@agent-native/core 0.154.0 → 0.154.2

package/corpus/templates/slides/app/components/editor/EditorActionCluster.tsx

@@ -1,12 +1,24 @@
 import { useT } from "@agent-native/core/client/i18n";
-import { IconLoader2, IconPlus, IconTextSize } from "@tabler/icons-react";
+import {
+  IconLoader2,
+  IconPlus,
+  IconTextSize,
+  IconTransitionRight,
+} from "@tabler/icons-react";
 import { useEffect, useRef, useState } from "react";
 
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
 import {
   Tooltip,
   TooltipContent,
   TooltipTrigger,
 } from "@/components/ui/tooltip";
+import type { Slide } from "@/context/DeckContext";
 import { useAgentGenerating } from "@/hooks/use-agent-generating";
 import { cn } from "@/lib/utils";
 
@@ -19,6 +31,15 @@ const IDLE_CLASS =
 const ACTIVE_CLASS = "bg-accent text-foreground";
 const DIVIDER_CLASS = "mx-1 h-4 w-px shrink-0 bg-border";
 
+type SlideTransition = NonNullable<Slide["transition"]>;
+
+const TRANSITIONS: { value: SlideTransition; labelKey: string }[] = [
+  { value: "instant", labelKey: "editorToolbar.transition_instant" },
+  { value: "fade", labelKey: "editorToolbar.transition_fade" },
+  { value: "slide", labelKey: "editorToolbar.transition_slide" },
+  { value: "zoom", labelKey: "editorToolbar.transition_zoom" },
+];
+
 /**
  * Add slide, undo, redo, and add-text-box — the actions that stay put
  * regardless of what is selected. Rendered at the head of the contextual
@@ -36,6 +57,8 @@ export function EditorActionCluster({
   onDuplicateCurrentSlide,
   textBoxMode,
   onToggleTextBoxMode,
+  slideTransition,
+  onChangeSlideTransition,
   className,
 }: {
   deckId: string;
@@ -49,12 +72,19 @@ export function EditorActionCluster({
   onDuplicateCurrentSlide?: () => void;
   textBoxMode?: boolean;
   onToggleTextBoxMode?: () => void;
+  slideTransition?: Slide["transition"];
+  onChangeSlideTransition?: (transition: SlideTransition) => void;
   className?: string;
 }) {
   const t = useT();
   const { generating, submit: agentSubmit } = useAgentGenerating();
   const [addSlideOpen, setAddSlideOpen] = useState(false);
   const addSlideRef = useRef<HTMLButtonElement>(null);
+  // "none" is a legacy alias the presentation view already treats as instant.
+  const activeTransition: SlideTransition =
+    !slideTransition || slideTransition === "none"
+      ? "instant"
+      : slideTransition;
 
   useEffect(() => {
     if (!generating) onAddSlideGeneratingChange?.(false);
@@ -125,6 +155,48 @@ export function EditorActionCluster({
           </Tooltip>
         </>
       )}
+
+      {onChangeSlideTransition && currentSlideId && (
+        <>
+          <div className={DIVIDER_CLASS} />
+          <DropdownMenu>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <DropdownMenuTrigger asChild>
+                  <button
+                    type="button"
+                    aria-label={t("editorToolbar.transition")}
+                    className={cn(
+                      BUTTON_CLASS,
+                      activeTransition === "instant"
+                        ? IDLE_CLASS
+                        : ACTIVE_CLASS,
+                    )}
+                  >
+                    <IconTransitionRight className="size-4" />
+                  </button>
+                </DropdownMenuTrigger>
+              </TooltipTrigger>
+              <TooltipContent>{t("editorToolbar.transition")}</TooltipContent>
+            </Tooltip>
+            <DropdownMenuContent align="start" className="w-40">
+              {TRANSITIONS.map((transition) => (
+                <DropdownMenuItem
+                  key={transition.value}
+                  onSelect={() => onChangeSlideTransition(transition.value)}
+                  className={
+                    activeTransition === transition.value
+                      ? "bg-accent text-accent-foreground"
+                      : undefined
+                  }
+                >
+                  {t(transition.labelKey)}
+                </DropdownMenuItem>
+              ))}
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </>
+      )}
     </div>
   );
 }

package/corpus/templates/slides/app/components/editor/EditorSidebar.tsx

@@ -198,7 +198,12 @@ function SortableSlideThumb({
         type="button"
         {...(readOnly ? {} : attributes)}
         {...(readOnly ? {} : listeners)}
-        onClick={onSelect}
+        onClick={(event) => {
+          // Safari does not focus a button on click, and the slide copy/paste
+          // and delete shortcuts are scoped to a focused thumbnail.
+          event.currentTarget.focus();
+          onSelect();
+        }}
         onFocus={onSelect}
         aria-label={t("editorSidebar.selectSlide", { number: index + 1 })}
         aria-current={isActive ? "true" : undefined}

package/corpus/templates/slides/app/components/editor/EditorToolbar.tsx

@@ -121,6 +121,9 @@ interface EditorToolbarProps {
   textBoxMode?: boolean;
   /** Toggle the add-text-box tool */
   onToggleTextBoxMode?: () => void;
+  onChangeSlideTransition?: (
+    transition: NonNullable<Slide["transition"]>,
+  ) => void;
   /** Duplicate the current deck */
   onDuplicateDeck?: () => void;
   /** Export the deck as PDF */
@@ -176,6 +179,7 @@ export default function EditorToolbar({
   onTogglePinMode,
   textBoxMode,
   onToggleTextBoxMode,
+  onChangeSlideTransition,
   onDuplicateDeck,
   onExportPdf,
   onExportPptx,
@@ -567,6 +571,8 @@ export default function EditorToolbar({
           onDuplicateCurrentSlide={onDuplicateCurrentSlide}
           textBoxMode={textBoxMode}
           onToggleTextBoxMode={onToggleTextBoxMode}
+          slideTransition={currentSlide?.transition}
+          onChangeSlideTransition={onChangeSlideTransition}
         />
       )}
 

package/corpus/templates/slides/app/components/editor/NewDeckReferenceStep.tsx

@@ -176,6 +176,21 @@ export function NewDeckReferenceStep({
   const chooseSource = (
     kind: NonNullable<NewDeckReferenceSelection["referenceSource"]>["kind"],
   ) => {
+    const isAlreadySelected =
+      selectedSource?.kind === kind ||
+      (kind === "google-docs" && importedReference?.source === "google-slides");
+    if (isAlreadySelected) {
+      setSelectedSource(null);
+      if (importedReference) {
+        // The import also set the reference deck. Leaving that id behind would
+        // submit a deck the UI no longer shows as selected.
+        setSelectedReferenceDeckId((current) =>
+          current === importedReference.id ? null : current,
+        );
+        setImportedReference(null);
+      }
+      return;
+    }
     setSelectedSource({ kind, value: "" });
     if (kind === "website" || kind === "figma") {
       setSelectedDesignSystemId(null);

package/corpus/templates/slides/app/context/DeckContext.tsx

@@ -40,12 +40,10 @@ type GranularOp =
       op: "add-slide";
       slideId: string;
       afterSlideId?: string;
-      fields: {
-        content: string;
-        notes?: string;
-        layout?: string;
-        background?: string;
-      };
+      /** Everything but `id` and the transient `imageLoading` flag. A slide
+       * copied or restored through this op keeps its transition, animations,
+       * and image/Excalidraw data instead of silently losing them on reload. */
+      fields: Omit<Partial<Slide>, "id" | "imageLoading"> & { content: string };
     }
   | {
       op: "patch-deck-fields";
@@ -57,6 +55,16 @@ type GranularOp =
   | { op: "full-replace"; deck: Deck };
 
 export type PatchDeckOp = Exclude<GranularOp, { op: "full-replace" }>;
+
+/** Slide payload for an `add-slide` op. `imageLoading` is transient UI state
+ * and must not persist; everything else on the slide has to survive the round
+ * trip or a duplicated/restored slide comes back missing fields. */
+function addSlideFields(
+  slide: Slide,
+): Extract<GranularOp, { op: "add-slide" }>["fields"] {
+  const { id: _id, imageLoading: _imageLoading, ...fields } = slide;
+  return fields;
+}
 export type DeckReloadStatus = "loaded" | "failed" | "stale";
 export interface UpdateSlideOptions {
   persistence?: "debounced" | "immediate";
@@ -683,13 +691,11 @@ export function applyOpToDeck(deck: Deck, op: PatchDeckOp): Deck {
     case "add-slide": {
       if (deck.slides.some((s) => s.id === op.slideId)) return deck; // idempotent
       const newSlide: Slide = {
+        ...op.fields,
         id: op.slideId,
         content: op.fields.content,
         notes: op.fields.notes ?? "",
         layout: (op.fields.layout as SlideLayout) ?? "content",
-        ...(op.fields.background !== undefined
-          ? { background: op.fields.background }
-          : {}),
       };
       const slides = [...deck.slides];
       const afterIdx = op.afterSlideId
@@ -822,14 +828,7 @@ export function deriveInverseOp(
           op: "add-slide",
           slideId: prior.id,
           afterSlideId,
-          fields: {
-            content: prior.content,
-            notes: prior.notes,
-            layout: prior.layout,
-            ...(prior.background !== undefined
-              ? { background: prior.background }
-              : {}),
-          },
+          fields: addSlideFields(prior),
         },
         {
           op: "reorder-slides",
@@ -2127,12 +2126,7 @@ export function DeckProvider({ children }: { children: ReactNode }) {
         op: "add-slide",
         slideId: newSlide.id,
         afterSlideId,
-        fields: {
-          content: newSlide.content,
-          notes: newSlide.notes,
-          layout: newSlide.layout,
-          background: newSlide.background,
-        },
+        fields: addSlideFields(newSlide),
       };
       enqueueDeckOp(deckId, op);
       if (before) recordUndo(before, op, { label: "Add slide" });
@@ -2240,17 +2234,11 @@ export function DeckProvider({ children }: { children: ReactNode }) {
       // Granular add-slide op — inserts the copy after the original. Build it
       // from the current deck before scheduling the React state update; the
       // functional updater runs later and cannot be used to produce the op.
-      const { id: newSlideId, ...rest } = copiedSlide;
       const op: PatchDeckOp = {
         op: "add-slide",
-        slideId: newSlideId,
+        slideId: copiedSlide.id,
         afterSlideId: slideId,
-        fields: {
-          content: rest.content,
-          notes: rest.notes,
-          layout: rest.layout,
-          background: rest.background,
-        },
+        fields: addSlideFields(copiedSlide),
       };
       enqueueDeckOp(deckId, op);
       recordUndo(before, op, { label: "Duplicate slide" });

package/corpus/templates/slides/app/hooks/use-navigation-state.ts

@@ -156,22 +156,21 @@ export function useNavigationState() {
       path = `/deck/${cmd.deckId}`;
       if (cmd.view === "present") {
         path += "/present";
-      } else {
-        const internalSlideIndex =
-          typeof cmd.slideNumber === "number" &&
-          Number.isFinite(cmd.slideNumber) &&
-          cmd.slideNumber >= 1
-            ? cmd.slideNumber - 1
-            : cmd.slideIndex;
-        if (
-          typeof internalSlideIndex === "number" &&
-          Number.isFinite(internalSlideIndex) &&
-          internalSlideIndex >= 0
-        ) {
-          // Convert the internal zero-based value back to the 1-based
-          // ?slide=N URL param the editor reads.
-          path += `?slide=${internalSlideIndex + 1}`;
-        }
+      }
+      const internalSlideIndex =
+        typeof cmd.slideNumber === "number" &&
+        Number.isFinite(cmd.slideNumber) &&
+        cmd.slideNumber >= 1
+          ? cmd.slideNumber - 1
+          : cmd.slideIndex;
+      if (
+        typeof internalSlideIndex === "number" &&
+        Number.isFinite(internalSlideIndex) &&
+        internalSlideIndex >= 0
+      ) {
+        // Convert the internal zero-based value back to the 1-based
+        // ?slide=N URL param both the editor and presentation view read.
+        path += `?slide=${internalSlideIndex + 1}`;
       }
     }
 

package/corpus/templates/slides/app/pages/DeckEditor.tsx

@@ -1194,6 +1194,11 @@ export default function DeckEditor() {
         onDuplicateCurrentSlide={
           currentSlide ? () => duplicateSlide(id, currentSlide.id) : undefined
         }
+        onChangeSlideTransition={
+          canEdit && currentSlide
+            ? (transition) => updateSlide(id, currentSlide.id, { transition })
+            : undefined
+        }
       />
 
       {/* Full-width host for the slide's contextual style toolbar: it spans the
@@ -1312,6 +1317,10 @@ export default function DeckEditor() {
                   }
                   textBoxMode={textBoxMode}
                   onToggleTextBoxMode={toggleTextBoxMode}
+                  slideTransition={currentSlide.transition}
+                  onChangeSlideTransition={(transition) =>
+                    updateSlide(id, currentSlide.id, { transition })
+                  }
                 />
               ) : undefined
             }

package/corpus/templates/slides/changelog/2026-08-13-clicking-a-slide-thumbnail-now-focuses-it-so-the-slide-shortc.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-13
+---
+
+Clicking a slide thumbnail now focuses it, so the slide copy, paste, and delete shortcuts work after a plain click

package/corpus/templates/slides/changelog/2026-08-13-duplicating-or-restoring-a-slide-now-keeps-its-transition-ani.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-13
+---
+
+Duplicating or undoing the deletion of a slide now keeps its transition, animations, and image data after reload

package/corpus/templates/slides/changelog/2026-08-13-opening-presentation-mode-from-the-agent-now-starts-on-the-re.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-13
+---
+
+Opening presentation mode from the agent now starts on the requested slide instead of the first one

package/corpus/templates/slides/changelog/2026-08-13-slide-transitions-can-be-set-from-a-visible-control-in-the-sl.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-08-13
+---
+
+Slide transitions can be set from a visible control in the slide toolbar instead of being agent-only

package/dist/a2a/audience.d.ts

@@ -0,0 +1,2 @@
+/** Canonical receiver identifier used by both A2A token issuers and verifiers. */
+export declare function canonicalA2AAudience(rawUrl: string, receiverBasePath?: string): string;

package/dist/a2a/audience.js

@@ -0,0 +1,23 @@
+function normalizePathname(pathname, stripEndpoint) {
+    const normalized = pathname.startsWith("/") ? pathname : `/${pathname}`;
+    const withoutTrailingSlashes = normalized.replace(/\/+$/, "");
+    const withoutEndpoint = stripEndpoint
+        ? withoutTrailingSlashes.endsWith("/_agent-native/a2a")
+            ? withoutTrailingSlashes.slice(0, -"/_agent-native/a2a".length)
+            : withoutTrailingSlashes.endsWith("/a2a")
+                ? withoutTrailingSlashes.slice(0, -"/a2a".length)
+                : withoutTrailingSlashes
+        : withoutTrailingSlashes;
+    return withoutEndpoint === "" ? "/" : withoutEndpoint;
+}
+/** Canonical receiver identifier used by both A2A token issuers and verifiers. */
+export function canonicalA2AAudience(rawUrl, receiverBasePath) {
+    try {
+        const url = new URL(rawUrl);
+        const pathname = normalizePathname(receiverBasePath ?? url.pathname, receiverBasePath === undefined);
+        return pathname === "/" ? url.origin : `${url.origin}${pathname}`;
+    }
+    catch {
+        return rawUrl.replace(/\/+$/, "");
+    }
+}

package/dist/a2a/client.d.ts

@@ -62,6 +62,10 @@ export declare class A2AClient {
      * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.
      */
     resolveEndpoint(): Promise<void>;
+    /** Resolve the card-advertised endpoint without sending an RPC request. */
+    resolveEndpointUrl(timeoutMs?: number): Promise<string>;
+    /** Replace caller credentials without discarding resolved endpoint fallbacks. */
+    setAuthentication(apiKey?: string, fallbackApiKeys?: string[]): void;
     private headers;
     private markApiKeySucceeded;
     private rpc;

package/dist/a2a/client.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import * as jose from "jose";
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
+import { canonicalA2AAudience } from "./audience.js";
 /**
  * A workspace serves every app from one gateway on loopback, so sibling A2A
  * targets are private addresses by construction and the SSRF guard cannot tell
@@ -185,6 +186,19 @@ export class A2AClient {
             }
         }
     }
+    /** Resolve the card-advertised endpoint without sending an RPC request. */
+    async resolveEndpointUrl(timeoutMs) {
+        await this.ensureEndpointCandidates(timeoutMs);
+        const endpoint = this.endpointCandidates[0];
+        if (!endpoint)
+            throw new Error("No A2A endpoint candidates available");
+        return endpoint;
+    }
+    /** Replace caller credentials without discarding resolved endpoint fallbacks. */
+    setAuthentication(apiKey, fallbackApiKeys = []) {
+        this.apiKey = apiKey;
+        this.apiKeyAttempts = uniqueAuthTokens([apiKey, ...fallbackApiKeys]);
+    }
     headers(apiKey = this.apiKey) {
         const h = { "Content-Type": "application/json" };
         if (apiKey) {
@@ -823,14 +837,27 @@ export async function callAction(url, action, input = {}, opts) {
     if (!input || typeof input !== "object" || Array.isArray(input)) {
         throw new Error("A2A action input must be an object");
     }
-    const apiKeyAttempts = await buildA2AApiKeyAttempts(opts, normalizeA2AAudience(url));
-    const fallbackApiKeys = apiKeyAttempts
+    const discoveryAudience = normalizeA2AAudience(url);
+    const discoveryApiKeyAttempts = await buildA2AApiKeyAttempts(opts, discoveryAudience);
+    const discoveryFallbackApiKeys = discoveryApiKeyAttempts
         .slice(1)
         .filter((token) => token !== undefined);
-    const client = new A2AClient(url, apiKeyAttempts[0], {
-        fallbackApiKeys,
+    const client = new A2AClient(url, discoveryApiKeyAttempts[0], {
+        fallbackApiKeys: discoveryFallbackApiKeys,
         requestTimeoutMs: opts?.requestTimeoutMs,
     });
+    const endpointUrl = await client.resolveEndpointUrl(opts?.requestTimeoutMs);
+    const invocationAudience = normalizeA2AAudience(endpointUrl);
+    if (invocationAudience !== discoveryAudience) {
+        const invocationApiKeyAttempts = await buildA2AApiKeyAttempts(opts, invocationAudience);
+        const combinedApiKeyAttempts = uniqueAuthTokens([
+            ...invocationApiKeyAttempts,
+            ...discoveryApiKeyAttempts,
+        ]);
+        client.setAuthentication(combinedApiKeyAttempts[0], combinedApiKeyAttempts
+            .slice(1)
+            .filter((token) => token !== undefined));
+    }
     return client.invokeAction(actionName, input, {
         metadata: sanitizeA2ACorrelationMetadata(opts?.correlation),
     });
@@ -876,16 +903,7 @@ async function buildA2AApiKeyAttempts(opts, audience) {
 function normalizeA2AAudience(url) {
     const explicit = splitExplicitA2AEndpoint(url.replace(/\/$/, ""));
     const base = (explicit?.baseUrl ?? url).replace(/\/$/, "");
-    // Receivers derive their expected audience from APP_URL, which carries no
-    // app path. In a workspace every app is mounted under one gateway origin, so
-    // signing the path-qualified URL yields an audience the receiver can never
-    // match. The origin is the identifier both sides agree on.
-    try {
-        return new URL(base).origin;
-    }
-    catch {
-        return base;
-    }
+    return canonicalA2AAudience(base);
 }
 function isA2AAuthRejection(err) {
     const message = err instanceof Error ? err.message : String(err ?? "");

package/dist/a2a/server.d.ts

@@ -1,4 +1,4 @@
-import type { A2AConfig } from "./types.js";
+import type { A2AConfig, AgentSkill } from "./types.js";
 /**
  * Result of verifying an inbound A2A JWT. `email` is the caller identity from
  * the token's `sub` claim (null when verification fails), `orgDomain` mirrors
@@ -21,9 +21,14 @@ export interface A2ATokenPayload {
  * Exported so workspaces can accept A2A callers on the HTTP action route with
  * the same routine — including org-level fallback secrets — instead of
  * reimplementing a partial verifier. Pass the H3 `event` to enable org-domain →
- * org-secret lookup and audience derivation; it is optional.
+ * org-secret lookup and audience derivation; it is optional. A custom mounted
+ * JSON-RPC route also passes its prefix so endpoint-bound tokens verify against
+ * the same audience the client derived from the advertised URL.
  */
-export declare function verifyA2AToken(token: string, event?: any): Promise<A2ATokenPayload>;
+export declare function verifyA2AToken(token: string, event?: any, audienceOptions?: {
+    routePrefix?: string;
+    allowBaseAudience?: boolean;
+}): Promise<A2ATokenPayload>;
 /**
  * Mount A2A protocol endpoints on an H3/Nitro app.
  *
@@ -35,4 +40,4 @@ export declare function verifyA2AToken(token: string, event?: any): Promise<A2AT
  * cryptographic identity verification for cross-app A2A calls.
  */
 export declare function mountA2A(nitroApp: any, config: A2AConfig, routePrefix?: string): void;
-export declare function filterPublicAgentCardSkills(config: A2AConfig): import("./types.js").AgentSkill[];
+export declare function filterPublicAgentCardSkills(config: A2AConfig): AgentSkill[];

package/dist/a2a/server.js

@@ -6,6 +6,7 @@ import { getH3App } from "../server/framework-request-handler.js";
 import { readBody } from "../server/h3-helpers.js";
 import { isSameOriginRequest } from "../server/request-origin.js";
 import { generateAgentCard } from "./agent-card.js";
+import { canonicalA2AAudience } from "./audience.js";
 import { hasConfiguredA2ASecret, isA2AProductionRuntime, } from "./auth-policy.js";
 import { handleJsonRpcH3, processA2ATaskFromQueue } from "./handlers.js";
 import { claimA2AApproval, getA2AApprovalForOwner, settleA2AApproval, } from "./task-store.js";
@@ -39,25 +40,46 @@ function addSecretCandidate(candidates, secret) {
  * service must not verify here). Only tokens without an `aud` claim (minted
  * before the audience claim shipped) skip the audience check.
  */
-function expectedJwtAudience(event) {
+function expectedJwtAudience(event, options) {
     const fromEnv = process.env.APP_URL ||
         process.env.URL ||
         process.env.DEPLOY_URL ||
         process.env.BETTER_AUTH_URL;
-    if (fromEnv)
-        return String(fromEnv).replace(/\/$/, "");
+    const receiverBasePath = process.env.APP_BASE_PATH;
+    if (fromEnv) {
+        return audienceForRoute(canonicalA2AAudience(String(fromEnv), receiverBasePath), options);
+    }
     // Best-effort: derive from the inbound request host. This is forgeable
     // (Host-header attack), but only useful as a hint when env-derived URL
     // is unset; the rest of the JWT verification still uses the secret.
     try {
         const proto = getRequestHeader(event, "x-forwarded-proto") || "https";
         const host = getRequestHeader(event, "host");
-        if (host)
-            return `${proto}://${host}`;
+        if (host) {
+            return audienceForRoute(canonicalA2AAudience(`${proto}://${host}`, receiverBasePath), options);
+        }
+        // coercion-ok: undefined makes audience-bearing token verification fail closed.
     }
     catch { }
     return undefined;
 }
+function audienceForRoute(baseAudience, options) {
+    const trimmedPrefix = options?.routePrefix?.replace(/^\/+|\/+$/g, "");
+    if (!trimmedPrefix || trimmedPrefix === "_agent-native")
+        return baseAudience;
+    const normalizedPrefix = `/${trimmedPrefix}`;
+    const routeAudience = `${baseAudience.replace(/\/+$/, "")}${normalizedPrefix}`;
+    return options?.allowBaseAudience
+        ? [routeAudience, baseAudience]
+        : routeAudience;
+}
+function tokenHasAudienceClaim(token) {
+    return typeof jose.decodeJwt(token).aud !== "undefined";
+}
+function isDirectReadSkill(skill) {
+    return (skill.readOnly === true ||
+        (skill.readOnly === undefined && skill.publicAgent?.readOnly === true));
+}
 /**
  * Verify an inbound A2A bearer token (HS256) exactly as the
  * `/_agent-native/a2a` endpoint does: it peeks at the unverified `org_domain`
@@ -71,9 +93,11 @@ function expectedJwtAudience(event) {
  * Exported so workspaces can accept A2A callers on the HTTP action route with
  * the same routine — including org-level fallback secrets — instead of
  * reimplementing a partial verifier. Pass the H3 `event` to enable org-domain →
- * org-secret lookup and audience derivation; it is optional.
+ * org-secret lookup and audience derivation; it is optional. A custom mounted
+ * JSON-RPC route also passes its prefix so endpoint-bound tokens verify against
+ * the same audience the client derived from the advertised URL.
  */
-export async function verifyA2AToken(token, event) {
+export async function verifyA2AToken(token, event, audienceOptions) {
     // Step 1: Peek at JWT claims WITHOUT verification to get org_domain.
     // This is safe because we only use org_domain to look up the secret,
     // then verify the full JWT with that secret. If someone forges a JWT
@@ -129,7 +153,7 @@ export async function verifyA2AToken(token, event) {
             // whose `aud` targets ANOTHER service verify against a shared secret. A
             // token that self-declares an audience must be checked against ours, so
             // when we have nothing to check it against we reject rather than skip.
-            const aud = expectedJwtAudience(event);
+            const aud = expectedJwtAudience(event, audienceOptions);
             if (!aud)
                 return { email: null, orgDomain: null };
             verifyOptions.audience = aud;
@@ -187,19 +211,26 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
         const host = getRequestHeader(event, "host") ?? "localhost";
         const baseUrl = `${protocol}://${host}`;
         // The anonymous card may only advertise actions safe to disclose
-        // publicly (`requiresAuth !== true`), but `actions/invoke` only ever
-        // runs the opposite set (`requiresAuth === true`). Those are disjoint,
-        // so an unauthenticated card said "no directly callable actions" about
-        // an app whose actions a verified sibling can call — and callers fell
-        // back to open-ended delegation. Show a verified caller what it can
-        // actually invoke; anonymous fetches keep the public list unchanged.
+        // publicly (`requiresAuth !== true`). A verified caller instead sees the
+        // authenticated surface: schemas for direct read invocation plus concise
+        // message-only capabilities for writes owned by the receiving agent.
+        // Anonymous fetches keep the public list unchanged.
         let skills = filterPublicAgentCardSkills(config);
         if (config.authenticatedSkills?.length) {
             const bearer = extractBearerToken(getRequestHeader(event, "authorization"));
             if (bearer) {
-                const payload = await verifyA2AToken(bearer, event);
-                if (payload.email)
-                    skills = config.authenticatedSkills;
+                const payload = await verifyA2AToken(bearer, event, {
+                    routePrefix,
+                    // Capability discovery may begin from either the app URL or an
+                    // already-advertised endpoint URL. Both identify this receiver;
+                    // direct POST invocation below remains endpoint-bound.
+                    allowBaseAudience: true,
+                });
+                if (payload.email) {
+                    skills = tokenHasAudienceClaim(bearer)
+                        ? config.authenticatedSkills
+                        : config.authenticatedSkills.filter((skill) => !isDirectReadSkill(skill));
+                }
             }
         }
         return generateAgentCard({ ...config, skills }, baseUrl, `${routePrefix}/a2a`);
@@ -372,17 +403,13 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
         const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);
         // Try JWT verification first (org-level or global A2A_SECRET-based identity)
         if (bearerToken) {
-            const tokenPayload = await verifyA2AToken(bearerToken, event);
+            const tokenPayload = await verifyA2AToken(bearerToken, event, {
+                routePrefix,
+            });
             verifiedCallerEmail = tokenPayload.email;
             verifiedOrgDomain = tokenPayload.orgDomain;
             if (verifiedCallerEmail) {
-                try {
-                    verifiedAudienceBound =
-                        typeof jose.decodeJwt(bearerToken).aud !== "undefined";
-                }
-                catch {
-                    verifiedAudienceBound = false;
-                }
+                verifiedAudienceBound = tokenHasAudienceClaim(bearerToken);
             }
             bearerTokenRejectedByJwt = !verifiedCallerEmail;
         }