@agent-native/core 0.216.0 → 0.217.0

package/dist/server/analytics.js

@@ -1,5 +1,7 @@
 import { getAppConfig } from "../app-config/index.js";
+import { CONSENT_REGION_PATH, CONSENT_REGION_TIME_ZONE_LIST, } from "../shared/consent.js";
 import { SYNTHETIC_TRAFFIC_BETA_E2E } from "../shared/test-traffic.js";
+import { publicFrameworkPath } from "./framework-route-prefix.js";
 const AGENT_NATIVE_ANALYTICS_DEFAULT_ENDPOINT = "https://analytics.agent-native.com/track";
 function normalizeMeasurementId(value) {
     const trimmed = value?.trim();
@@ -54,18 +56,18 @@ export function getAgentNativeAnalyticsConfigScript() {
         ");</script>",
     ].join("");
 }
-function escapeHtmlAttribute(value) {
-    return value
-        .replace(/&/g, "&amp;")
-        .replace(/"/g, "&quot;")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;");
-}
-export function getHeadScriptTag() {
+// A deployment's widget may set cookies or track, so it waits for
+// performance consent like GA does.
+function getHeadScript() {
     const src = getAppConfig().analytics.headScriptSrc;
     if (!src)
         return null;
-    return `<script src="${escapeHtmlAttribute(src)}" defer data-agent-native-head-script></script>`;
+    // "<" inside an inline script could close it early.
+    const jsSrc = JSON.stringify(src).replace(/</g, "\\x3c");
+    return consentGatedScript("performance", `var agentNativeHeadScript=document.createElement('script');` +
+        `agentNativeHeadScript.src=${jsSrc};` +
+        `agentNativeHeadScript.setAttribute('data-agent-native-head-script','');` +
+        `document.head.appendChild(agentNativeHeadScript);`);
 }
 export function getGaInlineConfigScriptBody(options) {
     const id = getGaMeasurementId();
@@ -100,47 +102,106 @@ export function getGaInlineConfigScriptBody(options) {
         `document.head.appendChild(agentNativeGtagScript);` +
         `}`);
 }
+/**
+ * Queue `body` until the visitor's region and choice allow `category`; the
+ * bootstrap after it, or `client/consent.ts` once loaded, runs it. A reject
+ * then a fresh accept calls it again, so it loads its tag only once a page.
+ */
+function consentGatedScript(category, body) {
+    return `<script>(window.__AN_CONSENT_QUEUE__=window.__AN_CONSENT_QUEUE__||[]).push([${JSON.stringify(category)},(function(){var ran=false;return function(){if(ran)return;ran=true;${body}}})()]);</script>`;
+}
+const GA_FALLBACK_DATA_LAYER = "__AGENT_NATIVE_GA_DATA_LAYER__";
+// gtag reads an `arguments` object from the data layer, never an array.
+const GOOGLE_CONSENT_PUSH = `function push(g){for(var i=0;i<L.length;i++){var l=w[L[i]]=w[L[i]]||[];` +
+    `(function(){l.push(arguments)})("consent",g.mode,{analytics_storage:g.p?"granted":"denied",ad_storage:g.t?"granted":"denied",ad_user_data:g.t?"granted":"denied",ad_personalization:g.t?"granted":"denied"})}}`;
+/**
+ * Google Consent Mode: before any Google tag loads, tell each data layer
+ * what the stored choice allows (nothing, without one), so tags already on
+ * the page stop storing and sending when `client/consent.ts` later pushes a
+ * reject. Lists the layers there, under `__AN_CONSENT_LAYERS__`.
+ */
+function getGoogleConsentDefaultScript(dataLayers) {
+    return (`<script data-agent-native-consent-mode>(function(w,d){var L=${JSON.stringify(dataLayers)};w.__AN_CONSENT_LAYERS__=L;` +
+        GOOGLE_CONSENT_PUSH +
+        `var m=/(?:^|;\\s*)an_consent=1\\.p([01])\\.t([01])(?:;|$)/.exec(d.cookie||"");` +
+        `push({mode:"default",p:!!m&&m[1]==="1",t:!!m&&m[2]==="1"})` +
+        `})(window,document);</script>`);
+}
+/**
+ * Runs the queued tags on pages that never load the app bundle, like the
+ * plain sign-in page, and runs them without waiting for it elsewhere: at once
+ * for a stored choice or a region already known this session, else after
+ * asking the server, with the time zone as fallback. Once
+ * `client/consent.ts` replaces the queue it owns what's left, so nothing runs
+ * twice. Keep its cookie and region rules in step with that module.
+ */
+function getConsentBootstrapScript() {
+    const zones = JSON.stringify(CONSENT_REGION_TIME_ZONE_LIST);
+    const regionPath = JSON.stringify(publicFrameworkPath(CONSENT_REGION_PATH));
+    return (`<script data-agent-native-consent>(function(w,d){var Q="__AN_CONSENT_QUEUE__",K="an_consent_region";` +
