@agent-native/core 0.84.18 → 0.84.21

package/corpus/templates/clips/shared/finalize-recovery.ts

@@ -0,0 +1,242 @@
+type FetchLike = (
+  input: RequestInfo | URL,
+  init?: RequestInit,
+) => Promise<Response>;
+
+export type RecoveredReadyRecording = {
+  ok: true;
+  finalized: true;
+  recoveredAfterFinalizeError: true;
+  id: string;
+  recordingId: string;
+  status: "ready";
+  videoUrl: string;
+  durationMs?: number;
+  width?: number;
+  height?: number;
+  hasAudio?: boolean;
+  hasCamera?: boolean;
+};
+
+type ProbeResult =
+  | { ready: true; result: RecoveredReadyRecording }
+  | { ready: false; terminal: boolean; status?: string };
+
+const DEFAULT_READY_RECOVERY_TIMEOUT_MS = 90_000;
+const DEFAULT_READY_RECOVERY_INTERVAL_MS = 3_000;
+const DEFAULT_READY_RECOVERY_FETCH_TIMEOUT_MS = 2_000;
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function absoluteUploadUrl(uploadUrl: string): URL {
+  if (/^[a-z][a-z0-9+.-]*:/i.test(uploadUrl)) return new URL(uploadUrl);
+  const origin =
+    typeof globalThis.location?.origin === "string"
+      ? globalThis.location.origin
+      : "http://localhost";
+  return new URL(uploadUrl, origin);
+}
+
+function maybeRelativeUrl(url: URL, original: string): string {
+  if (/^[a-z][a-z0-9+.-]*:/i.test(original)) return url.toString();
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+
+export function publicRecordingStatusUrl(
+  uploadUrl: string,
+  recordingId: string,
+): string {
+  const url = absoluteUploadUrl(uploadUrl);
+  const match = url.pathname.match(/^(.*)\/api\/uploads\/[^/]+\/chunk$/);
+  const basePath = match?.[1] ?? "";
+  url.pathname = `${basePath}/api/public-recording`;
+  url.search = "";
+  url.searchParams.set("id", recordingId);
+  return maybeRelativeUrl(url, uploadUrl);
+}
+
+export function authenticatedRecordingStatusUrl(
+  uploadUrl: string,
+  recordingId: string,
+): string {
+  const url = absoluteUploadUrl(uploadUrl);
+  const match = url.pathname.match(/^(.*)\/api\/uploads\/[^/]+\/chunk$/);
+  const basePath = match?.[1] ?? "";
+  url.pathname = `${basePath}/api/uploads/${encodeURIComponent(
+    recordingId,
+  )}/status`;
+  url.search = "";
+  return maybeRelativeUrl(url, uploadUrl);
+}
+
+function optionalNumber(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isFinite(value)
+    ? value
+    : undefined;
+}
+
+function optionalBoolean(value: unknown): boolean | undefined {
+  return typeof value === "boolean" ? value : undefined;
+}
+
+export function readyRecordingFromPublicPayload(
+  payload: unknown,
+  fallbackRecordingId: string,
+): ProbeResult {
+  const root =
+    payload && typeof payload === "object"
+      ? (payload as Record<string, unknown>)
+      : null;
+  const recording =
+    root?.recording && typeof root.recording === "object"
+      ? (root.recording as Record<string, unknown>)
+      : null;
+  const status =
+    typeof recording?.status === "string" ? recording.status : undefined;
+
+  if (!recording) return { ready: false, terminal: false };
+  if (status === "failed") return { ready: false, terminal: true, status };
+
+  const videoUrl =
+    typeof recording.videoUrl === "string" ? recording.videoUrl : "";
+  if (status !== "ready" || !videoUrl) {
+    return { ready: false, terminal: false, status };
+  }
+
+  const id =
+    typeof recording.id === "string" && recording.id
+      ? recording.id
+      : fallbackRecordingId;
+  return {
+    ready: true,
+    result: {
+      ok: true,
+      finalized: true,
+      recoveredAfterFinalizeError: true,
+      id,
+      recordingId: id,
+      status: "ready",
+      videoUrl,
+      durationMs: optionalNumber(recording.durationMs),
+      width: optionalNumber(recording.width),
+      height: optionalNumber(recording.height),
+      hasAudio: optionalBoolean(recording.hasAudio),
+      hasCamera: optionalBoolean(recording.hasCamera),
+    },
+  };
+}
+
+async function fetchWithTimeout(
+  fetchImpl: FetchLike,
+  url: string,
+  init: RequestInit,
+  timeoutMs: number,
+): Promise<Response> {
+  if (timeoutMs <= 0 || typeof AbortController === "undefined") {
+    return fetchImpl(url, init);
+  }
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetchImpl(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function waitForReadyRecordingAfterFinalizeError(args: {
+  uploadUrl: string;
+  recordingId: string;
+  authToken?: string | null;
+  preferAuthenticated?: boolean;
+  fetchImpl?: FetchLike;
+  sleepImpl?: (ms: number) => Promise<void>;
+  timeoutMs?: number;
+  intervalMs?: number;
+  fetchTimeoutMs?: number;
+}): Promise<RecoveredReadyRecording | null> {
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const sleepImpl = args.sleepImpl ?? sleep;
+  const timeoutMs = Math.max(
+    1,
+    args.timeoutMs ?? DEFAULT_READY_RECOVERY_TIMEOUT_MS,
+  );
+  const intervalMs = Math.max(
+    1,
+    args.intervalMs ?? DEFAULT_READY_RECOVERY_INTERVAL_MS,
+  );
+  const attempts = Math.max(1, Math.ceil(timeoutMs / intervalMs));
+  let url: string;
+  let authenticatedUrl: string | null = null;
+  try {
+    url = publicRecordingStatusUrl(args.uploadUrl, args.recordingId);
+    authenticatedUrl =
+      args.authToken || args.preferAuthenticated
+        ? authenticatedRecordingStatusUrl(args.uploadUrl, args.recordingId)
+        : null;
+  } catch {
+    return null;
+  }
+
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    const urls = authenticatedUrl
+      ? [
+          { url: authenticatedUrl, authenticated: true },
+          { url, authenticated: false },
+        ]
+      : [{ url, authenticated: false }];
+
+    for (const endpoint of urls) {
+      const headers: Record<string, string> = {
+        Accept: "application/json",
+        "X-Agent-Native-Frontend": "1",
+      };
+      if (endpoint.authenticated && args.authToken) {
+        headers.Authorization = `Bearer ${args.authToken}`;
+      }
+
+      try {
+        const response = await fetchWithTimeout(
+          fetchImpl,
+          endpoint.url,
+          {
+            method: "GET",
+            headers,
+            credentials: "include",
+            cache: "no-store",
+          },
+          args.fetchTimeoutMs ?? DEFAULT_READY_RECOVERY_FETCH_TIMEOUT_MS,
+        );
+
+        if (response.ok) {
+          const payload = await response.json().catch(() => null);
+          const probe = readyRecordingFromPublicPayload(
+            payload,
+            args.recordingId,
+          );
+          if (probe.ready) return probe.result;
+          if (probe.terminal) return null;
+          break;
+        }
+
+        if (
+          response.status >= 400 &&
+          response.status < 500 &&
+          !endpoint.authenticated &&
+          !authenticatedUrl
+        ) {
+          return null;
+        }
+      } catch {
+        // Try the public endpoint fallback below, then keep polling.
+      }
+    }
+
+    if (attempt < attempts - 1) await sleepImpl(intervalMs);
+  }
+
+  return null;
+}

