@agent-native/core 0.154.0 → 0.154.2

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/identity-sso-store.d.ts

@@ -7,9 +7,9 @@
  *
  *   - `identity_sso_flow_state` binds state to the exact app, client,
  *     authority, callback, and PKCE challenge. State is single-use.
- *   - `identity_sso_jti` remains a defence-in-depth replay guard for the
- *     server-to-server assertion. The assertion is never sent through the
- *     browser; the one-time authorization code is the only browser credential.
+ *   - `identity_sso_jti` is the legacy-named shared replay guard for short-lived
+ *     server-to-server assertions, including identity SSO and privileged A2A
+ *     mutations.
  *
  * Uses the same portable raw-SQL pattern as the other framework stores. DDL is
  * additive and lazy, and PostgreSQL creation goes through the DDL guard.
@@ -59,4 +59,5 @@ export declare function consumeSsoState(state: string, expected: SsoStateBinding
  * guarantee, and refusing a login is safer than accepting an unverifiable
  * replay boundary.
  */
-export declare function isJtiReplayed(jti: string | undefined): Promise<boolean>;
+export declare function consumeOneTimeJti(jti: string | undefined): Promise<boolean>;
+export declare const isJtiReplayed: typeof consumeOneTimeJti;

package/dist/server/identity-sso-store.js

@@ -7,9 +7,9 @@
  *
  *   - `identity_sso_flow_state` binds state to the exact app, client,
  *     authority, callback, and PKCE challenge. State is single-use.
- *   - `identity_sso_jti` remains a defence-in-depth replay guard for the
- *     server-to-server assertion. The assertion is never sent through the
- *     browser; the one-time authorization code is the only browser credential.
+ *   - `identity_sso_jti` is the legacy-named shared replay guard for short-lived
+ *     server-to-server assertions, including identity SSO and privileged A2A
+ *     mutations.
  *
  * Uses the same portable raw-SQL pattern as the other framework stores. DDL is
  * additive and lazy, and PostgreSQL creation goes through the DDL guard.
@@ -321,7 +321,7 @@ export async function consumeSsoState(state, expected) {
  * guarantee, and refusing a login is safer than accepting an unverifiable
  * replay boundary.
  */
-export async function isJtiReplayed(jti) {
+export async function consumeOneTimeJti(jti) {
     if (!jti)
         return true;
     try {
@@ -352,3 +352,4 @@ export async function isJtiReplayed(jti) {
         return true;
     }
 }
+export const isJtiReplayed = consumeOneTimeJti;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.154.0",
+  "version": "0.154.2",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {