@agent-native/core 0.153.10 → 0.154.1

package/corpus/templates/slides/app/lib/image-download.ts

@@ -0,0 +1,84 @@
+import { appBasePath } from "@agent-native/core/client/api-path";
+
+function imageProxyUrl(src: string): string {
+  return `${appBasePath()}/api/image-proxy?url=${encodeURIComponent(src)}`;
+}
+
+function isRemoteHttpUrl(src: string): boolean {
+  try {
+    const url = new URL(src, window.location.href);
+    return (
+      (url.protocol === "http:" || url.protocol === "https:") &&
+      url.origin !== window.location.origin
+    );
+  } catch {
+    // coercion-ok: malformed image sources are treated as non-remote candidates.
+    return false;
+  }
+}
+
+export function imageDownloadFilename(src: string): string {
+  if (/^(?:data|blob):/i.test(src)) return "image";
+
+  try {
+    const pathname = new URL(src, window.location.href).pathname;
+    const filename = pathname.split("/").filter(Boolean).pop();
+    const decoded = filename ? decodeURIComponent(filename) : "";
+    const sanitized = decoded.replace(/[^a-z0-9._-]+/gi, "-");
+    if (sanitized) return sanitized;
+  } catch {
+    // coercion-ok: malformed image sources use the generic download filename.
+    // Use the generic name for malformed or non-URL image sources.
+  }
+  return "image";
+}
+
+function triggerBlobDownload(blob: Blob, filename: string): void {
+  const objectUrl = URL.createObjectURL(blob);
+  const anchor = document.createElement("a");
+  anchor.href = objectUrl;
+  anchor.download = filename;
+  anchor.hidden = true;
+  document.body.append(anchor);
+  anchor.click();
+  anchor.remove();
+  URL.revokeObjectURL(objectUrl);
+}
+
+function openImageInNewTab(src: string, filename: string): void {
+  const anchor = document.createElement("a");
+  anchor.href = src;
+  anchor.download = filename;
+  anchor.target = "_blank";
+  anchor.rel = "noopener noreferrer";
+  anchor.hidden = true;
+  document.body.append(anchor);
+  anchor.click();
+  anchor.remove();
+}
+
+/** Download the selected image, proxying external sources when CORS blocks the browser. */
+export async function downloadImage(src: string): Promise<void> {
+  const normalizedSrc = src.trim();
+  if (!normalizedSrc || typeof document === "undefined") return;
+
+  const candidates = [normalizedSrc];
+  if (isRemoteHttpUrl(normalizedSrc)) {
+    candidates.push(imageProxyUrl(normalizedSrc));
+  }
+
+  const filename = imageDownloadFilename(normalizedSrc);
+  for (const candidate of candidates) {
+    try {
+      const response = await fetch(candidate, { credentials: "include" });
+      if (!response.ok) continue;
+      triggerBlobDownload(await response.blob(), filename);
+      return;
+    } catch {
+      // coercion-ok: a failed candidate is retried or falls back to opening the source.
+      // Try the authenticated image proxy before falling back to the source URL.
+    }
+  }
+
+  openImageInNewTab(normalizedSrc, filename);
+}

package/corpus/templates/slides/app/lib/utils.ts

@@ -27,5 +27,5 @@ export function shortcutLabel(shortcut: string): string {
       if (lower === "space") return "Space";
       return token.length === 1 ? token.toUpperCase() : token;
     })
-    .join("+");
+    .join(" ");
 }

package/corpus/templates/slides/app/pages/DeckEditor.tsx

@@ -1194,6 +1194,11 @@ export default function DeckEditor() {
         onDuplicateCurrentSlide={
           currentSlide ? () => duplicateSlide(id, currentSlide.id) : undefined
         }
+        onChangeSlideTransition={
+          canEdit && currentSlide
+            ? (transition) => updateSlide(id, currentSlide.id, { transition })
+            : undefined
+        }
       />
 
       {/* Full-width host for the slide's contextual style toolbar: it spans the
@@ -1312,6 +1317,10 @@ export default function DeckEditor() {
                   }
                   textBoxMode={textBoxMode}
                   onToggleTextBoxMode={toggleTextBoxMode}
+                  slideTransition={currentSlide.transition}
+                  onChangeSlideTransition={(transition) =>
+                    updateSlide(id, currentSlide.id, { transition })
+                  }
                 />
               ) : undefined
             }

package/corpus/templates/slides/app/pages/Index.tsx

@@ -67,6 +67,12 @@ import { useWorkspaceDefaults } from "@/hooks/use-workspace-defaults";
 import { createDeckAgentMessage } from "@/lib/agent-visible-message";
 import { savePromptToComposerDraft } from "@/lib/composer-draft";
 import { isSourceImprovementRequest } from "@/lib/create-deck-generation";
+import {
+  readStoredDeckFilter,
+  resolveDeckFilter,
+  writeStoredDeckFilter,
+  type DeckFilter,
+} from "@/lib/deck-filter";
 import { sortDecksByRecency } from "@/lib/deck-sorting";
 import {
   IMPORT_ACTION_TIMEOUT_MS,
@@ -291,6 +297,7 @@ export default function Index() {
     string | null
   >(null);
   const [deckSearch, setDeckSearch] = useState("");
+  const [storedDeckFilter, setStoredDeckFilter] = useState<DeckFilter>("mine");
   // True while the picker still reflects an auto-applied default rather than
   // an explicit user choice. `useWorkspaceDefaults()`/`useDesignSystems()`
   // resolve asynchronously, so the initial value set on dialog open can be a
@@ -324,7 +331,8 @@ export default function Index() {
   const initialDesignSystemId =
     lastUsedDesignSystemId ?? workspaceDesignSystemId;
   const initialReferenceDeckId = lastUsedReferenceDeckId;
-  const deckFilter = searchParams.get("createdBy") === "me" ? "mine" : "all";
+  const createdByParam = searchParams.get("createdBy");
+  const deckFilter = resolveDeckFilter(createdByParam, storedDeckFilter);
   const normalizedDeckSearch = deckSearch.trim().toLowerCase();
   const visibleDecks = useMemo(
     () =>
@@ -356,6 +364,12 @@ export default function Index() {
     if (result.readable) setRecentReferences(result.items);
   }, []);
 
+  useEffect(() => {
+    if (createdByParam !== null) return;
+    const savedFilter = readStoredDeckFilter();
+    if (savedFilter) setStoredDeckFilter(savedFilter);
+  }, [createdByParam]);
+
   const initialPrompt = searchParams.get("initialPrompt")?.trim() ?? "";
   const onboardingPreview = searchParams.get("onboarding") === "preview";
   const firstRunOnboardingEnabled =
@@ -417,6 +431,8 @@ export default function Index() {
   const setDeckFilter = useCallback(
     (value: string) => {
       const nextFilter = value === "mine" ? "mine" : "all";
+      setStoredDeckFilter(nextFilter);
+      writeStoredDeckFilter(nextFilter);
       setSearchParams(
         (prev) => {
           const next = new URLSearchParams(prev);
@@ -1377,14 +1393,6 @@ export default function Index() {
               className="w-fit rounded-lg border border-border bg-card p-0.5"
               size="sm"
             >
-              <ToggleGroupItem
-                value="all"
-                aria-label={t("home.showAllDecks")}
-                className="h-7 rounded-md px-3 text-xs data-[state=on]:bg-accent"
-              >
-                <IconStack2 className="me-1.5 h-3.5 w-3.5" />
-                {t("home.all")}
-              </ToggleGroupItem>
               <ToggleGroupItem
                 value="mine"
                 aria-label={t("home.showMineDecks")}
@@ -1393,6 +1401,14 @@ export default function Index() {
                 <IconUserCircle className="me-1.5 h-3.5 w-3.5" />
                 {t("home.mine")}
               </ToggleGroupItem>
+              <ToggleGroupItem
+                value="all"
+                aria-label={t("home.showAllDecks")}
+                className="h-7 rounded-md px-3 text-xs data-[state=on]:bg-accent"
+              >
+                <IconStack2 className="me-1.5 h-3.5 w-3.5" />
+                {t("home.all")}
+              </ToggleGroupItem>
             </ToggleGroup>
             <label className="flex h-8 w-full items-center gap-2 rounded-lg border border-border bg-card px-2.5 text-muted-foreground sm:w-60">
               <IconSearch className="size-3.5 shrink-0" aria-hidden="true" />

package/corpus/templates/slides/changelog/2026-08-13-clicking-a-slide-thumbnail-now-focuses-it-so-the-slide-shortc.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-13
+---
+
+Clicking a slide thumbnail now focuses it, so the slide copy, paste, and delete shortcuts work after a plain click

package/corpus/templates/slides/changelog/2026-08-13-duplicating-or-restoring-a-slide-now-keeps-its-transition-ani.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-13
+---
+
+Duplicating or undoing the deletion of a slide now keeps its transition, animations, and image data after reload

package/corpus/templates/slides/changelog/2026-08-13-opening-presentation-mode-from-the-agent-now-starts-on-the-re.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-13
+---
+
+Opening presentation mode from the agent now starts on the requested slide instead of the first one

package/corpus/templates/slides/changelog/2026-08-13-slide-transitions-can-be-set-from-a-visible-control-in-the-sl.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-08-13
+---
+
+Slide transitions can be set from a visible control in the slide toolbar instead of being agent-only

package/corpus/templates/slides/netlify.toml

@@ -7,6 +7,7 @@ publish = "templates/slides/dist"
 functions = "templates/slides/.netlify/functions-internal"
 
 [build.environment]
+NODE_VERSION = "24.14.0"
 GA_MEASUREMENT_ID = "G-ESF7FYXGN9"
 GTM_CONTAINER_ID = "GTM-N3WSTXZ"
 NITRO_PRESET = "netlify"

package/corpus/templates/slides/server/lib/builder-design-system-proxy.ts

@@ -2,6 +2,7 @@ import {
   createBuilderDesignSystemProxyFields,
   localBuilderDesignSystemId,
   type BuilderDesignSystemIndexResult,
+  type BuilderDesignSystemGitHubSource,
   type BuilderDesignSystemSourceKind,
 } from "@agent-native/core/server";
 import { and, eq, isNull } from "drizzle-orm";
@@ -16,6 +17,8 @@ export async function upsertBuilderProxyDesignSystem({
   projectName,
   description,
   sourceKind,
+  githubSources,
+  localDesignSystemId: requestedLocalDesignSystemId,
 }: {
   result: BuilderDesignSystemIndexResult;
   ownerEmail: string;
@@ -23,6 +26,8 @@ export async function upsertBuilderProxyDesignSystem({
   projectName?: string;
   description?: string;
   sourceKind?: BuilderDesignSystemSourceKind;
+  githubSources?: BuilderDesignSystemGitHubSource[];
+  localDesignSystemId?: string;
 }) {
   const db = getDb();
   const now = new Date().toISOString();
@@ -35,6 +40,8 @@ export async function upsertBuilderProxyDesignSystem({
     description,
     surface: "slides",
     sourceKind,
+    githubSources,
+    syncedAt: githubSources?.length ? now : undefined,
   });
   const [existing] = await db
     .select({
@@ -43,7 +50,12 @@ export async function upsertBuilderProxyDesignSystem({
       orgId: schema.designSystems.orgId,
     })
     .from(schema.designSystems)
-    .where(eq(schema.designSystems.id, baseLocalDesignSystemId))
+    .where(
+      eq(
+        schema.designSystems.id,
+        requestedLocalDesignSystemId ?? baseLocalDesignSystemId,
+      ),
+    )
     .limit(1);
   const existingBelongsToScope =
     existing?.ownerEmail === ownerEmail &&
@@ -51,7 +63,7 @@ export async function upsertBuilderProxyDesignSystem({
   const localDesignSystemId =
     existing && !existingBelongsToScope
       ? `${baseLocalDesignSystemId}-${nanoid(8)}`
-      : baseLocalDesignSystemId;
+      : (requestedLocalDesignSystemId ?? baseLocalDesignSystemId);
   if (existingBelongsToScope) {
     await db
       .update(schema.designSystems)

package/dist/a2a/audience.d.ts

@@ -0,0 +1,2 @@
+/** Canonical receiver identifier used by both A2A token issuers and verifiers. */
+export declare function canonicalA2AAudience(rawUrl: string, receiverBasePath?: string): string;

package/dist/a2a/audience.js

@@ -0,0 +1,23 @@
+function normalizePathname(pathname, stripEndpoint) {
+    const normalized = pathname.startsWith("/") ? pathname : `/${pathname}`;
+    const withoutTrailingSlashes = normalized.replace(/\/+$/, "");
+    const withoutEndpoint = stripEndpoint
+        ? withoutTrailingSlashes.endsWith("/_agent-native/a2a")
+            ? withoutTrailingSlashes.slice(0, -"/_agent-native/a2a".length)
+            : withoutTrailingSlashes.endsWith("/a2a")
+                ? withoutTrailingSlashes.slice(0, -"/a2a".length)
+                : withoutTrailingSlashes
+        : withoutTrailingSlashes;
+    return withoutEndpoint === "" ? "/" : withoutEndpoint;
+}
+/** Canonical receiver identifier used by both A2A token issuers and verifiers. */
+export function canonicalA2AAudience(rawUrl, receiverBasePath) {
+    try {
+        const url = new URL(rawUrl);
+        const pathname = normalizePathname(receiverBasePath ?? url.pathname, receiverBasePath === undefined);
+        return pathname === "/" ? url.origin : `${url.origin}${pathname}`;
+    }
+    catch {
+        return rawUrl.replace(/\/+$/, "");
+    }
+}

package/dist/a2a/client.d.ts

@@ -62,6 +62,10 @@ export declare class A2AClient {
      * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.
      */
     resolveEndpoint(): Promise<void>;
+    /** Resolve the card-advertised endpoint without sending an RPC request. */
+    resolveEndpointUrl(timeoutMs?: number): Promise<string>;
+    /** Replace caller credentials without discarding resolved endpoint fallbacks. */
+    setAuthentication(apiKey?: string, fallbackApiKeys?: string[]): void;
     private headers;
     private markApiKeySucceeded;
     private rpc;

package/dist/a2a/client.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import * as jose from "jose";
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
+import { canonicalA2AAudience } from "./audience.js";
 /**
  * A workspace serves every app from one gateway on loopback, so sibling A2A
  * targets are private addresses by construction and the SSRF guard cannot tell
@@ -185,6 +186,19 @@ export class A2AClient {
             }
         }
     }
+    /** Resolve the card-advertised endpoint without sending an RPC request. */
+    async resolveEndpointUrl(timeoutMs) {
+        await this.ensureEndpointCandidates(timeoutMs);
+        const endpoint = this.endpointCandidates[0];
+        if (!endpoint)
+            throw new Error("No A2A endpoint candidates available");
+        return endpoint;
+    }
+    /** Replace caller credentials without discarding resolved endpoint fallbacks. */
+    setAuthentication(apiKey, fallbackApiKeys = []) {
+        this.apiKey = apiKey;
+        this.apiKeyAttempts = uniqueAuthTokens([apiKey, ...fallbackApiKeys]);
+    }
     headers(apiKey = this.apiKey) {
         const h = { "Content-Type": "application/json" };
         if (apiKey) {
@@ -823,14 +837,27 @@ export async function callAction(url, action, input = {}, opts) {
     if (!input || typeof input !== "object" || Array.isArray(input)) {
         throw new Error("A2A action input must be an object");
     }
-    const apiKeyAttempts = await buildA2AApiKeyAttempts(opts, normalizeA2AAudience(url));
-    const fallbackApiKeys = apiKeyAttempts
+    const discoveryAudience = normalizeA2AAudience(url);
+    const discoveryApiKeyAttempts = await buildA2AApiKeyAttempts(opts, discoveryAudience);
+    const discoveryFallbackApiKeys = discoveryApiKeyAttempts
         .slice(1)
         .filter((token) => token !== undefined);
-    const client = new A2AClient(url, apiKeyAttempts[0], {
-        fallbackApiKeys,
+    const client = new A2AClient(url, discoveryApiKeyAttempts[0], {
+        fallbackApiKeys: discoveryFallbackApiKeys,
         requestTimeoutMs: opts?.requestTimeoutMs,
     });
+    const endpointUrl = await client.resolveEndpointUrl(opts?.requestTimeoutMs);
+    const invocationAudience = normalizeA2AAudience(endpointUrl);
+    if (invocationAudience !== discoveryAudience) {
+        const invocationApiKeyAttempts = await buildA2AApiKeyAttempts(opts, invocationAudience);
+        const combinedApiKeyAttempts = uniqueAuthTokens([
+            ...invocationApiKeyAttempts,
+            ...discoveryApiKeyAttempts,
+        ]);
+        client.setAuthentication(combinedApiKeyAttempts[0], combinedApiKeyAttempts
+            .slice(1)
+            .filter((token) => token !== undefined));
+    }
     return client.invokeAction(actionName, input, {
         metadata: sanitizeA2ACorrelationMetadata(opts?.correlation),
     });
@@ -876,16 +903,7 @@ async function buildA2AApiKeyAttempts(opts, audience) {
 function normalizeA2AAudience(url) {
     const explicit = splitExplicitA2AEndpoint(url.replace(/\/$/, ""));
     const base = (explicit?.baseUrl ?? url).replace(/\/$/, "");
-    // Receivers derive their expected audience from APP_URL, which carries no
-    // app path. In a workspace every app is mounted under one gateway origin, so
-    // signing the path-qualified URL yields an audience the receiver can never
-    // match. The origin is the identifier both sides agree on.
-    try {
-        return new URL(base).origin;
-    }
-    catch {
-        return base;
-    }
+    return canonicalA2AAudience(base);
 }
 function isA2AAuthRejection(err) {
     const message = err instanceof Error ? err.message : String(err ?? "");

package/dist/a2a/server.d.ts

@@ -1,4 +1,4 @@
-import type { A2AConfig } from "./types.js";
+import type { A2AConfig, AgentSkill } from "./types.js";
 /**
  * Result of verifying an inbound A2A JWT. `email` is the caller identity from
  * the token's `sub` claim (null when verification fails), `orgDomain` mirrors
@@ -21,9 +21,14 @@ export interface A2ATokenPayload {
  * Exported so workspaces can accept A2A callers on the HTTP action route with
  * the same routine — including org-level fallback secrets — instead of
  * reimplementing a partial verifier. Pass the H3 `event` to enable org-domain →
- * org-secret lookup and audience derivation; it is optional.
+ * org-secret lookup and audience derivation; it is optional. A custom mounted
+ * JSON-RPC route also passes its prefix so endpoint-bound tokens verify against
+ * the same audience the client derived from the advertised URL.
  */
-export declare function verifyA2AToken(token: string, event?: any): Promise<A2ATokenPayload>;
+export declare function verifyA2AToken(token: string, event?: any, audienceOptions?: {
+    routePrefix?: string;
+    allowBaseAudience?: boolean;
+}): Promise<A2ATokenPayload>;
 /**
  * Mount A2A protocol endpoints on an H3/Nitro app.
  *
@@ -35,4 +40,4 @@ export declare function verifyA2AToken(token: string, event?: any): Promise<A2AT
  * cryptographic identity verification for cross-app A2A calls.
  */
 export declare function mountA2A(nitroApp: any, config: A2AConfig, routePrefix?: string): void;
-export declare function filterPublicAgentCardSkills(config: A2AConfig): import("./types.js").AgentSkill[];
+export declare function filterPublicAgentCardSkills(config: A2AConfig): AgentSkill[];

package/dist/a2a/server.js

@@ -6,6 +6,7 @@ import { getH3App } from "../server/framework-request-handler.js";
 import { readBody } from "../server/h3-helpers.js";
 import { isSameOriginRequest } from "../server/request-origin.js";
 import { generateAgentCard } from "./agent-card.js";
+import { canonicalA2AAudience } from "./audience.js";
 import { hasConfiguredA2ASecret, isA2AProductionRuntime, } from "./auth-policy.js";
 import { handleJsonRpcH3, processA2ATaskFromQueue } from "./handlers.js";
 import { claimA2AApproval, getA2AApprovalForOwner, settleA2AApproval, } from "./task-store.js";
@@ -39,25 +40,46 @@ function addSecretCandidate(candidates, secret) {
  * service must not verify here). Only tokens without an `aud` claim (minted
  * before the audience claim shipped) skip the audience check.
  */
-function expectedJwtAudience(event) {
+function expectedJwtAudience(event, options) {
     const fromEnv = process.env.APP_URL ||
         process.env.URL ||
         process.env.DEPLOY_URL ||
         process.env.BETTER_AUTH_URL;
-    if (fromEnv)
-        return String(fromEnv).replace(/\/$/, "");
+    const receiverBasePath = process.env.APP_BASE_PATH;
+    if (fromEnv) {
+        return audienceForRoute(canonicalA2AAudience(String(fromEnv), receiverBasePath), options);
+    }
     // Best-effort: derive from the inbound request host. This is forgeable
     // (Host-header attack), but only useful as a hint when env-derived URL
     // is unset; the rest of the JWT verification still uses the secret.
     try {
         const proto = getRequestHeader(event, "x-forwarded-proto") || "https";
         const host = getRequestHeader(event, "host");
-        if (host)
-            return `${proto}://${host}`;
+        if (host) {
+            return audienceForRoute(canonicalA2AAudience(`${proto}://${host}`, receiverBasePath), options);
+        }
+        // coercion-ok: undefined makes audience-bearing token verification fail closed.
     }
     catch { }
     return undefined;
 }
+function audienceForRoute(baseAudience, options) {
+    const trimmedPrefix = options?.routePrefix?.replace(/^\/+|\/+$/g, "");
+    if (!trimmedPrefix || trimmedPrefix === "_agent-native")
+        return baseAudience;
+    const normalizedPrefix = `/${trimmedPrefix}`;
+    const routeAudience = `${baseAudience.replace(/\/+$/, "")}${normalizedPrefix}`;
+    return options?.allowBaseAudience
+        ? [routeAudience, baseAudience]
+        : routeAudience;
+}
+function tokenHasAudienceClaim(token) {
+    return typeof jose.decodeJwt(token).aud !== "undefined";
+}
+function isDirectReadSkill(skill) {
+    return (skill.readOnly === true ||
+        (skill.readOnly === undefined && skill.publicAgent?.readOnly === true));
+}
 /**
  * Verify an inbound A2A bearer token (HS256) exactly as the
  * `/_agent-native/a2a` endpoint does: it peeks at the unverified `org_domain`
@@ -71,9 +93,11 @@ function expectedJwtAudience(event) {
  * Exported so workspaces can accept A2A callers on the HTTP action route with
  * the same routine — including org-level fallback secrets — instead of
  * reimplementing a partial verifier. Pass the H3 `event` to enable org-domain →
- * org-secret lookup and audience derivation; it is optional.
+ * org-secret lookup and audience derivation; it is optional. A custom mounted
+ * JSON-RPC route also passes its prefix so endpoint-bound tokens verify against
+ * the same audience the client derived from the advertised URL.
  */
-export async function verifyA2AToken(token, event) {
+export async function verifyA2AToken(token, event, audienceOptions) {
     // Step 1: Peek at JWT claims WITHOUT verification to get org_domain.
     // This is safe because we only use org_domain to look up the secret,
     // then verify the full JWT with that secret. If someone forges a JWT
@@ -129,7 +153,7 @@ export async function verifyA2AToken(token, event) {
             // whose `aud` targets ANOTHER service verify against a shared secret. A
             // token that self-declares an audience must be checked against ours, so
             // when we have nothing to check it against we reject rather than skip.
-            const aud = expectedJwtAudience(event);
+            const aud = expectedJwtAudience(event, audienceOptions);
             if (!aud)
                 return { email: null, orgDomain: null };
             verifyOptions.audience = aud;
@@ -187,19 +211,26 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
         const host = getRequestHeader(event, "host") ?? "localhost";
         const baseUrl = `${protocol}://${host}`;
         // The anonymous card may only advertise actions safe to disclose
-        // publicly (`requiresAuth !== true`), but `actions/invoke` only ever
-        // runs the opposite set (`requiresAuth === true`). Those are disjoint,
-        // so an unauthenticated card said "no directly callable actions" about
-        // an app whose actions a verified sibling can call — and callers fell
-        // back to open-ended delegation. Show a verified caller what it can
-        // actually invoke; anonymous fetches keep the public list unchanged.
+        // publicly (`requiresAuth !== true`). A verified caller instead sees the
+        // authenticated surface: schemas for direct read invocation plus concise
+        // message-only capabilities for writes owned by the receiving agent.
+        // Anonymous fetches keep the public list unchanged.
         let skills = filterPublicAgentCardSkills(config);
         if (config.authenticatedSkills?.length) {
             const bearer = extractBearerToken(getRequestHeader(event, "authorization"));
             if (bearer) {
-                const payload = await verifyA2AToken(bearer, event);
-                if (payload.email)
-                    skills = config.authenticatedSkills;
+                const payload = await verifyA2AToken(bearer, event, {
+                    routePrefix,
+                    // Capability discovery may begin from either the app URL or an
+                    // already-advertised endpoint URL. Both identify this receiver;
+                    // direct POST invocation below remains endpoint-bound.
+                    allowBaseAudience: true,
+                });
+                if (payload.email) {
+                    skills = tokenHasAudienceClaim(bearer)
+                        ? config.authenticatedSkills
+                        : config.authenticatedSkills.filter((skill) => !isDirectReadSkill(skill));
+                }
             }
         }
         return generateAgentCard({ ...config, skills }, baseUrl, `${routePrefix}/a2a`);
@@ -372,17 +403,13 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
         const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);
         // Try JWT verification first (org-level or global A2A_SECRET-based identity)
         if (bearerToken) {
-            const tokenPayload = await verifyA2AToken(bearerToken, event);
+            const tokenPayload = await verifyA2AToken(bearerToken, event, {
+                routePrefix,
+            });
             verifiedCallerEmail = tokenPayload.email;
             verifiedOrgDomain = tokenPayload.orgDomain;
             if (verifiedCallerEmail) {
-                try {
-                    verifiedAudienceBound =
-                        typeof jose.decodeJwt(bearerToken).aud !== "undefined";
-                }
-                catch {
-                    verifiedAudienceBound = false;
-                }
+                verifiedAudienceBound = tokenHasAudienceClaim(bearerToken);
             }
             bearerTokenRejectedByJwt = !verifiedCallerEmail;
         }

package/dist/a2a/types.d.ts

@@ -189,10 +189,10 @@ export interface A2AConfig {
     version?: string;
     skills: AgentSkill[];
     /**
-     * Skills advertised only to a caller with a verified A2A identity — the set
-     * `actions/invoke` will actually run. Anonymous card fetches never see these.
-     * Without it the card advertises the public set, which is disjoint from the
-     * invocable set, so siblings are told nothing is directly callable.
+     * Skills advertised only to a caller with a verified A2A identity. Read-only
+     * skills may also be available through `actions/invoke`; mutating skills are
+     * message-only capabilities for delegation. Anonymous card fetches never see
+     * either set.
      */
     authenticatedSkills?: AgentSkill[];
     /** If true, public agent-card discovery includes only explicit public-safe skills. */

package/dist/agent/production-agent.js

@@ -6499,7 +6499,7 @@ export function createProductionAgentHandler(options) {
                 const capturedAt = typeof sel.capturedAt === "number" ? sel.capturedAt : 0;
                 if (Date.now() - capturedAt > SELECTION_TTL_MS)
                     return "";
-                return (`\n\nThe user has selected the following text and pressed Cmd+I to focus the agent. ` +
+                return (`\n\nThe user has selected the following text and pressed Cmd I to focus the agent. ` +
                     `Treat this as the immediate context to act on:\n` +
                     `<selection>\n${capSelectionContext(sel.text)}\n</selection>`);
             }

package/dist/brand-kit/types.d.ts

@@ -23,8 +23,16 @@ export interface BrandKitColors {
     text: string;
     textMuted: string;
 }
-/** Semantic category a {@link BrandKitToken} belongs to. */
-export type BrandKitTokenType = "color" | "typography" | "spacing" | "radius" | "shadow" | "other";
+/**
+ * Semantic category a {@link BrandKitToken} belongs to.
+ *
+ * `motion` covers durations, easings, and transitions — the DTCG `duration`,
+ * `cubicBezier`, and `transition` types. It exists because a design system's
+ * motion is part of its identity, and a category-less token is a dropped one:
+ * extractors discard what they cannot classify, so "no bucket" silently became
+ * "no motion in any imported system".
+ */
+export type BrandKitTokenType = "color" | "typography" | "spacing" | "radius" | "shadow" | "motion" | "other";
 /**
  * One token under the name its source design system uses. The seven
  * {@link BrandKitColors} roles are a summary view, not a substitute: collapsing

package/dist/cli/code.js

@@ -946,7 +946,7 @@ async function attachCodeAgentRun(runs, args, output) {
     const printed = new Set();
     writeLine(output, "");
     writeLine(output, `Attaching to Agent-Native Code run ${run.id}`);
-    writeLine(output, "Press Ctrl+C to detach. The session keeps its transcript.");
+    writeLine(output, "Press Ctrl C to detach. The session keeps its transcript.");
     writeLine(output, "");
     const printNewEvents = () => {
         const events = listCodeAgentTranscriptEvents(run.id);