@agent-native/core 0.84.20 → 0.84.21

package/corpus/templates/clips/desktop/src/lib/recorder.ts

@@ -51,6 +51,7 @@ import { invoke } from "@tauri-apps/api/core";
 import { emit, listen, type UnlistenFn } from "@tauri-apps/api/event";
 import { open as openExternal } from "@tauri-apps/plugin-shell";
 
+import { waitForReadyRecordingAfterFinalizeError } from "../../../shared/finalize-recovery";
 import type { LocalRecordingMode } from "../shared/config";
 import { createAudioCue, type AudioCue } from "./audio-cue";
 import { createCameraCompositeStream } from "./camera-composite";
@@ -718,6 +719,28 @@ async function markBrowserRecordingBackupError(
   });
 }
 
+async function recoverReadyRecordingAfterFinalizeError({
+  serverUrl,
+  recordingId,
+  authToken,
+}: {
+  serverUrl: string;
+  recordingId: string;
+  authToken?: string;
+}): Promise<boolean> {
+  const recovered = await waitForReadyRecordingAfterFinalizeError({
+    uploadUrl: chunkUrl(serverUrl, recordingId, 0, false),
+    recordingId,
+    authToken,
+    preferAuthenticated: true,
+  });
+  if (!recovered) return false;
+  await deleteBrowserRecordingBackup(recordingId).catch((err) => {
+    console.warn("[clips-recorder] recovered backup cleanup failed:", err);
+  });
+  return true;
+}
+
 export async function listBrowserRecordingBackups(): Promise<
   PendingBrowserRecordingUpload[]
 > {
@@ -827,8 +850,12 @@ export async function retryBrowserRecordingBackup(input: {
       );
     }
 
-    await postBackupChunk(
-      chunkUrl(meta.serverUrl, meta.recordingId, validatedChunks.length, true, {
+    const finalChunkUrl = chunkUrl(
+      meta.serverUrl,
+      meta.recordingId,
+      validatedChunks.length,
+      true,
+      {
         total: String(totalPosts),
         mimeType: meta.mimeType,
         durationMs: String(Math.round(meta.durationMs || 0)),
@@ -836,10 +863,29 @@ export async function retryBrowserRecordingBackup(input: {
         ...(meta.height ? { height: String(meta.height) } : {}),
         hasAudio: meta.hasAudio ? "1" : "0",
         hasCamera: meta.hasCamera ? "1" : "0",
-      }),
-      new Blob([], { type: meta.mimeType }),
-      input.authToken,
+      },
     );
+    try {
+      await postBackupChunk(
+        finalChunkUrl,
+        new Blob([], { type: meta.mimeType }),
+        input.authToken,
+      );
+    } catch (err) {
+      if (
+        await recoverReadyRecordingAfterFinalizeError({
+          serverUrl: meta.serverUrl,
+          recordingId: meta.recordingId,
+          authToken: input.authToken,
+        })
+      ) {
+        return {
+          recordingId: meta.recordingId,
+          viewUrl: `/r/${meta.recordingId}`,
+        };
+      }
+      throw err;
+    }
 
     await deleteBrowserRecordingBackup(meta.recordingId);
     return { recordingId: meta.recordingId, viewUrl: `/r/${meta.recordingId}` };
@@ -1986,6 +2032,22 @@ async function startNativeFullscreenRecording(
           try {
             uploadResult = await uploadPromise;
           } catch (err) {
+            if (
+              await recoverReadyRecordingAfterFinalizeError({
+                serverUrl: params.serverUrl,
+                recordingId: id,
+                authToken: params.authToken,
+              })
+            ) {
+              try {
+                await openExternal(
+                  `${params.serverUrl.replace(/\/+$/, "")}${viewUrl}`,
+                );
+              } catch (openErr) {
+                console.error("[clips-recorder] openExternal failed:", openErr);
+              }
+              return { recordingId: id, viewUrl };
+            }
             await abortRecordingUpload(
               params.serverUrl,
               id,
@@ -3225,6 +3287,26 @@ async function startRecordingInner(
       } catch (err) {
         console.error("[clips-recorder] finalize fetch failed:", err);
         const error = err instanceof Error ? err : new Error(String(err));
+        if (
+          await recoverReadyRecordingAfterFinalizeError({
+            serverUrl: params.serverUrl,
+            recordingId: id,
+            authToken: params.authToken,
+          })
+        ) {
+          const viewUrl = `/r/${id}`;
+          try {
+            await openExternal(
+              `${params.serverUrl.replace(/\/+$/, "")}${viewUrl}`,
+            );
+          } catch (openErr) {
+            console.error("[clips-recorder] openExternal failed:", openErr);
+          }
+          invoke("hide_finalizing").catch((hideErr) =>
+            console.error("[clips-recorder] hide_finalizing failed:", hideErr),
+          );
+          return { recordingId: id, viewUrl };
+        }
         await markBrowserRecordingBackupError(id, error.message).catch(
           () => {},
         );

