@agent-native/core 0.164.12 → 0.164.17

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.js

@@ -405,6 +405,8 @@ export function isLoopbackRequest(event) {
 async function readDesktopSsoSafely(event) {
     if (process.env.NODE_ENV === "production")
         return null;
+    if (getAppConfig().auth.disableDesktopSsoFallbackInDevelopment)
+        return null;
     if (!isElectronRequest(event))
         return null;
     if (!isLoopbackRequest(event))
@@ -1122,8 +1124,8 @@ const DESKTOP_AUTH_TOKEN_BODY_ORIGINS = new Set([
     "https://tauri.localhost",
     "http://localhost:1420",
 ]);
-// 5-minute TTL for exchange entries (short — single-use tokens).
-const DESKTOP_EXCHANGE_TTL_MS = 5 * 60 * 1000;
+// 10-minute TTL for exchange entries (short — single-use tokens).
+const DESKTOP_EXCHANGE_TTL_MS = 10 * 60 * 1000;
 function normalizeDesktopFlowId(value) {
     if (typeof value !== "string")
         return null;
@@ -1242,7 +1244,7 @@ export function prepareDesktopOAuthBrowserBinding(event) {
     if (!binding || !/^[A-Za-z0-9_-]{43}$/.test(binding)) {
         binding = crypto.randomBytes(32).toString("base64url");
         setCookie(event, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, binding, {
-            ...crossSiteCookieAttrs(event),
+            ...desktopOAuthBrowserBindingCookieAttrs(event),
             httpOnly: true,
             path: "/",
             maxAge: Math.floor(DESKTOP_EXCHANGE_TTL_MS / 1_000),
@@ -2810,6 +2812,18 @@ function crossSiteCookieAttrs(event) {
         ? { sameSite: "none", secure: true, partitioned: true }
         : { sameSite: "lax", secure: false };
 }
+/**
+ * The binding cookie is set before navigating to Google and read after the
+ * provider redirects back. A partitioned cookie uses the top-level site from
+ * the bootstrap request, so it is unavailable when the callback starts from
+ * Google's top-level site. Keep this host-scoped cookie unpartitioned while
+ * retaining the cross-site and transport protections required by the flow.
+ */
+function desktopOAuthBrowserBindingCookieAttrs(event) {
+    return isHttpsRequest(event)
+        ? { sameSite: "none", secure: true }
+        : { sameSite: "lax", secure: false };
+}
 function setFirstRunOnboardingCookie(event) {
     setCookie(event, FIRST_RUN_ONBOARDING_COOKIE, "1", {
         ...crossSiteCookieAttrs(event),

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;

package/dist/vite/client.js

@@ -2028,6 +2028,8 @@ function ssrStubPlugin(packages) {
         "init",
         "isChangeOrigin",
         "isNodeEmpty",
+        "markInputRule",
+        "markPasteRule",
         "mergeAttributes",
         "renderToString",
         "applyUpdate",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.164.12",
+  "version": "0.164.17",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {