@agent-native/core 0.209.2 → 0.209.3-nightly-20261016212700

package/dist/a2a-claims.js

@@ -13,9 +13,8 @@ export async function verifyA2ATokenWithClaims(token, event) {
                 : [];
         if (audiences.length === 0 || audiences.some((value) => !value.trim()))
             return null;
+        const hasClaimedOrgId = Object.prototype.hasOwnProperty.call(raw, "org_id");
         const claimedOrgId = typeof raw.org_id === "string" ? raw.org_id.trim() : "";
-        // Global-secret verification can resolve an ID-only claim locally; require
-        // the signed domain too so the ID alone cannot choose the authorization scope.
         const claimedOrgDomain = typeof raw.org_domain === "string"
             ? raw.org_domain.trim().toLowerCase()
             : "";
@@ -26,11 +25,12 @@ export async function verifyA2ATokenWithClaims(token, event) {
             : [];
         const issuer = typeof raw.iss === "string" ? raw.iss.trim() : "";
         const orgDomain = identity.orgDomain?.trim().toLowerCase() ?? "";
-        return claimedOrgId &&
-            claimedOrgId === orgId &&
+        // Independently hosted apps resolve their own organization ID from this verified domain.
+        const organizationScopeMatches = Boolean(orgId &&
             claimedOrgDomain &&
             claimedOrgDomain === orgDomain &&
-            jti
+            (!hasClaimedOrgId || claimedOrgId === orgId));
+        return organizationScopeMatches && jti
             ? {
                 email: identity.email,
                 orgId,

package/dist/agent/context-xray/plugin.js

@@ -1,14 +1,10 @@
-import { runMigrations } from "../../db/migrations.js";
 import { awaitBootstrap, markDefaultPluginProvided, } from "../../server/framework-request-handler.js";
-import { CONTEXT_XRAY_MIGRATIONS } from "./migrations.js";
+import { contextXrayStore } from "./schema-store.js";
 export function createContextXrayPlugin() {
-    const migrate = runMigrations(CONTEXT_XRAY_MIGRATIONS, {
-        table: "_context_xray_migrations",
-    });
     return async (nitroApp) => {
         markDefaultPluginProvided(nitroApp, "context-xray");
         await awaitBootstrap(nitroApp);
-        await migrate(nitroApp);
+        await contextXrayStore.ready();
     };
 }
 export const defaultContextXrayPlugin = createContextXrayPlugin();

package/dist/agent/context-xray/schema-store.d.ts

@@ -0,0 +1 @@
+export declare const contextXrayStore: import("../../db/store-registry.js").Store;

package/dist/agent/context-xray/schema-store.js

@@ -0,0 +1,7 @@
+import { defineStore } from "../../db/store-registry.js";
+import { fromMigrationEntries } from "../../db/versioned-store-migrations.js";
+import { CONTEXT_XRAY_MIGRATIONS } from "./migrations.js";
+export const contextXrayStore = defineStore({
+    id: "context_xray",
+    migrations: fromMigrationEntries("_context_xray_migrations", CONTEXT_XRAY_MIGRATIONS, { ranAtBoot: true }),
+});

package/dist/agent/harness/store.js

@@ -1,6 +1,8 @@
 import { getDbExec } from "../../db/client.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../../db/ddl-guard.js";
 import { defineStore } from "../../db/store-registry.js";
+import { fromMigrationEntries } from "../../db/versioned-store-migrations.js";
+import { AGENT_HARNESS_SESSION_MIGRATIONS, AGENT_HARNESS_SESSION_MIGRATIONS_TABLE, } from "./migrations.js";
 export class AgentHarnessSessionConflictError extends Error {
     constructor(sessionId) {
         super(`Harness session ${sessionId} changed concurrently; retry the operation.`);
@@ -58,6 +60,7 @@ export const agentHarnessSessionsStore = defineStore({
                 await ensureIndexExists("idx_agent_harness_sessions_owner", `CREATE INDEX IF NOT EXISTS idx_agent_harness_sessions_owner ON agent_harness_sessions(owner_email, updated_at)`);
             },
         },
+        ...fromMigrationEntries(AGENT_HARNESS_SESSION_MIGRATIONS_TABLE, AGENT_HARNESS_SESSION_MIGRATIONS),
     ],
 });
 export function ensureAgentHarnessSessionTables() {

package/dist/agent/observational-memory/plugin.js

@@ -1,14 +1,10 @@
-import { runMigrations } from "../../db/migrations.js";
 import { awaitBootstrap, markDefaultPluginProvided, } from "../../server/framework-request-handler.js";
-import { OBSERVATIONAL_MEMORY_MIGRATIONS } from "./migrations.js";
+import { observationalMemoryStore } from "./store.js";
 export function createObservationalMemoryPlugin() {
-    const migrate = runMigrations(OBSERVATIONAL_MEMORY_MIGRATIONS, {
-        table: "_observational_memory_migrations",
-    });
     return async (nitroApp) => {
         markDefaultPluginProvided(nitroApp, "observational-memory");
         await awaitBootstrap(nitroApp);
-        await migrate(nitroApp);
+        await observationalMemoryStore.ready();
     };
 }
 export const defaultObservationalMemoryPlugin = createObservationalMemoryPlugin();

package/dist/agent/observational-memory/store.js

@@ -14,7 +14,9 @@
 import { getDbExec } from "../../db/client.js";
 import { ensureTableExists, ensureIndexExists } from "../../db/ddl-guard.js";
 import { defineStore } from "../../db/store-registry.js";
+import { fromMigrationEntries } from "../../db/versioned-store-migrations.js";
 import { widenIntColumnsToBigInt } from "../../db/widen-columns.js";
+import { OBSERVATIONAL_MEMORY_MIGRATIONS } from "./migrations.js";
 export const observationalMemoryStore = defineStore({
     id: "observational_memory",
     migrations: [
@@ -53,6 +55,7 @@ export const observationalMemoryStore = defineStore({
                 ]);
             },
         },
+        ...fromMigrationEntries("_observational_memory_migrations", OBSERVATIONAL_MEMORY_MIGRATIONS, { ranAtBoot: true }),
     ],
 });
 export function ensureTable() {

package/dist/agent/run-store.js

@@ -3,6 +3,7 @@ import { isArtifactReceipt, } from "../artifacts/detect.js";
 import { getDbExec } from "../db/client.js";
 import { ensureColumnExists, ensureTableExists } from "../db/ddl-guard.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { automationRecoveryMessagesForLocale } from "../localization/automation-recovery-messages.js";
 import { lockAndAssertServicePrincipalMayStartRun, prepareServicePrincipalRunStart, recordServicePrincipalDenial, } from "../org/service-principal-guard.js";
@@ -13,6 +14,7 @@ import { approvalKeyForHistory } from "./approval-key.js";
 import { admitAutoContinue, admitManualContinue, } from "./auto-continue.js";
 import { AGENT_CHAT_RECOVERY_OF_RUN_FIELD } from "./durable-background.js";
 import { LLM_MISSING_CREDENTIALS_ERROR_CODE, LLM_MISSING_CREDENTIALS_MESSAGE, } from "./engine/credential-errors.js";
+import { AGENT_RUN_MIGRATIONS, AGENT_RUN_MIGRATIONS_TABLE, } from "./run-migrations.js";
 import { isConsistentToolCallInputFingerprint, isUnavailableToolCallInput, toolCallInputFingerprint, } from "./tool-call-journal.js";
 import { CONTINUATION_REASONS, isContinuationTerminalReason } from "./types.js";
 export const RUN_STALE_MS = 15_000;
@@ -266,6 +268,7 @@ export const agentRunsStore = defineStore({
                 await widenIntColumnsToBigInt("agent_tool_ledger", ["completed_at"]);
             },
         },
+        ...fromMigrationEntries(AGENT_RUN_MIGRATIONS_TABLE, AGENT_RUN_MIGRATIONS),
     ],
 });
 export function ensureRunTables() {

