@agent-native/core 0.7.81 → 0.7.83

package/dist/server/core-routes-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAyEvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AA6CvD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CA+pDhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}
+{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAyEvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AA6CvD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CAqqDhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}

package/dist/server/core-routes-plugin.js

@@ -10,7 +10,7 @@ import { BUILDER_ENV_KEYS, buildBuilderCliAuthUrl, createBuilderBrowserCallbackE
 import { getState, putState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, } from "../application-state/handlers.js";
 import { getSetting, putSetting, deleteSetting } from "../settings/store.js";
 import { getUserSetting, putUserSetting, deleteUserSetting, } from "../settings/user-settings.js";
-import { getSession, DEV_MODE_USER_EMAIL } from "./auth.js";
+import { getSession } from "./auth.js";
 import { getOrigin } from "./google-oauth.js";
 import { findWorkspaceRoot } from "../scripts/utils.js";
 import { listOnboardingSteps } from "../onboarding/registry.js";
@@ -201,9 +201,7 @@ export function createCoreRoutesPlugin(options = {}) {
                 String(event.node?.req?.url ?? event.path ?? "/").split("?")[0]);
             if (!pathname.startsWith(P) && !pathname.startsWith("/api/"))
                 return;
-            const reqHeaders = (event.node?.req?.headers ?? {});
-            const originRaw = reqHeaders["origin"];
-            const origin = Array.isArray(originRaw) ? originRaw[0] : originRaw;
+            const origin = getHeader(event, "origin");
             const method = getMethod(event);
             // Decide whether this origin is allowed. We never fall back to the
             // first allowlist entry — that previously echoed `Access-Control-
@@ -514,18 +512,6 @@ export function createCoreRoutesPlugin(options = {}) {
                 setResponseStatus(event, 401);
                 return { error: "Authentication required" };
             }
-            // `local@localhost` is the dev/local-mode bypass session. In a
-            // hosted production deploy it means either AUTH_MODE=local was
-            // misconfigured or AUTH_DISABLED=true is in use — either way the
-            // caller isn't a named user we should spend a Builder private key
-            // on. Allow it only when the environment explicitly opts into
-            // local mode (dev, tests, or AUTH_MODE=local).
-            if (session.email === DEV_MODE_USER_EMAIL &&
-                process.env.NODE_ENV === "production" &&
-                process.env.AUTH_MODE !== "local") {
-                setResponseStatus(event, 401);
-                return { error: "A signed-in user is required to run Builder" };
-            }
             const userEmail = session.email;
             if (!isBuilderBranchingEnabled()) {
                 setResponseStatus(event, 403);
@@ -566,6 +552,27 @@ export function createCoreRoutesPlugin(options = {}) {
                 }
             });
         }));
+        // Branch-creation waitlist signup. Used by ConnectBuilderCard when the
+        // deploy hasn't been opted into Builder branch creation (no
+        // ENABLE_BUILDER / BUILDER_BRANCH_PROJECT_ID) — instead of the raw 403
+        // from /builder/run, the card surfaces a "coming soon" CTA that POSTs
+        // here. Recorded as a tracking event so PostHog/Mixpanel/etc. capture
+        // demand without us standing up new storage.
+        getH3App(nitroApp).use(`${P}/builder/branch-waitlist`, defineEventHandler(async (event) => {
+            if (getMethod(event) !== "POST") {
+                setResponseStatus(event, 405);
+                return { error: "Method not allowed" };
+            }
+            const session = await getSession(event).catch(() => null);
+            if (!session?.email) {
+                setResponseStatus(event, 401);
+                return { error: "Authentication required" };
+            }
+            trackBuilderLifecycle("builder branch waitlist joined", session.email, {
+                stage: "waitlist",
+            });
+            return { ok: true };
+        }));
         getH3App(nitroApp).use(`${P}/builder/callback`, defineEventHandler(async (event) => {
             if (getMethod(event) !== "GET") {
                 setResponseStatus(event, 405);