@agent-native/core 0.201.0-nightly-20261005153421 → 0.201.0

package/dist/search/index-store.js

@@ -42,6 +42,53 @@ export function ensureSearchIndexTables(injectedClient) {
     });
     return ensured;
 }
+/**
+ * Raises an index's target version, leaving the rebuild for the first drain
+ * at that version to claim. A process on a lower version reads the index as
+ * outdated from then on and serves its previous search. Returns the target
+ * now in force, which is higher than `version` when a newer build raised it.
+ */
+export async function raiseSearchIndexTarget(exec, target) {
+    await exec.execute({
+        sql: `INSERT INTO ${SEARCH_INDEX_STATE_TABLE} (app, resource_type, target_version)
+          VALUES (?, ?, ?)
+          ON CONFLICT (app, resource_type) DO UPDATE SET
+            target_version = EXCLUDED.target_version,
+            rebuild_high_seq = NULL,
+            rebuild_started_at = NULL,
+            rebuild_completed_at = NULL
+          WHERE ${SEARCH_INDEX_STATE_TABLE}.target_version < EXCLUDED.target_version`,
+        args: [target.app, target.type, target.version],
+    });
+    const { rows } = await exec.execute({
+        sql: `SELECT target_version FROM ${SEARCH_INDEX_STATE_TABLE} WHERE app = ? AND resource_type = ?`,
+        args: [target.app, target.type],
+    });
+    const [row] = rows;
+    if (!row)
+        throw new Error("Raising the search index target left no row.");
+    return Number(row.target_version);
+}
+/**
+ * Marks the index as needing a rebuild at its current version, including a
+ * rebuild still queueing rows: its queue may predate the writes this
+ * invalidation is for. Nothing to do before the search tables exist: there
+ * is no index yet.
+ */
+export async function invalidateSearchIndex(exec, target) {
+    const { rows } = await exec.execute({
+        sql: `SELECT 1 AS present WHERE to_regclass(?) IS NOT NULL`,
+        args: [SEARCH_INDEX_STATE_TABLE],
+    });
+    if (!rows.length)
+        return;
+    await exec.execute({
+        sql: `UPDATE ${SEARCH_INDEX_STATE_TABLE}
+          SET rebuild_high_seq = NULL, rebuild_started_at = NULL, rebuild_completed_at = NULL
+          WHERE app = ? AND resource_type = ?`,
+        args: [target.app, target.type],
+    });
+}
 async function ensureAll(injectedClient) {
     const options = { injectedClient };
     await ensureTableExists(SEARCH_RESOURCES_TABLE, SEARCH_RESOURCES_CREATE_SQL, options);