package/dist/agent/tool-approval-store.js

@@ -2,7 +2,9 @@ import { createHash, randomUUID } from "node:crypto";
 import { getDbExec } from "../db/client.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
 import { hashAgentToolApprovalKey } from "./approval-key.js";
+import { AGENT_TOOL_APPROVAL_MIGRATIONS, AGENT_TOOL_APPROVAL_MIGRATIONS_TABLE, } from "./tool-approval-migrations.js";
 import { AGENT_TOOL_APPROVAL_INDEX_SQL, AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL, AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL, AGENT_TOOL_APPROVAL_POLICY_REVISION_COLUMN_SQL, AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL, AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL, AGENT_TOOL_APPROVAL_REVISION_COLUMN_SQL, AGENT_TOOL_APPROVAL_TABLE_SQL, } from "./tool-approval-migrations.js";
 export { hashAgentToolApprovalKey } from "./approval-key.js";
 const APPROVAL_TTL_MS = 60 * 60_000;
@@ -25,6 +27,7 @@ export const agentToolApprovalsStore = defineStore({
                 await ensureColumnExists("agent_tool_approvals", "tool_revision", AGENT_TOOL_APPROVAL_REVISION_COLUMN_SQL);
             },
         },
+        ...fromMigrationEntries(AGENT_TOOL_APPROVAL_MIGRATIONS_TABLE, AGENT_TOOL_APPROVAL_MIGRATIONS.filter((entry) => entry.version <= 3)),
     ],
 });
 export function ensureAgentToolApprovalTable() {
@@ -46,6 +49,7 @@ export const agentToolApprovalPoliciesStore = defineStore({
                 await ensureColumnExists("agent_tool_approval_policies", "tool_revision", AGENT_TOOL_APPROVAL_POLICY_REVISION_COLUMN_SQL);
             },
         },
+        ...fromMigrationEntries(AGENT_TOOL_APPROVAL_MIGRATIONS_TABLE, AGENT_TOOL_APPROVAL_MIGRATIONS.filter((entry) => entry.version === 4)),
     ],
 });
 export function ensureAgentToolApprovalPolicyTable() {

package/dist/automation/index.d.ts

@@ -139,8 +139,8 @@ export declare function createAutomationCallbackHandler(runtime: AutomationRunti
     duplicate?: undefined;
     eventId?: undefined;
 } | {
+    error?: undefined;
     accepted: boolean;
     duplicate: boolean;
     eventId: string;
-    error?: undefined;
 }>;

package/dist/chat-threads/store.js

@@ -7,6 +7,7 @@ import { getDbExec } from "../db/client.js";
 import { createGetDb } from "../db/create-get-db.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { getRequestOrgId } from "../server/request-context.js";
 import { assertNoInlineImageBytes, stripInlineBytes, } from "../shared/inline-bytes.js";
@@ -14,6 +15,7 @@ import { resolveAccess } from "../sharing/access.js";
 import { registerShareableResource } from "../sharing/registry.js";
 import { roleSatisfies } from "../sharing/schema.js";
 import { emitChatThreadChange } from "./emitter.js";
+import { CHAT_THREAD_SCHEMA_MIGRATIONS, CHAT_THREAD_SCHEMA_MIGRATIONS_TABLE, } from "./schema-migrations.js";
 import { chatThreads, chatThreadShares, CHAT_THREAD_SHARES_CREATE_SQL, CHAT_THREAD_SHARES_RESOURCE_INDEX_SQL, } from "./schema.js";
 /**
  * Per-thread async mutex. Read-modify-write on the `thread_data` JSON blob
@@ -155,6 +157,7 @@ export const chatThreadsStore = defineStore({
                 await ensureIndexExists("chat_thread_shares_resource_idx", CHAT_THREAD_SHARES_RESOURCE_INDEX_SQL);
             },
         },
+        ...fromMigrationEntries(CHAT_THREAD_SCHEMA_MIGRATIONS_TABLE, CHAT_THREAD_SCHEMA_MIGRATIONS, { data: [3] }),
     ],
 });
 function ensureTable() {

package/dist/client/action-query-cache-context.d.ts

@@ -0,0 +1 @@
+export declare const trustedActionQueryCacheBindingPendingContext: import("react").Context<boolean>;

package/dist/client/action-query-cache-context.js

@@ -0,0 +1,2 @@
+import { createContext } from "react";
+export const trustedActionQueryCacheBindingPendingContext = createContext(false);

package/dist/client/action-query-cache.d.ts

@@ -27,7 +27,7 @@ export declare function bindActionQueryCache(client: QueryClient, scope: string,
 }): Promise<void>;
 /** Sign-out: stop, drop this document's results, and delete every stored
  * record. */
-export declare function clearActionQueryCache(): Promise<void>;
+export declare function clearActionQueryCache(client?: QueryClient): Promise<void>;
 /**
  * Holds action queries until the session's cached results are in the client,
  * so a revisit paints them instead of a skeleton. With a signed-out session it

