@agent-native/core 0.218.0 → 0.219.0

package/dist/a2a/server.d.ts

@@ -50,7 +50,7 @@ export declare function verifyA2AToken(token: string, event?: any, audienceOptio
     allowAnthropicManagedContinuation?: boolean;
     requireAudience?: boolean;
 }): Promise<A2ATokenPayload>;
-export type A2ATokenFailureCause = "malformed" | "secret-missing" | "audience-unresolvable" | "audience" | "issuer" | "expired" | "signature" | "invalid-claims" | "mcp-credential" | "missing-subject" | "org-binding" | "org-lookup-failed" | "undetermined";
+export type A2ATokenFailureCause = "malformed" | "secret-missing" | "audience-unresolvable" | "audience" | "issuer" | "expired" | "signature" | "algorithm" | "invalid-claims" | "mcp-credential" | "missing-subject" | "org-binding" | "org-lookup-failed" | "undetermined";
 /**
  * Names why a token that `verifyA2AToken` resolved no identity for was
  * refused. `verifyA2AToken` collapses a wrong audience, a wrong secret and an

package/dist/a2a/server.js

@@ -21,6 +21,7 @@ import { hasConfiguredA2ASecret, isA2AProductionRuntime, } from "./auth-policy.j
 import { handleJsonRpcH3, processA2ATaskFromQueue } from "./handlers.js";
 import { A2A_ORG_MEMBER_DELEGATION_TYPE, organizationPrincipalClaims, verifyA2AOrganizationIdentity, } from "./organization-identity.js";
 import { claimA2AApproval, a2aTaskLeaseThreadId, getA2AApprovalForOwner, settleA2AApproval, } from "./task-store.js";
+const A2A_TOKEN_ALGORITHMS = ["HS256"];
 let _warnedUnauthA2A = false;
 function warnA2AUnauthOnce() {
     if (_warnedUnauthA2A)
@@ -196,6 +197,8 @@ async function checkAgainstSecret(token, secret, options) {
     }
     catch (error) {
         const { code, claim } = error;
+        if (code === "ERR_JOSE_ALG_NOT_ALLOWED")
+            return { cause: "algorithm" };
         if (code === "ERR_JWT_EXPIRED")
             return { cause: "expired" };
         if (code === "ERR_JWS_SIGNATURE_VERIFICATION_FAILED") {
@@ -243,7 +246,7 @@ export async function diagnoseA2ATokenFailure(token, event) {
         return "malformed";
     }
     const secret = readDeployCredentialEnv("A2A_SECRET")?.trim();
-    const options = {};
+    const options = { algorithms: A2A_TOKEN_ALGORITHMS };
     if (typeof claims.aud !== "undefined") {
         const audience = expectedJwtAudience(event);
         if (!audience)
@@ -331,7 +334,9 @@ async function verifyA2ATokenInternal(token, event, audienceOptions) {
     if (audienceOptions?.requireAudience && !hasAudience) {
         return { payload: { email: null, orgDomain: null } };
     }
-    const verifyOptions = {};
+    const verifyOptions = {
+        algorithms: A2A_TOKEN_ALGORITHMS,
+    };
     if (hasAudience) {
         // Fail closed: the token was minted for a specific audience, but this
         // receiver can't derive its own expected audience (no APP_URL/URL and no
@@ -424,10 +429,7 @@ async function verifyA2ATokenInternal(token, event, audienceOptions) {
     }
     if (!organization)
         return { payload: { email: null, orgDomain: null } };
-    const orgVerifyOptions = unverifiedPayload?.typ === A2A_ORG_MEMBER_DELEGATION_TYPE
-        ? { ...verifyOptions, algorithms: ["HS256"] }
-        : verifyOptions;
-    const payload = await verifyJwtWithSecret(token, organization.secret, orgVerifyOptions);
+    const payload = await verifyJwtWithSecret(token, organization.secret, verifyOptions);
     if (!payload)
         return { payload: { email: null, orgDomain: null } };
     const claims = organizationPrincipalClaims(payload, organization);

