@agent-native/core 0.108.0 → 0.109.1

package/corpus/templates/slides/server/lib/media-search-providers.ts

@@ -0,0 +1,216 @@
+import { resolveSecret } from "@agent-native/core/server";
+
+const GOOGLE_IMAGE_SEARCH_URL = "https://www.googleapis.com/customsearch/v1";
+const LOGO_DEV_SEARCH_URL = "https://api.logo.dev/search";
+const PROVIDER_TIMEOUT_MS = 15_000;
+
+export interface ImageSearchResult {
+  url: string;
+  thumbnail: string;
+  title: string;
+  width?: number;
+  height?: number;
+}
+
+export interface LogoSearchResult {
+  name: string;
+  domain: string;
+  logoUrl: string;
+  source: "logo.dev" | "domain-guess";
+}
+
+export interface MediaSearchRuntime {
+  resolveSecret: (key: string) => Promise<string | null | undefined>;
+  fetch: typeof fetch;
+}
+
+const defaultRuntime: MediaSearchRuntime = {
+  resolveSecret,
+  fetch: (...args) => fetch(...args),
+};
+
+function fetchOptions(init: RequestInit = {}): RequestInit {
+  return {
+    ...init,
+    signal: init.signal ?? AbortSignal.timeout(PROVIDER_TIMEOUT_MS),
+  };
+}
+
+function normalizedDomain(value: string): string {
+  return value
+    .trim()
+    .toLowerCase()
+    .replace(/^https?:\/\//, "")
+    .replace(/^www\./, "")
+    .split("/", 1)[0]!
+    .replace(/[^a-z0-9.-]/g, "");
+}
+
+function logoResult(
+  name: string,
+  domain: string,
+  source: LogoSearchResult["source"],
+): LogoSearchResult | null {
+  const normalized = normalizedDomain(domain);
+  if (!normalized || !normalized.includes(".")) return null;
+  return {
+    name: name.trim() || normalized.split(".")[0] || normalized,
+    domain: normalized,
+    logoUrl: `https://cdn.brandfetch.io/${normalized}/logo.png`,
+    source,
+  };
+}
+
+function guessedLogoDomains(query: string): LogoSearchResult[] {
+  const normalized = normalizedDomain(query);
+  if (normalized.includes(".")) {
+    const result = logoResult(
+      normalized.split(".")[0] ?? normalized,
+      normalized,
+      "domain-guess",
+    );
+    return result ? [result] : [];
+  }
+
+  const compact = query.toLowerCase().replace(/[^a-z0-9]/g, "");
+  const dashed = query
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-|-$/g, "");
+  if (!compact) return [];
+
+  const candidates = [
+    ...["com", "io", "co", "dev", "org", "net"].map(
+      (tld) => `${compact}.${tld}`,
+    ),
+    ...(dashed && dashed !== compact ? [`${dashed}.com`] : []),
+  ];
+  return candidates.flatMap((domain) => {
+    const result = logoResult(query, domain, "domain-guess");
+    return result ? [result] : [];
+  });
+}
+
+export async function searchProviderImages(
+  query: string,
+  count = 10,
+  runtime: MediaSearchRuntime = defaultRuntime,
+): Promise<ImageSearchResult[]> {
+  const normalizedQuery = query.trim();
+  if (!normalizedQuery) throw new Error("Image search requires a query.");
+
+  const [apiKey, searchEngineId] = await Promise.all([
+    runtime.resolveSecret("GOOGLE_API_KEY"),
+    runtime.resolveSecret("GOOGLE_SEARCH_CX"),
+  ]);
+  if (!apiKey || !searchEngineId) {
+    throw new Error(
+      "Google Search not configured. Save GOOGLE_API_KEY and GOOGLE_SEARCH_CX in settings.",
+    );
+  }
+
+  const params = new URLSearchParams({
+    key: apiKey,
+    cx: searchEngineId,
+    q: normalizedQuery,
+    searchType: "image",
+    num: String(Math.max(1, Math.min(Math.floor(count), 10))),
+    safe: "active",
+  });
+  const response = await runtime.fetch(
+    `${GOOGLE_IMAGE_SEARCH_URL}?${params}`,
+    fetchOptions(),
+  );
+  if (!response.ok) {
+    throw new Error(`Google image search failed (${response.status}).`);
+  }
+
+  const data = (await response.json()) as {
+    items?: Array<{
+      link?: unknown;
+      title?: unknown;
+      image?: {
+        width?: unknown;
+        height?: unknown;
+        thumbnailLink?: unknown;
+      };
+    }>;
+  };
+  return (data.items ?? []).flatMap((item) => {
+    if (typeof item.link !== "string" || !item.link) return [];
+    const thumbnail =
+      typeof item.image?.thumbnailLink === "string"
+        ? item.image.thumbnailLink
+        : item.link;
+    return [
+      {
+        url: item.link,
+        thumbnail,
+        title: typeof item.title === "string" ? item.title : "Untitled image",
+        ...(typeof item.image?.width === "number"
+          ? { width: item.image.width }
+          : {}),
+        ...(typeof item.image?.height === "number"
+          ? { height: item.image.height }
+          : {}),
+      },
+    ];
+  });
+}
+
+export async function searchProviderLogos(
+  query: string,
+  runtime: MediaSearchRuntime = defaultRuntime,
+): Promise<LogoSearchResult[]> {
+  const normalizedQuery = query.trim();
+  if (!normalizedQuery) throw new Error("Logo search requires a query.");
+
+  const secretKey = await runtime.resolveSecret("LOGO_DEV_SECRET_KEY");
+  if (secretKey?.startsWith("sk_")) {
+    try {
+      const url = new URL(LOGO_DEV_SEARCH_URL);
+      url.searchParams.set("q", normalizedQuery);
+      const response = await runtime.fetch(
+        url,
+        fetchOptions({
+          headers: { Authorization: `Bearer ${secretKey}` },
+        }),
+      );
+      if (response.ok) {
+        const data = (await response.json()) as Array<{
+          name?: unknown;
+          domain?: unknown;
+        }>;
+        const results = data.flatMap((item) => {
+          if (typeof item.domain !== "string") return [];
+          const result = logoResult(
+            typeof item.name === "string" ? item.name : normalizedQuery,
+            item.domain,
+            "logo.dev",
+          );
+          return result ? [result] : [];
+        });
+        if (results.length > 0) return results;
+      }
+    } catch {
+      // The deterministic domain fallback keeps the UI usable during provider outages.
+    }
+  }
+
+  return guessedLogoDomains(normalizedQuery);
+}
+
+export async function getLogoProviderConfig(
+  runtime: MediaSearchRuntime = defaultRuntime,
+) {
+  const [brandfetchId, logoDevToken, logoDevSecret] = await Promise.all([
+    runtime.resolveSecret("BRANDFETCH_CLIENT_ID"),
+    runtime.resolveSecret("LOGO_DEV_TOKEN"),
+    runtime.resolveSecret("LOGO_DEV_SECRET_KEY"),
+  ]);
+  return {
+    brandfetchId: brandfetchId || null,
+    logoDevToken: logoDevToken?.startsWith("pk_") ? logoDevToken : null,
+    hasLogoDevSecret: logoDevSecret?.startsWith("sk_") === true,
+  };
+}

package/corpus/templates/slides/server/register-secrets.ts

@@ -94,6 +94,36 @@ registerRequiredSecret({
   required: false,
 });
 
+registerRequiredSecret({
+  key: "LOGO_DEV_SECRET_KEY",
+  label: "Logo.dev Search Key",
+  description: "Optional server-side key for company and domain logo search.",
+  docsUrl: "https://www.logo.dev/",
+  scope: "user",
+  kind: "api-key",
+  required: false,
+});
+
+registerRequiredSecret({
+  key: "LOGO_DEV_TOKEN",
+  label: "Logo.dev Publishable Token",
+  description: "Optional publishable token for rendering Logo.dev images.",
+  docsUrl: "https://www.logo.dev/",
+  scope: "user",
+  kind: "api-key",
+  required: false,
+});
+
+registerRequiredSecret({
+  key: "BRANDFETCH_CLIENT_ID",
+  label: "Brandfetch Client ID",
+  description: "Optional public client ID for Brandfetch logo rendering.",
+  docsUrl: "https://developers.brandfetch.com/",
+  scope: "user",
+  kind: "api-key",
+  required: false,
+});
+
 registerRequiredSecret({
   key: "GOOGLE_CLIENT_ID",
   label: "Google OAuth Client ID",

package/dist/a2a/client.d.ts

@@ -1,4 +1,4 @@
-import type { A2AApprovedAction, AgentCard, Message, Task } from "./types.js";
+import type { A2AApprovedAction, A2ACorrelationMetadata, A2AReadOnlyActionResult, AgentCard, Message, Task } from "./types.js";
 export declare class A2ATaskTimeoutError extends Error {
     readonly taskId: string;
     readonly lastTask: Task;
@@ -51,6 +51,7 @@ export declare class A2AClient {
     send(message: Message, opts?: {
         contextId?: string;
         metadata?: Record<string, unknown>;
+        idempotencyKey?: string;
         approvedActions?: A2AApprovedAction[];
         /**
          * If true, ask the server to return the task immediately in `working`
@@ -66,6 +67,14 @@ export declare class A2AClient {
      * Poll for a task by id. Used in async mode after `send({ async: true })`.
      */
     getTask(taskId: string): Promise<Task>;
+    /**
+     * Execute one receiver-approved read-only action without starting the
+     * receiver's agent loop. The receiver still owns validation, credentials,
+     * request scoping, and the explicit action exposure decision.
+     */
+    invokeAction(action: string, input?: Record<string, unknown>, opts?: {
+        metadata?: A2ACorrelationMetadata;
+    }): Promise<A2AReadOnlyActionResult>;
     /**
      * Send a message in async mode and poll until the task reaches a terminal
      * state. This is the recommended path on serverless hosts with short
@@ -78,6 +87,7 @@ export declare class A2AClient {
     sendAndWait(message: Message, opts?: {
         contextId?: string;
         metadata?: Record<string, unknown>;
+        idempotencyKey?: string;
         approvedActions?: A2AApprovedAction[];
         /** Total time to wait for completion. Default 5 min. */
         timeoutMs?: number;
@@ -86,6 +96,20 @@ export declare class A2AClient {
         /** Called with each polled task — useful for surfacing progress. */
         onUpdate?: (task: Task) => void;
     }): Promise<Task>;
+    /**
+     * Continue waiting for an existing async task without submitting a second
+     * message. Use this after a bounded caller-side wait expires but the remote
+     * task is still working.
+     */
+    waitForTask(taskId: string, opts?: {
+        /** Total time to wait for completion. Default 5 min. */
+        timeoutMs?: number;
+        /** Poll interval. Default 2s. */
+        pollIntervalMs?: number;
+        /** Called with each successfully polled task. */
+        onUpdate?: (task: Task) => void;
+    }): Promise<Task>;
+    private pollTask;
     stream(message: Message, opts?: {
         contextId?: string;
         metadata?: Record<string, unknown>;
@@ -110,6 +134,10 @@ export declare function callAgent(url: string, text: string, opts?: {
     requestOrigin?: string;
     /** Exact downstream actions explicitly authorized in the caller's chat. */
     approvedActions?: A2AApprovedAction[];
+    /** Bounded telemetry-only lineage forwarded to the receiving app. */
+    correlation?: A2ACorrelationMetadata;
+    /** Stable caller-generated key for one message submission. */
+    idempotencyKey?: string;
     /**
      * Use async/poll instead of a single blocking POST. Recommended for
      * cross-app calls that may exceed a synchronous serverless request budget.
@@ -118,6 +146,11 @@ export declare function callAgent(url: string, text: string, opts?: {
     async?: boolean;
     /** Total time to wait for the polled task (default 5 min). */
     timeoutMs?: number;
+    /**
+     * Existing async task to keep polling. When set, no new message is sent.
+     * This prevents a caller-side timeout from duplicating downstream work.
+     */
+    taskId?: string;
     /** Poll interval for async calls. Primarily useful for tests/retries. */
     pollIntervalMs?: number;
     /**
@@ -137,4 +170,17 @@ export declare function callAgent(url: string, text: string, opts?: {
      */
     onUpdate?: (task: Task) => void;
 }): Promise<string>;
+/**
+ * Invoke one receiver-approved read-only action with an audience-bound user
+ * token. Unlike conversational delegation, this never starts the receiver's
+ * model loop.
+ */
+export declare function callAction(url: string, action: string, input?: Record<string, unknown>, opts?: {
+    apiKey?: string;
+    userEmail?: string;
+    orgDomain?: string;
+    orgSecret?: string;
+    requestTimeoutMs?: number;
+    correlation?: A2ACorrelationMetadata;
+}): Promise<A2AReadOnlyActionResult>;
 //# sourceMappingURL=client.d.ts.map

package/dist/a2a/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,iBAAiB,EACjB,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAU5D;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,wBAAgB,2BAA2B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EAepE;IAED;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBrC;IAED,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,mBAAmB;YAQb,GAAG;IA+CX,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAUvC;IAEK,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACtC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAkBf;IAED;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3C;IAED;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACtC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAmCf;IAEM,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC,CAsEtB;YAEa,wBAAwB;YAyBxB,QAAQ;CA2BvB;AAgFD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACtC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,mCAAmC,CAAC,EAAE,OAAO,CAAC;IAC9C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CACjC,GACA,OAAO,CAAC,MAAM,CAAC,CA8EjB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAU5D;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,wBAAgB,2BAA2B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EAepE;IAED;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBrC;IAED,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,mBAAmB;YAQb,GAAG;IAyDX,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAUvC;IAEK,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACtC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAmBf;IAED;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3C;IAED;;;;OAIG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,sBAAsB,CAAA;KAAE,GAC3C,OAAO,CAAC,uBAAuB,CAAC,CAalC;IAED;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACtC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAYf;IAED;;;;OAIG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QACL,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,iDAAiD;QACjD,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAIf;YAEa,QAAQ;IAmCf,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC,CAsEtB;YAEa,wBAAwB;YAyBxB,QAAQ;CA2BvB;AAiFD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACtC,qEAAqE;IACrE,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,mCAAmC,CAAC,EAAE,OAAO,CAAC;IAC9C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CACjC,GACA,OAAO,CAAC,MAAM,CAAC,CA0FjB;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,sBAAsB,CAAC;CACtC,GACA,OAAO,CAAC,uBAAuB,CAAC,CAqBlC"}

package/dist/a2a/client.js

@@ -1,5 +1,6 @@
 import * as jose from "jose";
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
+import { sanitizeA2ACorrelationMetadata } from "./correlation.js";
 export class A2ATaskTimeoutError extends Error {
     taskId;
     lastTask;
@@ -130,9 +131,15 @@ export class A2AClient {
                 const res = await this.postJson(url, body, this.apiKeyAttempts[i]);
                 console.log(`[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`);
                 if (res.ok) {
+                    const text = await res.text();
+                    if (i < this.apiKeyAttempts.length - 1 &&
+                        isA2AAuthRejectionResponse(res.status, text)) {
+                        lastError = new Error(`A2A request failed (${res.status}): ${text}`);
+                        continue;
+                    }
                     this.endpointCandidates = [url];
                     this.markApiKeySucceeded(this.apiKeyAttempts[i]);
-                    return res.json();
+                    return JSON.parse(text);
                 }
                 const text = await res.text();
                 lastError = new Error(`A2A request failed (${res.status}): ${text}`);
@@ -160,6 +167,7 @@ export class A2AClient {
             message,
             contextId: opts?.contextId,
             metadata: opts?.metadata,
+            ...(opts?.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {}),
             ...(opts?.approvedActions?.length
                 ? { approvedActions: opts.approvedActions }
                 : {}),
@@ -180,6 +188,23 @@ export class A2AClient {
         }
         return response.result;
     }
+    /**
+     * Execute one receiver-approved read-only action without starting the
+     * receiver's agent loop. The receiver still owns validation, credentials,
+     * request scoping, and the explicit action exposure decision.
+     */
+    async invokeAction(action, input = {}, opts) {
+        const metadata = sanitizeA2ACorrelationMetadata(opts?.metadata);
+        const response = await this.rpc("actions/invoke", {
+            action,
+            input,
+            ...(Object.keys(metadata).length > 0 ? { metadata } : {}),
+        });
+        if (response.error) {
+            throw new Error(`A2A error (${response.error.code}): ${response.error.message}`);
+        }
+        return response.result;
+    }
     /**
      * Send a message in async mode and poll until the task reaches a terminal
      * state. This is the recommended path on serverless hosts with short
@@ -193,11 +218,25 @@ export class A2AClient {
         const submitted = await this.send(message, {
             contextId: opts?.contextId,
             metadata: opts?.metadata,
+            idempotencyKey: opts?.idempotencyKey,
             ...(opts?.approvedActions?.length
                 ? { approvedActions: opts.approvedActions }
                 : {}),
             async: true,
         });
+        return this.pollTask(submitted, opts);
+    }
+    /**
+     * Continue waiting for an existing async task without submitting a second
+     * message. Use this after a bounded caller-side wait expires but the remote
+     * task is still working.
+     */
+    async waitForTask(taskId, opts) {
+        const current = await this.getTask(taskId);
+        opts?.onUpdate?.(current);
+        return this.pollTask(current, opts);
+    }
+    async pollTask(submitted, opts) {
         const terminalStates = new Set([
             "completed",
             "failed",
@@ -399,6 +438,7 @@ function uniqueAuthTokens(values) {
 }
 function isA2AAuthRejectionResponse(status, text) {
     return (status === 401 ||
+        /verified, audience-bound user identity/i.test(text) ||
         /A2A error \(-32001\): (?:Invalid or expired A2A token|Invalid API key|Authentication required)|Invalid or expired A2A token|Invalid API key|Authentication required/i.test(text));
 }
 /**
@@ -416,6 +456,7 @@ export async function callAgent(url, text, opts) {
         metadata.orgDomain = opts.orgDomain;
     if (opts?.requestOrigin)
         metadata.requestOrigin = opts.requestOrigin;
+    Object.assign(metadata, sanitizeA2ACorrelationMetadata(opts?.correlation));
     // Default to async + poll. The receiving A2A server's `_process-task` route
     // runs the handler in a fresh function execution (cross-platform queue
     // pattern), so async mode now works on every host instead of relying on