package/dist/client/action-query-cache.js

@@ -2,8 +2,9 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { persistQueryClient, } from "@tanstack/query-persist-client-core";
 import { IsRestoringProvider, useQueryClient, } from "@tanstack/react-query";
 import { clear as clearStore, createStore, del as deleteEntry, get as getEntry, keys as listKeys, set as setEntry, } from "idb-keyval";
-import { useEffect, useMemo, useState } from "react";
+import { useEffect, useLayoutEffect, useMemo, useState, } from "react";
 import { actionErrorStatus } from "./action-failure-circuit.js";
+import { trustedActionQueryCacheBindingPendingContext } from "./action-query-cache-context.js";
 import { clientBuildId } from "./build-compatibility.js";
 import { getAccessDeniedActionQueryBinding, isBrowserPersistableActionQueryForBinding, markRestoredBrowserPersistableActionQuery, registerActionQueryCacheRevoker, revokeBrowserPersistableActionQuery, setActionQueryCacheBindingToken, } from "./use-action.js";
 import { isSessionFromFirstRead, useSession } from "./use-session.js";
@@ -221,9 +222,11 @@ async function waitForStorageClearWithinBound(timeoutMs = INITIAL_CLEAR_TIMEOUT_
         clearTimeout(timer);
     }
 }
-function releaseWithoutCache(client, attempt) {
+function releaseWithoutCache(client, attempt, trustPrebindResults) {
     closeBinding();
-    client.removeQueries({ queryKey: ACTION_QUERY_KEY });
+    if (!trustPrebindResults) {
+        client.removeQueries({ queryKey: ACTION_QUERY_KEY });
+    }
     registerActionQueryCacheRevoker(client, () => {
         if (attempt !== bindAttemptGeneration || binding !== undefined) {
             return;
@@ -436,7 +439,7 @@ function trackRevokedScopeDelete(scope, deletion) {
 }
 /** Stops persisting and drops this document's action results. Storage is
  * untouched. */
-function closeBinding() {
+function closeBinding(preserveActionQueries = false) {
     bindingGeneration += 1;
     const closing = binding;
     binding = undefined;
@@ -453,7 +456,7 @@ function closeBinding() {
         if (isAccessDeniedActionQuery(query)) {
             clearAccessDeniedActionQueryData(query);
         }
-        else {
+        else if (!preserveActionQueries) {
             closing.client.removeQueries({ queryKey: query.queryKey, exact: true });
         }
     }
@@ -505,11 +508,12 @@ async function waitForRestore(restored, timeoutMs = RESTORE_TIMEOUT_MS) {
  */
 export async function bindActionQueryCache(client, scope, options = {}) {
     const attempt = ++bindAttemptGeneration;
+    const trustPrebindResults = options.trustPrebindResults === true;
     const bindDeadline = Date.now() + BIND_WAIT_BUDGET_MS;
     const remainingBindBudget = () => Math.max(0, bindDeadline - Date.now());
     let cacheSafety = readCacheSafetyState(true);
     if (!cacheSafety) {
-        releaseWithoutCache(client, attempt);
+        releaseWithoutCache(client, attempt, trustPrebindResults);
         return;
     }
     if (!storageClearInFlight) {
@@ -522,7 +526,7 @@ export async function bindActionQueryCache(client, scope, options = {}) {
         }
         catch (error) {
             if (attempt === bindAttemptGeneration) {
-                releaseWithoutCache(client, attempt);
+                releaseWithoutCache(client, attempt, trustPrebindResults);
             }
             throw error;
         }
@@ -530,16 +534,15 @@ export async function bindActionQueryCache(client, scope, options = {}) {
             return;
         }
         if (!clearFinished || remainingBindBudget() <= 0) {
-            releaseWithoutCache(client, attempt);
+            releaseWithoutCache(client, attempt, trustPrebindResults);
             return;
         }
     }
     cacheSafety = readCacheSafetyState(true);
     if (!cacheSafety || cacheSafety.pendingClearIntents.length > 0) {
-        releaseWithoutCache(client, attempt);
+        releaseWithoutCache(client, attempt, trustPrebindResults);
         return;
     }
-    const trustPrebindResults = options.trustPrebindResults === true;
     const previousBinding = binding;
     const alreadyBoundClient = previousBinding?.client === client;
     const deniedBeforeBind = client
@@ -788,14 +791,15 @@ export async function bindActionQueryCache(client, scope, options = {}) {
     }
     catch (error) {
         if (binding === currentBinding)
-            closeBinding();
+            closeBinding(trustPrebindResults);
         throw error;
     }
 }
 /** Sign-out: stop, drop this document's results, and delete every stored
  * record. */
-export async function clearActionQueryCache() {
+export async function clearActionQueryCache(client) {
     closeBinding();
+    client?.removeQueries({ queryKey: ACTION_QUERY_KEY });
     const clear = beginStorageClear();
     const clearFinished = await waitForCleanup(clear, "Cached action results could not be cleared in time; cleanup remains required.");
     if (!clearFinished) {
@@ -814,14 +818,23 @@ export function ActionQueryCacheGate({ children }) {
         ? actionQueryCacheScope(session, clientBuildId())
         : null;
     const terminalUnauthenticated = status === "unauthenticated";
+    const [signedOutCacheCleared, setSignedOutCacheCleared] = useState(false);
     const bindAttempt = useMemo(() => ({
         trustPrebindResults: scope !== null && !terminalUnauthenticated && isSessionFromFirstRead(),
     }), [queryClient, scope, terminalUnauthenticated]);
     const [settledAttempt, setSettledAttempt] = useState(null);
+    useLayoutEffect(() => {
+        if (!terminalUnauthenticated) {
+            setSignedOutCacheCleared(false);
+            return;
+        }
+        const clearing = clearActionQueryCache(queryClient);
+        setSignedOutCacheCleared(true);
+        void clearing.catch((error) => console.warn("Unable to clear cached action results", error));
+    }, [queryClient, terminalUnauthenticated]);
     useEffect(() => {
         // A transient session reread does not replace a same-scope cache binding.
         if (terminalUnauthenticated) {
-            clearActionQueryCache().catch((error) => console.warn("Unable to clear cached action results", error));
             setSettledAttempt(bindAttempt);
             return;
         }
@@ -846,7 +859,13 @@ export function ActionQueryCacheGate({ children }) {
             closeBinding();
         };
     }, [bindAttempt, queryClient, scope, terminalUnauthenticated]);
-    const restoring = scope !== null && settledAttempt !== bindAttempt;
+    const restoring = scope !== null &&
+        settledAttempt !== bindAttempt &&
+        !bindAttempt.trustPrebindResults;
     const holdUntrustedChildren = scope !== null && !bindAttempt.trustPrebindResults && restoring;
-    return (_jsx(IsRestoringProvider, { value: restoring, children: holdUntrustedChildren ? null : children }));
+    const holdSignedOutChildren = terminalUnauthenticated && !signedOutCacheCleared;
+    const trustedBindingPending = scope !== null &&
+        settledAttempt !== bindAttempt &&
+        bindAttempt.trustPrebindResults;
+    return (_jsx(trustedActionQueryCacheBindingPendingContext.Provider, { value: trustedBindingPending, children: _jsx(IsRestoringProvider, { value: restoring, children: holdUntrustedChildren || holdSignedOutChildren ? null : children }) }));
 }

