@agent-native/core 0.205.0 → 0.206.0-nightly-20261009011246

package/dist/provider-api/corpus-jobs.d.ts

@@ -73,7 +73,6 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     offset?: unknown;
     limit?: unknown;
 }, {
-    deleted?: undefined;
     jobs: {
         id: string;
         name: string;
@@ -84,6 +83,7 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
         updatedAt: string;
     }[];
     total: number;
+    deleted?: undefined;
     jobId?: undefined;
 } | {
     jobs?: undefined;
@@ -91,9 +91,9 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     deleted: boolean;
     jobId: string;
 } | {
-    deleted?: undefined;
     jobs?: undefined;
     total?: undefined;
+    deleted?: undefined;
     jobId?: undefined;
     hits: Record<string, unknown>[];
     offset: number;

package/dist/scripts/agent-engines/list-agent-engines.js

@@ -201,6 +201,7 @@ export async function run(args = {}) {
             label: e.label,
             description: e.description,
             defaultModel: e.defaultModel,
+            runtimeSupportedModels: e.supportedModels,
             supportedModels: e.name === CHATGPT_SUBSCRIPTION_ENGINE_NAME
                 ? (chatGPTCatalog?.models ?? [])
                 : applyProviderModelSelection(e.supportedModels, modelSelection),

package/dist/server/action-routes.js

@@ -43,7 +43,7 @@ function currentBuildId() {
 }
 import { isLoopbackRequest, registerAuthPublicPaths } from "./auth.js";
 import { getH3App } from "./framework-request-handler.js";
-import { getRequestIdentityAuthenticatedAtMs, getRequestIdentitySessionToken, hasExplicitPersonalOrgScope, markExplicitPersonalOrgScope, runWithRequestContext, } from "./request-context.js";
+import { getVerifiedServiceIdentityFromEvent, getRequestIdentityAuthenticatedAtMs, getRequestIdentitySessionToken, hasExplicitPersonalOrgScope, markExplicitPersonalOrgScope, runWithRequestContext, } from "./request-context.js";
 const ROUTE_PREFIX = "/_agent-native/actions";
 const WEBMCP_ACTION_ROUTE_PREFIX = "/_agent-native/webmcp/actions";
 const MAX_MCP_DIRECTORY_WIDGET_SCHEMA_ARGUMENT_BYTES = 32 * 1024;
@@ -640,8 +640,15 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
             const identitySessionToken = userEmail
                 ? getRequestIdentitySessionToken(event, userEmail)
                 : undefined;
+            const verifiedServiceIdentity = getVerifiedServiceIdentityFromEvent(event);
             return runWithRequestContext({
                 userEmail,
+                ...(verifiedServiceIdentity &&
+                    verifiedServiceIdentity.userEmail.trim().toLowerCase() ===
+                        userEmail?.trim().toLowerCase() &&
+                    verifiedServiceIdentity.orgId === orgId
+                    ? { verifiedServiceIdentity }
+                    : {}),
                 ...(identityAuthenticatedAtMs !== undefined
                     ? { identityAuthenticatedAtMs }
                     : {}),

package/dist/server/agent-chat-plugin.js

@@ -4063,6 +4063,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         label: entry.label,
                         description: entry.description,
                         defaultModel: entry.defaultModel,
+                        runtimeSupportedModels: entry.supportedModels,
                         ...(await modelsFor(entry)),
                         requiredEnvVars: entry.requiredEnvVars,
                         installPackage: entry.installPackage,

package/dist/server/agent-engine-default-model-route.d.ts

@@ -8,8 +8,8 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  * resolveEngine's credential detection.
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
     scope?: undefined;
 } | {
     ok: boolean;

package/dist/server/auth.js

@@ -4,6 +4,7 @@ import { getAppConfig, resolveAppHomePath } from "../app-config/index.js";
 import { acceptPendingInvitationsForEmail } from "../org/accept-pending.js";
 import { newOrgSelection, ORG_SELECTION_COOKIE, } from "../org/request-org-cache.js";
 import { isWorkspaceAppAccessAllowed, WORKSPACE_APP_ACCESS_UNAVAILABLE, WORKSPACE_APP_ACCESS_UNAVAILABLE_MESSAGE, } from "../org/workspace-app-access.js";
+import { resolveWorkspaceAccessAppId } from "../org/workspace-app-identity.js";
 import { EMBED_SESSION_COOKIE, EMBED_START_PATH, EMBED_TARGET_HEADER, isMcpDirectoryWidgetReadCapabilityScope, } from "../shared/embed-auth.js";
 import { FIRST_RUN_ONBOARDING_COOKIE, FIRST_RUN_ONBOARDING_MAX_AGE, } from "../shared/first-run-onboarding.js";
 import { isGoogleProfileImageUrl } from "../shared/google-profile-image.js";
@@ -65,6 +66,7 @@ import { getAppOriginClientConfigScript } from "./app-origin-config.js";
 import { getAppProductionUrl } from "./app-url.js";
 import { addSignupAttributionHeader, readAnalyticsAnonymousId, signupAttributionContextFromCookieHeader, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getAuthLoginMode } from "./auth-login-mode.js";
+import { markBearerCredentialRefused, respondBearerCredentialRefused, } from "./bearer-credential-refusal.js";
 import { injectBetaOptOutPersistence } from "./beta-opt-out-html.js";
 import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getBetterAuthInternalAdapter, getBetterAuthUserIdForEmail, getAuthSecret, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
 import { BUILDER_CONNECT_PARAM, BUILDER_RELAY_PATH, BUILDER_RELAY_STATE_PARAM, verifyBuilderConnectTokenAndGetOwner, verifyBuilderPreviewRelayStateForCallback, } from "./builder-browser.js";
@@ -86,7 +88,7 @@ import { encodeMagicLinkSignupAttribution, MAGIC_LINK_ATTRIBUTION_PARAM, } from
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { getDeploySettingsRequiredHtml, getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
 import { queryEchoSafeRedirect } from "./query-echo-safe-redirect.js";
-import { getRequestContext, markRequestIdentityAuthenticatedAtMs, hasContinuationLocalRequestContext, hasExplicitPersonalOrgScope, markExplicitPersonalOrgScope, runWithRequestContext, } from "./request-context.js";
+import { getRequestContext, markRequestIdentityAuthenticatedAtMs, markVerifiedServiceIdentityForEvent, hasContinuationLocalRequestContext, hasExplicitPersonalOrgScope, markExplicitPersonalOrgScope, runWithRequestContext, } from "./request-context.js";
 import { captureAuthError } from "./sentry.js";
 import { isTestIdentity } from "./test-identity.js";
 import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
@@ -773,7 +775,7 @@ export async function getMcpOAuthBearerSession(event) {
     if (!bearerToken)
         return null;
     try {
-        const [{ getMcpOAuthAudiences }, { verifyAuth, resolveMcpIdentityOrgId }] = await Promise.all([
+        const [{ getMcpConnectUrl, getMcpOAuthAudiences }, { verifyAuth, resolveMcpIdentityOrgId },] = await Promise.all([
             import("../mcp/oauth-route.js"),
             import("../mcp/build-server.js"),
         ]);
@@ -786,12 +788,26 @@ export async function getMcpOAuthBearerSession(event) {
             markCredentialMembershipUnavailable(event);
             return null;
         }
-        const identity = result.authed ? result.identity : undefined;
+        if (!result.authed) {
+            if (result.refusal) {
+                markBearerCredentialRefused(event, result.refusal, getMcpConnectUrl(event));
+            }
+            return null;
+        }
+        const identity = result.identity;
         if (!identity?.userEmail)
             return null;
         if (identity.orgId === null)
             markExplicitPersonalOrgScope(event);
         const orgId = await resolveMcpIdentityOrgId(identity);
+        if (identity.identityAssurance === "service" &&
+            identity.orgId &&
+            orgId === identity.orgId) {
+            markVerifiedServiceIdentityForEvent(event, {
+                userEmail: identity.userEmail,
+                orgId: identity.orgId,
+            });
+        }
         return {
             email: identity.userEmail,
             token: bearerToken,
@@ -2682,20 +2698,6 @@ function loginHtmlResponse(config, event, requestPath, options = {}) {
         },
     });
 }
-function resolveWorkspaceAccessAppId() {
-    const app = getAppConfig().app;
-    const workspaceId = app.workspaceId?.trim();
-    if (workspaceId)
-        return workspaceId;
-    const isDispatch = [
-        app.id,
-        app.legacyId,
-        app.template,
-        app.slug,
-        app.packageName,
-    ].some((value) => value?.trim().toLowerCase() === "dispatch");
-    return isDispatch ? "dispatch" : "";
-}
 function isHtmlDocumentRequest(event, pathname) {
     if (!isReadMethod(event))
         return false;
@@ -3049,6 +3051,9 @@ function createAuthGuardFn(app) {
         if (isCredentialMembershipUnavailable(event)) {
             return respondCredentialMembershipUnavailable(event);
         }
+        const refused = respondBearerCredentialRefused(event);
+        if (refused)
+            return refused;
         if (p.startsWith("/api/") || p.startsWith("/_agent-native/")) {
             setResponseStatus(event, 401);
             // Dev-only breadcrumb for the loopback origin-label trap: the session
@@ -3615,6 +3620,17 @@ function normalizePath(path) {
 function matchesPathList(path, paths) {
     return paths.some((candidate) => {
         const normalized = normalizePath(candidate);
+        if (normalized.includes("/:")) {
+            const expectedSegments = normalized.split("/");
+            const actualSegments = path.split("/");
+            return (expectedSegments.length === actualSegments.length &&
+                expectedSegments.every((segment, index) => {
+                    if (/^:[A-Za-z][A-Za-z0-9_]*$/.test(segment)) {
+                        return Boolean(actualSegments[index]);
+                    }
+                    return segment === actualSegments[index];
+                }));
+        }
         return path === normalized || path.startsWith(normalized + "/");
     });
 }

package/dist/server/bearer-credential-refusal.d.ts

@@ -0,0 +1,23 @@
+import { type H3Event } from "h3";
+/**
+ * Why a presented bearer token was refused. `invalid` covers every token
+ * nothing here could verify. The others describe a credential this app issued
+ * and verified, so its holder has proven possession and can act on the reason.
+ */
+export type BearerCredentialRefusal = "invalid" | "revoked" | "unknown-connect-token" | "identity-mismatch" | "not-member" | "email-retired" | "service-principal-inactive";
+/**
+ * One sentence naming the refusal. It travels in a `WWW-Authenticate`
+ * `error_description`, so it must stay printable ASCII without `"` or `\`.
+ */
+export declare function describeBearerCredentialRefusal(refusal: BearerCredentialRefusal): string;
+export declare function describeBearerCredentialRefusalWithRecovery(refusal: BearerCredentialRefusal, connectUrl: string | undefined): string;
+/**
+ * Records why this request's bearer token was refused, so the auth guard's
+ * 401 says why instead of a bare `Unauthorized`.
+ */
+export declare function markBearerCredentialRefused(event: H3Event, refusal: BearerCredentialRefusal, connectUrl: string | undefined): void;
+export declare function respondBearerCredentialRefused(event: H3Event): {
+    error: string;
+    reason: BearerCredentialRefusal;
+    message: string;
+} | null;

