@agent-native/core 0.95.1 → 0.97.0

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,11 +27,11 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};
 //# sourceMappingURL=agent-engine-api-key-route.d.ts.map

package/dist/server/core-routes-plugin.d.ts

@@ -65,6 +65,7 @@ export interface BuilderWaitlistBody {
     appUrl?: unknown;
     pageUrl?: unknown;
     source?: unknown;
+    template?: unknown;
     useCase?: unknown;
 }
 export declare function resolveFrameworkSseRoutes(sseRoute?: string): string[];
@@ -85,6 +86,7 @@ export declare function buildBuilderWaitlistFormPayload(event: H3Event, sessionE
         appUrl: string;
         prompt: string;
         source: string;
+        template: string;
         useCase: string;
     };
     _hp: string;
@@ -92,6 +94,7 @@ export declare function buildBuilderWaitlistFormPayload(event: H3Event, sessionE
         submitterEmail: string;
         pageUrl: string;
         source: string;
+        template: string;
         useCase: string;
     };
 };

package/dist/server/core-routes-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAqClC,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,8BAA8B,CAAC;AAgDtC,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AA+BzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAoCvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,eAAO,MAAM,sBAAsB,0BAAqC,CAAC;AACzE,eAAO,MAAM,6BAA6B,+BAA0C,CAAC;AAErF,wBAAgB,+BAA+B,CAC7C,KAAK,EACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1E,SAAS,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAGR;AAED,wBAAgB,mBAAmB,IAAI,YAAY,EAAE,CA+BpD;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,EAAE,EAAE,IAAI,CAAC;IACT,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,EAAE,EAAE,OAAO,CAAC;IACZ,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,0EAA0E;IAC1E,QAAQ,EAAE;QACR,UAAU,EAAE,OAAO,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,OAAO,CAAC;QAC7B,4BAA4B,EAAE,OAAO,CAAC;KACvC,CAAC;IACF,yDAAyD;IACzD,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,GAAE,MAAM;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAc,EACtE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAmBD,UAAU,yBAAyB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrE;AAyBD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,SAAS,EAAE,OAAO,GACjB,MAAM,GAAG,IAAI,CAOf;AAoCD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,GAAG,SAAa,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAoCzD;AAED,wBAAgB,qCAAqC,SAEpD;AAmBD,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,OAAO,GACb,yBAAyB,GAAG,IAAI,CAsBlC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,mBAAmB;;;;;;;;;;;;;;;;EA2B1B;AAgDD,eAAO,MAAM,kBAAkB,QAAwC,CAAC;AAExE,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,MAAM,CAoBR;AAwHD,KAAK,6BAA6B,GAAG,CACnC,KAAK,EAAE,OAAO,KACX,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjE,EACN,IAAI,CAAC,EAAE,SAAS,GAAG,UAAU,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAsD9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CASf;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAc/D;AAUD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;wCACoC;IACpC,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAChF;2DACuD;IACvD,wBAAwB,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IAClG,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CA8sFhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}
+{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAqClC,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,8BAA8B,CAAC;AAgDtC,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AA+BzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAoCvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,eAAO,MAAM,sBAAsB,0BAAqC,CAAC;AACzE,eAAO,MAAM,6BAA6B,+BAA0C,CAAC;AAErF,wBAAgB,+BAA+B,CAC7C,KAAK,EACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1E,SAAS,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAGR;AAED,wBAAgB,mBAAmB,IAAI,YAAY,EAAE,CA+BpD;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,EAAE,EAAE,IAAI,CAAC;IACT,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,EAAE,EAAE,OAAO,CAAC;IACZ,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,0EAA0E;IAC1E,QAAQ,EAAE;QACR,UAAU,EAAE,OAAO,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,OAAO,CAAC;QAC7B,4BAA4B,EAAE,OAAO,CAAC;KACvC,CAAC;IACF,yDAAyD;IACzD,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,GAAE,MAAM;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAc,EACtE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAoBD,UAAU,yBAAyB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrE;AAgCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,SAAS,EAAE,OAAO,GACjB,MAAM,GAAG,IAAI,CAOf;AAoCD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,GAAG,SAAa,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAoCzD;AAED,wBAAgB,qCAAqC,SAEpD;AAmBD,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,OAAO,GACb,yBAAyB,GAAG,IAAI,CAsBlC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;EA8B1B;AAgDD,eAAO,MAAM,kBAAkB,QAAwC,CAAC;AAExE,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,MAAM,CAoBR;AAwHD,KAAK,6BAA6B,GAAG,CACnC,KAAK,EAAE,OAAO,KACX,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjE,EACN,IAAI,CAAC,EAAE,SAAS,GAAG,UAAU,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAsD9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CASf;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAc/D;AAUD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;wCACoC;IACpC,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAChF;2DACuD;IACvD,wBAAwB,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IAClG,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CAiuFhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}

package/dist/server/core-routes-plugin.js

@@ -146,6 +146,7 @@ const BUILDER_WAITLIST_USE_CASES = new Set([
     BUILDER_WAITLIST_DEFAULT_USE_CASE,
     "design_publish_app",
     "docs_build_online_waitlist",
+    "docs_edit_online_waitlist",
 ]);
 const BUILDER_WAITLIST_FORM_TIMEOUT_MS = 8000;
 const BUILDER_WAITLIST_TEXT_LIMIT = 4000;
@@ -174,6 +175,12 @@ function normalizeBuilderWaitlistUseCase(value) {
         ? useCase
         : BUILDER_WAITLIST_DEFAULT_USE_CASE;
 }
+function normalizeBuilderWaitlistTemplate(value) {
+    const template = cleanBuilderWaitlistText(value, 100);
+    return template && /^[a-z0-9][a-z0-9-]{0,99}$/.test(template)
+        ? template
+        : undefined;
+}
 function isValidWaitlistEmail(email) {
     return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
 }
@@ -292,6 +299,7 @@ export function buildBuilderWaitlistFormPayload(event, sessionEmail, body) {
         cleanBuilderWaitlistText(getHeader(event, "referer"), 2000) ??
         getOrigin(event);
     const source = cleanBuilderWaitlistText(body.source, 100) ?? BUILDER_WAITLIST_FORM_SOURCE;
+    const template = normalizeBuilderWaitlistTemplate(body.template);
     const useCase = normalizeBuilderWaitlistUseCase(body.useCase);
     return {
         data: {
@@ -300,6 +308,7 @@ export function buildBuilderWaitlistFormPayload(event, sessionEmail, body) {
             appUrl,
             prompt: cleanBuilderWaitlistText(body.prompt),
             source,
+            template,
             useCase,
         },
         _hp: "",
@@ -307,6 +316,7 @@ export function buildBuilderWaitlistFormPayload(event, sessionEmail, body) {
             submitterEmail: sessionEmail,
             pageUrl: appUrl,
             source,
+            template,
             useCase,
         },
     };
@@ -736,12 +746,20 @@ export function createCoreRoutesPlugin(options = {}) {
                 setResponseHeader(event, "Access-Control-Allow-Methods", "GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS");
                 setResponseHeader(event, "Access-Control-Allow-Headers", MCP_EMBED_CORS_ALLOW_HEADERS);
             }));
-            // Defense-in-depth CSRF check for state-changing /_agent-native/* routes.
-            // Mounted AFTER the CORS layer so disallowed-origin OPTIONS preflights
-            // 403 first (rather than being rejected on a stale cookie heuristic).
-            // See `csrf.ts` for the threat model and allowlist.
-            const { createCsrfMiddleware } = await import("./csrf.js");
-            getH3App(nitroApp).use(createCsrfMiddleware(P));
+            // Defense-in-depth CSRF check for state-changing /_agent-native/* routes
+            // (see `csrf.ts` for the threat model and allowlist) is registered by
+            // `getH3App()` itself (framework-request-handler.ts), synchronously, on
+            // the very first call to `getH3App(nitroApp)` for this process — NOT
+            // here. Registering it inside this plugin's own async init chain would
+            // race against agent-chat-plugin's action-route registration (a
+            // SEPARATE, independently-async-initialized Nitro plugin file in real
+            // deployments): whichever plugin's `getH3App(nitroApp).use(...)` call
+            // happened to resolve first would win the position in the middleware
+            // array, and CSRF losing that race would let an action route match and
+            // run before the CSRF check ever saw the request. Centralizing the
+            // registration in `getH3App()`'s one-time bootstrap makes it the first
+            // middleware any plugin's route can possibly land behind, regardless of
+            // plugin init ordering.
             // Agent discovery primitive — shared by headless CLI/A2A surfaces and
             // UI shells that need to show connected peer apps without depending on
             // the chat route namespace.
@@ -821,7 +839,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     setResponseStatus(event, 400);
                     return { error: "executionId required" };
                 }
-                const { hasConfiguredA2ASecret, isA2AProductionRuntime } = await import("../a2a/auth-policy.js");
+                const { hasConfiguredA2ASecret, isLoopbackAddress, isTrustedLocalRuntime, } = await import("../a2a/auth-policy.js");
                 if (hasConfiguredA2ASecret()) {
                     const { verifyInternalToken, extractBearerToken } = await import("../integrations/internal-token.js");
                     const token = extractBearerToken(getHeader(event, "authorization"));
@@ -830,11 +848,14 @@ export function createCoreRoutesPlugin(options = {}) {
                         return { error: "Invalid or expired processor token" };
                     }
                 }
-                else if (isA2AProductionRuntime()) {
-                    setResponseStatus(event, 503);
-                    return {
-                        error: "Sandbox execution processor not configured — set A2A_SECRET on this deployment.",
-                    };
+                else {
+                    const loopback = isLoopbackAddress(getRequestIP(event, { xForwardedFor: false }));
+                    if (!isTrustedLocalRuntime({ loopback })) {
+                        setResponseStatus(event, 503);
+                        return {
+                            error: "Sandbox execution processor not configured — set A2A_SECRET on this deployment (or A2A_ALLOW_UNSIGNED_INTERNAL=1 for trusted local dev).",
+                        };
+                    }
                 }
                 try {
                     const { processQueuedSandboxExecution } = await import("../coding-tools/sandbox/background.js");
@@ -1425,6 +1446,7 @@ export function createCoreRoutesPlugin(options = {}) {
                 }
                 const waitlistPayload = buildBuilderWaitlistFormPayload(event, waitlistEmail, body);
                 const waitlistSource = waitlistPayload.data.source;
+                const waitlistTemplate = waitlistPayload.data.template;
                 const waitlistUseCase = waitlistPayload.data.useCase;
                 let formSubmission;
                 try {
@@ -1435,6 +1457,7 @@ export function createCoreRoutesPlugin(options = {}) {
                         reason: err instanceof Error ? err.message : "unknown_waitlist_error",
                         source: waitlistSource,
                         stage: "waitlist",
+                        template: waitlistTemplate ?? null,
                         useCase: waitlistUseCase,
                     });
                     setResponseStatus(event, 502);
@@ -1447,6 +1470,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     formSubmitted: formSubmission.submitted,
                     source: waitlistSource,
                     stage: "waitlist",
+                    template: waitlistTemplate ?? null,
                     useCase: waitlistUseCase,
                 });
                 return { ok: true, formSubmitted: formSubmission.submitted };