package/dist/agent/run-manager.js

@@ -1205,6 +1205,9 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
     };
     let lastAbortCheck = Date.now() - 3000;
     let consecutiveAbortCheckFailures = 0;
+    let completionInProgress = false;
+    let ownTerminalStatusEstablished = false;
+    let terminalStatusWrite = null;
     const checkSqlAbort = () => {
         const now = Date.now();
         if (now - lastAbortCheck < 3000)
@@ -1216,9 +1219,16 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
                 abortInMemoryRun(run, state.reason ?? "user");
                 return;
             }
-            if (!abort.signal.aborted) {
+            if (!abort.signal.aborted && !ownTerminalStatusEstablished) {
                 const status = await getRunStatus(runId);
                 if (status !== null && status !== "running") {
+                    const pendingStatusWrite = terminalStatusWrite;
+                    if (pendingStatusWrite)
+                        await pendingStatusWrite;
+                }
+                if (status !== null &&
+                    status !== "running" &&
+                    !ownTerminalStatusEstablished) {
                     abortInMemoryRun(run, "displaced");
                 }
             }
@@ -1249,7 +1259,6 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
     };
     let consecutiveHeartbeatFailures = 0;
     let heartbeatInFlight = false;
-    let completionInProgress = false;
     const heartbeatTimer = setInterval(() => {
         if (!heartbeatInFlight) {
             heartbeatInFlight = true;
@@ -1748,11 +1757,26 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
         const persistTerminalStatus = () => Object.keys(terminalStatusOptions).length === 0
             ? updateRunStatusIfRunning(runId, persistedStatus)
             : updateRunStatusIfRunning(runId, persistedStatus, terminalStatusOptions);
-        const reconcileTerminalRun = () => threadProjectionPending
+        const persistOwnTerminalState = async (persist) => {
+            const write = withWorkerFence(persist);
+            terminalStatusWrite = write;
+            try {
+                const established = await write;
+                if (established)
+                    ownTerminalStatusEstablished = true;
+                return established;
+            }
+            finally {
+                if (terminalStatusWrite === write)
+                    terminalStatusWrite = null;
+            }
+        };
+        const persistOwnTerminalStatus = () => persistOwnTerminalState(persistTerminalStatus);
+        const reconcileTerminalRun = () => persistOwnTerminalState(() => threadProjectionPending
             ? reconcileTerminalRunFromEvents(runId, {
                 threadProjectionPending: true,
             })
-            : reconcileTerminalRunFromEvents(runId);
+            : reconcileTerminalRunFromEvents(runId));
         const reportTerminalStatusPersistenceError = (error) => {
             captureError(error, {
                 route: "/_agent-native/agent-chat",
@@ -1795,9 +1819,10 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
                 else {
                     try {
                         await insertRunPromise;
-                        continuationStatusPersistedBeforeEvent = await withWorkerFence(persistTerminalStatus);
+                        continuationStatusPersistedBeforeEvent =
+                            await persistOwnTerminalStatus();
                         if (!continuationStatusPersistedBeforeEvent) {
-                            await withWorkerFence(reconcileTerminalRun);
+                            await reconcileTerminalRun();
                             const persistedRun = await getRunById(runId);
                             continuationStatusPersistedBeforeEvent =
                                 persistedRun?.status === "truncated" &&
@@ -1875,7 +1900,7 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
                         : await withWorkerFence(persistAtomicAbort);
                     terminalPersistenceEstablished = aborted
                         ? true
-                        : await withWorkerFence(reconcileTerminalRun);
+                        : await reconcileTerminalRun();
                 }
                 catch (error) {
                     terminalPersistenceEstablished = false;
@@ -1893,7 +1918,7 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
                     (!terminalPersistenceError || eventPersistenceError)) {
                     let statusUpdated = false;
                     try {
-                        statusUpdated = await withWorkerFence(persistTerminalStatus);
+                        statusUpdated = await persistOwnTerminalStatus();
                     }
                     catch (error) {
                         reportTerminalStatusPersistenceError(error);
@@ -1905,8 +1930,7 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
                         terminalPersistenceEstablished = !terminalPersistenceError;
                     }
                     else {
-                        terminalPersistenceEstablished =
-                            await withWorkerFence(reconcileTerminalRun);
+                        terminalPersistenceEstablished = await reconcileTerminalRun();
                     }
                 }
             }
@@ -1957,7 +1981,7 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
         if (terminalPersistenceError) {
             const reconciled = eventPersistenceError
                 ? false
-                : await withWorkerFence(reconcileTerminalRun);
+                : await reconcileTerminalRun();
             if (!reconciled)
                 throw terminalPersistenceError;
             terminalPersistenceEstablished = true;

package/dist/automation/index.d.ts

@@ -139,8 +139,8 @@ export declare function createAutomationCallbackHandler(runtime: AutomationRunti
     duplicate?: undefined;
     eventId?: undefined;
 } | {
-    error?: undefined;
     accepted: boolean;
     duplicate: boolean;
     eventId: string;
+    error?: undefined;
 }>;

package/dist/client/route-warmup.js

@@ -4,8 +4,28 @@ import { ROUTE_WARMUP_PRELOAD_ATTRIBUTE } from "../shared/route-chunk-recovery-b
 import { mergeAgentNativeRouteWarmupConfig, } from "../shared/route-warmup-config.js";
 import { isServerRoutePath } from "./api-path.js";
 const PREFETCH_ATTR = "data-an-prefetch";
+// WebKit checks once, 3 seconds after the window's load event, for link
+// preloads nothing has used yet, and logs "was preloaded using link preload but
+// not used within a few seconds" for each one. Warmed route modules are for
+// later navigations, so their modulepreload links wait until that check has
+// run. Until then the module files are fetched into the HTTP cache instead:
+// built assets are immutable, so an early click still skips the network, and
+// WebKit only reports link preloads. Data warmup is a plain fetch and starts
+// right away.
+// A third-party script that never finishes can hold the load event back
+// indefinitely. The hold lasts as long, since preloads added before a late load
+// event would still be reported; the HTTP cache and intent preloads cover clicks
+// meanwhile.
+const MODULE_WARMUP_DELAY_AFTER_LOAD_MS = 4_000;
 const warmedDataRoutes = new Set();
 const warmedRouteAssets = new Set();
+const fetchedRouteAssets = new Set();
+// A later scan retries a failed fetch, at most twice and no sooner than 5
+// seconds after the last failure, so page updates during an outage don't set
+// the request rate.
+const ROUTE_ASSET_FETCH_ATTEMPTS = 3;
+const ROUTE_ASSET_RETRY_DELAY_MS = 5_000;
+const failedRouteAssetFetches = new Map();
 let cachedManifest;
 let cachedManifestRoutesSignature = "";
 let cachedManifestRouteTree = [];
@@ -305,6 +325,62 @@ function warmRouteAssetsForHref(href) {
         document.head.appendChild(link);
     }
 }
+function fetchRouteAssetsForHref(href) {
+    for (const assetUrl of routeAssetUrlsForHref(href)) {
+        if (warmedRouteAssets.has(assetUrl) || fetchedRouteAssets.has(assetUrl)) {
+            continue;
+        }
+        const failed = failedRouteAssetFetches.get(assetUrl);
+        if (failed &&
+            (failed.attempts >= ROUTE_ASSET_FETCH_ATTEMPTS ||
+                Date.now() < failed.retryAt)) {
+            continue;
+        }
+        fetchedRouteAssets.add(assetUrl);
+        const onFailure = () => {
+            fetchedRouteAssets.delete(assetUrl);
+            failedRouteAssetFetches.set(assetUrl, {
+                attempts: (failed?.attempts ?? 0) + 1,
+                retryAt: Date.now() + ROUTE_ASSET_RETRY_DELAY_MS,
+            });
+        };
+        window
+            .fetch(assetUrl, { credentials: "same-origin", priority: "low" })
+            .then((response) => {
+            if (response.ok) {
+                failedRouteAssetFetches.delete(assetUrl);
+                return response.arrayBuffer();
+            }
+            onFailure();
+        })
+            .catch(onFailure);
+    }
+}
+function msSinceLoadEventEnd() {
+    const [entry] = performance.getEntriesByType?.("navigation") ?? [];
+    const loadEventEnd = entry
+        ?.loadEventEnd;
+    return loadEventEnd ? Math.max(0, performance.now() - loadEventEnd) : 0;
+}
+function afterUnusedPreloadCheck(callback) {
+    let timer;
+    const startTimer = () => {
+        if (timer !== undefined)
+            window.clearTimeout(timer);
+        timer = window.setTimeout(callback, Math.max(0, MODULE_WARMUP_DELAY_AFTER_LOAD_MS - msSinceLoadEventEnd()));
+    };
+    if (document.readyState === "complete") {
+        startTimer();
+    }
+    else {
+        window.addEventListener("load", startTimer, { once: true });
+    }
+    return () => {
+        window.removeEventListener("load", startTimer);
+        if (timer !== undefined)
+            window.clearTimeout(timer);
+    };
+}
 function linkWarmupMode(link, strategy) {
     const explicit = link.getAttribute(PREFETCH_ATTR)?.trim().toLowerCase();
     if (explicit === "none" || explicit === "off" || explicit === "false") {
@@ -353,6 +429,8 @@ function resetRouteWarmupCachesForTests() {
     cachedManifestRouteTree = [];
     warmedDataRoutes.clear();
     warmedRouteAssets.clear();
+    fetchedRouteAssets.clear();
+    failedRouteAssetFetches.clear();
 }
 export function AgentNativeRouteWarmup({ config, }) {
     useEffect(() => {
@@ -376,6 +454,8 @@ export function AgentNativeRouteWarmup({ config, }) {
         const dataRetryAttempts = new Map();
         const retryTimers = new Set();
         const observedLinks = new WeakSet();
+        const heldModuleHrefs = new Set();
+        let modulesHeld = warmModules;
         let active = 0;
         let stopped = false;
         let scheduleTimer;
@@ -435,9 +515,14 @@ export function AgentNativeRouteWarmup({ config, }) {
                 });
             }
         };
-        function warmHref(href) {
-            if (warmModules)
+        function warmHref(href, fromIntent = false) {
+            if (modulesHeld && !fromIntent) {
+                heldModuleHrefs.add(href);
+                fetchRouteAssetsForHref(href);
+            }
+            else if (warmModules) {
                 warmRouteAssetsForHref(href);
+            }
             if (!warmData)
                 return;
             for (const dataUrl of dataRouteUrlsForHref(href)) {
@@ -512,8 +597,20 @@ export function AgentNativeRouteWarmup({ config, }) {
             const mode = linkWarmupMode(link, resolved.strategy);
             if (mode === "none")
                 return;
-            warmHref(link.href);
+            // Hover, touch and focus usually come just before a click, so they
+            // preload right away even during the hold: the click uses the preload
+            // before WebKit's check, and an early click doesn't wait for the module
+            // to compile.
+            warmHref(link.href, true);
         };
+        const cancelModuleHold = warmModules
+            ? afterUnusedPreloadCheck(() => {
+                modulesHeld = false;
+                for (const href of heldModuleHrefs)
+                    warmRouteAssetsForHref(href);
+                heldModuleHrefs.clear();
+            })
+            : undefined;
         schedule();
         const observer = new MutationObserver(schedule);
         observer.observe(document.documentElement, {
@@ -533,6 +630,7 @@ export function AgentNativeRouteWarmup({ config, }) {
         document.addEventListener("focusin", warmFromIntent, true);
         return () => {
             stopped = true;
+            cancelModuleHold?.();
             if (scheduleTimer !== undefined)
                 window.clearTimeout(scheduleTimer);
             for (const timer of retryTimers)