package/dist/server/bearer-credential-refusal.js

@@ -0,0 +1,67 @@
+import { setResponseStatus } from "h3";
+const CONTEXT_KEY = "__anBearerCredentialRefusal";
+/**
+ * One sentence naming the refusal. It travels in a `WWW-Authenticate`
+ * `error_description`, so it must stay printable ASCII without `"` or `\`.
+ */
+export function describeBearerCredentialRefusal(refusal) {
+    switch (refusal) {
+        case "revoked":
+            return "This token was revoked.";
+        case "unknown-connect-token":
+            return "This app has no record of this connect token: another deployment minted it, or its record was deleted.";
+        case "identity-mismatch":
+            return "This connect token does not match the account it was issued to.";
+        case "not-member":
+            return "This token's account is no longer a member of the organization it was issued for.";
+        case "email-retired":
+            return "This token was issued to an email address the account no longer uses.";
+        case "service-principal-inactive":
+            return "This token belongs to a service principal an organization admin suspended or retired; only an admin can resume a suspended one.";
+        case "invalid":
+            return "This bearer token could not be verified: it is malformed, expired, issued for another app, or older than a required reconnect.";
+    }
+}
+/** RFC 6750 `error_description` characters: printable ASCII except `"` and `\`. */
+const ERROR_DESCRIPTION_CHARACTERS = /^[\x20\x21\x23-\x5B\x5D-\x7E]*$/;
+/**
+ * The connect URL serialized as an ASCII URL, or undefined when it still could
+ * not travel in an `error_description`. Its host comes from request headers
+ * and its base path from configuration, so neither is trusted to be safe.
+ */
+function headerSafeUrl(url) {
+    if (!url)
+        return undefined;
+    let href;
+    try {
+        href = new URL(url).href;
+    }
+    catch {
+        // coercion-ok: an unparseable connect URL is left out of the hint, which then names no URL.
+        return undefined;
+    }
+    return ERROR_DESCRIPTION_CHARACTERS.test(href) ? href : undefined;
+}
+export function describeBearerCredentialRefusalWithRecovery(refusal, connectUrl) {
+    const url = headerSafeUrl(connectUrl);
+    const recovery = url ? `Reconnect at ${url}.` : "Reconnect this connector.";
+    return `${describeBearerCredentialRefusal(refusal)} ${recovery}`;
+}
+/**
+ * Records why this request's bearer token was refused, so the auth guard's
+ * 401 says why instead of a bare `Unauthorized`.
+ */
+export function markBearerCredentialRefused(event, refusal, connectUrl) {
+    const holder = event;
+    (holder.context ??= {})[CONTEXT_KEY] = {
+        reason: refusal,
+        message: describeBearerCredentialRefusalWithRecovery(refusal, connectUrl),
+    };
+}
+export function respondBearerCredentialRefused(event) {
+    const refused = event.context?.[CONTEXT_KEY];
+    if (!refused)
+        return null;
+    setResponseStatus(event, 401);
+    return { error: "Unauthorized", ...refused };
+}

package/dist/server/better-auth-instance.js

@@ -28,6 +28,7 @@ import { getAuthEmailForUserId, getRequiredAuthProviderForEmail, } from "../org/
 import { autoJoinDomainMatchingOrgs } from "../org/auto-join-domain.js";
 import { createFrameworkSCIMIdentity, frameworkOrgBridgePlugin, } from "../org/scim-provisioning.js";
 import { enforceSignupAdmission, isBootstrapAdmin, } from "../org/signup-admission.js";
+import { normalizeAnalyticsSessionId } from "../shared/analytics-session-id.js";
 import { isGoogleProfileImageUrl } from "../shared/google-profile-image.js";
 import { loadOptionalPeer } from "../shared/optional-peer.js";
 import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, } from "../shared/password-policy.js";
@@ -131,6 +132,7 @@ export async function emitSignupEventForCreatedUser(user, context) {
     const requestHeaders = context?.headers ?? context?.request?.headers ?? null;
     if (!requestHeaders)
         return;
+    const requestSessionId = normalizeAnalyticsSessionId(requestHeaders.get("x-agent-native-session-id"));
     const scoped = hasContinuationLocalRequestContext()
         ? getRequestContext()
         : undefined;
@@ -146,7 +148,8 @@ export async function emitSignupEventForCreatedUser(user, context) {
             signupAttributionContextFromCookieHeader(requestHeaders.get("cookie"));
         attribution = browser?.attribution;
         anonymousId = browser?.anonymousId;
-        sessionId = browser?.sessionId;
+        sessionId =
+            normalizeAnalyticsSessionId(browser?.sessionId) ?? requestSessionId;
     }
     catch (err) {
         console.error("[auth] failed to derive signup attribution", err);
@@ -155,9 +158,13 @@ export async function emitSignupEventForCreatedUser(user, context) {
     // so an account created by another signed-in user (admin or API creation)
     // must not inherit it.
     const actingUserId = context?.context?.session?.user?.id;
-    if (user.id && attribution && (!actingUserId || actingUserId === user.id)) {
+    const ownsSignupAttribution = !actingUserId || actingUserId === user.id;
+    const eventAttribution = ownsSignupAttribution ? attribution : undefined;
+    const eventAnonymousId = ownsSignupAttribution ? anonymousId : undefined;
+    const eventSessionId = ownsSignupAttribution ? sessionId : undefined;
+    if (user.id && eventAttribution) {
         try {
-            await persistUserFirstTouchAttribution(user.id, attribution);
+            await persistUserFirstTouchAttribution(user.id, eventAttribution);
         }
         catch (err) {
             // The signup itself already succeeded; the event below still carries
@@ -177,9 +184,9 @@ export async function emitSignupEventForCreatedUser(user, context) {
         authUserId: user.id,
         email,
         name: user.name,
-        attribution,
-        anonymousId,
-        sessionId,
+        attribution: eventAttribution,
+        anonymousId: eventAnonymousId,
+        sessionId: eventSessionId,
     });
 }
 export async function hasGoogleAuthIdentity(email) {