package/corpus/templates/design/changelog/2026-07-01-design-recovers-sooner-when-an-agent-gets-stuck-preparing-a-.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-01
+---
+
+Design recovers sooner when an agent gets stuck preparing a large design edit.

package/corpus/templates/plan/app/global.css

@@ -156,7 +156,7 @@
   }
 
   .plan-content-surface[data-recap-screenshot-theme] .plan-document-shell {
-    padding: 10px;
+    padding: 0;
   }
 
   .plan-content-surface[data-recap-screenshot-theme] .plan-document-body {

package/dist/a2a/caller-auth.d.ts

@@ -1,5 +1,6 @@
 export interface A2ACallerAuth {
     apiKey?: string;
+    apiKeyFallbacks?: string[];
     userEmail?: string;
     orgId?: string;
     orgDomain?: string;

package/dist/a2a/caller-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caller-auth.d.ts","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IACnD,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,OAAO,CAAC,aAAa,CAAC,CAmCzB"}
+{"version":3,"file":"caller-auth.d.ts","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IACnD,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,OAAO,CAAC,aAAa,CAAC,CA+DzB"}

package/dist/a2a/caller-auth.js

@@ -23,20 +23,46 @@ export async function resolveA2ACallerAuth(options) {
         }
         catch { }
     }
-    let apiKey;
+    const apiKeyAttempts = [];
+    const addApiKeyAttempt = (token) => {
+        if (!token || apiKeyAttempts.includes(token))
+            return;
+        apiKeyAttempts.push(token);
+    };
     if (userEmail && (orgSecret || process.env.A2A_SECRET)) {
-        try {
-            apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {
-                expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
-                preferGlobalSecret: !orgSecret,
-            });
+        if (process.env.A2A_SECRET?.trim()) {
+            try {
+                addApiKeyAttempt(await signA2AToken(userEmail, orgDomain, orgSecret, {
+                    expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
+                    preferGlobalSecret: true,
+                }));
+            }
+            catch { }
+        }
+        if (orgSecret) {
+            try {
+                addApiKeyAttempt(await signA2AToken(userEmail, orgDomain, orgSecret, {
+                    expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
+                    preferGlobalSecret: false,
+                }));
+            }
+            catch { }
         }
-        catch { }
     }
     if (options?.includeGoogleToken) {
         await attachGoogleTokenMetadata(metadata, userEmail);
     }
-    return { apiKey, userEmail, orgId, orgDomain, orgSecret, metadata };
+    return {
+        apiKey: apiKeyAttempts[0],
+        ...(apiKeyAttempts.length > 1
+            ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }
+            : {}),
+        userEmail,
+        orgId,
+        orgDomain,
+        orgSecret,
+        metadata,
+    };
 }
 async function attachGoogleTokenMetadata(metadata, userEmail) {
     if (process.env.NODE_ENV !== "production" || !userEmail)

package/dist/a2a/caller-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"caller-auth.js","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAW3C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAG1C;IACC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IAE9C,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC3D,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YACrD,IAAI,SAAS;gBAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC9D,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;gBAC3D,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,4BAA4B;gBAC7D,kBAAkB,EAAE,CAAC,SAAS;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAChC,MAAM,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAiC,EACjC,SAA6B;IAE7B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO;IAEhE,IAAI,CAAC;QACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,QAAQ,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC","sourcesContent":["import {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"../server/request-context.js\";\nimport { signA2AToken } from \"./client.js\";\n\nconst DEFAULT_A2A_CALLER_TOKEN_TTL = \"30m\";\n\nexport interface A2ACallerAuth {\n  apiKey?: string;\n  userEmail?: string;\n  orgId?: string;\n  orgDomain?: string;\n  orgSecret?: string;\n  metadata: Record<string, unknown>;\n}\n\nexport async function resolveA2ACallerAuth(options?: {\n  expiresIn?: string | number;\n  includeGoogleToken?: boolean;\n}): Promise<A2ACallerAuth> {\n  const userEmail = getRequestUserEmail();\n  const metadata: Record<string, unknown> = {};\n  if (userEmail) metadata.userEmail = userEmail;\n\n  let orgDomain: string | undefined;\n  let orgSecret: string | undefined;\n  const orgId = getRequestOrgId();\n  if (orgId) {\n    try {\n      const { getOrgDomain } = await import(\"../org/context.js\");\n      orgDomain = (await getOrgDomain(orgId)) ?? undefined;\n      if (orgDomain) metadata.orgDomain = orgDomain;\n    } catch {}\n    try {\n      const { getOrgA2ASecret } = await import(\"../org/context.js\");\n      orgSecret = (await getOrgA2ASecret(orgId)) ?? undefined;\n    } catch {}\n  }\n\n  let apiKey: string | undefined;\n  if (userEmail && (orgSecret || process.env.A2A_SECRET)) {\n    try {\n      apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {\n        expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,\n        preferGlobalSecret: !orgSecret,\n      });\n    } catch {}\n  }\n\n  if (options?.includeGoogleToken) {\n    await attachGoogleTokenMetadata(metadata, userEmail);\n  }\n\n  return { apiKey, userEmail, orgId, orgDomain, orgSecret, metadata };\n}\n\nasync function attachGoogleTokenMetadata(\n  metadata: Record<string, unknown>,\n  userEmail: string | undefined,\n): Promise<void> {\n  if (process.env.NODE_ENV !== \"production\" || !userEmail) return;\n\n  try {\n    const { listOAuthAccountsByOwner } =\n      await import(\"../oauth-tokens/store.js\");\n    const accounts = await listOAuthAccountsByOwner(\"google\", userEmail);\n    const tokens = accounts[0]?.tokens;\n    if (tokens?.access_token) {\n      metadata.googleToken = tokens.access_token;\n    }\n  } catch {}\n}\n"]}
+{"version":3,"file":"caller-auth.js","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAY3C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAG1C;IACC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IAE9C,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC3D,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YACrD,IAAI,SAAS;gBAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC9D,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAAE,EAAE;QACrD,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QACrD,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,IAAI,SAAS,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,gBAAgB,CACd,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;oBAClD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,4BAA4B;oBAC7D,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,gBAAgB,CACd,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;oBAClD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,4BAA4B;oBAC7D,kBAAkB,EAAE,KAAK;iBAC1B,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAChC,MAAM,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QACzB,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YAC3B,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,SAAS;QACT,KAAK;QACL,SAAS;QACT,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAiC,EACjC,SAA6B;IAE7B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO;IAEhE,IAAI,CAAC;QACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,QAAQ,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC","sourcesContent":["import {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"../server/request-context.js\";\nimport { signA2AToken } from \"./client.js\";\n\nconst DEFAULT_A2A_CALLER_TOKEN_TTL = \"30m\";\n\nexport interface A2ACallerAuth {\n  apiKey?: string;\n  apiKeyFallbacks?: string[];\n  userEmail?: string;\n  orgId?: string;\n  orgDomain?: string;\n  orgSecret?: string;\n  metadata: Record<string, unknown>;\n}\n\nexport async function resolveA2ACallerAuth(options?: {\n  expiresIn?: string | number;\n  includeGoogleToken?: boolean;\n}): Promise<A2ACallerAuth> {\n  const userEmail = getRequestUserEmail();\n  const metadata: Record<string, unknown> = {};\n  if (userEmail) metadata.userEmail = userEmail;\n\n  let orgDomain: string | undefined;\n  let orgSecret: string | undefined;\n  const orgId = getRequestOrgId();\n  if (orgId) {\n    try {\n      const { getOrgDomain } = await import(\"../org/context.js\");\n      orgDomain = (await getOrgDomain(orgId)) ?? undefined;\n      if (orgDomain) metadata.orgDomain = orgDomain;\n    } catch {}\n    try {\n      const { getOrgA2ASecret } = await import(\"../org/context.js\");\n      orgSecret = (await getOrgA2ASecret(orgId)) ?? undefined;\n    } catch {}\n  }\n\n  const apiKeyAttempts: string[] = [];\n  const addApiKeyAttempt = (token: string | undefined) => {\n    if (!token || apiKeyAttempts.includes(token)) return;\n    apiKeyAttempts.push(token);\n  };\n  if (userEmail && (orgSecret || process.env.A2A_SECRET)) {\n    if (process.env.A2A_SECRET?.trim()) {\n      try {\n        addApiKeyAttempt(\n          await signA2AToken(userEmail, orgDomain, orgSecret, {\n            expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,\n            preferGlobalSecret: true,\n          }),\n        );\n      } catch {}\n    }\n    if (orgSecret) {\n      try {\n        addApiKeyAttempt(\n          await signA2AToken(userEmail, orgDomain, orgSecret, {\n            expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,\n            preferGlobalSecret: false,\n          }),\n        );\n      } catch {}\n    }\n  }\n\n  if (options?.includeGoogleToken) {\n    await attachGoogleTokenMetadata(metadata, userEmail);\n  }\n\n  return {\n    apiKey: apiKeyAttempts[0],\n    ...(apiKeyAttempts.length > 1\n      ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }\n      : {}),\n    userEmail,\n    orgId,\n    orgDomain,\n    orgSecret,\n    metadata,\n  };\n}\n\nasync function attachGoogleTokenMetadata(\n  metadata: Record<string, unknown>,\n  userEmail: string | undefined,\n): Promise<void> {\n  if (process.env.NODE_ENV !== \"production\" || !userEmail) return;\n\n  try {\n    const { listOAuthAccountsByOwner } =\n      await import(\"../oauth-tokens/store.js\");\n    const accounts = await listOAuthAccountsByOwner(\"google\", userEmail);\n    const tokens = accounts[0]?.tokens;\n    if (tokens?.access_token) {\n      metadata.googleToken = tokens.access_token;\n    }\n  } catch {}\n}\n"]}

