@adcp/sdk 13.0.4 → 13.1.1

package/dist/lib/testing/storyboard/request-signing/a2a-dispatch.js

@@ -0,0 +1,279 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var a2a_dispatch_exports = {};
+__export(a2a_dispatch_exports, {
+  captureA2aRequest: () => captureA2aRequest,
+  createCachedA2aCardFetch: () => createCachedA2aCardFetch,
+  operationFromVectorUrl: () => operationFromVectorUrl,
+  resolveA2aDispatchTarget: () => resolveA2aDispatchTarget
+});
+module.exports = __toCommonJS(a2a_dispatch_exports);
+var import_agent_transport_fetch = require('../../../net/agent-transport-fetch.js');
+var import_abort = require('../../../protocols/abort.js');
+var import_a2a_discovery = require('../../../utils/a2a-discovery.js');
+var import_a2a_push_notification = require('../../../protocols/a2a-push-notification.js');
+const DEFAULT_CARD_FETCH_TIMEOUT_MS = 1e4;
+const MAX_CACHED_AGENT_CARD_BYTES = 1048576;
+const ADCP_A2A_EXTENSION = "https://adcontextprotocol.org/extensions/adcp/v3";
+const CARD_DRIVEN_LEGACY_COMPAT = Object.freeze({ enabled: true });
+class RequestCaptured extends Error {
+  constructor(captured) {
+    super("a2a request captured");
+    this.captured = captured;
+  }
+  captured;
+}
+async function captureA2aRequest(agentUrl, call, options = {}) {
+  const { ClientFactory, JsonRpcTransportFactory, ServiceParameters, withA2AExtensions } = await import("@a2a-js/sdk-v1/client");
+  const { Role } = await import("@a2a-js/sdk-v1");
+  const capturingFetch = async (input, init) => {
+    const request = new Request(input, init);
+    const headers = {};
+    request.headers.forEach((value, name) => {
+      headers[name] = value;
+    });
+    throw new RequestCaptured({
+      url: request.url,
+      method: request.method,
+      headers,
+      body: await request.text()
+    });
+  };
+  const cardFetch = buildGuardedCardFetch(agentUrl, options);
+  const factory = new ClientFactory({
+    transports: [new JsonRpcTransportFactory({ fetchImpl: capturingFetch, legacyCompat: CARD_DRIVEN_LEGACY_COMPAT })],
+    cardResolver: new (await import("@a2a-js/sdk-v1/client")).DefaultAgentCardResolver({
+      fetchImpl: cardFetch,
+      legacyCompat: CARD_DRIVEN_LEGACY_COMPAT
+    })
+  });
+  const client = await createCardDrivenClient(agentUrl, factory);
+  const legacyWire = client.protocolVersion?.startsWith("0.") ?? false;
+  try {
+    if (call.kind === "cancelTask") {
+      await client.cancelTask({ tenant: "", id: call.taskId, metadata: void 0 });
+    } else {
+      const pushNotificationConfig = call.args.push_notification_config;
+      const invocation = legacyWire ? {
+        skill: call.operation,
+        // The maintained 0.3 runtime carries the AdCP application-layer
+        // registration in skill parameters. Do not reinterpret it as the
+        // native 1.0 transport facility while capturing signing bytes.
+        parameters: call.args
+      } : {
+        skill: call.operation,
+        // Native A2A transport registration cannot represent AdCP-only
+        // fields such as operation_id. Keep the complete application
+        // registration in skill input, matching the runtime path.
+        input: call.args
+      };
+      const request = {
+        tenant: "",
+        message: {
+          messageId: globalThis.crypto.randomUUID(),
+          contextId: "",
+          taskId: "",
+          role: Role.ROLE_USER,
+          parts: [
+            {
+              content: { $case: "data", value: invocation },
+              metadata: void 0,
+              filename: "",
+              mediaType: "application/json"
+            }
+          ],
+          metadata: void 0,
+          extensions: legacyWire ? [] : [ADCP_A2A_EXTENSION],
+          referenceTaskIds: []
+        },
+        configuration: !legacyWire && pushNotificationConfig != null && typeof pushNotificationConfig === "object" && !Array.isArray(pushNotificationConfig) ? {
+          acceptedOutputModes: ["application/json"],
+          taskPushNotificationConfig: (0, import_a2a_push_notification.toA2ATaskPushNotificationConfig)(
+            pushNotificationConfig
+          ),
+          returnImmediately: false
+        } : void 0,
+        metadata: void 0
+      };
+      await client.sendMessage(request, {
+        ...legacyWire ? {} : { serviceParameters: ServiceParameters.create(withA2AExtensions(ADCP_A2A_EXTENSION)) }
+      });
+    }
+  } catch (error) {
+    if (error instanceof RequestCaptured) {
+      assertSameOriginEndpoint(agentUrl, error.captured.url);
+      return error.captured;
+    }
+    throw error;
+  }
+  throw new Error(`the A2A client returned without issuing a request for ${call.kind}`);
+}
+async function createCardDrivenClient(agentUrl, factory) {
+  let lastError;
+  for (const cardUrl of (0, import_a2a_discovery.buildCardUrls)(agentUrl)) {
+    try {
+      return await factory.createFromUrl(cardUrl, "");
+    } catch (error) {
+      if ((0, import_abort.isAbortOrTimeoutError)(error)) throw error;
+      lastError = error;
+    }
+  }
+  throw new Error("A2A agent card discovery failed", { cause: lastError });
+}
+function buildGuardedCardFetch(agentUrl, options) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_CARD_FETCH_TIMEOUT_MS;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > import_abort.MAX_TIMER_DELAY_MS) {
+    throw new RangeError(`A2A card timeoutMs must be a finite positive number <= ${import_abort.MAX_TIMER_DELAY_MS}`);
+  }
+  const transportFetch = (0, import_agent_transport_fetch.createAgentTransportFetch)(agentUrl, {
+    ...options.cardFetch ? { trustedFetchFn: options.cardFetch } : {},
+    allowPrivateIp: options.allowPrivateIp === true
+  });
+  return ((input, init = {}) => (0, import_abort.withAbortSignal)([init.signal], timeoutMs, async (signal) => {
+    const response = await transportFetch(input, { ...init, ...signal ? { signal } : {} });
+    const body = await readCardBodyBounded(response, MAX_CACHED_AGENT_CARD_BYTES, signal);
+    return new Response(body.byteLength > 0 ? Uint8Array.from(body).buffer : null, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+  }));
+}
+function createCachedA2aCardFetch(agentUrl, options = {}) {
+  const upstream = buildGuardedCardFetch(agentUrl, options);
+  const responses = /* @__PURE__ */ new Map();
+  return async (input, init) => {
+    const request = new Request(input, init);
+    if (request.method !== "GET") return upstream(input, init);
+    let pending = responses.get(request.url);
+    if (!pending) {
+      pending = upstream(input, init).then(async (response) => ({
+        status: response.status,
+        statusText: response.statusText,
+        headers: (() => {
+          const entries = [];
+          response.headers.forEach((value, name) => entries.push([name, value]));
+          return entries;
+        })(),
+        body: await readCardBodyBounded(response, MAX_CACHED_AGENT_CARD_BYTES)
+      }));
+      responses.set(request.url, pending);
+      pending.catch(() => responses.delete(request.url));
+    }
+    const cached = await pending;
+    return new Response(cached.body.slice(), {
+      status: cached.status,
+      statusText: cached.statusText,
+      headers: cached.headers
+    });
+  };
+}
+async function readCardBodyBounded(response, maxBytes, signal) {
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+    void response.body?.cancel().catch(() => void 0);
+    throw new Error(`A2A agent card exceeds the ${maxBytes}-byte discovery limit`);
+  }
+  if (!response.body) return new Uint8Array();
+  const reader = response.body.getReader();
+  const cancel = () => void reader.cancel(signal?.reason).catch(() => void 0);
+  signal?.addEventListener("abort", cancel, { once: true });
+  try {
+    const chunks = [];
+    let length = 0;
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      length += value.byteLength;
+      if (length > maxBytes) {
+        void reader.cancel().catch(() => void 0);
+        throw new Error(`A2A agent card exceeds the ${maxBytes}-byte discovery limit`);
+      }
+      chunks.push(value);
+    }
+    const body = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+      body.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return body;
+  } finally {
+    signal?.removeEventListener("abort", cancel);
+  }
+}
+function operationFromVectorUrl(vectorUrl) {
+  const last = new URL(vectorUrl).pathname.split("/").filter(Boolean).at(-1);
+  if (!last || !/^[a-z][a-z0-9_]*$/.test(last)) {
+    throw new Error(`Cannot extract an AdCP operation name from vector URL: ${vectorUrl}`);
+  }
+  return last;
+}
+async function resolveA2aDispatchTarget(agentUrl, options = {}) {
+  const { ClientFactory, DefaultAgentCardResolver, JsonRpcTransportFactory } = await import("@a2a-js/sdk-v1/client");
+  let endpoint = "";
+  const noteEndpoint = async (input, init) => {
+    endpoint = new Request(input, init).url;
+    throw new RequestCaptured({ url: endpoint, method: "POST", headers: {}, body: "" });
+  };
+  const factory = new ClientFactory({
+    transports: [new JsonRpcTransportFactory({ fetchImpl: noteEndpoint, legacyCompat: CARD_DRIVEN_LEGACY_COMPAT })],
+    cardResolver: new DefaultAgentCardResolver({
+      fetchImpl: buildGuardedCardFetch(agentUrl, options),
+      legacyCompat: CARD_DRIVEN_LEGACY_COMPAT
+    })
+  });
+  const client = await createCardDrivenClient(agentUrl, factory);
+  try {
+    await client.cancelTask({ tenant: "", id: "a2a-dispatch-probe", metadata: void 0 });
+  } catch (error) {
+    if (error instanceof RequestCaptured) {
+      assertSameOriginEndpoint(agentUrl, endpoint);
+      return { endpoint };
+    }
+    throw error;
+  }
+  throw new Error("the A2A client returned without issuing a dispatch probe");
+}
+function assertSameOriginEndpoint(agentUrl, endpoint) {
+  const agentOrigin = new URL(agentUrl).origin;
+  const endpointOrigin = new URL(endpoint).origin;
+  if (endpointOrigin === agentOrigin) return;
+  throw new Error(
+    `A2A request-signing probes refuse a cross-origin card endpoint (${endpointOrigin}); expected ${agentOrigin}`
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  captureA2aRequest,
+  createCachedA2aCardFetch,
+  operationFromVectorUrl,
+  resolveA2aDispatchTarget
+});
+//# sourceMappingURL=a2a-dispatch.js.map

package/dist/lib/testing/storyboard/request-signing/a2a-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../src/lib/testing/storyboard/request-signing/a2a-dispatch.ts"],"sourcesContent":["/**\n * Capture requests emitted by the official A2A 1.x client for RFC 9421\n * signing. The SDK owns endpoint selection, method names, version headers,\n * and proto-JSON encoding; this module only intercepts its fetch seam.\n */\nimport { createAgentTransportFetch } from '../../../net/agent-transport-fetch';\nimport { isAbortOrTimeoutError, MAX_TIMER_DELAY_MS, withAbortSignal } from '../../../protocols/abort';\nimport { buildCardUrls } from '../../../utils/a2a-discovery';\nimport {\n  toA2ATaskPushNotificationConfig,\n  type A2APushNotificationConfig,\n} from '../../../protocols/a2a-push-notification';\nimport type { SendMessageRequest } from '@a2a-js/sdk-v1';\nimport type { Client } from '@a2a-js/sdk-v1/client';\n\nconst DEFAULT_CARD_FETCH_TIMEOUT_MS = 10_000;\nconst MAX_CACHED_AGENT_CARD_BYTES = 1_048_576;\nconst ADCP_A2A_EXTENSION = 'https://adcontextprotocol.org/extensions/adcp/v3';\n// Defined by the AdCP A2A profile extension and its canonical test vector:\n// docs/building/by-layer/L0/a2a-profile-extension.mdx\n// static/test-vectors/a2a-profile-extension-v3.json\nconst CARD_DRIVEN_LEGACY_COMPAT = Object.freeze({ enabled: true });\n\nexport interface CapturedA2aRequest {\n  url: string;\n  method: string;\n  headers: Record<string, string>;\n  body: string;\n}\n\nexport type A2aCall =\n  | { kind: 'sendMessage'; operation: string; args: Record<string, unknown> }\n  | { kind: 'cancelTask'; taskId: string };\n\nexport interface A2aDispatchOptions {\n  timeoutMs?: number;\n  allowPrivateIp?: boolean;\n  /** Trusted fetch used only for agent-card discovery. */\n  cardFetch?: typeof fetch;\n}\n\nclass RequestCaptured extends Error {\n  constructor(readonly captured: CapturedA2aRequest) {\n    super('a2a request captured');\n  }\n}\n\nexport async function captureA2aRequest(\n  agentUrl: string,\n  call: A2aCall,\n  options: A2aDispatchOptions = {}\n): Promise<CapturedA2aRequest> {\n  const { ClientFactory, JsonRpcTransportFactory, ServiceParameters, withA2AExtensions } =\n    await import('@a2a-js/sdk-v1/client');\n  const { Role } = await import('@a2a-js/sdk-v1');\n\n  const capturingFetch: typeof fetch = async (input, init) => {\n    const request = new Request(input as RequestInfo, init);\n    const headers: Record<string, string> = {};\n    request.headers.forEach((value, name) => {\n      headers[name] = value;\n    });\n    throw new RequestCaptured({\n      url: request.url,\n      method: request.method,\n      headers,\n      body: await request.text(),\n    });\n  };\n\n  const cardFetch = buildGuardedCardFetch(agentUrl, options);\n  const factory = new ClientFactory({\n    transports: [new JsonRpcTransportFactory({ fetchImpl: capturingFetch, legacyCompat: CARD_DRIVEN_LEGACY_COMPAT })],\n    cardResolver: new (await import('@a2a-js/sdk-v1/client')).DefaultAgentCardResolver({\n      fetchImpl: cardFetch,\n      legacyCompat: CARD_DRIVEN_LEGACY_COMPAT,\n    }),\n  });\n  const client = await createCardDrivenClient(agentUrl, factory);\n  const legacyWire = client.protocolVersion?.startsWith('0.') ?? false;\n\n  try {\n    if (call.kind === 'cancelTask') {\n      await client.cancelTask({ tenant: '', id: call.taskId, metadata: undefined });\n    } else {\n      const pushNotificationConfig = call.args.push_notification_config;\n      const invocation = legacyWire\n        ? {\n            skill: call.operation,\n            // The maintained 0.3 runtime carries the AdCP application-layer\n            // registration in skill parameters. Do not reinterpret it as the\n            // native 1.0 transport facility while capturing signing bytes.\n            parameters: call.args,\n          }\n        : {\n            skill: call.operation,\n            // Native A2A transport registration cannot represent AdCP-only\n            // fields such as operation_id. Keep the complete application\n            // registration in skill input, matching the runtime path.\n            input: call.args,\n          };\n      const request: SendMessageRequest = {\n        tenant: '',\n        message: {\n          messageId: globalThis.crypto.randomUUID(),\n          contextId: '',\n          taskId: '',\n          role: Role.ROLE_USER,\n          parts: [\n            {\n              content: { $case: 'data', value: invocation },\n              metadata: undefined,\n              filename: '',\n              mediaType: 'application/json',\n            },\n          ],\n          metadata: undefined,\n          extensions: legacyWire ? [] : [ADCP_A2A_EXTENSION],\n          referenceTaskIds: [],\n        },\n        configuration:\n          !legacyWire &&\n          pushNotificationConfig != null &&\n          typeof pushNotificationConfig === 'object' &&\n          !Array.isArray(pushNotificationConfig)\n            ? {\n                acceptedOutputModes: ['application/json'],\n                taskPushNotificationConfig: toA2ATaskPushNotificationConfig(\n                  pushNotificationConfig as A2APushNotificationConfig\n                ),\n                returnImmediately: false,\n              }\n            : undefined,\n        metadata: undefined,\n      };\n      await client.sendMessage(request, {\n        ...