package/dist/server/builder-browser.d.ts

@@ -302,6 +302,8 @@ export declare function isBuilderAccountProvisioningEnabled(): boolean;
 export declare function provisionBuilderAccount(input: {
     email: string;
     name?: string;
+    agentNativeApp?: string;
+    agentNativeTemplate?: string;
 }): Promise<BuilderRelayCredentials>;
 /** @deprecated Repository-backed Builder projects are retained for compatibility. */
 export declare function findBuilderProjectForRepo(args: BuilderProjectLookupArgs): Promise<BuilderProjectResult | null>;

package/dist/server/builder-browser.js

@@ -1819,14 +1819,22 @@ export async function provisionBuilderAccount(input) {
         throw new Error("Builder account provisioning requires a valid email.");
     }
     const name = input.name?.trim().slice(0, 120) || email.slice(0, email.indexOf("@"));
+    const agentNativeApp = cleanTrackingParam(input.agentNativeApp);
+    const agentNativeTemplate = cleanTrackingParam(input.agentNativeTemplate);
+    const version = agentNativeApp || agentNativeTemplate
+        ? "agent-native-account-v2"
+        : "agent-native-account-v1";
     const timestamp = String(Date.now());
     const requestId = randomBytes(32).toString("base64url");
     const signaturePayload = [
-        "agent-native-account-v1",
+        version,
         timestamp,
         requestId,
         email,
         name,
+        ...(version === "agent-native-account-v2"
+            ? [agentNativeApp ?? "", agentNativeTemplate ?? ""]
+            : []),
     ].join("\n");
     const signature = createHmac("sha256", builderAccountProvisioningSecret())
         .update(signaturePayload)
@@ -1835,12 +1843,17 @@ export async function provisionBuilderAccount(input) {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
-            "x-agent-native-account-version": "agent-native-account-v1",
+            "x-agent-native-account-version": version,
             "x-agent-native-account-timestamp": timestamp,
             "x-agent-native-account-request-id": requestId,
             "x-agent-native-account-signature": signature,
         },
-        body: JSON.stringify({ email, name }),
+        body: JSON.stringify({
+            email,
+            name,
+            ...(agentNativeApp ? { agentNativeApp } : {}),
+            ...(agentNativeTemplate ? { agentNativeTemplate } : {}),
+        }),
     }, "account provisioning");
     const parsed = await readBuilderApiObject(response, "account provisioning");
     if (!response.ok) {

package/dist/server/capture-error.d.ts

@@ -1,5 +1,6 @@
 import type { FailureContext } from "../shared/failure-report.js";
 export interface CaptureErrorContext {
+    errorMessagePolicy?: "omit";
     route?: string;
     method?: string;
     userAgent?: string;

package/dist/server/capture-error.js

@@ -1,3 +1,4 @@
+import { runErrorTelemetryProperties, runTelemetryException, } from "../agent/engine/error-telemetry.js";
 import { isTransientDatabaseError } from "../db/client.js";
 import { withFailureContext } from "../observability/failure-context.js";
 import { classifyError } from "./error-noise-filter.js";
@@ -106,9 +107,11 @@ function emit(error, context) {
     return eventId;
 }
 function errorLabel(error) {
-    const { name, message } = (error ?? {});
+    const { name, message, errorCode } = (error ?? {});
     const text = typeof message === "string" ? message : String(error);
-    return `${typeof name === "string" ? name : "Error"}: ${text}`.slice(0, 120);
+    // An omitted run failure's message is fixed text, so its code is what tells it apart.
+    const code = typeof errorCode === "string" ? ` [${errorCode}]` : "";
+    return `${typeof name === "string" ? name : "Error"}${code}: ${text}`.slice(0, 120);
 }
 function recordSuppressed(state, error) {
     state.suppressed += 1;
@@ -255,6 +258,7 @@ export function captureError(error, callerContext = {}) {
         }
         : callerContext;
     let outgoing = context;
+    let reportedError = error;
     try {
         const verdict = classifyError(error, { tags: context.tags });
         if (verdict.drop) {
@@ -266,10 +270,23 @@ export function captureError(error, callerContext = {}) {
         if (errorCode && context.tags?.errorCode === undefined) {
             outgoing = { ...context, tags: { ...context.tags, errorCode } };
         }
+        // The failure packet copies the code tag, so it must be sanitized first.
+        if (context.errorMessagePolicy === "omit") {
+            const properties = runErrorTelemetryProperties(outgoing.tags?.errorCode, error instanceof Error ? error.message : undefined);
+            reportedError = runTelemetryException(error, properties.error_code);
+            outgoing = {
+                ...outgoing,
+                tags: {
+                    ...outgoing.tags,
+                    errorCode: properties.error_code,
+                    errorCause: properties.error_cause,
+                },
+            };
+        }
         const cls = classifyFloodClass(error, outgoing);
         outgoing = withPacket(outgoing, { errorCode, failureClass: cls });
         if (cls) {
-            const admitted = admitFloodEvent(cls, error, outgoing);
+            const admitted = admitFloodEvent(cls, reportedError, outgoing);
             if (!admitted)
                 return undefined;
             outgoing = admitted;
@@ -278,7 +295,14 @@ export function captureError(error, callerContext = {}) {
     }
     catch {
         outgoing = context;
+        if (context.errorMessagePolicy === "omit") {
+            reportedError = runTelemetryException(error, "unknown");
+            outgoing = {
+                ...context,
+                tags: { ...context.tags, errorCode: "unknown" },
+            };
+        }
     }
-    return emit(error, outgoing);
+    return emit(reportedError, outgoing);
 }
 export const captureServerError = captureError;

package/dist/server/complete-text.js

@@ -32,6 +32,7 @@ function contentText(parts) {
 function createCompletionAbortSignal(signal, timeoutMs) {
     const controller = new AbortController();
     const cleanupFns = [];
+    let timeoutError;
     if (signal) {
         if (signal.aborted) {
             controller.abort(signal.reason);
@@ -44,12 +45,14 @@ function createCompletionAbortSignal(signal, timeoutMs) {
     }
     if (timeoutMs !== undefined) {
         const timeout = setTimeout(() => {
-            controller.abort(new Error(`completeText timed out after ${timeoutMs}ms`));
+            timeoutError = new EngineError(`completeText timed out after ${timeoutMs}ms`, { errorCode: "complete_text_timeout" });
+            controller.abort(timeoutError);
         }, timeoutMs);
         cleanupFns.push(() => clearTimeout(timeout));
     }
     return {
         signal: controller.signal,
+        getTimeoutError: () => timeoutError,
         cleanup: () => {
             for (const cleanup of cleanupFns)
                 cleanup();
@@ -85,7 +88,8 @@ export async function completeText(options) {
         (await getStoredModelForEngine(engine, { appId: options.appId })) ??
         engine.defaultModel;
     const model = normalizeModelForEngine(engine, modelCandidate);
-    const { signal, cleanup } = createCompletionAbortSignal(options.signal, options.timeoutMs);
+    const completionAbort = createCompletionAbortSignal(options.signal, options.timeoutMs);
+    const { signal } = completionAbort;
     let streamedText = "";
     let finalContent;
     let usage;
@@ -131,9 +135,18 @@ export async function completeText(options) {
             }
         }
     }
+    catch (error) {
+        const timeoutError = completionAbort.getTimeoutError();
+        if (timeoutError)
+            throw timeoutError;
+        throw error;
+    }
     finally {
-        cleanup();
+        completionAbort.cleanup();
     }
+    const timeoutError = completionAbort.getTimeoutError();
+    if (timeoutError)
+        throw timeoutError;
     const content = finalContent ?? [{ type: "text", text: streamedText }];
     return {
         text: contentText(content) || streamedText,

