
 - [**AWS Lambda**](/docs/aws-lambda)
 - [**Deno Deploy**](/docs/deno-deploy)
 - [**Azure Static Web Apps**](/docs/azure-static-web-apps)

package/docs/content/deployment.mdx

@@ -1,7 +1,7 @@
 ---
 title: "Deployment"
 description: "Deploy an Agent-Native app or workspace to a Nitro-compatible platform with a persistent SQL database."
-search: "deployment deploy app workspace hosting database Nitro Node.js Docker Vercel Netlify Cloudflare AWS Lambda Deno Deploy Azure Static Web Apps Koyeb Render"
+search: "deployment deploy app workspace hosting database Nitro Node.js Docker Vercel Netlify Cloudflare AWS Amplify AWS Lambda Deno Deploy Azure Static Web Apps Koyeb Render"
 ---
 
 # Deployment
@@ -79,7 +79,7 @@ contract stay the same.
 
 <!-- i18n-copy-ignore: renderer-only Diagram attributes keep this shared UI block in clean mode. -->
 
-<Diagram id="doc-block-deployment-targets" title="Supported deployment targets" summary="Agent-Native apps can deploy to Node.js, Docker, Vercel, Netlify, Cloudflare Pages, Cloudflare Workers, AWS Lambda, Deno Deploy, Azure Static Web Apps, Koyeb, and Render." frame="hide" renderMode="design">
+<Diagram id="doc-block-deployment-targets" title="Supported deployment targets" summary="Agent-Native apps can deploy to Node.js, Docker, Vercel, Netlify, Cloudflare Pages, Cloudflare Workers, AWS Amplify, AWS Lambda, Deno Deploy, Azure Static Web Apps, Koyeb, and Render." frame="hide" renderMode="design">
 
 ```html
 <!-- i18n-copy-ignore: deployment target logo markup is visual-only; labels are unchanged. -->
@@ -148,6 +148,16 @@ contract stay the same.
     </span>
     <strong>AWS Lambda</strong>
   </a>
+  <a class="deployment-target" href="/docs/aws-amplify">
+    <span class="deployment-target-mark">
+      <img
+        class="deployment-target-logo"
+        src="/integration-logos/aws-lambda.svg"
+        alt=""
+      />
+    </span>
+    <strong>AWS Amplify</strong>
+  </a>
   <a class="deployment-target" href="/docs/deno-deploy">
     <span class="deployment-target-mark">
       <img
@@ -268,7 +278,8 @@ settings or production controls:
 - [**Node.js**](/docs/node-js) - run the default Nitro server preset
 - [**Docker**](/docs/docker) - package the Node.js server in a container
 - [**Vercel**](/docs/vercel), [**Netlify**](/docs/netlify), [**Cloudflare Pages**](/docs/cloudflare#cloudflare-pages), and [**Cloudflare Workers**](/docs/cloudflare#cloudflare-workers) - configure hosted targets
-- [**AWS Lambda**](/docs/aws-lambda) and [**Deno Deploy**](/docs/deno-deploy) - deploy to function and Deno runtimes
+- [**AWS Amplify**](/docs/aws-amplify) and [**AWS Lambda**](/docs/aws-lambda) - deploy Nitro's serverless output on AWS
+- [**Deno Deploy**](/docs/deno-deploy) - deploy to the Deno runtime
 - [**Azure Static Web Apps**](/docs/azure-static-web-apps), [**Koyeb**](/docs/koyeb), and [**Render**](/docs/render) - use additional Nitro providers
 - [Nitro's provider list](https://nitro.build/deploy/providers) - see the broader set of presets Nitro supports
 - [**SSR Caching**](/docs/ssr-caching) - configure the public shell cache

package/docs/content/environment-variables.mdx

@@ -70,6 +70,7 @@ public app behavior, use the config paths above instead.
 | `DATABASE_AUTH_TOKEN`                          | Separate database token when the database provider requires one.                                                                                                        | An opaque provider token, or unset when the URL includes authentication.                                                |
 | `APP_URL`                                      | Optional canonical public origin used for auth, OAuth, A2A, webhooks, and generated links. Netlify and Vercel metadata are inferred when it is unset.                   | An absolute public `http(s)` origin.                                                                                    |
 | `BETTER_AUTH_URL`                              | Optional Better Auth origin override. Known template or request context, `APP_URL`, and platform metadata such as Netlify or Vercel are used when it is unset.          | An absolute public `http(s)` origin.                                                                                    |
+| `BETTER_AUTH_TRUSTED_ORIGINS`                  | Exact browser origins trusted by Better Auth, including configured host aliases.                                                                                        | A comma-separated list of absolute `http(s)` origins; wildcards are not accepted.                                       |
 | `APP_BASE_PATH`                                | Mounts an app under a path such as `/mail`.                                                                                                                             | Unset for a standalone app, or a slash-prefixed path.                                                                   |
 | `PORT`                                         | Local Node/Nitro server port.                                                                                                                                           | A decimal TCP port.                                                                                                     |
 | `NITRO_PRESET`                                 | Build and deployment adapter.                                                                                                                                           | A preset supported by the target host, such as `node`, `netlify`, `vercel`, or `cloudflare_pages`.                      |