@agent-native/core 0.157.11 → 0.157.13

package/corpus/templates/analytics/server/lib/first-party-analytics-purge.ts

@@ -1,7 +1,4 @@
 import { getDbExec } from "@agent-native/core/db";
-import { and, eq, gte, isNull, ne, or } from "drizzle-orm";
-
-import { getDb, schema } from "../db/index.js";
 
 export interface FirstPartyAnalyticsPurgeScope {
   userEmail: string;
@@ -19,34 +16,6 @@ export interface FirstPartyAnalyticsPurgeWindow {
   startEventDate: string;
 }
 
-function scopePredicate(
-  table: {
-    orgId: any;
-    ownerEmail: any;
-  },
-  scope: FirstPartyAnalyticsPurgeScope,
-  includeLegacyOwnerRows: boolean,
-) {
-  if (!includeLegacyOwnerRows) return eq(table.orgId, scope.orgId);
-  return or(
-    eq(table.orgId, scope.orgId),
-    and(isNull(table.orgId), eq(table.ownerEmail, scope.userEmail)),
-  );
-}
-
-function windowPredicate(
-  table: {
-    eventDate: any;
-    receivedAt?: any;
-  },
-  predicate: any,
-  window: FirstPartyAnalyticsPurgeWindow,
-) {
-  return table.receivedAt
-    ? and(predicate, gte(table.receivedAt, window.startReceivedAt))
-    : and(predicate, gte(table.eventDate, window.startEventDate));
-}
-
 type CountTable =
   | "analytics_events"
   | "analytics_event_daily_rollups"
@@ -54,6 +23,40 @@ type CountTable =
 
 type CountTimeColumn = "received_at" | "event_date";
 
+const PURGE_BATCH_SIZE = 10_000;
+const PURGE_BATCH_TIMEOUT_MS = 60_000;
+const PURGE_COUNT_TIMEOUT_MS = 60_000;
+
+function purgeWhereSql(
+  table: CountTable,
+  scope: FirstPartyAnalyticsPurgeScope,
+  includeLegacyOwnerRows: boolean,
+  window: FirstPartyAnalyticsPurgeWindow,
+): { sql: string; args: unknown[]; timeColumn: CountTimeColumn } {
+  const scopeSql = includeLegacyOwnerRows
+    ? "(org_id = ? OR (org_id IS NULL AND owner_email = ?))"
+    : "org_id = ?";
+  const args: unknown[] = includeLegacyOwnerRows
+    ? [scope.orgId, scope.userEmail]
+    : [scope.orgId];
+  const timeColumn =
+    table === "analytics_events" ? "received_at" : "event_date";
+  args.push(
+    timeColumn === "received_at"
+      ? window.startReceivedAt
+      : window.startEventDate,
+  );
+  const eventFilter =
+    table === "analytics_events"
+      ? " AND event_name IS DISTINCT FROM 'http.response'"
+      : "";
+  return {
+    sql: `${scopeSql}${eventFilter} AND ${timeColumn} >= ?`,
+    args,
+    timeColumn,
+  };
+}
+
 async function countScopedRows(
   table: CountTable,
   timeColumn: CountTimeColumn,
@@ -84,7 +87,7 @@ async function countScopedRows(
              ${eventFilter}
              AND ${timeColumn} >= ?`,
     args,
-    timeoutMs: 5_000,
+    timeoutMs: PURGE_COUNT_TIMEOUT_MS,
     maxAttempts: 1,
   });
   const rawCount = (rows[0] as { row_count?: unknown } | undefined)?.row_count;
@@ -136,49 +139,34 @@ export async function purgeFirstPartyAnalyticsPostgresRows(
     includeLegacyOwnerRows,
     window,
   );
-  await (getDb() as any).transaction(async (tx: any) => {
-    await tx
-      .delete(schema.analyticsEvents)
-      .where(
-        and(
-          windowPredicate(
-            schema.analyticsEvents,
-            scopePredicate(
-              schema.analyticsEvents,
-              scope,
-              includeLegacyOwnerRows,
-            ),
-            window,
-          ),
-          ne(schema.analyticsEvents.eventName, "http.response"),
-        ),
-      );
-    await tx
-      .delete(schema.analyticsEventDailyRollups)
-      .where(
-        windowPredicate(
-          schema.analyticsEventDailyRollups,
-          scopePredicate(
-            schema.analyticsEventDailyRollups,
-            scope,
-            includeLegacyOwnerRows,
-          ),
-          window,
-        ),
-      );
-    await tx
-      .delete(schema.analyticsUserDays)
-      .where(
-        windowPredicate(
-          schema.analyticsUserDays,
-          scopePredicate(
-            schema.analyticsUserDays,
-            scope,
-            includeLegacyOwnerRows,
-          ),
-          window,
-        ),
-      );
-  });
+
+  for (const table of [
+    "analytics_events",
+    "analytics_event_daily_rollups",
+    "analytics_user_days",
+  ] as const) {
+    const {
+      sql: whereSql,
+      args,
+      timeColumn,
+    } = purgeWhereSql(table, scope, includeLegacyOwnerRows, window);
+    while (true) {
+      const result = await getDbExec().execute({
+        sql: `WITH candidates AS (
+          SELECT id
+          FROM ${table}
+          WHERE ${whereSql}
+          ORDER BY ${timeColumn}, id
+          LIMIT ?
+        )
+        DELETE FROM ${table}
+        WHERE id IN (SELECT id FROM candidates)`,
+        args: [...args, PURGE_BATCH_SIZE],
+        timeoutMs: PURGE_BATCH_TIMEOUT_MS,
+        maxAttempts: 1,
+      });
+      if (Number(result.rowsAffected ?? 0) < PURGE_BATCH_SIZE) break;
+    }
+  }
   return counts;
 }

package/corpus/templates/slides/actions/export-pptx.ts

@@ -1051,7 +1051,7 @@ function importedLineStroke(
   innerHtml: string,
   dims: SlideDims,
 ):
-  | Pick<
+  | (Pick<
       ShapeElement,
       | "shapeType"
       | "lineColor"
@@ -1060,7 +1060,8 @@ function importedLineStroke(
       | "lineDashType"
       | "lineHeadType"
       | "lineTailType"
-    >
+    > &
+      Partial<Pick<ShapeElement, "w" | "h">>)
   | undefined {
   for (const [property, axis] of Object.entries(SINGLE_EDGE_BORDER_AXES)) {
     const border = parseCssBorder(getStyle(style, property));
@@ -1068,6 +1069,10 @@ function importedLineStroke(
     const color = colorToHex(border.color);
     return {
       shapeType: "line",
+      // A single-edge border is a line in the element's local coordinate
+      // system. Keep its perpendicular dimension collapsed after the box
+      // geometry has been parsed, or a thin rule becomes a diagonal line.
+      ...(axis === "x" ? { h: 0 } : { w: 0 }),
       lineColor: color.hex,
       lineTransparency: color.transparency,
       // The same 0.5pt floor the outline paths use, for the same reason:

package/dist/db/runtime-diagnostics.js

@@ -54,6 +54,18 @@ export const DEFAULT_REQUIRED_SCHEMA = [
         table: "application_state",
         columns: ["session_id", "key", "value", "updated_at"],
     },
+    {
+        table: "integration_remote_devices",
+        columns: [
+            "id",
+            "owner_email",
+            "label",
+            "device_token_hash",
+            "status",
+            "created_at",
+            "updated_at",
+        ],
+    },
 ];
 function envValue(key) {
     const value = process.env[key]?.trim();

package/dist/deploy/workspace-deploy.js

@@ -52,6 +52,18 @@ const WORKSPACE_APPS_ENV_KEY = "AGENT_NATIVE_WORKSPACE_APPS_JSON";
 const WORKSPACE_APPS_MANIFEST_DIR = ".agent-native";
 const WORKSPACE_APPS_MANIFEST_FILE = "workspace-apps.json";
 const VERCEL_OUTPUT_DIR = ".vercel/output";
+const WORKSPACE_DIRECTORY_ENV_SNIPPET = `
+  const directoryOrigin =
+    processRef.env.AGENT_NATIVE_ORG_DIRECTORY_URL ||
+    processRef.env.WORKSPACE_GATEWAY_URL ||
+    processRef.env.APP_URL ||
+    processRef.env.URL ||
+    processRef.env.DEPLOY_URL ||
+    processRef.env.BETTER_AUTH_URL;
+  if (directoryOrigin) {
+    processRef.env.AGENT_NATIVE_ORG_DIRECTORY_URL = directoryOrigin;
+  }
+`;
 export async function runWorkspaceDeploy(opts = {}) {
     const workspaceRoot = opts.workspaceRoot ?? findWorkspaceRoot(process.cwd()) ?? process.cwd();
     const appsDir = path.join(workspaceRoot, "apps");
@@ -149,6 +161,11 @@ function buildOneApp(workspaceRoot, app, preset, execFile, workspaceApps) {
         VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS: JSON.stringify(workspaceAppRouteAccess.publicPaths),
         VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS: JSON.stringify(workspaceAppRouteAccess.protectedPaths),
         VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON: JSON.stringify(workspaceApps),
+        ...(workspaceGatewayUrl
+            ? {
+                AGENT_NATIVE_ORG_DIRECTORY_URL: process.env.AGENT_NATIVE_ORG_DIRECTORY_URL || workspaceGatewayUrl,
+            }
+            : {}),
         ...(workspaceGatewayUrl
             ? {
                 WORKSPACE_GATEWAY_URL: process.env.WORKSPACE_GATEWAY_URL || workspaceGatewayUrl,
@@ -670,6 +687,7 @@ function processorPathFromBody(body) {
 function setBasePathEnv() {
   const processRef = globalThis.process ??= { env: {} };
   processRef.env ??= {};
+${WORKSPACE_DIRECTORY_ENV_SNIPPET}
   Object.assign(processRef.env, {
     AGENT_NATIVE_WORKSPACE: "1",
     AGENT_NATIVE_WORKSPACE_APP_ID: ${JSON.stringify(app)},
@@ -755,6 +773,7 @@ globalThis.${INTEGRATION_RECOVERY_RUNTIME_MARKER} = true;
 function setBasePathEnv() {
   const processRef = globalThis.process ??= { env: {} };
   processRef.env ??= {};
+${WORKSPACE_DIRECTORY_ENV_SNIPPET}
   Object.assign(processRef.env, {
     AGENT_NATIVE_WORKSPACE: "1",
     AGENT_NATIVE_WORKSPACE_APP_ID: ${JSON.stringify(app)},
@@ -855,6 +874,7 @@ function normalizeBasePathArgs(args) {
 function setBasePathEnv() {
   const processRef = globalThis.process ??= { env: {} };
   processRef.env ??= {};
+${WORKSPACE_DIRECTORY_ENV_SNIPPET}
   Object.assign(processRef.env, {
     AGENT_NATIVE_WORKSPACE: "1",
     AGENT_NATIVE_WORKSPACE_APP_ID: ${JSON.stringify(app)},
@@ -914,6 +934,7 @@ function patchVercelFunctionEntry(functionDir, app, workspaceApps) {
 function setBasePathEnv() {
   const processRef = globalThis.process ??= { env: {} };
   processRef.env ??= {};
+${WORKSPACE_DIRECTORY_ENV_SNIPPET}
   Object.assign(processRef.env, {
     AGENT_NATIVE_WORKSPACE: "1",
     AGENT_NATIVE_WORKSPACE_APP_ID: ${JSON.stringify(app)},

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;

package/dist/integrations/plugin.js

@@ -708,12 +708,15 @@ export function createIntegrationsPlugin(options) {
             // sees the request. Keep the device secret in a dedicated TLS-only
             // header as a transport fallback; the value is still hashed and looked
             // up by authenticateRemoteDeviceToken, never persisted raw.
-            const token = extractBearerToken(getRequestHeader(event, "authorization")) ??
-                (getRequestHeader(event, "x-agent-native-device-token")?.trim() ||
-                    null);
-            const device = await authenticateRemoteDeviceToken(token);
-            if (device)
-                return device;
+            const candidates = [
+                getRequestHeader(event, "x-agent-native-device-token")?.trim() || null,
+                extractBearerToken(getRequestHeader(event, "authorization")),
+            ].filter((token, index, all) => Boolean(token) && all.indexOf(token) === index);
+            for (const token of candidates) {
+                const device = await authenticateRemoteDeviceToken(token);
+                if (device)
+                    return device;
+            }
             setResponseStatus(event, 401);
             return null;
         }

package/dist/integrations/remote-device-migrations.d.ts

@@ -0,0 +1,9 @@
+import type { MigrationEntry } from "../db/migrations.js";
+/**
+ * Remote-device state is read on request paths, so its table must exist before
+ * production serverless functions serve requests. The store keeps its local
+ * development convergence path for older databases; release migrations own
+ * production schema.
+ */
+export declare const REMOTE_DEVICE_MIGRATIONS: MigrationEntry[];
+export declare const REMOTE_DEVICE_MIGRATIONS_TABLE = "_remote_device_migrations";

package/dist/integrations/remote-device-migrations.js

@@ -0,0 +1,59 @@
+/**
+ * Remote-device state is read on request paths, so its table must exist before
+ * production serverless functions serve requests. The store keeps its local
+ * development convergence path for older databases; release migrations own
+ * production schema.
+ */
+export const REMOTE_DEVICE_MIGRATIONS = [
+    {
+        version: 1,
+        name: "remote-device-table-and-indexes",
+        sql: {
+            postgres: `
+        CREATE TABLE IF NOT EXISTS integration_remote_devices (
+          id TEXT PRIMARY KEY,
+          owner_email TEXT NOT NULL,
+          org_id TEXT,
+          label TEXT NOT NULL,
+          platform TEXT,
+          app_version TEXT,
+          host_name TEXT,
+          metadata_json TEXT,
+          device_token_hash TEXT NOT NULL,
+          last_seen_at BIGINT,
+          status TEXT NOT NULL,
+          revoked_at BIGINT,
+          created_at BIGINT NOT NULL,
+          updated_at BIGINT NOT NULL
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_devices_token_hash
+          ON integration_remote_devices (device_token_hash);
+        CREATE INDEX IF NOT EXISTS idx_remote_devices_owner
+          ON integration_remote_devices (owner_email, org_id);
+      `,
+            sqlite: `
+        CREATE TABLE IF NOT EXISTS integration_remote_devices (
+          id TEXT PRIMARY KEY,
+          owner_email TEXT NOT NULL,
+          org_id TEXT,
+          label TEXT NOT NULL,
+          platform TEXT,
+          app_version TEXT,
+          host_name TEXT,
+          metadata_json TEXT,
+          device_token_hash TEXT NOT NULL,
+          last_seen_at INTEGER,
+          status TEXT NOT NULL,
+          revoked_at INTEGER,
+          created_at INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_devices_token_hash
+          ON integration_remote_devices (device_token_hash);
+        CREATE INDEX IF NOT EXISTS idx_remote_devices_owner
+          ON integration_remote_devices (owner_email, org_id);
+      `,
+        },
+    },
+];
+export const REMOTE_DEVICE_MIGRATIONS_TABLE = "_remote_device_migrations";

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    ok?: undefined;
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -34,16 +34,16 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     ok: boolean;
     status: string;
     error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
     ok: boolean;
     removed: boolean;
@@ -54,9 +54,9 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
     ok: boolean;
     note?: undefined;

package/dist/server/action-routes.js

@@ -33,7 +33,7 @@ function currentBuildId() {
  * Actions are exposed as POST by default. Use `http: { method: "GET" }` in
  * defineAction to expose as GET. Use `http: false` to mark as agent-only.
  */
-import { isLoopbackRequest } from "./auth.js";
+import { isLoopbackRequest, registerAuthPublicPaths } from "./auth.js";
 import { getH3App } from "./framework-request-handler.js";
 import { runWithRequestContext } from "./request-context.js";
 const ROUTE_PREFIX = "/_agent-native/actions";
@@ -245,6 +245,13 @@ export function mountActionRoutes(nitroApp, actions, options) {
         const method = entry.http?.method ?? "POST";
         const path = entry.http?.path ?? name;
         const routePath = `${ROUTE_PREFIX}/${path}`;
+        // These two actions authenticate with a scoped A2A bearer rather than a
+        // browser session. Let that verifier see the request before the cookie
+        // auth guard rejects it; the action route still fails closed on invalid
+        // or missing credentials.
+        if (name === "list-feature-flags" || name === "set-feature-flag") {
+            registerAuthPublicPaths([routePath]);
+        }
         getH3App(nitroApp).use(routePath, defineEventHandler(async (event) => {
             const reqMethod = getMethod(event);
             const effectiveMethod = reqMethod === "HEAD" && method === "GET" ? "GET" : reqMethod;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.d.ts

@@ -221,6 +221,15 @@ export declare function removeSession(token: string): Promise<void>;
  * TTL and the only-cache-successes rule.
  */
 export declare function getSessionEmail(token: string): Promise<string | null>;
+/**
+ * Allow framework routes with their own non-cookie authentication to reach
+ * the handler. The handler remains responsible for verifying the credential.
+ *
+ * This is registered separately from template auth options because framework
+ * routes can be mounted after the auth plugin and must also work in custom
+ * workspace deployments that do not own a template auth file.
+ */
+export declare function registerAuthPublicPaths(paths: readonly string[]): void;
 export interface DesktopExchangeErrorPayload {
     message: string;
     code?: string;

package/dist/server/auth.js

@@ -960,7 +960,31 @@ export async function getSessionEmail(token) {
 // ---------------------------------------------------------------------------
 let customGetSession = null;
 let _authGuardConfig = null;
+const _registeredAuthPublicPaths = new Set();
 const _genericGoogleOAuthRoutesEnabled = new WeakMap();
+/**
+ * Allow framework routes with their own non-cookie authentication to reach
+ * the handler. The handler remains responsible for verifying the credential.
+ *
+ * This is registered separately from template auth options because framework
+ * routes can be mounted after the auth plugin and must also work in custom
+ * workspace deployments that do not own a template auth file.
+ */
+export function registerAuthPublicPaths(paths) {
+    for (const path of paths) {
+        const normalized = typeof path === "string" ? path.trim() : "";
+        if (!normalized.startsWith("/"))
+            continue;
+        _registeredAuthPublicPaths.add(normalized);
+        if (_authGuardConfig &&
+            !_authGuardConfig.publicPaths.includes(normalized)) {
+            _authGuardConfig.publicPaths.push(normalized);
+        }
+    }
+}
+function resolveAuthPublicPaths(paths) {
+    return [...new Set([...(paths ?? []), ..._registeredAuthPublicPaths])];
+}
 function getRequestHost(event) {
     return (getHeader(event, "x-forwarded-host") ??
         getHeader(event, "host") ??
@@ -2578,7 +2602,7 @@ function getCustomAuthRequiredHtml() {
 // mountBetterAuthRoutes — Better Auth powered auth with backward-compat routes
 // ---------------------------------------------------------------------------
 async function mountBetterAuthRoutes(app, options) {
-    const publicPaths = [...(options.publicPaths ?? [])];
+    const publicPaths = resolveAuthPublicPaths(options.publicPaths);
     const workspaceAppAudience = resolveWorkspaceAppAudience(options);
     const workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess(options);
     // The A2A agent card is part of an open protocol — other agents must be
@@ -3811,7 +3835,7 @@ export async function autoMountAuth(app, options = {}) {
     // Reset globals
     customGetSession = null;
     sessionMaxAge = options.maxAge ?? DEFAULT_MAX_AGE;
-    const publicPaths = options.publicPaths ?? [];
+    const publicPaths = resolveAuthPublicPaths(options.publicPaths);
     const workspaceAppAudience = resolveWorkspaceAppAudience(options);
     const workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess(options);
     mountAuthCorsMiddleware(app);

package/dist/server/index.d.ts

@@ -7,7 +7,7 @@ export { createOpenRouteHandler, type OpenRouteOptions } from "./open-route.js";
 export { createEmbedStartRouteHandler, buildEmbedStartPath, type EmbedStartRouteOptions, } from "./embed-route.js";
 export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTargetPath, requestHasEmbedAuthMarker, resolveEmbedSessionFromRequest, setEmbedSessionCookie, signEmbedSessionToken, verifyEmbedSessionToken, type ConsumedEmbedSessionTicket, type ConsumeEmbedSessionTicketOptions, type EmbedSessionTicket, type EmbedSessionTicketInput, type EmbedSessionTokenClaims, type ResolvedEmbedSession, type VerifyEmbedSessionTokenResult, } from "./embed-session.js";
 export { createSSEHandler, type SSEHandlerOptions } from "./sse.js";
-export { mountAuthMiddleware, autoMountAuth, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
+export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
 export { handleIdentitySso, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
 export { requireEnvKey, type MissingKeyResponse } from "./missing-key.js";
 export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";

package/dist/server/index.js

@@ -7,7 +7,7 @@ export { createOpenRouteHandler } from "./open-route.js";
 export { createEmbedStartRouteHandler, buildEmbedStartPath, } from "./embed-route.js";
 export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTargetPath, requestHasEmbedAuthMarker, resolveEmbedSessionFromRequest, setEmbedSessionCookie, signEmbedSessionToken, verifyEmbedSessionToken, } from "./embed-session.js";
 export { createSSEHandler } from "./sse.js";
-export { mountAuthMiddleware, autoMountAuth, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
+export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
 export { handleIdentitySso, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
 export { requireEnvKey } from "./missing-key.js";
 export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/server/release-migrations.js

@@ -5,6 +5,7 @@ import { AGENT_RUN_MIGRATIONS, AGENT_RUN_MIGRATIONS_TABLE, } from "../agent/run-
 import { AGENT_TOOL_APPROVAL_MIGRATIONS, AGENT_TOOL_APPROVAL_MIGRATIONS_TABLE, } from "../agent/tool-approval-migrations.js";
 import { CHAT_THREAD_SCHEMA_MIGRATIONS, CHAT_THREAD_SCHEMA_MIGRATIONS_TABLE, } from "../chat-threads/schema-migrations.js";
 import { runMigrations } from "../db/migrations.js";
+import { REMOTE_DEVICE_MIGRATIONS, REMOTE_DEVICE_MIGRATIONS_TABLE, } from "../integrations/remote-device-migrations.js";
 import { runAutomationRunMigrations } from "../jobs/run-history.js";
 import { runAutomationSchedulerHealthMigrations } from "../jobs/scheduler-health.js";
 import { OAUTH_TOKEN_MIGRATIONS, OAUTH_TOKEN_MIGRATIONS_TABLE, } from "../oauth-tokens/migrations.js";
@@ -40,6 +41,9 @@ export async function runFrameworkReleaseMigrations(nitroApp) {
         table: USAGE_ALERT_MIGRATIONS_TABLE,
     })(nitroApp);
     await runMigrations(ORG_MIGRATIONS, { table: "_org_migrations" })(nitroApp);
+    await runMigrations(REMOTE_DEVICE_MIGRATIONS, {
+        table: REMOTE_DEVICE_MIGRATIONS_TABLE,
+    })(nitroApp);
     await runMigrations(IDENTITY_SSO_MIGRATIONS, {
         table: "_identity_sso_migrations",
     })(nitroApp);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.157.11",
+  "version": "0.157.13",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {