@agent-native/core 0.18.0 → 0.19.0

package/README.md

@@ -141,17 +141,7 @@ Message, manage, and delegate to agents from Slack, Telegram, or the web. Dispat
 Generate forms from a prompt, branch logic with the agent, and own every response in your own database.
 
 </td>
-<td width="33%" align="center" valign="top">
-
-**Brain**
-
-<a href="https://agent-native.com/templates/brain"><strong>Open Brain template</strong></a>
-
-**Company chat with cited memory**
-
-Ask clean company chat questions backed by cited institutional memory from approved Slack, meetings, transcripts, GitHub, and webhooks. For live app-owned data, Brain can delegate to specialized agents instead of owning every connector itself.
-
-</td>
+<td width="33%" align="center" valign="top"></td>
 <td width="33%" align="center" valign="top"></td>
 </tr>
 </table>

package/dist/a2a/client.d.ts

@@ -18,6 +18,13 @@ export declare class A2ATaskTimeoutError extends Error {
 export declare function signA2AToken(email: string, orgDomain?: string, orgSecret?: string, options?: {
     expiresIn?: string | number;
     preferGlobalSecret?: boolean;
+    /**
+     * Extra JWT claims to merge alongside `sub` / `org_domain`. Used by the
+     * MCP connect flow to add a revocable `jti` and a `scope: "mcp-connect"`
+     * marker. Reserved claims (`sub`, `org_domain`) cannot be overridden —
+     * they are spread last so a caller can never spoof identity via this map.
+     */
+    extraClaims?: Record<string, unknown>;
 }): Promise<string>;
 export declare class A2AClient {
     private baseUrl;

package/dist/a2a/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM;CAW9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GACtE,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;gBAGhC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;IAazC;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBtC,OAAO,CAAC,OAAO;YAQD,GAAG;IAqCX,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAQlC,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC;IAiBhB;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5C;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC;IA6BT,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC;YA6DT,wBAAwB;YAyBxB,QAAQ;CAmBvB;AA2DD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,MAAM,CAAC,CAqEjB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM;CAW9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;gBAGhC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;IAazC;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBtC,OAAO,CAAC,OAAO;YAQD,GAAG;IAqCX,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAQlC,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC;IAiBhB;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5C;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC;IA6BT,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC;YA6DT,wBAAwB;YAyBxB,QAAQ;CAmBvB;AA2DD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,MAAM,CAAC,CAqEjB"}

package/dist/a2a/client.js

@@ -35,6 +35,9 @@ export async function signA2AToken(email, orgDomain, orgSecret, options) {
         process.env.BETTER_AUTH_URL ||
         "http://localhost:3000";
     return new jose.SignJWT({
+        ...(options?.extraClaims ?? {}),
+        // `sub` / `org_domain` are spread AFTER extraClaims so a caller-supplied
+        // map can never override the verified identity claims.
         sub: email,
         ...(orgDomain ? { org_domain: orgDomain } : {}),
     })

package/dist/a2a/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAS7B,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,QAAQ,CAAO;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAE3B,YAAY,MAAc,EAAE,QAAc,EAAE,SAAiB;QAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,KAAK,CACH,YAAY,MAAM,4BAA4B,SAAS,mBAAmB,SAAS,GAAG,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,SAAkB,EAClB,SAAkB,EAClB,OAAuE;IAEvE,MAAM,MAAM,GAAG,OAAO,EAAE,kBAAkB;QACxC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS;QACrC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,uBAAuB,CAAC;IAE1B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,GAAG,EAAE,KAAK;QACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,EAAE;SACb,iBAAiB,CAAC,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;SAC9C,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,OAAO,SAAS;IACZ,OAAO,CAAS;IAChB,MAAM,CAAU;IAChB,kBAAkB,GAAa,EAAE,CAAC;IAClC,gBAAgB,GAAG,KAAK,CAAC;IACzB,gBAAgB,CAAU;IAElC,YACE,OAAe,EACf,MAAe,EACf,OAAuC;QAEvC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,UAAU,CAAC;QACvD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO;QAEhD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACzD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7C,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO;QACb,MAAM,CAAC,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,MAAc,EACd,MAA+B;QAE/B,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,MAAM;SACP,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAiB,IAAI,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,WAAW,MAAM,EAAE,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CACT,0BAA0B,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,CACtE,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChC,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;YAChD,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,MAAM,SAAS,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,8BAA8B,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAwB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAgB,EAChB,IAYC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;YAC9C,OAAO;YACP,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,OAAgB,EAChB,IASC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACzC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACpE,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjE,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6DAA6D;gBAC7D,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CACX,OAAgB,EAChB,IAAiE;QAEjE,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,OAAO;gBACP,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;aACzB;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,GAAG,GAAoB,IAAI,CAAC;QAChC,IAAI,SAAS,GAAiB,IAAI,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChD,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,SAAS,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,MAAM,QAAQ,GAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,MAAc,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,4BAA4B,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,gBAAgB,EAAE,CAAC;oBACrB,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAoB;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB;YACtC,CAAC,CAAC,IAAI,eAAe,EAAE;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GACT,UAAU,IAAI,IAAI,CAAC,gBAAgB;YACjC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;gBACvB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,EAAE,MAAM;aAC3B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAC/B,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACzE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YAC3D,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAoB,EAAE,OAAe;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CACnB,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAY,EACZ,IAcC;IAED,IAAI,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;IAE1B,8FAA8F;IAC9F,IACE,CAAC,MAAM;QACP,IAAI,EAAE,SAAS;QACf,CAAC,IAAI,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAC3C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CACzB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,EAAE,kBAAkB,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CACxC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAEzD,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IACrC,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC;IAEF,IAAI,IAAU,CAAC;IACf,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;gBACvC,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,QAAQ;gBACR,SAAS,EAAE,IAAI,EAAE,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACvC,MAAM,eAAe,GAAG,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrE,IAAI,eAAe;oBAAE,OAAO,eAAe,CAAC;YAC9C,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;YAChC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,iCAAiC;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IAC5C,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK;aACpC,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;aACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,8BAA8B,CAAC,IAAU;IAChD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,KAAK;SACjB,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import * as jose from \"jose\";\nimport type {\n  AgentCard,\n  JsonRpcRequest,\n  JsonRpcResponse,\n  Message,\n  Task,\n} from \"./types.js\";\n\nexport class A2ATaskTimeoutError extends Error {\n  readonly taskId: string;\n  readonly lastTask: Task;\n  readonly lastState: string;\n  readonly timeoutMs: number;\n\n  constructor(taskId: string, lastTask: Task, timeoutMs: number) {\n    const lastState = lastTask.status.state;\n    super(\n      `A2A task ${taskId} did not complete within ${timeoutMs}ms (last state: ${lastState})`,\n    );\n    this.name = \"A2ATaskTimeoutError\";\n    this.taskId = taskId;\n    this.lastTask = lastTask;\n    this.lastState = lastState;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Sign a JWT for A2A cross-app identity verification.\n *\n * Uses an org-level secret by default for direct org-secret workflows. Callers\n * that are doing ordinary hosted cross-app delegation can set\n * `preferGlobalSecret` so deployments with a shared A2A_SECRET don't depend on\n * every app database having an identical org row. The token contains the\n * caller's email as `sub`, so the receiving app can verify who's calling.\n */\nexport async function signA2AToken(\n  email: string,\n  orgDomain?: string,\n  orgSecret?: string,\n  options?: { expiresIn?: string | number; preferGlobalSecret?: boolean },\n): Promise<string> {\n  const secret = options?.preferGlobalSecret\n    ? process.env.A2A_SECRET || orgSecret\n    : orgSecret || process.env.A2A_SECRET;\n  if (!secret) {\n    throw new Error(\n      \"No A2A secret available. Set an org-level A2A secret in Team settings, \" +\n        \"or set A2A_SECRET as an environment variable on all apps that need to verify identity.\",\n    );\n  }\n\n  const appUrl =\n    process.env.APP_URL ||\n    process.env.BETTER_AUTH_URL ||\n    \"http://localhost:3000\";\n\n  return new jose.SignJWT({\n    sub: email,\n    ...(orgDomain ? { org_domain: orgDomain } : {}),\n  })\n    .setProtectedHeader({ alg: \"HS256\" })\n    .setIssuer(appUrl)\n    .setIssuedAt()\n    .setExpirationTime(options?.expiresIn ?? \"15m\")\n    .sign(new TextEncoder().encode(secret));\n}\n\nexport class A2AClient {\n  private baseUrl: string;\n  private apiKey?: string;\n  private endpointCandidates: string[] = [];\n  private endpointResolved = false;\n  private requestTimeoutMs?: number;\n\n  constructor(\n    baseUrl: string,\n    apiKey?: string,\n    options?: { requestTimeoutMs?: number },\n  ) {\n    const normalized = baseUrl.replace(/\\/$/, \"\");\n    const explicitEndpoint = splitExplicitA2AEndpoint(normalized);\n    this.baseUrl = explicitEndpoint?.baseUrl ?? normalized;\n    if (explicitEndpoint) {\n      this.endpointCandidates = [explicitEndpoint.endpointUrl];\n      this.endpointResolved = true;\n    }\n    this.apiKey = apiKey;\n    this.requestTimeoutMs = options?.requestTimeoutMs;\n  }\n\n  /**\n   * Detect which A2A path the target agent uses.\n   * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.\n   */\n  async resolveEndpoint(): Promise<void> {\n    await this.ensureEndpointCandidates();\n    if (this.endpointCandidates.length <= 1) return;\n\n    for (const endpoint of this.endpointCandidates) {\n      try {\n        const res = await fetch(endpoint, { method: \"OPTIONS\" });\n        if (res.status !== 404 && res.status !== 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n        if (res.status === 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n      } catch {\n        // Try the next candidate.\n      }\n    }\n  }\n\n  private headers(): Record<string, string> {\n    const h: Record<string, string> = { \"Content-Type\": \"application/json\" };\n    if (this.apiKey) {\n      h[\"Authorization\"] = `Bearer ${this.apiKey}`;\n    }\n    return h;\n  }\n\n  private async rpc(\n    method: string,\n    params: Record<string, unknown>,\n  ): Promise<JsonRpcResponse> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method,\n      params,\n    };\n\n    await this.ensureEndpointCandidates();\n    let lastError: Error | null = null;\n\n    for (const url of this.endpointCandidates) {\n      console.log(`[A2A Client] POST ${url} method=${method}`);\n      const startTime = Date.now();\n      const res = await this.postJson(url, body);\n      console.log(\n        `[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`,\n      );\n\n      if (res.ok) {\n        this.endpointCandidates = [url];\n        return res.json() as Promise<JsonRpcResponse>;\n      }\n\n      const text = await res.text();\n      lastError = new Error(`A2A request failed (${res.status}): ${text}`);\n      if (!shouldTryNextEndpoint(res.status)) {\n        throw lastError;\n      }\n    }\n\n    throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n  }\n\n  async getAgentCard(): Promise<AgentCard> {\n    const res = await fetch(`${this.baseUrl}/.well-known/agent-card.json`);\n    if (!res.ok) {\n      throw new Error(`Failed to fetch agent card (${res.status})`);\n    }\n    return res.json() as Promise<AgentCard>;\n  }\n\n  async send(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      /**\n       * If true, ask the server to return the task immediately in `working`\n       * state and process the handler in the background. The caller should\n       * then poll `getTask(taskId)` until `completed` / `failed` / `canceled`.\n       *\n       * Use this when you expect the handler may exceed a synchronous\n       * serverless request budget.\n       */\n      async?: boolean;\n    },\n  ): Promise<Task> {\n    const response = await this.rpc(\"message/send\", {\n      message,\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      ...(opts?.async ? { async: true } : {}),\n    });\n\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n\n    return response.result as Task;\n  }\n\n  /**\n   * Poll for a task by id. Used in async mode after `send({ async: true })`.\n   */\n  async getTask(taskId: string): Promise<Task> {\n    const response = await this.rpc(\"tasks/get\", { id: taskId });\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n    return response.result as Task;\n  }\n\n  /**\n   * Send a message in async mode and poll until the task reaches a terminal\n   * state. This is the recommended path on serverless hosts with short\n   * function timeouts (Netlify, Vercel) where a synchronous LLM-driven A2A\n   * call can exceed the gateway limit.\n   *\n   * Each individual fetch returns quickly; long-running work happens on the\n   * receiving side and is checked via `tasks/get`.\n   */\n  async sendAndWait(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      /** Total time to wait for completion. Default 5 min. */\n      timeoutMs?: number;\n      /** Poll interval. Default 2s. */\n      pollIntervalMs?: number;\n      /** Called with each polled task — useful for surfacing progress. */\n      onUpdate?: (task: Task) => void;\n    },\n  ): Promise<Task> {\n    const submitted = await this.send(message, {\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      async: true,\n    });\n\n    const terminalStates = new Set([\"completed\", \"failed\", \"canceled\"]);\n    if (terminalStates.has(submitted.status.state)) return submitted;\n\n    const timeoutMs = opts?.timeoutMs ?? 5 * 60_000;\n    const pollMs = opts?.pollIntervalMs ?? 2_000;\n    const deadline = Date.now() + timeoutMs;\n\n    let current = submitted;\n    while (Date.now() < deadline) {\n      await new Promise((r) => setTimeout(r, pollMs));\n      try {\n        current = await this.getTask(submitted.id);\n        opts?.onUpdate?.(current);\n      } catch (err) {\n        // Transient fetch failure — keep polling until the deadline.\n        continue;\n      }\n      if (terminalStates.has(current.status.state)) return current;\n    }\n    throw new A2ATaskTimeoutError(submitted.id, current, timeoutMs);\n  }\n\n  async *stream(\n    message: Message,\n    opts?: { contextId?: string; metadata?: Record<string, unknown> },\n  ): AsyncGenerator<Task> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method: \"message/stream\",\n      params: {\n        message,\n        contextId: opts?.contextId,\n        metadata: opts?.metadata,\n      },\n    };\n\n    await this.ensureEndpointCandidates();\n    let res: Response | null = null;\n    let lastError: Error | null = null;\n    for (const candidate of this.endpointCandidates) {\n      res = await this.postJson(candidate, body);\n      if (res.ok) {\n        this.endpointCandidates = [candidate];\n        break;\n      }\n      const text = await res.text();\n      lastError = new Error(`A2A stream failed (${res.status}): ${text}`);\n      if (!shouldTryNextEndpoint(res.status)) throw lastError;\n    }\n    if (!res?.ok) {\n      throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n    }\n\n    const reader = res.body?.getReader();\n    if (!reader) throw new Error(\"No response body\");\n\n    const decoder = new TextDecoder();\n    let buffer = \"\";\n\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n\n      buffer += decoder.decode(value, { stream: true });\n      const lines = buffer.split(\"\\n\");\n      buffer = lines.pop() ?? \"\";\n\n      for (const line of lines) {\n        if (!line.startsWith(\"data: \")) continue;\n        const json = line.slice(6).trim();\n        if (!json) continue;\n\n        const response: JsonRpcResponse = JSON.parse(json);\n        if (response.error) {\n          throw new Error(\n            `A2A error (${response.error.code}): ${response.error.message}`,\n          );\n        }\n        if (response.result) {\n          yield response.result as Task;\n        }\n      }\n    }\n  }\n\n  private async ensureEndpointCandidates(): Promise<void> {\n    if (this.endpointResolved) return;\n    this.endpointResolved = true;\n\n    const candidates: string[] = [];\n    addDefaultEndpointCandidates(candidates, this.baseUrl);\n\n    try {\n      const card = await this.getAgentCard();\n      const cardUrl = normalizeUrl(card.url, this.baseUrl);\n      if (cardUrl) {\n        const explicitEndpoint = splitExplicitA2AEndpoint(cardUrl);\n        if (explicitEndpoint) {\n          candidates.unshift(explicitEndpoint.endpointUrl);\n        } else {\n          addDefaultEndpointCandidates(candidates, cardUrl);\n        }\n      }\n    } catch {\n      // Agent cards are discovery hints. Fall back to conventional endpoints.\n    }\n\n    this.endpointCandidates = unique(candidates);\n  }\n\n  private async postJson(url: string, body: JsonRpcRequest): Promise<Response> {\n    const controller = this.requestTimeoutMs\n      ? new AbortController()\n      : undefined;\n    const timer =\n      controller && this.requestTimeoutMs\n        ? setTimeout(() => controller.abort(), this.requestTimeoutMs)\n        : undefined;\n    try {\n      return await fetch(url, {\n        method: \"POST\",\n        headers: this.headers(),\n        body: JSON.stringify(body),\n        signal: controller?.signal,\n      });\n    } finally {\n      if (timer) clearTimeout(timer);\n    }\n  }\n}\n\nfunction splitExplicitA2AEndpoint(\n  url: string,\n): { baseUrl: string; endpointUrl: string } | null {\n  try {\n    const parsed = new URL(url);\n    const pathname = parsed.pathname.replace(/\\/$/, \"\");\n    if (pathname.endsWith(\"/_agent-native/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/_agent-native/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n    if (pathname.endsWith(\"/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n  } catch {\n    // Relative or invalid URLs are handled by the caller's normal fetch path.\n  }\n  return null;\n}\n\nfunction addDefaultEndpointCandidates(candidates: string[], baseUrl: string) {\n  const base = baseUrl.replace(/\\/$/, \"\");\n  candidates.push(`${base}/_agent-native/a2a`, `${base}/a2a`);\n}\n\nfunction normalizeUrl(\n  value: string | undefined,\n  baseUrl: string,\n): string | null {\n  if (!value) return null;\n  try {\n    return new URL(value, `${baseUrl.replace(/\\/$/, \"\")}/`)\n      .toString()\n      .replace(/\\/$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction shouldTryNextEndpoint(status: number): boolean {\n  return status === 404 || status === 405;\n}\n\nfunction unique(values: string[]): string[] {\n  return Array.from(new Set(values));\n}\n\n/**\n * One-shot convenience function: send a text message and get a text response.\n *\n * When A2A_SECRET is set and userEmail is provided, outbound calls are signed\n * with a JWT so the receiving app can cryptographically verify the caller's\n * identity (instead of blindly trusting metadata).\n */\nexport async function callAgent(\n  url: string,\n  text: string,\n  opts?: {\n    apiKey?: string;\n    contextId?: string;\n    userEmail?: string;\n    orgDomain?: string;\n    orgSecret?: string;\n    /**\n     * Use async/poll instead of a single blocking POST. Recommended for\n     * cross-app calls that may exceed a synchronous serverless request budget.\n     * Defaults to true so callers get safe behavior out of the box.\n     */\n    async?: boolean;\n    /** Total time to wait for the polled task (default 5 min). */\n    timeoutMs?: number;\n  },\n): Promise<string> {\n  let apiKey = opts?.apiKey;\n\n  // Auto-sign with JWT when an A2A secret (org or global) is available and we have a user email\n  if (\n    !apiKey &&\n    opts?.userEmail &&\n    (opts?.orgSecret || process.env.A2A_SECRET)\n  ) {\n    try {\n      apiKey = await signA2AToken(\n        opts.userEmail,\n        opts.orgDomain,\n        opts.orgSecret,\n        { preferGlobalSecret: !opts.orgSecret },\n      );\n    } catch {\n      // Fall back to unsigned call\n    }\n  }\n\n  const client = new A2AClient(url, apiKey);\n  const metadata: Record<string, unknown> = {};\n  if (opts?.userEmail) metadata.userEmail = opts.userEmail;\n  if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;\n\n  // Default to async + poll. The receiving A2A server's `_process-task` route\n  // runs the handler in a fresh function execution (cross-platform queue\n  // pattern), so async mode now works on every host instead of relying on\n  // detached promises that get killed on Netlify/Vercel. Callers that\n  // explicitly want a single-shot blocking POST can pass `async: false`.\n  const useAsync = opts?.async ?? true;\n  const message: Message = {\n    role: \"user\",\n    parts: [{ type: \"text\", text }],\n  };\n\n  let task: Task;\n  if (useAsync) {\n    try {\n      task = await client.sendAndWait(message, {\n        contextId: opts?.contextId,\n        metadata,\n        timeoutMs: opts?.timeoutMs,\n      });\n    } catch (err) {\n      if (err instanceof A2ATaskTimeoutError) {\n        const recoverableText = extractRecoverableArtifactText(err.lastTask);\n        if (recoverableText) return recoverableText;\n      }\n      throw err;\n    }\n  } else {\n    task = await client.send(message, {\n      contextId: opts?.contextId,\n      metadata,\n    });\n  }\n\n  // Extract text from the response\n  const responseMessage = task.status.message;\n  if (responseMessage) {\n    const textParts = responseMessage.parts\n      .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n      .map((p) => p.text);\n    return textParts.join(\"\\n\");\n  }\n\n  return \"\";\n}\n\nfunction extractRecoverableArtifactText(task: Task): string {\n  if (!task.status.message?.metadata?.agentNativeRecoverableArtifacts) {\n    return \"\";\n  }\n  return extractMessageText(task.status.message);\n}\n\nfunction extractMessageText(message: Message): string {\n  return message.parts\n    .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n    .map((p) => p.text)\n    .join(\"\\n\");\n}\n"]}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAS7B,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,QAAQ,CAAO;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAE3B,YAAY,MAAc,EAAE,QAAc,EAAE,SAAiB;QAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,KAAK,CACH,YAAY,MAAM,4BAA4B,SAAS,mBAAmB,SAAS,GAAG,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,SAAkB,EAClB,SAAkB,EAClB,OAUC;IAED,MAAM,MAAM,GAAG,OAAO,EAAE,kBAAkB;QACxC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS;QACrC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,uBAAuB,CAAC;IAE1B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;QAC/B,yEAAyE;QACzE,uDAAuD;QACvD,GAAG,EAAE,KAAK;QACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,EAAE;SACb,iBAAiB,CAAC,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;SAC9C,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,OAAO,SAAS;IACZ,OAAO,CAAS;IAChB,MAAM,CAAU;IAChB,kBAAkB,GAAa,EAAE,CAAC;IAClC,gBAAgB,GAAG,KAAK,CAAC;IACzB,gBAAgB,CAAU;IAElC,YACE,OAAe,EACf,MAAe,EACf,OAAuC;QAEvC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,UAAU,CAAC;QACvD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO;QAEhD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACzD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7C,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO;QACb,MAAM,CAAC,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,MAAc,EACd,MAA+B;QAE/B,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,MAAM;SACP,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAiB,IAAI,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,WAAW,MAAM,EAAE,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CACT,0BAA0B,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,CACtE,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChC,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;YAChD,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,MAAM,SAAS,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,8BAA8B,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAwB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAgB,EAChB,IAYC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;YAC9C,OAAO;YACP,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,OAAgB,EAChB,IASC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACzC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACpE,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjE,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6DAA6D;gBAC7D,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CACX,OAAgB,EAChB,IAAiE;QAEjE,