@agent-native/core 0.157.13 → 0.157.14

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
+    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
 }>;
 export default _default;

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,6 +159,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -174,7 +175,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,6 +190,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -199,7 +200,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,6 +216,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -234,7 +235,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,6 +250,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -263,7 +264,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/notifications/routes.d.ts

@@ -16,18 +16,18 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error?: undefined;
     ok?: undefined;
 } | {
+    count?: undefined;
     updated: number;
     error?: undefined;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error: string;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error?: undefined;
     ok: boolean;
-    count?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,14 +41,14 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
 } | {
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/action-routes.js

@@ -238,6 +238,7 @@ async function resolveRequestAuthCapability(event) {
  */
 export function mountActionRoutes(nitroApp, actions, options) {
     const mounted = [];
+    const app = getH3App(nitroApp);
     for (const [name, entry] of Object.entries(actions)) {
         // Skip agent-only actions
         if (entry.http === false)
@@ -250,9 +251,9 @@ export function mountActionRoutes(nitroApp, actions, options) {
         // auth guard rejects it; the action route still fails closed on invalid
         // or missing credentials.
         if (name === "list-feature-flags" || name === "set-feature-flag") {
-            registerAuthPublicPaths([routePath]);
+            registerAuthPublicPaths([routePath], app);
         }
-        getH3App(nitroApp).use(routePath, defineEventHandler(async (event) => {
+        app.use(routePath, defineEventHandler(async (event) => {
             const reqMethod = getMethod(event);
             const effectiveMethod = reqMethod === "HEAD" && method === "GET" ? "GET" : reqMethod;
             if (reqMethod === "OPTIONS") {

package/dist/server/auth.d.ts

@@ -229,7 +229,7 @@ export declare function getSessionEmail(token: string): Promise<string | null>;
  * routes can be mounted after the auth plugin and must also work in custom
  * workspace deployments that do not own a template auth file.
  */
-export declare function registerAuthPublicPaths(paths: readonly string[]): void;
+export declare function registerAuthPublicPaths(paths: readonly string[], app?: object): void;
 export interface DesktopExchangeErrorPayload {
     message: string;
     code?: string;

package/dist/server/auth.js

@@ -960,7 +960,29 @@ export async function getSessionEmail(token) {
 // ---------------------------------------------------------------------------
 let customGetSession = null;
 let _authGuardConfig = null;
+// Pin the registry to globalThis so template plugins and framework routes that
+// load Core through different SSR bundle or pnpm peer graphs still share it.
+// Scope entries by H3 app so a route registered by one app cannot become public
+// in another app that happens to share the same Node realm.
+const AUTH_PUBLIC_PATHS_REGISTRY_KEY = Symbol.for("@agent-native/core/auth.publicPaths");
 const _registeredAuthPublicPaths = new Set();
+function getAuthPublicPathRegistry() {
+    const globals = globalThis;
+    return (globals[AUTH_PUBLIC_PATHS_REGISTRY_KEY] ??= {
+        pathsByApp: new WeakMap(),
+    });
+}
+function getRegisteredAuthPublicPaths(app) {
+    if (!app)
+        return _registeredAuthPublicPaths;
+    const registry = getAuthPublicPathRegistry();
+    let paths = registry.pathsByApp.get(app);
+    if (!paths) {
+        paths = new Set();
+        registry.pathsByApp.set(app, paths);
+    }
+    return paths;
+}
 const _genericGoogleOAuthRoutesEnabled = new WeakMap();
 /**
  * Allow framework routes with their own non-cookie authentication to reach
@@ -970,20 +992,23 @@ const _genericGoogleOAuthRoutesEnabled = new WeakMap();
  * routes can be mounted after the auth plugin and must also work in custom
  * workspace deployments that do not own a template auth file.
  */
-export function registerAuthPublicPaths(paths) {
+export function registerAuthPublicPaths(paths, app) {
+    const registeredPaths = getRegisteredAuthPublicPaths(app);
     for (const path of paths) {
         const normalized = typeof path === "string" ? path.trim() : "";
         if (!normalized.startsWith("/"))
             continue;
-        _registeredAuthPublicPaths.add(normalized);
-        if (_authGuardConfig &&
-            !_authGuardConfig.publicPaths.includes(normalized)) {
-            _authGuardConfig.publicPaths.push(normalized);
-        }
+        registeredPaths.add(normalized);
     }
 }
-function resolveAuthPublicPaths(paths) {
-    return [...new Set([...(paths ?? []), ..._registeredAuthPublicPaths])];
+function resolveAuthPublicPaths(paths, app) {
+    return [
+        ...new Set([
+            ...(paths ?? []),
+            ..._registeredAuthPublicPaths,
+            ...(app ? getRegisteredAuthPublicPaths(app) : []),
+        ]),
+    ];
 }
 function getRequestHost(event) {
     return (getHeader(event, "x-forwarded-host") ??
@@ -1564,12 +1589,14 @@ function isHtmlDocumentRequest(event, pathname) {
     const accept = getHeader(event, "accept")?.toLowerCase();
     return !accept || accept.includes("text/html") || accept.includes("*/*");
 }
-function createAuthGuardFn() {
+function createAuthGuardFn(app) {
     return async (event) => {
         const config = _authGuardConfig;
         if (!config)
             return;
-        const { publicPaths } = config;
+        // Resolve on every request because a framework route can be mounted by a
+        // different Core module instance after this auth guard is initialized.
+        const publicPaths = resolveAuthPublicPaths(config.publicPaths, app);
         const url = event.node?.req?.url ?? event.path ?? "/";
         const queryStart = url.indexOf("?");
         const rawPath = queryStart >= 0 ? url.slice(0, queryStart) : url;
@@ -2602,7 +2629,7 @@ function getCustomAuthRequiredHtml() {
 // mountBetterAuthRoutes — Better Auth powered auth with backward-compat routes
 // ---------------------------------------------------------------------------
 async function mountBetterAuthRoutes(app, options) {
-    const publicPaths = resolveAuthPublicPaths(options.publicPaths);
+    const publicPaths = resolveAuthPublicPaths(options.publicPaths, app);
     const workspaceAppAudience = resolveWorkspaceAppAudience(options);
     const workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess(options);
     // The A2A agent card is part of an open protocol — other agents must be
@@ -3612,7 +3639,7 @@ async function mountBetterAuthRoutes(app, options) {
         workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
         workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
     };
-    const guardFn = createAuthGuardFn();
+    const guardFn = createAuthGuardFn(app);
     _authGuardFn = guardFn;
     app.use(defineEventHandler(guardFn));
 }
@@ -3835,7 +3862,7 @@ export async function autoMountAuth(app, options = {}) {
     // Reset globals
     customGetSession = null;
     sessionMaxAge = options.maxAge ?? DEFAULT_MAX_AGE;
-    const publicPaths = resolveAuthPublicPaths(options.publicPaths);
+    const publicPaths = resolveAuthPublicPaths(options.publicPaths, app);
     const workspaceAppAudience = resolveWorkspaceAppAudience(options);
     const workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess(options);
     mountAuthCorsMiddleware(app);
@@ -3880,7 +3907,7 @@ export async function autoMountAuth(app, options = {}) {
             workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
             workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
         };
-        const guardFn = createAuthGuardFn();
+        const guardFn = createAuthGuardFn(app);
         _authGuardFn = guardFn;
         app.use(defineEventHandler(guardFn));
         if (process.env.DEBUG)
@@ -3907,7 +3934,7 @@ export async function autoMountAuth(app, options = {}) {
             workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
             workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
         };
-        const guardFn = createAuthGuardFn();
+        const guardFn = createAuthGuardFn(app);
         _authGuardFn = guardFn;
         app.use(defineEventHandler(guardFn));
         console.log("[agent-native] Auth guard registered despite init failure — app is locked.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.157.13",
+  "version": "0.157.14",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {