@agent-native/core 0.159.1 → 0.159.2

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/embed-route.js

@@ -125,6 +125,8 @@ function logEmbedConsumeResult(event, diagnostic, responseStatus) {
         ticketRowFound: diagnostic.ticketRowFound,
         consumed: diagnostic.consumed,
         expired: diagnostic.expired,
+        expectedOwnerKey: diagnostic.expectedOwnerKey,
+        ticketOwnerKey: diagnostic.ticketOwnerKey,
         expectedOrgKey: diagnostic.expectedOrgKey,
         ticketOrgKey: diagnostic.ticketOrgKey,
         responseStatus,
@@ -253,7 +255,10 @@ export function createEmbedStartRouteHandler(options = {}) {
             .catch(() => null);
         let consumeDiagnostic = null;
         const consumed = await consumeEmbedSessionTicket(ticket, {
-            expectedOrgId: existingSession?.orgId ?? null,
+            // Org ids are app-local in the workspace: the Dispatch parent and a
+            // target app can represent the same signed-in person with different
+            // ids. Bind an existing target session to the ticket owner instead.
+            expectedOwnerEmail: existingSession?.email ?? null,
             onResult: (diagnostic) => {
                 consumeDiagnostic = diagnostic;
             },

package/dist/server/embed-session.d.ts

@@ -12,17 +12,20 @@ export interface EmbedSessionTicket {
     ticketHash: string;
     expiresAt: number;
 }
-export type EmbedSessionTicketConsumeOutcome = "missing-ticket" | "not-found" | "already-consumed" | "expired" | "org-mismatch" | "consumption-race" | "invalid-row" | "consumed";
+export type EmbedSessionTicketConsumeOutcome = "missing-ticket" | "not-found" | "already-consumed" | "expired" | "identity-mismatch" | "org-mismatch" | "consumption-race" | "invalid-row" | "consumed";
 export interface EmbedSessionTicketConsumeDiagnostic {
     outcome: EmbedSessionTicketConsumeOutcome;
     ticketKey: string | null;
     ticketRowFound: boolean;
     consumed: boolean;
     expired: boolean;
+    expectedOwnerKey: string | null;
+    ticketOwnerKey: string | null;
     expectedOrgKey: string | null;
     ticketOrgKey: string | null;
 }
 export interface ConsumeEmbedSessionTicketOptions {
+    expectedOwnerEmail?: string | null;
     expectedOrgId?: string | null;
     onResult?: (result: EmbedSessionTicketConsumeDiagnostic) => void;
 }

package/dist/server/embed-session.js

@@ -139,6 +139,10 @@ function redactedIdentifier(value) {
         return null;
     return crypto.createHash("sha256").update(value).digest("hex").slice(0, 12);
 }
+function normalizedEmail(value) {
+    const normalized = value?.trim().toLowerCase();
+    return normalized || null;
+}
 function numberOrNull(value) {
     if (value == null)
         return null;
@@ -464,6 +468,8 @@ export async function createEmbedSessionTicket(input) {
     return { ticket, ticketHash, expiresAt };
 }
 export async function consumeEmbedSessionTicket(ticket, options = {}) {
+    const expectedOwnerEmail = normalizedEmail(options.expectedOwnerEmail);
+    const expectedOwnerKey = redactedIdentifier(expectedOwnerEmail);
     const expectedOrgKey = redactedIdentifier(options.expectedOrgId);
     if (!ticket) {
         options.onResult?.({
@@ -472,6 +478,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: false,
             consumed: false,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey: null,
             expectedOrgKey,
             ticketOrgKey: null,
         });
@@ -493,6 +501,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: false,
             consumed: false,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey: null,
             expectedOrgKey,
             ticketOrgKey: null,
         });
@@ -501,6 +511,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
     const row = rows[0];
     const expiresAt = numberOrNull(row.expires_at ?? row.expiresAt);
     const consumedAt = numberOrNull(row.consumed_at ?? row.consumedAt);
+    const ownerEmail = stringOrUndefined(row.owner_email ?? row.ownerEmail);
+    const ticketOwnerKey = redactedIdentifier(normalizedEmail(ownerEmail));
     const orgId = stringOrUndefined(row.org_id ?? row.orgId);
     const ticketOrgKey = redactedIdentifier(orgId);
     if (consumedAt != null) {
@@ -510,6 +522,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: true,
             consumed: true,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey,
             expectedOrgKey,
             ticketOrgKey,
         });
@@ -522,6 +536,24 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: true,
             consumed: false,
             expired: true,
+            expectedOwnerKey,
+            ticketOwnerKey,
+            expectedOrgKey,
+            ticketOrgKey,
+        });
+        return null;
+    }
+    if (expectedOwnerEmail &&
+        ownerEmail &&
+        normalizedEmail(ownerEmail) !== expectedOwnerEmail) {
+        options.onResult?.({
+            outcome: "identity-mismatch",
+            ticketKey,
+            ticketRowFound: true,
+            consumed: false,
+            expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey,
             expectedOrgKey,
             ticketOrgKey,
         });
@@ -534,6 +566,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: true,
             consumed: false,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey,
             expectedOrgKey,
             ticketOrgKey,
         });
@@ -551,13 +585,14 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: true,
             consumed: false,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey,
             expectedOrgKey,
             ticketOrgKey,
         });
         return null;
     }
     const targetPath = normalizeEmbedTargetPath(stringOrUndefined(row.target_path ?? row.targetPath));
-    const ownerEmail = stringOrUndefined(row.owner_email ?? row.ownerEmail);
     if (!targetPath || !ownerEmail || expiresAt == null) {
         options.onResult?.({
             outcome: "invalid-row",
@@ -565,6 +600,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: true,
             consumed: true,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey,
             expectedOrgKey,
             ticketOrgKey,
         });
@@ -576,6 +613,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
         ticketRowFound: true,
         consumed: true,
         expired: false,
+        expectedOwnerKey,
+        ticketOwnerKey,
         expectedOrgKey,
         ticketOrgKey,
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.159.1",
+  "version": "0.159.2",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {