@agent-native/core 0.159.1 → 0.159.3

package/corpus/templates/content/shared/builder-mdx.ts

@@ -315,12 +315,50 @@ function isBuilderTrackingPixelBlock(value: unknown) {
   }
 }
 
-export function builderBlocksHash(blocks: unknown[]) {
-  return stableHash(
-    blocks.filter((block) => !isBuilderTrackingPixelBlock(block)),
+function stripBuilderTrackingPixels(value: unknown): unknown {
+  if (isBuilderTrackingPixelBlock(value)) return undefined;
+  if (Array.isArray(value)) {
+    return value
+      .map((item) => stripBuilderTrackingPixels(item))
+      .filter((item) => item !== undefined);
+  }
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(
+    Object.entries(value).flatMap(([key, child]) => {
+      const stripped = stripBuilderTrackingPixels(child);
+      return stripped === undefined ? [] : [[key, stripped]];
+    }),
   );
 }
 
+function canonicalBuilderBodyHashValue(value: unknown): unknown {
+  if (isBuilderTrackingPixelBlock(value)) return undefined;
+  if (Array.isArray(value)) {
+    return value
+      .map((item) => canonicalBuilderBodyHashValue(item))
+      .filter((item) => item !== undefined);
+  }
+  if (!isRecord(value)) return value;
+
+  const canonical: Record<string, unknown> = {};
+  const isReference = value["@type"] === "@builder.io/core:Reference";
+  const isBuilderElement = value["@type"] === "@builder.io/sdk:Element";
+  const isSymbolContent =
+    isRecord(value.data) && Array.isArray(value.data.blocks);
+  for (const [key, child] of Object.entries(value)) {
+    if (isReference && key === "value") continue;
+    if (isBuilderElement && key === "id") continue;
+    if (isSymbolContent && key === "rev") continue;
+    const next = canonicalBuilderBodyHashValue(child);
+    if (next !== undefined) canonical[key] = next;
+  }
+  return canonical;
+}
+
+export function builderBlocksHash(blocks: unknown[]) {
+  return stableHash(canonicalBuilderBodyHashValue(blocks));
+}
+
 export function builderSourceHash(entry: BuilderContentEntry) {
   const data = entry.data ?? {};
   return stableHash({
@@ -1686,7 +1724,9 @@ async function emitBuilderEntryToMdxFile({
   }
   emitted.add(key);
 
-  const blocks = builderEntryBlocks(entry);
+  const blocks = stripBuilderTrackingPixels(
+    builderEntryBlocks(entry),
+  ) as unknown[];
   const rawRoot = builderRawRootForEntry(entry.model, entry.id);
   const ctx: BlocksToMdxContext = {
     rawRoot,

package/corpus/templates/slides/actions/get-layout-overflows.ts

@@ -3,7 +3,58 @@ import { resolveAccess } from "@agent-native/core/sharing";
 import { z } from "zod";
 
 import { hashSlideContent, type DeckFitState } from "../shared/slide-fit.js";
-import { readAppStateForCurrentTab } from "./_tab-state.js";
+import {
+  readAppStateForCurrentTab,
+  writeAppStateForCurrentTab,
+} from "./_tab-state.js";
+
+// The layout-fit skill tells the agent to make one bounded repair pass and
+// verify, never to loop. Nothing stopped it from ignoring that and thrashing
+// between get-layout-overflows and update-slide on the same deck until the
+// framework's generic identical-tool-call guard killed the whole turn many
+// calls later. Surface a directive after a few unresolved checks so the
+// agent stops and reports instead of grinding toward that guard.
+const REPEATED_CHECK_WARNING_THRESHOLD = 3;
+const REPEATED_CHECK_WINDOW_MS = 30 * 60_000;
+
+interface LayoutOverflowCheckHistory {
+  deckId: string;
+  count: number;
+  lastCheckAt: number;
+}
+
+// Keyed per deck (not one shared record) so checking deck A, then B, then A
+// again does not reset A's count on every deck switch within the same tab.
+function historyKeyForDeck(deckId: string): string {
+  return `layout-overflow-check-history:${deckId}`;
+}
+
+async function noteLayoutOverflowCheck(
+  deckId: string,
+  resolved: boolean,
+): Promise<number> {
+  const key = historyKeyForDeck(deckId);
+  const now = Date.now();
+  if (resolved) {
+    await writeAppStateForCurrentTab(key, {
+      deckId,
+      count: 0,
+      lastCheckAt: now,
+    });
+    return 0;
+  }
+  const prior = (await readAppStateForCurrentTab(key, {
+    fallbackToGlobal: false,
+  })) as LayoutOverflowCheckHistory | null;
+  const carriesOver =
+    prior?.deckId === deckId &&
+    typeof prior.count === "number" &&
+    typeof prior.lastCheckAt === "number" &&
+    now - prior.lastCheckAt <= REPEATED_CHECK_WINDOW_MS;
+  const count = (carriesOver ? prior!.count : 0) + 1;
+  await writeAppStateForCurrentTab(key, { deckId, count, lastCheckAt: now });
+  return count;
+}
 
 type CurrentSlideFitMeasurement = DeckFitState["slides"][string] & {
   slideId: string;
@@ -140,6 +191,10 @@ export default defineAction({
       }
     });
 
+    const canClaimDeckFits =
+      unknownSlideIds.length === 0 && overflows.length === 0;
+    const checkCount = await noteLayoutOverflowCheck(deckId, canClaimDeckFits);
+
     return {
       deckId,
       status: unknownSlideIds.length > 0 ? "unknown" : "measured",
@@ -147,7 +202,15 @@ export default defineAction({
       slideCount: slides.length,
       unknownSlideIds,
       overflows,
-      canClaimDeckFits: unknownSlideIds.length === 0 && overflows.length === 0,
+      canClaimDeckFits,
+      ...(checkCount >= REPEATED_CHECK_WARNING_THRESHOLD
+        ? {
+            guidance:
+              overflows.length > 0
+                ? `This deck has been checked ${checkCount} times with overflow still present. Stop re-measuring and patching one slide at a time. Report the exact remaining overflow (slide, pixels, dimension) to the user instead of calling get-layout-overflows again this turn.`
+                : `This deck has been checked ${checkCount} times and slide measurements are still unavailable (unknownSlideIds). Stop re-checking and tell the user which slides could not be measured instead of calling get-layout-overflows again this turn.`,
+          }
+        : {}),
     };
   },
 });

package/dist/deploy/build.d.ts

@@ -232,6 +232,8 @@ export declare function emitSingleTemplateNetlifyIntegrationRecoveryFunction(pro
  * then point every emitted server chunk at that one portable runtime module.
  */
 export declare function bundleYjsRuntimeForServerlessOutput(serverDir: string, projectCwd: string): string[];
+/** Presets whose Node-style output needs the emitted Yjs runtime bundle. */
+export declare function shouldBundleYjsRuntimeForPreset(targetPreset: string): boolean;
 export declare function assertSingleTemplateNetlifyBuildOutput(projectCwd: string): void;
 /**
  * Strip the harmful single-template catch-all rewrite that points at
@@ -319,8 +321,8 @@ export declare function createCloudflareModuleStubPlugin(): {
     load(id: string): string;
 };
 /**
- * Dependencies Nitro itself must bundle outside the controlled serverless
- * output pass. Netlify, Vercel, and Lambda keep Yjs external through Nitro;
+ * Dependencies Nitro itself must bundle outside the controlled Yjs output pass.
+ * Node and controlled serverless presets keep Yjs external through Nitro;
  * `bundleYjsRuntimeForServerlessOutput` then creates their one portable copy.
  */
 export declare const NITRO_SERVER_RUNTIME_BUNDLED_DEPS: readonly ["yjs"];
@@ -331,8 +333,8 @@ export declare const NITRO_SERVER_RUNTIME_BUNDLED_DEPS: readonly ["yjs"];
  */
 export declare function resolveNitroBundledYjsEntry(): string;
 /**
- * Edge runtimes have no node_modules, while Node/serverless outputs only need
- * the small set above bundled to keep their package manifests traceable.
+ * Edge runtimes have no node_modules, while Node/serverless outputs receive the
+ * small set above through the controlled post-build pass.
  */
 export declare function nitroNoExternalsForPreset(targetPreset: string): true | readonly string[];
 export declare function resolveNitroBuildReplacements(env?: NodeJS.ProcessEnv): Record<string, string>;

package/dist/deploy/build.js

@@ -2913,7 +2913,7 @@ export function bundleYjsRuntimeForServerlessOutput(serverDir, projectCwd) {
         bareImports.push(filePath);
     });
     if (unsupportedSubpathImports.length > 0) {
-        throw new Error(`[deploy] Serverless output left unsupported yjs subpath imports in ${unsupportedSubpathImports.join(", ")}`);
+        throw new Error(`[deploy] Node/server output left unsupported yjs subpath imports in ${unsupportedSubpathImports.join(", ")}`);
     }
     if (bareImports.length === 0)
         return [];
@@ -2954,6 +2954,14 @@ export function bundleYjsRuntimeForServerlessOutput(serverDir, projectCwd) {
     });
     return bareImports;
 }
+/** Presets whose Node-style output needs the emitted Yjs runtime bundle. */
+export function shouldBundleYjsRuntimeForPreset(targetPreset) {
+    return (targetPreset === "netlify" ||
+        targetPreset === "vercel" ||
+        targetPreset === "aws-lambda" ||
+        targetPreset === "node" ||
+        targetPreset === "node-server");
+}
 // Netlify's hard limit is 250MB unzipped per function; keep 10MB of headroom
 // for packaging variance so a passing guard does not sit on the platform edge.
 const NETLIFY_FUNCTION_SIZE_BUDGET_BYTES = 120 * 1024 * 1024;
@@ -3623,8 +3631,8 @@ export function createCloudflareModuleStubPlugin() {
     };
 }
 /**
- * Dependencies Nitro itself must bundle outside the controlled serverless
- * output pass. Netlify, Vercel, and Lambda keep Yjs external through Nitro;
+ * Dependencies Nitro itself must bundle outside the controlled Yjs output pass.
+ * Node and controlled serverless presets keep Yjs external through Nitro;
  * `bundleYjsRuntimeForServerlessOutput` then creates their one portable copy.
  */
 export const NITRO_SERVER_RUNTIME_BUNDLED_DEPS = ["yjs"];
@@ -3643,8 +3651,8 @@ export function resolveNitroBundledYjsEntry() {
     return entry;
 }
 /**
- * Edge runtimes have no node_modules, while Node/serverless outputs only need
- * the small set above bundled to keep their package manifests traceable.
+ * Edge runtimes have no node_modules, while Node/serverless outputs receive the
+ * small set above through the controlled post-build pass.
  */
 export function nitroNoExternalsForPreset(targetPreset) {
     return targetPreset.startsWith("cloudflare") ||
@@ -3652,7 +3660,9 @@ export function nitroNoExternalsForPreset(targetPreset) {
         ? true
         : targetPreset === "netlify" ||
             targetPreset === "vercel" ||
-            targetPreset === "aws-lambda"
+            targetPreset === "aws-lambda" ||
+            targetPreset === "node" ||
+            targetPreset === "node-server"
             ? []
             : NITRO_SERVER_RUNTIME_BUNDLED_DEPS;
 }
@@ -3809,10 +3819,14 @@ export default bundle;
         rollupConfig: {
             // Nitro treats the intermediate React Router SSR files as prebuilt
             // chunks, while core's server collaboration files participate in the
-            // final Rolldown graph. Externalize Yjs consistently on serverless so
+            // final Rolldown graph. Externalize Yjs consistently on Node/serverless so
             // both graphs retain their public import shapes; the controlled
             // post-build pass below bundles and rewrites them to one module.
-            ...(preset === "netlify" || preset === "vercel" || preset === "aws-lambda"
+            ...(preset === "netlify" ||
+                preset === "vercel" ||
+                preset === "aws-lambda" ||
+                preset === "node" ||
+                preset === "node-server"
                 ? { external: ["yjs"] }
                 : {}),
             plugins: [
@@ -3827,9 +3841,9 @@ export default bundle;
             : {}),
         routeRules: mcpEmbedStaticAssetRouteRules(appBasePath),
         // Edge presets (cloudflare, deno) bundle all deps because node_modules are
-        // unavailable at runtime. Ordinary Node presets bundle Yjs through Nitro.
-        // Controlled serverless presets externalize it above, then emit one full
-        // runtime module after Nitro has preserved every consumer's public imports.
+        // unavailable at runtime. Node and controlled serverless presets
+        // externalize Yjs above, then emit one full runtime module after Nitro has
+        // preserved every consumer's public imports.
         noExternals: nitroNoExternalsForPreset(preset),
     });
     await runNitroBuildPipeline({
@@ -3852,6 +3866,8 @@ export default bundle;
         // Before the Netlify block below clones this dir into the extra functions,
         // so they inherit the pruned bundle instead of a second full copy.
         pruneServerlessFunctionDeadWeight(nitro.options.output.serverDir);
+    }
+    if (shouldBundleYjsRuntimeForPreset(preset)) {
         bundleYjsRuntimeForServerlessOutput(nitro.options.output.serverDir, cwd);
     }
     if (isCloudflareModulePreset(preset)) {

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,7 +159,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -175,6 +174,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,7 +190,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -200,6 +199,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,7 +216,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -235,6 +234,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,7 +250,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -264,6 +263,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/notifications/routes.d.ts

@@ -16,18 +16,18 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error?: undefined;
     ok?: undefined;
 } | {
-    count?: undefined;
     updated: number;
     error?: undefined;
     ok?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     error: string;
     ok?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     error?: undefined;
     ok: boolean;
+    count?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    ok?: undefined;
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/secrets/routes.d.ts

@@ -34,16 +34,16 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     ok: boolean;
     status: string;
     error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
     ok: boolean;
     removed: boolean;
@@ -54,9 +54,9 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
     ok: boolean;
     note?: undefined;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/embed-route.js

@@ -125,6 +125,8 @@ function logEmbedConsumeResult(event, diagnostic, responseStatus) {
         ticketRowFound: diagnostic.ticketRowFound,
         consumed: diagnostic.consumed,
         expired: diagnostic.expired,
+        expectedOwnerKey: diagnostic.expectedOwnerKey,
+        ticketOwnerKey: diagnostic.ticketOwnerKey,
         expectedOrgKey: diagnostic.expectedOrgKey,
         ticketOrgKey: diagnostic.ticketOrgKey,
         responseStatus,
@@ -253,7 +255,10 @@ export function createEmbedStartRouteHandler(options = {}) {
             .catch(() => null);
         let consumeDiagnostic = null;
         const consumed = await consumeEmbedSessionTicket(ticket, {
-            expectedOrgId: existingSession?.orgId ?? null,
+            // Org ids are app-local in the workspace: the Dispatch parent and a
+            // target app can represent the same signed-in person with different
+            // ids. Bind an existing target session to the ticket owner instead.
+            expectedOwnerEmail: existingSession?.email ?? null,
             onResult: (diagnostic) => {
                 consumeDiagnostic = diagnostic;
             },

package/dist/server/embed-session.d.ts

@@ -12,17 +12,20 @@ export interface EmbedSessionTicket {
     ticketHash: string;
     expiresAt: number;
 }
-export type EmbedSessionTicketConsumeOutcome = "missing-ticket" | "not-found" | "already-consumed" | "expired" | "org-mismatch" | "consumption-race" | "invalid-row" | "consumed";
+export type EmbedSessionTicketConsumeOutcome = "missing-ticket" | "not-found" | "already-consumed" | "expired" | "identity-mismatch" | "org-mismatch" | "consumption-race" | "invalid-row" | "consumed";
 export interface EmbedSessionTicketConsumeDiagnostic {
     outcome: EmbedSessionTicketConsumeOutcome;
     ticketKey: string | null;
     ticketRowFound: boolean;
     consumed: boolean;
     expired: boolean;
+    expectedOwnerKey: string | null;
+    ticketOwnerKey: string | null;
     expectedOrgKey: string | null;
     ticketOrgKey: string | null;
 }
 export interface ConsumeEmbedSessionTicketOptions {
+    expectedOwnerEmail?: string | null;
     expectedOrgId?: string | null;
     onResult?: (result: EmbedSessionTicketConsumeDiagnostic) => void;
 }

package/dist/server/embed-session.js

@@ -139,6 +139,10 @@ function redactedIdentifier(value) {
         return null;
     return crypto.createHash("sha256").update(value).digest("hex").slice(0, 12);
 }
+function normalizedEmail(value) {
+    const normalized = value?.trim().toLowerCase();
+    return normalized || null;
+}
 function numberOrNull(value) {
     if (value == null)
         return null;
@@ -464,6 +468,8 @@ export async function createEmbedSessionTicket(input) {
     return { ticket, ticketHash, expiresAt };
 }
 export async function consumeEmbedSessionTicket(ticket, options = {}) {
+    const expectedOwnerEmail = normalizedEmail(options.expectedOwnerEmail);
+    const expectedOwnerKey = redactedIdentifier(expectedOwnerEmail);
     const expectedOrgKey = redactedIdentifier(options.expectedOrgId);
     if (!ticket) {
         options.onResult?.({
@@ -472,6 +478,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: false,
             consumed: false,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey: null,
             expectedOrgKey,
             ticketOrgKey: null,
         });
@@ -493,6 +501,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: false,
             consumed: false,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey: null,
             expectedOrgKey,
             ticketOrgKey: null,
         });
@@ -501,6 +511,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
     const row = rows[0];
     const expiresAt = numberOrNull(row.expires_at ?? row.expiresAt);
     const consumedAt = numberOrNull(row.consumed_at ?? row.consumedAt);
+    const ownerEmail = stringOrUndefined(row.owner_email ?? row.ownerEmail);
+    const ticketOwnerKey = redactedIdentifier(normalizedEmail(ownerEmail));
     const orgId = stringOrUndefined(row.org_id ?? row.orgId);
     const ticketOrgKey = redactedIdentifier(orgId);
     if (consumedAt != null) {
@@ -510,6 +522,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: true,
             consumed: true,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey,
             expectedOrgKey,
             ticketOrgKey,
         });
@@ -522,6 +536,24 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: true,
             consumed: false,
             expired: true,
+            expectedOwnerKey,
+            ticketOwnerKey,
+            expectedOrgKey,
+            ticketOrgKey,
+        });
+        return null;
+    }
+    if (expectedOwnerEmail &&
+        ownerEmail &&
+        normalizedEmail(ownerEmail) !== expectedOwnerEmail) {
+        options.onResult?.({
+            outcome: "identity-mismatch",
+            ticketKey,
+            ticketRowFound: true,
+            consumed: false,
+            expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey,
             expectedOrgKey,
             ticketOrgKey,
         });
@@ -534,6 +566,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: true,
             consumed: false,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey,
             expectedOrgKey,
             ticketOrgKey,
         });
@@ -551,13 +585,14 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: true,
             consumed: false,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey,
             expectedOrgKey,
             ticketOrgKey,
         });
         return null;
     }
     const targetPath = normalizeEmbedTargetPath(stringOrUndefined(row.target_path ?? row.targetPath));
-    const ownerEmail = stringOrUndefined(row.owner_email ?? row.ownerEmail);
     if (!targetPath || !ownerEmail || expiresAt == null) {
         options.onResult?.({
             outcome: "invalid-row",
@@ -565,6 +600,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             ticketRowFound: true,
             consumed: true,
             expired: false,
+            expectedOwnerKey,
+            ticketOwnerKey,
             expectedOrgKey,
             ticketOrgKey,
         });
@@ -576,6 +613,8 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
         ticketRowFound: true,
         consumed: true,
         expired: false,
+        expectedOwnerKey,
+        ticketOwnerKey,
         expectedOrgKey,
         ticketOrgKey,
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.159.1",
+  "version": "0.159.3",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -426,7 +426,7 @@
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
     "@agent-native/recap-cli": "0.5.4",
-    "@agent-native/toolkit": "^0.16.3"
+    "@agent-native/toolkit": "^0.16.4"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",