@agent-native/core 0.137.4 → 0.137.5

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 7577
+- template files: 7578

package/corpus/templates/clips/changelog/2026-08-04-signing-out-now-takes-effect-immediately-after-verifying-a-n.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-04
+---
+
+Signing out now takes effect immediately after verifying a new account.

package/corpus/templates/clips/desktop/src/app.tsx

@@ -1206,7 +1206,7 @@ export function App() {
     try {
       const res = await fetch(
         `${serverUrl.replace(/\/+$/, "")}/_agent-native/auth/session`,
-        { credentials: "include" },
+        { credentials: "include", cache: "no-store" },
       );
       if (!res.ok) {
         if (res.status === 401 || res.status === 403) {

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,10 +77,10 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;
 //# sourceMappingURL=awareness.d.ts.map

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/notifications/routes.d.ts

@@ -28,7 +28,7 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     status?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     error: string;
     removed?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     note?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,12 +95,12 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,11 +27,11 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};
 //# sourceMappingURL=agent-engine-api-key-route.d.ts.map

package/dist/server/auth.js

@@ -389,18 +389,18 @@ async function readDesktopSsoSafely(event) {
  * user. Returns undefined if no session cookie was minted (the common
  * case — Better Auth's reset doesn't auto-sign-in by default).
  */
+function getSetCookieHeaders(headers) {
+    const responseHeaders = headers;
+    return typeof responseHeaders.getSetCookie === "function"
+        ? responseHeaders.getSetCookie()
+        : (responseHeaders.get("set-cookie") ?? "")
+            .split(/,(?=[^;]+=)/)
+            .map((value) => value.trim())
+            .filter(Boolean);
+}
 function extractSessionTokenFromSetCookies(response) {
     try {
-        // Headers may have multiple Set-Cookie entries; iterate via getSetCookie
-        // when available (Node 20+ / undici), else fall back to comma split.
-        const headers = response.headers;
-        const setCookies = typeof headers.getSetCookie === "function"
-            ? headers.getSetCookie()
-            : (headers.get("set-cookie") ?? "")
-                .split(/,(?=[^;]+=)/)
-                .map((s) => s.trim())
-                .filter(Boolean);
-        for (const sc of setCookies) {
+        for (const sc of getSetCookieHeaders(response.headers)) {
             // Better Auth's session cookie name is configurable but defaults to
             // `<prefix>.session_token`. Match either the Better Auth default or
             // our COOKIE_NAME (`an_session`) on the same line.
@@ -414,6 +414,16 @@ function extractSessionTokenFromSetCookies(response) {
     }
     return undefined;
 }
+function forwardBetterAuthSetCookies(event, result) {
+    if (!result || typeof result !== "object")
+        return;
+    const headers = result.headers;
+    if (!headers || typeof headers.get !== "function")
+        return;
+    for (const cookie of getSetCookieHeaders(headers)) {
+        event.res?.headers?.append("set-cookie", cookie);
+    }
+}
 // ---------------------------------------------------------------------------
 // ACCESS_TOKEN resolution
 // ---------------------------------------------------------------------------
@@ -2762,7 +2772,11 @@ async function mountBetterAuthRoutes(app, options) {
         clearFrameworkSessionCookies(event);
         optOutOfAuthDisabledSession(event);
         try {
-            await auth.api.signOut({ headers: event.headers });
+            const result = await auth.api.signOut({
+                headers: event.headers,
+                returnHeaders: true,
+            });
+            forwardBetterAuthSetCookies(event, result);
         }
         catch {
             // Ignore if no Better Auth session
@@ -2826,7 +2840,11 @@ async function mountBetterAuthRoutes(app, options) {
             clearFrameworkSessionCookies(event);
             optOutOfAuthDisabledSession(event);
             try {
-                await auth.api.signOut({ headers: event.headers });
+                const result = await auth.api.signOut({
+                    headers: event.headers,
+                    returnHeaders: true,
+                });
+                forwardBetterAuthSetCookies(event, result);
             }
             catch {
                 // Ignore — sessions are already gone in DB.
@@ -2981,7 +2999,11 @@ function mountAuthFallbackRoutes(app) {
         optOutOfAuthDisabledSession(event);
         try {
             const auth = await getBetterAuth();
-            await auth.api.signOut({ headers: event.headers });
+            const result = await auth.api.signOut({
+                headers: event.headers,
+                returnHeaders: true,
+            });
+            forwardBetterAuthSetCookies(event, result);
         }
         catch {
             // Ignore if Better Auth is still unavailable

package/dist/server/better-auth-instance.d.ts

@@ -75,6 +75,7 @@ export interface BetterAuthInstance {
         }) => Promise<any>;
         signOut: (opts: {
             headers: Headers;
+            returnHeaders?: boolean;
         }) => Promise<any>;
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.137.4",
+  "version": "0.137.5",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {