@agent-native/core 0.154.1 → 0.154.3

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 8205
+- template files: 8208

package/corpus/templates/analytics/changelog/2026-08-12-feature-flags-can-be-managed-across-apps-whose-workspace-rec.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-12
+---
+
+Feature flags can be managed across apps whose workspace records use different local IDs

package/corpus/templates/analytics/changelog/2026-08-12-kept-feature-flag-details-readable-by-stacking-rollout-contr.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-12
+---
+
+Kept feature flag details readable by stacking rollout controls at narrow widths.

package/corpus/templates/analytics/scripts/preview-dashboard-report.ts

@@ -19,7 +19,8 @@
  */
 
 import { mkdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import path, { join } from "node:path";
+import { pathToFileURL } from "node:url";
 
 import { runWithRequestContext } from "@agent-native/core/server/request-context";
 import { eq } from "drizzle-orm";
@@ -215,7 +216,17 @@ async function renderPreview(
   if (rendered.degradedPanelIds.length) process.exitCode = 1;
 }
 
-main().catch((err) => {
-  console.error("[preview] failed:", err);
-  process.exit(1);
-});
+function isDirectRun(): boolean {
+  const entrypoint = process.argv[1];
+  return Boolean(
+    entrypoint &&
+    import.meta.url === pathToFileURL(path.resolve(entrypoint)).href,
+  );
+}
+
+if (isDirectRun()) {
+  main().catch((err) => {
+    console.error("[preview] failed:", err);
+    process.exit(1);
+  });
+}

package/corpus/templates/analytics/server/lib/workspace-feature-flags.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 
 import { signA2AToken } from "@agent-native/core/a2a";
 import { fetchOrgApps, type OrgApp } from "@agent-native/core/mcp";
+import { getOrgDomain } from "@agent-native/core/org";
 
 import type { AnalyticsAdminContext } from "./db-admin-connections.js";
 
@@ -31,11 +32,11 @@ export interface WorkspaceFeatureFlagsResult {
 }
 
 export interface WorkspaceFeatureFlagMutationResult {
-  contractVersion: 1;
+  contractVersion: 2;
   status: "ready";
   key: string;
   rules: Record<string, unknown>;
-  scope: { orgId: string | null };
+  scope: { orgId: string | null; orgDomain: string | null };
 }
 
 export interface WorkspaceFeatureFlagMutationInput {
@@ -66,14 +67,14 @@ export function validateWorkspaceFeatureFlagMutation(
   body: unknown,
   expected: {
     key: string;
-    orgId: string;
+    orgDomain: string;
     rules?: Record<string, unknown>;
     enabledForEmail?: string;
   },
 ): WorkspaceFeatureFlagMutationResult {
   const payload = body as Partial<WorkspaceFeatureFlagMutationResult> | null;
   const valid =
-    payload?.contractVersion === 1 &&
+    payload?.contractVersion === 2 &&
     payload.status === "ready" &&
     payload.key === expected.key &&
     !!payload.rules &&
@@ -81,7 +82,7 @@ export function validateWorkspaceFeatureFlagMutation(
     !Array.isArray(payload.rules) &&
     !!payload.scope &&
     typeof payload.scope === "object" &&
-    payload.scope.orgId === expected.orgId;
+    payload.scope.orgDomain === expected.orgDomain;
   if (!valid)
     throw new Error(
       "The target app returned an unsupported or unverified feature flag mutation response.",
@@ -152,13 +153,43 @@ async function delegatedToken(
   admin: AnalyticsAdminContext,
   origin: string,
   scope: "flags:read" | "flags:write",
+  resolvedOrgDomain?: string,
 ): Promise<string> {
-  return signA2AToken(admin.userEmail, undefined, undefined, {
-    expiresIn: "120s",
-    preferGlobalSecret: true,
-    audience: origin,
-    extraClaims: { org_id: admin.orgId, scope, jti: randomUUID() },
-  });
+  try {
+    const orgDomain =
+      resolvedOrgDomain ??
+      (await getOrgDomain(admin.orgId))?.trim().toLowerCase();
+    if (!orgDomain) throw new TargetCallFailure("token-generation");
+    return await signA2AToken(admin.userEmail, orgDomain, undefined, {
+      expiresIn: "120s",
+      preferGlobalSecret: true,
+      audience: origin,
+      extraClaims: { org_id: admin.orgId, scope, jti: randomUUID() },
+    });
+  } catch {
+    throw new TargetCallFailure("token-generation");
+  }
+}
+
+type TargetFailureReason = "token-generation" | "timeout" | "network";
+
+class TargetCallFailure extends Error {
+  constructor(readonly reason: TargetFailureReason) {
+    super(`Feature flag target call failed: ${reason}`);
+    this.name = "TargetCallFailure";
+  }
+}
+
+export function classifyWorkspaceFeatureFlagTargetFailure(
+  error: unknown,
+): TargetFailureReason {
+  if (error instanceof TargetCallFailure) return error.reason;
+  if (
+    error instanceof Error &&
+    (error.name === "TimeoutError" || error.name === "AbortError")
+  )
+    return "timeout";
+  return "network";
 }
 
 async function callTarget(
@@ -166,25 +197,34 @@ async function callTarget(
   admin: AnalyticsAdminContext,
   action: "list-feature-flags" | "set-feature-flag",
   body: Record<string, unknown>,
+  orgDomain?: string,
 ): Promise<{ status: number; body: unknown }> {
   const origin = targetOrigin(app);
   const token = await delegatedToken(
     admin,
     origin,
     action === "list-feature-flags" ? "flags:read" : "flags:write",
+    orgDomain,
   );
-  const response = await fetch(`${origin}/_agent-native/actions/${action}`, {
-    method: action === "list-feature-flags" ? "GET" : "POST",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      Accept: "application/json",
-      ...(action === "set-feature-flag"
-        ? { "Content-Type": "application/json" }
-        : {}),
-    },
-    ...(action === "set-feature-flag" ? { body: JSON.stringify(body) } : {}),
-    signal: AbortSignal.timeout(TARGET_TIMEOUT_MS),
-  });
+  let response: Response;
+  try {
+    response = await fetch(`${origin}/_agent-native/actions/${action}`, {
+      method: action === "list-feature-flags" ? "GET" : "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        ...(action === "set-feature-flag"
+          ? { "Content-Type": "application/json" }
+          : {}),
+      },
+      ...(action === "set-feature-flag" ? { body: JSON.stringify(body) } : {}),
+      signal: AbortSignal.timeout(TARGET_TIMEOUT_MS),
+    });
+  } catch (error) {
+    throw new TargetCallFailure(
+      classifyWorkspaceFeatureFlagTargetFailure(error),
+    );
+  }
   let parsed: unknown = null;
   try {
     parsed = await response.json();
@@ -209,7 +249,7 @@ export function classifyWorkspaceFeatureFlagList(
   if (result.status === 404 || result.status === 405)
     return { ...base, state: "unsupported" };
   if (result.status < 200 || result.status >= 300)
-    return { ...base, state: "unknown-legacy" };
+    return { ...base, state: "unknown-legacy", reason: "target-execution" };
   const payload = result.body as {
     flags?: unknown;
     canManage?: unknown;
@@ -254,7 +294,11 @@ async function mapBounded<T, R>(
 export async function listWorkspaceFeatureFlags(
   admin: AnalyticsAdminContext,
 ): Promise<WorkspaceFeatureFlagsResult> {
-  const apps = await fetchOrgApps({ serviceOrgId: admin.orgId });
+  const apps = await fetchOrgApps({
+    selfId: "analytics",
+    includeDirectoryApp: true,
+    serviceOrgId: admin.orgId,
+  });
   if (apps.length === 0) return { directoryStatus: "unavailable", apps: [] };
   const entries = await mapBounded(apps, async (app) => {
     try {
@@ -262,13 +306,14 @@ export async function listWorkspaceFeatureFlags(
         app,
         await callTarget(app, admin, "list-feature-flags", {}),
       );
-    } catch {
+    } catch (error) {
       return {
         appId: app.id,
         appName: app.name,
         appOrigin: targetOrigin(app),
         state: "unreachable" as const,
         flags: [],
+        reason: classifyWorkspaceFeatureFlagTargetFailure(error),
       };
     }
   });
@@ -279,14 +324,31 @@ export async function setWorkspaceFeatureFlag(
   admin: AnalyticsAdminContext,
   input: WorkspaceFeatureFlagMutationInput,
 ): Promise<WorkspaceFeatureFlagMutationResult> {
-  const apps = await fetchOrgApps({ serviceOrgId: admin.orgId });
+  const apps = await fetchOrgApps({
+    selfId: "analytics",
+    includeDirectoryApp: true,
+    serviceOrgId: admin.orgId,
+  });
   const app = apps.find((candidate) => candidate.id === input.appId);
   if (!app)
     throw new Error(
       "The requested app is not available in this organization directory.",
     );
   const targetInput = workspaceFeatureFlagTargetInput(input);
-  const result = await callTarget(app, admin, "set-feature-flag", targetInput);
+  let orgDomain: string | undefined;
+  try {
+    orgDomain = (await getOrgDomain(admin.orgId))?.trim().toLowerCase();
+  } catch {
+    throw new TargetCallFailure("token-generation");
+  }
+  if (!orgDomain) throw new TargetCallFailure("token-generation");
+  const result = await callTarget(
+    app,
+    admin,
+    "set-feature-flag",
+    targetInput,
+    orgDomain,
+  );
   if (result.status === 401 || result.status === 403)
     throw new Error("The target app denied this delegated flag operation.");
   if (result.status === 404 || result.status === 405)
@@ -297,7 +359,7 @@ export async function setWorkspaceFeatureFlag(
     );
   return validateWorkspaceFeatureFlagMutation(result.body, {
     key: input.key,
-    orgId: admin.orgId,
+    orgDomain,
     ...(input.operation === "replace-rules" && input.rules
       ? {
           rules: {
@@ -324,7 +386,11 @@ export async function getWorkspaceFlagTarget(
   admin: AnalyticsAdminContext,
   appId: string,
 ): Promise<FleetFlagApp> {
-  const apps = await fetchOrgApps({ serviceOrgId: admin.orgId });
+  const apps = await fetchOrgApps({
+    selfId: "analytics",
+    includeDirectoryApp: true,
+    serviceOrgId: admin.orgId,
+  });
   const app = apps.find((candidate) => candidate.id === appId);
   if (!app)
     throw new Error(
@@ -335,13 +401,14 @@ export async function getWorkspaceFlagTarget(
       app,
       await callTarget(app, admin, "list-feature-flags", {}),
     );
-  } catch {
+  } catch (error) {
     return {
       appId: app.id,
       appName: app.name,
       appOrigin: targetOrigin(app),
       state: "unreachable",
       flags: [],
+      reason: classifyWorkspaceFeatureFlagTargetFailure(error),
     };
   }
 }

package/corpus/templates/dispatch/changelog/2026-08-12-dispatch-now-appears-in-authorized-workspace-app-directories.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-12
+---
+
+Dispatch now appears in authorized workspace app directories for fleet-wide administration

package/corpus/templates/dispatch/server/lib/org-apps-directory.ts

@@ -278,14 +278,13 @@ export interface DiscoveredAppLike {
 
 /**
  * Shape the discovered-agent list into the directory response. The input is
- * Dispatch's EXISTING connected-apps registry — `discoverAgents("dispatch")`
+ * Dispatch's EXISTING connected-apps registry — `discoverAgents()`
  * from `@agent-native/core/server/agent-discovery`, the same source
  * `list-connected-agents` and the `call-agent` delegation path use. It is
  * already allow-list-respecting (hidden first-party templates are excluded
  * from `BUILTIN_AGENTS` unless `defaultAgent`), so no second filter is
- * needed here; we only drop entries without a usable absolute http(s) URL
- * and Dispatch itself (a caller does not need to discover the directory it
- * just called).
+ * needed here; we only drop entries without a usable absolute http(s) URL.
+ * Callers that identify themselves may also request self-filtering.
  */
 export function buildOrgAppsResponse(input: {
   org: string;

package/corpus/templates/dispatch/server/plugins/org-apps-directory.ts

@@ -24,7 +24,7 @@
  *
  * APP-LIST SOURCE — Dispatch's existing connected-apps registry.
  * -------------------------------------------------------------
- * Dispatch already has a connected-apps concept: `discoverAgents("dispatch")`
+ * Dispatch already has a connected-apps concept: `discoverAgents()`
  * from `@agent-native/core/server/agent-discovery` (the same source
  * `list-connected-agents` and the `call-agent` delegation path use). It
  * returns the allow-listed first-party apps with their prod URLs PLUS any
@@ -143,7 +143,16 @@ const orgAppsHandler = defineEventHandler(
     const apps: DiscoveredAppLike[] = await runWithRequestContext(
       { userEmail: verified.email, orgId: localOrg.orgId },
       async () => {
-        const discovered = await discoverAgents(SELF_APP_ID);
+        const includeDirectoryApp =
+          getRequestHeader(event, "x-agent-native-include-directory-app") ===
+          "1";
+        const discovered = await discoverAgents(
+          includeDirectoryApp ? undefined : SELF_APP_ID,
+          {
+            preferLocalUrls:
+              process.env.AGENT_NATIVE_PREFER_LOCAL_APP_URLS === "1",
+          },
+        );
         return discovered.map((a) => ({
           id: a.id,
           name: a.name,
@@ -165,7 +174,10 @@ const orgAppsHandler = defineEventHandler(
     const body = buildOrgAppsResponse({
       org: orgLabel,
       apps,
-      selfId: SELF_APP_ID,
+      selfId:
+        getRequestHeader(event, "x-agent-native-include-directory-app") === "1"
+          ? undefined
+          : SELF_APP_ID,
     });
 
     // Short, cacheable, read-only. Private (per-org) so shared caches must

package/dist/a2a-claims.d.ts

@@ -1,6 +1,7 @@
 export interface VerifiedA2AClaims {
     email: string;
     orgId: string;
+    orgDomain: string;
     jti: string;
     issuer?: string;
     scope: string[];

package/dist/a2a-claims.js

@@ -24,10 +24,12 @@ export async function verifyA2ATokenWithClaims(token, event) {
             ? raw.scope.split(/\s+/).filter(Boolean)
             : [];
         const issuer = typeof raw.iss === "string" ? raw.iss.trim() : "";
-        return orgId && jti
+        const orgDomain = identity.orgDomain?.trim().toLowerCase() ?? "";
+        return orgId && orgDomain && jti
             ? {
                 email: identity.email,
                 orgId,
+                orgDomain,
                 jti,
                 ...(issuer ? { issuer } : {}),
                 scope: scopes,

package/dist/cli/create.js

@@ -81,6 +81,7 @@ const FIRST_PARTY_TARBALL_SYMLINK_EXCLUDES = [
     "*/CLAUDE.md",
     "*/.claude/skills",
 ];
+const TAR_LISTING_MAX_BUFFER = 100 * 1024 * 1024;
 const localPackageTarballs = new Map();
 /** VCS/editor files that don't count as "not empty" for an in-place scaffold. */
 const IN_PLACE_ALLOWLIST = new Set([
@@ -1737,6 +1738,7 @@ function archiveSymlinksForExtraction(tarPath) {
     const listing = execFileSync("tar", ["tvzf", tarPath], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"],
+        maxBuffer: TAR_LISTING_MAX_BUFFER,
     });
     return listing.split(/\r?\n/).flatMap((line) => {
         if (!line.startsWith("l"))
@@ -1866,6 +1868,7 @@ function validateCommunityArchive(tarPath) {
     const listing = execFileSync("tar", ["tvzf", tarPath], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"],
+        maxBuffer: TAR_LISTING_MAX_BUFFER,
     });
     assertSafeCommunityArchiveListing(listing);
 }

package/dist/client/feature-flags/FeatureFlagsPanel.js

@@ -117,9 +117,9 @@ function FeatureFlagRow({ flag, onMutate, isPending, error, }) {
     const actor = formatActor(flag.rules.updatedBy);
     const when = formatWhen(flag.rules.updatedAt);
     const metadata = [actor, when].filter(Boolean).join(" · ");
-    return (_jsxs("article", { id: `feature-flag-${flag.key}`, className: "grid gap-4 scroll-mt-24 border-b border-border py-5 last:border-b-0 md:grid-cols-[minmax(0,1fr)_auto] md:items-center", children: [_jsxs("div", { className: "min-w-0", children: [_jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [_jsx("h3", { className: "truncate text-sm font-medium text-foreground", children: flag.displayName ?? flag.key }), flag.displayName && flag.displayName !== flag.key ? (_jsx("code", { className: "truncate text-xs text-muted-foreground", children: flag.key })) : null, _jsx(Badge, { variant: flag.rules.mode === "on" ? "secondary" : "outline", className: "ms-auto shrink-0", children: modeLabel(flag.rules, t) })] }), flag.description ? (_jsx("p", { className: "mt-1 text-sm text-muted-foreground", children: flag.description })) : null, _jsxs("div", { className: "mt-3 flex flex-wrap gap-x-3 gap-y-1 text-xs text-muted-foreground", children: [_jsxs("span", { children: [t("featureFlags.enabledFor"), ": ", audienceLabel(flag.rules, t)] }), metadata ? (_jsx("span", { children: t("featureFlags.lastChanged", { metadata }) })) : null] }), _jsx("div", { className: "mt-2 flex items-center gap-1.5 text-xs font-medium text-foreground", children: flag.enabledForCurrentUser === true ? (_jsxs(_Fragment, { children: [_jsx(IconCheck, { className: "size-4 text-emerald-500" }), t("featureFlags.youHaveAccess")] })) : flag.enabledForCurrentUser === false ? (_jsx(_Fragment, { children: t("featureFlags.youDoNotHaveAccess") })) : (_jsx(_Fragment, { children: t("featureFlags.currentUserUnknown") })) }), error ? (_jsx("p", { className: "mt-3 text-sm text-destructive", children: t("featureFlags.mutationUnverified", {
+    return (_jsxs("article", { id: `feature-flag-${flag.key}`, className: "grid gap-4 scroll-mt-24 border-b border-border py-5 last:border-b-0 lg:grid-cols-[minmax(0,1fr)_auto] lg:items-center", children: [_jsxs("div", { className: "min-w-0", children: [_jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [_jsx("h3", { className: "truncate text-sm font-medium text-foreground", children: flag.displayName ?? flag.key }), flag.displayName && flag.displayName !== flag.key ? (_jsx("code", { className: "truncate text-xs text-muted-foreground", children: flag.key })) : null, _jsx(Badge, { variant: flag.rules.mode === "on" ? "secondary" : "outline", className: "ms-auto shrink-0", children: modeLabel(flag.rules, t) })] }), flag.description ? (_jsx("p", { className: "mt-1 text-sm text-muted-foreground", children: flag.description })) : null, _jsxs("div", { className: "mt-3 flex flex-wrap gap-x-3 gap-y-1 text-xs text-muted-foreground", children: [_jsxs("span", { children: [t("featureFlags.enabledFor"), ": ", audienceLabel(flag.rules, t)] }), metadata ? (_jsx("span", { children: t("featureFlags.lastChanged", { metadata }) })) : null] }), _jsx("div", { className: "mt-2 flex items-center gap-1.5 text-xs font-medium text-foreground", children: flag.enabledForCurrentUser === true ? (_jsxs(_Fragment, { children: [_jsx(IconCheck, { className: "size-4 text-emerald-500" }), t("featureFlags.youHaveAccess")] })) : flag.enabledForCurrentUser === false ? (_jsx(_Fragment, { children: t("featureFlags.youDoNotHaveAccess") })) : (_jsx(_Fragment, { children: t("featureFlags.currentUserUnknown") })) }), error ? (_jsx("p", { className: "mt-3 text-sm text-destructive", children: t("featureFlags.mutationUnverified", {
                             name: flag.displayName ?? flag.key,
-                        }) })) : null] }), _jsxs("div", { className: "flex flex-wrap items-center gap-2 md:justify-end", children: [_jsxs(Button, { type: "button", variant: "outline", size: "sm", className: "text-xs", disabled: isPending || flag.enabledForCurrentUser === true, onClick: () => onMutate({
+                        }) })) : null] }), _jsxs("div", { className: "flex flex-wrap items-center gap-2 lg:justify-end", children: [_jsxs(Button, { type: "button", variant: "outline", size: "sm", className: "text-xs", disabled: isPending || flag.enabledForCurrentUser === true, onClick: () => onMutate({
                             key: flag.key,
                             operation: "enable-for-current-user",
                         }), children: [flag.enabledForCurrentUser === true ? (_jsx(IconCheck, {})) : (_jsx(IconUserCheck, {})), flag.enabledForCurrentUser === true