@@ -438,21 +479,32 @@ export async function callAgent(url, text, opts) {
             });
             let task;
             if (useAsync) {
-                task = await client.sendAndWait(message, {
-                    contextId: opts?.contextId,
-                    metadata,
-                    ...(opts?.approvedActions?.length
-                        ? { approvedActions: opts.approvedActions }
-                        : {}),
-                    timeoutMs: opts?.timeoutMs,
-                    pollIntervalMs: opts?.pollIntervalMs,
-                    onUpdate: opts?.onUpdate,
-                });
+                task = opts?.taskId
+                    ? await client.waitForTask(opts.taskId, {
+                        timeoutMs: opts.timeoutMs,
+                        pollIntervalMs: opts.pollIntervalMs,
+                        onUpdate: opts.onUpdate,
+                    })
+                    : await client.sendAndWait(message, {
+                        contextId: opts?.contextId,
+                        metadata,
+                        idempotencyKey: opts?.idempotencyKey,
+                        ...(opts?.approvedActions?.length
+                            ? { approvedActions: opts.approvedActions }
+                            : {}),
+                        timeoutMs: opts?.timeoutMs,
+                        pollIntervalMs: opts?.pollIntervalMs,
+                        onUpdate: opts?.onUpdate,
+                    });
             }
             else {
+                if (opts?.taskId) {
+                    throw new Error("Polling an existing A2A task requires async mode");
+                }
                 task = await client.send(message, {
                     contextId: opts?.contextId,
                     metadata,
+                    idempotencyKey: opts?.idempotencyKey,
                     ...(opts?.approvedActions?.length
                         ? { approvedActions: opts.approvedActions }
                         : {}),
@@ -486,7 +538,31 @@ export async function callAgent(url, text, opts) {
         throw lastAuthError;
     return "";
 }
-async function buildA2AApiKeyAttempts(opts) {
+/**
+ * Invoke one receiver-approved read-only action with an audience-bound user
+ * token. Unlike conversational delegation, this never starts the receiver's
+ * model loop.
+ */
+export async function callAction(url, action, input = {}, opts) {
+    const actionName = action.trim();
+    if (!actionName)
+        throw new Error("A2A action name is required");
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+        throw new Error("A2A action input must be an object");
+    }
+    const apiKeyAttempts = await buildA2AApiKeyAttempts(opts, normalizeA2AAudience(url));
+    const fallbackApiKeys = apiKeyAttempts
+        .slice(1)
+        .filter((token) => token !== undefined);
+    const client = new A2AClient(url, apiKeyAttempts[0], {
+        fallbackApiKeys,
+        requestTimeoutMs: opts?.requestTimeoutMs,
+    });
+    return client.invokeAction(actionName, input, {
+        metadata: sanitizeA2ACorrelationMetadata(opts?.correlation),
+    });
+}
+async function buildA2AApiKeyAttempts(opts, audience) {
     const attempts = [];
     const add = (token) => {
         if (token === undefined || attempts.includes(token))
@@ -499,6 +575,7 @@ async function buildA2AApiKeyAttempts(opts) {
             try {
                 add(await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {
                     preferGlobalSecret: true,
+                    audience,
                 }));
             }
             catch {
@@ -509,6 +586,7 @@ async function buildA2AApiKeyAttempts(opts) {
             try {
                 add(await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {
                     preferGlobalSecret: false,
+                    audience,
                 }));
             }
             catch {
@@ -520,6 +598,10 @@ async function buildA2AApiKeyAttempts(opts) {
         attempts.push(undefined);
     return attempts;
 }
+function normalizeA2AAudience(url) {
+    const explicit = splitExplicitA2AEndpoint(url.replace(/\/$/, ""));
+    return (explicit?.baseUrl ?? url).replace(/\/$/, "");
+}
 function isA2AAuthRejection(err) {
     const message = err instanceof Error ? err.message : String(err ?? "");
     return /A2A request failed \(401\)|A2A error \(-32001\): (?:Invalid or expired A2A token|Invalid API key|Authentication required)|Invalid or expired A2A token|Invalid API key|Authentication required/i.test(message);