@agent-native/core 0.157.12 → 0.157.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/collab/awareness.d.ts +2 -2
- package/dist/collab/struct-routes.d.ts +1 -1
- package/dist/db/runtime-diagnostics.js +12 -0
- package/dist/deploy/workspace-deploy.js +21 -0
- package/dist/file-upload/actions/upload-image.d.ts +1 -1
- package/dist/integrations/remote-device-migrations.d.ts +9 -0
- package/dist/integrations/remote-device-migrations.js +59 -0
- package/dist/observability/routes.d.ts +3 -3
- package/dist/progress/routes.d.ts +1 -1
- package/dist/resources/handlers.d.ts +1 -1
- package/dist/secrets/routes.d.ts +3 -3
- package/dist/server/action-routes.js +10 -2
- package/dist/server/auth.d.ts +9 -0
- package/dist/server/auth.js +58 -7
- package/dist/server/index.d.ts +1 -1
- package/dist/server/index.js +1 -1
- package/dist/server/realtime-token.d.ts +1 -1
- package/dist/server/release-migrations.js +4 -0
- package/dist/server/transcribe-voice.d.ts +1 -1
- package/package.json +1 -1
|
@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
|
|
|
62
62
|
error: string;
|
|
63
63
|
states?: undefined;
|
|
64
64
|
} | {
|
|
65
|
-
error?: undefined;
|
|
66
65
|
states: {
|
|
67
66
|
clientId: number;
|
|
68
67
|
state: string;
|
|
69
68
|
}[];
|
|
69
|
+
error?: undefined;
|
|
70
70
|
}>>;
|
|
71
71
|
/**
|
|
72
72
|
* GET /_agent-native/collab/:docId/users
|
|
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
|
|
|
77
77
|
error: string;
|
|
78
78
|
users?: undefined;
|
|
79
79
|
} | {
|
|
80
|
-
error?: undefined;
|
|
81
80
|
users: {
|
|
82
81
|
clientId: number;
|
|
83
82
|
lastSeen: number;
|
|
84
83
|
}[];
|
|
84
|
+
error?: undefined;
|
|
85
85
|
}>>;
|
|
@@ -13,8 +13,8 @@
|
|
|
13
13
|
* Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
|
|
14
14
|
*/
|
|
15
15
|
export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
|
|
16
|
-
error: string;
|
|
17
16
|
ok?: undefined;
|
|
17
|
+
error: string;
|
|
18
18
|
} | {
|
|
19
19
|
error?: undefined;
|
|
20
20
|
ok: boolean;
|
|
@@ -54,6 +54,18 @@ export const DEFAULT_REQUIRED_SCHEMA = [
|
|
|
54
54
|
table: "application_state",
|
|
55
55
|
columns: ["session_id", "key", "value", "updated_at"],
|
|
56
56
|
},
|
|
57
|
+
{
|
|
58
|
+
table: "integration_remote_devices",
|
|
59
|
+
columns: [
|
|
60
|
+
"id",
|
|
61
|
+
"owner_email",
|
|
62
|
+
"label",
|
|
63
|
+
"device_token_hash",
|
|
64
|
+
"status",
|
|
65
|
+
"created_at",
|
|
66
|
+
"updated_at",
|
|
67
|
+
],
|
|
68
|
+
},
|
|
57
69
|
];
|
|
58
70
|
function envValue(key) {
|
|
59
71
|
const value = process.env[key]?.trim();
|
|
@@ -52,6 +52,18 @@ const WORKSPACE_APPS_ENV_KEY = "AGENT_NATIVE_WORKSPACE_APPS_JSON";
|
|
|
52
52
|
const WORKSPACE_APPS_MANIFEST_DIR = ".agent-native";
|
|
53
53
|
const WORKSPACE_APPS_MANIFEST_FILE = "workspace-apps.json";
|
|
54
54
|
const VERCEL_OUTPUT_DIR = ".vercel/output";
|
|
55
|
+
const WORKSPACE_DIRECTORY_ENV_SNIPPET = `
|
|
56
|
+
const directoryOrigin =
|
|
57
|
+
processRef.env.AGENT_NATIVE_ORG_DIRECTORY_URL ||
|
|
58
|
+
processRef.env.WORKSPACE_GATEWAY_URL ||
|
|
59
|
+
processRef.env.APP_URL ||
|
|
60
|
+
processRef.env.URL ||
|
|
61
|
+
processRef.env.DEPLOY_URL ||
|
|
62
|
+
processRef.env.BETTER_AUTH_URL;
|
|
63
|
+
if (directoryOrigin) {
|
|
64
|
+
processRef.env.AGENT_NATIVE_ORG_DIRECTORY_URL = directoryOrigin;
|
|
65
|
+
}
|
|
66
|
+
`;
|
|
55
67
|
export async function runWorkspaceDeploy(opts = {}) {
|
|
56
68
|
const workspaceRoot = opts.workspaceRoot ?? findWorkspaceRoot(process.cwd()) ?? process.cwd();
|
|
57
69
|
const appsDir = path.join(workspaceRoot, "apps");
|
|
@@ -149,6 +161,11 @@ function buildOneApp(workspaceRoot, app, preset, execFile, workspaceApps) {
|
|
|
149
161
|
VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS: JSON.stringify(workspaceAppRouteAccess.publicPaths),
|
|
150
162
|
VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS: JSON.stringify(workspaceAppRouteAccess.protectedPaths),
|
|
151
163
|
VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON: JSON.stringify(workspaceApps),
|
|
164
|
+
...(workspaceGatewayUrl
|
|
165
|
+
? {
|
|
166
|
+
AGENT_NATIVE_ORG_DIRECTORY_URL: process.env.AGENT_NATIVE_ORG_DIRECTORY_URL || workspaceGatewayUrl,
|
|
167
|
+
}
|
|
168
|
+
: {}),
|
|
152
169
|
...(workspaceGatewayUrl
|
|
153
170
|
? {
|
|
154
171
|
WORKSPACE_GATEWAY_URL: process.env.WORKSPACE_GATEWAY_URL || workspaceGatewayUrl,
|
|
@@ -670,6 +687,7 @@ function processorPathFromBody(body) {
|
|
|
670
687
|
function setBasePathEnv() {
|
|
671
688
|
const processRef = globalThis.process ??= { env: {} };
|
|
672
689
|
processRef.env ??= {};
|
|
690
|
+
${WORKSPACE_DIRECTORY_ENV_SNIPPET}
|
|
673
691
|
Object.assign(processRef.env, {
|
|
674
692
|
AGENT_NATIVE_WORKSPACE: "1",
|
|
675
693
|
AGENT_NATIVE_WORKSPACE_APP_ID: ${JSON.stringify(app)},
|
|
@@ -755,6 +773,7 @@ globalThis.${INTEGRATION_RECOVERY_RUNTIME_MARKER} = true;
|
|
|
755
773
|
function setBasePathEnv() {
|
|
756
774
|
const processRef = globalThis.process ??= { env: {} };
|
|
757
775
|
processRef.env ??= {};
|
|
776
|
+
${WORKSPACE_DIRECTORY_ENV_SNIPPET}
|
|
758
777
|
Object.assign(processRef.env, {
|
|
759
778
|
AGENT_NATIVE_WORKSPACE: "1",
|
|
760
779
|
AGENT_NATIVE_WORKSPACE_APP_ID: ${JSON.stringify(app)},
|
|
@@ -855,6 +874,7 @@ function normalizeBasePathArgs(args) {
|
|
|
855
874
|
function setBasePathEnv() {
|
|
856
875
|
const processRef = globalThis.process ??= { env: {} };
|
|
857
876
|
processRef.env ??= {};
|
|
877
|
+
${WORKSPACE_DIRECTORY_ENV_SNIPPET}
|
|
858
878
|
Object.assign(processRef.env, {
|
|
859
879
|
AGENT_NATIVE_WORKSPACE: "1",
|
|
860
880
|
AGENT_NATIVE_WORKSPACE_APP_ID: ${JSON.stringify(app)},
|
|
@@ -914,6 +934,7 @@ function patchVercelFunctionEntry(functionDir, app, workspaceApps) {
|
|
|
914
934
|
function setBasePathEnv() {
|
|
915
935
|
const processRef = globalThis.process ??= { env: {} };
|
|
916
936
|
processRef.env ??= {};
|
|
937
|
+
${WORKSPACE_DIRECTORY_ENV_SNIPPET}
|
|
917
938
|
Object.assign(processRef.env, {
|
|
918
939
|
AGENT_NATIVE_WORKSPACE: "1",
|
|
919
940
|
AGENT_NATIVE_WORKSPACE_APP_ID: ${JSON.stringify(app)},
|
|
@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
|
|
|
17
17
|
id?: undefined;
|
|
18
18
|
provider?: undefined;
|
|
19
19
|
} | {
|
|
20
|
+
error?: undefined;
|
|
20
21
|
configured?: undefined;
|
|
21
22
|
connectPath?: undefined;
|
|
22
23
|
url: string;
|
|
23
24
|
id: string;
|
|
24
25
|
provider: string;
|
|
25
|
-
error?: undefined;
|
|
26
26
|
}>;
|
|
27
27
|
export default _default;
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
import type { MigrationEntry } from "../db/migrations.js";
|
|
2
|
+
/**
|
|
3
|
+
* Remote-device state is read on request paths, so its table must exist before
|
|
4
|
+
* production serverless functions serve requests. The store keeps its local
|
|
5
|
+
* development convergence path for older databases; release migrations own
|
|
6
|
+
* production schema.
|
|
7
|
+
*/
|
|
8
|
+
export declare const REMOTE_DEVICE_MIGRATIONS: MigrationEntry[];
|
|
9
|
+
export declare const REMOTE_DEVICE_MIGRATIONS_TABLE = "_remote_device_migrations";
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Remote-device state is read on request paths, so its table must exist before
|
|
3
|
+
* production serverless functions serve requests. The store keeps its local
|
|
4
|
+
* development convergence path for older databases; release migrations own
|
|
5
|
+
* production schema.
|
|
6
|
+
*/
|
|
7
|
+
export const REMOTE_DEVICE_MIGRATIONS = [
|
|
8
|
+
{
|
|
9
|
+
version: 1,
|
|
10
|
+
name: "remote-device-table-and-indexes",
|
|
11
|
+
sql: {
|
|
12
|
+
postgres: `
|
|
13
|
+
CREATE TABLE IF NOT EXISTS integration_remote_devices (
|
|
14
|
+
id TEXT PRIMARY KEY,
|
|
15
|
+
owner_email TEXT NOT NULL,
|
|
16
|
+
org_id TEXT,
|
|
17
|
+
label TEXT NOT NULL,
|
|
18
|
+
platform TEXT,
|
|
19
|
+
app_version TEXT,
|
|
20
|
+
host_name TEXT,
|
|
21
|
+
metadata_json TEXT,
|
|
22
|
+
device_token_hash TEXT NOT NULL,
|
|
23
|
+
last_seen_at BIGINT,
|
|
24
|
+
status TEXT NOT NULL,
|
|
25
|
+
revoked_at BIGINT,
|
|
26
|
+
created_at BIGINT NOT NULL,
|
|
27
|
+
updated_at BIGINT NOT NULL
|
|
28
|
+
);
|
|
29
|
+
CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_devices_token_hash
|
|
30
|
+
ON integration_remote_devices (device_token_hash);
|
|
31
|
+
CREATE INDEX IF NOT EXISTS idx_remote_devices_owner
|
|
32
|
+
ON integration_remote_devices (owner_email, org_id);
|
|
33
|
+
`,
|
|
34
|
+
sqlite: `
|
|
35
|
+
CREATE TABLE IF NOT EXISTS integration_remote_devices (
|
|
36
|
+
id TEXT PRIMARY KEY,
|
|
37
|
+
owner_email TEXT NOT NULL,
|
|
38
|
+
org_id TEXT,
|
|
39
|
+
label TEXT NOT NULL,
|
|
40
|
+
platform TEXT,
|
|
41
|
+
app_version TEXT,
|
|
42
|
+
host_name TEXT,
|
|
43
|
+
metadata_json TEXT,
|
|
44
|
+
device_token_hash TEXT NOT NULL,
|
|
45
|
+
last_seen_at INTEGER,
|
|
46
|
+
status TEXT NOT NULL,
|
|
47
|
+
revoked_at INTEGER,
|
|
48
|
+
created_at INTEGER NOT NULL,
|
|
49
|
+
updated_at INTEGER NOT NULL
|
|
50
|
+
);
|
|
51
|
+
CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_devices_token_hash
|
|
52
|
+
ON integration_remote_devices (device_token_hash);
|
|
53
|
+
CREATE INDEX IF NOT EXISTS idx_remote_devices_owner
|
|
54
|
+
ON integration_remote_devices (owner_email, org_id);
|
|
55
|
+
`,
|
|
56
|
+
},
|
|
57
|
+
},
|
|
58
|
+
];
|
|
59
|
+
export const REMOTE_DEVICE_MIGRATIONS_TABLE = "_remote_device_migrations";
|
|
@@ -42,22 +42,22 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
|
|
|
42
42
|
avgEvalScore: number;
|
|
43
43
|
} | {
|
|
44
44
|
error?: undefined;
|
|
45
|
+
ok?: undefined;
|
|
45
46
|
summary: import("./types.js").TraceSummary;
|
|
46
47
|
spans: import("./types.js").TraceSpan[];
|
|
47
48
|
id?: undefined;
|
|
48
|
-
ok?: undefined;
|
|
49
49
|
} | {
|
|
50
50
|
error?: undefined;
|
|
51
|
+
ok?: undefined;
|
|
51
52
|
summary?: undefined;
|
|
52
53
|
spans?: undefined;
|
|
53
54
|
id: string;
|
|
54
|
-
ok?: undefined;
|
|
55
55
|
} | {
|
|
56
|
+
ok?: undefined;
|
|
56
57
|
summary?: undefined;
|
|
57
58
|
spans?: undefined;
|
|
58
59
|
id?: undefined;
|
|
59
60
|
error: any;
|
|
60
|
-
ok?: undefined;
|
|
61
61
|
} | {
|
|
62
62
|
error?: undefined;
|
|
63
63
|
summary?: undefined;
|
|
@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
|
|
|
48
48
|
}>;
|
|
49
49
|
/** DELETE /_agent-native/resources/:id — delete a resource */
|
|
50
50
|
export declare function handleDeleteResource(event: any): Promise<{
|
|
51
|
-
error: string;
|
|
52
51
|
ok?: undefined;
|
|
52
|
+
error: string;
|
|
53
53
|
} | {
|
|
54
54
|
error?: undefined;
|
|
55
55
|
ok: boolean;
|
package/dist/secrets/routes.d.ts
CHANGED
|
@@ -34,16 +34,16 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
|
|
|
34
34
|
/** POST /_agent-native/secrets/:key — write a secret. */
|
|
35
35
|
export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
|
|
36
36
|
error: string;
|
|
37
|
-
status?: undefined;
|
|
38
37
|
ok?: undefined;
|
|
38
|
+
status?: undefined;
|
|
39
39
|
} | {
|
|
40
40
|
error?: undefined;
|
|
41
41
|
ok: boolean;
|
|
42
42
|
status: string;
|
|
43
43
|
} | {
|
|
44
|
+
ok?: undefined;
|
|
44
45
|
error: string;
|
|
45
46
|
removed?: undefined;
|
|
46
|
-
ok?: undefined;
|
|
47
47
|
} | {
|
|
48
48
|
error?: undefined;
|
|
49
49
|
ok: boolean;
|
|
@@ -54,9 +54,9 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
|
|
|
54
54
|
* or the current stored value without changing anything.
|
|
55
55
|
*/
|
|
56
56
|
export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
|
|
57
|
+
ok?: undefined;
|
|
57
58
|
error: string;
|
|
58
59
|
note?: undefined;
|
|
59
|
-
ok?: undefined;
|
|
60
60
|
} | {
|
|
61
61
|
error?: undefined;
|
|
62
62
|
ok: boolean;
|
|
@@ -33,7 +33,7 @@ function currentBuildId() {
|
|
|
33
33
|
* Actions are exposed as POST by default. Use `http: { method: "GET" }` in
|
|
34
34
|
* defineAction to expose as GET. Use `http: false` to mark as agent-only.
|
|
35
35
|
*/
|
|
36
|
-
import { isLoopbackRequest } from "./auth.js";
|
|
36
|
+
import { isLoopbackRequest, registerAuthPublicPaths } from "./auth.js";
|
|
37
37
|
import { getH3App } from "./framework-request-handler.js";
|
|
38
38
|
import { runWithRequestContext } from "./request-context.js";
|
|
39
39
|
const ROUTE_PREFIX = "/_agent-native/actions";
|
|
@@ -238,6 +238,7 @@ async function resolveRequestAuthCapability(event) {
|
|
|
238
238
|
*/
|
|
239
239
|
export function mountActionRoutes(nitroApp, actions, options) {
|
|
240
240
|
const mounted = [];
|
|
241
|
+
const app = getH3App(nitroApp);
|
|
241
242
|
for (const [name, entry] of Object.entries(actions)) {
|
|
242
243
|
// Skip agent-only actions
|
|
243
244
|
if (entry.http === false)
|
|
@@ -245,7 +246,14 @@ export function mountActionRoutes(nitroApp, actions, options) {
|
|
|
245
246
|
const method = entry.http?.method ?? "POST";
|
|
246
247
|
const path = entry.http?.path ?? name;
|
|
247
248
|
const routePath = `${ROUTE_PREFIX}/${path}`;
|
|
248
|
-
|
|
249
|
+
// These two actions authenticate with a scoped A2A bearer rather than a
|
|
250
|
+
// browser session. Let that verifier see the request before the cookie
|
|
251
|
+
// auth guard rejects it; the action route still fails closed on invalid
|
|
252
|
+
// or missing credentials.
|
|
253
|
+
if (name === "list-feature-flags" || name === "set-feature-flag") {
|
|
254
|
+
registerAuthPublicPaths([routePath], app);
|
|
255
|
+
}
|
|
256
|
+
app.use(routePath, defineEventHandler(async (event) => {
|
|
249
257
|
const reqMethod = getMethod(event);
|
|
250
258
|
const effectiveMethod = reqMethod === "HEAD" && method === "GET" ? "GET" : reqMethod;
|
|
251
259
|
if (reqMethod === "OPTIONS") {
|
package/dist/server/auth.d.ts
CHANGED
|
@@ -221,6 +221,15 @@ export declare function removeSession(token: string): Promise<void>;
|
|
|
221
221
|
* TTL and the only-cache-successes rule.
|
|
222
222
|
*/
|
|
223
223
|
export declare function getSessionEmail(token: string): Promise<string | null>;
|
|
224
|
+
/**
|
|
225
|
+
* Allow framework routes with their own non-cookie authentication to reach
|
|
226
|
+
* the handler. The handler remains responsible for verifying the credential.
|
|
227
|
+
*
|
|
228
|
+
* This is registered separately from template auth options because framework
|
|
229
|
+
* routes can be mounted after the auth plugin and must also work in custom
|
|
230
|
+
* workspace deployments that do not own a template auth file.
|
|
231
|
+
*/
|
|
232
|
+
export declare function registerAuthPublicPaths(paths: readonly string[], app?: object): void;
|
|
224
233
|
export interface DesktopExchangeErrorPayload {
|
|
225
234
|
message: string;
|
|
226
235
|
code?: string;
|
package/dist/server/auth.js
CHANGED
|
@@ -960,7 +960,56 @@ export async function getSessionEmail(token) {
|
|
|
960
960
|
// ---------------------------------------------------------------------------
|
|
961
961
|
let customGetSession = null;
|
|
962
962
|
let _authGuardConfig = null;
|
|
963
|
+
// Pin the registry to globalThis so template plugins and framework routes that
|
|
964
|
+
// load Core through different SSR bundle or pnpm peer graphs still share it.
|
|
965
|
+
// Scope entries by H3 app so a route registered by one app cannot become public
|
|
966
|
+
// in another app that happens to share the same Node realm.