+        `function choice(){var m=/(?:^|;\\s*)an_consent=1\\.p([01])\\.t([01])(?:;|$)/.exec(d.cookie||"");return m?{performance:m[1]==="1",targeting:m[2]==="1"}:null}` +
+        `function allows(c,k,region){return c?c[k]:region==="none"}` +
+        `function run(region){var q=w[Q];if(!Array.isArray(q))return;var c=choice(),keep=[],L=w.__AN_CONSENT_LAYERS__||[];` +
+        GOOGLE_CONSENT_PUSH +
+        `push({mode:"update",p:allows(c,"performance",region),t:allows(c,"targeting",region)});` +
+        `for(var i=0;i<q.length;i++){var e=q[i];if(allows(c,e[0],region)){e[1]()}else{keep.push(e)}}q.length=0;q.push.apply(q,keep)}` +
+        `function zone(){try{return ${zones}.indexOf(Intl.DateTimeFormat().resolvedOptions().timeZone)>-1?"consent":"none"}catch(e){return"consent"}}` +
+        // coercion-ok: a page without session storage asks the server again.
+        `var cached=null;try{cached=w.sessionStorage.getItem(K)}catch(e){}` +
+        `if(choice()||cached==="consent"||cached==="none"){run(cached);return}` +
+        // An unreachable server falls back to the time zone.
+        // coercion-ok: a region it can't save is asked again on the next page.
+        `fetch(${regionPath},{credentials:"same-origin"}).then(function(r){return r.ok?r.json():{}}).then(function(b){return b&&(b.region==="consent"||b.region==="none")?b.region:zone()},zone).then(function(region){try{w.sessionStorage.setItem(K,region)}catch(e){}run(region)})` +
+        `})(window,document);</script>`);
+}
 function getGaScript() {
     const id = getGaMeasurementId();
     if (!id)
         return null;
     const inlineBody = getGaInlineConfigScriptBody();
-    return `<script>${inlineBody}</script>`;
+    return inlineBody ? consentGatedScript("performance", inlineBody) : null;
 }
 function getGtmGaFallbackScript() {
     const inlineBody = getGaInlineConfigScriptBody({
-        dataLayerName: "__AGENT_NATIVE_GA_DATA_LAYER__",
+        dataLayerName: GA_FALLBACK_DATA_LAYER,
         sendPageView: false,
     });
-    return inlineBody ? `<script>${inlineBody}</script>` : null;
+    return inlineBody ? consentGatedScript("performance", inlineBody) : null;
 }
+// The container carries the ad pixels (Meta, LinkedIn, Reddit, X, Bing,
+// Google Ads, OpenAI) and B2B identification tags alongside GA events, so it
+// all waits for targeting. Its <noscript> iframe can't wait, so there is none.
 function getGtmHeadScript(containerId) {
     const jsId = JSON.stringify(containerId);
-    return `<script>if(${getSyntheticTrafficBrowserGuard()}){(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer',${jsId});}</script>`;
-}
-function getGtmBodyFallback(containerId) {
-    const src = encodeURIComponent(containerId);
-    return `<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=${src}" height="0" width="0" style="display:none;visibility:hidden" title="Google Tag Manager"></iframe></noscript>`;
+    return consentGatedScript("targeting", `if(${getSyntheticTrafficBrowserGuard()}){(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer',${jsId});}`);
 }
 function getAnalyticsInjection() {
     const agentNativeAnalytics = getAgentNativeAnalyticsConfigScript();
-    const headScript = getHeadScriptTag();
+    const headScript = getHeadScript();
     const containerId = getGtmContainerId();
     if (containerId) {
         return {
             head: [
                 agentNativeAnalytics,
+                getGoogleConsentDefaultScript(["dataLayer", GA_FALLBACK_DATA_LAYER]),
                 getGtmHeadScript(containerId),
                 getGtmGaFallbackScript(),
                 headScript,
+                getConsentBootstrapScript(),
             ]
                 .filter(Boolean)
                 .join(""),
-            body: getGtmBodyFallback(containerId),
+            body: "",
         };
     }
     const gaScript = getGaScript();
-    const head = [agentNativeAnalytics, gaScript, headScript]
+    const head = [
+        agentNativeAnalytics,
+        gaScript ? getGoogleConsentDefaultScript(["dataLayer"]) : null,
+        gaScript,
+        headScript,
+        gaScript || headScript ? getConsentBootstrapScript() : null,
+    ]
         .filter(Boolean)
         .join("");
     return head ? { head, body: "" } : null;

package/dist/server/builder-api-auth.d.ts

@@ -16,6 +16,13 @@ export interface BuilderRequestAuthorization {
     authorization: string;
     source: "oauth" | "legacy";
     oauthScope?: RemoteMcpScope;
+    oauthResource?: "general" | "publish";
+    oauthConnectionId?: string;
+    /**
+     * Space selected during Builder OAuth. This is only a request locator; the
+     * provider must verify the token and reject a different apiKey.
+     */
+    oauthSelectedPublicKey?: string;
     legacyCredentialKey?: BuilderLegacyCredentialKey;
     legacyPublicKey?: string;
     userId?: string;

package/dist/server/builder-api-auth.js

@@ -51,6 +51,22 @@ function isBuilderPublishResource(value) {
         !url.search &&
         !url.hash);
 }
+function selectedPublicKeyFromBuilderAccessToken(token) {
+    const payload = token.split(".")[1];
+    if (!payload)
+        return undefined;
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof decoded.org === "string" && decoded.org.trim()
+            ? decoded.org.trim()
+            : undefined;
+    }
+    catch {
+        // coercion-ok: an opaque or malformed optional locator claim is absent;
+        // authorization remains the provider's signed-token responsibility.
+        return undefined;
+    }
+}
 async function resolveBuilderPublishAuthorization(ownerEmail, orgId) {
     const candidates = orgId
         ? [{ scope: "org", scopeId: orgId }]
@@ -108,6 +124,7 @@ async function resolveBuilderPublishAuthorization(ownerEmail, orgId) {
             authorization: `Bearer ${match[1]}`,
             source: "oauth",
             oauthScope: candidate.scope,
+            oauthResource: "publish",
         };
     }
     if (ownerEmail) {
@@ -154,6 +171,7 @@ export async function resolveBuilderRequestAuthorization(input = {}) {
                 throw new ActionContractError(`Builder.io access needs re-authorizing to grant ${input.requiredScope}. Open Settings and authorize Builder.io again.`, {
                     errorCode: "builder_oauth_reauthorization_required",
                     statusCode: 400,
+                    details: { reason: "missing_scope", scope: input.requiredScope },
                 });
             }
             throw err;
@@ -168,6 +186,7 @@ export async function resolveBuilderRequestAuthorization(input = {}) {
             throw new ActionContractError(`Builder.io access needs re-authorizing to grant ${input.requiredScope}. Open Settings and authorize Builder.io again.`, {
                 errorCode: "builder_oauth_reauthorization_required",
                 statusCode: 400,
+                details: { reason: "missing_scope", scope: input.requiredScope },
             });
         }
         return {
@@ -175,6 +194,11 @@ export async function resolveBuilderRequestAuthorization(input = {}) {
             authorization: `Bearer ${session.accessToken}`,
             source: "oauth",
             oauthScope: session.scope,
+            oauthResource: "general",
+            ...(session.connectionId
+                ? { oauthConnectionId: session.connectionId }
+                : {}),
+            oauthSelectedPublicKey: selectedPublicKeyFromBuilderAccessToken(session.accessToken),
         };
     }
     return resolveBuilderLegacyRequestAuthorization(input.legacyCredentialKeys);

package/dist/server/builder-oauth.d.ts

@@ -3,7 +3,9 @@ export declare const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
 export declare const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
 export declare const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
 export declare const BUILDER_ASSETS_WRITE_SCOPE = "builder:assets:write";
-export declare const BUILDER_OAUTH_SCOPES: readonly ["builder:ai:invoke", "builder:agents:run", "builder:browser:connect", "builder:assets:write", "builder:projects:read", "builder:projects:write", "builder:designsystem:read", "builder:designsystem:write"];
+export declare const BUILDER_CONTENT_READ_SCOPE = "builder:content:read";
+export declare const BUILDER_CONTENT_WRITE_SCOPE = "builder:content:write";
+export declare const BUILDER_OAUTH_SCOPES: readonly ["builder:ai:invoke", "builder:agents:run", "builder:browser:connect", "builder:assets:write", "builder:content:read", "builder:content:write", "builder:projects:read", "builder:projects:write", "builder:designsystem:read", "builder:designsystem:write"];
 export type BuilderOAuthPermissionScope = (typeof BUILDER_OAUTH_SCOPES)[number];
 export type BuilderOAuthPendingFlow = {
     codeVerifier: string;
@@ -43,6 +45,8 @@ export type BuilderOAuthSession = {
     expiresAt?: number;
     scopes: string[];
     scope: BuilderOAuthScope;
+    /** Opaque identity of the selected stored OAuth credential lane. */
+    connectionId?: string;
 };
 export type BuilderOAuthRequestAccess = BuilderOAuthSession & {
     ownerEmail: string;

package/dist/server/builder-oauth.js

@@ -9,11 +9,15 @@ export const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
 export const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
 export const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
 export const BUILDER_ASSETS_WRITE_SCOPE = "builder:assets:write";
+export const BUILDER_CONTENT_READ_SCOPE = "builder:content:read";
+export const BUILDER_CONTENT_WRITE_SCOPE = "builder:content:write";
 export const BUILDER_OAUTH_SCOPES = [
     BUILDER_OAUTH_SCOPE,
     "builder:agents:run",
     "builder:browser:connect",
     BUILDER_ASSETS_WRITE_SCOPE,
+    BUILDER_CONTENT_READ_SCOPE,
+    BUILDER_CONTENT_WRITE_SCOPE,
     "builder:projects:read",
     "builder:projects:write",
     "builder:designsystem:read",
@@ -290,6 +294,7 @@ export async function getBuilderOAuthSession(ownerEmail, orgId, requiredScope, a
             expiresAt: credentials.tokenExpiresAt,
             scopes,
             scope: options.scope,
+            connectionId: options.key,
         };
     }
     if (requiredScope && missingRequiredScope) {

package/dist/server/core-routes-plugin.d.ts

@@ -588,8 +588,8 @@ export declare function createPublicRemoteAgentsHandler(discover?: PublicAgentDi
     error: string;
     agents?: undefined;
 } | {
-    error?: undefined;
     agents: Omit<import("./agent-discovery.js").DiscoveredAgent, "auth" | "kind">[];
+    error?: undefined;
 }>>;
 export declare function getBuilderConnectErrorDisposition(error: unknown, connectAttemptId: string | null): "correlated" | "legacy" | null;
 export declare function getBuilderConnectErrorKey(ownerEmail: string, connectAttemptId?: string | null): string;

package/dist/server/first-touch-route.d.ts

@@ -17,8 +17,8 @@ export type FirstTouchSyncResult = {
  * browser's `an_ft` and `an_lt` again, so Safari keeps them their 30 days.
  */
 export declare function createFirstTouchHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    reason?: undefined;
     error: string;
+    reason?: undefined;
     stored?: undefined;
     firstTouch?: undefined;
 } | {
@@ -32,8 +32,8 @@ export declare function createFirstTouchHandler(): import("h3").EventHandlerWith
     reason: "expired";
     firstTouch?: undefined;
 } | {
-    reason?: undefined;
     error?: undefined;
+    reason?: undefined;
     stored: true;
     firstTouch: FirstTouchAttribution;
 }>>;

package/dist/server/index.d.ts

@@ -104,7 +104,7 @@ export { resolveDeployPlatform, type DeployPlatform, } from "./deploy-environmen
 export { isServerlessRuntime } from "../db/client.js";
 export { BUILDER_PUBLISH_MCP_RESOURCE, canAuthorizeBuilderApiRequest, hasBuilderApiCredentialCustody, resolveBuilderApiAuthorization, resolveBuilderLegacyRequestAuthorization, resolveBuilderRequestAuthorization, type BuilderLegacyCredentialKey, type BuilderRequestAuthorization, } from "./builder-api-auth.js";
 export { createFusionAgentFeed, fusionStepToAgentChatEvents, type FusionAgentFeedSummary, } from "./fusion-agent-feed.js";
-export { BUILDER_ASSETS_WRITE_SCOPE, BUILDER_OAUTH_SCOPE, type BuilderOAuthPermissionScope, } from "./builder-oauth.js";
+export { BUILDER_ASSETS_WRITE_SCOPE, BUILDER_CONTENT_READ_SCOPE, BUILDER_CONTENT_WRITE_SCOPE, BUILDER_OAUTH_RESOURCE, BUILDER_OAUTH_SCOPE, type BuilderOAuthPermissionScope, } from "./builder-oauth.js";
 export { assertBuilderDesignSystemCodeIndexingAllowed, builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, collectBuilderDesignSystemGitHubFiles, createBuilderDesignSystemProxyFields, designSystemTierUpgradeUrl, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, fetchBuilderDesignSystemDocumentCount, fetchBuilderDesignSystemRecord, fetchBuilderDesignSystemTierLimit, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, isBuilderDesignSystemReadyByCount, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, type BuildBuilderDesignSystemIndexFilesOptions, type BuilderDesignSystemCodeFileInput, type BuilderDesignSystemDecodeJobStatus, type BuilderDesignSystemDocsOptions, type BuilderDesignSystemDocument, type BuilderDesignSystemDocumentCountResult, type BuilderDesignSystemHydratedReference, type BuilderDesignSystemIndexFile, type BuilderDesignSystemIndexFromSourcesOptions, type BuilderDesignSystemIndexOptions, type BuilderDesignSystemIndexResult, type BuilderDesignSystemRecord, type BuilderDesignSystemStatus, type BuilderDesignSystemTierLimit, type BuilderDesignSystemGitHubFile, type BuilderDesignSystemGitHubFileCollection, type BuilderDesignSystemGitHubSource, type BuilderDesignSystemUploadAttachment, type BuilderDesignSystemUploadSlot, type BuilderDesignSystemProxyFields, type BuilderDesignSystemProxyFieldsOptions, type BuilderDesignSystemProxyReference, type BuilderDesignSystemSourceKind, } from "./builder-design-systems.js";
 export { cdnSafeOriginStatus, createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, normalizeBuilderAgentAttachments, runBuilderAgent, type BuilderAgentAttachment, type BuilderAgentUploadAttachment, type BuilderAgentUrlAttachment, type BuilderProjectResult, type RunBuilderAgentResult, } from "./builder-browser.js";
 export { BuilderBranchError, getBuilderBranchStatus, sendBuilderBranchMessage, type BuilderBranchAgentState, type BuilderBranchErrorCode, type BuilderBranchOperation, type BuilderBranchPrStatus, type BuilderBranchRef, type BuilderBranchState, type BuilderBranchStatus, type GetBuilderBranchStatusOptions, type SendBuilderBranchMessageOptions, type SendBuilderBranchMessageResult, } from "./builder-branch.js";

package/dist/server/index.js

@@ -98,7 +98,7 @@ export { resolveDeployPlatform, } from "./deploy-environment.js";
 export { isServerlessRuntime } from "../db/client.js";
 export { BUILDER_PUBLISH_MCP_RESOURCE, canAuthorizeBuilderApiRequest, hasBuilderApiCredentialCustody, resolveBuilderApiAuthorization, resolveBuilderLegacyRequestAuthorization, resolveBuilderRequestAuthorization, } from "./builder-api-auth.js";
 export { createFusionAgentFeed, fusionStepToAgentChatEvents, } from "./fusion-agent-feed.js";
-export { BUILDER_ASSETS_WRITE_SCOPE, BUILDER_OAUTH_SCOPE, } from "./builder-oauth.js";
+export { BUILDER_ASSETS_WRITE_SCOPE, BUILDER_CONTENT_READ_SCOPE, BUILDER_CONTENT_WRITE_SCOPE, BUILDER_OAUTH_RESOURCE, BUILDER_OAUTH_SCOPE, } from "./builder-oauth.js";
 export { assertBuilderDesignSystemCodeIndexingAllowed, builderDesignSystemUrl, builderProjectBranchUrl, buildBuilderDesignSystemIndexFiles, collectBuilderDesignSystemGitHubFiles, createBuilderDesignSystemProxyFields, designSystemTierUpgradeUrl, fetchBuilderDesignSystemDecodeJobStatus, fetchBuilderDesignSystemDocs, fetchBuilderDesignSystemDocumentCount, fetchBuilderDesignSystemRecord, fetchBuilderDesignSystemTierLimit, getBuilderDesignSystemsBaseUrl, hydrateBuilderDesignSystemReference, indexBuilderDesignSystem, isBuilderDesignSystemReadyByCount, localBuilderDesignSystemId, mimeTypeForBuilderDesignSystemFilename, parseBuilderDesignSystemProxyReference, startBuilderDesignSystemIndex, startBuilderDesignSystemUpload, } from "./builder-design-systems.js";
 export { cdnSafeOriginStatus, createBuilderProject, ensureBuilderProject, findBuilderProjectForRepo, getBuilderBranchProjectId, isBuilderBranchingEnabled, requestBuilderBrowserConnection, resolveBuilderBranchProjectId, resolveIsBuilderBranchingEnabled, normalizeBuilderAgentAttachments, runBuilderAgent, } from "./builder-browser.js";
 export { BuilderBranchError, getBuilderBranchStatus, sendBuilderBranchMessage, } from "./builder-branch.js";

package/dist/shared/consent.d.ts

@@ -3,6 +3,8 @@
  * follow builder.io's consent banner: visitors in these countries opt in, and
  * every other visitor is tracked as before, with no banner.
  */
+/** For the inline bootstrap the server writes into each page. */
+export declare const CONSENT_REGION_TIME_ZONE_LIST: readonly string[];
 export declare function isConsentRegionCountry(code: string | null | undefined): boolean;
 export declare function isConsentRegionTimeZone(timeZone: string | null | undefined): boolean;
 /**

package/dist/shared/consent.js

@@ -106,6 +106,10 @@ const CONSENT_REGION_TIME_ZONES = new Set([
     "Portugal",
     "WET",
 ]);
+/** For the inline bootstrap the server writes into each page. */
+export const CONSENT_REGION_TIME_ZONE_LIST = [
+    ...CONSENT_REGION_TIME_ZONES,
+];
 export function isConsentRegionCountry(code) {
     return CONSENT_REGION_COUNTRY_CODES.has(code?.trim().toUpperCase() ?? "");
 }

package/dist/triggers/actions/manage-automation.d.ts

@@ -67,7 +67,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
     triggerType: "event" | "manual" | "schedule" | "webhook";
     body: string;
 }, {
-    deleted?: undefined;
     created: boolean;
     resourceId: string;
     name: string;
@@ -88,25 +87,26 @@ declare const _default: import("../../action.js").ActionDefinition<{
     executionCwd: string;
     mcpTools: string[];
     webhookPath: string;
+    deleted?: undefined;
     updated?: undefined;
     changed?: undefined;
     previouslyEnabled?: undefined;
     requestedEnabled?: undefined;
 } | {
-    scope?: undefined;
-    enabled?: undefined;
-    nextRun?: undefined;
     created?: undefined;
     deleted: boolean;
     resourceId: string;
     name: string;
     updated?: undefined;
+    scope?: undefined;
     triggerType?: undefined;
     event?: undefined;
     schedule?: undefined;
     timezone?: undefined;
     condition?: undefined;
     body?: undefined;
+    enabled?: undefined;
+    nextRun?: undefined;
     createdBy?: undefined;
     model?: undefined;
     reasoningEffort?: undefined;
@@ -119,8 +119,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     requestedEnabled?: undefined;
     webhookPath?: undefined;
 } | {
-    deleted?: undefined;
     created?: undefined;
+    deleted?: undefined;
     updated: boolean;
     resourceId: string;
     name: string;

package/dist/usage/actions/get-usage-metrics.js

@@ -17,7 +17,7 @@ function resolveAppSelection(app, appId) {
     return app;
 }
 export default defineAction({
-    description: 'Reports this workspace\'s own agent/LLM usage (Settings › Usage) for members of this organization only; it does NOT cover usage, credits, or activity of external customers, accounts, companies, or product usage, which belong to the app that owns that data (see <relevant-apps>, or search with describe-workspace-apps). Returns lookback totals, the daily trend (dailyBy feature, app, model and surface), top features, models, apps, chats and people, tool calls per day, and recent prompts, across every app unless app names one. Members see only their own usage; scope "workspace" (everyone in the organization) is for owners and admins. billing.unit identifies Builder.io credits, estimated dollars, mixed billing, or unknown.',
+    description: "Reports this workspace's own agent/LLM usage (Settings › Usage) for members of this organization only; it does NOT cover usage, credits, or activity of external customers, accounts, companies, or product usage, use this app's own customer or billing actions for those, or the app that owns that data (see <relevant-apps>, or search with describe-workspace-apps). Returns lookback totals, the daily trend (dailyBy feature, app, model and surface), top features, models, apps, chats and people, tool calls per day, and recent prompts, across every app unless app names one. Members see only their own usage; scope \"workspace\" (everyone in the organization) is for owners and admins. billing.unit identifies Builder.io credits, estimated dollars, mixed billing, or unknown.",
     http: { method: "GET" },
     schema: z.object({
         sinceDays: z.coerce.number().int().min(1).max(365).default(30),
@@ -56,10 +56,10 @@ export default defineAction({
                 ownerEmail: ctx.userEmail,
                 orgId: ctx.orgId,
             }))) {
-                fail("Only organization owners and admins can look up another person's usage with get-usage-metrics. Usage, credits, or activity for customers, accounts, or companies belongs to the app that owns that data (see <relevant-apps> or run describe-workspace-apps with a query).", { errorCode: "usage_user_lookup_forbidden", statusCode: 403 });
+                fail(`get-usage-metrics cannot answer this. For a teammate in this organization, only owners and admins can look up their usage. For a customer or other external user, get-usage-metrics has no data: use this app's own customer or billing actions if it has any, or find the app that owns that data with describe-workspace-apps query="<what you need>" and delegate with call-agent.`, { errorCode: "usage_user_lookup_forbidden", statusCode: 403 });
             }
             if (!(await isOrgMember(ctx.orgId, userEmail))) {
-                fail(`${userEmail} is not a member of this organization. get-usage-metrics only covers this workspace's own agent usage; usage, credits, or activity for customers, accounts, or companies belongs to the app that owns that data (see <relevant-apps> or run describe-workspace-apps with a query).`, { errorCode: "usage_user_not_org_member", statusCode: 404 });
+                fail(`${userEmail} is not a member of this organization, so get-usage-metrics has no data on them. For a customer's or account's usage or credits, use this app's own customer or billing actions if it has any, or find the app that owns that data with describe-workspace-apps query="<what you need>" and delegate with call-agent.`, { errorCode: "usage_user_not_org_member", statusCode: 404 });
             }
         }
         const selection = resolveAppSelection(app, appId);

package/docs/content/deployment-environment-variables.mdx

@@ -20,7 +20,7 @@ hosting behavior.
 | `APP_URL`                                   | Optional canonical public origin. Checked ahead of `BETTER_AUTH_URL` when resolving the A2A JWT audience, the OAuth public origin, self-dispatch webhook targets, and generated resource links. Set it explicitly on preview/staging deploys where the request host is unreliable.                                                                                      |
 | `AGENT_PROD_CODE_EXECUTION`                 | Optional production code-execution mode: `off` (default), `sandboxed`, or `trusted`. See [Production Code Execution](/docs/actions-agent-tools#production-code-execution).                                                                                                                                                                                              |
 | `AGENT_NATIVE_SSR_CACHE`                    | Deployment-wide SSR shell cache policy: unset/`on` keeps the default hard-cache, `off` sends `no-store`, or a duration such as `30s` / `5m` sets a shorter freshness. See [SSR Caching](/docs/ssr-caching).                                                                                                                                                             |
-| `AGENT_NATIVE_HEAD_SCRIPT_SRC`              | Optional HTTPS URL of a script loaded with `defer` in the `<head>` of every server-rendered page. Use it for deployment-specific tooling such as an internal feedback widget, without changing app source. Non-HTTPS URLs fail config validation.                                                                                                                       |
+| `AGENT_NATIVE_HEAD_SCRIPT_SRC`              | Optional HTTPS URL of a script added to the `<head>` of every server-rendered page. Where the consent banner shows, it waits for analytics consent, like Google Analytics. Use it for deployment-specific tooling such as an internal feedback widget, without changing app source. Non-HTTPS URLs fail config validation.                                              |
 | `AGENT_NATIVE_ENABLE_KEEP_WARM`             | Opt into the Netlify keep-warm scheduled function. Unset by default. See [Keep-warm](/docs/netlify#netlify-keep-warm).                                                                                                                                                                                                                                                  |
 | `AGENT_NATIVE_DISABLE_KEEP_WARM`            | Compatibility kill switch for the Netlify keep-warm scheduled function. See [Keep-warm](/docs/netlify#netlify-keep-warm).                                                                                                                                                                                                                                               |
 | `AGENT_NATIVE_KEEP_WARM_SCHEDULE`           | Override the keep-warm cadence with a 5-field cron expression (default `* * * * *` when enabled). An unparseable value fails the build. See [Keep-warm](/docs/netlify#netlify-keep-warm).                                                                                                                                                                               |

