@agent-native/core 0.145.2 → 0.145.3

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/notifications/routes.d.ts

@@ -13,13 +13,13 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated: number;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated?: undefined;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/poll.d.ts

@@ -114,6 +114,15 @@ export interface AppSyncStateOptions {
      * Postgres only; ignored on SQLite.
      */
     dbAssignedVersions?: boolean;
+    /**
+     * TTL for a cached ALLOW decision. Defaults to 30s.
+     *
+     * `invalidateCollabAccessCache` only reaches the in-process default instance,
+     * so a gateway holding per-app instances cannot be told a share was revoked
+     * and serves its cached ALLOW until this lapses. Shorten it to bound that
+     * window, at the cost of more `can-see` round-trips per shared resource.
+     */
+    accessAllowTtlMs?: number;
 }
 /**
  * Per-app change-tracking state and read path. One instance per deployed app.
@@ -180,7 +189,9 @@ export declare class AppSyncState {
     private readonly accessInFlight;
     /** Per-resource generation bumped when shares/visibility change. */
     private readonly accessInvalidationEpoch;
+    private readonly accessAllowTtlMs;
     constructor(options?: AppSyncStateOptions);
+    private accessCacheTtl;
     /**
      * Durable-event id. Deterministic (hash of logical identity + `dedupeKey`,
      * excluding the per-instance `version`) when the instance opts in AND a

package/dist/server/poll.js

@@ -153,9 +153,6 @@ function accessCacheKey(userEmail, orgId, resourceType, resourceId) {
 function accessResourceKey(resourceType, resourceId) {
     return `${resourceType}|${resourceId}`;
 }
-function accessCacheTtl(allowed) {
-    return allowed ? ACCESS_CACHE_TTL_MS : ACCESS_CACHE_DENY_TTL_MS;
-}
 function extensionTargetKey(target) {
     if (target.owner)
         return `owner:${target.owner}`;
@@ -291,14 +288,19 @@ export class AppSyncState {
     accessInFlight = new Set();
     /** Per-resource generation bumped when shares/visibility change. */
     accessInvalidationEpoch = new Map();
+    accessAllowTtlMs;
     constructor(options = {}) {
         this.getDb = options.getDb ?? getDbExec;
         this.isPg = options.isPostgres ?? isPostgres;
         this.resolveAccessFn = options.resolveAccess ?? defaultResolveAccess;
         this.deterministicEventIds = options.deterministicEventIds ?? false;
         this.dbAssignedVersions = options.dbAssignedVersions ?? false;
+        this.accessAllowTtlMs = options.accessAllowTtlMs ?? ACCESS_CACHE_TTL_MS;
         this.pollEmitter.setMaxListeners(0);
     }
+    accessCacheTtl(allowed) {
+        return allowed ? this.accessAllowTtlMs : ACCESS_CACHE_DENY_TTL_MS;
+    }
     /**
      * Durable-event id. Deterministic (hash of logical identity + `dedupeKey`,
      * excluding the per-instance `version`) when the instance opts in AND a
@@ -675,7 +677,8 @@ export class AppSyncState {
             const key = accessCacheKey(userEmail, orgId, event.resourceType, event.resourceId);
             const cached = this.accessCache.get(key);
             const now = Date.now();
-            if (cached && now - cached.checkedAt < accessCacheTtl(cached.allowed)) {
+            if (cached &&
+                now - cached.checkedAt < this.accessCacheTtl(cached.allowed)) {
                 // Fresh, non-expired cache hit → trust the cached decision.
                 return cached.allowed ? "visible" : "hidden";
             }

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/realtime-token.js

@@ -28,6 +28,13 @@ import { signRealtimeSubscribeToken } from "./short-lived-token.js";
 export const REALTIME_HMAC_SECRET_ENV = "AGENT_NATIVE_REALTIME_HMAC_SECRET";
 /** Short TTL — validated at connect; the gateway rotates over the stream. */
 const REALTIME_TOKEN_TTL_SECONDS = 600;
+/**
+ * Ceiling on how long one mint can be extended by gateway rotation before the
+ * client must come back through this session-gated endpoint. Without it a single
+ * mint streams forever and logout, session expiry, user deletion and org removal
+ * never reach an open stream.
+ */
+const REALTIME_SESSION_MAX_SECONDS = 15 * 60;
 export function getRealtimeSigningSecret() {
     return process.env[REALTIME_HMAC_SECRET_ENV]?.trim() || undefined;
 }
@@ -76,6 +83,7 @@ export function createRealtimeTokenHandler() {
                 owner: session.email,
                 orgId: requestContext.orgId,
                 ttlSeconds: REALTIME_TOKEN_TTL_SECONDS,
+                absExp: Math.floor(Date.now() / 1000) + REALTIME_SESSION_MAX_SECONDS,
             }, secret);
             const expiresAt = new Date(Date.now() + REALTIME_TOKEN_TTL_SECONDS * 1000).toISOString();
             return { token, expiresAt, ttlSeconds: REALTIME_TOKEN_TTL_SECONDS };

package/dist/server/short-lived-token.d.ts

@@ -82,6 +82,13 @@ export interface RealtimeSubscribeClaims {
     orgId?: string;
     /** Override default TTL (seconds). */
     ttlSeconds?: number;
+    /**
+     * Absolute unix-seconds ceiling, independent of `exp`. The gateway re-signs a
+     * stream's token every few minutes without consulting the app, so `exp` alone
+     * lets one mint be extended forever and a revoked session keeps streaming.
+     * Rotation copies this verbatim and never extends it.
+     */
+    absExp?: number;
 }
 /**
  * Result of {@link verifyRealtimeSubscribeToken}. On success it returns the
@@ -93,6 +100,7 @@ export type RealtimeVerifyResult = {
     owner?: string;
     orgId?: string;
     exp: number;
+    absExp?: number;
 } | {
     ok: false;
     reason: string;

package/dist/server/short-lived-token.js

@@ -182,6 +182,8 @@ export function signRealtimeSubscribeToken(claims, key) {
         payload.owner = claims.owner;
     if (claims.orgId)
         payload.orgId = claims.orgId;
+    if (claims.absExp)
+        payload.absExp = claims.absExp;
     const payloadStr = base64UrlEncode(JSON.stringify(payload));
     return `${payloadStr}.${hmacB64(payloadStr, key)}`;
 }
@@ -218,6 +220,15 @@ export function verifyRealtimeSubscribeToken(token, expected) {
     if (claims.exp * 1000 < Date.now()) {
         return { ok: false, reason: "expired" };
     }
+    if (claims.absExp !== undefined) {
+        if (typeof claims.absExp !== "number") {
+            return { ok: false, reason: "bad_payload" };
+        }
+        // `<=`, not `<`: a ceiling is not valid at the instant it is reached.
+        if (claims.absExp * 1000 <= Date.now()) {
+            return { ok: false, reason: "session_expired" };
+        }
+    }
     if (claims.projectId !== expected.projectId) {
         return { ok: false, reason: "wrong_project" };
     }
@@ -227,6 +238,7 @@ export function verifyRealtimeSubscribeToken(token, expected) {
         owner: claims.owner,
         orgId: claims.orgId,
         exp: claims.exp,
+        absExp: claims.absExp,
     };
 }
 // ── Gateway access-check tokens ──────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.145.2",
+  "version": "0.145.3",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {