@agent-native/core 0.145.4 → 0.145.5

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 7851
+- template files: 7853

package/corpus/templates/clips/app/components/editor/editor-layout.tsx

@@ -255,6 +255,11 @@ export function EditorLayout({ recordingId, className }: EditorLayoutProps) {
     [viewportWidth, zoom],
   );
 
+  const clampedScrollLeft = Math.min(
+    scrollLeft,
+    Math.max(0, totalWidth - viewportWidth),
+  );
+
   const calculateAnchoredScrollLeft = useCallback(
     (
       nextZoom: number,
@@ -815,7 +820,7 @@ export function EditorLayout({ recordingId, className }: EditorLayoutProps) {
                 splitPoints={splitPoints}
                 activityRanges={transcriptSegments}
                 onSeek={seek}
-                scrollLeft={scrollLeft}
+                scrollLeft={clampedScrollLeft}
                 onScroll={(s) => setScrollLeft(s)}
               />
               <div
@@ -826,7 +831,7 @@ export function EditorLayout({ recordingId, className }: EditorLayoutProps) {
                   className="relative h-full"
                   style={{
                     width: totalWidth,
-                    transform: `translateX(${-scrollLeft}px)`,
+                    transform: `translateX(${-clampedScrollLeft}px)`,
                   }}
                 >
                   {durationMs > 0 && (
@@ -849,7 +854,7 @@ export function EditorLayout({ recordingId, className }: EditorLayoutProps) {
             >
               <div
                 style={{
-                  transform: `translateX(${-scrollLeft}px)`,
+                  transform: `translateX(${-clampedScrollLeft}px)`,
                   width: totalWidth,
                 }}
               >

package/corpus/templates/clips/app/components/editor/waveform.tsx

@@ -185,7 +185,8 @@ export function Waveform({
 
     const ctx = canvas.getContext("2d");
     if (!ctx) return;
-    ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+    const scaleX = canvas.width / totalWidth;
+    ctx.setTransform(scaleX, 0, 0, dpr, 0, 0);
 
     const hasPeaks = Boolean(
       peaks?.bucketCount &&

package/corpus/templates/clips/app/components/library/search-bar.tsx

@@ -31,7 +31,7 @@ function highlight(
     parts.push(
       <mark
         key={`${idx}-${parts.length}`}
-        className="bg-yellow-200 text-foreground rounded-sm px-0.5"
+        className="bg-highlight/30 text-foreground rounded-sm px-0.5"
       >
         {text.slice(idx, idx + q.length)}
       </mark>,

package/corpus/templates/clips/app/global.css

@@ -36,6 +36,8 @@
   --sidebar-accent-foreground: 0 0% 15%;
   --sidebar-border: 0 0% 90%;
   --sidebar-ring: 0 0% 40%;
+  --highlight: 197 100% 50%;
+  --highlight-foreground: 0 0% 10%;
 }
 
 .dark {
@@ -67,6 +69,13 @@
   --sidebar-accent-foreground: 0 0% 90%;
   --sidebar-border: 0 0% 20%;
   --sidebar-ring: 0 0% 60%;
+  --highlight: 197 100% 50%;
+  --highlight-foreground: 0 0% 10%;
+}
+
+@theme inline {
+  --color-highlight: hsl(var(--highlight));
+  --color-highlight-foreground: hsl(var(--highlight-foreground));
 }
 
 @layer base {

package/corpus/templates/clips/desktop/src-tauri/src/silence_detector.rs

@@ -392,7 +392,6 @@ fn install_call_ended_watcher(app: &AppHandle, threshold_ms: u64) {
             let mut ever_seen_front = false;
             let mut last_front_at: Option<Instant> = None;
             let mut fired = false;
-            let mut last_front_was_generic_browser = false;
             let mut call_app_used_microphone = false;
             let mut microphone_released_at: Option<Instant> = None;
             let mut generation: Option<u64> = None;
@@ -408,7 +407,6 @@ fn install_call_ended_watcher(app: &AppHandle, threshold_ms: u64) {
                     ever_seen_front = false;
                     last_front_at = None;
                     fired = false;
-                    last_front_was_generic_browser = false;
                     call_app_used_microphone = false;
                     microphone_released_at = None;
                     continue;
@@ -417,7 +415,6 @@ fn install_call_ended_watcher(app: &AppHandle, threshold_ms: u64) {
                     ever_seen_front = false;
                     last_front_at = None;
                     fired = false;
-                    last_front_was_generic_browser = false;
                     call_app_used_microphone = false;
                     microphone_released_at = None;
                     generation = Some(active_generation);
@@ -450,7 +447,6 @@ fn install_call_ended_watcher(app: &AppHandle, threshold_ms: u64) {
                 if is_strong_vc || is_generic_browser {
                     ever_seen_front = true;
                     last_front_at = Some(Instant::now());
-                    last_front_was_generic_browser = is_generic_browser;
                 }
                 if fired {
                     continue;
@@ -474,10 +470,18 @@ fn install_call_ended_watcher(app: &AppHandle, threshold_ms: u64) {
                     _ => {}
                 }
 
+                // Require audio corroboration for every trigger in this
+                // watcher: backgrounding the call app, or its process
+                // dropping its mic input, does not by itself prove the call
+                // ended — a browser tab can report either transition while
+                // the meeting is still playing through system audio. Only
+                // quiet mic+system audio alongside the signal does.
+                let audio_quiet = audio_recently_silent(&state, threshold_ms);
+
                 let microphone_released = microphone_release_stop_ready(
                     call_app_used_microphone,
                     microphone_released_at.map(|at| Instant::now().duration_since(at)),
-                );
+                ) && audio_quiet;
 
                 let frontmost_call_ended = ever_seen_front
                     && last_front_at
@@ -485,12 +489,7 @@ fn install_call_ended_watcher(app: &AppHandle, threshold_ms: u64) {
                             Instant::now().duration_since(t).as_millis() as u64 >= threshold_ms
                         })
                         .unwrap_or(false)
-                    // Require audio corroboration for browser-hosted calls:
-                    // backgrounding Chrome/Arc alone does not prove that the
-                    // Meet tab ended. Use the last known conference app, not
-                    // the unrelated app now in front.
-                    && (!last_front_was_generic_browser
-                        || audio_recently_silent(&state, threshold_ms));
+                    && audio_quiet;
 
                 if microphone_released || frontmost_call_ended {
                     let _ = app.emit("meetings:call-ended", ());

package/corpus/templates/design/actions/view-screen.ts

@@ -220,6 +220,7 @@ export default defineAction({
     "See what the user is currently looking at on screen. Returns the current navigation state including which design or template is open, which view they are on (list, templates, editor, design-systems, present, settings), active/focused design screen, selected element, active inspector tab (design, comments, or tweaks), active left rail panel (file, agent, assets, import, tools, tokens, or code), active code file metadata, overview canvas state, review status and feedback queue summary, plus any pending question overlay. Always call this first before taking any action.",
   schema: z.object({}),
   http: false,
+  readOnly: true,
   run: async (_, ctx) => {
     const [navigation, designSelection] = await Promise.all([
       readAppStateForCurrentTab("navigation"),

package/corpus/templates/design/app/hooks/useDesignHotkeys.ts

@@ -277,6 +277,18 @@ export function isDesignHotkeyEditableTarget(target: EventTarget | null) {
   return tagName === "input" || tagName === "textarea" || tagName === "select";
 }
 
+/** Chat bodies and panel labels are selectable but not editable targets, so the
+ * editable guard never sees them. Canvas layers live in the preview iframe and
+ * produce no parent-document range, so this cannot mask a real layer copy. */
+export function hasDocumentTextSelection() {
+  if (typeof window === "undefined" || !window.getSelection) return false;
+  const selection = window.getSelection();
+  if (!selection || selection.isCollapsed || selection.rangeCount === 0) {
+    return false;
+  }
+  return selection.toString().trim().length > 0;
+}
+
 export function isShowKeyboardShortcutsHotkey(event: KeyboardEvent) {
   if (!(event.ctrlKey || event.metaKey) || !event.shiftKey || event.altKey) {
     return false;
@@ -523,7 +535,7 @@ export function handleDesignHotkey(
   if (primary && event.shiftKey && key === "x") {
     return run(props.onToggleStrikethrough);
   }
-  if (primary && key === "x") {
+  if (primary && key === "x" && !hasDocumentTextSelection()) {
     return runSharedCanvasCommand() || run(props.onCut);
   }
   // Figma's Cmd+U — toggle underline. No existing binding claims plain "u".
@@ -556,6 +568,7 @@ export function handleDesignHotkey(
   if (primary && key === "c") {
     if (event.altKey) return run(props.onCopyProps);
     if (event.shiftKey) return run(props.onCopyAsPng);
+    if (hasDocumentTextSelection()) return false;
     return runSharedCanvasCommand() || run(props.onCopy);
   }
   if (primary && key === "v") {

package/corpus/templates/design/changelog/2026-08-07-cmd-c-now-copies-selected-text-in-the-agent-panel-instead-of.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-07
+---
+
+Cmd+C now copies selected text in the agent panel instead of being captured by the canvas copy shortcut

package/corpus/templates/design/changelog/2026-08-07-real-time-voice-can-now-read-the-current-selection-and-edit-.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-07
+---
+
+Real-time voice can now read the current selection and edit the design, instead of failing to verify the agent thread

package/corpus/templates/design/server/lib/reprompt-action-guard.ts

@@ -77,13 +77,17 @@ export function guardRepromptActionRegistry(
           ...entry,
           run: async (args, context) => {
             if (context?.caller === "tool" && context.threadId) {
-              const thread = await getThread(context.threadId);
-              if (!thread) {
+              let thread: Awaited<ReturnType<typeof getThread>>;
+              try {
+                thread = await getThread(context.threadId);
+              } catch {
                 throw new Error(
                   `Cannot verify the agent thread for mutating action ${name}.`,
                 );
               }
-              const intent = threadSelectionIntent(thread);
+              // Off-thread callers (realtime voice, MCP, A2A, cron) have no
+              // stored thread, so they cannot be inside a reprompt turn.
+              const intent = thread ? threadSelectionIntent(thread) : null;
               if (
                 intent === "reprompt" &&
                 !REPROMPT_MUTATION_ALLOWLIST.has(name)

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,6 +159,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -174,7 +175,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,6 +190,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -199,7 +200,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,6 +216,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -234,7 +235,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,6 +250,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -263,7 +264,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,7 +75,6 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    message?: undefined;
     deleted?: undefined;
     found?: undefined;
     providers: {
@@ -92,8 +91,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     id?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     deleted?: undefined;
     providers?: undefined;
     count?: undefined;
@@ -102,8 +101,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     id?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     deleted?: undefined;
     providers?: undefined;
     count?: undefined;
@@ -112,8 +111,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     id: string;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     found?: undefined;
     providers?: undefined;
     count?: undefined;
@@ -122,6 +121,7 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     id: string;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
     deleted?: undefined;
     found?: undefined;

package/dist/provider-api/actions/provider-api.d.ts

@@ -312,8 +312,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         scope?: "org" | "user" | undefined;
     }, {
         id?: undefined;
-        deleted?: undefined;
         provider?: undefined;
+        deleted?: undefined;
         found?: undefined;
         providers: {
             id: string;
@@ -339,9 +339,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
+        provider?: undefined;
         deleted?: undefined;
         count?: undefined;
-        provider?: undefined;
         providers?: undefined;
         found: boolean;
         id: string;
@@ -349,9 +349,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        count?: undefined;
         provider?: undefined;
         found?: undefined;
+        count?: undefined;
         providers?: undefined;
         deleted: boolean;
         id: string;
@@ -359,10 +359,10 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        deleted?: undefined;
-        count?: undefined;
         provider?: undefined;
+        deleted?: undefined;
         found?: undefined;
+        count?: undefined;
         providers?: undefined;
         registered: boolean;
         id: string;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/realtime-voice.d.ts

@@ -8,8 +8,9 @@ export declare const REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS = 16000;
 export declare const REALTIME_VOICE_MAX_TOOLS = 32;
 export declare const REALTIME_VOICE_MAX_TOOL_SCHEMA_BYTES = 32000;
 export declare const REALTIME_VOICE_MAX_SESSION_BYTES = 64000;
+/** Absolute, not sliding — a signed grant cannot be extended server-side, so
+ * this must outlast the provider's 60-minute maximum realtime session. */
 export declare const REALTIME_VOICE_TOOL_GRANT_TTL_MS: number;
-export declare const REALTIME_VOICE_MAX_TOOL_GRANT_SESSIONS = 256;
 export declare const REALTIME_VOICE_CAPABILITY_HEADER = "X-Agent-Native-Realtime-Capability";
 export interface RealtimeVoiceRequestContext {
     event: H3Event;

package/dist/server/realtime-voice.js

@@ -9,6 +9,7 @@ import { getBuilderGatewayBaseUrl, resolveBuilderCredentials, resolveSecret, } f
 import { getH3App } from "./framework-request-handler.js";
 import { runWithRequestContext } from "./request-context.js";
 import { isSameOriginRequest } from "./request-origin.js";
+import { signRealtimeVoiceCapability, verifyRealtimeVoiceCapability, } from "./short-lived-token.js";
 export const REALTIME_VOICE_SESSION_PATH = "/_agent-native/realtime-voice/session";
 export const REALTIME_VOICE_TOOL_PATH = "/_agent-native/realtime-voice/tool";
 export const REALTIME_VOICE_MAX_SDP_BYTES = 64 * 1024;
@@ -17,8 +18,9 @@ export const REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS = 16_000;
 export const REALTIME_VOICE_MAX_TOOLS = 32;
 export const REALTIME_VOICE_MAX_TOOL_SCHEMA_BYTES = 32_000;
 export const REALTIME_VOICE_MAX_SESSION_BYTES = 64_000;
-export const REALTIME_VOICE_TOOL_GRANT_TTL_MS = 10 * 60 * 1_000;
-export const REALTIME_VOICE_MAX_TOOL_GRANT_SESSIONS = 256;
+/** Absolute, not sliding — a signed grant cannot be extended server-side, so
+ * this must outlast the provider's 60-minute maximum realtime session. */
+export const REALTIME_VOICE_TOOL_GRANT_TTL_MS = 75 * 60 * 1_000;
 export const REALTIME_VOICE_CAPABILITY_HEADER = "X-Agent-Native-Realtime-Capability";
 const OPENAI_REALTIME_CALLS_URL = "https://api.openai.com/v1/realtime/calls";
 const DEFAULT_MODEL = "gpt-realtime-2.1";
@@ -207,56 +209,30 @@ function packRealtimeTools(session, eligibleTools) {
     }
     return packed;
 }
-function mintRealtimeToolCapability() {
-    return globalThis.crypto.randomUUID().replaceAll("-", "");
-}
-function cleanRealtimeToolCapabilities(capabilities, now = Date.now()) {
-    for (const [key, capability] of capabilities) {
-        if (capability.expiresAt <= now)
-            capabilities.delete(key);
-    }
-    while (capabilities.size > REALTIME_VOICE_MAX_TOOL_GRANT_SESSIONS) {
-        let oldestKey;
-        let oldestExpiry = Number.POSITIVE_INFINITY;
-        for (const [key, capability] of capabilities) {
-            if (capability.expiresAt < oldestExpiry) {
-                oldestKey = key;
-                oldestExpiry = capability.expiresAt;
-            }
-        }
-        if (!oldestKey)
-            break;
-        capabilities.delete(oldestKey);
-    }
+function mintRealtimeToolCapability(auth, capability) {
+    return signRealtimeVoiceCapability({
+        userEmail: auth.userEmail,
+        ...(auth.orgId ? { orgId: auth.orgId } : {}),
+        ...(auth.browserTabId ? { browserTabId: auth.browserTabId } : {}),
+        toolNames: [...capability.initialNames],
+        discoveredToolNames: [...capability.names],
+    }, REALTIME_VOICE_TOOL_GRANT_TTL_MS / 1_000);
 }
-function registerRealtimeToolCapability(capabilities, auth, initialNames) {
-    cleanRealtimeToolCapabilities(capabilities);
-    const token = mintRealtimeToolCapability();
-    capabilities.set(token, {
-        userEmail: auth.userEmail.trim().toLowerCase(),
+function resolveRealtimeToolCapability(token, auth) {
+    const verified = verifyRealtimeVoiceCapability(token, {
+        userEmail: auth.userEmail,
         ...(auth.orgId ? { orgId: auth.orgId } : {}),
         ...(auth.browserTabId ? { browserTabId: auth.browserTabId } : {}),
-        expiresAt: Date.now() + REALTIME_VOICE_TOOL_GRANT_TTL_MS,
-        initialNames: new Set(initialNames),
-        names: new Set(),
     });
-    cleanRealtimeToolCapabilities(capabilities);
-    return token;
-}
-function resolveRealtimeToolCapability(capabilities, token, auth) {
-    cleanRealtimeToolCapabilities(capabilities);
-    if (!token)
-        return null;
-    const capability = capabilities.get(token);
-    if (!capability)
-        return null;
-    if (capability.userEmail !== auth.userEmail.trim().toLowerCase() ||
-        capability.orgId !== auth.orgId ||
-        capability.browserTabId !== auth.browserTabId) {
+    if (!verified.ok)
         return null;
-    }
-    capability.expiresAt = Date.now() + REALTIME_VOICE_TOOL_GRANT_TTL_MS;
-    return capability;
+    return {
+        userEmail: verified.userEmail,
+        ...(verified.orgId ? { orgId: verified.orgId } : {}),
+        ...(verified.browserTabId ? { browserTabId: verified.browserTabId } : {}),
+        initialNames: new Set(verified.toolNames),
+        names: new Set(verified.discoveredToolNames),
+    };
 }
 function parseSuccessfulToolSearchNames(output) {
     try {
@@ -302,7 +278,6 @@ function grantDiscoveredRealtimeTools(input) {
         input.capability.names.add(tool.name);
         expandedTools.push(tool);
     }
-    input.capability.expiresAt = Date.now() + REALTIME_VOICE_TOOL_GRANT_TTL_MS;
     return expandedTools;
 }
 function declaredBodyBytes(event) {
@@ -364,7 +339,7 @@ function invalidMethod(event) {
     setResponseStatus(event, 405);
     return { error: "Method not allowed" };
 }
-function createSessionHandler(tools, capabilities, options) {
+function createSessionHandler(tools, options) {
     return defineEventHandler(async (event) => {
         if (getMethod(event) !== "POST")
             return invalidMethod(event);
@@ -510,7 +485,10 @@ function createSessionHandler(tools, capabilities, options) {
             }
             setResponseStatus(event, upstream.status);
             setResponseHeader(event, "Content-Type", "application/sdp");
-            setResponseHeader(event, REALTIME_VOICE_CAPABILITY_HEADER, registerRealtimeToolCapability(capabilities, auth, packedTools.map((tool) => tool.name)));
+            setResponseHeader(event, REALTIME_VOICE_CAPABILITY_HEADER, mintRealtimeToolCapability(auth, {
+                initialNames: new Set(packedTools.map((tool) => tool.name)),
+                names: new Set(),
+            }));
             return answerSdp;
         });
     });
@@ -563,7 +541,7 @@ function normalizeExecutionResult(result) {
             : {}),
     };
 }
-function createToolHandler(toolsByName, capabilities, options) {
+function createToolHandler(toolsByName, options) {
     return defineEventHandler(async (event) => {
         if (getMethod(event) !== "POST")
             return invalidMethod(event);
@@ -577,7 +555,7 @@ function createToolHandler(toolsByName, capabilities, options) {
             setResponseStatus(event, 401);
             return { error: "Authentication required" };
         }
-        const capability = resolveRealtimeToolCapability(capabilities, readSafeHeader(event, REALTIME_VOICE_CAPABILITY_HEADER), auth);
+        const capability = resolveRealtimeToolCapability(readSafeHeader(event, REALTIME_VOICE_CAPABILITY_HEADER), auth);
         if (!capability) {
             setResponseStatus(event, 403);
             return { error: "Invalid or expired realtime voice capability" };
@@ -648,7 +626,12 @@ function createToolHandler(toolsByName, capabilities, options) {
                 return {
                     callId: request.callId,
                     ...result,
-                    ...(expandedTools.length > 0 ? { expandedTools } : {}),
+                    ...(expandedTools.length > 0
+                        ? {
+                            expandedTools,
+                            capability: mintRealtimeToolCapability(auth, capability),
+                        }
+                        : {}),
                 };
             }
             catch (error) {
@@ -669,10 +652,9 @@ export function mountRealtimeVoiceRoutes(nitroApp, actions, options) {
     }
     const tools = buildRealtimeTools(actions);
     const toolsByName = new Map(tools.map((tool) => [tool.name, tool]));
-    const capabilities = new Map();
     const app = getH3App(nitroApp);
-    app.use(REALTIME_VOICE_SESSION_PATH, createSessionHandler(tools, capabilities, options));
-    app.use(REALTIME_VOICE_TOOL_PATH, createToolHandler(toolsByName, capabilities, options));
+    app.use(REALTIME_VOICE_SESSION_PATH, createSessionHandler(tools, options));
+    app.use(REALTIME_VOICE_TOOL_PATH, createToolHandler(toolsByName, options));
     return {
         sessionPath: REALTIME_VOICE_SESSION_PATH,
         toolPath: REALTIME_VOICE_TOOL_PATH,

package/dist/server/short-lived-token.d.ts

@@ -121,6 +121,49 @@ export declare function verifyRealtimeSubscribeToken(token: string, expected: {
     projectId: string;
     key: string;
 }): RealtimeVerifyResult;
+/** Payload `typ` discriminator for realtime voice tool capabilities. */
+export declare const REALTIME_VOICE_CAPABILITY_TOKEN_TYPE = "rt-voice-capability";
+/** Inputs for {@link signRealtimeVoiceCapability}. */
+export interface RealtimeVoiceCapabilityClaims {
+    /** Authenticated caller. Re-checked against the session on every tool call. */
+    userEmail: string;
+    orgId?: string;
+    /** Binds the capability to the tab that opened the session. */
+    browserTabId?: string;
+    /** Tool names packed into the session's opening manifest. */
+    toolNames: readonly string[];
+    /** Names added later by a successful `tool-search`, capped separately. */
+    discoveredToolNames?: readonly string[];
+    ttlSeconds?: number;
+}
+/** Result of {@link verifyRealtimeVoiceCapability}. */
+export type RealtimeVoiceCapabilityVerifyResult = {
+    ok: true;
+    userEmail: string;
+    orgId?: string;
+    browserTabId?: string;
+    toolNames: string[];
+    discoveredToolNames: string[];
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Mint a capability authorising `claims.toolNames` for one realtime voice
+ * session. The token is a bounded manifest scope layered on top of the
+ * caller's session cookie — never a standalone credential.
+ */
+export declare function signRealtimeVoiceCapability(claims: RealtimeVoiceCapabilityClaims, ttlSecondsDefault: number): string;
+/**
+ * Verify a realtime voice capability and confirm it was minted for exactly the
+ * identity now making the request. Identity mismatch is reported separately
+ * from a bad signature so callers can tell a replay from a stale tab.
+ */
+export declare function verifyRealtimeVoiceCapability(token: string | undefined, expected: {
+    userEmail: string;
+    orgId?: string;
+    browserTabId?: string;
+}): RealtimeVoiceCapabilityVerifyResult;
 /** Payload `typ` discriminator for gateway access-check tokens. */
 export declare const GATEWAY_ACCESS_TOKEN_TYPE = "rt-access-check";
 /** Inputs for {@link signGatewayAccessToken}. */

package/dist/server/short-lived-token.js

@@ -241,6 +241,80 @@ export function verifyRealtimeSubscribeToken(token, expected) {
         absExp: claims.absExp,
     };
 }
+// ── Realtime voice tool capabilities ─────────────────────────────────────────
+// Signed, not stored: minting and spending are separate requests, and under a
+// serverless preset they land on different instances.
+/** Payload `typ` discriminator for realtime voice tool capabilities. */
+export const REALTIME_VOICE_CAPABILITY_TOKEN_TYPE = "rt-voice-capability";
+/**
+ * Mint a capability authorising `claims.toolNames` for one realtime voice
+ * session. The token is a bounded manifest scope layered on top of the
+ * caller's session cookie — never a standalone credential.
+ */
+export function signRealtimeVoiceCapability(claims, ttlSecondsDefault) {
+    const payload = {
+        typ: REALTIME_VOICE_CAPABILITY_TOKEN_TYPE,
+        userEmail: claims.userEmail.trim().toLowerCase(),
+        toolNames: [...claims.toolNames],
+        exp: Math.floor(Date.now() / 1000) + (claims.ttlSeconds ?? ttlSecondsDefault),
+    };
+    if (claims.orgId)
+        payload.orgId = claims.orgId;
+    if (claims.browserTabId)
+        payload.browserTabId = claims.browserTabId;
+    if (claims.discoveredToolNames?.length) {
+        payload.discovered = [...claims.discoveredToolNames];
+    }
+    const payloadStr = base64UrlEncode(JSON.stringify(payload));
+    return `${payloadStr}.${hmacB64(payloadStr, getSigningKey())}`;
+}
+/**
+ * Verify a realtime voice capability and confirm it was minted for exactly the
+ * identity now making the request. Identity mismatch is reported separately
+ * from a bad signature so callers can tell a replay from a stale tab.
+ */
+export function verifyRealtimeVoiceCapability(token, expected) {
+    if (typeof token !== "string" || !token.includes(".")) {
+        return { ok: false, reason: "malformed" };
+    }
+    const [payloadStr, sig] = token.split(".", 2);
+    if (!payloadStr || !sig)
+        return { ok: false, reason: "malformed" };
+    if (!timingSafeEqualB64(sig, hmacB64(payloadStr, getSigningKey()))) {
+        return { ok: false, reason: "bad_signature" };
+    }
+    let claims;
+    try {
+        claims = JSON.parse(base64UrlDecode(payloadStr).toString("utf8"));
+    }
+    catch {
+        return { ok: false, reason: "bad_payload" };
+    }
+    if (claims.typ !== REALTIME_VOICE_CAPABILITY_TOKEN_TYPE) {
+        return { ok: false, reason: "wrong_type" };
+    }
+    if (typeof claims.exp !== "number" || !Array.isArray(claims.toolNames)) {
+        return { ok: false, reason: "bad_payload" };
+    }
+    if (claims.exp * 1000 < Date.now())
+        return { ok: false, reason: "expired" };
+    if (claims.userEmail !== expected.userEmail.trim().toLowerCase() ||
+        claims.orgId !== expected.orgId ||
+        claims.browserTabId !== expected.browserTabId) {
+        return { ok: false, reason: "identity_mismatch" };
+    }
+    const stringsOnly = (value) => Array.isArray(value)
+        ? value.filter((name) => typeof name === "string")
+        : [];
+    return {
+        ok: true,
+        userEmail: claims.userEmail,
+        orgId: claims.orgId,
+        browserTabId: claims.browserTabId,
+        toolNames: stringsOnly(claims.toolNames),
+        discoveredToolNames: stringsOnly(claims.discovered),
+    };
+}
 // ── Gateway access-check tokens ──────────────────────────────────────────────
 //
 // The hosted gateway has no access to an app's shareable-resource registry, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.145.4",
+  "version": "0.145.5",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -413,7 +413,7 @@
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
     "@agent-native/recap-cli": "0.5.3",
-    "@agent-native/toolkit": "^0.13.3"
+    "@agent-native/toolkit": "^0.13.4"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",