|
|
967
|
+
const AUTH_PUBLIC_PATHS_REGISTRY_KEY = Symbol.for("@agent-native/core/auth.publicPaths");
|
|
968
|
+
const _registeredAuthPublicPaths = new Set();
|
|
969
|
+
function getAuthPublicPathRegistry() {
|
|
970
|
+
const globals = globalThis;
|
|
971
|
+
return (globals[AUTH_PUBLIC_PATHS_REGISTRY_KEY] ??= {
|
|
972
|
+
pathsByApp: new WeakMap(),
|
|
973
|
+
});
|
|
974
|
+
}
|
|
975
|
+
function getRegisteredAuthPublicPaths(app) {
|
|
976
|
+
if (!app)
|
|
977
|
+
return _registeredAuthPublicPaths;
|
|
978
|
+
const registry = getAuthPublicPathRegistry();
|
|
979
|
+
let paths = registry.pathsByApp.get(app);
|
|
980
|
+
if (!paths) {
|
|
981
|
+
paths = new Set();
|
|
982
|
+
registry.pathsByApp.set(app, paths);
|
|
983
|
+
}
|
|
984
|
+
return paths;
|
|
985
|
+
}
|
|
963
986
|
const _genericGoogleOAuthRoutesEnabled = new WeakMap();
|
|
987
|
+
/**
|
|
988
|
+
* Allow framework routes with their own non-cookie authentication to reach
|
|
989
|
+
* the handler. The handler remains responsible for verifying the credential.
|
|
990
|
+
*
|
|
991
|
+
* This is registered separately from template auth options because framework
|
|
992
|
+
* routes can be mounted after the auth plugin and must also work in custom
|
|
993
|
+
* workspace deployments that do not own a template auth file.
|
|
994
|
+
*/
|
|
995
|
+
export function registerAuthPublicPaths(paths, app) {
|
|
996
|
+
const registeredPaths = getRegisteredAuthPublicPaths(app);
|
|
997
|
+
for (const path of paths) {
|
|
998
|
+
const normalized = typeof path === "string" ? path.trim() : "";
|
|
999
|
+
if (!normalized.startsWith("/"))
|
|
1000
|
+
continue;
|
|
1001
|
+
registeredPaths.add(normalized);
|
|
1002
|
+
}
|
|
1003
|
+
}
|
|
1004
|
+
function resolveAuthPublicPaths(paths, app) {
|
|
1005
|
+
return [
|
|
1006
|
+
...new Set([
|
|
1007
|
+
...(paths ?? []),
|
|
1008
|
+
..._registeredAuthPublicPaths,
|
|
1009
|
+
...(app ? getRegisteredAuthPublicPaths(app) : []),
|
|
1010
|
+
]),
|
|
1011
|
+
];
|
|
1012
|
+
}
|
|
964
1013
|
function getRequestHost(event) {
|
|
965
1014
|
return (getHeader(event, "x-forwarded-host") ??
|
|
966
1015
|
getHeader(event, "host") ??
|
|
@@ -1540,12 +1589,14 @@ function isHtmlDocumentRequest(event, pathname) {
|
|
|
1540
1589
|
const accept = getHeader(event, "accept")?.toLowerCase();
|
|
1541
1590
|
return !accept || accept.includes("text/html") || accept.includes("*/*");
|
|
1542
1591
|
}
|
|
1543
|
-
function createAuthGuardFn() {
|
|
1592
|
+
function createAuthGuardFn(app) {
|
|
1544
1593
|
return async (event) => {
|
|
1545
1594
|
const config = _authGuardConfig;
|
|
1546
1595
|
if (!config)
|
|
1547
1596
|
return;
|
|
1548
|
-
|
|
1597
|
+
// Resolve on every request because a framework route can be mounted by a
|
|
1598
|
+
// different Core module instance after this auth guard is initialized.
|
|
1599
|
+
const publicPaths = resolveAuthPublicPaths(config.publicPaths, app);
|
|
1549
1600
|
const url = event.node?.req?.url ?? event.path ?? "/";
|
|
1550
1601
|
const queryStart = url.indexOf("?");
|
|
1551
1602
|
const rawPath = queryStart >= 0 ? url.slice(0, queryStart) : url;
|
|
@@ -2578,7 +2629,7 @@ function getCustomAuthRequiredHtml() {
|
|
|
2578
2629
|
// mountBetterAuthRoutes — Better Auth powered auth with backward-compat routes
|
|
2579
2630
|
// ---------------------------------------------------------------------------
|
|
2580
2631
|
async function mountBetterAuthRoutes(app, options) {
|
|
2581
|
-
const publicPaths =
|
|
2632
|
+
const publicPaths = resolveAuthPublicPaths(options.publicPaths, app);
|
|
2582
2633
|
const workspaceAppAudience = resolveWorkspaceAppAudience(options);
|
|
2583
2634
|
const workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess(options);
|
|
2584
2635
|
// The A2A agent card is part of an open protocol — other agents must be
|
|
@@ -3588,7 +3639,7 @@ async function mountBetterAuthRoutes(app, options) {
|
|
|
3588
3639
|
workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
|
|
3589
3640
|
workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
|
|
3590
3641
|
};
|
|
3591
|
-
const guardFn = createAuthGuardFn();
|
|
3642
|
+
const guardFn = createAuthGuardFn(app);
|
|
3592
3643
|
_authGuardFn = guardFn;
|
|
3593
3644
|
app.use(defineEventHandler(guardFn));
|
|
3594
3645
|
}
|
|
@@ -3811,7 +3862,7 @@ export async function autoMountAuth(app, options = {}) {
|
|
|
3811
3862
|
// Reset globals
|
|
3812
3863
|
customGetSession = null;
|
|
3813
3864
|
sessionMaxAge = options.maxAge ?? DEFAULT_MAX_AGE;
|
|
3814
|
-
const publicPaths = options.publicPaths
|
|
3865
|
+
const publicPaths = resolveAuthPublicPaths(options.publicPaths, app);
|
|
3815
3866
|
const workspaceAppAudience = resolveWorkspaceAppAudience(options);
|
|
3816
3867
|
const workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess(options);
|
|
3817
3868
|
mountAuthCorsMiddleware(app);
|
|
@@ -3856,7 +3907,7 @@ export async function autoMountAuth(app, options = {}) {
|
|
|
3856
3907
|
workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
|
|
3857
3908
|
workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
|
|
3858
3909
|
};
|
|
3859
|
-
const guardFn = createAuthGuardFn();
|
|
3910
|
+
const guardFn = createAuthGuardFn(app);
|
|
3860
3911
|
_authGuardFn = guardFn;
|
|
3861
3912
|
app.use(defineEventHandler(guardFn));
|
|
3862
3913
|
if (process.env.DEBUG)
|
|
@@ -3883,7 +3934,7 @@ export async function autoMountAuth(app, options = {}) {
|
|
|
3883
3934
|
workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
|
|
3884
3935
|
workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
|
|
3885
3936
|
};
|
|
3886
|
-
const guardFn = createAuthGuardFn();
|
|
3937
|
+
const guardFn = createAuthGuardFn(app);
|
|
3887
3938
|
_authGuardFn = guardFn;
|
|
3888
3939
|
app.use(defineEventHandler(guardFn));
|
|
3889
3940
|
console.log("[agent-native] Auth guard registered despite init failure — app is locked.");
|
package/dist/server/index.d.ts
CHANGED
|
@@ -7,7 +7,7 @@ export { createOpenRouteHandler, type OpenRouteOptions } from "./open-route.js";
|
|
|
7
7
|
export { createEmbedStartRouteHandler, buildEmbedStartPath, type EmbedStartRouteOptions, } from "./embed-route.js";
|
|
8
8
|
export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTargetPath, requestHasEmbedAuthMarker, resolveEmbedSessionFromRequest, setEmbedSessionCookie, signEmbedSessionToken, verifyEmbedSessionToken, type ConsumedEmbedSessionTicket, type ConsumeEmbedSessionTicketOptions, type EmbedSessionTicket, type EmbedSessionTicketInput, type EmbedSessionTokenClaims, type ResolvedEmbedSession, type VerifyEmbedSessionTokenResult, } from "./embed-session.js";
|
|
9
9
|
export { createSSEHandler, type SSEHandlerOptions } from "./sse.js";
|
|
10
|
-
export { mountAuthMiddleware, autoMountAuth, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
|
|
10
|
+
export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
|
|
11
11
|
export { handleIdentitySso, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
|
|
12
12
|
export { requireEnvKey, type MissingKeyResponse } from "./missing-key.js";
|
|
13
13
|
export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";
|
package/dist/server/index.js
CHANGED
|
@@ -7,7 +7,7 @@ export { createOpenRouteHandler } from "./open-route.js";
|
|
|
7
7
|
export { createEmbedStartRouteHandler, buildEmbedStartPath, } from "./embed-route.js";
|
|
8
8
|
export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTargetPath, requestHasEmbedAuthMarker, resolveEmbedSessionFromRequest, setEmbedSessionCookie, signEmbedSessionToken, verifyEmbedSessionToken, } from "./embed-session.js";
|
|
9
9
|
export { createSSEHandler } from "./sse.js";
|
|
10
|
-
export { mountAuthMiddleware, autoMountAuth, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
|
|
10
|
+
export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
|
|
11
11
|
export { handleIdentitySso, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
|
|
12
12
|
export { requireEnvKey } from "./missing-key.js";
|
|
13
13
|
export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";
|
|
@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
|
|
|
26
26
|
expiresAt?: undefined;
|
|
27
27
|
ttlSeconds?: undefined;
|
|
28
28
|
} | {
|
|
29
|
+
error?: undefined;
|
|
29
30
|
token: string;
|
|
30
31
|
expiresAt: string;
|
|
31
32
|
ttlSeconds: number;
|
|
32
|
-
error?: undefined;
|
|
33
33
|
}>>;
|
|
@@ -5,6 +5,7 @@ import { AGENT_RUN_MIGRATIONS, AGENT_RUN_MIGRATIONS_TABLE, } from "../agent/run-
|
|
|
5
5
|
import { AGENT_TOOL_APPROVAL_MIGRATIONS, AGENT_TOOL_APPROVAL_MIGRATIONS_TABLE, } from "../agent/tool-approval-migrations.js";
|
|
6
6
|
import { CHAT_THREAD_SCHEMA_MIGRATIONS, CHAT_THREAD_SCHEMA_MIGRATIONS_TABLE, } from "../chat-threads/schema-migrations.js";
|
|
7
7
|
import { runMigrations } from "../db/migrations.js";
|
|
8
|
+
import { REMOTE_DEVICE_MIGRATIONS, REMOTE_DEVICE_MIGRATIONS_TABLE, } from "../integrations/remote-device-migrations.js";
|
|
8
9
|
import { runAutomationRunMigrations } from "../jobs/run-history.js";
|
|
9
10
|
import { runAutomationSchedulerHealthMigrations } from "../jobs/scheduler-health.js";
|
|
10
11
|
import { OAUTH_TOKEN_MIGRATIONS, OAUTH_TOKEN_MIGRATIONS_TABLE, } from "../oauth-tokens/migrations.js";
|
|
@@ -40,6 +41,9 @@ export async function runFrameworkReleaseMigrations(nitroApp) {
|
|
|
40
41
|
table: USAGE_ALERT_MIGRATIONS_TABLE,
|
|
41
42
|
})(nitroApp);
|
|
42
43
|
await runMigrations(ORG_MIGRATIONS, { table: "_org_migrations" })(nitroApp);
|
|
44
|
+
await runMigrations(REMOTE_DEVICE_MIGRATIONS, {
|
|
45
|
+
table: REMOTE_DEVICE_MIGRATIONS_TABLE,
|
|
46
|
+
})(nitroApp);
|
|
43
47
|
await runMigrations(IDENTITY_SSO_MIGRATIONS, {
|
|
44
48
|
table: "_identity_sso_migrations",
|
|
45
49
|
})(nitroApp);
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agent-native/core",
|
|
3
|
-
"version": "0.157.
|
|
3
|
+
"version": "0.157.14",
|
|
4
4
|
"description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
|
|
5
5
|
"homepage": "https://github.com/BuilderIO/agent-native#readme",
|
|
6
6
|
"bugs": {
|