@agent-native/core 0.225.2-nightly-20261106152255 → 0.226.0

package/dist/server/builder-signup-experiment.js

@@ -0,0 +1,345 @@
+import { createHmac, randomBytes, randomInt, timingSafeEqual, } from "node:crypto";
+import { defineEventHandler, deleteCookie, getCookie, getHeader, getMethod, setCookie, setResponseHeader, setResponseStatus, } from "h3";
+import { z } from "zod";
+import { getAppConfig } from "../app-config/index.js";
+import { getSetting, mutateSetting } from "../settings/store.js";
+import { track } from "../tracking/index.js";
+import { getAuthSecret, getBetterAuthInternalAdapter, } from "./better-auth-instance.js";
+import { readBodyWithSizeLimit } from "./h3-helpers.js";
+export const BUILDER_SIGNUP_EXPERIMENT = "design_builder_signup_v1";
+export const BUILDER_SIGNUP_POLICY = "builder-signup-2026-11-06";
+export const BUILDER_SIGNUP_COOKIE = "an_builder_signup";
+const TTL = 7 * 24 * 60 * 60;
+const assignmentSchema = z.object({
+    id: z.string().regex(/^[a-f0-9]{32}$/),
+    variant: z.enum(["control", "automatic"]),
+    issuedAt: z.number().int(),
+    acceptedAt: z.number().int().optional(),
+    attemptId: z.string().min(16).max(128).optional(),
+    method: z.enum(["password", "magic-link", "google"]).optional(),
+    email: z.string().email().max(320).optional(),
+    policy: z.literal(BUILDER_SIGNUP_POLICY),
+});
+function mac(body) {
+    return createHmac("sha256", getAuthSecret())
+        .update(`${BUILDER_SIGNUP_EXPERIMENT}:${body}`)
+        .digest();
+}
+export function encodeBuilderSignupAssignment(assignment) {
+    const body = Buffer.from(JSON.stringify(assignment)).toString("base64url");
+    return `${body}.${mac(body).toString("base64url")}`;
+}
+export function decodeBuilderSignupAssignment(value) {
+    if (!value || value.length > 2048)
+        return null;
+    const parts = value.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [body, signature] = parts;
+    if (!body || !signature)
+        return null;
+    const expected = mac(body);
+    const actual = Buffer.from(signature, "base64url");
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+        return null;
+    let json;
+    try {
+        json = JSON.parse(Buffer.from(body, "base64url").toString());
+    }
+    catch {
+        // coercion-ok: malformed anonymous cookies are rejected, never used as consent.
+        return null;
+    }
+    const parsed = assignmentSchema.safeParse(json);
+    if (!parsed.success)
+        return null;
+    const assignment = parsed.data;
+    if (assignment.issuedAt > Date.now() ||
+        Date.now() - assignment.issuedAt > TTL * 1000)
+        return null;
+    if (assignment.acceptedAt !== undefined &&
+        (assignment.acceptedAt < assignment.issuedAt ||
+            assignment.acceptedAt > Date.now()))
+        return null;
+    return assignment;
+}
+function writeAssignment(event, assignment) {
+    setCookie(event, BUILDER_SIGNUP_COOKIE, encodeBuilderSignupAssignment(assignment), {
+        httpOnly: true,
+        secure: getHeader(event, "x-forwarded-proto") === "https" ||
+            getHeader(event, "host")?.includes("localhost") !== true,
+        sameSite: "lax",
+        path: "/",
+        maxAge: TTL,
+    });
+}
+export function isBuilderSignupExperimentEnabled() {
+    const config = getAppConfig().onboarding;
+    return (config.builderSignupExperimentOverride ?? config.builderSignupExperiment);
+}
+export async function bindBuilderSignupAttempt(event, attemptId, method, email) {
+    if (!isBuilderSignupExperimentEnabled())
+        return false;
+    const assignment = decodeBuilderSignupAssignment(getCookie(event, BUILDER_SIGNUP_COOKIE));
+    if (!assignment)
+        return false;
+    if (assignment.variant === "control") {
+        const adapter = await getBetterAuthInternalAdapter();
+        if (!adapter)
+            throw new Error("Signup identity store is unavailable");
+        const identity = await adapter.findUserByEmail(email, {
+            includeAccounts: false,
+        });
+        const createdAt = identity?.user.createdAt;
+        const createdAtMs = createdAt ? new Date(createdAt).getTime() : Number.NaN;
+        if (!identity ||
+            !Number.isFinite(createdAtMs) ||
+            createdAtMs < assignment.issuedAt)
+            return false;
+        const key = `${BUILDER_SIGNUP_EXPERIMENT}:${identity.user.id}`;
+        if (!(await getSetting(key))) {
+            await mutateSetting(key, (current) => current ?? {
+                id: assignment.id,
+                variant: "control",
+                issuedAt: assignment.issuedAt,
+                policy: assignment.policy,
+                userId: identity.user.id,
+                status: "control",
+            });
+            track("builder_signup_experiment_outcome", {
+                experiment_id: BUILDER_SIGNUP_EXPERIMENT,
+                experiment_variant: "control",
+                assignment_id: assignment.id,
+                status: "control",
+            }, { authUserId: identity.user.id, userId: email });
+        }
+        return false;
+    }
+    if (typeof attemptId !== "string" ||
+        attemptId.length > 128 ||
+        !assignment.acceptedAt ||
+        assignment.attemptId !== attemptId)
+        return false;
+    const key = `${BUILDER_SIGNUP_EXPERIMENT}:attempt:${attemptId}`;
+    const normalizedEmail = email.trim().toLowerCase();
+    if (assignment.method !== method ||
+        (assignment.email && assignment.email !== normalizedEmail))
+        return false;
+    const adapter = await getBetterAuthInternalAdapter();
+    if (!adapter)
+        throw new Error("Signup identity store is unavailable");
+    const identity = await adapter.findUserByEmail(normalizedEmail, {
+        includeAccounts: false,
+    });
+    const createdAt = identity?.user.createdAt;
+    const createdAtMs = createdAt ? new Date(createdAt).getTime() : Number.NaN;
+    if (!identity ||
+        !Number.isFinite(createdAtMs) ||
+        createdAtMs < assignment.acceptedAt)
+        return false;
+    const bound = z
+        .object({ id: z.string(), boundUserId: z.string() })
+        .parse(await mutateSetting(key, (current) => current ?? { id: assignment.id, boundUserId: identity.user.id }));
+    if (bound.id !== assignment.id || bound.boundUserId !== identity.user.id)
+        return false;
+    await mutateSetting(`${BUILDER_SIGNUP_EXPERIMENT}:consent:${identity.user.id}`, (current) => current ?? {
+        ...assignment,
+        userId: identity.user.id,
+        email: normalizedEmail,
+    });
+    setCookie(event, "an_builder_signup_pending", "1", {
+        path: "/",
+        sameSite: "lax",
+        maxAge: TTL,
+        secure: getHeader(event, "host")?.includes("localhost") !== true,
+    });
+    return true;
+}
+export async function getBuilderSignupConnectError(userId) {
+    if (!userId || !isBuilderSignupExperimentEnabled())
+        return undefined;
+    const record = await getSetting(`${BUILDER_SIGNUP_EXPERIMENT}:${userId}`);
+    if (record?.status !== "fallback" || record.code !== "account_exists")
+        return undefined;
+    const error = z
+        .object({ message: z.string(), completedAt: z.number().finite() })
+        .parse(record);
+    return {
+        code: "account_exists",
+        message: error.message,
+        at: error.completedAt,
+    };
+}
+async function finishSignupActivation(key, attempt, outcome) {
+    const committed = await mutateSetting(key, (current) => {
+        if (!current || current.attempt !== attempt)
+            throw new Error("Signup activation reservation ownership changed");
+        const status = z
+            .enum(["started", "connected", "fallback"])
+            .parse(current.status);
+        if (status !== "started")
+            return current;
+        return {
+            ...current,
+            status: outcome.status,
+            code: outcome.code ?? null,
+            message: outcome.message ?? null,
+            completedAt: Date.now(),
+        };
+    });
+    return z
+        .object({
+        status: z.enum(["connected", "fallback"]),
+        code: z.string().nullable().optional(),
+    })
+        .parse(committed);
+}
+export function createBuilderSignupExperimentHandler(dependencies) {
+    return defineEventHandler(async (event) => {
+        setResponseHeader(event, "Cache-Control", "no-store");
+        const refuse = (status, code) => {
+            setResponseStatus(event, status);
+            return { status: "unavailable", code };
+        };
+        if (!isBuilderSignupExperimentEnabled())
+            return { status: "disabled" };
+        const method = getMethod(event);
+        if (method !== "GET" && method !== "POST")
+            return refuse(405, "method_not_allowed");
+        if (!dependencies.sameOrigin(event))
+            return refuse(403, "cross_origin");
+        const session = await dependencies.getSession(event);
+        let assignment = decodeBuilderSignupAssignment(getCookie(event, BUILDER_SIGNUP_COOKIE));
+        if (method === "GET") {
+            if (session)
+                return { status: "disabled" };
+            if (!assignment) {
+                assignment = {
+                    id: randomBytes(16).toString("hex"),
+                    variant: randomInt(2) === 0 ? "control" : "automatic",
+                    issuedAt: Date.now(),
+                    policy: BUILDER_SIGNUP_POLICY,
+                };
+                writeAssignment(event, assignment);
+            }
+            return { status: "assigned", ...assignment };
+        }
+        if (!/^application\/json\s*(;|$)/i.test(getHeader(event, "content-type") ?? ""))
+            return refuse(415, "json_required");
+        const body = z
+            .object({
+            operation: z.enum(["accept", "activate"]),
+            assignmentId: z.string().optional(),
+            attemptId: z.string().min(16).max(128).optional(),
+            method: z.enum(["password", "magic-link", "google"]).optional(),
+            email: z.string().email().max(320).optional(),
+        })
+            .safeParse(await readBodyWithSizeLimit(event, 4096));
+        if (!body.success)
+            return refuse(400, "invalid_request");
+        if (!assignment) {
+            deleteCookie(event, "an_builder_signup_pending", { path: "/" });
+            return body.data.operation === "activate"
+                ? { status: "fallback" }
+                : refuse(409, "assignment_missing");
+        }
+        if (body.data.operation === "accept") {
+            if (session || body.data.assignmentId !== assignment.id)
+                return refuse(409, "assignment_mismatch");
+            if (assignment.variant !== "automatic")
+                return { status: "not_required" };
+            if (!body.data.attemptId ||
+                !body.data.method ||
+                (body.data.method !== "google" && !body.data.email))
+                return refuse(400, "attempt_required");
+            assignment = {
+                ...assignment,
+                acceptedAt: Date.now(),
+                attemptId: body.data.attemptId,
+                method: body.data.method,
+                ...(body.data.email
+                    ? { email: body.data.email.trim().toLowerCase() }
+                    : {}),
+            };
+            writeAssignment(event, assignment);
+            setCookie(event, "an_builder_signup_pending", "1", {
+                path: "/",
+                sameSite: "lax",
+                maxAge: TTL,
+                secure: getHeader(event, "host")?.includes("localhost") !== true,
+            });
+            return { status: "accepted" };
+        }
+        if (!session?.emailVerified || !session.userId)
+            return refuse(401, "verified_session_required");
+        const terminal = (status, code) => {
+            deleteCookie(event, "an_builder_signup_pending", { path: "/" });
+            return { status, ...(code ? { code } : {}) };
+        };
+        if (assignment.variant !== "automatic")
+            return terminal("fallback", "control");
+        if (!assignment.acceptedAt || !assignment.attemptId)
+            return terminal("fallback");
+        const consent = await getSetting(`${BUILDER_SIGNUP_EXPERIMENT}:consent:${session.userId}`);
+        if (!consent ||
+            consent.attemptId !== assignment.attemptId ||
+            consent.id !== assignment.id ||
+            consent.userId !== session.userId ||
+            consent.email !== session.email.trim().toLowerCase())
+            return terminal("fallback", "signup_attempt_unbound");
+        const adapter = await getBetterAuthInternalAdapter();
+        if (!adapter)
+            return refuse(503, "identity_unavailable");
+        const identity = await adapter.findUserByEmail(session.email, {
+            includeAccounts: false,
+        });
+        const createdAt = identity?.user.createdAt;
+        const createdAtMs = createdAt ? new Date(createdAt).getTime() : Number.NaN;
+        if (!identity ||
+            identity.user.id !== session.userId ||
+            !Number.isFinite(createdAtMs) ||
+            createdAtMs < assignment.acceptedAt)
+            return terminal("fallback");
+        const key = `${BUILDER_SIGNUP_EXPERIMENT}:${session.userId}`;
+        const existing = await getSetting(key);
+        if (existing) {
+            const status = z
+                .enum(["started", "connected", "fallback"])
+                .parse(existing.status);
+            if (status !== "started")
+                return terminal(status);
+            return { status: "pending" };
+        }
+        const attempt = randomBytes(16).toString("hex");
+        const record = await mutateSetting(key, (current) => current ?? {
+            ...assignment,
+            status: "started",
+            startedAt: Date.now(),
+            attempt,
+            userId: session.userId,
+        });
+        if (record.attempt !== attempt)
+            return { status: "pending" };
+        let result;
+        try {
+            result = await dependencies.activate(event, session);
+        }
+        catch {
+            result = { ok: false, code: "activation_interrupted" };
+        }
+        const committed = await finishSignupActivation(key, attempt, {
+            status: result.ok ? "connected" : "fallback",
+            ...(result.code ? { code: result.code } : {}),
+            ...(result.message ? { message: result.message } : {}),
+        });
+        const status = committed.status;
+        track("builder_signup_experiment_outcome", {
+            experiment_id: BUILDER_SIGNUP_EXPERIMENT,
+            experiment_variant: assignment.variant,
+            assignment_id: assignment.id,
+            status,
+            code: committed.code ?? null,
+        }, { userId: session.email, authUserId: session.userId });
+        return terminal(status, committed.code ?? undefined);
+    });
+}