package/dist/collab/routes.d.ts

@@ -16,9 +16,9 @@ export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     liveCopy: "derived" | "not_derived" | "unchanged";
     liveCopyReason?: string;
+    error?: undefined;
     ok: boolean;
 } | {
     error?: undefined;

package/dist/file-upload/actions/upload-image.d.ts

@@ -42,8 +42,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url: string;
     id: string;
     provider: string;
-    configured?: undefined;
     error?: undefined;
+    configured?: undefined;
 } | {
     url?: undefined;
     id?: undefined;

package/dist/jobs/actions/manage-recurring-job.d.ts

@@ -13,10 +13,10 @@ declare const _default: import("../../action.js").ActionDefinition<{
     enabled?: undefined;
     nextRun?: undefined;
 } | {
-    deleted?: undefined;
     resourceId: string;
     name: string;
     enabled: boolean;
     nextRun: string;
+    deleted?: undefined;
 }>;
 export default _default;

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/secrets/routes.d.ts

@@ -57,39 +57,39 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
     errorCode?: undefined;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     error: string;
     errorCode: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     errorCode?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -117,11 +117,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -67,12 +67,12 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     code: any;
 } | {
     errorCode?: undefined;
-    error?: undefined;
     code?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
     defaultModel?: import("./agent-engine-default-model-route.js").SavedKeyDefaultModelOutcome;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-default-model-route.d.ts

@@ -8,17 +8,17 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  * resolveEngine's credential detection.
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
     scope?: undefined;
 } | {
     ok: boolean;
     error: any;
     scope?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     scope: "org" | "user";
-    error?: undefined;
 }>>;
 export interface DefaultModelSelectionRequest {
     engine: string;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,6 +1,6 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
     models?: undefined;
 } | {
     error?: undefined;

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/triggers/actions/manage-automation.d.ts

@@ -67,7 +67,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
     triggerType: "event" | "manual" | "schedule" | "webhook";
     body: string;
 }, {
-    deleted?: undefined;
     created: boolean;
     resourceId: string;
     name: string;
@@ -88,13 +87,12 @@ declare const _default: import("../../action.js").ActionDefinition<{
     executionCwd: string;
     mcpTools: string[];
     webhookPath: string;
+    deleted?: undefined;
     updated?: undefined;
     changed?: undefined;
     previouslyEnabled?: undefined;
     requestedEnabled?: undefined;
 } | {
-    enabled?: undefined;
-    nextRun?: undefined;
     created?: undefined;
     deleted: boolean;
     resourceId: string;
@@ -107,6 +105,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     timezone?: undefined;
     condition?: undefined;
     body?: undefined;
+    enabled?: undefined;
+    nextRun?: undefined;
     createdBy?: undefined;
     model?: undefined;
     reasoningEffort?: undefined;
@@ -119,8 +119,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     requestedEnabled?: undefined;
     webhookPath?: undefined;
 } | {
-    deleted?: undefined;
     created?: undefined;
+    deleted?: undefined;
     updated: boolean;
     resourceId: string;
     name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.218.0",
+  "version": "0.219.0",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -730,8 +730,8 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/recap-cli": "^0.5.87",
-    "@agent-native/agentkit": "^0.218.0"
+    "@agent-native/agentkit": "^0.219.0",
+    "@agent-native/recap-cli": "^0.5.88"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",