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/feature-flags/a2a-action-route.js

@@ -1,6 +1,8 @@
 import { getHeader } from "h3";
 import * as jose from "jose";
 import { verifyA2ATokenWithClaims } from "../a2a-claims.js";
+import { resolveOrgByDomain } from "../org/context.js";
+import { consumeOneTimeJti } from "../server/identity-sso-store.js";
 const FLAG_ACTION_SCOPES = {
     "list-feature-flags": "flags:read",
     "set-feature-flag": "flags:write",
@@ -37,9 +39,16 @@ export function createFeatureFlagA2AActionRouteAuth(actionName) {
             if (!claims || !claims.scope.includes(FLAG_ACTION_SCOPES[actionName])) {
                 throw new Error("Invalid feature flag delegation");
             }
+            const localOrg = await resolveOrgByDomain(claims.orgDomain);
+            if (!localOrg)
+                throw new Error("Invalid feature flag delegation");
+            if (actionName === "set-feature-flag" &&
+                (await consumeOneTimeJti(claims.jti))) {
+                throw new Error("Invalid feature flag delegation");
+            }
             return {
                 owner: claims.email,
-                orgId: claims.orgId,
+                orgId: localOrg.orgId,
                 anonymous: false,
                 delegationJti: claims.jti,
                 delegationIssuer: claims.issuer,

package/dist/feature-flags/actions/set-feature-flag.d.ts

@@ -14,12 +14,13 @@ declare const _default: import("../../action.js").ActionDefinition<{
         percentage?: number;
     };
 }, {
-    contractVersion: 1;
+    contractVersion: 2;
     status: "ready";
     key: string;
     rules: import("../store.js").FeatureFlagRules;
     scope: {
         orgId: string;
+        orgDomain: string;
     };
 }>;
 export default _default;

package/dist/feature-flags/actions/set-feature-flag.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { defineAction } from "../../action.js";
+import { getOrgDomain } from "../../org/context.js";
 import { requireFeatureFlagManager } from "../permissions.js";
 import { getFeatureFlagDefinition } from "../registry.js";
 import { defaultFeatureFlagRules, mutateFeatureFlagRules, normalizeFeatureFlagRules, } from "../store.js";
@@ -47,6 +48,12 @@ export default defineAction({
         if (!getFeatureFlagDefinition(args.key)) {
             throw new Error(`Unknown feature flag: ${args.key}`);
         }
+        const orgDomain = manager.orgId
+            ? (await getOrgDomain(manager.orgId))?.trim().toLowerCase() || null
+            : null;
+        if (ctx?.caller === "a2a" && manager.orgId && !orgDomain) {
+            throw new Error("Feature flag organization domain is unavailable.");
+        }
         const persistedRules = await mutateFeatureFlagRules(args.key, manager, (current) => {
             let rules;
             if (args.operation === "off") {
@@ -67,11 +74,11 @@ export default defineAction({
             return { ...rules, updatedAt: Date.now(), updatedBy: manager.email };
         });
         return {
-            contractVersion: 1,
+            contractVersion: 2,
             status: "ready",
             key: args.key,
             rules: persistedRules,
-            scope: { orgId: manager.orgId },
+            scope: { orgId: manager.orgId, orgDomain },
         };
     },
 });

package/dist/mcp/org-directory.d.ts

@@ -71,11 +71,14 @@ export declare function resolveOrgDirectoryOrigin(env?: NodeJS.ProcessEnv): stri
  *
  * @param opts.selfId      Current app id (so it's stripped from the result).
  * @param opts.selfOrigin  Current app origin (so it's stripped by origin too).
+ * @param opts.includeDirectoryApp Request the directory authority itself. The
+ *   server keeps legacy self-filtering unless this explicit signal is present.
  * @param opts.env         Injectable env (tests). Defaults to `process.env`.
  */
 export declare function fetchOrgApps(opts?: {
     selfId?: string;
     selfOrigin?: string;
+    includeDirectoryApp?: boolean;
     serviceOrgId?: string;
     env?: NodeJS.ProcessEnv;
 }): Promise<OrgApp[]>;

package/dist/mcp/org-directory.js

@@ -109,18 +109,23 @@ function sameOrigin(a, b) {
         return a.replace(/\/+$/, "") === b.replace(/\/+$/, "");
     }
 }
-function scopedCacheKey(origin, auth) {
+function scopedCacheKey(origin, auth, includeDirectoryApp = false) {
     return [
         origin,
         `user:${auth.userEmail ?? ""}`,
         `org:${auth.orgId ?? auth.orgDomain ?? ""}`,
+        `include-directory:${includeDirectoryApp ? "1" : "0"}`,
     ].join("|");
 }
 function authTokenAttempts(auth) {
     return [auth.apiKey, ...(auth.apiKeyFallbacks ?? [])].filter((token) => typeof token === "string" && token.length > 0);
 }
-function serviceScopedCacheKey(origin, orgId) {
-    return [origin, `service-org:${orgId}`].join("|");
+function serviceScopedCacheKey(origin, orgId, includeDirectoryApp = false) {
+    return [
+        origin,
+        `service-org:${orgId}`,
+        `include-directory:${includeDirectoryApp ? "1" : "0"}`,
+    ].join("|");
 }
 /**
  * Fetch the org's first-party sibling apps from the org directory.
@@ -133,6 +138,8 @@ function serviceScopedCacheKey(origin, orgId) {
  *
  * @param opts.selfId      Current app id (so it's stripped from the result).
  * @param opts.selfOrigin  Current app origin (so it's stripped by origin too).
+ * @param opts.includeDirectoryApp Request the directory authority itself. The
+ *   server keeps legacy self-filtering unless this explicit signal is present.
  * @param opts.env         Injectable env (tests). Defaults to `process.env`.
  */
 export async function fetchOrgApps(opts) {
@@ -155,7 +162,7 @@ export async function fetchOrgApps(opts) {
     let ttl = EMPTY_TTL_MS;
     const serviceOrgId = opts?.serviceOrgId?.trim();
     if (serviceOrgId) {
-        const serviceCacheKey = serviceScopedCacheKey(origin, serviceOrgId);
+        const serviceCacheKey = serviceScopedCacheKey(origin, serviceOrgId, opts?.includeDirectoryApp);
         const cached = cache.get(serviceCacheKey);
         if (cached && cached.expiresAt > Date.now()) {
             return stripSelf(cached.apps);
@@ -174,7 +181,7 @@ export async function fetchOrgApps(opts) {
         }
         if (!cacheKey) {
             const now = Date.now();
-            cacheKey = scopedCacheKey(origin, auth);
+            cacheKey = scopedCacheKey(origin, auth, opts?.includeDirectoryApp);
             const cached = cache.get(cacheKey);
             if (cached && cached.expiresAt > now) {
                 return stripSelf(cached.apps);
@@ -186,6 +193,9 @@ export async function fetchOrgApps(opts) {
                 headers: {
                     Authorization: `Bearer ${attempts[i]}`,
                     Accept: "application/json",
+                    ...(opts?.includeDirectoryApp
+                        ? { "X-Agent-Native-Include-Directory-App": "1" }
+                        : {}),
                 },
                 signal: AbortSignal.timeout(4000),
             });

package/dist/notifications/routes.d.ts

@@ -28,6 +28,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
-    error?: undefined;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/action-routes.js

@@ -2,7 +2,7 @@ import { createError, defineEventHandler, setResponseStatus, setResponseHeader,
 import { verifyA2ATokenWithClaims } from "../a2a-claims.js";
 import { isAgentActionStopError } from "../action.js";
 import { declaresFeatureFlagDelegation } from "../feature-flags/a2a-action-route.js";
-import { resolveOrgIdForEmail } from "../org/context.js";
+import { resolveOrgByDomain, resolveOrgIdForEmail } from "../org/context.js";
 import { readBody } from "../server/h3-helpers.js";
 import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
 import { isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
@@ -12,6 +12,7 @@ import { captureError } from "./capture-error.js";
 import { getAllowedCorsOrigin as resolveAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
 import { resolveEmbedSessionFromRequest, resolvedEmbedCapabilityScope, } from "./embed-session.js";
 import { getHttpRequestTelemetryId } from "./http-response-telemetry.js";
+import { consumeOneTimeJti } from "./identity-sso-store.js";
 function requiredClientCompatibilityVersion() {
     const configured = typeof __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__ === "string"
         ? __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__
@@ -52,9 +53,16 @@ async function resolveFeatureFlagA2ACaller(event, actionName) {
     const claims = await verifyA2ATokenWithClaims(token, event);
     if (!claims || !claims.scope.includes(required))
         throw new Error("Invalid feature flag delegation");
+    const localOrg = await resolveOrgByDomain(claims.orgDomain);
+    if (!localOrg)
+        throw new Error("Invalid feature flag delegation");
+    if (actionName === "set-feature-flag" &&
+        (await consumeOneTimeJti(claims.jti))) {
+        throw new Error("Invalid feature flag delegation");
+    }
     return {
         owner: claims.email,
-        orgId: claims.orgId,
+        orgId: localOrg.orgId,
         anonymous: false,
         delegationJti: claims.jti,
         delegationIssuer: claims.issuer,

package/dist/server/agent-discovery.d.ts

@@ -70,12 +70,16 @@ export declare function shouldIncludeRemoteAgentManifest(manifest: {
 /**
  * Get built-in agents (static, no DB). Used as fallback and for seeding.
  */
-export declare function getBuiltinAgents(selfAppId?: string): DiscoveredAgent[];
+export declare function getBuiltinAgents(selfAppId?: string, options?: {
+    preferLocalUrls?: boolean;
+}): DiscoveredAgent[];
 /**
  * Discover all agents: built-in + custom agents stored as resources.
  * Custom agents override built-in agents with the same ID.
  */
-export declare function discoverAgents(selfAppId?: string): Promise<DiscoveredAgent[]>;
+export declare function discoverAgents(selfAppId?: string, options?: {
+    preferLocalUrls?: boolean;
+}): Promise<DiscoveredAgent[]>;
 /**
  * Look up a single agent by ID or name (case-insensitive).
  */