package/dist/server/core-routes-plugin.d.ts

@@ -610,6 +610,7 @@ type BuilderConnectMember = {
 export type BuilderAccountActivationResult = {
     ok: true;
     scope: "user" | "org";
+    code?: string;
 } | {
     ok: false;
     status: number;
@@ -620,6 +621,7 @@ export type BuilderAccountActivationResult = {
     code?: string;
 };
 interface BuilderAccountActivationInput {
+    newAccountOnly?: boolean;
     ownerEmail: string;
     session: AuthSession | null;
     provisioningToken: string | null | undefined;

package/dist/server/core-routes-plugin.js

@@ -10,6 +10,7 @@ import { registerBuiltinEngines } from "../agent/engine/builtin.js";
 import { OPENAI_BASE_URL_ENV_VAR, PROVIDER_ENV_META, } from "../agent/engine/provider-env-vars.js";
 import { detectEngineFromEnvForRequest, detectEngineFromUserSecrets, isStoredEngineUsableForRequest, } from "../agent/engine/registry.js";
 import { canUpdateAgentLoopSettings, readAgentLoopSettings, resetAgentLoopSettings, validateMaxIterationsInput, writeAgentLoopSettings, } from "../agent/loop-settings.js";
+import { createBuilderSignupExperimentHandler, getBuilderSignupConnectError, } from "./builder-signup-experiment.js";
 export { normalizeAgentEngineStatusModel, resolveAgentEngineStatus, } from "../agent/engine-status.js";
 import { getAppConfig } from "../app-config/index.js";
 import { getState, putState, compareAndSetState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, saveComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, getStateMany, putStateMany, APP_STATE_ANONYMOUS_OWNER_CONTEXT_KEY, } from "../application-state/handlers.js";
@@ -1555,36 +1556,57 @@ export async function activateBuilderAccount(event, input) {
         }
         const activationOrg = activation.write;
         const credentials = await provisionBuilderAccount({
+            ...(input.newAccountOnly ? { newAccountOnly: true } : {}),
             email: ownerEmail,
             name: session.name,
             agentNativeApp: input.tracking.agentNativeApp,
             agentNativeTemplate: input.tracking.agentNativeTemplate,
         });
         const { writeBuilderCredentials } = await import("./credential-provider.js");
-        const written = await writeBuilderCredentials(ownerEmail, credentials, activationOrg ?? undefined);
-        await Promise.all([
-            deleteSetting("builder-disconnected").catch(() => false),
-            ...getBuilderConnectErrorCleanupKeys(ownerEmail, connectAttemptId).map((key) => deleteSetting(key).catch(() => false)),
-        ]);
-        await trackBuilderLifecycle(event, "builder connect succeeded", ownerEmail, {
-            ...builderConnectTrackingProperties(input.tracking),
-            stage: "provision",
-            credential_scope: written.scope,
-            account_provisioned: true,
-        });
-        track("llm_credential_changed", {
-            change_type: "connected",
-            provider: "builder",
-            scope: written.scope,
-            credential_kind: "builder",
-        }, { userId: ownerEmail });
-        await recordBuilderConnectionAudit({
-            connected: true,
-            ownerEmail,
-            orgId: activationOrg?.orgId ?? null,
-            scope: written.scope,
-            attribution: routeAuditAttribution(event),
-        });
+        let written;
+        try {
+            written = await writeBuilderCredentials(ownerEmail, credentials, activationOrg ?? undefined);
+        }
+        catch (error) {
+            captureError(error, { route: "builder.provision.credential-write" });
+            return fail(409, "A Builder.io account already exists for this email. Sign in to Builder.io to use it.", "credential_write_failed", "account_exists");
+        }
+        try {
+            await Promise.all([
+                deleteSetting("builder-disconnected").catch(() => false),
+                ...getBuilderConnectErrorCleanupKeys(ownerEmail, connectAttemptId).map((key) => deleteSetting(key).catch(() => false)),
+            ]);
+            await trackBuilderLifecycle(event, "builder connect succeeded", ownerEmail, {
+                ...builderConnectTrackingProperties(input.tracking),
+                stage: "provision",
+                credential_scope: written.scope,
+                account_provisioned: true,
+            });
+            track("llm_credential_changed", {
+                change_type: "connected",
+                provider: "builder",
+                scope: written.scope,
+                credential_kind: "builder",
+            }, { userId: ownerEmail });
+            await recordBuilderConnectionAudit({
+                connected: true,
+                ownerEmail,
+                orgId: activationOrg?.orgId ?? null,
+                scope: written.scope,
+                attribution: routeAuditAttribution(event),
+            });
+        }
+        catch (error) {
+            captureError(error, {
+                route: "builder.provision.post-write",
+                tags: { credential_write: "completed" },
+            });
+            return {
+                ok: true,
+                scope: written.scope,
+                code: "post_write_reporting_failed",
+            };
+        }
         return { ok: true, scope: written.scope };
     }
     catch (error) {
@@ -2871,6 +2893,7 @@ export function createCoreRoutesPlugin(options = {}) {
                 const envStatus = getBuilderBrowserStatusForEvent(event);
                 const ownerContext = await resolveBuilderOwnerContext(event);
                 const userEmail = ownerContext.email;
+                const signupConnectError = await getBuilderSignupConnectError(ownerContext.session?.userId);
                 const provisioningToken = userEmail &&
                     ownerContext.session?.token &&
                     isBuilderAccountProvisioningEnabled()
@@ -2884,7 +2907,14 @@ export function createCoreRoutesPlugin(options = {}) {
                 // (`effective`) alongside the grants that exist, so the UI can show
                 // the organization and personal connections as separate rows.
                 const withConnectToken = (status, effective = null) => {
-                    const withConnections = { ...status, ...connections, effective };
+                    const withConnections = {
+                        ...status,
+                        ...connections,
+                        effective,
+                        ...(signupConnectError && status.configured !== true
+                            ? { connectError: signupConnectError }
+                            : {}),
+                    };
                     if (!userEmail)
                         return withConnections;
                     return {
@@ -3430,6 +3460,28 @@ export function createCoreRoutesPlugin(options = {}) {
                 setResponseHeader(event, "Location", authorizationUrl);
                 return "";
             }));
+            getH3App(nitroApp).use(`${P}/auth/builder-signup-experiment`, createBuilderSignupExperimentHandler({
+                getSession,
+                sameOrigin: isSameOriginConnect,
+                activate: async (event, session) => {
+                    const authorization = await authorizeBuilderConnectScope(event, session.email, null);
+                    if ("deny" in authorization)
+                        return { ok: false, code: authorization.deny.reason };
+                    return activateBuilderAccount(event, {
+                        ownerEmail: session.email,
+                        session,
+                        provisioningToken: signBuilderProvisioningToken(session.email, session.token ?? ""),
+                        requestedScope: null,
+                        member: authorization.member,
+                        connectAttemptId: null,
+                        tracking: {
+                            agentNativeApp: "design",
+                            agentNativeTemplate: "design",
+                        },
+                        newAccountOnly: true,
+                    });
+                },
+            }));
             getH3App(nitroApp).use(`${P}/builder/provision`, createBuilderProvisionHandler((event) => resolveBuilderOwnerContext(event)));
             // Desktop Code Agents speak Anthropic Messages locally, but Builder
             // Gateway credentials live on the server. This same-origin route keeps

package/dist/server/first-touch-route.d.ts

@@ -17,8 +17,8 @@ export type FirstTouchSyncResult = {
  * browser's `an_ft` and `an_lt` again, so Safari keeps them their 30 days.
  */
 export declare function createFirstTouchHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     reason?: undefined;
+    error: string;
     stored?: undefined;
     firstTouch?: undefined;
 } | {

package/dist/server/google-oauth.d.ts

@@ -75,6 +75,7 @@ export interface OAuthStatePayload {
     desktopVerifierHash?: string;
     desktopBrowserBindingHash?: string;
     desktopWebview?: boolean;
+    builderSignupAttemptId?: string;
     signupAttribution?: Record<string, string | undefined>;
     signupAnonymousId?: string;
     signupSessionId?: string;
@@ -114,6 +115,7 @@ export interface EncodeOAuthStateOptions {
     desktopVerifierHash?: string;
     desktopBrowserBindingHash?: string;
     desktopWebview?: boolean;
+    builderSignupAttemptId?: string;
     signupAttribution?: Record<string, string | undefined>;
     signupAnonymousId?: string;
     signupSessionId?: string;

package/dist/server/google-oauth.js

@@ -479,6 +479,8 @@ export function encodeOAuthState(redirectUriOrOpts, owner, desktop, addAccount,
         payload.bh = opts.desktopBrowserBindingHash;
     if (opts.desktopWebview)
         payload.dw = true;
+    if (opts.builderSignupAttemptId)
+        payload.bs = opts.builderSignupAttemptId;
     if (opts.signupAttribution)
         payload.ft = opts.signupAttribution;
     const signupAnonymousId = normalizeAnalyticsAnonymousId(opts.signupAnonymousId);
@@ -538,6 +540,9 @@ export function decodeOAuthState(stateParam, fallbackUri) {
             desktopVerifierHash: typeof parsed.vh === "string" ? parsed.vh : undefined,
             desktopBrowserBindingHash: typeof parsed.bh === "string" ? parsed.bh : undefined,
             desktopWebview: parsed.dw === true,
+            builderSignupAttemptId: typeof parsed.bs === "string" && parsed.bs.length <= 128
+                ? parsed.bs
+                : undefined,
             signupAttribution: sanitizeStateAttribution(parsed.ft),
             signupAnonymousId: sanitizeStateAnonymousId(parsed.ai),
             signupSessionId: normalizeAnalyticsSessionId(parsed.si),

package/dist/server/index.d.ts

@@ -69,7 +69,7 @@ export { refreshMcpManagerForPrincipal } from "./agent-chat/mcp-glue.js";
 export { AGENT_CHAT_STREAM_PATH, AGENT_CHAT_STREAM_TOKEN_SUFFIX, AGENT_CHAT_STREAM_TOKEN_TTL_SECONDS, createAgentChatStreamToken, isAgentChatStreamingRuntime, readAgentChatStreamBearerToken, verifyAgentChatStreamToken, type AgentChatStreamPrincipal, } from "./agent-chat-stream.js";
 export type { AgentChatMcpIcon, AgentChatMcpOptions, } from "./agent-chat/mcp-options.js";
 export { configureAgentNativeEmbeddedEnvironment, createAgentNativeEmbeddedAuthOptions, createAgentNativeEmbeddedPlugin, mountAgentNativeEmbedded, normalizeAgentNativeEmbeddedSession, type AgentNativeEmbeddedAuthOptions, type AgentNativeEmbeddedGetSession, type AgentNativeEmbeddedHostSession, type AgentNativeEmbeddedPluginOptions, } from "./embedded.js";
-export { createThread, getThread, listThreads, updateThreadData, deleteThread, setThreadArchived, setThreadPinned, setThreadScope, type ChatThread, type ChatThreadAccessBasis, type ChatThreadOwnership, type ChatThreadScope, type ChatThreadSummary, type ChatThreadListRow, type ListThreadsOptions, } from "../chat-threads/store.js";
+export { createThread, getThread, listThreads, searchThreads, updateThreadData, deleteThread, setThreadArchived, setThreadPinned, setThreadScope, type ChatThread, type ChatThreadAccessBasis, type ChatThreadOwnership, type ChatThreadScope, type ChatThreadSummary, type ChatThreadListRow, type ListThreadsOptions, } from "../chat-threads/store.js";
 export { createResourcesPlugin, defaultResourcesPlugin, } from "./resources-plugin.js";
 export { createCoreRoutesPlugin, defaultCoreRoutesPlugin, FRAMEWORK_ROUTE_PREFIX, type CoreRoutesPluginOptions, } from "./core-routes-plugin.js";
 export type { CoreRoutesMcpOptions } from "./core-routes/mcp-connect-options.js";

package/dist/server/index.js

@@ -64,7 +64,7 @@ export { buildFrameworkPrompts, generateActionsPrompt, } from "./agent-chat/fram
 export { refreshMcpManagerForPrincipal } from "./agent-chat/mcp-glue.js";
 export { AGENT_CHAT_STREAM_PATH, AGENT_CHAT_STREAM_TOKEN_SUFFIX, AGENT_CHAT_STREAM_TOKEN_TTL_SECONDS, createAgentChatStreamToken, isAgentChatStreamingRuntime, readAgentChatStreamBearerToken, verifyAgentChatStreamToken, } from "./agent-chat-stream.js";
 export { configureAgentNativeEmbeddedEnvironment, createAgentNativeEmbeddedAuthOptions, createAgentNativeEmbeddedPlugin, mountAgentNativeEmbedded, normalizeAgentNativeEmbeddedSession, } from "./embedded.js";
-export { createThread, getThread, listThreads, updateThreadData, deleteThread, setThreadArchived, setThreadPinned, setThreadScope, } from "../chat-threads/store.js";
+export { createThread, getThread, listThreads, searchThreads, updateThreadData, deleteThread, setThreadArchived, setThreadPinned, setThreadScope, } from "../chat-threads/store.js";
 export { createResourcesPlugin, defaultResourcesPlugin, } from "./resources-plugin.js";
 export { createCoreRoutesPlugin, defaultCoreRoutesPlugin, FRAMEWORK_ROUTE_PREFIX, } from "./core-routes-plugin.js";
 export { buildRuntimeConfigPrompt, formatRuntimeConfigReport, getRuntimeConfigReport, parseRuntimeConfigReport, runtimeConfigRequirementsFromSearchParams, } from "../shared/runtime-config.js";

package/dist/server/transcribe-voice.d.ts

@@ -17,8 +17,8 @@
  * typed JSON-in / JSON-out).
  */
 export declare function createTranscribeVoiceHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     text?: undefined;
+    error: string;
 } | {
     error?: undefined;
     text: string;

package/dist/shared/agent-chat-references.d.ts

@@ -0,0 +1,2 @@
+import { type AgentSubmissionReference } from "@agent-native/agentkit/protocol";
+export declare function parseAgentChatReferences(value: unknown): AgentSubmissionReference[];

package/dist/shared/agent-chat-references.js

@@ -0,0 +1,8 @@
+import { parseQueueMessageInput, } from "@agent-native/agentkit/protocol";
+export function parseAgentChatReferences(value) {
+    return (parseQueueMessageInput({
+        threadId: "composer-handoff",
+        text: "",
+        references: value,
+    }).references ?? []);
+}

package/dist/shared/auth-copy.d.ts

@@ -14,6 +14,7 @@ export interface NativeAuthCopy {
     emailLinkContinueAction: string;
     email: string;
     emailPlaceholder: string;
+    builderSignupDisclosure: string;
     legalPrefix: string;
     legalTerms: string;
     legalConnector: string;