package/dist/client/motion-text.css

@@ -1,3 +1,11 @@
 .agent-native-motion-text-unit {
   display: inline-block;
 }
+
+.agent-native-motion-text-space-unit {
+  position: absolute;
+  display: block;
+  width: 0;
+  height: 0;
+  overflow: hidden;
+}

package/dist/client/motion-text.d.ts

@@ -2,6 +2,8 @@ import { type ReactElement, type ReactNode, type Ref } from "react";
 import "./motion-text.css";
 export type MotionTextUnit = "character" | "word" | "line" | "paragraph";
 export type MotionTextDirection = "forward" | "reverse";
+export type MotionTextAnimationDirection = "in" | "out";
+export type MotionTextOrder = "left-to-right" | "right-to-left" | "center-out" | "random" | "top-to-bottom" | "bottom-to-top";
 export type MotionTextProperty = "opacity" | "translate" | "scale" | "rotate" | "filter";
 export type MotionTextPlaybackMode = "loop" | "once" | "ping-pong";
 export interface MotionTextKeyframe {
@@ -14,6 +16,10 @@ export interface MotionTextAnimation {
     unit: MotionTextUnit;
     direction: MotionTextDirection;
     staggerMs: number;
+    animationDirection?: MotionTextAnimationDirection;
+    order?: MotionTextOrder;
+    overlapPercent?: number;
+    ignoreSpaces?: boolean;
     delayMs?: number;
     property: MotionTextProperty;
     durationMs: number;