package/dist/server/agent-discovery.js

@@ -191,13 +191,13 @@ export function shouldIncludeRemoteAgentManifest(manifest, selfAppId) {
 /**
  * Get built-in agents (static, no DB). Used as fallback and for seeding.
  */
-export function getBuiltinAgents(selfAppId) {
+export function getBuiltinAgents(selfAppId, options) {
     const normalizedSelfAppId = selfAppId ? normalizeAgentId(selfAppId) : "";
     return BUILTIN_AGENTS.filter((app) => app.id !== normalizedSelfAppId && app.url).map((app) => ({
         id: app.id,
         name: app.name,
         description: app.description,
-        url: resolveAgentUrl(app),
+        url: resolveAgentUrl(app, options?.preferLocalUrls),
         color: app.color,
     }));
 }
@@ -205,8 +205,8 @@ export function getBuiltinAgents(selfAppId) {
  * Discover all agents: built-in + custom agents stored as resources.
  * Custom agents override built-in agents with the same ID.
  */
-export async function discoverAgents(selfAppId) {
-    const builtins = getBuiltinAgents(selfAppId);
+export async function discoverAgents(selfAppId, options) {
+    const builtins = getBuiltinAgents(selfAppId, options);
     const agentsById = new Map();
     // Start with built-ins
     for (const agent of builtins) {
@@ -249,6 +249,11 @@ export async function discoverAgents(selfAppId) {
                         url = builtin.url;
                 }
                 const builtin = agentsById.get(manifestId);
+                if (options?.preferLocalUrls && builtin) {
+                    const isBuiltinAgent = BUILTIN_AGENTS.some((candidate) => candidate.id === manifestId);
+                    if (isBuiltinAgent)
+                        url = builtin.url;
+                }
                 const isLegacyAssetsManifest = manifest.id.trim().toLowerCase() !== manifestId;
                 if (isLegacyAssetsManifest && builtin?.url) {
                     try {
@@ -280,7 +285,7 @@ export async function discoverAgents(selfAppId) {
     }
     // Overlay sibling workspace apps last so same-origin workspaces prefer the
     // app mounted in this workspace over the public template with the same id.
-    for (const agent of await discoverWorkspaceAgents(selfAppId)) {
+    for (const agent of await discoverWorkspaceAgents(selfAppId, options)) {
         agentsById.set(agent.id, agent);
     }
     return Array.from(agentsById.values());
@@ -347,8 +352,8 @@ function isHostedRuntime() {
 function shouldUseLocalAgentUrls() {
     return !isHostedRuntime();
 }
-function resolveAgentUrl(app) {
-    if (shouldUseLocalAgentUrls()) {
+function resolveAgentUrl(app, preferLocalUrls = false) {
+    if (preferLocalUrls || shouldUseLocalAgentUrls()) {
         return app.devUrl || `http://localhost:${app.devPort}`;
     }
     return app.url;
@@ -527,7 +532,7 @@ function workspaceAppUrl(app, hostedLoopbackFallbackUrl) {
         return null;
     }
 }
-async function discoverWorkspaceAgents(selfAppId) {
+async function discoverWorkspaceAgents(selfAppId, options) {
     const workspaceApps = loadWorkspaceAppsManifest();
     if (!workspaceApps)
         return [];
@@ -537,7 +542,9 @@ async function discoverWorkspaceAgents(selfAppId) {
         .map((app) => {
         const withOverride = applyWorkspaceAppMetadataOverride(app, metadataSettings);
         const builtin = BUILTIN_AGENTS.find((agent) => agent.id === withOverride.id);
-        const url = workspaceAppUrl(withOverride, builtin?.url);
+        const url = options?.preferLocalUrls && builtin
+            ? resolveAgentUrl(builtin, true)
+            : workspaceAppUrl(withOverride, builtin?.url);
         if (!url)
             return null;
         return {

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/identity-sso-store.d.ts

@@ -7,9 +7,9 @@
  *
  *   - `identity_sso_flow_state` binds state to the exact app, client,
  *     authority, callback, and PKCE challenge. State is single-use.
- *   - `identity_sso_jti` remains a defence-in-depth replay guard for the
- *     server-to-server assertion. The assertion is never sent through the
- *     browser; the one-time authorization code is the only browser credential.
+ *   - `identity_sso_jti` is the legacy-named shared replay guard for short-lived
+ *     server-to-server assertions, including identity SSO and privileged A2A
+ *     mutations.
  *
  * Uses the same portable raw-SQL pattern as the other framework stores. DDL is
  * additive and lazy, and PostgreSQL creation goes through the DDL guard.
@@ -59,4 +59,5 @@ export declare function consumeSsoState(state: string, expected: SsoStateBinding
  * guarantee, and refusing a login is safer than accepting an unverifiable
  * replay boundary.
  */
-export declare function isJtiReplayed(jti: string | undefined): Promise<boolean>;
+export declare function consumeOneTimeJti(jti: string | undefined): Promise<boolean>;
+export declare const isJtiReplayed: typeof consumeOneTimeJti;

package/dist/server/identity-sso-store.js

@@ -7,9 +7,9 @@
  *
  *   - `identity_sso_flow_state` binds state to the exact app, client,
  *     authority, callback, and PKCE challenge. State is single-use.
- *   - `identity_sso_jti` remains a defence-in-depth replay guard for the
- *     server-to-server assertion. The assertion is never sent through the
- *     browser; the one-time authorization code is the only browser credential.
+ *   - `identity_sso_jti` is the legacy-named shared replay guard for short-lived
+ *     server-to-server assertions, including identity SSO and privileged A2A
+ *     mutations.
  *
  * Uses the same portable raw-SQL pattern as the other framework stores. DDL is
  * additive and lazy, and PostgreSQL creation goes through the DDL guard.
@@ -321,7 +321,7 @@ export async function consumeSsoState(state, expected) {
  * guarantee, and refusing a login is safer than accepting an unverifiable
  * replay boundary.
  */
-export async function isJtiReplayed(jti) {
+export async function consumeOneTimeJti(jti) {
     if (!jti)
         return true;
     try {
@@ -352,3 +352,4 @@ export async function isJtiReplayed(jti) {
         return true;
     }
 }
+export const isJtiReplayed = consumeOneTimeJti;

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.154.1",
+  "version": "0.154.3",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -421,8 +421,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "^0.14.2",
-    "@agent-native/recap-cli": "0.5.4"
+    "@agent-native/recap-cli": "0.5.4",
+    "@agent-native/toolkit": "^0.14.2"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",