@agent-native/core 0.90.5 → 0.90.8

package/dist/observability/routes.d.ts

@@ -42,22 +42,22 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     avgEvalScore: number;
 } | {
     error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    ok?: undefined;
 } | {
     error?: undefined;
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
     error?: undefined;
     summary?: undefined;

package/dist/server/core-routes-plugin.d.ts

@@ -54,6 +54,7 @@ interface BuilderWaitlistFormTarget {
     formsOrigin: string;
 }
 export interface BuilderWaitlistBody {
+    email?: unknown;
     prompt?: unknown;
     orgName?: unknown;
     appUrl?: unknown;
@@ -62,6 +63,15 @@ export interface BuilderWaitlistBody {
     useCase?: unknown;
 }
 export declare function resolveFrameworkSseRoutes(sseRoute?: string): string[];
+export declare function isAnonymousWaitlistSessionEmail(email: string): boolean;
+export declare function resolveWaitlistEmail(sessionEmail: string | undefined, bodyEmail: unknown): string | null;
+export declare function checkBuilderWaitlistRateLimit(event: H3Event, email: string, now?: number): {
+    ok: true;
+} | {
+    ok: false;
+    retryAfterSeconds: number;
+};
+export declare function resetBuilderWaitlistRateLimitForTests(): void;
 export declare function resolveBuilderWaitlistFormTargetForRequest(event: H3Event): BuilderWaitlistFormTarget | null;
 export declare function buildBuilderWaitlistFormPayload(event: H3Event, sessionEmail: string, body: BuilderWaitlistBody): {
     data: {

package/dist/server/core-routes-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAoClC,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,8BAA8B,CAAC;AAgDtC,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AA+BzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAoCvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,eAAO,MAAM,sBAAsB,0BAAqC,CAAC;AACzE,eAAO,MAAM,6BAA6B,+BAA0C,CAAC;AAErF,wBAAgB,mBAAmB,IAAI,YAAY,EAAE,CA+BpD;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,EAAE,EAAE,IAAI,CAAC;IACT,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,EAAE,EAAE,OAAO,CAAC;IACZ,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,0EAA0E;IAC1E,QAAQ,EAAE;QACR,UAAU,EAAE,OAAO,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,OAAO,CAAC;QAC7B,4BAA4B,EAAE,OAAO,CAAC;KACvC,CAAC;IACF,yDAAyD;IACzD,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,GAAE,MAAM;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAc,EACtE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAYD,UAAU,yBAAyB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrE;AAsCD,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,OAAO,GACb,yBAAyB,GAAG,IAAI,CAsBlC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,mBAAmB;;;;;;;;;;;;;;;;EA2B1B;AAgDD,eAAO,MAAM,kBAAkB,QAAwC,CAAC;AAExE,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,MAAM,CAoBR;AAwHD,KAAK,6BAA6B,GAAG,CACnC,KAAK,EAAE,OAAO,KACX,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjE,EACN,IAAI,CAAC,EAAE,SAAS,GAAG,UAAU,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAsD9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CASf;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAc/D;AAUD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;wCACoC;IACpC,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAChF;2DACuD;IACvD,wBAAwB,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IAClG,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CAkrFhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}
+{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAoClC,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,8BAA8B,CAAC;AAgDtC,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AA+BzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAoCvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,eAAO,MAAM,sBAAsB,0BAAqC,CAAC;AACzE,eAAO,MAAM,6BAA6B,+BAA0C,CAAC;AAErF,wBAAgB,mBAAmB,IAAI,YAAY,EAAE,CA+BpD;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,EAAE,EAAE,IAAI,CAAC;IACT,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,EAAE,EAAE,OAAO,CAAC;IACZ,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,0EAA0E;IAC1E,QAAQ,EAAE;QACR,UAAU,EAAE,OAAO,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,OAAO,CAAC;QAC7B,4BAA4B,EAAE,OAAO,CAAC;KACvC,CAAC;IACF,yDAAyD;IACzD,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,GAAE,MAAM;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAc,EACtE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAmBD,UAAU,yBAAyB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrE;AAyBD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,SAAS,EAAE,OAAO,GACjB,MAAM,GAAG,IAAI,CAOf;AAoCD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,GAAG,SAAa,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAoCzD;AAED,wBAAgB,qCAAqC,SAEpD;AAmBD,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,OAAO,GACb,yBAAyB,GAAG,IAAI,CAsBlC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,mBAAmB;;;;;;;;;;;;;;;;EA2B1B;AAgDD,eAAO,MAAM,kBAAkB,QAAwC,CAAC;AAExE,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,MAAM,CAoBR;AAwHD,KAAK,6BAA6B,GAAG,CACnC,KAAK,EAAE,OAAO,KACX,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjE,EACN,IAAI,CAAC,EAAE,SAAS,GAAG,UAAU,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAsD9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CASf;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAc/D;AAUD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;wCACoC;IACpC,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAChF;2DACuD;IACvD,wBAAwB,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IAClG,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CAssFhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}

package/dist/server/core-routes-plugin.js

@@ -1,4 +1,4 @@
-import { defineEventHandler, setResponseStatus, setResponseHeader, getMethod, getHeader, getCookie, setCookie, deleteCookie, getRequestURL, } from "h3";
+import { defineEventHandler, setResponseStatus, setResponseHeader, getMethod, getHeader, getCookie, setCookie, deleteCookie, getRequestURL, getRequestIP, } from "h3";
 import { readMultipartFormData } from "h3";
 import { DEFAULT_MODEL } from "../agent/default-model.js";
 import { registerBuiltinEngines } from "../agent/engine/builtin.js";
@@ -140,9 +140,13 @@ const BUILDER_WAITLIST_DEFAULT_USE_CASE = "builder_agent_background_coding";
 const BUILDER_WAITLIST_USE_CASES = new Set([
     BUILDER_WAITLIST_DEFAULT_USE_CASE,
     "design_publish_app",
+    "docs_build_online_waitlist",
 ]);
 const BUILDER_WAITLIST_FORM_TIMEOUT_MS = 8000;
 const BUILDER_WAITLIST_TEXT_LIMIT = 4000;
+const BUILDER_WAITLIST_RATE_LIMIT_WINDOW_MS = 60_000;
+const BUILDER_WAITLIST_RATE_LIMIT_MAX = 5;
+const builderWaitlistRateLimitHits = new Map();
 export function resolveFrameworkSseRoutes(sseRoute) {
     return Array.from(new Set([
         sseRoute ?? FRAMEWORK_EVENTS_ROUTE,
@@ -165,6 +169,87 @@ function normalizeBuilderWaitlistUseCase(value) {
         ? useCase
         : BUILDER_WAITLIST_DEFAULT_USE_CASE;
 }
+function isValidWaitlistEmail(email) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+export function isAnonymousWaitlistSessionEmail(email) {
+    return email.startsWith("anon-") && email.endsWith("@agent-native.com");
+}
+export function resolveWaitlistEmail(sessionEmail, bodyEmail) {
+    const provided = cleanBuilderWaitlistText(bodyEmail, 320);
+    if (provided && isValidWaitlistEmail(provided))
+        return provided;
+    if (sessionEmail && !isAnonymousWaitlistSessionEmail(sessionEmail)) {
+        return sessionEmail;
+    }
+    return null;
+}
+function normalizeWaitlistRateLimitPart(value) {
+    return value.trim().toLowerCase();
+}
+function getBuilderWaitlistClientIp(event) {
+    const trusted = getHeader(event, "x-nf-client-connection-ip") ??
+        getHeader(event, "cf-connecting-ip") ??
+        getHeader(event, "true-client-ip") ??
+        getHeader(event, "x-real-ip");
+    if (trusted && trusted.trim())
+        return trusted.trim();
+    const forwardedFor = getHeader(event, "x-forwarded-for");
+    const forwardedClientIp = forwardedFor?.split(",")[0]?.trim();
+    if (forwardedClientIp)
+        return forwardedClientIp;
+    try {
+        return getRequestIP(event) ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function getBuilderWaitlistRateLimitKeys(event, email) {
+    const clientIp = getBuilderWaitlistClientIp(event);
+    return [
+        `email:${normalizeWaitlistRateLimitPart(email)}`,
+        `ip:${normalizeWaitlistRateLimitPart(clientIp ?? "unknown")}`,
+    ];
+}
+export function checkBuilderWaitlistRateLimit(event, email, now = Date.now()) {
+    const keys = getBuilderWaitlistRateLimitKeys(event, email);
+    let retryAfterMs = 0;
+    for (const key of keys) {
+        const entry = builderWaitlistRateLimitHits.get(key);
+        if (!entry)
+            continue;
+        if (entry.resetAt <= now) {
+            builderWaitlistRateLimitHits.delete(key);
+            continue;
+        }
+        if (entry.count >= BUILDER_WAITLIST_RATE_LIMIT_MAX) {
+            retryAfterMs = Math.max(retryAfterMs, entry.resetAt - now);
+        }
+    }
+    if (retryAfterMs > 0) {
+        return {
+            ok: false,
+            retryAfterSeconds: Math.max(1, Math.ceil(retryAfterMs / 1000)),
+        };
+    }
+    for (const key of keys) {
+        const entry = builderWaitlistRateLimitHits.get(key);
+        if (!entry || entry.resetAt <= now) {
+            builderWaitlistRateLimitHits.set(key, {
+                count: 1,
+                resetAt: now + BUILDER_WAITLIST_RATE_LIMIT_WINDOW_MS,
+            });
+        }
+        else {
+            entry.count += 1;
+        }
+    }
+    return { ok: true };
+}
+export function resetBuilderWaitlistRateLimitForTests() {
+    builderWaitlistRateLimitHits.clear();
+}
 function normalizeHttpOrigin(value) {
     try {
         const url = new URL(value);
@@ -1318,21 +1403,30 @@ export function createCoreRoutesPlugin(options = {}) {
                     return { error: "Method not allowed" };
                 }
                 const session = await getSession(event).catch(() => null);
-                if (!session?.email) {
-                    setResponseStatus(event, 401);
-                    return { error: "Authentication required" };
-                }
                 const body = ((await readBody(event).catch(() => ({}))) ??
                     {});
-                const waitlistPayload = buildBuilderWaitlistFormPayload(event, session.email, body);
+                const waitlistEmail = resolveWaitlistEmail(session?.email, body.email);
+                if (!waitlistEmail) {
+                    setResponseStatus(event, 400);
+                    return { error: "Valid email required" };
+                }
+                const waitlistRateLimit = checkBuilderWaitlistRateLimit(event, waitlistEmail);
+                if (!waitlistRateLimit.ok) {
+                    setResponseStatus(event, 429);
+                    setResponseHeader(event, "Retry-After", String(waitlistRateLimit.retryAfterSeconds));
+                    return {
+                        error: "Too many waitlist requests. Please try again in a minute.",
+                    };
+                }
+                const waitlistPayload = buildBuilderWaitlistFormPayload(event, waitlistEmail, body);
                 const waitlistSource = waitlistPayload.data.source;
                 const waitlistUseCase = waitlistPayload.data.useCase;
                 let formSubmission;
                 try {
-                    formSubmission = await submitBuilderWaitlistForm(event, session.email, body);
+                    formSubmission = await submitBuilderWaitlistForm(event, waitlistEmail, body);
                 }
                 catch (err) {
-                    await trackBuilderLifecycle(event, "builder branch waitlist form failed", session.email, {
+                    await trackBuilderLifecycle(event, "builder branch waitlist form failed", waitlistEmail, {
                         reason: err instanceof Error ? err.message : "unknown_waitlist_error",
                         source: waitlistSource,
                         stage: "waitlist",
@@ -1343,7 +1437,7 @@ export function createCoreRoutesPlugin(options = {}) {
                         error: "Couldn't join the waitlist. Please try again in a moment.",
                     };
                 }
-                await trackBuilderLifecycle(event, "builder branch waitlist joined", session.email, {
+                await trackBuilderLifecycle(event, "builder branch waitlist joined", waitlistEmail, {
                     formId: formSubmission.formId ?? null,
                     formSubmitted: formSubmission.submitted,
                     source: waitlistSource,