@agent-native/core 0.158.7 → 0.158.9

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/auth.js

@@ -1545,33 +1545,35 @@ function magicLinkStoredIdentifier(token) {
     return crypto.createHash("sha256").update(token).digest("base64url");
 }
 function redactMagicLinkUrl(value, baseURL) {
-    try {
-        const url = new URL(value, baseURL);
+    const redactUrl = (url, depth) => {
         for (const key of ["token", "flow_id", "verifier", "state"]) {
             if (url.searchParams.has(key))
                 url.searchParams.set(key, "[redacted]");
         }
+        if (depth >= 4)
+            return;
         for (const key of [
             "callbackURL",
             "newUserCallbackURL",
             "errorCallbackURL",
+            "return",
         ]) {
             const callback = url.searchParams.get(key);
             if (!callback)
                 continue;
             try {
                 const callbackURL = new URL(callback, url.origin);
-                for (const nestedKey of ["flow_id", "verifier", "state"]) {
-                    if (callbackURL.searchParams.has(nestedKey)) {
-                        callbackURL.searchParams.set(nestedKey, "[redacted]");
-                    }
-                }
+                redactUrl(callbackURL, depth + 1);
                 url.searchParams.set(key, callbackURL.toString());
             }
             catch {
                 url.searchParams.set(key, "[invalid]");
             }
         }
+    };
+    try {
+        const url = new URL(value, baseURL);
+        redactUrl(url, 0);
         return `${url.pathname}${url.search}`;
     }
     catch {

package/dist/server/better-auth-migrations.js

@@ -27,6 +27,27 @@ async function assertBetterAuthUserIdentityColumns() {
         throw new Error(`Cannot repair the Better Auth "user" table because required identity column(s) are missing: ${missing.join(", ")}. Restore the existing user schema before deploying this migration.`);
     }
 }
+/**
+ * Better Auth encrypts persisted JWT private keys with the current auth
+ * secret. If that secret is rotated, the old row remains the newest key and
+ * every token-producing request fails before it can mint a replacement. Mark
+ * active rows expired during the release so Better Auth rotates the signing
+ * key without touching users or sessions. The JWKS endpoint keeps expired
+ * keys during its grace period, so already-issued short-lived tokens remain
+ * verifiable while the new key propagates.
+ */
+async function expireJwksKeysAfterAuthSecretRotation() {
+    const { getDbExec, isPostgres } = await import("../db/client.js");
+    const now = isPostgres() ? new Date().toISOString() : Date.now();
+    const table = isPostgres() ? '"jwks"' : "jwks";
+    const result = await getDbExec().execute({
+        sql: `UPDATE ${table} SET expires_at = ? WHERE expires_at IS NULL OR expires_at > ?`,
+        args: [now, now],
+    });
+    if (result.rowsAffected > 0) {
+        console.info(`[auth] Expired ${result.rowsAffected} Better Auth JWKS key(s) after auth-secret rotation; public keys remain in the verification grace period.`);
+    }
+}
 /**
  * Better Auth's framework-owned schema. This is deliberately a release
  * migration, not a fallback inside `getBetterAuth()`: request functions must
@@ -247,6 +268,12 @@ export const BETTER_AUTH_MIGRATIONS = [
       `,
         },
     },
+    {
+        version: 4,
+        name: "better-auth-jwks-key-rotation-recovery",
+        sql: {},
+        run: expireJwksKeysAfterAuthSecretRotation,
+    },
 ];
 export async function runBetterAuthMigrations(nitroApp) {
     await runMigrations(BETTER_AUTH_MIGRATIONS, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.158.7",
+  "version": "0.158.9",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -425,8 +425,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
-    "@agent-native/recap-cli": "0.5.4",
-    "@agent-native/toolkit": "^0.16.3"
+    "@agent-native/toolkit": "^0.16.3",
+    "@agent-native/recap-cli": "0.5.4"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",