(legacyWire ? {} : { serviceParameters: ServiceParameters.create(withA2AExtensions(ADCP_A2A_EXTENSION)) }),\n      });\n    }\n  } catch (error) {\n    if (error instanceof RequestCaptured) {\n      assertSameOriginEndpoint(agentUrl, error.captured.url);\n      return error.captured;\n    }\n    throw error;\n  }\n  throw new Error(`the A2A client returned without issuing a request for ${call.kind}`);\n}\n\nasync function createCardDrivenClient(\n  agentUrl: string,\n  factory: { createFromUrl(baseUrl: string, path?: string): Promise<Client> }\n): Promise<Client> {\n  let lastError: unknown;\n  for (const cardUrl of buildCardUrls(agentUrl)) {\n    try {\n      return await factory.createFromUrl(cardUrl, '');\n    } catch (error) {\n      if (isAbortOrTimeoutError(error)) throw error;\n      lastError = error;\n    }\n  }\n  throw new Error('A2A agent card discovery failed', { cause: lastError });\n}\n\nfunction buildGuardedCardFetch(agentUrl: string, options: A2aDispatchOptions): typeof fetch {\n  const timeoutMs = options.timeoutMs ?? DEFAULT_CARD_FETCH_TIMEOUT_MS;\n  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_TIMER_DELAY_MS) {\n    throw new RangeError(`A2A card timeoutMs must be a finite positive number <= ${MAX_TIMER_DELAY_MS}`);\n  }\n  const transportFetch = createAgentTransportFetch(agentUrl, {\n    ...(options.cardFetch ? { trustedFetchFn: options.cardFetch } : {}),\n    allowPrivateIp: options.allowPrivateIp === true,\n  });\n  return ((input: RequestInfo | URL, init: RequestInit = {}) =>\n    withAbortSignal([init.signal], timeoutMs, async signal => {\n      const response = await transportFetch(input, { ...init, ...(signal ? { signal } : {}) });\n      // Keep the same discovery deadline active through body consumption. A\n      // peer can otherwise return headers plus one byte and stall grading\n      // forever while the official resolver waits for JSON completion.\n      const body = await readCardBodyBounded(response, MAX_CACHED_AGENT_CARD_BYTES, signal);\n      return new Response(body.byteLength > 0 ? Uint8Array.from(body).buffer : null, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: response.headers,\n      });\n    })) as typeof fetch;\n}\n\n/**\n * Cache discovery within one grading run without turning the platform fetch\n * into a trusted fetch override. The guarded transport performs DNS/private\n * address enforcement before this wrapper sees a response.\n */\nexport function createCachedA2aCardFetch(agentUrl: string, options: A2aDispatchOptions = {}): typeof fetch {\n  const upstream = buildGuardedCardFetch(agentUrl, options);\n  const responses = new Map<\n    string,\n    Promise<{ status: number; statusText: string; headers: [string, string][]; body: Uint8Array }>\n  >();\n  return async (input, init) => {\n    const request = new Request(input as RequestInfo, init);\n    if (request.method !== 'GET') return upstream(input, init);\n    let pending = responses.get(request.url);\n    if (!pending) {\n      pending = upstream(input, init).then(async response => ({\n        status: response.status,\n        statusText: response.statusText,\n        headers: (() => {\n          const entries: [string, string][] = [];\n          response.headers.forEach((value, name) => entries.push([name, value]));\n          return entries;\n        })(),\n        body: await readCardBodyBounded(response, MAX_CACHED_AGENT_CARD_BYTES),\n      }));\n      responses.set(request.url, pending);\n      pending.catch(() => responses.delete(request.url));\n    }\n    const cached = await pending;\n    return new Response(cached.body.slice(), {\n      status: cached.status,\n      statusText: cached.statusText,\n      headers: cached.headers,\n    });\n  };\n}\n\nasync function readCardBodyBounded(response: Response, maxBytes: number, signal?: AbortSignal): Promise<Uint8Array> {\n  const declaredLength = Number(response.headers.get('content-length'));\n  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {\n    void response.body?.cancel().catch(() => undefined);\n    throw new Error(`A2A agent card exceeds the ${maxBytes}-byte discovery limit`);\n  }\n  if (!response.body) return new Uint8Array();\n  const reader = response.body.getReader();\n  const cancel = () => void reader.cancel(signal?.reason).catch(() => undefined);\n  signal?.addEventListener('abort', cancel, { once: true });\n  try {\n    const chunks: Uint8Array[] = [];\n    let length = 0;\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      length += value.byteLength;\n      if (length > maxBytes) {\n        void reader.cancel().catch(() => undefined);\n        throw new Error(`A2A agent card exceeds the ${maxBytes}-byte discovery limit`);\n      }\n      chunks.push(value);\n    }\n    const body = new Uint8Array(length);\n    let offset = 0;\n    for (const chunk of chunks) {\n      body.set(chunk, offset);\n      offset += chunk.byteLength;\n    }\n    return body;\n  } finally {\n    signal?.removeEventListener('abort', cancel);\n  }\n}\n\nexport function operationFromVectorUrl(vectorUrl: string): string {\n  const last = new URL(vectorUrl).pathname.split('/').filter(Boolean).at(-1);\n  if (!last || !/^[a-z][a-z0-9_]*$/.test(last)) {\n    throw new Error(`Cannot extract an AdCP operation name from vector URL: ${vectorUrl}`);\n  }\n  return last;\n}\n\nexport async function resolveA2aDispatchTarget(\n  agentUrl: string,\n  options: A2aDispatchOptions = {}\n): Promise<{ endpoint: string }> {\n  const { ClientFactory, DefaultAgentCardResolver, JsonRpcTransportFactory } = await import('@a2a-js/sdk-v1/client');\n  let endpoint = '';\n  const noteEndpoint: typeof fetch = async (input, init) => {\n    endpoint = new Request(input as RequestInfo, init).url;\n    throw new RequestCaptured({ url: endpoint, method: 'POST', headers: {}, body: '' });\n  };\n  const factory = new ClientFactory({\n    transports: [new JsonRpcTransportFactory({ fetchImpl: noteEndpoint, legacyCompat: CARD_DRIVEN_LEGACY_COMPAT })],\n    cardResolver: new DefaultAgentCardResolver({\n      fetchImpl: buildGuardedCardFetch(agentUrl, options),\n      legacyCompat: CARD_DRIVEN_LEGACY_COMPAT,\n    }),\n  });\n  const client = await createCardDrivenClient(agentUrl, factory);\n  try {\n    await client.cancelTask({ tenant: '', id: 'a2a-dispatch-probe', metadata: undefined });\n  } catch (error) {\n    if (error instanceof RequestCaptured) {\n      assertSameOriginEndpoint(agentUrl, endpoint);\n      return { endpoint };\n    }\n    throw error;\n  }\n  throw new Error('the A2A client returned without issuing a dispatch probe');\n}\n\nfunction assertSameOriginEndpoint(agentUrl: string, endpoint: string): void {\n  const agentOrigin = new URL(agentUrl).origin;\n  const endpointOrigin = new URL(endpoint).origin;\n  if (endpointOrigin === agentOrigin) return;\n  throw new Error(\n    `A2A request-signing probes refuse a cross-origin card endpoint (${endpointOrigin}); expected ${agentOrigin}`\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,mCAA0C;AAC1C,mBAA2E;AAC3E,2BAA8B;AAC9B,mCAGO;AAIP,MAAM,gCAAgC;AACtC,MAAM,8BAA8B;AACpC,MAAM,qBAAqB;AAI3B,MAAM,4BAA4B,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC;AAoBjE,MAAM,wBAAwB,MAAM;AAAA,EAClC,YAAqB,UAA8B;AACjD,UAAM,sBAAsB;AADT;AAAA,EAErB;AAAA,EAFqB;AAGvB;AAEA,eAAsB,kBACpB,UACA,MACA,UAA8B,CAAC,GACF;AAC7B,QAAM,EAAE,eAAe,yBAAyB,mBAAmB,kBAAkB,IACnF,MAAM,OAAO,uBAAuB;AACtC,QAAM,EAAE,KAAK,IAAI,MAAM,OAAO,gBAAgB;AAE9C,QAAM,iBAA+B,OAAO,OAAO,SAAS;AAC1D,UAAM,UAAU,IAAI,QAAQ,OAAsB,IAAI;AACtD,UAAM,UAAkC,CAAC;AACzC,YAAQ,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACvC,cAAQ,IAAI,IAAI;AAAA,IAClB,CAAC;AACD,UAAM,IAAI,gBAAgB;AAAA,MACxB,KAAK,QAAQ;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,QAAM,YAAY,sBAAsB,UAAU,OAAO;AACzD,QAAM,UAAU,IAAI,cAAc;AAAA,IAChC,YAAY,CAAC,IAAI,wBAAwB,EAAE,WAAW,gBAAgB,cAAc,0BAA0B,CAAC,CAAC;AAAA,IAChH,cAAc,KAAK,MAAM,OAAO,uBAAuB,GAAG,yBAAyB;AAAA,MACjF,WAAW;AAAA,MACX,cAAc;AAAA,IAChB,CAAC;AAAA,EACH,CAAC;AACD,QAAM,SAAS,MAAM,uBAAuB,UAAU,OAAO;AAC7D,QAAM,aAAa,OAAO,iBAAiB,WAAW,IAAI,KAAK;AAE/D,MAAI;AACF,QAAI,KAAK,SAAS,cAAc;AAC9B,YAAM,OAAO,WAAW,EAAE,QAAQ,IAAI,IAAI,KAAK,QAAQ,UAAU,OAAU,CAAC;AAAA,IAC9E,OAAO;AACL,YAAM,yBAAyB,KAAK,KAAK;AACzC,YAAM,aAAa,aACf;AAAA,QACE,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA,QAIZ,YAAY,KAAK;AAAA,MACnB,IACA;AAAA,QACE,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA,QAIZ,OAAO,KAAK;AAAA,MACd;AACJ,YAAM,UAA8B;AAAA,QAClC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,WAAW,WAAW,OAAO,WAAW;AAAA,UACxC,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,MAAM,KAAK;AAAA,UACX,OAAO;AAAA,YACL;AAAA,cACE,SAAS,EAAE,OAAO,QAAQ,OAAO,WAAW;AAAA,cAC5C,UAAU;AAAA,cACV,UAAU;AAAA,cACV,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,UAAU;AAAA,UACV,YAAY,aAAa,CAAC,IAAI,CAAC,kBAAkB;AAAA,UACjD,kBAAkB,CAAC;AAAA,QACrB;AAAA,QACA,eACE,CAAC,cACD,0BAA0B,QAC1B,OAAO,2BAA2B,YAClC,CAAC,MAAM,QAAQ,sBAAsB,IACjC;AAAA,UACE,qBAAqB,CAAC,kBAAkB;AAAA,UACxC,gCAA4B;AAAA,YAC1B;AAAA,UACF;AAAA,UACA,mBAAmB;AAAA,QACrB,IACA;AAAA,QACN,UAAU;AAAA,MACZ;AACA,YAAM,OAAO,YAAY,SAAS;AAAA,QAChC,GAAI,aAAa,CAAC,IAAI,EAAE,mBAAmB,kBAAkB,OAAO,kBAAkB,kBAAkB,CAAC,EAAE;AAAA,MAC7G,CAAC;AAAA,IACH;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAiB;AACpC,+BAAyB,UAAU,MAAM,SAAS,GAAG;AACrD,aAAO,MAAM;AAAA,IACf;AACA,UAAM;AAAA,EACR;AACA,QAAM,IAAI,MAAM,yDAAyD,KAAK,IAAI,EAAE;AACtF;AAEA,eAAe,uBACb,UACA,SACiB;AACjB,MAAI;AACJ,aAAW,eAAW,oCAAc,QAAQ,GAAG;AAC7C,QAAI;AACF,aAAO,MAAM,QAAQ,cAAc,SAAS,EAAE;AAAA,IAChD,SAAS,OAAO;AACd,cAAI,oCAAsB,KAAK,EAAG,OAAM;AACxC,kBAAY;AAAA,IACd;AAAA,EACF;AACA,QAAM,IAAI,MAAM,mCAAmC,EAAE,OAAO,UAAU,CAAC;AACzE;AAEA,SAAS,sBAAsB,UAAkB,SAA2C;AAC1F,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,KAAK,YAAY,iCAAoB;AACnF,UAAM,IAAI,WAAW,0DAA0D,+BAAkB,EAAE;AAAA,EACrG;AACA,QAAM,qBAAiB,wDAA0B,UAAU;AAAA,IACzD,GAAI,QAAQ,YAAY,EAAE,gBAAgB,QAAQ,UAAU,IAAI,CAAC;AAAA,IACjE,gBAAgB,QAAQ,mBAAmB;AAAA,EAC7C,CAAC;AACD,UAAQ,CAAC,OAA0B,OAAoB,CAAC,UACtD,8BAAgB,CAAC,KAAK,MAAM,GAAG,WAAW,OAAM,WAAU;AACxD,UAAM,WAAW,MAAM,eAAe,OAAO,EAAE,GAAG,MAAM,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG,CAAC;AAIvF,UAAM,OAAO,MAAM,oBAAoB,UAAU,6BAA6B,MAAM;AACpF,WAAO,IAAI,SAAS,KAAK,aAAa,IAAI,WAAW,KAAK,IAAI,EAAE,SAAS,MAAM;AAAA,MAC7E,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,MACrB,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH,CAAC;AACL;AAOO,SAAS,yBAAyB,UAAkB,UAA8B,CAAC,GAAiB;AACzG,QAAM,WAAW,sBAAsB,UAAU,OAAO;AACxD,QAAM,YAAY,oBAAI,IAGpB;AACF,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAsB,IAAI;AACtD,QAAI,QAAQ,WAAW,MAAO,QAAO,SAAS,OAAO,IAAI;AACzD,QAAI,UAAU,UAAU,IAAI,QAAQ,GAAG;AACvC,QAAI,CAAC,SAAS;AACZ,gBAAU,SAAS,OAAO,IAAI,EAAE,KAAK,OAAM,cAAa;AAAA,QACtD,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,UAAU,MAAM;AACd,gBAAM,UAA8B,CAAC;AACrC,mBAAS,QAAQ,QAAQ,CAAC,OAAO,SAAS,QAAQ,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AACrE,iBAAO;AAAA,QACT,GAAG;AAAA,QACH,MAAM,MAAM,oBAAoB,UAAU,2BAA2B;AAAA,MACvE,EAAE;AACF,gBAAU,IAAI,QAAQ,KAAK,OAAO;AAClC,cAAQ,MAAM,MAAM,UAAU,OAAO,QAAQ,GAAG,CAAC;AAAA,IACnD;AACA,UAAM,SAAS,MAAM;AACrB,WAAO,IAAI,SAAS,OAAO,KAAK,MAAM,GAAG;AAAA,MACvC,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO;AAAA,MACnB,SAAS,OAAO;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,oBAAoB,UAAoB,UAAkB,QAA2C;AAClH,QAAM,iBAAiB,OAAO,SAAS,QAAQ,IAAI,gBAAgB,CAAC;AACpE,MAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,UAAU;AAChE,SAAK,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAClD,UAAM,IAAI,MAAM,8BAA8B,QAAQ,uBAAuB;AAAA,EAC/E;AACA,MAAI,CAAC,SAAS,KAAM,QAAO,IAAI,WAAW;AAC1C,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,SAAS,MAAM,KAAK,OAAO,OAAO,QAAQ,MAAM,EAAE,MAAM,MAAM,MAAS;AAC7E,UAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACxD,MAAI;AACF,UAAM,SAAuB,CAAC;AAC9B,QAAI,SAAS;AACb,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,gBAAU,MAAM;AAChB,UAAI,SAAS,UAAU;AACrB,aAAK,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC1C,cAAM,IAAI,MAAM,8BAA8B,QAAQ,uBAAuB;AAAA,MAC/E;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AACA,UAAM,OAAO,IAAI,WAAW,MAAM;AAClC,QAAI,SAAS;AACb,eAAW,SAAS,QAAQ;AAC1B,WAAK,IAAI,OAAO,MAAM;AACtB,gBAAU,MAAM;AAAA,IAClB;AACA,WAAO;AAAA,EACT,UAAE;AACA,YAAQ,oBAAoB,SAAS,MAAM;AAAA,EAC7C;AACF;AAEO,SAAS,uBAAuB,WAA2B;AAChE,QAAM,OAAO,IAAI,IAAI,SAAS,EAAE,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,GAAG,EAAE;AACzE,MAAI,CAAC,QAAQ,CAAC,oBAAoB,KAAK,IAAI,GAAG;AAC5C,UAAM,IAAI,MAAM,0DAA0D,SAAS,EAAE;AAAA,EACvF;AACA,SAAO;AACT;AAEA,eAAsB,yBACpB,UACA,UAA8B,CAAC,GACA;AAC/B,QAAM,EAAE,eAAe,0BAA0B,wBAAwB,IAAI,MAAM,OAAO,uBAAuB;AACjH,MAAI,WAAW;AACf,QAAM,eAA6B,OAAO,OAAO,SAAS;AACxD,eAAW,IAAI,QAAQ,OAAsB,IAAI,EAAE;AACnD,UAAM,IAAI,gBAAgB,EAAE,KAAK,UAAU,QAAQ,QAAQ,SAAS,CAAC,GAAG,MAAM,GAAG,CAAC;AAAA,EACpF;AACA,QAAM,UAAU,IAAI,cAAc;AAAA,IAChC,YAAY,CAAC,IAAI,wBAAwB,EAAE,WAAW,cAAc,cAAc,0BAA0B,CAAC,CAAC;AAAA,IAC9G,cAAc,IAAI,yBAAyB;AAAA,MACzC,WAAW,sBAAsB,UAAU,OAAO;AAAA,MAClD,cAAc;AAAA,IAChB,CAAC;AAAA,EACH,CAAC;AACD,QAAM,SAAS,MAAM,uBAAuB,UAAU,OAAO;AAC7D,MAAI;AACF,UAAM,OAAO,WAAW,EAAE,QAAQ,IAAI,IAAI,sBAAsB,UAAU,OAAU,CAAC;AAAA,EACvF,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAiB;AACpC,+BAAyB,UAAU,QAAQ;AAC3C,aAAO,EAAE,SAAS;AAAA,IACpB;AACA,UAAM;AAAA,EACR;AACA,QAAM,IAAI,MAAM,0DAA0D;AAC5E;AAEA,SAAS,yBAAyB,UAAkB,UAAwB;AAC1E,QAAM,cAAc,IAAI,IAAI,QAAQ,EAAE;AACtC,QAAM,iBAAiB,IAAI,IAAI,QAAQ,EAAE;AACzC,MAAI,mBAAmB,YAAa;AACpC,QAAM,IAAI;AAAA,IACR,mEAAmE,cAAc,eAAe,WAAW;AAAA,EAC7G;AACF;","names":[]}

package/dist/lib/testing/storyboard/request-signing/a2a-dispatch.mjs

@@ -0,0 +1,244 @@
+import { createAgentTransportFetch } from "../../../net/agent-transport-fetch.mjs";
+import { isAbortOrTimeoutError, MAX_TIMER_DELAY_MS, withAbortSignal } from "../../../protocols/abort.mjs";
+import { buildCardUrls } from "../../../utils/a2a-discovery.mjs";
+import {
+  toA2ATaskPushNotificationConfig
+} from "../../../protocols/a2a-push-notification.mjs";
+const DEFAULT_CARD_FETCH_TIMEOUT_MS = 1e4;
+const MAX_CACHED_AGENT_CARD_BYTES = 1048576;
+const ADCP_A2A_EXTENSION = "https://adcontextprotocol.org/extensions/adcp/v3";
+const CARD_DRIVEN_LEGACY_COMPAT = Object.freeze({ enabled: true });
+class RequestCaptured extends Error {
+  constructor(captured) {
+    super("a2a request captured");
+    this.captured = captured;
+  }
+  captured;
+}
+async function captureA2aRequest(agentUrl, call, options = {}) {
+  const { ClientFactory, JsonRpcTransportFactory, ServiceParameters, withA2AExtensions } = await import("@a2a-js/sdk-v1/client");
+  const { Role } = await import("@a2a-js/sdk-v1");
+  const capturingFetch = async (input, init) => {
+    const request = new Request(input, init);
+    const headers = {};
+    request.headers.forEach((value, name) => {
+      headers[name] = value;
+    });
+    throw new RequestCaptured({
+      url: request.url,
+      method: request.method,
+      headers,
+      body: await request.text()
+    });
+  };
+  const cardFetch = buildGuardedCardFetch(agentUrl, options);
+  const factory = new ClientFactory({
+    transports: [new JsonRpcTransportFactory({ fetchImpl: capturingFetch, legacyCompat: CARD_DRIVEN_LEGACY_COMPAT })],
+    cardResolver: new (await import("@a2a-js/sdk-v1/client")).DefaultAgentCardResolver({
+      fetchImpl: cardFetch,
+      legacyCompat: CARD_DRIVEN_LEGACY_COMPAT
+    })
+  });
+  const client = await createCardDrivenClient(agentUrl, factory);
+  const legacyWire = client.protocolVersion?.startsWith("0.") ?? false;
+  try {
+    if (call.kind === "cancelTask") {
+      await client.cancelTask({ tenant: "", id: call.taskId, metadata: void 0 });
+    } else {
+      const pushNotificationConfig = call.args.push_notification_config;
+      const invocation = legacyWire ? {
+        skill: call.operation,
+        // The maintained 0.3 runtime carries the AdCP application-layer
+        // registration in skill parameters. Do not reinterpret it as the
+        // native 1.0 transport facility while capturing signing bytes.
+        parameters: call.args
+      } : {
+        skill: call.operation,
+        // Native A2A transport registration cannot represent AdCP-only
+        // fields such as operation_id. Keep the complete application
+        // registration in skill input, matching the runtime path.
+        input: call.args
+      };
+      const request = {
+        tenant: "",
+        message: {
+          messageId: globalThis.crypto.randomUUID(),
+          contextId: "",
+          taskId: "",
+          role: Role.ROLE_USER,
+          parts: [
+            {
+              content: { $case: "data", value: invocation },
+              metadata: void 0,
+              filename: "",
+              mediaType: "application/json"
+            }
+          ],
+          metadata: void 0,
+          extensions: legacyWire ? [] : [ADCP_A2A_EXTENSION],
+          referenceTaskIds: []
+        },
+        configuration: !legacyWire && pushNotificationConfig != null && typeof pushNotificationConfig === "object" && !Array.isArray(pushNotificationConfig) ? {
+          acceptedOutputModes: ["application/json"],
+          taskPushNotificationConfig: toA2ATaskPushNotificationConfig(
+            pushNotificationConfig
+          ),
+          returnImmediately: false
+        } : void 0,
+        metadata: void 0
+      };
+      await client.sendMessage(request, {
+        ...legacyWire ? {} : { serviceParameters: ServiceParameters.create(withA2AExtensions(ADCP_A2A_EXTENSION)) }
+      });
+    }
+  } catch (error) {
+    if (error instanceof RequestCaptured) {
+      assertSameOriginEndpoint(agentUrl, error.captured.url);
+      return error.captured;
+    }
+    throw error;
+  }
+  throw new Error(`the A2A client returned without issuing a request for ${call.kind}`);
+}
+async function createCardDrivenClient(agentUrl, factory) {
+  let lastError;
+  for (const cardUrl of buildCardUrls(agentUrl)) {
+    try {
+      return await factory.createFromUrl(cardUrl, "");
+    } catch (error) {
+      if (isAbortOrTimeoutError(error)) throw error;
+      lastError = error;
+    }
+  }
+  throw new Error("A2A agent card discovery failed", { cause: lastError });
+}
+function buildGuardedCardFetch(agentUrl, options) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_CARD_FETCH_TIMEOUT_MS;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_TIMER_DELAY_MS) {
+    throw new RangeError(`A2A card timeoutMs must be a finite positive number <= ${MAX_TIMER_DELAY_MS}`);
+  }
+  const transportFetch = createAgentTransportFetch(agentUrl, {
+    ...options.cardFetch ? { trustedFetchFn: options.cardFetch } : {},
+    allowPrivateIp: options.allowPrivateIp === true
+  });
+  return ((input, init = {}) => withAbortSignal([init.signal], timeoutMs, async (signal) => {
+    const response = await transportFetch(input, { ...init, ...signal ? { signal } : {} });
+    const body = await readCardBodyBounded(response, MAX_CACHED_AGENT_CARD_BYTES, signal);
+    return new Response(body.byteLength > 0 ? Uint8Array.from(body).buffer : null, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+  }));
+}
+function createCachedA2aCardFetch(agentUrl, options = {}) {
+  const upstream = buildGuardedCardFetch(agentUrl, options);
+  const responses = /* @__PURE__ */ new Map();
+  return async (input, init) => {
+    const request = new Request(input, init);
+    if (request.method !== "GET") return upstream(input, init);
+    let pending = responses.get(request.url);
+    if (!pending) {
+      pending = upstream(input, init).then(async (response) => ({
+        status: response.status,
+        statusText: response.statusText,
+        headers: (() => {
+          const entries = [];
+          response.headers.forEach((value, name) => entries.push([name, value]));
+          return entries;
+        })(),
+        body: await readCardBodyBounded(response, MAX_CACHED_AGENT_CARD_BYTES)
+      }));
+      responses.set(request.url, pending);
+      pending.catch(() => responses.delete(request.url));
+    }
+    const cached = await pending;
+    return new Response(cached.body.slice(), {
+      status: cached.status,
+      statusText: cached.statusText,
+      headers: cached.headers
+    });
+  };
+}
+async function readCardBodyBounded(response, maxBytes, signal) {
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+    void response.body?.cancel().catch(() => void 0);
+    throw new Error(`A2A agent card exceeds the ${maxBytes}-byte discovery limit`);
+  }
+  if (!response.body) return new Uint8Array();
+  const reader = response.body.getReader();
+  const cancel = () => void reader.cancel(signal?.reason).catch(() => void 0);
+  signal?.addEventListener("abort", cancel, { once: true });
+  try {
+    const chunks = [];
+    let length = 0;
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      length += value.byteLength;
+      if (length > maxBytes) {
+        void reader.cancel().catch(() => void 0);
+        throw new Error(`A2A agent card exceeds the ${maxBytes}-byte discovery limit`);
+      }
+      chunks.push(value);
+    }
+    const body = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+      body.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return body;
+  } finally {
+    signal?.removeEventListener("abort", cancel);
+  }
+}
+function operationFromVectorUrl(vectorUrl) {
+  const last = new URL(vectorUrl).pathname.split("/").filter(Boolean).at(-1);
+  if (!last || !/^[a-z][a-z0-9_]*$/.test(last)) {
+    throw new Error(`Cannot extract an AdCP operation name from vector URL: ${vectorUrl}`);
+  }
+  return last;
+}
+async function resolveA2aDispatchTarget(agentUrl, options = {}) {
+  const { ClientFactory, DefaultAgentCardResolver, JsonRpcTransportFactory } = await import("@a2a-js/sdk-v1/client");
+  let endpoint = "";
+  const noteEndpoint = async (input, init) => {
+    endpoint = new Request(input, init).url;
+    throw new RequestCaptured({ url: endpoint, method: "POST", headers: {}, body: "" });
+  };
+  const factory = new ClientFactory({
+    transports: [new JsonRpcTransportFactory({ fetchImpl: noteEndpoint, legacyCompat: CARD_DRIVEN_LEGACY_COMPAT })],
+    cardResolver: new DefaultAgentCardResolver({
+      fetchImpl: buildGuardedCardFetch(agentUrl, options),
+      legacyCompat: CARD_DRIVEN_LEGACY_COMPAT
+    })
+  });
+  const client = await createCardDrivenClient(agentUrl, factory);
+  try {
+    await client.cancelTask({ tenant: "", id: "a2a-dispatch-probe", metadata: void 0 });
+  } catch (error) {
+    if (error instanceof RequestCaptured) {
+      assertSameOriginEndpoint(agentUrl, endpoint);
+      return { endpoint };
+    }
+    throw error;
+  }
+  throw new Error("the A2A client returned without issuing a dispatch probe");
+}
+function assertSameOriginEndpoint(agentUrl, endpoint) {
+  const agentOrigin = new URL(agentUrl).origin;
+  const endpointOrigin = new URL(endpoint).origin;
+  if (endpointOrigin === agentOrigin) return;
+  throw new Error(
+    `A2A request-signing probes refuse a cross-origin card endpoint (${endpointOrigin}); expected ${agentOrigin}`
+  );
+}
+export {
+  captureA2aRequest,
+  createCachedA2aCardFetch,
+  operationFromVectorUrl,
