@agent-native/core 0.187.0 → 0.187.1-nightly-20260925003003

package/dist/mcp/connect-store.js

@@ -11,10 +11,10 @@
  *     the OAuth 2.0 device-authorization-style CLI flow. Single-use
  *     (`consumed_at`), rate-limited at creation.
  *
- * Mirrors `application-state/store.ts`: lazy `ensureTable()`, `getDbExec()`,
- * `isConnectionError()` swallow so a transient Neon WS drop never 500s.
- * `CREATE TABLE IF NOT EXISTS` only — strictly additive, never DROP / ALTER
- * (shared prod DB rule).
+ * Mirrors `application-state/store.ts`: lazy `ensureTable()` and `getDbExec()`.
+ * Device-code reads propagate connection errors so unreadable cannot look
+ * like an absent authorization. `CREATE TABLE IF NOT EXISTS` only — strictly
+ * additive, never DROP / ALTER (shared prod DB rule).
  */
 import { randomBytes, randomUUID } from "node:crypto";
 import { getDbExec, isConnectionError } from "../db/client.js";
@@ -73,6 +73,7 @@ export async function ensureTable() {
           org_id TEXT,
           status TEXT NOT NULL DEFAULT 'pending',
           token_jti TEXT,
+          catalog_scope TEXT,
           created_at BIGINT,
           expires_at BIGINT,
           consumed_at BIGINT
@@ -83,6 +84,7 @@ export async function ensureTable() {
             await ensureColumnExists("mcp_connect_tokens", "service_name", `ALTER TABLE mcp_connect_tokens ADD COLUMN IF NOT EXISTS service_name TEXT`);
             await ensureColumnExists("mcp_connect_tokens", "created_by", `ALTER TABLE mcp_connect_tokens ADD COLUMN IF NOT EXISTS created_by TEXT`);
             await ensureTableExists("mcp_device_codes", createDeviceCodesSql);
+            await ensureColumnExists("mcp_device_codes", "catalog_scope", `ALTER TABLE mcp_device_codes ADD COLUMN IF NOT EXISTS catalog_scope TEXT`);
         })().catch((err) => {
             // Don't cache a rejected init. A transient DB blip should let the next
             // connect/mint/revoke call retry rather than wedging the process.
@@ -329,7 +331,7 @@ function generateDeviceCode() {
  * Throws `RATE_LIMITED` when the cap is exceeded so the route can map it to a
  * 429.
  */
-export async function createDeviceCode() {
+export async function createDeviceCode(catalogScope = null) {
     await ensureTable();
     const client = getDbExec();
     const now = Date.now();
@@ -353,7 +355,7 @@ export async function createDeviceCode() {
     const userCode = generateUserCode();
     const expiresAt = now + DEVICE_CODE_TTL_MS;
     await client.execute({
-        sql: `INSERT INTO mcp_device_codes (device_code, user_code, owner_email, org_id, status, token_jti, created_at, expires_at, consumed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        sql: `INSERT INTO mcp_device_codes (device_code, user_code, owner_email, org_id, status, token_jti, catalog_scope, created_at, expires_at, consumed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: [
             deviceCode,
             userCode,
@@ -361,6 +363,7 @@ export async function createDeviceCode() {
             null,
             "pending",
             null,
+            catalogScope,
             now,
             expiresAt,
             null,
@@ -373,6 +376,7 @@ export async function createDeviceCode() {
         orgId: null,
         status: "pending",
         tokenJti: null,
+        catalogScope,
         createdAt: now,
         expiresAt,
         consumedAt: null,
@@ -386,46 +390,33 @@ function mapDeviceRow(r) {
         orgId: (r.org_id ?? r.orgId ?? null),
         status: (r.status ?? "pending"),
         tokenJti: (r.token_jti ?? r.tokenJti ?? null),
+        catalogScope: (r.catalog_scope ?? r.catalogScope) === "full" ? "full" : null,
         createdAt: numOrNull(r.created_at ?? r.createdAt),
         expiresAt: numOrNull(r.expires_at ?? r.expiresAt),
         consumedAt: numOrNull(r.consumed_at ?? r.consumedAt),
     };
 }
 export async function getDeviceCode(deviceCode) {
-    try {
-        await ensureTable();
-        const client = getDbExec();
-        const { rows } = await client.execute({
-            sql: `SELECT * FROM mcp_device_codes WHERE device_code = ?`,
-            args: [deviceCode],
-        });
-        if (rows.length === 0)
-            return null;
-        return mapDeviceRow(rows[0]);
-    }
-    catch (err) {
-        if (isConnectionError(err))
-            return null;
-        throw err;
-    }
+    await ensureTable();
+    const client = getDbExec();
+    const { rows } = await client.execute({
+        sql: `SELECT * FROM mcp_device_codes WHERE device_code = ?`,
+        args: [deviceCode],
+    });
+    if (rows.length === 0)
+        return null;
+    return mapDeviceRow(rows[0]);
 }
-async function getDeviceCodeByUserCode(userCode) {
-    try {
-        await ensureTable();
-        const client = getDbExec();
-        const { rows } = await client.execute({
-            sql: `SELECT * FROM mcp_device_codes WHERE user_code = ?`,
-            args: [userCode],
-        });
-        if (rows.length === 0)
-            return null;
-        return mapDeviceRow(rows[0]);
-    }
-    catch (err) {
-        if (isConnectionError(err))
-            return null;
-        throw err;
-    }
+export async function getDeviceCodeByUserCode(userCode) {
+    await ensureTable();
+    const client = getDbExec();
+    const { rows } = await client.execute({
+        sql: `SELECT * FROM mcp_device_codes WHERE user_code = ?`,
+        args: [userCode],
+    });
+    if (rows.length === 0)
+        return null;
+    return mapDeviceRow(rows[0]);
 }
 /**
  * Bind the logged-in user (email + org) to a pending device code, identified

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
-    error?: undefined;
     count: number;
     updated?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated: number;
+    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,8 +26,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/actions/get-observability-review-detail.d.ts

@@ -0,0 +1,7 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    runId: string;
+}, {
+    app: import("../../mcp-client/app-result.js").AgentMcpAppPayload | null;
+    messages: import("../types.js").OutputReviewThreadMessage[];
+}>;
+export default _default;

package/dist/observability/actions/get-observability-review-detail.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+import { fail, defineAction } from "../../action.js";
+import { getOutputReviewDetailForRun } from "../reviews.js";
+export default defineAction({
+    description: "Load the saved preview and full chat transcript for one human-review run.",
+    schema: z.object({
+        runId: z.string().trim().min(1).max(200).describe("Agent review run ID."),
+    }),
+    http: { method: "GET" },
+    agentTool: false,
+    readOnly: true,
+    parallelSafe: true,
+    run: async (args, ctx) => {
+        const userId = ctx?.userEmail;
+        if (!userId)
+            fail("Sign in to view review details.", { statusCode: 401 });
+        const result = await getOutputReviewDetailForRun({
+            runId: args.runId,
+            userId,
+        });
+        if (!result.found)
+            fail("That agent output is no longer available.", { statusCode: 404 });
+        return { app: result.app, messages: result.messages };
+    },
+});

package/dist/observability/reviews.d.ts

@@ -1,5 +1,5 @@
 import type { AgentMcpAppPayload } from "../mcp-client/app-result.js";
-import type { OutputReviewListRow } from "./types.js";
+import type { OutputReviewDetail, OutputReviewListRow } from "./types.js";
 export declare function getOutputReviewAppForRun(opts: {
     runId: string;
     userId: string;
@@ -9,6 +9,14 @@ export declare function getOutputReviewAppForRun(opts: {
     found: true;
     app: AgentMcpAppPayload | null;
 }>;
+export declare function getOutputReviewDetailForRun(opts: {
+    runId: string;
+    userId: string;
+}): Promise<{
+    found: false;
+} | ({
+    found: true;
+} & OutputReviewDetail)>;
 export declare function listOutputReviews(opts: {
     sinceMs: number;
     limit: number;

package/dist/observability/reviews.js

@@ -157,6 +157,26 @@ export async function getOutputReviewAppForRun(opts) {
         app: getInlineAppForRun(summary, thread.threadData ?? null),
     };
 }
+export async function getOutputReviewDetailForRun(opts) {
+    const summary = await getTraceSummary(opts.runId, { userId: opts.userId });
+    if (!summary)
+        return { found: false };
+    if (!summary.threadId) {
+        return { found: true, app: null, messages: [] };
+    }
+    const threads = await resolveThreadsAccess(opts.userId, [summary.threadId]);
+    const thread = threads.get(summary.threadId);
+    if (!thread)
+        return { found: false };
+    const threadMessages = thread.threadData
+        ? readThreadMessages(thread.threadData)
+        : [];
+    return {
+        found: true,
+        app: getInlineAppForRun(summary, thread.threadData ?? null),
+        messages: threadMessages.map(({ role, text }) => ({ role, text })),
+    };
+}
 export async function listOutputReviews(opts) {
     const summaries = await getTraceSummaries({
         sinceMs: opts.sinceMs,

package/dist/observability/routes.d.ts

@@ -41,9 +41,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    id?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
+    id?: undefined;
     error?: undefined;
     ok?: undefined;
 } | {
@@ -53,15 +53,15 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error?: undefined;
     ok?: undefined;
 } | {
-    id?: undefined;
     summary?: undefined;
     spans?: undefined;
+    id?: undefined;
     error: any;
     ok?: undefined;
 } | {
-    id?: undefined;
     summary?: undefined;
     spans?: undefined;
+    id?: undefined;
     error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/types.d.ts

@@ -85,6 +85,14 @@ export interface OutputReviewListRow {
     feedback: FeedbackEntry[];
     instructionUpdate: InstructionUpdate | null;
 }
+export interface OutputReviewThreadMessage {
+    role: "user" | "assistant";
+    text: string;
+}
+export interface OutputReviewDetail {
+    app: AgentMcpAppPayload | null;
+    messages: OutputReviewThreadMessage[];
+}
 /** @deprecated Use OutputReviewListRow for list data. */
 export interface OutputReviewRow extends OutputReviewListRow {
     inlineApp?: AgentMcpAppPayload;

package/dist/org/handlers.d.ts

@@ -53,9 +53,9 @@ export declare const setWorkspaceAppDefaultVisibilityHandler: import("h3").Event
 /** POST /_agent-native/org — create a new organization */
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     success: boolean;
-    id?: undefined;
     name?: undefined;
     role?: undefined;
+    id?: undefined;
 } | {
     success?: undefined;
     id: string;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,8 +75,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    message?: undefined;
     id?: undefined;
+    found?: undefined;
     deleted?: undefined;
     providers: {
         id: string;
@@ -89,11 +89,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     }[];
     count: number;
     provider?: undefined;
-    found?: undefined;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     id?: undefined;
     count?: undefined;
     deleted?: undefined;
@@ -102,8 +101,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     count?: undefined;
     deleted?: undefined;
     providers?: undefined;
@@ -112,22 +111,23 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     id: string;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
+    found?: undefined;
     count?: undefined;
     providers?: undefined;
     provider?: undefined;
-    found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
+    found?: undefined;
     count?: undefined;
     deleted?: undefined;
     providers?: undefined;
     provider?: undefined;
-    found?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -313,6 +313,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
     }, {
         id?: undefined;
         deleted?: undefined;
+        provider?: undefined;
+        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -323,16 +325,14 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
-        provider?: undefined;
-        found?: undefined;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
         id?: undefined;
         deleted?: undefined;
-        count?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
@@ -340,19 +340,19 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         message?: undefined;
     } | {
         deleted?: undefined;
-        count?: undefined;
-        providers?: undefined;
         provider?: undefined;
+        providers?: undefined;
+        count?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
-        count?: undefined;
-        providers?: undefined;
         provider?: undefined;
         found?: undefined;
+        providers?: undefined;
+        count?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
@@ -360,10 +360,10 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         message?: undefined;
     } | {
         deleted?: undefined;
-        count?: undefined;
-        providers?: undefined;
         provider?: undefined;
         found?: undefined;
+        providers?: undefined;
+        count?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/scripts/db/query.js

@@ -5,7 +5,7 @@
  * execution uses PGlite and hosted execution uses PostgreSQL.
  */
 import path from "node:path";
-import { getRuntimeDatabaseUrl, toPostgresParams } from "../../db/client.js";
+import { assertHostedRuntimeDatabase, getRuntimeDatabaseUrl, toPostgresParams, } from "../../db/client.js";
 import { getRequestOrgId, getRequestUserEmail, } from "../../server/request-context.js";
 import { parseArgs, fail } from "../utils.js";
 import { tryForwardDbQueryToDevServer } from "./dev-query-proxy.js";
@@ -78,6 +78,11 @@ export async function runDbQuery(options) {
         !/\bLIMIT\b/i.test(stripped)) {
         query = `${options.sql} LIMIT ${options.limit}`;
     }
+    // Only guarded when falling back to the ambient resolution: an explicit
+    // options.databaseUrl (e.g. --db pointing at a snapshot directory) is a
+    // deliberate operator choice, not the silent fallback this guards against.
+    if (!options.databaseUrl)
+        assertHostedRuntimeDatabase();
     // Must match the resolver `tryForwardDbQueryToDevServer` hashes for its
     // forward-eligibility check (dev-query-proxy.ts) — otherwise the same
     // command reads a different database depending on whether forwarding

package/dist/server/agent-engine-api-key-route.d.ts

@@ -56,10 +56,10 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     ok: boolean;
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -6,10 +6,10 @@
  */
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     models?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     models: string[];
+    error?: undefined;
 }>>;

package/dist/server/agent-teams.js

@@ -1419,7 +1419,8 @@ export async function processAgentTeamRun(opts) {
                             if (u.inputTokens > 0 ||
                                 u.outputTokens > 0 ||
                                 u.cacheReadTokens > 0 ||
-                                u.cacheWriteTokens > 0) {
+                                u.cacheWriteTokens > 0 ||
+                                u.builderCreditsUsed != null) {
                                 const { recordUsage } = await import("../usage/store.js");
                                 const label = payload.name
                                     ? `agent-team:${payload.name}`
@@ -1430,6 +1431,8 @@ export async function processAgentTeamRun(opts) {
                                     outputTokens: u.outputTokens,
                                     cacheReadTokens: u.cacheReadTokens,
                                     cacheWriteTokens: u.cacheWriteTokens,
+                                    builderCreditsUsed: u.builderCreditsUsed,
+                                    engineName: u.engineName ?? config.engine.name,
                                     model: u.model,
                                     label,
                                 });

package/dist/server/auth.js

@@ -672,6 +672,22 @@ function forwardBetterAuthSetCookies(event, result, options = {}) {
         }
     }
 }
+async function rotateTwoFactorSession(event, session, result) {
+    const headers = result?.headers;
+    const cookieToken = headers && extractSessionTokenFromSetCookies({ headers });
+    if (!cookieToken)
+        return;
+    if (!session.token)
+        throw new Error("The current session token is missing.");
+    const replacement = await resolveBetterAuthSessionToken(cookieToken);
+    if (!replacement) {
+        throw new Error("Better Auth replaced the session without a resolvable token.");
+    }
+    if (replacement.token === session.token)
+        return;
+    await replaceSession(session.token, replacement.token, replacement.email);
+    setFrameworkSessionCookie(event, replacement.token);
+}
 function betterAuthApiBody(result) {
     if (!result || typeof result !== "object")
         return {};
@@ -872,8 +888,13 @@ function appendVerifiedParamToLocation(location) {
     return `${beforeHash}${sep}verified=1${hash}`;
 }
 async function ensureEmailVerifiedForRedirect(request, response) {
-    const email = (await emailFromVerificationResponseSession(response)) ??
-        decodeEmailVerificationTokenEmail(request);
+    let email = decodeEmailVerificationTokenEmail(request);
+    try {
+        email = (await emailFromVerificationResponseSession(response)) ?? email;
+    }
+    catch (error) {
+        console.warn("[auth] could not resolve the magic-link session for verification repair:", error instanceof Error ? error.constructor.name : typeof error);
+    }
     if (!email)
         return;
     try {
@@ -909,17 +930,12 @@ async function ensureEmailVerifiedForRedirect(request, response) {
     }
 }
 async function emailFromBetterAuthSessionToken(token) {
-    try {
-        const db = getDbExec();
-        const { rows } = await db.execute({
-            sql: 'SELECT u.email FROM "session" s JOIN "user" u ON u.id = s.user_id WHERE s.token = ? LIMIT 1',
-            args: [token],
-        });
-        return normalizeAuthEmail(rows[0]?.email ?? rows[0]?.[0]);
-    }
-    catch {
-        return null;
-    }
+    const db = getDbExec();
+    const { rows } = await db.execute({
+        sql: 'SELECT u.email FROM "session" s JOIN "user" u ON u.id = s.user_id WHERE s.token = ? LIMIT 1',
+        args: [token],
+    });
+    return normalizeAuthEmail(rows[0]?.email ?? rows[0]?.[0]);
 }
 async function emailFromVerificationResponseSession(response) {
     const sessionToken = extractSessionTokenFromAuthResponse(response);
@@ -1019,7 +1035,15 @@ async function persistMagicLinkLegacySession(event, response) {
     const rawToken = extractSessionTokenFromAuthResponse(response);
     if (!rawToken)
         return;
-    const resolved = await resolveBetterAuthSessionToken(rawToken);
+    let resolved;
+    try {
+        resolved = await resolveBetterAuthSessionToken(rawToken);
+    }
+    catch (error) {
+        console.error("[auth] failed to resolve magic-link session:", error instanceof Error ? error.constructor.name : typeof error);
+        setFrameworkSessionCookie(event, decodeSessionCookieValue(rawToken));
+        return;
+    }
     const token = resolved?.token ?? decodeSessionCookieValue(rawToken);
     setFrameworkSessionCookie(event, token);
     if (!resolved)
@@ -1342,6 +1366,24 @@ export async function addSession(token, email) {
     // resolution for it is now wrong.
     invalidateSessionEmailCache();
 }
+async function replaceSession(oldToken, newToken, email) {
+    await ensureSessionTable();
+    const client = getDbExec();
+    if (!client.transaction) {
+        throw new Error("Session rotation requires database transactions.");
+    }
+    await retryIfSessionsMissing(() => client.transaction(async (tx) => {
+        await tx.execute({
+            sql: `INSERT INTO sessions (token, email, created_at) VALUES (?, ?, ?) ON CONFLICT (token) DO UPDATE SET email=EXCLUDED.email, created_at=EXCLUDED.created_at`,
+            args: [newToken, email ?? null, Date.now()],
+        });
+        await tx.execute({
+            sql: `DELETE FROM sessions WHERE token = ?`,
+            args: [oldToken],
+        });
+    }));
+    invalidateSessionEmailCache();
+}
 export async function hasLegacySessionForEmail(email) {
     await ensureSessionTable();
     const client = getDbExec();
@@ -4594,9 +4636,8 @@ async function mountBetterAuthRoutes(app, options) {
                 headers: betterAuthHeadersForSession(event, session.token),
                 returnHeaders: true,
             });
-            forwardBetterAuthSetCookies(event, result, {
-                excludeSessionCookies: true,
-            });
+            await rotateTwoFactorSession(event, session, result);
+            forwardBetterAuthSetCookies(event, result);
             return betterAuthApiBody(result);
         }
         catch (error) {
@@ -4619,9 +4660,8 @@ async function mountBetterAuthRoutes(app, options) {
                 headers: betterAuthHeadersForSession(event, session.token),
                 returnHeaders: true,
             });
-            forwardBetterAuthSetCookies(event, result, {
-                excludeSessionCookies: true,
-            });
+            await rotateTwoFactorSession(event, session, result);
+            forwardBetterAuthSetCookies(event, result);
             return betterAuthApiBody(result);
         }
         catch (error) {

package/dist/server/better-auth-instance.js

@@ -25,7 +25,7 @@ import { setCookie } from "h3";
 import { enterpriseAuthAdaptersBuilt, getAppConfig, } from "../app-config/index.js";
 import { TEMPLATES } from "../cli/templates-meta.js";
 import { getDbExec } from "../db/client.js";
-import { getRuntimeDatabaseUrl, getPgliteClient, isPgliteUrl, loadPgliteDrizzle, pgliteDrizzleClient, pgPoolOptions, neonPoolOptions, guardNeonPool, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, } from "../db/client.js";
+import { assertHostedRuntimeDatabase, getRuntimeDatabaseUrl, getPgliteClient, isPgliteUrl, loadPgliteDrizzle, pgliteDrizzleClient, pgPoolOptions, neonPoolOptions, guardNeonPool, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, } from "../db/client.js";
 import { CORE_CHANGE_EMAIL_CONFIRMATION_EMAIL_ID, CORE_CHANGE_EMAIL_VERIFICATION_EMAIL_ID, CORE_MAGIC_LINK_EMAIL_ID, CORE_RESET_PASSWORD_EMAIL_ID, CORE_VERIFY_SIGNUP_EMAIL_ID, } from "../email-catalog/system-emails.js";
 import { executeIdentityRekey, rekeyIdentity, resumePendingIdentityRekeys, verifiedEmailChangeFromToken, } from "../identity/rekey.js";
 import { saveOAuthTokens } from "../oauth-tokens/store.js";
@@ -2010,6 +2010,12 @@ async function createBetterAuthInstance(config) {
     return auth;
 }
 export async function buildDatabaseConfig() {
+    // getDbExec() (client.ts's initClient) and createGetDb()'s Drizzle opener
+    // both refuse a hosted invocation with no database URL before resolving
+    // it. This adapter resolves the same runtime URL but used to skip the
+    // refusal entirely, so signup/login reaching this opener first silently
+    // opened the ephemeral per-instance PGlite file instead of failing loudly.
+    assertHostedRuntimeDatabase();
     const url = getRuntimeDatabaseUrl("pglite:./data/pglite");
     const { buildResilientNeonPool, buildResilientPostgresJsClient, isNeonUrl } = await import("../db/create-get-db.js");
     if (isPgliteUrl(url)) {

package/dist/server/core-routes-plugin.d.ts

@@ -419,8 +419,8 @@ export declare function createPublicRemoteAgentsHandler(discover?: PublicAgentDi
     error: string;
     agents?: undefined;
 } | {
-    agents: Omit<import("./agent-discovery.js").DiscoveredAgent, "auth" | "kind">[];
     error?: undefined;
+    agents: Omit<import("./agent-discovery.js").DiscoveredAgent, "auth" | "kind">[];
 }>>;
 export declare function getBuilderConnectErrorDisposition(error: unknown, connectAttemptId: string | null): "correlated" | "legacy" | null;
 export declare function getBuilderConnectErrorKey(ownerEmail: string, connectAttemptId?: string | null): string;