package/dist/server/core-routes-plugin.js

@@ -1480,6 +1480,8 @@ export async function activateBuilderAccount(event, input) {
         const credentials = await provisionBuilderAccount({
             email: ownerEmail,
             name: session.name,
+            agentNativeApp: input.tracking.agentNativeApp,
+            agentNativeTemplate: input.tracking.agentNativeTemplate,
         });
         const { writeBuilderCredentials } = await import("./credential-provider.js");
         const written = await writeBuilderCredentials(ownerEmail, credentials, activationOrg ?? undefined);

package/dist/server/dev-action-bridge.js

@@ -33,6 +33,7 @@ import { resolveDeployEnvironment } from "./deploy-environment.js";
 import { DEV_ACTION_DISCOVERY_PATH, readDevActionDiscoveryFile, } from "./dev-action-discovery.js";
 import { getH3App } from "./framework-request-handler.js";
 import { getRequestOrgId, getRequestUserEmail, runWithRequestContext, } from "./request-context.js";
+import { getForwardedRequestOrigin } from "./request-origin.js";
 export const DEV_ACTION_ROUTE = "/_agent-native/dev/action";
 export const DEV_DB_QUERY_ROUTE = "/_agent-native/dev/db-query";
 export const DEV_ACTION_TOKEN_HEADER = "x-agent-native-dev-token";
@@ -231,7 +232,12 @@ export function mountDevActionForwardRoute(nitroApp, actions, options) {
         const userEmail = getHeader(event, DEV_ACTION_USER_HEADER) ||
             (await resolveDevUserEmail());
         const orgId = getHeader(event, DEV_ACTION_ORG_HEADER) || undefined;
-        return runWithRequestContext({ userEmail, orgId }, async () => {
+        const context = {
+            userEmail,
+            orgId,
+            requestOrigin: getForwardedRequestOrigin(event),
+        };
+        return runWithRequestContext(context, async () => {
             try {
                 const ctx = {
                     userEmail: getRequestUserEmail(),

package/dist/server/google-oauth.js

@@ -4,7 +4,7 @@ import { getAppConfig } from "../app-config/index.js";
 import { normalizeAnalyticsAnonymousId } from "../shared/analytics-anonymous-id.js";
 import { normalizeAppPath } from "../shared/sign-in-journey.js";
 import { getAppBasePathFromViteEnv } from "./app-base-path.js";
-import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
+import { readAnalyticsAnonymousId, readAnalyticsSessionId, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getBetterAuthUserIdForEmail, hasBetterAuthUserEmail, trackSignupEvent, } from "./better-auth-instance.js";
 import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 import { writeDesktopSso } from "./desktop-sso.js";
@@ -575,10 +575,12 @@ export async function createOAuthSession(event, email, opts) {
             setFirstRunOnboardingCookie(event);
         }
         if (shouldTrackSignup && opts.trackSignup) {
+            const signupCookieHeader = getHeader(event, "cookie") ?? null;
             const attribution = opts.trackSignup.attribution ??
-                signupAttributionFromCookieHeader(getHeader(event, "cookie") ?? null);
+                signupAttributionFromCookieHeader(signupCookieHeader);
             const anonymousId = opts.trackSignup.signupAnonymousId ??
-                readAnalyticsAnonymousId(getHeader(event, "cookie") ?? null);
+                readAnalyticsAnonymousId(signupCookieHeader);
+            const sessionId = readAnalyticsSessionId(signupCookieHeader);
             const authUserId = (await getBetterAuthUserIdForEmail(email)) ??
                 opts.trackSignup.canonicalAuthUserId;
             await trackSignupEvent({
@@ -590,6 +592,7 @@ export async function createOAuthSession(event, email, opts) {
                 name: opts.trackSignup.name,
                 attribution,
                 anonymousId,
+                sessionId,
             });
         }
         // Desktop SSO: record this session in the home-dir broker file so

package/dist/server/index.d.ts

@@ -79,7 +79,7 @@ export { attachToolSearch, createToolSearchEntry, searchToolRegistry, TOOL_SEARC
 export { filterFrameworkToolGroups, frameworkGroupEnabled, resolveFrameworkTools, FRAMEWORK_TOOL_GROUPS, type FrameworkToolGroup, type FrameworkToolsConfig, type FrameworkToolsOption, type ResolvedFrameworkTools, } from "../framework-tools.js";
 export { buildCompactSkillsSummary, registerPromptContextProvider, type PromptContextProvider, type PromptContextProviderContext, type PromptContextProviderContribution, } from "./agent-chat/prompt-resources.js";
 export { mountActionRoutes, type MountActionRoutesOptions, type ActionRouteAuthAdapter, type ActionRouteResolvedCaller, } from "./action-routes.js";
-export { AGENT_RUN_OWNER_CONTEXT_KEY, seedAgentRunOwnerContext, type AgentRunOwnerContext, } from "./agent-run-context.js";
+export { AGENT_RUN_OWNER_CONTEXT_KEY, readBrowserSessionIdHeader, seedAgentRunOwnerContext, type AgentRunOwnerContext, } from "./agent-run-context.js";
 export { runWithRequestContext, hasRequestContext, hasRequestBoundary, getRequestContext, getRequestUserEmail, getRequestUserName, getRequestOrgId, getAmbientUserEmail, getAmbientOrgId, getRequestTimezone, getRequestRunContext, getCredentialContext, isIntegrationCallerRequest, type RequestContext, type RequestRunContext, } from "./request-context.js";
 export { formatDateInTimezone, todayInTimezone } from "./date-utils.js";
 export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/plugin.js";

package/dist/server/index.js

@@ -74,7 +74,7 @@ export { attachToolSearch, createToolSearchEntry, searchToolRegistry, TOOL_SEARC
 export { filterFrameworkToolGroups, frameworkGroupEnabled, resolveFrameworkTools, FRAMEWORK_TOOL_GROUPS, } from "../framework-tools.js";
 export { buildCompactSkillsSummary, registerPromptContextProvider, } from "./agent-chat/prompt-resources.js";
 export { mountActionRoutes, } from "./action-routes.js";
-export { AGENT_RUN_OWNER_CONTEXT_KEY, seedAgentRunOwnerContext, } from "./agent-run-context.js";
+export { AGENT_RUN_OWNER_CONTEXT_KEY, readBrowserSessionIdHeader, seedAgentRunOwnerContext, } from "./agent-run-context.js";
 export { runWithRequestContext, hasRequestContext, hasRequestBoundary, getRequestContext, getRequestUserEmail, getRequestUserName, getRequestOrgId, getAmbientUserEmail, getAmbientOrgId, getRequestTimezone, getRequestRunContext, getCredentialContext, isIntegrationCallerRequest, } from "./request-context.js";
 export { formatDateInTimezone, todayInTimezone } from "./date-utils.js";
 export { createOnboardingPlugin, defaultOnboardingPlugin, } from "../onboarding/plugin.js";

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/recap-image-route.js

@@ -1,5 +1,6 @@
 import { defineEventHandler, getHeader, getMethod, readRawBody, setResponseHeader, setResponseStatus, } from "h3";
 import { getMcpOAuthBearerSession, getSession, } from "./auth.js";
+import { respondBearerCredentialRefused } from "./bearer-credential-refusal.js";
 import { isCredentialMembershipUnavailable, respondCredentialMembershipUnavailable, } from "./credential-membership-unavailable.js";
 import { getAppUrl } from "./google-oauth.js";
 import { RECAP_IMAGE_CONTENT_TYPE, RECAP_IMAGE_MAX_BYTES, getRecapImage, isValidRecapImageToken, saveRecapImage, } from "./recap-image-store.js";
@@ -55,6 +56,9 @@ async function handleUpload(event) {
         return respondCredentialMembershipUnavailable(event);
     }
     if (!session?.email) {
+        const refused = respondBearerCredentialRefused(event);
+        if (refused)
+            return refused;
         setResponseStatus(event, 401);
         return { error: "Authentication required" };
     }