package/dist/search/indexer.js

@@ -13,7 +13,7 @@ import { getAppConfig } from "../app-config/index.js";
 import { getDbExec } from "../db/client.js";
 import { RESOURCE_CHANGE_MAX_ATTEMPTS, claimResourceChanges, completeResourceChanges, enqueueAllResourceChanges, failResourceChanges, hasPendingResourceChanges, resourceChangeBacklogColumns, resourceChangeCaptureInstalled, subscribeResourceChangeConsumer, } from "../resource-changes/store.js";
 import { getRequestRunContext } from "../server/request-context.js";
-import { SEARCH_INDEX_STATE_TABLE, SEARCH_RESOURCES_TABLE, } from "./index-store.js";
+import { SEARCH_INDEX_STATE_TABLE, SEARCH_RESOURCES_TABLE, invalidateSearchIndex, } from "./index-store.js";
 import { SEARCH_CHANGE_CONSUMER, listSearchableResources, searchableResourceSource, } from "./registry.js";
 import { buildSearchVector, normalizeSearchText, utf8ByteLength, } from "./tokenize.js";
 const CLAIM_BATCH = 50;
@@ -247,7 +247,7 @@ async function captureInstalled(exec, registration, runtime) {
     const source = searchableResourceSource(registration);
     const installed = await resourceChangeCaptureInstalled(exec, source);
     if (!installed) {
-        await invalidateIndex(exec, registration);
+        await invalidateSearchIndex(exec, registration);
         if (runtime.captureInstalled !== false) {
             console.error(`[search] Change capture for ${registration.app}/${registration.type} is missing or disabled on table "${source.table}". ` +
                 "Add searchIndexMigration() for it to the app's runMigrations list, or re-enable its triggers. " +
@@ -261,27 +261,6 @@ async function captureInstalled(exec, registration, runtime) {
     runtime.captureVerifiedAt = Date.now();
     return installed;
 }
-/**
- * Marks the index as needing a rebuild at its current version. Nothing to do
- * before the search tables exist: there is no index yet.
- */
-async function invalidateIndex(exec, registration) {
-    const { rows } = await exec.execute({
-        sql: `SELECT to_regclass(?) IS NOT NULL AS present`,
-        args: [SEARCH_INDEX_STATE_TABLE],
-    });
-    const [table] = rows;
-    if (!table)
-        throw new Error("Looking up the search index table returned no row.");
-    if (!flag(table.present))
-        return;
-    await exec.execute({
-        sql: `UPDATE ${SEARCH_INDEX_STATE_TABLE}
-          SET rebuild_high_seq = NULL, rebuild_started_at = NULL, rebuild_completed_at = NULL
-          WHERE app = ? AND resource_type = ? AND rebuild_high_seq IS NOT NULL`,
-        args: [registration.app, registration.type],
-    });
-}
 function flag(value) {
     return value === true || value === "t" || value === "true";
 }
@@ -332,7 +311,15 @@ function rebuildNeedsQueueing(registration, state) {
  * one, then queues every source row once. Only one process wins either, and
  * from a version bump on, the fence stops older processes. Queueing replaces
  * changes they already hold, so none of their in-flight work can complete
- * what the rebuild queued.
+ * what the rebuild queued. The queue counts toward completion only if no
+ * other transaction has written the index state since the claim: an
+ * invalidation or a later claim meanwhile means it may miss writes.
+ *
+ * The claim is the row's `xmin`, the transaction that last wrote it, not its
+ * timestamp: `now()` is when a transaction began, so a later claim can carry
+ * the same one. Writes in the claim's own transaction keep its `xmin`, so
+ * nothing may invalidate between this claim and its publish on a shared
+ * transaction.
  */
 async function startRebuild(exec, registration, state) {
     const { rows } = !state || state.targetVersion < registration.version
@@ -345,7 +332,7 @@ async function startRebuild(exec, registration, state) {
                   rebuild_high_seq = NULL,
                   rebuild_completed_at = NULL
                 WHERE ${SEARCH_INDEX_STATE_TABLE}.target_version < EXCLUDED.target_version
-                RETURNING target_version`,
+                RETURNING xmin::text AS claim`,
             args: [registration.app, registration.type, registration.version],
         })
         : await exec.execute({
@@ -353,7 +340,7 @@ async function startRebuild(exec, registration, state) {
                 WHERE app = ? AND resource_type = ? AND target_version = ?
                   AND rebuild_high_seq IS NULL AND rebuild_completed_at IS NULL
                   AND (rebuild_started_at IS NULL OR rebuild_started_at < now() - make_interval(secs => ?))
-                RETURNING target_version`,
+                RETURNING xmin::text AS claim`,
             args: [
                 registration.app,
                 registration.type,
@@ -361,18 +348,28 @@ async function startRebuild(exec, registration, state) {
                 REBUILD_ENQUEUE_RETRY_MS / 1000,
             ],
         });
-    if (!rows.length)
+    const [claimed] = rows;
+    if (!claimed)
         return;
     const highSeq = await enqueueAllResourceChanges(exec, searchableResourceSource(registration), SEARCH_CHANGE_CONSUMER, "rebuild");
     await exec.execute({
         sql: `UPDATE ${SEARCH_INDEX_STATE_TABLE} SET rebuild_high_seq = ?::bigint
-          WHERE app = ? AND resource_type = ? AND target_version = ?`,
-        args: [highSeq, registration.app, registration.type, registration.version],
+          WHERE app = ? AND resource_type = ? AND target_version = ?
+            AND xmin = ?::xid`,
+        args: [
+            highSeq,
+            registration.app,
+            registration.type,
+            registration.version,
+            String(claimed.claim),
+        ],
     });
 }
 /**
- * Marks the rebuild complete once every change it queued is processed.
- * Returns whether the state may have changed.
+ * Marks the rebuild complete once every change it queued is processed, if
+ * it's still the rebuild that was checked: an invalidation meanwhile clears
+ * its highest `seq`, which leaves the rows to be queued again. Returns
+ * whether the state may have changed.
  */
 async function completeRebuildIfDone(exec, registration, state) {
     if (state.rebuildHighSeq === null)
@@ -386,8 +383,14 @@ async function completeRebuildIfDone(exec, registration, state) {
         sql: `UPDATE ${SEARCH_INDEX_STATE_TABLE}
           SET index_version = target_version, rebuild_completed_at = now()
           WHERE app = ? AND resource_type = ? AND target_version = ? AND rebuild_completed_at IS NULL
+            AND rebuild_high_seq = ?::bigint
           RETURNING target_version`,
-        args: [registration.app, registration.type, state.targetVersion],
+        args: [
+            registration.app,
+            registration.type,
+            state.targetVersion,
+            state.rebuildHighSeq,
+        ],
     });
     if (rows.length) {
         // Rows whose source row is gone are deletes the feed missed: the source

package/dist/search/registry.d.ts

@@ -45,9 +45,12 @@ export declare function listSearchableResources(): SearchableResourceRegistratio
 export declare function unregisterSearchableResource(app: string, type: string): void;
 export declare function searchableResourceSource(registration: SearchableResourceRegistration): ResourceChangeSource;
 /**
- * A named migration that creates the search tables and installs change
- * capture on the registration's table. Add it to the app's `runMigrations`
- * list with the app's next version number.
+ * A named migration that creates the search tables, raises the index's
+ * target to the registration's version, and installs change capture on the
+ * registration's table. Add it to the app's `runMigrations`
+ * list with the app's next version number. It's recorded under `name` plus a
+ * fingerprint of the capture SQL, so a release that changes that SQL installs
+ * it again.
  */
 export declare function searchIndexMigration(registration: SearchableResourceRegistration, entry: {
     version: number;

package/dist/search/registry.js

@@ -1,8 +1,8 @@
 import { getTableName } from "drizzle-orm";
 import { deferMigration } from "../db/migrations.js";
 import { registerRecurringSweepHandler } from "../jobs/sweep-hooks.js";
-import { assertResourceKey, installResourceChangeCapture, registerAfterWriteDrain, resourceChangeTriggerNames, } from "../resource-changes/store.js";
-import { ensureSearchIndexTables } from "./index-store.js";
+import { assertResourceKey, installResourceChangeCapture, registerAfterWriteDrain, resourceChangeCaptureFingerprint, resourceChangeCaptureInstalled, resourceChangeTriggerNames, } from "../resource-changes/store.js";
+import { ensureSearchIndexTables, invalidateSearchIndex, raiseSearchIndexTarget, } from "./index-store.js";
 /** The change-feed consumer name the search index subscribes as. */
 export const SEARCH_CHANGE_CONSUMER = "search";
 const registrations = new Map();
@@ -73,21 +73,43 @@ export function searchableResourceSource(registration) {
     };
 }
 /**
- * A named migration that creates the search tables and installs change
- * capture on the registration's table. Add it to the app's `runMigrations`
- * list with the app's next version number.
+ * A named migration that creates the search tables, raises the index's
+ * target to the registration's version, and installs change capture on the
+ * registration's table. Add it to the app's `runMigrations`
+ * list with the app's next version number. It's recorded under `name` plus a
+ * fingerprint of the capture SQL, so a release that changes that SQL installs
+ * it again.
  */
 export function searchIndexMigration(registration, entry) {
+    const source = searchableResourceSource(registration);
     return {
         version: entry.version,
-        name: entry.name,
+        // Under the bare name, a database that recorded an earlier build's
+        // capture would never get this one, and search would stay on the
+        // fallback for good.
+        name: `${entry.name}@${resourceChangeCaptureFingerprint(source)}`,
         sql: {},
         run: async (exec) => {
             await ensureSearchIndexTables(exec);
-            const installed = await installResourceChangeCapture(exec, searchableResourceSource(registration), SEARCH_CHANGE_CONSUMER);
-            // A busy table: try again on the next boot rather than block writes.
+            // Before capture exists: a build still running a lower version would
+            // otherwise see this capture, finish a rebuild at its own version, and
+            // answer from rows it didn't write.
+            const target = await raiseSearchIndexTarget(exec, registration);
+            // A newer build owns the index and its capture, which this build's
+            // older SQL would replace.
+            if (target > registration.version)
+                return;
+            const hadCapture = await resourceChangeCaptureInstalled(exec, source);
+            const installed = await installResourceChangeCapture(exec, source, SEARCH_CHANGE_CONSUMER);
+            // A busy table: try again at the next migration run, which serverless
+            // hosts reach only at their next release, rather than block writes.
             if (!installed)
                 return deferMigration();
+            // Writes made while capture was missing were never recorded. A search
+            // that saw it missing has already discarded the finished index, but
+            // nothing guarantees one ran.
+            if (!hadCapture)
+                await invalidateSearchIndex(exec, registration);
         },
     };
 }

package/dist/secrets/routes.d.ts

@@ -73,32 +73,32 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
+    error?: undefined;
     errorCode?: undefined;
     retryable?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     ok?: undefined;
     error: string;
     note?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -126,11 +126,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-chat-plugin.js

@@ -49,6 +49,7 @@ import { normalizeDatabaseToolsMode } from "../scripts/db/tool-mode.js";
 import { getSetting, putSetting } from "../settings/store.js";
 import { retryContextFromRequest, } from "../shared/agent-chat-run-not-started.js";
 import { ANALYTICS_CLIENT_PLATFORM_BODY_FIELD, normalizeAnalyticsClientPlatform, } from "../shared/analytics-platform.js";
+import { backgroundAgentTurnIdForReceipt } from "../shared/background-agent-session.js";
 import { docsUrl } from "../shared/docs-url.js";
 import { stripSqlParams } from "../shared/error-noise.js";
 import { track } from "../tracking/registry.js";
@@ -2901,6 +2902,22 @@ export function createAgentChatPlugin(options) {
                             ? { refusedRetry: details.retryContext ?? {} }
                             : {}),
                     });
+                    // Background agent sessions send their operation id as
+                    // queuedMessageId (Content binds comment AI turns to it). It never
+                    // enters the queue, so it has no promotion claim; the session's
+                    // derived turn id is what marks the request as one.
+                    const queuedMessage = !details.queuedMessageId
+                        ? undefined
+                        : details.turnId ===
+                            backgroundAgentTurnIdForReceipt(threadId, details.queuedMessageId)
+                            ? {
+                                kind: "background-operation",
+                                id: details.queuedMessageId,
+                            }
+                            : {
+                                id: details.queuedMessageId,
+                                claimId: details.queuedMessageClaimId,
+                            };
                     let submissionFailure;
                     await updateThreadData(threadId, "{}", "", thread.preview, thread.messageCount, {
                         transformThreadData: (threadData) => {
@@ -2917,12 +2934,7 @@ export function createAgentChatPlugin(options) {
                                 submissionFailure = "invalid_thread_data";
                                 return threadData;
                             }
-                            const result = applySubmittedUserMessage(repo, userMessage, details.queuedMessageId
-                                ? {
-                                    id: details.queuedMessageId,
-                                    claimId: details.queuedMessageClaimId,
-                                }
-                                : undefined);
+                            const result = applySubmittedUserMessage(repo, userMessage, queuedMessage);
                             if (!("repo" in result)) {
                                 submissionFailure = result.status;
                                 return threadData;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -66,12 +66,12 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     code: any;
 } | {
     errorCode?: undefined;
-    error?: undefined;
     code?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
     defaultModel?: import("./agent-engine-default-model-route.js").SavedKeyDefaultModelOutcome;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-default-model-route.d.ts

@@ -8,8 +8,8 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  * resolveEngine's credential detection.
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
     scope?: undefined;
 } | {
     ok: boolean;

package/dist/server/agent-run-context.js

@@ -1,6 +1,7 @@
 import { createError, getHeader } from "h3";
 import { ANALYTICS_CLIENT_PLATFORM_BODY_FIELD, ANALYTICS_CLIENT_PLATFORM_HEADER, normalizeAnalyticsClientPlatform, } from "../shared/analytics-platform.js";
 import { SYNTHETIC_TRAFFIC_HEADER, isSyntheticTrafficValue, } from "../shared/test-traffic.js";
+import { CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE, isCredentialMembershipUnavailable, } from "./credential-membership-unavailable.js";
 import { getRequestContext, getRequestIdentityAuthenticatedAtMs, getRequestIdentitySessionToken, runWithRequestContext, } from "./request-context.js";
 const resolveOrgIdForEmail = (...args) => import("../org/context.js").then(({ resolveOrgIdForEmail }) => resolveOrgIdForEmail(...args));
 const getOrgContext = (...args) => import("../org/context.js").then(({ getOrgContext }) => getOrgContext(...args));
@@ -99,6 +100,14 @@ export async function resolveAgentRunOwnerContext(event, options = {}) {
         return seeded;
     const { getSession } = await import("./auth.js");
     const session = await getSession(event);
+    if (!session?.email && isCredentialMembershipUnavailable(event)) {
+        throw createError({
+            statusCode: 503,
+            statusMessage: "Service Unavailable",
+            message: CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE,
+            headers: { "Retry-After": "5" },
+        });
+    }
     if (session?.email) {
         const orgScope = getRequestContext()?.orgScope;
         const identityAuthenticatedAtMs = getRequestIdentityAuthenticatedAtMs(event, session.email);

package/dist/server/attribution.d.ts

@@ -31,6 +31,8 @@ export interface FirstTouchAttribution {
     vector_source?: string;
     landing_path?: string;
     landing_referrer?: string;
+    site_referrer?: string;
+    site_landing_path?: string;
     landed_at?: string;
     capture_truncated?: string;
 }

package/dist/server/attribution.js

@@ -15,6 +15,8 @@ const STRING_FIELDS = [
     "vector_source",
     "landing_path",
     "landing_referrer",
+    "site_referrer",
+    "site_landing_path",
     "landed_at",
     "capture_truncated",
 ];
@@ -111,8 +113,10 @@ export function deriveReferralSource(ft) {
         path.includes("/share-plan/")) {
         return "plan_share";
     }
-    if (isExternalReferrerHost(ft?.landing_referrer))
+    if (isExternalReferrerHost(ft?.landing_referrer) ||
+        isExternalReferrerHost(ft?.site_referrer)) {
         return "external";
+    }
     return "direct";
 }
 export function deriveSignupAttribution(ft) {
@@ -139,6 +143,8 @@ export function deriveSignupAttribution(ft) {
     setIf("vector_source", ft.vector_source);
     setIf("first_touch_path", ft.landing_path);
     setIf("landing_referrer", ft.landing_referrer);
+    setIf("site_referrer", ft.site_referrer);
+    setIf("site_landing_path", ft.site_landing_path);
     if (ft.capture_truncated === "1")
         out.attribution_truncated = "true";
     return out;

package/dist/server/auth.js

@@ -69,6 +69,7 @@ import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getBetterAut
 import { BUILDER_CONNECT_PARAM, BUILDER_RELAY_PATH, BUILDER_RELAY_STATE_PARAM, verifyBuilderConnectTokenAndGetOwner, verifyBuilderPreviewRelayStateForCallback, } from "./builder-browser.js";
 import { frameworkSessionHintCookieName, resolveAuthCookieNamespace, } from "./cookie-namespace.js";
 import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
+import { isCredentialMembershipUnavailable, markCredentialMembershipUnavailable, respondCredentialMembershipUnavailable, } from "./credential-membership-unavailable.js";
 import { resolveDeployEnvironment } from "./deploy-environment.js";
 import { getSignInBlockingSettingKeys } from "./deploy-settings.js";
 import { readDesktopSso, writeDesktopSso, clearDesktopSso, } from "./desktop-sso.js";
@@ -777,7 +778,12 @@ export async function getMcpOAuthBearerSession(event) {
         const result = await verifyAuth(authHeader, undefined, {
             resourceUrl: getMcpOAuthAudiences(event),
             allowDevOpen: false,
+            requestOrigin: getOrigin(event),
         });
+        if (!result.authed && result.unavailable) {
+            markCredentialMembershipUnavailable(event);
+            return null;
+        }
         const identity = result.authed ? result.identity : undefined;
         if (!identity?.userEmail)
             return null;
@@ -3008,6 +3014,9 @@ function createAuthGuardFn(app) {
             }
             return;
         }
+        if (isCredentialMembershipUnavailable(event)) {
+            return respondCredentialMembershipUnavailable(event);
+        }
         if (p.startsWith("/api/") || p.startsWith("/_agent-native/")) {
             setResponseStatus(event, 401);
             // Dev-only breadcrumb for the loopback origin-label trap: the session

package/dist/server/credential-membership-unavailable.d.ts

@@ -0,0 +1,13 @@
+import { type H3Event } from "h3";
+export declare const CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE = "Organization membership could not be verified. Retry shortly.";
+/**
+ * Records that this request's bearer token verified but its organization
+ * membership could not be checked. Such a request has no session, but it is
+ * not unauthenticated: answer a retryable 503, never a 401 that tells the
+ * client to sign in again.
+ */
+export declare function markCredentialMembershipUnavailable(event: H3Event): void;
+export declare function isCredentialMembershipUnavailable(event: H3Event): boolean;
+export declare function respondCredentialMembershipUnavailable(event: H3Event): {
+    error: string;
+};

package/dist/server/credential-membership-unavailable.js

@@ -0,0 +1,22 @@
+import { setResponseHeader, setResponseStatus } from "h3";
+const CONTEXT_KEY = "__anCredentialMembershipUnavailable";
+export const CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE = "Organization membership could not be verified. Retry shortly.";
+/**
+ * Records that this request's bearer token verified but its organization
+ * membership could not be checked. Such a request has no session, but it is
+ * not unauthenticated: answer a retryable 503, never a 401 that tells the
+ * client to sign in again.
+ */
+export function markCredentialMembershipUnavailable(event) {
+    const holder = event;
+    (holder.context ??= {})[CONTEXT_KEY] = true;
+}
+export function isCredentialMembershipUnavailable(event) {
+    return (event.context?.[CONTEXT_KEY] ===
+        true);
+}
+export function respondCredentialMembershipUnavailable(event) {
+    setResponseStatus(event, 503);
+    setResponseHeader(event, "Retry-After", "5");
+    return { error: CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE };
+}

package/dist/server/index.d.ts

@@ -13,6 +13,7 @@ export { createOpenRouteHandler, type OpenRouteOptions } from "./open-route.js";
 export { createEmbedStartRouteHandler, buildEmbedStartPath, type EmbedStartRouteOptions, } from "./embed-route.js";
 export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTargetPath, requestHasEmbedAuthMarker, resolveEmbedSessionFromRequest, setEmbedSessionCookie, signEmbedSessionToken, verifyEmbedSessionToken, type ConsumedEmbedSessionTicket, type ConsumeEmbedSessionTicketOptions, type EmbedSessionTicket, type EmbedSessionTicketInput, type EmbedSessionTokenClaims, type ResolvedEmbedSession, type VerifyEmbedSessionTokenResult, } from "./embed-session.js";
 export { createSSEHandler, type SSEHandlerOptions } from "./sse.js";
+export { isCredentialMembershipUnavailable } from "./credential-membership-unavailable.js";
 export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, getMcpOAuthBearerSession, logout, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, setFirstRunOnboardingCookie, clearFrameworkSessionCookies, runAuthGuard, registerDesktopExchange, prepareDesktopOAuthBrowserBinding, matchesDesktopOAuthBrowserBinding, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
 export { handleIdentitySso, ensureIdentityUser, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_BOOTSTRAP_ACTIVATE_PATH, IDENTITY_SSO_BOOTSTRAP_BINDING_COOKIE, clearIdentitySsoBootstrapBindingCookie, getIdentitySsoBootstrapBindingCookie, setIdentitySsoBootstrapBindingCookie, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
 export { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, hasGoogleAuthIdentity, setBetterAuthSessionCookie, } from "./better-auth-instance.js";

package/dist/server/index.js

@@ -13,6 +13,7 @@ export { createOpenRouteHandler } from "./open-route.js";
 export { createEmbedStartRouteHandler, buildEmbedStartPath, } from "./embed-route.js";
 export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTargetPath, requestHasEmbedAuthMarker, resolveEmbedSessionFromRequest, setEmbedSessionCookie, signEmbedSessionToken, verifyEmbedSessionToken, } from "./embed-session.js";
 export { createSSEHandler } from "./sse.js";
+export { isCredentialMembershipUnavailable } from "./credential-membership-unavailable.js";
 export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, getMcpOAuthBearerSession, logout, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, setFirstRunOnboardingCookie, clearFrameworkSessionCookies, runAuthGuard, registerDesktopExchange, prepareDesktopOAuthBrowserBinding, matchesDesktopOAuthBrowserBinding, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
 export { handleIdentitySso, ensureIdentityUser, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_BOOTSTRAP_ACTIVATE_PATH, IDENTITY_SSO_BOOTSTRAP_BINDING_COOKIE, clearIdentitySsoBootstrapBindingCookie, getIdentitySsoBootstrapBindingCookie, setIdentitySsoBootstrapBindingCookie, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
 export { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, hasGoogleAuthIdentity, setBetterAuthSessionCookie, } from "./better-auth-instance.js";

package/dist/server/onboarding-html.js

@@ -1125,7 +1125,7 @@ export function getOnboardingHtml(opts = {}) {
                 authDescription: marketing.authDescription ?? marketingPresentation?.description,
                 learnMoreUrl: marketing.learnMoreUrl ??
                     (marketingSlug
-                        ? `https://agent-native.com/apps/${marketingSlug}`
+                        ? `https://agent-native.com/apps/${marketingSlug}?utm_source=app&utm_medium=product&utm_content=onboarding-learn-more`
                         : undefined),
             }
             : undefined,

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/server/recap-image-route.js

@@ -1,5 +1,6 @@
 import { defineEventHandler, getHeader, getMethod, readRawBody, setResponseHeader, setResponseStatus, } from "h3";
 import { getMcpOAuthBearerSession, getSession, } from "./auth.js";
+import { isCredentialMembershipUnavailable, respondCredentialMembershipUnavailable, } from "./credential-membership-unavailable.js";
 import { getAppUrl } from "./google-oauth.js";
 import { RECAP_IMAGE_CONTENT_TYPE, RECAP_IMAGE_MAX_BYTES, getRecapImage, isValidRecapImageToken, saveRecapImage, } from "./recap-image-store.js";
 const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
@@ -50,6 +51,9 @@ async function readPngFromRequest(event) {
 }
 async function handleUpload(event) {
     const session = await resolveUploadSession(event);
+    if (!session?.email && isCredentialMembershipUnavailable(event)) {
+        return respondCredentialMembershipUnavailable(event);
+    }
     if (!session?.email) {
         setResponseStatus(event, 401);
         return { error: "Authentication required" };

package/dist/server/release-schema.js

@@ -137,6 +137,10 @@ const FRAMEWORK_SCHEMA_ENSURES = [
         "IdentityLinks",
         () => import("../integrations/identity-links-store.js").then((m) => m.ensureTable()),
     ],
+    [
+        "IdentityRetiredEmails",
+        () => import("../identity/retired-emails.js").then((m) => m.ensureTable()),
+    ],
     [
         "IdentitySso",
         () => import("./identity-sso-store.js").then((m) => m.ensureTable()),

package/dist/shared/docs-url.d.ts

@@ -1,8 +1,10 @@
 export declare const AGENT_NATIVE_DOCS_ORIGIN = "https://www.agent-native.com";
 export type DocsUrlOptions = {
     hash?: string;
+    source?: string;
     medium?: string;
-    campaign?: string;
+    /** Defaults to "docs" once any UTM option is set; `null` leaves it off. */
+    campaign?: string | null;
     content?: string | null;
 };
 export declare function docsUrl(slug: string, options?: DocsUrlOptions): string;

package/dist/shared/docs-url.js

@@ -1,13 +1,16 @@
 export const AGENT_NATIVE_DOCS_ORIGIN = "https://www.agent-native.com";
 function applyDocsUtm(params, options) {
-    const wantsUtm = options.medium != null ||
+    const wantsUtm = options.source != null ||
+        options.medium != null ||
         options.campaign != null ||
         options.content != null;
     if (!wantsUtm)
         return;
-    params.set("utm_source", "agent-native");
+    params.set("utm_source", options.source ?? "agent-native");
     params.set("utm_medium", options.medium ?? "product");
-    params.set("utm_campaign", options.campaign ?? "docs");
+    const campaign = options.campaign === undefined ? "docs" : options.campaign;
+    if (campaign)
+        params.set("utm_campaign", campaign);
     if (options.content)
         params.set("utm_content", options.content);
 }

package/dist/shared/environment-lanes.d.ts

@@ -33,6 +33,14 @@ export interface EnvironmentBadgeTargets {
     productionHost: string;
 }
 export declare function resolveEnvironmentTargets(hostname: string | undefined): EnvironmentBadgeTargets | null;
+/**
+ * Moves an endpoint on a production lane host to that host's beta lane when
+ * the calling app is itself served from beta, so beta apps report to beta
+ * Analytics. Both lanes share one database: this picks which build ingests an
+ * event, not where the event is stored. Endpoints on any other host are an
+ * explicit choice and pass through unchanged.
+ */
+export declare function resolveLaneEndpoint(endpoint: string, appHostname: string | undefined): string;
 export declare function buildEnvironmentUrl(sourceHref: string, targetHost: string): string | null;
 export declare function buildAutomaticBetaRedirectUrl(sourceHref: string, betaHost: string): string | null;
 export declare function buildEnvironmentOptOutUrl(sourceHref: string, targetHost: string, now?: number): string | null;