@agent-native/core 0.157.14 → 0.157.15

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/observability/routes.d.ts

@@ -42,22 +42,22 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     avgEvalScore: number;
 } | {
     error?: undefined;
-    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+    ok?: undefined;
 } | {
     error?: undefined;
-    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
+    ok?: undefined;
 } | {
     error?: undefined;
     summary?: undefined;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/agent-chat/plugin-options.d.ts

@@ -117,6 +117,11 @@ export interface AgentChatPluginOptions {
      * See {@link import("../action-routes.js").ActionRouteAuthAdapter}.
      */
     actionRouteAuth?: import("../action-routes.js").ActionRouteAuthAdapter;
+    /**
+     * Framework action paths that use `actionRouteAuth` instead of the browser
+     * session guard. The route handler still owns credential verification.
+     */
+    actionRoutePublicPaths?: string[];
     /**
      * Optional callback to append template-specific context to the system
      * prompt on each request. Runs after AGENTS.md / skills / memory are

package/dist/server/agent-chat-plugin.js

@@ -41,7 +41,7 @@ import { handleSharedThreadRequest, } from "./agent-chat/shared-thread.js";
 import { discoverAgents } from "./agent-discovery.js";
 import { resolveAgentRunOwnerContext, runWithAgentRunContext, seedBackgroundAgentRunOwnerContext, } from "./agent-run-context.js";
 import { AGENT_TEAM_PROCESS_RUN_PATH, getCurrentDelegationDepth, processAgentTeamRun, reconcileAgentTeamRunsForOwner, } from "./agent-teams.js";
-import { getSession } from "./auth.js";
+import { getSession, registerAuthPublicPaths } from "./auth.js";
 import { captureError } from "./capture-error.js";
 import { getH3App, markDefaultPluginProvided, trackPluginInit, } from "./framework-request-handler.js";
 import { getOrigin } from "./google-oauth.js";
@@ -2035,6 +2035,9 @@ export function createAgentChatPlugin(options) {
             }
             if (Object.keys(httpActions).length > 0) {
                 const { mountActionRoutes } = await import("./action-routes.js");
+                if (options?.actionRoutePublicPaths?.length) {
+                    registerAuthPublicPaths(options.actionRoutePublicPaths, getH3App(nitroApp));
+                }
                 mountActionRoutes(nitroApp, httpActions, {
                     getOwnerFromEvent,
                     getUserNameFromEvent,

package/dist/server/auth.d.ts

@@ -225,9 +225,10 @@ export declare function getSessionEmail(token: string): Promise<string | null>;
  * Allow framework routes with their own non-cookie authentication to reach
  * the handler. The handler remains responsible for verifying the credential.
  *
- * This is registered separately from template auth options because framework
- * routes can be mounted after the auth plugin and must also work in custom
- * workspace deployments that do not own a template auth file.
+ * Registered paths are exact matches. This is registered separately from
+ * template auth options because framework routes can be mounted after the auth
+ * plugin and must also work in custom workspace deployments that do not own a
+ * template auth file.
  */
 export declare function registerAuthPublicPaths(paths: readonly string[], app?: object): void;
 export interface DesktopExchangeErrorPayload {

package/dist/server/auth.js

@@ -965,21 +965,21 @@ let _authGuardConfig = null;
 // Scope entries by H3 app so a route registered by one app cannot become public
 // in another app that happens to share the same Node realm.
 const AUTH_PUBLIC_PATHS_REGISTRY_KEY = Symbol.for("@agent-native/core/auth.publicPaths");
-const _registeredAuthPublicPaths = new Set();
+const _registeredAuthExactPublicPaths = new Set();
 function getAuthPublicPathRegistry() {
     const globals = globalThis;
     return (globals[AUTH_PUBLIC_PATHS_REGISTRY_KEY] ??= {
-        pathsByApp: new WeakMap(),
+        exactPathsByApp: new WeakMap(),
     });
 }
-function getRegisteredAuthPublicPaths(app) {
+function getRegisteredAuthExactPaths(app) {
     if (!app)
-        return _registeredAuthPublicPaths;
+        return _registeredAuthExactPublicPaths;
     const registry = getAuthPublicPathRegistry();
-    let paths = registry.pathsByApp.get(app);
+    let paths = registry.exactPathsByApp.get(app);
     if (!paths) {
         paths = new Set();
-        registry.pathsByApp.set(app, paths);
+        registry.exactPathsByApp.set(app, paths);
     }
     return paths;
 }
@@ -988,12 +988,13 @@ const _genericGoogleOAuthRoutesEnabled = new WeakMap();
  * Allow framework routes with their own non-cookie authentication to reach
  * the handler. The handler remains responsible for verifying the credential.
  *
- * This is registered separately from template auth options because framework
- * routes can be mounted after the auth plugin and must also work in custom
- * workspace deployments that do not own a template auth file.
+ * Registered paths are exact matches. This is registered separately from
+ * template auth options because framework routes can be mounted after the auth
+ * plugin and must also work in custom workspace deployments that do not own a
+ * template auth file.
  */
 export function registerAuthPublicPaths(paths, app) {
-    const registeredPaths = getRegisteredAuthPublicPaths(app);
+    const registeredPaths = getRegisteredAuthExactPaths(app);
     for (const path of paths) {
         const normalized = typeof path === "string" ? path.trim() : "";
         if (!normalized.startsWith("/"))
@@ -1001,12 +1002,14 @@ export function registerAuthPublicPaths(paths, app) {
         registeredPaths.add(normalized);
     }
 }
-function resolveAuthPublicPaths(paths, app) {
+function resolveAuthPublicPaths(paths) {
+    return [...new Set(paths ?? [])];
+}
+function resolveAuthExactPublicPaths(app) {
     return [
         ...new Set([
-            ...(paths ?? []),
-            ..._registeredAuthPublicPaths,
-            ...(app ? getRegisteredAuthPublicPaths(app) : []),
+            ..._registeredAuthExactPublicPaths,
+            ...(app ? getRegisteredAuthExactPaths(app) : []),
         ]),
     ];
 }
@@ -1596,7 +1599,8 @@ function createAuthGuardFn(app) {
             return;
         // Resolve on every request because a framework route can be mounted by a
         // different Core module instance after this auth guard is initialized.
-        const publicPaths = resolveAuthPublicPaths(config.publicPaths, app);
+        const publicPaths = resolveAuthPublicPaths(config.publicPaths);
+        const exactPublicPaths = resolveAuthExactPublicPaths(app);
         const url = event.node?.req?.url ?? event.path ?? "/";
         const queryStart = url.indexOf("?");
         const rawPath = queryStart >= 0 ? url.slice(0, queryStart) : url;
@@ -1875,7 +1879,7 @@ function createAuthGuardFn(app) {
         if (getMethod(event) === "GET" && p.startsWith("/_agent-native/avatar/")) {
             return;
         }
-        if (isPublicPath(normalizedUrl, publicPaths))
+        if (isPublicPath(normalizedUrl, publicPaths, exactPublicPaths))
             return;
         if (shouldBypassAuthForBuilderConnect(event, p))
             return;
@@ -2494,15 +2498,19 @@ function isHttpsRequest(event) {
 // ---------------------------------------------------------------------------
 // Public path matching
 // ---------------------------------------------------------------------------
-function isPublicPath(url, publicPaths) {
+function isPublicPath(url, publicPaths, exactPublicPaths = []) {
     const p = url.split("?")[0];
+    if (exactPublicPaths.some((candidate) => normalizePath(candidate) === p)) {
+        return true;
+    }
     return matchesPathList(p, publicPaths);
 }
+function normalizePath(path) {
+    return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
 function matchesPathList(path, paths) {
     return paths.some((candidate) => {
-        const normalized = candidate.length > 1 && candidate.endsWith("/")
-            ? candidate.slice(0, -1)
-            : candidate;
+        const normalized = normalizePath(candidate);
         return path === normalized || path.startsWith(normalized + "/");
     });
 }
@@ -2629,7 +2637,7 @@ function getCustomAuthRequiredHtml() {
 // mountBetterAuthRoutes — Better Auth powered auth with backward-compat routes
 // ---------------------------------------------------------------------------
 async function mountBetterAuthRoutes(app, options) {
-    const publicPaths = resolveAuthPublicPaths(options.publicPaths, app);
+    const publicPaths = resolveAuthPublicPaths(options.publicPaths);
     const workspaceAppAudience = resolveWorkspaceAppAudience(options);
     const workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess(options);
     // The A2A agent card is part of an open protocol — other agents must be
@@ -3862,7 +3870,7 @@ export async function autoMountAuth(app, options = {}) {
     // Reset globals
     customGetSession = null;
     sessionMaxAge = options.maxAge ?? DEFAULT_MAX_AGE;
-    const publicPaths = resolveAuthPublicPaths(options.publicPaths, app);
+    const publicPaths = resolveAuthPublicPaths(options.publicPaths);
     const workspaceAppAudience = resolveWorkspaceAppAudience(options);
     const workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess(options);
     mountAuthCorsMiddleware(app);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.157.14",
+  "version": "0.157.15",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {