@agent-native/core 0.203.1 → 0.203.2-nightly-20261007213109

package/dist/agent/thread-message-projection.d.ts

@@ -9,6 +9,7 @@ export declare function projectRootAssistantMessages(input: {
 }): {
     representedRootMessageIds: Set<string>;
     snapshotMessageIdsByRootMessageId: Map<string, string>;
+    snapshotRunIdsByMessageId: Map<string, string>;
 };
 /** Root assistant IDs represented by the AgentKit snapshot. */
 export declare function representedRootAssistantMessageIds(input: {

package/dist/agent/thread-message-projection.js

@@ -80,11 +80,13 @@ function eventMessageIdsByRun(runIdsByMessageId) {
     }
     return result;
 }
-function assistantRunId(value, runIdsByMessageId) {
+function assistantRunId(value, runIdsByMessageId, inferredRunId) {
     if (value.role !== "assistant")
         return undefined;
     const eventRunIds = typeof value.id === "string" ? runIdsByMessageId.get(value.id) : undefined;
-    return eventRunIds?.size === 1 ? [...eventRunIds][0] : explicitRunId(value);
+    return ((eventRunIds?.size === 1 ? [...eventRunIds][0] : undefined) ??
+        explicitRunId(value) ??
+        (eventRunIds?.size ? undefined : inferredRunId));
 }
 function text(value, ignoreNonTextParts = false) {
     if (value.role !== "assistant")
@@ -231,11 +233,57 @@ export function projectRootAssistantMessages(input) {
         : [];
     const runIdsByMessageId = eventRunIds(input.events, input.runs);
     const messageIdsByRun = eventMessageIdsByRun(runIdsByMessageId);
+    const snapshotUserIdsByRun = new Map();
+    for (const root of rootMessages) {
+        if (root.role !== "user")
+            continue;
+        const custom = record(record(root.metadata)?.custom);
+        const snapshotId = typeof custom?.agentKitMessageId === "string"
+            ? custom.agentKitMessageId
+            : typeof root.id === "string"
+                ? root.id
+                : undefined;
+        const runId = custom?.submittedRunId;
+        if (!snapshotId || typeof runId !== "string")
+            continue;
+        snapshotUserIdsByRun.set(snapshotId, snapshotUserIdsByRun.has(snapshotId) ? null : runId);
+    }
+    const snapshotUserCounts = new Map();
+    for (const candidate of snapshotMessages) {
+        if (candidate.role !== "user" || typeof candidate.id !== "string")
+            continue;
+        snapshotUserCounts.set(candidate.id, (snapshotUserCounts.get(candidate.id) ?? 0) + 1);
+    }
+    for (const [snapshotId, runId] of snapshotUserIdsByRun) {
+        if (snapshotUserCounts.get(snapshotId) !== 1 || runId === null) {
+            snapshotUserIdsByRun.delete(snapshotId);
+        }
+    }
     const snapshotMessagesByRunId = new Map();
+    const snapshotRunIdsByMessageId = new Map();
+    let submittedRunId;
     for (const candidate of snapshotMessages) {
-        const runId = assistantRunId(candidate, runIdsByMessageId);
-        if (!runId)
+        if (candidate.role === "user") {
+            const candidateRunId = typeof candidate.id === "string"
+                ? snapshotUserIdsByRun.get(candidate.id)
+                : undefined;
+            submittedRunId =
+                typeof candidateRunId === "string" ? candidateRunId : undefined;
+            continue;
+        }
+        if (candidate.role !== "assistant")
+            continue;
+        const eventRunIds = typeof candidate.id === "string"
+            ? runIdsByMessageId.get(candidate.id)
+            : undefined;
+        const inferredRunId = !eventRunIds?.size && !explicitRunId(candidate)
+            ? submittedRunId
+            : undefined;
+        const runId = assistantRunId(candidate, runIdsByMessageId, inferredRunId);
+        if (!runId || typeof candidate.id !== "string")
             continue;
+        if (inferredRunId)
+            snapshotRunIdsByMessageId.set(candidate.id, runId);
         const candidates = snapshotMessagesByRunId.get(runId);
         if (candidates)
             candidates.push(candidate);
@@ -261,8 +309,9 @@ export function projectRootAssistantMessages(input) {
         const clientCanMatchPartial = matchingCandidate !== undefined &&
             (explicitRunId(matchingCandidate) === runId ||
                 (typeof matchingCandidate.id === "string" &&
-                    runIdsByMessageId.get(matchingCandidate.id)?.size === 1 &&
-                    messageIdsByRun.get(runId)?.size === 1));
+                    (snapshotRunIdsByMessageId.get(matchingCandidate.id) === runId ||
+                        (runIdsByMessageId.get(matchingCandidate.id)?.size === 1 &&
+                            messageIdsByRun.get(runId)?.size === 1))));
         if (sameRunMatches.length === 1 &&
             (exactTextMatch ||
                 (sameRunCandidates.length === 1 && clientCanMatchPartial))) {
@@ -292,6 +341,7 @@ export function projectRootAssistantMessages(input) {
     return {
         representedRootMessageIds: represented,
         snapshotMessageIdsByRootMessageId,
+        snapshotRunIdsByMessageId,
     };
 }
 /** Root assistant IDs represented by the AgentKit snapshot. */

package/dist/client/chat/agentkit-agent-native.js

@@ -412,6 +412,80 @@ function withRefusedTurnMetadata(message, stored) {
         },
     };
 }
+function orderMessagesByDurableSequence(snapshotMessages, missingMessages, durableMessages, durableIndexById, durableIdBySnapshotId) {
+    const messageByDurableId = new Map(missingMessages.map((message) => [message.id, message]));
+    const snapshotIdByDurableId = new Map();
+    const durableIndexBySnapshotId = new Map();
+    for (const message of snapshotMessages) {
+        const durableId = durableIdBySnapshotId.get(message.id) ??
+            (durableIndexById.has(message.id) ? message.id : undefined);
+        const durableIndex = durableId
+            ? durableIndexById.get(durableId)
+            : undefined;
+        if (!durableId ||
+            durableIndex === undefined ||
+            snapshotIdByDurableId.has(durableId)) {
+            continue;
+        }
+        snapshotIdByDurableId.set(durableId, message.id);
+        durableIndexBySnapshotId.set(message.id, durableIndex);
+        messageByDurableId.set(durableId, message);
+    }
+    if (snapshotIdByDurableId.size === 0) {
+        return [...snapshotMessages, ...missingMessages]
+            .map((message, index) => ({ message, index }))
+            .sort((left, right) => {
+            const leftCreatedAt = Date.parse(left.message.createdAt ?? "");
+            const rightCreatedAt = Date.parse(right.message.createdAt ?? "");
+            if (Number.isFinite(leftCreatedAt) &&
+                Number.isFinite(rightCreatedAt) &&
+                leftCreatedAt !== rightCreatedAt) {
+                return leftCreatedAt - rightCreatedAt;
+            }
+            return left.index - right.index;
+        })
+            .map(({ message }) => message);
+    }
+    const insertions = new Map();
+    for (let index = 0; index < snapshotMessages.length; index += 1) {
+        const message = snapshotMessages[index];
+        if (durableIndexBySnapshotId.has(message.id))
+            continue;
+        let insertionIndex;
+        for (let next = index + 1; next < snapshotMessages.length; next += 1) {
+            const durableIndex = durableIndexBySnapshotId.get(snapshotMessages[next].id);
+            if (durableIndex !== undefined) {
+                insertionIndex = durableIndex;
+                break;
+            }
+        }
+        if (insertionIndex === undefined) {
+            for (let previous = index - 1; previous >= 0; previous -= 1) {
+                const durableIndex = durableIndexBySnapshotId.get(snapshotMessages[previous].id);
+                if (durableIndex !== undefined) {
+                    insertionIndex = durableIndex + 1;
+                    break;
+                }
+            }
+        }
+        if (insertionIndex === undefined)
+            continue;
+        const messages = insertions.get(insertionIndex) ?? [];
+        messages.push(message);
+        insertions.set(insertionIndex, messages);
+    }
+    const ordered = [];
+    for (let index = 0; index <= durableMessages.length; index += 1) {
+        ordered.push(...(insertions.get(index) ?? []));
+        const durableMessage = durableMessages[index];
+        if (!durableMessage)
+            continue;
+        const projected = messageByDurableId.get(durableMessage.id);
+        if (projected)
+            ordered.push(projected);
+    }
+    return ordered;
+}
 function reconcileDurableMessages(messages, durable, events, runs, toolCalls) {
     const submittedRunId = (message) => {
         const value = asRecord(asRecord(message.metadata)?.custom)?.submittedRunId;
@@ -495,6 +569,7 @@ function reconcileDurableMessages(messages, durable, events, runs, toolCalls) {
         toolCalls,
     });
     const representedDurableAssistantIds = rootAssistantProjection.representedRootMessageIds;
+    const snapshotRunIdsByMessageId = rootAssistantProjection.snapshotRunIdsByMessageId;
     const rootMessageIdsBySnapshotMessageId = new Map([...rootAssistantProjection.snapshotMessageIdsByRootMessageId].map(([rootId, snapshotId]) => [snapshotId, rootId]));
     const deduplicatedMessages = messages.filter((message) => !representedDurableAssistantIds.has(message.id));
     const representedSubmittedUserIds = new Set();
@@ -526,7 +601,8 @@ function reconcileDurableMessages(messages, durable, events, runs, toolCalls) {
             const metadataRunId = asRecord(message.metadata)?.runId;
             const runId = typeof metadataRunId === "string"
                 ? metadataRunId
-                : runByAssistantId.get(message.id);
+                : (snapshotRunIdsByMessageId.get(message.id) ??
+                    runByAssistantId.get(message.id));
             if (runId)
                 snapshotAssistantRunIds.add(runId);
         }
@@ -565,6 +641,9 @@ function reconcileDurableMessages(messages, durable, events, runs, toolCalls) {
         for (const message of matchingSnapshots) {
             matchedSnapshotUserIds.add(message.id);
         }
+        for (let index = 0; index < matchingSnapshots.length; index += 1) {
+            storedUserBySnapshotId.set(matchingSnapshots[index].id, candidates[index]);
+        }
     }
     const missingMessages = submittedUsers.filter((message) => !representedSubmittedUserIds.has(message.id));
     const completedRunIds = new Set([
@@ -600,39 +679,35 @@ function reconcileDurableMessages(messages, durable, events, runs, toolCalls) {
         missingMessages.push(message);
         representedAssistantIds.add(message.id);
     }
-    const projectedMessages = [
-        ...deduplicatedMessages,
-        ...missingMessages.sort((left, right) => (durableIndexById.get(left.id) ?? 0) -
-            (durableIndexById.get(right.id) ?? 0)),
-    ]
-        .map((message, index) => ({
-        message,
-        index,
-    }))
-        .sort((left, right) => {
-        const leftCreatedAt = Date.parse(left.message.createdAt ?? "");
-        const rightCreatedAt = Date.parse(right.message.createdAt ?? "");
-        if (Number.isFinite(leftCreatedAt) &&
-            Number.isFinite(rightCreatedAt) &&
-            leftCreatedAt !== rightCreatedAt) {
-            return leftCreatedAt - rightCreatedAt;
-        }
-        return left.index - right.index;
-    })
-        .map(({ message }) => message);
+    const durableIdBySnapshotId = new Map();
+    for (const [snapshotId, stored] of storedUserBySnapshotId) {
+        durableIdBySnapshotId.set(snapshotId, stored.id);
+    }
+    for (const [snapshotId, rootId] of rootMessageIdsBySnapshotMessageId) {
+        durableIdBySnapshotId.set(snapshotId, rootId);
+    }
+    const projectedMessages = orderMessagesByDurableSequence(deduplicatedMessages, missingMessages.sort((left, right) => (durableIndexById.get(left.id) ?? 0) -
+        (durableIndexById.get(right.id) ?? 0)), durable, durableIndexById, durableIdBySnapshotId);
     const snapshotRunId = (message) => {
         const metadataRunId = asRecord(message.metadata)?.runId;
         return (runByAssistantId.get(message.id) ??
+            snapshotRunIdsByMessageId.get(message.id) ??
             (typeof metadataRunId === "string" ? metadataRunId : undefined));
     };
     const textOf = (parts) => parts
         .filter((part) => part.type === "text")
         .map((part) => part.text)
         .join("");
-    return projectedMessages.map((message) => {
+    const reconciledMessages = projectedMessages.map((message) => {
         if (message.role === "user") {
             const stored = storedUserBySnapshotId.get(message.id);
-            return stored ? withRefusedTurnMetadata(message, stored) : message;
+            if (!stored)
+                return message;
+            const createdAt = message.createdAt ?? stored.createdAt;
+            const reconciled = createdAt === message.createdAt
+                ? message
+                : { ...message, ...(createdAt ? { createdAt } : {}) };
+            return withRefusedTurnMetadata(reconciled, stored);
         }
         if (message.role !== "assistant")
             return message;
@@ -646,10 +721,14 @@ function reconcileDurableMessages(messages, durable, events, runs, toolCalls) {
                 representedRoot.status === "error"
                 ? representedRoot.status
                 : undefined;
-            if (parts !== message.parts || terminalStatus !== undefined) {
+            const createdAt = message.createdAt ?? representedRoot.createdAt;
+            if (parts !== message.parts ||
+                terminalStatus !== undefined ||
+                createdAt !== message.createdAt) {
                 message = {
                     ...message,
                     ...(parts !== message.parts ? { parts } : {}),
+                    ...(createdAt ? { createdAt } : {}),
                     ...(terminalStatus ? { status: terminalStatus } : {}),
                 };
             }
@@ -759,6 +838,7 @@ function reconcileDurableMessages(messages, durable, events, runs, toolCalls) {
         }
         return { ...reconciled, parts };
     });
+    return reconciledMessages;
 }
 function messageStatus(value) {
     const status = asRecord(value)?.type ?? value;

package/dist/collab/awareness.d.ts

@@ -38,19 +38,19 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/file-upload/actions/upload-image.d.ts

@@ -42,8 +42,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url: string;
     id: string;
     provider: string;
-    configured?: undefined;
     error?: undefined;
+    configured?: undefined;
 } | {
     url?: undefined;
     id?: undefined;

package/dist/notifications/routes.d.ts

@@ -1,12 +1,12 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
+    error?: undefined;
     count: number;
     updated?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated: number;
-    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -14,8 +14,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -28,32 +28,32 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     avgEvalScore: number;
 } | {
     id?: undefined;
-    ok?: undefined;
     error: string;
     message: string;
     summary?: undefined;
     spans?: undefined;
+    ok?: undefined;
 } | {
     id?: undefined;
     error?: undefined;
-    ok?: undefined;
     message?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
+    ok?: undefined;
 } | {
     error?: undefined;
-    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
+    ok?: undefined;
 } | {
     id?: undefined;
-    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     error: any;
+    ok?: undefined;
 } | {
     id?: undefined;
     error?: undefined;

package/dist/observability/store.js

@@ -138,7 +138,8 @@ export async function ensureObservabilityTables() {
           status TEXT NOT NULL DEFAULT 'success',
           error_message TEXT,
           metadata TEXT,
-          created_at BIGINT NOT NULL
+          created_at BIGINT NOT NULL,
+          ended_at BIGINT
         )
       `;
             const traceSummariesCreateSql = `
@@ -290,6 +291,7 @@ export async function ensureObservabilityTables() {
                 await ensureTableExists("agent_experiment_assignments", experimentAssignmentsCreateSql);
                 await ensureTableExists("agent_experiment_results", experimentResultsCreateSql);
                 await ensureColumnExists("agent_experiments", "owner_email", `ALTER TABLE agent_experiments ADD COLUMN IF NOT EXISTS owner_email TEXT`);
+                await ensureColumnExists("agent_trace_spans", "ended_at", `ALTER TABLE agent_trace_spans ADD COLUMN IF NOT EXISTS ended_at BIGINT`);
                 for (const table of USER_SCOPED_TABLES) {
                     await ensureColumnExists(table, "user_id", `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS user_id TEXT`);
                 }
@@ -344,8 +346,8 @@ export async function insertTraceSpan(span) {
         sql: `INSERT INTO agent_trace_spans
       (id, run_id, thread_id, user_id, org_id, parent_span_id, span_type, name,
        input_tokens, output_tokens, cache_read_tokens, cache_write_tokens,
-       cost_cents_x100, duration_ms, status, error_message, metadata, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       cost_cents_x100, duration_ms, status, error_message, metadata, created_at, ended_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: [
             span.id,
             span.runId,
@@ -365,6 +367,7 @@ export async function insertTraceSpan(span) {
             span.errorMessage,
             span.metadata ? JSON.stringify(span.metadata) : null,
             span.createdAt,
+            span.endedAt ?? span.createdAt + span.durationMs,
         ],
     });
 }
@@ -1733,6 +1736,8 @@ function rowToTraceSpan(row) {
     const exposesErrorText = row.span_type !== "tool_call" ||
         errorDetail === "full" ||
         errorDetail === "signature";
+    const createdAt = Number(row.created_at);
+    const durationMs = Number(row.duration_ms ?? 0);
     return {
         id: String(row.id),
         runId: String(row.run_id),
@@ -1747,14 +1752,15 @@ function rowToTraceSpan(row) {
         cacheReadTokens: Number(row.cache_read_tokens ?? 0),
         cacheWriteTokens: Number(row.cache_write_tokens ?? 0),
         costCentsX100: Number(row.cost_cents_x100 ?? 0),
-        durationMs: Number(row.duration_ms ?? 0),
+        durationMs,
         status: row.status,
         errorMessage: errorMessage && exposesErrorText
             ? sanitizeToolErrorMessage(errorMessage)
             : null,
         ...(errorDetail ? { errorDetail } : {}),
         metadata,
-        createdAt: Number(row.created_at),
+        createdAt,
+        endedAt: row.ended_at == null ? createdAt + durationMs : Number(row.ended_at),
     };
 }
 function rowToTraceSummary(row) {

package/dist/observability/traces.js

@@ -219,6 +219,8 @@ function emitLlmGenerationTrackingEvent(args) {
         model_selection_source: args.modelSelectionSource,
         created_at: new Date(args.createdAt).toISOString(),
         created_at_ms: args.createdAt,
+        ended_at: new Date(args.endedAt).toISOString(),
+        ended_at_ms: args.endedAt,
         $ai_trace_id: args.runId,
         $ai_session_id: args.threadId ?? undefined,
         $ai_span_id: args.llmSpanId,
@@ -1004,6 +1006,7 @@ export async function instrumentAgentLoop(opts) {
                         spanId: trip.spanId,
                         model: trip.usage?.model ?? runUsage.model,
                         createdAt: trip.start,
+                        endedAt: trip.end,
                         latencyMs: Math.max(0, trip.end - trip.start),
                         callUsage: trip.usage,
                         stopReason: trip.stopReason,
@@ -1025,6 +1028,7 @@ export async function instrumentAgentLoop(opts) {
                             spanId: spanId(),
                             model: runUsage.model,
                             createdAt: runStart,
+                            endedAt: runStart + derivedLlmDurationMs,
                             latencyMs: derivedLlmDurationMs,
                             callUsage: usage,
                             stopReason: undefined,
@@ -1113,6 +1117,7 @@ export async function instrumentAgentLoop(opts) {
                             ? capturedContent
                             : null,
                         createdAt: generation.createdAt,
+                        endedAt: generation.endedAt,
                     });
                     emitLlmGenerationTrackingEvent({
                         runId,
@@ -1154,6 +1159,7 @@ export async function instrumentAgentLoop(opts) {
                             : undefined,
                         delegation: opts.delegation,
                         createdAt: generation.createdAt,
+                        endedAt: generation.endedAt,
                         experimentAssignments: opts.experimentAssignments,
                         modelSelectionSource: opts.modelSelectionSource,
                         browserSessionId,

package/dist/observability/types.d.ts

@@ -36,6 +36,8 @@ export interface TraceSpan {
     errorDetail?: SpanErrorDetail;
     metadata: Record<string, unknown> | null;
     createdAt: number;
+    /** Request/span end time in epoch milliseconds. Older rows derive this from duration. */
+    endedAt?: number;
 }
 export interface TraceSummary {
     runId: string;

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/resources/handlers.d.ts

@@ -39,8 +39,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
     error: string;
 }>;
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -66,12 +66,12 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     code: any;
 } | {
     errorCode?: undefined;
-    error?: undefined;
     code?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
     defaultModel?: import("./agent-engine-default-model-route.js").SavedKeyDefaultModelOutcome;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-default-model-route.d.ts

@@ -9,8 +9,8 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    scope?: undefined;
     ok?: undefined;
+    scope?: undefined;
 } | {
     ok: boolean;
     error: any;

package/dist/server/core-routes-plugin.js

@@ -724,12 +724,14 @@ const BUILDER_WAITLIST_DEFAULT_USE_CASE = "builder_agent_background_coding";
 const BUILDER_WAITLIST_USE_CASES = new Set([
     BUILDER_WAITLIST_DEFAULT_USE_CASE,
     "design_publish_app",
-    "design_make_real_waitlist",
-    "design_system_workflows_waitlist",
-    "design_system_waitlist",
     "docs_build_online_waitlist",
     "docs_edit_online_waitlist",
 ]);
+const BUILDER_WAITLIST_USE_CASE_GROUPS = new Map([
+    ["design_make_real_waitlist", "design_publish_app"],
+    ["design_system_workflows_waitlist", "design_publish_app"],
+    ["design_system_waitlist", "design_publish_app"],
+]);
 const BUILDER_WAITLIST_FORM_TIMEOUT_MS = 8000;
 const BUILDER_WAITLIST_TEXT_LIMIT = 4000;
 const BUILDER_WAITLIST_RATE_LIMIT_WINDOW_MS = 60_000;
@@ -766,9 +768,15 @@ function cleanBuilderWaitlistText(value, maxLength = BUILDER_WAITLIST_TEXT_LIMIT
 }
 function normalizeBuilderWaitlistUseCase(value) {
     const useCase = cleanBuilderWaitlistText(value, 100);
-    return useCase && BUILDER_WAITLIST_USE_CASES.has(useCase)
-        ? useCase
-        : BUILDER_WAITLIST_DEFAULT_USE_CASE;
+    if (!useCase)
+        return BUILDER_WAITLIST_DEFAULT_USE_CASE;
+    if (BUILDER_WAITLIST_USE_CASES.has(useCase))
+        return useCase;
+    // The published waitlist form validates this select against its own option
+    // list. Keep new Design entry points in the existing Design category; their
+    // exact surfaces remain in the text `source` field.
+    return (BUILDER_WAITLIST_USE_CASE_GROUPS.get(useCase) ??
+        BUILDER_WAITLIST_DEFAULT_USE_CASE);
 }
 function normalizeBuilderWaitlistTemplate(value) {
     const template = cleanBuilderWaitlistText(value, 100);

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -2,7 +2,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
 }, {
-    role?: undefined;
     ownerEmail: any;
     visibility: any;
     shares: any[];
@@ -12,6 +11,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
         supportsGroupShares?: boolean;
     };
     orgId?: undefined;
+    role?: undefined;
     agentReadable?: undefined;
 } | {
     ownerEmail: string;

package/dist/templates/factory/.agents/skills/review-latest-feedback/SKILL.md

@@ -70,9 +70,16 @@ unapproved work. Pair `✅` + `🎫` only for distinct scopes; name the fixed
 behavior and ticket action. **Shipped**/**Live verified** alone don't earn
 `✅`. Never remove reactions.
 
-If no safe repo-owned fix is evident, record the evidence limit. Ask only a
-question that could unblock a fix; after four days without an answer, record
-**Abandoned - no answer in 4 days**.
+For every concrete objective defect, attempt to reproduce it before recording
+an evidence limit or asking the reporter for more information. A screenshot,
+error message, URL, or visible flow is enough to start tracing its owner; don't
+wait for details that would not change the reproduction attempt. Phase 2's
+local reproduction procedure applies to all defect reports, not only bashes.
+
+If no safe repo-owned fix is evident after that attempt, record the specific
+evidence limit. Ask only a question whose answer could change the reproduction
+or unblock a fix; after four days without an answer, record **Abandoned - no
+answer in 4 days**.
 
 Use **Skipped** only for non-defects, never breakage. **Open - no question**
 means you found neither a fix nor a useful question; state why in the thread.
@@ -340,6 +347,26 @@ screenshot is usually the whole diagnosis. Track an artifact that is
 permission-gated or expired separately from one that was never provided —
 inaccessible is not absent.
 
+### Attempt local reproduction before evidence-limiting
+
+For each concrete objective defect, try the reported flow before deciding it
+cannot be reproduced or fixed. Trace the screenshot, URL, visible action, and
+error through the app to its route, action, provider, or form contract; use
+those clues to choose the closest runnable local seam. Exercise the flow with
+a local build and synthetic fixtures. If its external dependency is unavailable,
+mock that boundary or submit the same shape to a local validator. Do not use a
+reporter's real email or create a real external record merely to prove a
+failure.
+
+Record the route or action, build, fixture, steps, expected and actual result,
+and error. Code inspection alone is not a reproduction attempt, and
+**Not reproducible - attempted** requires an actual flow attempt. Ask the
+reporter only when a specific missing detail would change the attempt or fix;
+otherwise make the best local attempt with the evidence already available.
+If the attempt stops at a concrete access or environment limit, name what was
+tried and what exact behavior remains untested. Measure misses with
+`feedback-no-local-repro`.
+
 **Sweep siblings before you claim anything is fixed.** Derive the fingerprint
 from the symptom, not the file — the exact crashing token, call shape, or
 literal — then search the repo for it and enumerate every hit in your recap
@@ -384,47 +411,10 @@ Measure this gate with friction keys `false-done` and
 --pattern <key>` for each before changing it and again later. A climbing count
 requires a mechanical proof or release gate, not more prose.
 
-### Bug-bash reproduction contract
-
-For Design, Slides, Core/framework, and template bashes, the reachable reported
-surface is the contract:
-
-1. **Reproduce before editing.** Use the exact URL/route, app/template,
-   account/workspace/role, build/package, browser/device, fixture, and inputs;
-   record expected/actual, errors, and attached artifacts.
-2. **Sweep siblings and boundaries.** Test a negative control plus empty, wrong,
-   whitespace, case, and permission variants; enumerate every shared fingerprint.
-3. **Repeat on the changed running artifact.** Rerun the flow, refresh/navigate,
-   read UI and persisted state, and cover failure/retry/cancel/async paths.
-   Destructive flows require wrong/partial/exact confirmation and recovery;
-   do not delete unless needed.
-4. **Test release/race layers when needed.** Use concurrency/10 runs, a clean
-   scaffold, and the exact package for package reports. Reproduce and verify
-   locally by default; use beta only if the full symptom cannot be reproduced
-   locally and hosted behavior is needed. Record why. These checks support
-   **Shipped**/**Live verified**, not a merged **Fixed** claim.
-5. Record untested layers. Before merge, use an evidence-limited status. After
-   verified source merge, mark **Fixed** even if release/live layers remain;
-   routine rollout and optional beta checks aren't ticketed follow-ups.
-   **Shipped**/**Live verified** need their own bars. Don't mark **Fixed**/`✅`
-   without merged-source proof. Reopen repeats only with a fresh failing
-   pre-change reproduction.
-
-### Reproduction ledger - required for every row
-
-For each row, record symptom/surface, reproduction steps and account, expected
-and pre/post behavior, tested commit/build, sibling results, untested layers,
-and runtime layer (`local`, `source-only`, `built`, `deployed`, `observed-live`).
-
-Without merged source proof, use an active or waiting disposition above. After
-merge, **Fixed** may coexist with release follow-up; **Live verified** requires
-all four bars. Status labels, reactions, and tests alone do not prove closure.
-Repeats require a new pre-change failure and link the earlier false claim.
-
-Regression claims require Red/Green proof: reverse-apply hunk with
-`git apply -R`, record failure, reapply, record pass. Repeat timing checks 10x.
-If output missing, build it and rerun on `origin/main` before calling them
-pre-existing.
+### Reproduction and verification detail
+
+Use [`reproduction-and-verification.md`](references/reproduction-and-verification.md)
+for the bug-bash contract, reproduction ledger, and regression proof.
 
 ### Npx and package reports have a release follow-up
 

package/dist/templates/factory/.agents/skills/review-latest-feedback/references/reproduction-and-verification.md

@@ -0,0 +1,46 @@
+# Reproduction and verification
+
+Use this reference for the detailed reproduction ledger and deeper verification
+contract. The skill's general rule still applies to every objective defect.
+
+## Bug-bash reproduction contract
+
+For Design, Slides, Core/framework, and template bashes, the reachable reported
+surface is the contract:
+
+1. **Reproduce before editing.** Use the exact URL/route, app/template,
+   account/workspace/role, build/package, browser/device, fixture, and inputs;
+   record expected/actual, errors, and attached artifacts.
+2. **Sweep siblings and boundaries.** Test a negative control plus empty, wrong,
+   whitespace, case, and permission variants; enumerate every shared fingerprint.
+3. **Repeat on the changed running artifact.** Rerun the flow, refresh/navigate,
+   read UI and persisted state, and cover failure/retry/cancel/async paths.
+   Destructive flows require wrong/partial/exact confirmation and recovery;
+   do not delete unless needed.
+4. **Test release/race layers when needed.** Use concurrency/10 runs, a clean
+   scaffold, and the exact package for package reports. Reproduce and verify
+   locally by default; use beta only if the full symptom cannot be reproduced
+   locally and hosted behavior is needed. Record why. These checks support
+   **Shipped**/**Live verified**, not a merged **Fixed** claim.
+5. Record untested layers. Before merge, use an evidence-limited status. After
+   verified source merge, mark **Fixed** even if release/live layers remain;
+   routine rollout and optional beta checks aren't ticketed follow-ups.
+   **Shipped**/**Live verified** need their own bars. Don't mark **Fixed**/`✅`
+   without merged-source proof. Reopen repeats only with a fresh failing
+   pre-change reproduction.
+
+## Reproduction ledger
+
+For each row, record symptom/surface, reproduction steps and account, expected
+and pre/post behavior, tested commit/build, sibling results, untested layers,
+and runtime layer (`local`, `source-only`, `built`, `deployed`, `observed-live`).
+
+Without merged source proof, use an active or waiting disposition above. After
+merge, **Fixed** may coexist with release follow-up; **Live verified** requires
+all four bars. Status labels, reactions, and tests alone do not prove closure.
+Repeats require a new pre-change failure and link the earlier false claim.
+
+Regression claims require Red/Green proof: reverse-apply the hunk with
+`git apply -R`, record failure, reapply, and record pass. Repeat timing checks
+10x. If output is missing, build it and rerun on `origin/main` before calling
+the behavior pre-existing.

package/dist/templates/factory/.agents/skills/review-prs/SKILL.md

@@ -284,9 +284,11 @@ the major product/UX decision above.
 
 For a PR that passes the applicable gate and lacks a current-head approval,
 submit one GitHub approval review and record the approval URL in the recap.
-Do not duplicate an existing current-head approval. Do not add a tag,
-assignment, mention, or explanatory comment unless the invocation explicitly
-asks for it.
+Do not duplicate an existing current-head approval. This skill reviews other
+people's PRs: do not add a tag, assignment, mention, or explanatory comment
+unless the current invocation explicitly authorizes that communication on the
+exact PR. This does not add a separate authorization step for replies required
+on the active user's own PR under `/ship`, `/ship-now`, or `/babysit-pr`.
 
 Bot-authored PRs, including Dependabot, are outside this skill's review and
 merge scope and must remain completely untouched.

package/dist/triggers/actions/manage-automation.d.ts

@@ -29,8 +29,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     executionEngine?: undefined;
     executionCwd?: undefined;
 } | {
-    created?: undefined;
     scope?: undefined;
+    created?: undefined;
     triggerType?: undefined;
     event?: undefined;
     deleted: boolean;
@@ -45,8 +45,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     nextRun?: undefined;
     webhookPath?: undefined;
 } | {
-    created?: undefined;
     scope?: undefined;
+    created?: undefined;
     triggerType?: undefined;
     event?: undefined;
     deleted?: undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.203.1",
+  "version": "0.203.2-nightly-20261007213109",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -682,7 +682,7 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.203.1",
+    "@agent-native/agentkit": "^0.203.2-nightly-20261007213109",
     "@agent-native/recap-cli": "^0.5.65"
   },
   "devDependencies": {
@@ -753,7 +753,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": ">=0.196.0",
+    "@agent-native/core-corpus": "0.203.2-nightly-20261007213109",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",

package/src/templates/factory/.agents/skills/review-latest-feedback/SKILL.md

@@ -70,9 +70,16 @@ unapproved work. Pair `✅` + `🎫` only for distinct scopes; name the fixed
 behavior and ticket action. **Shipped**/**Live verified** alone don't earn
 `✅`. Never remove reactions.
 
-If no safe repo-owned fix is evident, record the evidence limit. Ask only a
-question that could unblock a fix; after four days without an answer, record
-**Abandoned - no answer in 4 days**.
+For every concrete objective defect, attempt to reproduce it before recording
+an evidence limit or asking the reporter for more information. A screenshot,
+error message, URL, or visible flow is enough to start tracing its owner; don't
+wait for details that would not change the reproduction attempt. Phase 2's
+local reproduction procedure applies to all defect reports, not only bashes.
+
+If no safe repo-owned fix is evident after that attempt, record the specific
+evidence limit. Ask only a question whose answer could change the reproduction
+or unblock a fix; after four days without an answer, record **Abandoned - no
+answer in 4 days**.
 
 Use **Skipped** only for non-defects, never breakage. **Open - no question**
 means you found neither a fix nor a useful question; state why in the thread.
@@ -340,6 +347,26 @@ screenshot is usually the whole diagnosis. Track an artifact that is
 permission-gated or expired separately from one that was never provided —
 inaccessible is not absent.
 
+### Attempt local reproduction before evidence-limiting
+
+For each concrete objective defect, try the reported flow before deciding it
+cannot be reproduced or fixed. Trace the screenshot, URL, visible action, and
+error through the app to its route, action, provider, or form contract; use
+those clues to choose the closest runnable local seam. Exercise the flow with
+a local build and synthetic fixtures. If its external dependency is unavailable,
+mock that boundary or submit the same shape to a local validator. Do not use a
+reporter's real email or create a real external record merely to prove a
+failure.
+
+Record the route or action, build, fixture, steps, expected and actual result,
+and error. Code inspection alone is not a reproduction attempt, and
+**Not reproducible - attempted** requires an actual flow attempt. Ask the
+reporter only when a specific missing detail would change the attempt or fix;
+otherwise make the best local attempt with the evidence already available.
+If the attempt stops at a concrete access or environment limit, name what was
+tried and what exact behavior remains untested. Measure misses with
+`feedback-no-local-repro`.
+
 **Sweep siblings before you claim anything is fixed.** Derive the fingerprint
 from the symptom, not the file — the exact crashing token, call shape, or
 literal — then search the repo for it and enumerate every hit in your recap
@@ -384,47 +411,10 @@ Measure this gate with friction keys `false-done` and
 --pattern <key>` for each before changing it and again later. A climbing count
 requires a mechanical proof or release gate, not more prose.
 
-### Bug-bash reproduction contract
-
-For Design, Slides, Core/framework, and template bashes, the reachable reported
-surface is the contract:
-
-1. **Reproduce before editing.** Use the exact URL/route, app/template,
-   account/workspace/role, build/package, browser/device, fixture, and inputs;
-   record expected/actual, errors, and attached artifacts.
-2. **Sweep siblings and boundaries.** Test a negative control plus empty, wrong,
-   whitespace, case, and permission variants; enumerate every shared fingerprint.
-3. **Repeat on the changed running artifact.** Rerun the flow, refresh/navigate,
-   read UI and persisted state, and cover failure/retry/cancel/async paths.
-   Destructive flows require wrong/partial/exact confirmation and recovery;
-   do not delete unless needed.
-4. **Test release/race layers when needed.** Use concurrency/10 runs, a clean
-   scaffold, and the exact package for package reports. Reproduce and verify
-   locally by default; use beta only if the full symptom cannot be reproduced
-   locally and hosted behavior is needed. Record why. These checks support
-   **Shipped**/**Live verified**, not a merged **Fixed** claim.
-5. Record untested layers. Before merge, use an evidence-limited status. After
-   verified source merge, mark **Fixed** even if release/live layers remain;
-   routine rollout and optional beta checks aren't ticketed follow-ups.
-   **Shipped**/**Live verified** need their own bars. Don't mark **Fixed**/`✅`
-   without merged-source proof. Reopen repeats only with a fresh failing
-   pre-change reproduction.
-
-### Reproduction ledger - required for every row
-
-For each row, record symptom/surface, reproduction steps and account, expected
-and pre/post behavior, tested commit/build, sibling results, untested layers,
-and runtime layer (`local`, `source-only`, `built`, `deployed`, `observed-live`).
-
-Without merged source proof, use an active or waiting disposition above. After
-merge, **Fixed** may coexist with release follow-up; **Live verified** requires
-all four bars. Status labels, reactions, and tests alone do not prove closure.
-Repeats require a new pre-change failure and link the earlier false claim.
-
-Regression claims require Red/Green proof: reverse-apply hunk with
-`git apply -R`, record failure, reapply, record pass. Repeat timing checks 10x.
-If output missing, build it and rerun on `origin/main` before calling them
-pre-existing.
+### Reproduction and verification detail
+
+Use [`reproduction-and-verification.md`](references/reproduction-and-verification.md)
+for the bug-bash contract, reproduction ledger, and regression proof.
 
 ### Npx and package reports have a release follow-up
 

package/src/templates/factory/.agents/skills/review-latest-feedback/references/reproduction-and-verification.md

@@ -0,0 +1,46 @@
+# Reproduction and verification
+
+Use this reference for the detailed reproduction ledger and deeper verification
+contract. The skill's general rule still applies to every objective defect.
+
+## Bug-bash reproduction contract
+
+For Design, Slides, Core/framework, and template bashes, the reachable reported
+surface is the contract:
+
+1. **Reproduce before editing.** Use the exact URL/route, app/template,
+   account/workspace/role, build/package, browser/device, fixture, and inputs;
+   record expected/actual, errors, and attached artifacts.
+2. **Sweep siblings and boundaries.** Test a negative control plus empty, wrong,
+   whitespace, case, and permission variants; enumerate every shared fingerprint.
+3. **Repeat on the changed running artifact.** Rerun the flow, refresh/navigate,
+   read UI and persisted state, and cover failure/retry/cancel/async paths.
+   Destructive flows require wrong/partial/exact confirmation and recovery;
+   do not delete unless needed.
+4. **Test release/race layers when needed.** Use concurrency/10 runs, a clean
+   scaffold, and the exact package for package reports. Reproduce and verify
+   locally by default; use beta only if the full symptom cannot be reproduced
+   locally and hosted behavior is needed. Record why. These checks support
+   **Shipped**/**Live verified**, not a merged **Fixed** claim.
+5. Record untested layers. Before merge, use an evidence-limited status. After
+   verified source merge, mark **Fixed** even if release/live layers remain;
+   routine rollout and optional beta checks aren't ticketed follow-ups.
+   **Shipped**/**Live verified** need their own bars. Don't mark **Fixed**/`✅`
+   without merged-source proof. Reopen repeats only with a fresh failing
+   pre-change reproduction.
+
+## Reproduction ledger
+
+For each row, record symptom/surface, reproduction steps and account, expected
+and pre/post behavior, tested commit/build, sibling results, untested layers,
+and runtime layer (`local`, `source-only`, `built`, `deployed`, `observed-live`).
+
+Without merged source proof, use an active or waiting disposition above. After
+merge, **Fixed** may coexist with release follow-up; **Live verified** requires
+all four bars. Status labels, reactions, and tests alone do not prove closure.
+Repeats require a new pre-change failure and link the earlier false claim.
+
+Regression claims require Red/Green proof: reverse-apply the hunk with
+`git apply -R`, record failure, reapply, and record pass. Repeat timing checks
+10x. If output is missing, build it and rerun on `origin/main` before calling
+the behavior pre-existing.

package/src/templates/factory/.agents/skills/review-prs/SKILL.md

@@ -284,9 +284,11 @@ the major product/UX decision above.
 
 For a PR that passes the applicable gate and lacks a current-head approval,
 submit one GitHub approval review and record the approval URL in the recap.
-Do not duplicate an existing current-head approval. Do not add a tag,
-assignment, mention, or explanatory comment unless the invocation explicitly
-asks for it.
+Do not duplicate an existing current-head approval. This skill reviews other
+people's PRs: do not add a tag, assignment, mention, or explanatory comment
+unless the current invocation explicitly authorizes that communication on the
+exact PR. This does not add a separate authorization step for replies required
+on the active user's own PR under `/ship`, `/ship-now`, or `/babysit-pr`.
 
 Bot-authored PRs, including Dependabot, are outside this skill's review and
 merge scope and must remain completely untouched.