@agent-native/core 0.158.4 → 0.158.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/file-upload/actions/upload-image.d.ts +1 -1
  2. package/dist/observability/routes.d.ts +3 -3
  3. package/dist/secrets/routes.d.ts +9 -9
  4. package/dist/server/auth.js +63 -30
  5. package/package.json +1 -1
package/dist/file-upload/actions/upload-image.d.ts CHANGED
@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
17
17
  id?: undefined;
18
18
  provider?: undefined;
19
19
  } | {
20
+ error?: undefined;
20
21
  configured?: undefined;
21
22
  connectPath?: undefined;
22
23
  url: string;
23
24
  id: string;
24
25
  provider: string;
25
- error?: undefined;
26
26
  }>;
27
27
  export default _default;
package/dist/observability/routes.d.ts CHANGED
@@ -42,22 +42,22 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
42
42
  avgEvalScore: number;
43
43
  } | {
44
44
  error?: undefined;
45
+ ok?: undefined;
45
46
  summary: import("./types.js").TraceSummary;
46
47
  spans: import("./types.js").TraceSpan[];
47
48
  id?: undefined;
48
- ok?: undefined;
49
49
  } | {
50
50
  error?: undefined;
51
+ ok?: undefined;
51
52
  summary?: undefined;
52
53
  spans?: undefined;
53
54
  id: string;
54
- ok?: undefined;
55
55
  } | {
56
+ ok?: undefined;
56
57
  summary?: undefined;
57
58
  spans?: undefined;
58
59
  id?: undefined;
59
60
  error: any;
60
- ok?: undefined;
61
61
  } | {
62
62
  error?: undefined;
63
63
  summary?: undefined;
package/dist/secrets/routes.d.ts CHANGED
@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
34
34
  /** POST /_agent-native/secrets/:key — write a secret. */
35
35
  export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
36
36
  error: string;
37
- status?: undefined;
38
37
  ok?: undefined;
38
+ status?: undefined;
39
39
  } | {
40
+ error?: undefined;
40
41
  ok: boolean;
41
42
  status: string;
42
- error?: undefined;
43
43
  } | {
44
+ ok?: undefined;
44
45
  error: string;
45
46
  removed?: undefined;
46
- ok?: undefined;
47
47
  } | {
48
+ error?: undefined;
48
49
  ok: boolean;
49
50
  removed: boolean;
50
- error?: undefined;
51
51
  }>>;
52
52
  /**
53
53
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
54
54
  * or the current stored value without changing anything.
55
55
  */
56
56
  export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
57
+ ok?: undefined;
57
58
  error: string;
58
59
  note?: undefined;
59
- ok?: undefined;
60
60
  } | {
61
+ error?: undefined;
61
62
  ok: boolean;
62
63
  note?: undefined;
63
- error?: undefined;
64
64
  } | {
65
+ error?: undefined;
65
66
  ok: boolean;
66
67
  note: string;
67
- error?: undefined;
68
68
  } | {
69
69
  note?: undefined;
70
70
  ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
95
95
  export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
96
96
  error: string;
97
97
  } | {
98
+ error?: undefined;
98
99
  ok: boolean;
99
100
  key: string;
100
- error?: undefined;
101
101
  } | {
102
+ error?: undefined;
102
103
  ok: boolean;
103
104
  removed: boolean;
104
- error?: undefined;
105
105
  }>>;
package/dist/server/auth.js CHANGED
@@ -1538,9 +1538,44 @@ function escapeHtmlAttr(value) {
1538
1538
  const DESKTOP_MAGIC_LINK_CALLBACK_PATH = "/_agent-native/auth/magic-link/desktop-callback";
1539
1539
  const DESKTOP_MAGIC_LINK_LANDING_PATH = "/_agent-native/auth/magic-link/desktop-landing";
1540
1540
  const BETTER_AUTH_MAGIC_LINK_VERIFY_PATH = "/_agent-native/auth/ba/magic-link/verify";
1541
- function desktopMagicLinkLandingPage(verificationUrl) {
1542
- const safeVerificationUrl = escapeHtmlAttr(verificationUrl);
1543
- const html = `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Continue sign-in</title></head><body><main><h1>Continue signing in</h1><p>Click continue to finish signing in to the Agent Native desktop app.</p><form method="get" action="${safeVerificationUrl}"><button type="submit">Continue</button></form></main></body></html>`;
1541
+ function desktopMagicLinkVerificationUrl(event, values) {
1542
+ const value = (key) => typeof values[key] === "string" ? values[key] : "";
1543
+ const token = value("token").trim();
1544
+ const callbackURL = value("callbackURL");
1545
+ if (!token || !callbackURL)
1546
+ return undefined;
1547
+ try {
1548
+ const callback = new URL(callbackURL, getOrigin(event));
1549
+ if (callback.origin !== new URL(getOrigin(event)).origin ||
1550
+ !callback.pathname.endsWith(DESKTOP_MAGIC_LINK_CALLBACK_PATH) ||
1551
+ !normalizeDesktopFlowId(callback.searchParams.get("flow_id")) ||
1552
+ !normalizeDesktopFlowVerifier(callback.searchParams.get("verifier"))) {
1553
+ return undefined;
1554
+ }
1555
+ const verificationURL = new URL(getAppUrl(event, BETTER_AUTH_MAGIC_LINK_VERIFY_PATH));
1556
+ verificationURL.searchParams.set("token", token);
1557
+ for (const key of [
1558
+ "callbackURL",
1559
+ "newUserCallbackURL",
1560
+ "errorCallbackURL",
1561
+ ]) {
1562
+ const queryValue = value(key);
1563
+ if (queryValue)
1564
+ verificationURL.searchParams.set(key, queryValue);
1565
+ }
1566
+ return verificationURL;
1567
+ // coercion-ok: malformed user-supplied callback data is rejected as absent.
1568
+ }
1569
+ catch {
1570
+ return undefined;
1571
+ }
1572
+ }
1573
+ function desktopMagicLinkLandingPage(actionUrl, fields) {
1574
+ const safeActionUrl = escapeHtmlAttr(actionUrl);
1575
+ const hiddenInputs = Object.entries(fields)
1576
+ .map(([name, value]) => `<input type="hidden" name="${escapeHtmlAttr(name)}" value="${escapeHtmlAttr(value)}">`)
1577
+ .join("");
1578
+ const html = `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Continue sign-in</title></head><body><main><h1>Continue signing in</h1><p>Click continue to finish signing in to the Agent Native desktop app.</p><form method="post" action="${safeActionUrl}" autocomplete="off">${hiddenInputs}<button type="submit">Continue</button></form></main></body></html>`;
1544
1579
  return new Response(html, {
1545
1580
  status: 200,
1546
1581
  headers: {
@@ -3053,48 +3088,46 @@ async function mountBetterAuthRoutes(app, options) {
3053
3088
  // commonly prefetch GET links, while Better Auth consumes a magic-link token
3054
3089
  // on the first verification GET. The explicit form action below is the only
3055
3090
  // request that reaches Better Auth's consuming verification endpoint.
3056
- app.use(DESKTOP_MAGIC_LINK_LANDING_PATH, defineEventHandler((event) => {
3091
+ app.use(DESKTOP_MAGIC_LINK_LANDING_PATH, defineEventHandler(async (event) => {
3092
+ if (getMethod(event) === "POST") {
3093
+ const body = await readBody(event);
3094
+ const verificationURL = desktopMagicLinkVerificationUrl(event, body);
3095
+ if (!verificationURL) {
3096
+ setResponseStatus(event, 400);
3097
+ return { error: "Invalid desktop magic-link" };
3098
+ }
3099
+ // Verify inside the same request that received the explicit user
3100
+ // confirmation. A browser redirect would create a second network
3101
+ // hop where link scanners, redirect handling, or a fresh serverless
3102
+ // request could consume or lose the one-time token before the
3103
+ // desktop callback sees the Better Auth session cookie.
3104
+ return auth.handler(new Request(verificationURL, {
3105
+ method: "GET",
3106
+ headers: event.headers,
3107
+ }));
3108
+ }
3057
3109
  if (!isReadMethod(event)) {
3058
3110
  setResponseStatus(event, 405);
3059
3111
  return { error: "Method not allowed" };
3060
3112
  }
3061
3113
  const query = getQuery(event);
3062
- const token = typeof query.token === "string" ? query.token.trim() : "";
3063
- const callbackURL = typeof query.callbackURL === "string" ? query.callbackURL : "";
3064
- if (!token || !callbackURL) {
3065
- setResponseStatus(event, 400);
3066
- return { error: "Invalid desktop magic-link" };
3067
- }
3068
- let callback;
3069
- try {
3070
- callback = new URL(callbackURL, getOrigin(event));
3071
- }
3072
- catch {
3114
+ const verificationURL = desktopMagicLinkVerificationUrl(event, query);
3115
+ if (!verificationURL) {
3073
3116
  setResponseStatus(event, 400);
3074
3117
  return { error: "Invalid desktop magic-link" };
3075
3118
  }
3076
- if (callback.origin !== new URL(getOrigin(event)).origin ||
3077
- !callback.pathname.endsWith(DESKTOP_MAGIC_LINK_CALLBACK_PATH) ||
3078
- !normalizeDesktopFlowId(callback.searchParams.get("flow_id")) ||
3079
- !normalizeDesktopFlowVerifier(callback.searchParams.get("verifier"))) {
3080
- setResponseStatus(event, 400);
3081
- return { error: "Invalid desktop magic-link" };
3082
- }
3083
- const verificationURL = new URL(getOrigin(event));
3084
- verificationURL.pathname =
3085
- getAppBasePath() + BETTER_AUTH_MAGIC_LINK_VERIFY_PATH;
3086
- verificationURL.searchParams.set("token", token);
3119
+ const fields = {};
3087
3120
  for (const key of [
3121
+ "token",
3088
3122
  "callbackURL",
3089
3123
  "newUserCallbackURL",
3090
3124
  "errorCallbackURL",
3091
3125
  ]) {
3092
- const value = query[key];
3093
- if (typeof value === "string" && value) {
3094
- verificationURL.searchParams.set(key, value);
3126
+ if (typeof query[key] === "string" && query[key]) {
3127
+ fields[key] = query[key];
3095
3128
  }
3096
3129
  }
3097
- return desktopMagicLinkLandingPage(verificationURL.toString());
3130
+ return desktopMagicLinkLandingPage(getAppUrl(event, DESKTOP_MAGIC_LINK_LANDING_PATH), fields);
3098
3131
  }));
3099
3132
  app.use("/_agent-native/auth/magic-link/desktop-callback", defineEventHandler(async (event) => {
3100
3133
  if (!isReadMethod(event)) {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@agent-native/core",
3
- "version": "0.158.4",
3
+ "version": "0.158.6",
4
4
  "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
5
5
  "homepage": "https://github.com/BuilderIO/agent-native#readme",
6
6
  "bugs": {