@agent-native/core 0.227.0-nightly-20261110032437 → 0.227.0

package/dist/server/builder-signup-experiment.js

@@ -156,7 +156,8 @@ export async function bindBuilderSignupAttempt(event, attemptId, method, email)
     const createdAtMs = createdAt ? new Date(createdAt).getTime() : Number.NaN;
     if (!identity ||
         !Number.isFinite(createdAtMs) ||
-        createdAtMs < assignment.issuedAt)
+        createdAtMs < assignment.issuedAt ||
+        (assignment.acceptedAt !== undefined && createdAtMs < assignment.acceptedAt))
         return false;
     track("builder_signup_experiment_enrolled", { ...experimentProperties(assignment), method }, { authUserId: identity.user.id, userId: normalizedEmail });
     if (assignment.variant === "control") {
@@ -186,8 +187,6 @@ export async function bindBuilderSignupAttempt(event, attemptId, method, email)
     if (assignment.method !== method ||
         (assignment.email && assignment.email !== normalizedEmail))
         return false;
-    if (createdAtMs < assignment.acceptedAt)
-        return false;
     const bound = z
         .object({ id: z.string(), boundUserId: z.string() })
         .parse(await mutateSetting(key, (current) => current ?? { id: assignment.id, boundUserId: identity.user.id }));
@@ -204,7 +203,7 @@ export async function bindBuilderSignupAttempt(event, attemptId, method, email)
         maxAge: TTL,
         secure: getHeader(event, "host")?.includes("localhost") !== true,
     });
-    return true;
+    return { userId: identity.user.id };
 }
 export async function getBuilderSignupConnectError(userId) {
     if (!userId || !isBuilderSignupExperimentEnabled())
@@ -257,7 +256,22 @@ async function finishSignupActivation(key, attempt, outcome) {
         changed,
     };
 }
-export function createBuilderSignupExperimentHandler(dependencies) {
+let verifiedSignupStarter;
+export function setBuilderSignupVerifiedStarter(starter) {
+    verifiedSignupStarter = starter;
+}
+/** Called only after the auth provider issued this verified signup's session. */
+export async function startBuilderSignupForVerifiedSession(event, session) {
+    if (!isBuilderSignupExperimentEnabled() ||
+        !session.userId ||
+        !session.token ||
+        session.emailVerified !== true)
+        return;
+    if (!verifiedSignupStarter)
+        throw new Error("Builder signup activation handler is unavailable");
+    await verifiedSignupStarter(event, session);
+}
+export function createBuilderSignupExperiment(dependencies) {
     const reconcile = async (event, session, key, existing, assignment) => {
         const { attempt, startedAt } = existing;
         if (!session.userId ||
@@ -293,10 +307,11 @@ export function createBuilderSignupExperimentHandler(dependencies) {
             ...(result.code ? { code: result.code } : {}),
         };
     };
-    return defineEventHandler(async (event) => {
+    const handle = async (event, verifiedSignupSession) => {
         setResponseHeader(event, "Cache-Control", "no-store");
         const refuse = (status, code) => {
-            setResponseStatus(event, status);
+            if (!verifiedSignupSession)
+                setResponseStatus(event, status);
             return { status: "unavailable", code };
         };
         if (!isBuilderSignupExperimentEnabled()) {
@@ -304,12 +319,12 @@ export function createBuilderSignupExperimentHandler(dependencies) {
                 deleteCookie(event, "an_builder_signup_pending", { path: "/" });
             return { status: "disabled" };
         }
-        const method = getMethod(event);
+        const method = verifiedSignupSession ? "POST" : getMethod(event);
         if (method !== "GET" && method !== "POST")
             return refuse(405, "method_not_allowed");
-        if (!dependencies.sameOrigin(event))
+        if (!verifiedSignupSession && !dependencies.sameOrigin(event))
             return refuse(403, "cross_origin");
-        const session = await dependencies.getSession(event);
+        const session = verifiedSignupSession ?? (await dependencies.getSession(event));
         let assignment = decodeBuilderSignupAssignment(getCookie(event, builderSignupAssignmentCookieName()));
         if (method === "GET") {
             if (session)
@@ -329,7 +344,8 @@ export function createBuilderSignupExperimentHandler(dependencies) {
                 experimentId: experimentId(),
             };
         }
-        if (!/^application\/json\s*(;|$)/i.test(getHeader(event, "content-type") ?? ""))
+        if (!verifiedSignupSession &&
+            !/^application\/json\s*(;|$)/i.test(getHeader(event, "content-type") ?? ""))
             return refuse(415, "json_required");
         const body = z
             .object({
@@ -339,7 +355,9 @@ export function createBuilderSignupExperimentHandler(dependencies) {
             method: z.enum(["password", "magic-link", "google"]).optional(),
             email: z.string().email().max(320).optional(),
         })
-            .safeParse(await readBodyWithSizeLimit(event, 4096));
+            .safeParse(verifiedSignupSession
+            ? { operation: "start" }
+            : await readBodyWithSizeLimit(event, 4096));
         if (!body.success)
             return refuse(400, "invalid_request");
         const waitUntil = body.data.operation === "start"
@@ -385,7 +403,7 @@ export function createBuilderSignupExperimentHandler(dependencies) {
             }
         }
         if (body.data.operation === "status" ||
-            (body.data.operation === "start" && !waitUntil)) {
+            (body.data.operation === "start" && !waitUntil && !verifiedSignupSession)) {
             if (!session?.emailVerified || !session.userId)
                 return refuse(401, "verified_session_required");
             if (!consent) {
@@ -586,5 +604,9 @@ export function createBuilderSignupExperimentHandler(dependencies) {
         }
         // Hosts without a durable background lifetime must await the write.
         return completion;
-    });
+    };
+    return {
+        handler: defineEventHandler((event) => handle(event)),
+        startVerifiedSignup: (event, session) => handle(event, session),
+    };
 }

package/dist/server/core-routes-plugin.js

@@ -10,7 +10,7 @@ import { registerBuiltinEngines } from "../agent/engine/builtin.js";
 import { OPENAI_BASE_URL_ENV_VAR, PROVIDER_ENV_META, } from "../agent/engine/provider-env-vars.js";
 import { detectEngineFromEnvForRequest, detectEngineFromUserSecrets, isStoredEngineUsableForRequest, } from "../agent/engine/registry.js";
 import { canUpdateAgentLoopSettings, readAgentLoopSettings, resetAgentLoopSettings, validateMaxIterationsInput, writeAgentLoopSettings, } from "../agent/loop-settings.js";
-import { createBuilderSignupExperimentHandler, getBuilderSignupConnectError, getBuilderSignupTrackingIdentity, } from "./builder-signup-experiment.js";
+import { createBuilderSignupExperiment, setBuilderSignupVerifiedStarter, getBuilderSignupConnectError, getBuilderSignupTrackingIdentity, } from "./builder-signup-experiment.js";
 export { normalizeAgentEngineStatusModel, resolveAgentEngineStatus, } from "../agent/engine-status.js";
 import { getAppConfig } from "../app-config/index.js";
 import { getState, putState, compareAndSetState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, saveComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, getStateMany, putStateMany, APP_STATE_ANONYMOUS_OWNER_CONTEXT_KEY, } from "../application-state/handlers.js";
@@ -3478,7 +3478,7 @@ export function createCoreRoutesPlugin(options = {}) {
                 setResponseHeader(event, "Location", authorizationUrl);
                 return "";
             }));
-            getH3App(nitroApp).use(`${P}/auth/builder-signup-experiment`, createBuilderSignupExperimentHandler({
+            const builderSignupExperiment = createBuilderSignupExperiment({
                 getSession,
                 sameOrigin: isSameOriginConnect,
                 activate: async (event, session, owner) => {
@@ -3498,7 +3498,9 @@ export function createCoreRoutesPlugin(options = {}) {
                     });
                 },
                 reconcile: reconcileBuilderSignupActivation,
-            }));
+            });
+            setBuilderSignupVerifiedStarter(builderSignupExperiment.startVerifiedSignup);
+            getH3App(nitroApp).use(`${P}/auth/builder-signup-experiment`, builderSignupExperiment.handler);
             getH3App(nitroApp).use(`${P}/builder/provision`, createBuilderProvisionHandler((event) => resolveBuilderOwnerContext(event)));
             // Desktop Code Agents speak Anthropic Messages locally, but Builder
             // Gateway credentials live on the server. This same-origin route keeps

package/dist/server/index.d.ts

@@ -16,7 +16,7 @@ export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTarg
 export { createSSEHandler, type SSEHandlerOptions } from "./sse.js";
 export { isCredentialMembershipUnavailable } from "./credential-membership-unavailable.js";
 export { readOrgMemberRole } from "./personal-provider-key-policy.js";
-export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, getBrowserCookieSession, isSessionResolutionUnavailable, getMcpOAuthBearerSession, logout, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, setFirstRunOnboardingCookie, clearFrameworkSessionCookies, runAuthGuard, registerDesktopExchange, prepareDesktopOAuthBrowserBinding, matchesDesktopOAuthBrowserBinding, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
+export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, recordBuilderSignupBinding, getSession, getBrowserCookieSession, isSessionResolutionUnavailable, getMcpOAuthBearerSession, logout, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, setFirstRunOnboardingCookie, clearFrameworkSessionCookies, runAuthGuard, registerDesktopExchange, prepareDesktopOAuthBrowserBinding, matchesDesktopOAuthBrowserBinding, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
 export { hasSameOriginBrowserEvidence } from "./request-origin.js";
 export { getEmbedSessionOrigin } from "./embed-request-origin.js";
 export { handleIdentitySso, ensureIdentityUser, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_BOOTSTRAP_ACTIVATE_PATH, IDENTITY_SSO_BOOTSTRAP_BINDING_COOKIE, clearIdentitySsoBootstrapBindingCookie, getIdentitySsoBootstrapBindingCookie, setIdentitySsoBootstrapBindingCookie, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
@@ -41,6 +41,7 @@ export { callerHasThreadAccess } from "../agent/run-ownership.js";
 export { abortTurnByRefDurably, getActiveRunForThreadAsync, } from "../agent/run-manager.js";
 export { mountRealtimeVoiceRoutes, realtimeVoiceSafetyIdentifier, REALTIME_VOICE_MAX_SDP_BYTES, REALTIME_VOICE_MAX_TOOL_BODY_BYTES, REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS, REALTIME_VOICE_SESSION_PATH, REALTIME_VOICE_TOOL_PATH, type MountRealtimeVoiceRoutesOptions, type RealtimeVoiceIntelligence, type RealtimeVoiceRequestContext, type RealtimeVoiceToolExecutionRequest, type RealtimeVoiceToolExecutionResult, } from "./realtime-voice.js";
 export { getStoredModelForEngine, resolveEngine, } from "../agent/engine/index.js";
+export { resolveChatModelAvailability, type ChatModelAvailability, } from "../agent/engine/chat-model-availability.js";
 export { completeText, type CompleteTextMessage, type CompleteTextOptions, type CompleteTextResult, type CompleteTextUsage, } from "./complete-text.js";
 export { createDevScriptRegistry } from "../scripts/dev/index.js";
 export { createPollHandler, recordChange, prepareTransactionalChange, getVersion, getChangesSince, getCurrentPollBaseline, getPollEmitter, canSeeChangeForUser, POLL_CHANGE_EVENT, type TransactionalChange, } from "./poll.js";

package/dist/server/index.js

@@ -16,7 +16,7 @@ export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTarg
 export { createSSEHandler } from "./sse.js";
 export { isCredentialMembershipUnavailable } from "./credential-membership-unavailable.js";
 export { readOrgMemberRole } from "./personal-provider-key-policy.js";
-export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, getBrowserCookieSession, isSessionResolutionUnavailable, getMcpOAuthBearerSession, logout, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, setFirstRunOnboardingCookie, clearFrameworkSessionCookies, runAuthGuard, registerDesktopExchange, prepareDesktopOAuthBrowserBinding, matchesDesktopOAuthBrowserBinding, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
+export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, recordBuilderSignupBinding, getSession, getBrowserCookieSession, isSessionResolutionUnavailable, getMcpOAuthBearerSession, logout, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, setFirstRunOnboardingCookie, clearFrameworkSessionCookies, runAuthGuard, registerDesktopExchange, prepareDesktopOAuthBrowserBinding, matchesDesktopOAuthBrowserBinding, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
 export { hasSameOriginBrowserEvidence } from "./request-origin.js";
 export { getEmbedSessionOrigin } from "./embed-request-origin.js";
 export { handleIdentitySso, ensureIdentityUser, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_BOOTSTRAP_ACTIVATE_PATH, IDENTITY_SSO_BOOTSTRAP_BINDING_COOKIE, clearIdentitySsoBootstrapBindingCookie, getIdentitySsoBootstrapBindingCookie, setIdentitySsoBootstrapBindingCookie, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
@@ -39,6 +39,7 @@ export { callerHasThreadAccess } from "../agent/run-ownership.js";
 export { abortTurnByRefDurably, getActiveRunForThreadAsync, } from "../agent/run-manager.js";
 export { mountRealtimeVoiceRoutes, realtimeVoiceSafetyIdentifier, REALTIME_VOICE_MAX_SDP_BYTES, REALTIME_VOICE_MAX_TOOL_BODY_BYTES, REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS, REALTIME_VOICE_SESSION_PATH, REALTIME_VOICE_TOOL_PATH, } from "./realtime-voice.js";
 export { getStoredModelForEngine, resolveEngine, } from "../agent/engine/index.js";
+export { resolveChatModelAvailability, } from "../agent/engine/chat-model-availability.js";
 export { completeText, } from "./complete-text.js";
 export { createDevScriptRegistry } from "../scripts/dev/index.js";
 export { createPollHandler, recordChange, prepareTransactionalChange, getVersion, getChangesSince, getCurrentPollBaseline, getPollEmitter, canSeeChangeForUser, POLL_CHANGE_EVENT, } from "./poll.js";

package/dist/server/onboarding-html.d.ts

@@ -33,6 +33,8 @@ export interface OnboardingHtmlOptions {
     signupLegalNotice?: SignupLegalNoticeOptions | false;
     googleAuthMode?: GoogleAuthMode;
     renderSignInPage?: (props: AuthPageProps) => string | undefined;
+    /** Trusted HTML appended to the sign-in document head. */
+    authHeadHtml?: string;
 }
 export declare function getOnboardingHtml(opts?: OnboardingHtmlOptions): string;
 export declare function getResetPasswordHtml(requestPath?: string, renderResetPasswordPage?: (props: ResetPasswordPageProps) => string | undefined): string;

package/dist/server/onboarding-html.js

@@ -2129,6 +2129,10 @@ export function getOnboardingHtml(opts = {}) {
     bottom: max(1.25rem, env(safe-area-inset-bottom));
     inset-inline-end: max(1.25rem, env(safe-area-inset-right));
   }
+  body.has-marketing .locale-menu {
+    top: auto;
+    bottom: calc(100% + 0.375rem);
+  }
   @media (prefers-color-scheme: light) {
     body.has-marketing {
       --auth-marketing-border: color-mix(in srgb, var(--auth-marketing-foreground) 18%, transparent);
@@ -2185,7 +2189,7 @@ export function getOnboardingHtml(opts = {}) {
       padding: max(1.5rem, env(safe-area-inset-top)) 1.25rem max(1.5rem, env(safe-area-inset-bottom));
       border-inline-start: 0;
     }
-    .auth-marketing-home .marketing-panel { display: none; }
+    .auth-marketing-home .marketing-panel { order: 2; min-height: 0; }
     .auth-marketing-home .card h1 {
       font-size: clamp(1.625rem, 6vw, 2rem);
       line-height: 1.15;
@@ -2211,9 +2215,9 @@ export function getOnboardingHtml(opts = {}) {
   }
 `;
     const authClientScriptPath = authClientAssetPath(appBasePath);
-    const title = hasMarketing
-        ? `${marketing.appName} — ${t("pageTitleSignIn")}`
-        : t("pageTitleWelcome");
+    const title = marketing && !simplifiedAuth
+        ? `${marketing.appName} — ${EN_AUTH_COPY.pageTitleSignIn}`
+        : EN_AUTH_COPY.pageTitleWelcome;
     const authPageMarkup = opts.renderSignInPage?.(authPageProps);
     const fallbackTitle = googleOnly
         ? t("pageTitleSignIn")
@@ -2254,7 +2258,7 @@ export function getOnboardingHtml(opts = {}) {
         : hasMarketing
             ? "has-marketing"
             : "";
-    return `<!DOCTYPE html><html lang="${DEFAULT_LOCALE}" dir="ltr"><head><meta charset="UTF-8"/><script data-agent-native-locale-init="">${localeInitScript}</script><script data-agent-native-embedded-init="">${embeddedAuthInitScript}</script><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"/>${fontLinks}<title>${escapeHtml(title)}</title><link rel="icon" type="image/svg+xml" href="${escapeHtml(withAppBasePath("/favicon.svg", appBasePath))}"/><link rel="apple-touch-icon" href="${escapeHtml(withAppBasePath("/icon-180.svg", appBasePath))}"/>${marketingMeta}<style>${authDocumentStyles + authPageLayoutStyles}</style><script type="module" src="${escapeHtml(authClientScriptPath)}"></script></head><body${bodyClass ? ` class="${bodyClass}"` : ""}><div id="agent-native-auth-root" class="auth-root"${authPageMarkup === undefined ? ' data-agent-native-auth-fallback="true"' : ""}>${pageMarkup}</div><script type="application/json" id="agent-native-auth-data">${authPageData}</script></body></html>`;
+    return `<!DOCTYPE html><html lang="${DEFAULT_LOCALE}" dir="ltr"><head><meta charset="UTF-8"/><script data-agent-native-locale-init="">${localeInitScript}</script><script data-agent-native-embedded-init="">${embeddedAuthInitScript}</script><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"/>${fontLinks}<title>${escapeHtml(title)}</title><link rel="icon" type="image/svg+xml" href="${escapeHtml(withAppBasePath("/favicon.svg", appBasePath))}"/><link rel="apple-touch-icon" href="${escapeHtml(withAppBasePath("/icon-180.svg", appBasePath))}"/>${marketingMeta}<style>${authDocumentStyles + authPageLayoutStyles}</style>${opts.authHeadHtml ?? ""}<script type="module" src="${escapeHtml(authClientScriptPath)}"></script></head><body${bodyClass ? ` class="${bodyClass}"` : ""}><div id="agent-native-auth-root" class="auth-root"${authPageMarkup === undefined ? ' data-agent-native-auth-fallback="true"' : ""}>${pageMarkup}</div><script type="application/json" id="agent-native-auth-data">${authPageData}</script></body></html>`;
 }
 const RESET_PASSWORD_STYLES = `
   /* guard:allow-raw-color - standalone reset page has no app theme token layer */

package/dist/server/release-migrations.d.ts

@@ -1 +1,3 @@
-export declare function runFrameworkReleaseMigrations(_nitroApp?: unknown): Promise<void>;
+export declare function runFrameworkReleaseMigrations(_nitroApp?: unknown, options?: {
+    requirePostgres?: boolean;
+}): Promise<void>;

package/dist/server/release-migrations.js

@@ -11,21 +11,23 @@ import { runFrameworkSchemaEnsures } from "./release-schema.js";
  * still reports success — `Applied migration ...` lines, a zero exit, a
  * published deploy — so this has to fail here or it fails silently forever.
  *
- * Scoped to `CONTEXT=production` on purpose. The beta lane deliberately builds
+ * Explicit production commands always require a PostgreSQL target. Other callers
+ * are scoped to `CONTEXT=production`: the beta lane deliberately builds
  * with `AGENT_NATIVE_RUN_RELEASE_MIGRATIONS=1` under a branch-deploy context
  * against masked site secrets, and its database is migrated by the beta
  * publish step — so keying off that flag would fail every beta deploy while
  * never guarding the production one this exists for.
  */
-function assertReleaseMigrationTargetsRemoteDatabase() {
-    if (getAppConfig().migration.deployContext !== "production")
+function assertReleaseMigrationTargetsRemoteDatabase(requirePostgres) {
+    if (!requirePostgres &&
+        getAppConfig().migration.deployContext !== "production")
         return;
     const url = getDatabaseUrl();
     // `isLocalDatabase()` alone is not enough. Netlify hands the CLI a MASKED
     // secret ("****************uire") outside its own build infra, and that is
     // neither empty nor a local URL — so it reads as "not local" while being
     // unconnectable. Require a real remote scheme too.
-    if (url.includes("://"))
+    if (/^postgres(?:ql)?:\/\//i.test(url))
         return;
     throw new Error(`Release migrations resolved to an unusable database (${describeReleaseMigrationUrl(url)}). ` +
         "In a production deploy the schema must be applied to the same remote " +
@@ -50,7 +52,7 @@ function shouldLogReleaseTiming() {
         process.env.VITEST !== "true" &&
         process.env.VITEST !== "1");
 }
-export async function runFrameworkReleaseMigrations(_nitroApp) {
+export async function runFrameworkReleaseMigrations(_nitroApp, options = {}) {
     const logTiming = shouldLogReleaseTiming();
     const startedAt = Date.now();
     if (logTiming) {
@@ -58,7 +60,7 @@ export async function runFrameworkReleaseMigrations(_nitroApp) {
     }
     let lockWaitMs;
     try {
-        assertReleaseMigrationTargetsRemoteDatabase();
+        assertReleaseMigrationTargetsRemoteDatabase(options.requirePostgres === true);
         // One lease for the whole release, so two deploys against one database
         // never interleave.
         await withStoreMigrationLock(async () => {

package/dist/shared/mcp-embed-headers.js

@@ -164,8 +164,14 @@ const STATIC_ASSET_PATTERNS = [
     "/favicon.ico",
     "/favicon.svg",
     "/manifest.json",
-    "/icon-*.svg",
-    "/agent-native-*.svg",
+    "/icon-180.svg",
+    "/icon-192.svg",
+    "/icon-512.svg",
+    "/agent-native-icon-dark.svg",
+    "/agent-native-icon-light.svg",
+    "/agent-native-icon-light-512.svg",
+    "/agent-native-logo-dark.svg",
+    "/agent-native-logo-light.svg",
     "/library-presets/**",
 ];
 function normalizeBasePath(basePath) {

package/dist/templates/builder-code-starter/AGENTS.md.patch

@@ -41,7 +41,7 @@
 -Choose the primary workflow and route before editing. Add a domain route under `app/routes/` and set `app.homePath` in `server/plugins/agent-native-email-branding.ts` with `defineAppConfig`. The default Get started page lives at `/home`, and Chat stays at `/chat`; edit `app/routes/home.tsx` when replacing that page with a domain-specific home. Add a static link in `app/components/layout/Sidebar.tsx` before `ChatThreadsSection`; `Header.tsx` uses `APP_TITLE` elsewhere. Shared sidebar and AgentInspector remain.
 +Choose the primary workflow and route before editing. Build on the blank canvas in `app/routes/_index.tsx` or add domain routes under `app/routes/`. This starter has no Chat route, sidebar, header, or agent rail; add only the navigation the product needs. Set `app.homePath` in the existing `defineAppConfig` in `server/plugins/config.ts` as `DEVELOPING.md` describes.
  
--Use `adding-a-feature` for functional parity and `frontend-design` for a user-facing screen. Keep feature guidance here; do not rewrite `README.md` or `DESIGN.md`. After all edits, run one typecheck, one doctor check, and one browser smoke of the primary workflow, including overlap rejection, cancellation freeing the slot, and authenticated landing. Skip production build and extra test suites.
+-Use `adding-a-feature` for functional parity and `frontend-design` for a user-facing screen. Keep feature guidance here; do not rewrite `README.md` or `DESIGN.md`. After all edits, run one typecheck, one doctor check, and one browser smoke of the primary workflow and its authenticated landing. Skip production build and extra test suites.
 +Use `adding-a-feature` for functional parity and `frontend-design` for a user-facing screen. Keep feature guidance here and update `README.md` as `DEVELOPING.md` describes. After all edits, run one typecheck, one doctor check, and one browser smoke of the primary workflow and its authenticated landing. Skip production build and extra test suites.
  
  Before building common workspace or agent UI, read `agent-native-toolkit`; for supported customization, read `customizing-agent-native`.

package/dist/templates/builder-code-starter/server/plugins/auth.ts.patch

@@ -1,13 +1,14 @@
 ===================================================================
 --- a/server/plugins/auth.ts
 +++ b/server/plugins/auth.ts
-@@ -1,7 +1,8 @@
+@@ -1,8 +1,8 @@
 -import { createToolkitAuthPlugin } from "@agent-native/toolkit/app/auth/server";
 +import { createAuthPlugin } from "@agent-native/core/server";
  
 -export default createToolkitAuthPlugin({
 -  workspaceAppPublicPaths: ["/"],
 -  rootAuth: true,
+-  // Remove this option to use built-in marketing, or supply an object for custom copy.
 -  marketing: false,
 +// Email/password auth with optional Google OAuth (enabled automatically when
 +// GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are set). No marketing copy — a

package/dist/templates/chat/AGENTS.md

@@ -26,6 +26,6 @@ For custom branding, keep `server/plugins/agent-native-email-branding.ts` aligne
 
 Choose the primary workflow and route before editing. Add a domain route under `app/routes/` and set `app.homePath` in `server/plugins/agent-native-email-branding.ts` with `defineAppConfig`. The default Get started page lives at `/home`, and Chat stays at `/chat`; edit `app/routes/home.tsx` when replacing that page with a domain-specific home. Add a static link in `app/components/layout/Sidebar.tsx` before `ChatThreadsSection`; `Header.tsx` uses `APP_TITLE` elsewhere. Shared sidebar and AgentInspector remain.
 
-Use `adding-a-feature` for functional parity and `frontend-design` for a user-facing screen. Keep feature guidance here; do not rewrite `README.md` or `DESIGN.md`. After all edits, run one typecheck, one doctor check, and one browser smoke of the primary workflow, including overlap rejection, cancellation freeing the slot, and authenticated landing. Skip production build and extra test suites.
+Use `adding-a-feature` for functional parity and `frontend-design` for a user-facing screen. Keep feature guidance here; do not rewrite `README.md` or `DESIGN.md`. After all edits, run one typecheck, one doctor check, and one browser smoke of the primary workflow and its authenticated landing. Skip production build and extra test suites.
 
 Before building common workspace or agent UI, read `agent-native-toolkit`; for supported customization, read `customizing-agent-native`.

package/dist/templates/chat/app/components/layout/Sidebar.tsx

@@ -403,7 +403,7 @@ export function Sidebar({
       <nav
         aria-label={t("navigation.navigation")}
         className={cn(
-          "flex min-h-0 flex-1 flex-col",
+          "flex min-h-0 flex-1 flex-col overflow-y-auto",
           collapsed ? "items-center gap-1 px-1 py-2" : "pt-1",
         )}
       >

package/dist/templates/chat/scripts/migrate-production.ts

@@ -9,7 +9,7 @@ loadEnv();
 
 async function main(): Promise<void> {
   await withMigrationRuntime(async () => {
-    await runFrameworkReleaseMigrations(null);
+    await runFrameworkReleaseMigrations(null, { requirePostgres: true });
     await runAppReleaseMigrations();
   });
 }

package/dist/templates/chat/server/plugins/auth.ts

@@ -3,5 +3,6 @@ import { createToolkitAuthPlugin } from "@agent-native/toolkit/app/auth/server";
 export default createToolkitAuthPlugin({
   workspaceAppPublicPaths: ["/"],
   rootAuth: true,
+  // Remove this option to use built-in marketing, or supply an object for custom copy.
   marketing: false,
 });

package/dist/templates/default/pnpm-workspace.yaml

@@ -2,47 +2,6 @@ overrides:
   "@assistant-ui/store": ">=0.2.9 <0.2.14"
   "@assistant-ui/tap": "^0.5.14"
   nf3: "0.3.17"
-  "@tiptap/core": "3.28.0"
-  "@tiptap/extension-blockquote": "3.28.0"
-  "@tiptap/extension-bold": "3.28.0"
-  "@tiptap/extension-bubble-menu": "3.28.0"
-  "@tiptap/extension-bullet-list": "3.28.0"
-  "@tiptap/extension-code": "3.28.0"
-  "@tiptap/extension-code-block": "3.28.0"
-  "@tiptap/extension-code-block-lowlight": "3.28.0"
-  "@tiptap/extension-collaboration": "3.28.0"
-  "@tiptap/extension-collaboration-caret": "3.28.0"
-  "@tiptap/extension-color": "3.28.0"
-  "@tiptap/extension-document": "3.28.0"
-  "@tiptap/extension-dropcursor": "3.28.0"
-  "@tiptap/extension-floating-menu": "3.28.0"
-  "@tiptap/extension-gapcursor": "3.28.0"
-  "@tiptap/extension-hard-break": "3.28.0"
-  "@tiptap/extension-heading": "3.28.0"
-  "@tiptap/extension-horizontal-rule": "3.28.0"
-  "@tiptap/extension-image": "3.28.0"
-  "@tiptap/extension-italic": "3.28.0"
-  "@tiptap/extension-link": "3.28.0"
-  "@tiptap/extension-list": "3.28.0"
-  "@tiptap/extension-list-item": "3.28.0"
-  "@tiptap/extension-list-keymap": "3.28.0"
-  "@tiptap/extension-ordered-list": "3.28.0"
-  "@tiptap/extension-paragraph": "3.28.0"
-  "@tiptap/extension-placeholder": "3.28.0"
-  "@tiptap/extension-strike": "3.28.0"
-  "@tiptap/extension-table": "3.28.0"
-  "@tiptap/extension-table-cell": "3.28.0"
-  "@tiptap/extension-table-header": "3.28.0"
-  "@tiptap/extension-table-row": "3.28.0"
-  "@tiptap/extension-task-item": "3.28.0"
-  "@tiptap/extension-task-list": "3.28.0"
-  "@tiptap/extension-text": "3.28.0"
-  "@tiptap/extension-text-style": "3.28.0"
-  "@tiptap/extension-underline": "3.28.0"
-  "@tiptap/extensions": "3.28.0"
-  "@tiptap/pm": "3.28.0"
-  "@tiptap/react": "3.28.0"
-  "@tiptap/starter-kit": "3.28.0"
 
 allowBuilds:
   esbuild: true

package/dist/templates/default/scripts/migrate-production.ts

@@ -9,7 +9,7 @@ loadEnv();
 
 async function main(): Promise<void> {
   await withMigrationRuntime(async () => {
-    await runFrameworkReleaseMigrations(null);
+    await runFrameworkReleaseMigrations(null, { requirePostgres: true });
     await runAppReleaseMigrations();
   });
 }

package/dist/templates/workspace-root/pnpm-workspace.yaml

@@ -27,47 +27,6 @@ overrides:
   esbuild: "^0.28.1"
   srvx: "^0.12.4"
   zod: "^4.4.3"
-  "@tiptap/core": "3.28.0"
-  "@tiptap/extension-blockquote": "3.28.0"
-  "@tiptap/extension-bold": "3.28.0"
-  "@tiptap/extension-bubble-menu": "3.28.0"
-  "@tiptap/extension-bullet-list": "3.28.0"
-  "@tiptap/extension-code": "3.28.0"
-  "@tiptap/extension-code-block": "3.28.0"
-  "@tiptap/extension-code-block-lowlight": "3.28.0"
-  "@tiptap/extension-collaboration": "3.28.0"
-  "@tiptap/extension-collaboration-caret": "3.28.0"
-  "@tiptap/extension-color": "3.28.0"
-  "@tiptap/extension-document": "3.28.0"
-  "@tiptap/extension-dropcursor": "3.28.0"
-  "@tiptap/extension-floating-menu": "3.28.0"
-  "@tiptap/extension-gapcursor": "3.28.0"
-  "@tiptap/extension-hard-break": "3.28.0"
-  "@tiptap/extension-heading": "3.28.0"
-  "@tiptap/extension-horizontal-rule": "3.28.0"
-  "@tiptap/extension-image": "3.28.0"
-  "@tiptap/extension-italic": "3.28.0"
-  "@tiptap/extension-link": "3.28.0"
-  "@tiptap/extension-list": "3.28.0"
-  "@tiptap/extension-list-item": "3.28.0"
-  "@tiptap/extension-list-keymap": "3.28.0"
-  "@tiptap/extension-ordered-list": "3.28.0"
-  "@tiptap/extension-paragraph": "3.28.0"
-  "@tiptap/extension-placeholder": "3.28.0"
-  "@tiptap/extension-strike": "3.28.0"
-  "@tiptap/extension-table": "3.28.0"
-  "@tiptap/extension-table-cell": "3.28.0"
-  "@tiptap/extension-table-header": "3.28.0"
-  "@tiptap/extension-table-row": "3.28.0"
-  "@tiptap/extension-task-item": "3.28.0"
-  "@tiptap/extension-task-list": "3.28.0"
-  "@tiptap/extension-text": "3.28.0"
-  "@tiptap/extension-text-style": "3.28.0"
-  "@tiptap/extension-underline": "3.28.0"
-  "@tiptap/extensions": "3.28.0"
-  "@tiptap/pm": "3.28.0"
-  "@tiptap/react": "3.28.0"
-  "@tiptap/starter-kit": "3.28.0"
 
 packageExtensions:
   "node-pty@*":

package/dist/tracking/providers.js

@@ -14,12 +14,17 @@ const MAX_BATCH_SIZE = 50;
 const SEND_TIMEOUT_MS = 10_000;
 const QUEUE_KEY = Symbol.for("@agent-native/core/tracking.queue");
 const TIMER_KEY = Symbol.for("@agent-native/core/tracking.timer");
+const IN_FLIGHT_KEY = Symbol.for("@agent-native/core/tracking.in-flight");
 function getQueue() {
     const g = globalThis;
     if (!g[QUEUE_KEY])
         g[QUEUE_KEY] = [];
     return g[QUEUE_KEY];
 }
+function getInFlight() {
+    const global = globalThis;
+    return (global[IN_FLIGHT_KEY] ??= new Set());
+}
 function getTimer() {
     const g = globalThis;
     return g[TIMER_KEY] ?? null;
@@ -51,14 +56,21 @@ function drainQueue() {
     }
     const queue = getQueue();
     const batch = queue.splice(0, queue.length);
-    return Promise.all(batch.map((item) => 
-    // Whichever call's frame drains the queue, the events are not its writes.
-    withoutWriteObservation(() => fetch(item.url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", ...item.headers },
-        body: item.body,
-        signal: AbortSignal.timeout(SEND_TIMEOUT_MS),
-    })).then(() => undefined, () => undefined)));
+    const inFlight = getInFlight();
+    for (const item of batch) {
+        // Whichever call's frame drains the queue, the events are not its writes.
+        const send = withoutWriteObservation(() => fetch(item.url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", ...item.headers },
+            body: item.body,
+            signal: AbortSignal.timeout(SEND_TIMEOUT_MS),
+        })).then(() => undefined, () => undefined);
+        inFlight.add(send);
+        void send.finally(() => inFlight.delete(send));
+    }
+    // Serverless sends leave the queue immediately. A later flush must still
+    // hold the request's background lifetime until those sends settle.
+    return Promise.all([...inFlight]);
 }
 function isLocalhostUrl(value) {
     if (!value || !value.trim())

package/dist/triggers/actions/list-automations.js

@@ -3,6 +3,7 @@ import { defineAction } from "../../action.js";
 import { listAccessibleAutomationDefinitions, } from "../../automations/service.js";
 import { hasStalePause, isPausedByFramework, } from "../../jobs/automation-outcome.js";
 import { describeCron, effectiveTimezone, isValidCron, nextOccurrence, } from "../../jobs/cron.js";
+import { isRecoveredFactoryJob, jobBelongsToApp, } from "../../jobs/frontmatter.js";
 import { listLatestAutomationRuns } from "../../jobs/run-history.js";
 function nextRun(meta) {
     if (!meta.enabled)
@@ -111,7 +112,12 @@ export default defineAction({
                 deliveryTenantId: meta.deliveryTenantId ?? null,
                 canUpdate,
                 effectiveRole,
-                capabilities,
+                capabilities: {
+                    ...capabilities,
+                    canOperate: capabilities.canOperate &&
+                        (jobBelongsToApp(meta, ctx.appId) ||
+                            isRecoveredFactoryJob(meta, resource.path, ctx.appId, resource.owner)),
+                },
                 sharing,
                 creator,
             };