+  resolveA2aDispatchTarget
+};
+//# sourceMappingURL=a2a-dispatch.mjs.map

package/dist/lib/testing/storyboard/request-signing/a2a-dispatch.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../src/lib/testing/storyboard/request-signing/a2a-dispatch.ts"],"sourcesContent":["/**\n * Capture requests emitted by the official A2A 1.x client for RFC 9421\n * signing. The SDK owns endpoint selection, method names, version headers,\n * and proto-JSON encoding; this module only intercepts its fetch seam.\n */\nimport { createAgentTransportFetch } from '../../../net/agent-transport-fetch';\nimport { isAbortOrTimeoutError, MAX_TIMER_DELAY_MS, withAbortSignal } from '../../../protocols/abort';\nimport { buildCardUrls } from '../../../utils/a2a-discovery';\nimport {\n  toA2ATaskPushNotificationConfig,\n  type A2APushNotificationConfig,\n} from '../../../protocols/a2a-push-notification';\nimport type { SendMessageRequest } from '@a2a-js/sdk-v1';\nimport type { Client } from '@a2a-js/sdk-v1/client';\n\nconst DEFAULT_CARD_FETCH_TIMEOUT_MS = 10_000;\nconst MAX_CACHED_AGENT_CARD_BYTES = 1_048_576;\nconst ADCP_A2A_EXTENSION = 'https://adcontextprotocol.org/extensions/adcp/v3';\n// Defined by the AdCP A2A profile extension and its canonical test vector:\n// docs/building/by-layer/L0/a2a-profile-extension.mdx\n// static/test-vectors/a2a-profile-extension-v3.json\nconst CARD_DRIVEN_LEGACY_COMPAT = Object.freeze({ enabled: true });\n\nexport interface CapturedA2aRequest {\n  url: string;\n  method: string;\n  headers: Record<string, string>;\n  body: string;\n}\n\nexport type A2aCall =\n  | { kind: 'sendMessage'; operation: string; args: Record<string, unknown> }\n  | { kind: 'cancelTask'; taskId: string };\n\nexport interface A2aDispatchOptions {\n  timeoutMs?: number;\n  allowPrivateIp?: boolean;\n  /** Trusted fetch used only for agent-card discovery. */\n  cardFetch?: typeof fetch;\n}\n\nclass RequestCaptured extends Error {\n  constructor(readonly captured: CapturedA2aRequest) {\n    super('a2a request captured');\n  }\n}\n\nexport async function captureA2aRequest(\n  agentUrl: string,\n  call: A2aCall,\n  options: A2aDispatchOptions = {}\n): Promise<CapturedA2aRequest> {\n  const { ClientFactory, JsonRpcTransportFactory, ServiceParameters, withA2AExtensions } =\n    await import('@a2a-js/sdk-v1/client');\n  const { Role } = await import('@a2a-js/sdk-v1');\n\n  const capturingFetch: typeof fetch = async (input, init) => {\n    const request = new Request(input as RequestInfo, init);\n    const headers: Record<string, string> = {};\n    request.headers.forEach((value, name) => {\n      headers[name] = value;\n    });\n    throw new RequestCaptured({\n      url: request.url,\n      method: request.method,\n      headers,\n      body: await request.text(),\n    });\n  };\n\n  const cardFetch = buildGuardedCardFetch(agentUrl, options);\n  const factory = new ClientFactory({\n    transports: [new JsonRpcTransportFactory({ fetchImpl: capturingFetch, legacyCompat: CARD_DRIVEN_LEGACY_COMPAT })],\n    cardResolver: new (await import('@a2a-js/sdk-v1/client')).DefaultAgentCardResolver({\n      fetchImpl: cardFetch,\n      legacyCompat: CARD_DRIVEN_LEGACY_COMPAT,\n    }),\n  });\n  const client = await createCardDrivenClient(agentUrl, factory);\n  const legacyWire = client.protocolVersion?.startsWith('0.') ?? false;\n\n  try {\n    if (call.kind === 'cancelTask') {\n      await client.cancelTask({ tenant: '', id: call.taskId, metadata: undefined });\n    } else {\n      const pushNotificationConfig = call.args.push_notification_config;\n      const invocation = legacyWire\n        ? {\n            skill: call.operation,\n            // The maintained 0.3 runtime carries the AdCP application-layer\n            // registration in skill parameters. Do not reinterpret it as the\n            // native 1.0 transport facility while capturing signing bytes.\n            parameters: call.args,\n          }\n        : {\n            skill: call.operation,\n            // Native A2A transport registration cannot represent AdCP-only\n            // fields such as operation_id. Keep the complete application\n            // registration in skill input, matching the runtime path.\n            input: call.args,\n          };\n      const request: SendMessageRequest = {\n        tenant: '',\n        message: {\n          messageId: globalThis.crypto.randomUUID(),\n          contextId: '',\n          taskId: '',\n          role: Role.ROLE_USER,\n          parts: [\n            {\n              content: { $case: 'data', value: invocation },\n              metadata: undefined,\n              filename: '',\n              mediaType: 'application/json',\n            },\n          ],\n          metadata: undefined,\n          extensions: legacyWire ? [] : [ADCP_A2A_EXTENSION],\n          referenceTaskIds: [],\n        },\n        configuration:\n          !legacyWire &&\n          pushNotificationConfig != null &&\n          typeof pushNotificationConfig === 'object' &&\n          !Array.isArray(pushNotificationConfig)\n            ? {\n                acceptedOutputModes: ['application/json'],\n                taskPushNotificationConfig: toA2ATaskPushNotificationConfig(\n                  pushNotificationConfig as A2APushNotificationConfig\n                ),\n                returnImmediately: false,\n              }\n            : undefined,\n        metadata: undefined,\n      };\n      await client.sendMessage(request, {\n        ...(legacyWire ? {} : { serviceParameters: ServiceParameters.create(withA2AExtensions(ADCP_A2A_EXTENSION)) }),\n      });\n    }\n  } catch (error) {\n    if (error instanceof RequestCaptured) {\n      assertSameOriginEndpoint(agentUrl, error.captured.url);\n      return error.captured;\n    }\n    throw error;\n  }\n  throw new Error(`the A2A client returned without issuing a request for ${call.kind}`);\n}\n\nasync function createCardDrivenClient(\n  agentUrl: string,\n  factory: { createFromUrl(baseUrl: string, path?: string): Promise<Client> }\n): Promise<Client> {\n  let lastError: unknown;\n  for (const cardUrl of buildCardUrls(agentUrl)) {\n    try {\n      return await factory.createFromUrl(cardUrl, '');\n    } catch (error) {\n      if (isAbortOrTimeoutError(error)) throw error;\n      lastError = error;\n    }\n  }\n  throw new Error('A2A agent card discovery failed', { cause: lastError });\n}\n\nfunction buildGuardedCardFetch(agentUrl: string, options: A2aDispatchOptions): typeof fetch {\n  const timeoutMs = options.timeoutMs ?? DEFAULT_CARD_FETCH_TIMEOUT_MS;\n  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_TIMER_DELAY_MS) {\n    throw new RangeError(`A2A card timeoutMs must be a finite positive number <= ${MAX_TIMER_DELAY_MS}`);\n  }\n  const transportFetch = createAgentTransportFetch(agentUrl, {\n    ...(options.cardFetch ? { trustedFetchFn: options.cardFetch } : {}),\n    allowPrivateIp: options.allowPrivateIp === true,\n  });\n  return ((input: RequestInfo | URL, init: RequestInit = {}) =>\n    withAbortSignal([init.signal], timeoutMs, async signal => {\n      const response = await transportFetch(input, { ...init, ...(signal ? { signal } : {}) });\n      // Keep the same discovery deadline active through body consumption. A\n      // peer can otherwise return headers plus one byte and stall grading\n      // forever while the official resolver waits for JSON completion.\n      const body = await readCardBodyBounded(response, MAX_CACHED_AGENT_CARD_BYTES, signal);\n      return new Response(body.byteLength > 0 ? Uint8Array.from(body).buffer : null, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: response.headers,\n      });\n    })) as typeof fetch;\n}\n\n/**\n * Cache discovery within one grading run without turning the platform fetch\n * into a trusted fetch override. The guarded transport performs DNS/private\n * address enforcement before this wrapper sees a response.\n */\nexport function createCachedA2aCardFetch(agentUrl: string, options: A2aDispatchOptions = {}): typeof fetch {\n  const upstream = buildGuardedCardFetch(agentUrl, options);\n  const responses = new Map<\n    string,\n    Promise<{ status: number; statusText: string; headers: [string, string][]; body: Uint8Array }>\n  >();\n  return async (input, init) => {\n    const request = new Request(input as RequestInfo, init);\n    if (request.method !== 'GET') return upstream(input, init);\n    let pending = responses.get(request.url);\n    if (!pending) {\n      pending = upstream(input, init).then(async response => ({\n        status: response.status,\n        statusText: response.statusText,\n        headers: (() => {\n          const entries: [string, string][] = [];\n          response.headers.forEach((value, name) => entries.push([name, value]));\n          return entries;\n        })(),\n        body: await readCardBodyBounded(response, MAX_CACHED_AGENT_CARD_BYTES),\n      }));\n      responses.set(request.url, pending);\n      pending.catch(() => responses.delete(request.url));\n    }\n    const cached = await pending;\n    return new Response(cached.body.slice(), {\n      status: cached.status,\n      statusText: cached.statusText,\n      headers: cached.headers,\n    });\n  };\n}\n\nasync function readCardBodyBounded(response: Response, maxBytes: number, signal?: AbortSignal): Promise<Uint8Array> {\n  const declaredLength = Number(response.headers.get('content-length'));\n  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {\n    void response.body?.cancel().catch(() => undefined);\n    throw new Error(`A2A agent card exceeds the ${maxBytes}-byte discovery limit`);\n  }\n  if (!response.body) return new Uint8Array();\n  const reader = response.body.getReader();\n  const cancel = () => void reader.cancel(signal?.reason).catch(() => undefined);\n  signal?.addEventListener('abort', cancel, { once: true });\n  try {\n    const chunks: Uint8Array[] = [];\n    let length = 0;\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      length += value.byteLength;\n      if (length > maxBytes) {\n        void reader.cancel().catch(() => undefined);\n        throw new Error(`A2A agent card exceeds the ${maxBytes}-byte discovery limit`);\n      }\n      chunks.push(value);\n    }\n    const body = new Uint8Array(length);\n    let offset = 0;\n    for (const chunk of chunks) {\n      body.set(chunk, offset);\n      offset += chunk.byteLength;\n    }\n    return body;\n  } finally {\n    signal?.removeEventListener('abort', cancel);\n  }\n}\n\nexport function operationFromVectorUrl(vectorUrl: string): string {\n  const last = new URL(vectorUrl).pathname.split('/').filter(Boolean).at(-1);\n  if (!last || !/^[a-z][a-z0-9_]*$/.test(last)) {\n    throw new Error(`Cannot extract an AdCP operation name from vector URL: ${vectorUrl}`);\n  }\n  return last;\n}\n\nexport async function resolveA2aDispatchTarget(\n  agentUrl: string,\n  options: A2aDispatchOptions = {}\n): Promise<{ endpoint: string }> {\n  const { ClientFactory, DefaultAgentCardResolver, JsonRpcTransportFactory } = await import('@a2a-js/sdk-v1/client');\n  let endpoint = '';\n  const noteEndpoint: typeof fetch = async (input, init) => {\n    endpoint = new Request(input as RequestInfo, init).url;\n    throw new RequestCaptured({ url: endpoint, method: 'POST', headers: {}, body: '' });\n  };\n  const factory = new ClientFactory({\n    transports: [new JsonRpcTransportFactory({ fetchImpl: noteEndpoint, legacyCompat: CARD_DRIVEN_LEGACY_COMPAT })],\n    cardResolver: new DefaultAgentCardResolver({\n      fetchImpl: buildGuardedCardFetch(agentUrl, options),\n      legacyCompat: CARD_DRIVEN_LEGACY_COMPAT,\n    }),\n  });\n  const client = await createCardDrivenClient(agentUrl, factory);\n  try {\n    await client.cancelTask({ tenant: '', id: 'a2a-dispatch-probe', metadata: undefined });\n  } catch (error) {\n    if (error instanceof RequestCaptured) {\n      assertSameOriginEndpoint(agentUrl, endpoint);\n      return { endpoint };\n    }\n    throw error;\n  }\n  throw new Error('the A2A client returned without issuing a dispatch probe');\n}\n\nfunction assertSameOriginEndpoint(agentUrl: string, endpoint: string): void {\n  const agentOrigin = new URL(agentUrl).origin;\n  const endpointOrigin = new URL(endpoint).origin;\n  if (endpointOrigin === agentOrigin) return;\n  throw new Error(\n    `A2A request-signing probes refuse a cross-origin card endpoint (${endpointOrigin}); expected ${agentOrigin}`\n  );\n}\n"],"mappings":"AAKA,SAAS,iCAAiC;AAC1C,SAAS,uBAAuB,oBAAoB,uBAAuB;AAC3E,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,OAEK;AAIP,MAAM,gCAAgC;AACtC,MAAM,8BAA8B;AACpC,MAAM,qBAAqB;AAI3B,MAAM,4BAA4B,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC;AAoBjE,MAAM,wBAAwB,MAAM;AAAA,EAClC,YAAqB,UAA8B;AACjD,UAAM,sBAAsB;AADT;AAAA,EAErB;AAAA,EAFqB;AAGvB;AAEA,eAAsB,kBACpB,UACA,MACA,UAA8B,CAAC,GACF;AAC7B,QAAM,EAAE,eAAe,yBAAyB,mBAAmB,kBAAkB,IACnF,MAAM,OAAO,uBAAuB;AACtC,QAAM,EAAE,KAAK,IAAI,MAAM,OAAO,gBAAgB;AAE9C,QAAM,iBAA+B,OAAO,OAAO,SAAS;AAC1D,UAAM,UAAU,IAAI,QAAQ,OAAsB,IAAI;AACtD,UAAM,UAAkC,CAAC;AACzC,YAAQ,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACvC,cAAQ,IAAI,IAAI;AAAA,IAClB,CAAC;AACD,UAAM,IAAI,gBAAgB;AAAA,MACxB,KAAK,QAAQ;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,QAAM,YAAY,sBAAsB,UAAU,OAAO;AACzD,QAAM,UAAU,IAAI,cAAc;AAAA,IAChC,YAAY,CAAC,IAAI,wBAAwB,EAAE,WAAW,gBAAgB,cAAc,0BAA0B,CAAC,CAAC;AAAA,IAChH,cAAc,KAAK,MAAM,OAAO,uBAAuB,GAAG,yBAAyB;AAAA,MACjF,WAAW;AAAA,MACX,cAAc;AAAA,IAChB,CAAC;AAAA,EACH,CAAC;AACD,QAAM,SAAS,MAAM,uBAAuB,UAAU,OAAO;AAC7D,QAAM,aAAa,OAAO,iBAAiB,WAAW,IAAI,KAAK;AAE/D,MAAI;AACF,QAAI,KAAK,SAAS,cAAc;AAC9B,YAAM,OAAO,WAAW,EAAE,QAAQ,IAAI,IAAI,KAAK,QAAQ,UAAU,OAAU,CAAC;AAAA,IAC9E,OAAO;AACL,YAAM,yBAAyB,KAAK,KAAK;AACzC,YAAM,aAAa,aACf;AAAA,QACE,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA,QAIZ,YAAY,KAAK;AAAA,MACnB,IACA;AAAA,QACE,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA,QAIZ,OAAO,KAAK;AAAA,MACd;AACJ,YAAM,UAA8B;AAAA,QAClC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,WAAW,WAAW,OAAO,WAAW;AAAA,UACxC,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,MAAM,KAAK;AAAA,UACX,OAAO;AAAA,YACL;AAAA,cACE,SAAS,EAAE,OAAO,QAAQ,OAAO,WAAW;AAAA,cAC5C,UAAU;AAAA,cACV,UAAU;AAAA,cACV,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,UAAU;AAAA,UACV,YAAY,aAAa,CAAC,IAAI,CAAC,kBAAkB;AAAA,UACjD,kBAAkB,CAAC;AAAA,QACrB;AAAA,QACA,eACE,CAAC,cACD,0BAA0B,QAC1B,OAAO,2BAA2B,YAClC,CAAC,MAAM,QAAQ,sBAAsB,IACjC;AAAA,UACE,qBAAqB,CAAC,kBAAkB;AAAA,UACxC,4BAA4B;AAAA,YAC1B;AAAA,UACF;AAAA,UACA,mBAAmB;AAAA,QACrB,IACA;AAAA,QACN,UAAU;AAAA,MACZ;AACA,YAAM,OAAO,YAAY,SAAS;AAAA,QAChC,GAAI,aAAa,CAAC,IAAI,EAAE,mBAAmB,kBAAkB,OAAO,kBAAkB,kBAAkB,CAAC,EAAE;AAAA,MAC7G,CAAC;AAAA,IACH;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAiB;AACpC,+BAAyB,UAAU,MAAM,SAAS,GAAG;AACrD,aAAO,MAAM;AAAA,IACf;AACA,UAAM;AAAA,EACR;AACA,QAAM,IAAI,MAAM,yDAAyD,KAAK,IAAI,EAAE;AACtF;AAEA,eAAe,uBACb,UACA,SACiB;AACjB,MAAI;AACJ,aAAW,WAAW,cAAc,QAAQ,GAAG;AAC7C,QAAI;AACF,aAAO,MAAM,QAAQ,cAAc,SAAS,EAAE;AAAA,IAChD,SAAS,OAAO;AACd,UAAI,sBAAsB,KAAK,EAAG,OAAM;AACxC,kBAAY;AAAA,IACd;AAAA,EACF;AACA,QAAM,IAAI,MAAM,mCAAmC,EAAE,OAAO,UAAU,CAAC;AACzE;AAEA,SAAS,sBAAsB,UAAkB,SAA2C;AAC1F,QAAM,YAAY,QAAQ,aAAa;AACvC,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,KAAK,YAAY,oBAAoB;AACnF,UAAM,IAAI,WAAW,0DAA0D,kBAAkB,EAAE;AAAA,EACrG;AACA,QAAM,iBAAiB,0BAA0B,UAAU;AAAA,IACzD,GAAI,QAAQ,YAAY,EAAE,gBAAgB,QAAQ,UAAU,IAAI,CAAC;AAAA,IACjE,gBAAgB,QAAQ,mBAAmB;AAAA,EAC7C,CAAC;AACD,UAAQ,CAAC,OAA0B,OAAoB,CAAC,MACtD,gBAAgB,CAAC,KAAK,MAAM,GAAG,WAAW,OAAM,WAAU;AACxD,UAAM,WAAW,MAAM,eAAe,OAAO,EAAE,GAAG,MAAM,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG,CAAC;AAIvF,UAAM,OAAO,MAAM,oBAAoB,UAAU,6BAA6B,MAAM;AACpF,WAAO,IAAI,SAAS,KAAK,aAAa,IAAI,WAAW,KAAK,IAAI,EAAE,SAAS,MAAM;AAAA,MAC7E,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,MACrB,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH,CAAC;AACL;AAOO,SAAS,yBAAyB,UAAkB,UAA8B,CAAC,GAAiB;AACzG,QAAM,WAAW,sBAAsB,UAAU,OAAO;AACxD,QAAM,YAAY,oBAAI,IAGpB;AACF,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAsB,IAAI;AACtD,QAAI,QAAQ,WAAW,MAAO,QAAO,SAAS,OAAO,IAAI;AACzD,QAAI,UAAU,UAAU,IAAI,QAAQ,GAAG;AACvC,QAAI,CAAC,SAAS;AACZ,gBAAU,SAAS,OAAO,IAAI,EAAE,KAAK,OAAM,cAAa;AAAA,QACtD,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,UAAU,MAAM;AACd,gBAAM,UAA8B,CAAC;AACrC,mBAAS,QAAQ,QAAQ,CAAC,OAAO,SAAS,QAAQ,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AACrE,iBAAO;AAAA,QACT,GAAG;AAAA,QACH,MAAM,MAAM,oBAAoB,UAAU,2BAA2B;AAAA,MACvE,EAAE;AACF,gBAAU,IAAI,QAAQ,KAAK,OAAO;AAClC,cAAQ,MAAM,MAAM,UAAU,OAAO,QAAQ,GAAG,CAAC;AAAA,IACnD;AACA,UAAM,SAAS,MAAM;AACrB,WAAO,IAAI,SAAS,OAAO,KAAK,MAAM,GAAG;AAAA,MACvC,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO;AAAA,MACnB,SAAS,OAAO;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEA,eAAe,oBAAoB,UAAoB,UAAkB,QAA2C;AAClH,QAAM,iBAAiB,OAAO,SAAS,QAAQ,IAAI,gBAAgB,CAAC;AACpE,MAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,UAAU;AAChE,SAAK,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAClD,UAAM,IAAI,MAAM,8BAA8B,QAAQ,uBAAuB;AAAA,EAC/E;AACA,MAAI,CAAC,SAAS,KAAM,QAAO,IAAI,WAAW;AAC1C,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,SAAS,MAAM,KAAK,OAAO,OAAO,QAAQ,MAAM,EAAE,MAAM,MAAM,MAAS;AAC7E,UAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AACxD,MAAI;AACF,UAAM,SAAuB,CAAC;AAC9B,QAAI,SAAS;AACb,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,gBAAU,MAAM;AAChB,UAAI,SAAS,UAAU;AACrB,aAAK,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC1C,cAAM,IAAI,MAAM,8BAA8B,QAAQ,uBAAuB;AAAA,MAC/E;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AACA,UAAM,OAAO,IAAI,WAAW,MAAM;AAClC,QAAI,SAAS;AACb,eAAW,SAAS,QAAQ;AAC1B,WAAK,IAAI,OAAO,MAAM;AACtB,gBAAU,MAAM;AAAA,IAClB;AACA,WAAO;AAAA,EACT,UAAE;AACA,YAAQ,oBAAoB,SAAS,MAAM;AAAA,EAC7C;AACF;AAEO,SAAS,uBAAuB,WAA2B;AAChE,QAAM,OAAO,IAAI,IAAI,SAAS,EAAE,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,GAAG,EAAE;AACzE,MAAI,CAAC,QAAQ,CAAC,oBAAoB,KAAK,IAAI,GAAG;AAC5C,UAAM,IAAI,MAAM,0DAA0D,SAAS,EAAE;AAAA,EACvF;AACA,SAAO;AACT;AAEA,eAAsB,yBACpB,UACA,UAA8B,CAAC,GACA;AAC/B,QAAM,EAAE,eAAe,0BAA0B,wBAAwB,IAAI,MAAM,OAAO,uBAAuB;AACjH,MAAI,WAAW;AACf,QAAM,eAA6B,OAAO,OAAO,SAAS;AACxD,eAAW,IAAI,QAAQ,OAAsB,IAAI,EAAE;AACnD,UAAM,IAAI,gBAAgB,EAAE,KAAK,UAAU,QAAQ,QAAQ,SAAS,CAAC,GAAG,MAAM,GAAG,CAAC;AAAA,EACpF;AACA,QAAM,UAAU,IAAI,cAAc;AAAA,IAChC,YAAY,CAAC,IAAI,wBAAwB,EAAE,WAAW,cAAc,cAAc,0BAA0B,CAAC,CAAC;AAAA,IAC9G,cAAc,IAAI,yBAAyB;AAAA,MACzC,WAAW,sBAAsB,UAAU,OAAO;AAAA,MAClD,cAAc;AAAA,IAChB,CAAC;AAAA,EACH,CAAC;AACD,QAAM,SAAS,MAAM,uBAAuB,UAAU,OAAO;AAC7D,MAAI;AACF,UAAM,OAAO,WAAW,EAAE,QAAQ,IAAI,IAAI,sBAAsB,UAAU,OAAU,CAAC;AAAA,EACvF,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAiB;AACpC,+BAAyB,UAAU,QAAQ;AAC3C,aAAO,EAAE,SAAS;AAAA,IACpB;AACA,UAAM;AAAA,EACR;AACA,QAAM,IAAI,MAAM,0DAA0D;AAC5E;AAEA,SAAS,yBAAyB,UAAkB,UAAwB;AAC1E,QAAM,cAAc,IAAI,IAAI,QAAQ,EAAE;AACtC,QAAM,iBAAiB,IAAI,IAAI,QAAQ,EAAE;AACzC,MAAI,mBAAmB,YAAa;AACpC,QAAM,IAAI;AAAA,IACR,mEAAmE,cAAc,eAAe,WAAW;AAAA,EAC7G;AACF;","names":[]}

package/dist/lib/testing/storyboard/request-signing/builder.d.mts

@@ -1,4 +1,5 @@
 import type { NegativeVector, PositiveVector, TestKeyset } from './types.mjs';
+import type { CapturedA2aRequest } from './a2a-dispatch.mjs';
 export interface BuildOptions {
     /** Override the signer clock (unix seconds). Defaults to `Date.now()/1000`. */
     now?: number;
@@ -30,7 +31,9 @@ export interface BuildOptions {
      * 005–008 fold into plain POSTs against the MCP endpoint, but the grader
      * works against any MCP agent that wires a verifier at the HTTP layer.
      */
-    transport?: 'raw' | 'mcp';
+    transport?: 'raw' | 'mcp' | 'a2a';
+    /** Request emitted by the official A2A SDK; required for A2A transport. */
+    a2aRequest?: CapturedA2aRequest;
     /**
      * JSON-RPC `id` for the MCP envelope. Defaults to `crypto.randomUUID()`
      * so concurrent runs never collide. Override for tests that need a stable

package/dist/lib/testing/storyboard/request-signing/builder.d.ts

@@ -1,4 +1,5 @@
 import type { NegativeVector, PositiveVector, TestKeyset } from './types';
+import type { CapturedA2aRequest } from './a2a-dispatch';
 export interface BuildOptions {
     /** Override the signer clock (unix seconds). Defaults to `Date.now()/1000`. */
     now?: number;
@@ -30,7 +31,9 @@ export interface BuildOptions {
      * 005–008 fold into plain POSTs against the MCP endpoint, but the grader
      * works against any MCP agent that wires a verifier at the HTTP layer.
      */
-    transport?: 'raw' | 'mcp';
+    transport?: 'raw' | 'mcp' | 'a2a';
+    /** Request emitted by the official A2A SDK; required for A2A transport. */
+    a2aRequest?: CapturedA2aRequest;
     /**
      * JSON-RPC `id` for the MCP envelope. Defaults to `crypto.randomUUID()`
      * so concurrent runs never collide. Override for tests that need a stable

package/dist/lib/testing/storyboard/request-signing/builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/builder.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAe,MAAM,SAAS,CAAC;AAEvF,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,YAAiB,GACzB,iBAAiB,CAMnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,YAAiB,GACzB,iBAAiB,CAMnB;AAED,wBAAgB,4BAA4B,IAAI,MAAM,EAAE,CAEvD"}
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/builder.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAe,MAAM,SAAS,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IAClC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,YAAiB,GACzB,iBAAiB,CAMnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,YAAiB,GACzB,iBAAiB,CAMnB;AAED,wBAAgB,4BAA4B,IAAI,MAAM,EAAE,CAEvD"}