package/docs/content/environment-variables.mdx

@@ -95,7 +95,7 @@ public app behavior, use the config paths above instead.
 | `ACCESS_TOKEN` / `ACCESS_TOKENS`               | Static bearer fallback for MCP and Connect clients.                                                                                                                            | One token or a delimited token list; these are not browser auth.                                                        |
 | `AGENT_PROD_CODE_EXECUTION`                    | Production code-execution policy.                                                                                                                                              | `off`, `sandboxed`, or `trusted`. See [Production Code Execution](/docs/actions-agent-tools#production-code-execution). |
 | `AGENT_NATIVE_SSR_CACHE`                       | Deployment-wide public SSR shell cache policy.                                                                                                                                 | Unset/`on`, `off`, or a duration such as `30s` or `5m`. See [SSR Caching](/docs/ssr-caching).                           |
-| `AGENT_NATIVE_HEAD_SCRIPT_SRC`                 | Extra script injected into every server-rendered page head with `defer`.                                                                                                       | An absolute `https://` URL; non-HTTPS values fail config validation.                                                    |
+| `AGENT_NATIVE_HEAD_SCRIPT_SRC`                 | Extra script added to every server-rendered page head. Where the consent banner shows, it waits for analytics consent, like Google Analytics.                                  | An absolute `https://` URL; non-HTTPS values fail config validation.                                                    |
 | `AGENT_NATIVE_ENABLE_KEEP_WARM`                | Opts into the Netlify keep-warm scheduled function; unset by default.                                                                                                          | `1`; see [Keep-warm](/docs/netlify#netlify-keep-warm).                                                                  |
 | `AGENT_NATIVE_DISABLE_KEEP_WARM`               | Compatibility kill switch for the Netlify keep-warm scheduled function.                                                                                                        | `1`; see [Keep-warm](/docs/netlify#netlify-keep-warm).                                                                  |
 | `AGENT_NATIVE_KEEP_WARM_SCHEDULE`              | Keep-warm cadence override when enabled.                                                                                                                                       | A 5-field cron expression such as `*/5 * * * *`; an unparseable value fails the build.                                  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.216.0",
+  "version": "0.217.0",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -552,6 +552,7 @@
     "./client/onboarding/first-run-registry": "./dist/client/onboarding/first-run-registry.js",
     "./client/onboarding/first-run-status": "./dist/client/onboarding/first-run-status.js",
     "./client/onboarding/use-onboarding": "./dist/client/onboarding/use-onboarding.js",
+    "./client/onboarding/use-onboarding-checklist": "./dist/client/onboarding/use-onboarding-checklist.js",
     "./client/onboarding/use-preview-mode": "./dist/client/onboarding/use-preview-mode.js",
     "./client/org/hooks": "./dist/client/org/hooks.js",
     "./client/resources/mcp-connection-resume": "./dist/client/resources/mcp-connection-resume.js",
@@ -601,6 +602,7 @@
     "./notifications/types": "./dist/notifications/types.js",
     "./observability/types": "./dist/observability/types.js",
     "./onboarding/types": "./dist/onboarding/types.js",
+    "./onboarding/status": "./dist/onboarding/status.js",
     "./onboarding/workspace-services": "./dist/onboarding/workspace-services.js",
     "./onboarding/app-profile-data": "./dist/onboarding/app-profile-data.js",
     "./org/app-roles": "./dist/org/app-roles.js",
@@ -728,8 +730,8 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.216.0",
-    "@agent-native/recap-cli": "^0.5.85"
+    "@agent-native/agentkit": "^0.217.0",
+    "@agent-native/recap-cli": "^0.5.86"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",