package/dist/a2a/client.d.ts

@@ -27,14 +27,17 @@ export declare function signA2AToken(email: string, orgDomain?: string, orgSecre
      */
     extraClaims?: Record<string, unknown>;
 }): Promise<string>;
+export declare function shouldPreferGlobalA2ASecret(orgSecret?: string): boolean;
 export declare class A2AClient {
     private baseUrl;
     private apiKey?;
+    private apiKeyAttempts;
     private endpointCandidates;
     private endpointResolved;
     private requestTimeoutMs?;
     constructor(baseUrl: string, apiKey?: string, options?: {
         requestTimeoutMs?: number;
+        fallbackApiKeys?: string[];
     });
     /**
      * Detect which A2A path the target agent uses.
@@ -42,6 +45,7 @@ export declare class A2AClient {
      */
     resolveEndpoint(): Promise<void>;
     private headers;
+    private markApiKeySucceeded;
     private rpc;
     getAgentCard(): Promise<AgentCard>;
     send(message: Message, opts?: {

package/dist/a2a/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAU5D;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,EAWxC;IAED;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBrC;IAED,OAAO,CAAC,OAAO;YAQD,GAAG;IAqCX,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAUvC;IAEK,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAef;IAED;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3C;IAED;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAEM,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC,CA2DtB;YAEa,wBAAwB;YAyBxB,QAAQ;CAuBvB;AA2DD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GACA,OAAO,CAAC,MAAM,CAAC,CAsEjB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAU5D;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,wBAAgB,2BAA2B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EAepE;IAED;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBrC;IAED,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,mBAAmB;YAQb,GAAG;IA+CX,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAUvC;IAEK,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAef;IAED;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3C;IAED;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAEM,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC,CAsEtB;YAEa,wBAAwB;YAyBxB,QAAQ;CA2BvB;AAgFD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GACA,OAAO,CAAC,MAAM,CAAC,CAmEjB"}