package/corpus/templates/clips/server/lib/streaming-upload-mode.ts

@@ -0,0 +1,7 @@
+// Temporary kill switch: streaming resumable uploads caused a spike of
+// recording issues. Set CLIPS_DISABLE_STREAMING_UPLOAD=false to re-enable
+// once the root cause is fixed. Defaults to disabled (streaming off).
+export function isStreamingUploadDisabled(): boolean {
+  const flag = process.env.CLIPS_DISABLE_STREAMING_UPLOAD ?? "";
+  return flag.toLowerCase() !== "false";
+}

package/corpus/templates/clips/server/routes/api/uploads/[recordingId]/chunk.post.ts

@@ -46,6 +46,7 @@ import {
   setResumableSession,
   type StoredResumableSession,
 } from "../../../../lib/resumable-session.js";
+import { isStreamingUploadDisabled } from "../../../../lib/streaming-upload-mode.js";
 import {
   shouldRejectVideoUploadWithoutStorage,
   STORAGE_SETUP_REQUIRED_REASON,
@@ -174,6 +175,11 @@ export default defineEventHandler(async (event: H3Event) => {
 
     // Resumable streaming path — forward chunks directly to the provider.
     const resumableSession = await getResumableSession(recordingId);
+    if (resumableSession && isStreamingUploadDisabled()) {
+      console.warn(
+        `[chunk] streaming uploads are disabled, but preserving existing resumable session for in-flight recording: ${recordingId}`,
+      );
+    }
     if (resumableSession) {
       return handleResumableChunk(
         event,
@@ -574,6 +580,13 @@ async function handleResumableChunk(
   }
 
   if (isFinal && bytes.byteLength === 0) {
+    if (session.bytesUploaded <= 0) {
+      setResponseStatus(event, 400);
+      return {
+        ok: false,
+        error: "Cannot finalize an empty resumable upload",
+      };
+    }
     // 0-byte sentinel from the recorder after stop(). All data chunks have
     // already been PUT to the provider; send Content-Range: bytes */<total>
     // to close the session before handing off to finalize-recording.
@@ -582,7 +595,7 @@ async function handleResumableChunk(
       `bytes */${session.bytesUploaded}`,
       new Uint8Array(0),
     );
-    if (!closeRes.ok) {
+    if (!closeRes.ok || closeRes.status === 308) {
       console.error(
         `[resumable-chunk-${recordingId}] session close failed (${closeRes.status})`,
       );

package/corpus/templates/clips/server/routes/api/uploads/[recordingId]/status.get.ts

@@ -59,7 +59,10 @@ export default defineEventHandler(async (event: H3Event) => {
       recording: {
         id: recording.id,
         status: recording.status,
-        videoUrl: resolvePlayerVideoUrl(recording, { appPath }),
+        videoUrl: resolvePlayerVideoUrl(recording, {
+          appPath,
+          proxyRemoteMedia: true,
+        }),
         durationMs: recording.durationMs,
         width: recording.width,
         height: recording.height,

package/corpus/templates/clips/server/routes/api/video/[recordingId].get.ts

@@ -86,6 +86,8 @@ const PROXIED_HEADER_NAMES = [
 const PROVIDER_MEDIA_FETCH_TIMEOUT_MS = 30_000;
 const PROTECTED_MEDIA_ACCESS_TTL_SECONDS = 6 * 60 * 60;
 const PROTECTED_MEDIA_COOKIE_PREFIX = "clips_media_";
+const COMPRESSED_BUILDER_MEDIA_MISS_TTL_MS = 5_000;
+const compressedBuilderMediaMisses = new Map<string, number>();
 
 function appPath(path: string): string {
   if (!path.startsWith("/")) return path;
@@ -145,6 +147,82 @@ function isRecursiveVideoRouteUrl(value: string, recordingId: string): boolean {
   }
 }
 
+function compressedBuilderMediaUrl(sourceUrl: string): string | null {
+  try {
+    const url = new URL(sourceUrl);
+    if (!/^cdn(?:-qa)?\.builder\.io$/i.test(url.hostname)) return null;
+    if (url.searchParams.get("optimized") === "true") return null;
+
+    let objectPath: string | null = null;
+    if (url.pathname.startsWith("/o/")) {
+      objectPath = decodeURIComponent(url.pathname.slice("/o/".length));
+    } else if (url.pathname.startsWith("/api/v1/file/")) {
+      objectPath = decodeURIComponent(
+        url.pathname.slice("/api/v1/file/".length),
+      );
+    }
+    if (!objectPath || !objectPath.startsWith("assets/")) return null;
+    if (objectPath.endsWith("/compressed")) return null;
+
+    const parts = objectPath.split("/");
+    const assetId = parts[parts.length - 1];
+    const apiKey = url.searchParams.get("apiKey") || parts[1];
+    if (!assetId || !apiKey) return null;
+
+    const compressedPath = `${objectPath}/compressed`;
+    const compressedUrl = new URL(
+      `/o/${encodeURIComponent(compressedPath)}`,
+      url.origin,
+    );
+    compressedUrl.searchParams.set("apiKey", apiKey);
+    compressedUrl.searchParams.set(
+      "token",
+      url.searchParams.get("token") || assetId,
+    );
+    compressedUrl.searchParams.set("alt", "media");
+    compressedUrl.searchParams.set("optimized", "true");
+    return compressedUrl.toString();
+  } catch {
+    return null;
+  }
+}
+
+function shouldSkipCompressedBuilderMediaProbe(
+  compressedSourceUrl: string,
+): boolean {
+  const expiresAt = compressedBuilderMediaMisses.get(compressedSourceUrl);
+  if (!expiresAt) return false;
+  if (expiresAt <= Date.now()) {
+    compressedBuilderMediaMisses.delete(compressedSourceUrl);
+    return false;
+  }
+  return true;
+}
+
+function rememberCompressedBuilderMediaMiss(compressedSourceUrl: string): void {
+  if (compressedBuilderMediaMisses.size > 1_000) {
+    for (const [url, expiresAt] of compressedBuilderMediaMisses) {
+      if (expiresAt <= Date.now()) compressedBuilderMediaMisses.delete(url);
+    }
+  }
+  compressedBuilderMediaMisses.set(
+    compressedSourceUrl,
+    Date.now() + COMPRESSED_BUILDER_MEDIA_MISS_TTL_MS,
+  );
+}
+
+function shouldFallbackToOriginalMedia(
+  upstream: Response | { error: string; status: number },
+): boolean {
+  return [403, 404, 416].includes(upstream.status);
+}
+
+function shouldRememberCompressedBuilderMediaMiss(
+  upstream: Response | { error: string; status: number },
+): boolean {
+  return [403, 404].includes(upstream.status);
+}
+
 async function fetchProviderMedia(
   sourceUrl: string,
   rangeHeader: string | undefined,
@@ -434,7 +512,24 @@ export default defineEventHandler(async (event: H3Event) => {
 
         let upstream: Response | { error: string; status: number };
         try {
-          upstream = await fetchProviderMedia(sourceUrl, rangeHeader);
+          const compressedSourceUrl = compressedBuilderMediaUrl(sourceUrl);
+          if (
+            compressedSourceUrl &&
+            !shouldSkipCompressedBuilderMediaProbe(compressedSourceUrl)
+          ) {
+            upstream = await fetchProviderMedia(
+              compressedSourceUrl,
+              rangeHeader,
+            );
+            if (shouldRememberCompressedBuilderMediaMiss(upstream)) {
+              rememberCompressedBuilderMediaMiss(compressedSourceUrl);
+            }
+            if (shouldFallbackToOriginalMedia(upstream)) {
+              upstream = await fetchProviderMedia(sourceUrl, rangeHeader);
+            }
+          } else {
+            upstream = await fetchProviderMedia(sourceUrl, rangeHeader);
+          }
         } catch (err) {
           setResponseStatus(event, statusCodeForProviderFetchError(err));
           return { error: messageForProviderFetchError(err) };

package/corpus/templates/clips/shared/finalize-recovery.ts

@@ -0,0 +1,242 @@
+type FetchLike = (
+  input: RequestInfo | URL,
+  init?: RequestInit,
+) => Promise<Response>;
+
+export type RecoveredReadyRecording = {
+  ok: true;
+  finalized: true;
+  recoveredAfterFinalizeError: true;
+  id: string;
+  recordingId: string;
+  status: "ready";
+  videoUrl: string;
+  durationMs?: number;
+  width?: number;
+  height?: number;
+  hasAudio?: boolean;
+  hasCamera?: boolean;
+};
+
+type ProbeResult =
+  | { ready: true; result: RecoveredReadyRecording }
+  | { ready: false; terminal: boolean; status?: string };
+
+const DEFAULT_READY_RECOVERY_TIMEOUT_MS = 90_000;
+const DEFAULT_READY_RECOVERY_INTERVAL_MS = 3_000;
+const DEFAULT_READY_RECOVERY_FETCH_TIMEOUT_MS = 2_000;
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function absoluteUploadUrl(uploadUrl: string): URL {
+  if (/^[a-z][a-z0-9+.-]*:/i.test(uploadUrl)) return new URL(uploadUrl);
+  const origin =
+    typeof globalThis.location?.origin === "string"
+      ? globalThis.location.origin
+      : "http://localhost";
+  return new URL(uploadUrl, origin);
+}
+
+function maybeRelativeUrl(url: URL, original: string): string {
+  if (/^[a-z][a-z0-9+.-]*:/i.test(original)) return url.toString();
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+
+export function publicRecordingStatusUrl(
+  uploadUrl: string,
+  recordingId: string,
+): string {
+  const url = absoluteUploadUrl(uploadUrl);
+  const match = url.pathname.match(/^(.*)\/api\/uploads\/[^/]+\/chunk$/);
+  const basePath = match?.[1] ?? "";
+  url.pathname = `${basePath}/api/public-recording`;
+  url.search = "";
+  url.searchParams.set("id", recordingId);
+  return maybeRelativeUrl(url, uploadUrl);
+}
+
+export function authenticatedRecordingStatusUrl(
+  uploadUrl: string,
+  recordingId: string,
+): string {
+  const url = absoluteUploadUrl(uploadUrl);
+  const match = url.pathname.match(/^(.*)\/api\/uploads\/[^/]+\/chunk$/);
+  const basePath = match?.[1] ?? "";
+  url.pathname = `${basePath}/api/uploads/${encodeURIComponent(
+    recordingId,
+  )}/status`;
+  url.search = "";
+  return maybeRelativeUrl(url, uploadUrl);
+}
+
+function optionalNumber(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isFinite(value)
+    ? value
+    : undefined;
+}
+
+function optionalBoolean(value: unknown): boolean | undefined {
+  return typeof value === "boolean" ? value : undefined;
+}
+
+export function readyRecordingFromPublicPayload(
+  payload: unknown,
+  fallbackRecordingId: string,
+): ProbeResult {
+  const root =
+    payload && typeof payload === "object"
+      ? (payload as Record<string, unknown>)
+      : null;
+  const recording =
+    root?.recording && typeof root.recording === "object"
+      ? (root.recording as Record<string, unknown>)
+      : null;
+  const status =
+    typeof recording?.status === "string" ? recording.status : undefined;
+
+  if (!recording) return { ready: false, terminal: false };
+  if (status === "failed") return { ready: false, terminal: true, status };
+
+  const videoUrl =
+    typeof recording.videoUrl === "string" ? recording.videoUrl : "";
+  if (status !== "ready" || !videoUrl) {
+    return { ready: false, terminal: false, status };
+  }
+
+  const id =
+    typeof recording.id === "string" && recording.id
+      ? recording.id
+      : fallbackRecordingId;
+  return {
+    ready: true,
+    result: {
+      ok: true,
+      finalized: true,
+      recoveredAfterFinalizeError: true,
+      id,
+      recordingId: id,
+      status: "ready",
+      videoUrl,
+      durationMs: optionalNumber(recording.durationMs),
+      width: optionalNumber(recording.width),
+      height: optionalNumber(recording.height),
+      hasAudio: optionalBoolean(recording.hasAudio),
+      hasCamera: optionalBoolean(recording.hasCamera),
+    },
+  };
+}
+
+async function fetchWithTimeout(
+  fetchImpl: FetchLike,
+  url: string,
+  init: RequestInit,
+  timeoutMs: number,
+): Promise<Response> {
+  if (timeoutMs <= 0 || typeof AbortController === "undefined") {
+    return fetchImpl(url, init);
+  }
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetchImpl(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function waitForReadyRecordingAfterFinalizeError(args: {
+  uploadUrl: string;
+  recordingId: string;
+  authToken?: string | null;
+  preferAuthenticated?: boolean;
+  fetchImpl?: FetchLike;
+  sleepImpl?: (ms: number) => Promise<void>;
+  timeoutMs?: number;
+  intervalMs?: number;
+  fetchTimeoutMs?: number;
+}): Promise<RecoveredReadyRecording | null> {
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const sleepImpl = args.sleepImpl ?? sleep;
+  const timeoutMs = Math.max(
+    1,
+    args.timeoutMs ?? DEFAULT_READY_RECOVERY_TIMEOUT_MS,
+  );
+  const intervalMs = Math.max(
+    1,
+    args.intervalMs ?? DEFAULT_READY_RECOVERY_INTERVAL_MS,
+  );
+  const attempts = Math.max(1, Math.ceil(timeoutMs / intervalMs));
+  let url: string;
+  let authenticatedUrl: string | null = null;
+  try {
+    url = publicRecordingStatusUrl(args.uploadUrl, args.recordingId);
+    authenticatedUrl =
+      args.authToken || args.preferAuthenticated
+        ? authenticatedRecordingStatusUrl(args.uploadUrl, args.recordingId)
+        : null;
+  } catch {
+    return null;
+  }
+
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    const urls = authenticatedUrl
+      ? [
+          { url: authenticatedUrl, authenticated: true },
+          { url, authenticated: false },
+        ]
+      : [{ url, authenticated: false }];
+
+    for (const endpoint of urls) {
+      const headers: Record<string, string> = {
+        Accept: "application/json",
+        "X-Agent-Native-Frontend": "1",
+      };
+      if (endpoint.authenticated && args.authToken) {
+        headers.Authorization = `Bearer ${args.authToken}`;
+      }
+
+      try {
+        const response = await fetchWithTimeout(
+          fetchImpl,
+          endpoint.url,
+          {
+            method: "GET",
+            headers,
+            credentials: "include",
+            cache: "no-store",
+          },
+          args.fetchTimeoutMs ?? DEFAULT_READY_RECOVERY_FETCH_TIMEOUT_MS,
+        );
+
+        if (response.ok) {
+          const payload = await response.json().catch(() => null);
+          const probe = readyRecordingFromPublicPayload(
+            payload,
+            args.recordingId,
+          );
+          if (probe.ready) return probe.result;
+          if (probe.terminal) return null;
+          break;
+        }
+
+        if (
+          response.status >= 400 &&
+          response.status < 500 &&
+          !endpoint.authenticated &&
+          !authenticatedUrl
+        ) {
+          return null;
+        }
+      } catch {
+        // Try the public endpoint fallback below, then keep polling.
+      }
+    }
+
+    if (attempt < attempts - 1) await sleepImpl(intervalMs);
+  }
+
+  return null;
+}

package/corpus/templates/design/changelog/2026-07-01-design-recovers-sooner-when-an-agent-gets-stuck-preparing-a-.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-01
+---
+
+Design recovers sooner when an agent gets stuck preparing a large design edit.

package/corpus/templates/plan/app/global.css

@@ -156,7 +156,7 @@
   }
 
   .plan-content-surface[data-recap-screenshot-theme] .plan-document-shell {
-    padding: 10px;
+    padding: 0;
   }
 
   .plan-content-surface[data-recap-screenshot-theme] .plan-document-body {

package/dist/a2a/caller-auth.d.ts

@@ -1,5 +1,6 @@
 export interface A2ACallerAuth {
     apiKey?: string;
+    apiKeyFallbacks?: string[];
     userEmail?: string;
     orgId?: string;
     orgDomain?: string;

package/dist/a2a/caller-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caller-auth.d.ts","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IACnD,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,OAAO,CAAC,aAAa,CAAC,CAmCzB"}
+{"version":3,"file":"caller-auth.d.ts","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IACnD,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,GAAG,OAAO,CAAC,aAAa,CAAC,CA+DzB"}

package/dist/a2a/caller-auth.js

@@ -23,20 +23,46 @@ export async function resolveA2ACallerAuth(options) {
         }
         catch { }
     }
-    let apiKey;
+    const apiKeyAttempts = [];
+    const addApiKeyAttempt = (token) => {
+        if (!token || apiKeyAttempts.includes(token))
+            return;
+        apiKeyAttempts.push(token);
+    };
     if (userEmail && (orgSecret || process.env.A2A_SECRET)) {
-        try {
-            apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {
-                expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
-                preferGlobalSecret: !orgSecret,
-            });
+        if (process.env.A2A_SECRET?.trim()) {
+            try {
+                addApiKeyAttempt(await signA2AToken(userEmail, orgDomain, orgSecret, {
+                    expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
+                    preferGlobalSecret: true,
+                }));
+            }
+            catch { }
+        }
+        if (orgSecret) {
+            try {
+                addApiKeyAttempt(await signA2AToken(userEmail, orgDomain, orgSecret, {
+                    expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
+                    preferGlobalSecret: false,
+                }));
+            }
+            catch { }
         }
-        catch { }
     }
     if (options?.includeGoogleToken) {
         await attachGoogleTokenMetadata(metadata, userEmail);
     }
-    return { apiKey, userEmail, orgId, orgDomain, orgSecret, metadata };
+    return {
+        apiKey: apiKeyAttempts[0],
+        ...(apiKeyAttempts.length > 1
+            ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }
+            : {}),
+        userEmail,
+        orgId,
+        orgDomain,
+        orgSecret,
+        metadata,
+    };
 }
 async function attachGoogleTokenMetadata(metadata, userEmail) {
     if (process.env.NODE_ENV !== "production" || !userEmail)

package/dist/a2a/caller-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"caller-auth.js","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAW3C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAG1C;IACC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IAE9C,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC3D,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YACrD,IAAI,SAAS;gBAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC9D,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;gBAC3D,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,4BAA4B;gBAC7D,kBAAkB,EAAE,CAAC,SAAS;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAChC,MAAM,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAiC,EACjC,SAA6B;IAE7B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO;IAEhE,IAAI,CAAC;QACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,QAAQ,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC","sourcesContent":["import {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"../server/request-context.js\";\nimport { signA2AToken } from \"./client.js\";\n\nconst DEFAULT_A2A_CALLER_TOKEN_TTL = \"30m\";\n\nexport interface A2ACallerAuth {\n  apiKey?: string;\n  userEmail?: string;\n  orgId?: string;\n  orgDomain?: string;\n  orgSecret?: string;\n  metadata: Record<string, unknown>;\n}\n\nexport async function resolveA2ACallerAuth(options?: {\n  expiresIn?: string | number;\n  includeGoogleToken?: boolean;\n}): Promise<A2ACallerAuth> {\n  const userEmail = getRequestUserEmail();\n  const metadata: Record<string, unknown> = {};\n  if (userEmail) metadata.userEmail = userEmail;\n\n  let orgDomain: string | undefined;\n  let orgSecret: string | undefined;\n  const orgId = getRequestOrgId();\n  if (orgId) {\n    try {\n      const { getOrgDomain } = await import(\"../org/context.js\");\n      orgDomain = (await getOrgDomain(orgId)) ?? undefined;\n      if (orgDomain) metadata.orgDomain = orgDomain;\n    } catch {}\n    try {\n      const { getOrgA2ASecret } = await import(\"../org/context.js\");\n      orgSecret = (await getOrgA2ASecret(orgId)) ?? undefined;\n    } catch {}\n  }\n\n  let apiKey: string | undefined;\n  if (userEmail && (orgSecret || process.env.A2A_SECRET)) {\n    try {\n      apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {\n        expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,\n        preferGlobalSecret: !orgSecret,\n      });\n    } catch {}\n  }\n\n  if (options?.includeGoogleToken) {\n    await attachGoogleTokenMetadata(metadata, userEmail);\n  }\n\n  return { apiKey, userEmail, orgId, orgDomain, orgSecret, metadata };\n}\n\nasync function attachGoogleTokenMetadata(\n  metadata: Record<string, unknown>,\n  userEmail: string | undefined,\n): Promise<void> {\n  if (process.env.NODE_ENV !== \"production\" || !userEmail) return;\n\n  try {\n    const { listOAuthAccountsByOwner } =\n      await import(\"../oauth-tokens/store.js\");\n    const accounts = await listOAuthAccountsByOwner(\"google\", userEmail);\n    const tokens = accounts[0]?.tokens;\n    if (tokens?.access_token) {\n      metadata.googleToken = tokens.access_token;\n    }\n  } catch {}\n}\n"]}
+{"version":3,"file":"caller-auth.js","sourceRoot":"","sources":["../../src/a2a/caller-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAY3C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAG1C;IACC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IAE9C,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC3D,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YACrD,IAAI,SAAS;gBAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC9D,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAAE,EAAE;QACrD,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QACrD,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,IAAI,SAAS,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,gBAAgB,CACd,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;oBAClD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,4BAA4B;oBAC7D,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,gBAAgB,CACd,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;oBAClD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,4BAA4B;oBAC7D,kBAAkB,EAAE,KAAK;iBAC1B,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAChC,MAAM,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QACzB,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YAC3B,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,SAAS;QACT,KAAK;QACL,SAAS;QACT,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAiC,EACjC,SAA6B;IAE7B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO;IAEhE,IAAI,CAAC;QACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,QAAQ,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC","sourcesContent":["import {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"../server/request-context.js\";\nimport { signA2AToken } from \"./client.js\";\n\nconst DEFAULT_A2A_CALLER_TOKEN_TTL = \"30m\";\n\nexport interface A2ACallerAuth {\n  apiKey?: string;\n  apiKeyFallbacks?: string[];\n  userEmail?: string;\n  orgId?: string;\n  orgDomain?: string;\n  orgSecret?: string;\n  metadata: Record<string, unknown>;\n}\n\nexport async function resolveA2ACallerAuth(options?: {\n  expiresIn?: string | number;\n  includeGoogleToken?: boolean;\n}): Promise<A2ACallerAuth> {\n  const userEmail = getRequestUserEmail();\n  const metadata: Record<string, unknown> = {};\n  if (userEmail) metadata.userEmail = userEmail;\n\n  let orgDomain: string | undefined;\n  let orgSecret: string | undefined;\n  const orgId = getRequestOrgId();\n  if (orgId) {\n    try {\n      const { getOrgDomain } = await import(\"../org/context.js\");\n      orgDomain = (await getOrgDomain(orgId)) ?? undefined;\n      if (orgDomain) metadata.orgDomain = orgDomain;\n    } catch {}\n    try {\n      const { getOrgA2ASecret } = await import(\"../org/context.js\");\n      orgSecret = (await getOrgA2ASecret(orgId)) ?? undefined;\n    } catch {}\n  }\n\n  const apiKeyAttempts: string[] = [];\n  const addApiKeyAttempt = (token: string | undefined) => {\n    if (!token || apiKeyAttempts.includes(token)) return;\n    apiKeyAttempts.push(token);\n  };\n  if (userEmail && (orgSecret || process.env.A2A_SECRET)) {\n    if (process.env.A2A_SECRET?.trim()) {\n      try {\n        addApiKeyAttempt(\n          await signA2AToken(userEmail, orgDomain, orgSecret, {\n            expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,\n            preferGlobalSecret: true,\n          }),\n        );\n      } catch {}\n    }\n    if (orgSecret) {\n      try {\n        addApiKeyAttempt(\n          await signA2AToken(userEmail, orgDomain, orgSecret, {\n            expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,\n            preferGlobalSecret: false,\n          }),\n        );\n      } catch {}\n    }\n  }\n\n  if (options?.includeGoogleToken) {\n    await attachGoogleTokenMetadata(metadata, userEmail);\n  }\n\n  return {\n    apiKey: apiKeyAttempts[0],\n    ...(apiKeyAttempts.length > 1\n      ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }\n      : {}),\n    userEmail,\n    orgId,\n    orgDomain,\n    orgSecret,\n    metadata,\n  };\n}\n\nasync function attachGoogleTokenMetadata(\n  metadata: Record<string, unknown>,\n  userEmail: string | undefined,\n): Promise<void> {\n  if (process.env.NODE_ENV !== \"production\" || !userEmail) return;\n\n  try {\n    const { listOAuthAccountsByOwner } =\n      await import(\"../oauth-tokens/store.js\");\n    const accounts = await listOAuthAccountsByOwner(\"google\", userEmail);\n    const tokens = accounts[0]?.tokens;\n    if (tokens?.access_token) {\n      metadata.googleToken = tokens.access_token;\n    }\n  } catch {}\n}\n"]}