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,OAAO;gBACP,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;aACzB;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,GAAG,GAAoB,IAAI,CAAC;QAChC,IAAI,SAAS,GAAiB,IAAI,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChD,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,SAAS,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,MAAM,QAAQ,GAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,MAAc,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,4BAA4B,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,gBAAgB,EAAE,CAAC;oBACrB,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAoB;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB;YACtC,CAAC,CAAC,IAAI,eAAe,EAAE;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GACT,UAAU,IAAI,IAAI,CAAC,gBAAgB;YACjC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;gBACvB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,EAAE,MAAM;aAC3B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAC/B,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACzE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YAC3D,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAoB,EAAE,OAAe;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CACnB,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAY,EACZ,IAcC;IAED,IAAI,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;IAE1B,8FAA8F;IAC9F,IACE,CAAC,MAAM;QACP,IAAI,EAAE,SAAS;QACf,CAAC,IAAI,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAC3C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CACzB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,EAAE,kBAAkB,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CACxC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAEzD,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IACrC,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC;IAEF,IAAI,IAAU,CAAC;IACf,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;gBACvC,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,QAAQ;gBACR,SAAS,EAAE,IAAI,EAAE,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACvC,MAAM,eAAe,GAAG,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrE,IAAI,eAAe;oBAAE,OAAO,eAAe,CAAC;YAC9C,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;YAChC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,iCAAiC;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IAC5C,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK;aACpC,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;aACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,8BAA8B,CAAC,IAAU;IAChD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,KAAK;SACjB,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import * as jose from \"jose\";\nimport type {\n  AgentCard,\n  JsonRpcRequest,\n  JsonRpcResponse,\n  Message,\n  Task,\n} from \"./types.js\";\n\nexport class A2ATaskTimeoutError extends Error {\n  readonly taskId: string;\n  readonly lastTask: Task;\n  readonly lastState: string;\n  readonly timeoutMs: number;\n\n  constructor(taskId: string, lastTask: Task, timeoutMs: number) {\n    const lastState = lastTask.status.state;\n    super(\n      `A2A task ${taskId} did not complete within ${timeoutMs}ms (last state: ${lastState})`,\n    );\n    this.name = \"A2ATaskTimeoutError\";\n    this.taskId = taskId;\n    this.lastTask = lastTask;\n    this.lastState = lastState;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Sign a JWT for A2A cross-app identity verification.\n *\n * Uses an org-level secret by default for direct org-secret workflows. Callers\n * that are doing ordinary hosted cross-app delegation can set\n * `preferGlobalSecret` so deployments with a shared A2A_SECRET don't depend on\n * every app database having an identical org row. The token contains the\n * caller's email as `sub`, so the receiving app can verify who's calling.\n */\nexport async function signA2AToken(\n  email: string,\n  orgDomain?: string,\n  orgSecret?: string,\n  options?: {\n    expiresIn?: string | number;\n    preferGlobalSecret?: boolean;\n    /**\n     * Extra JWT claims to merge alongside `sub` / `org_domain`. Used by the\n     * MCP connect flow to add a revocable `jti` and a `scope: \"mcp-connect\"`\n     * marker. Reserved claims (`sub`, `org_domain`) cannot be overridden —\n     * they are spread last so a caller can never spoof identity via this map.\n     */\n    extraClaims?: Record<string, unknown>;\n  },\n): Promise<string> {\n  const secret = options?.preferGlobalSecret\n    ? process.env.A2A_SECRET || orgSecret\n    : orgSecret || process.env.A2A_SECRET;\n  if (!secret) {\n    throw new Error(\n      \"No A2A secret available. Set an org-level A2A secret in Team settings, \" +\n        \"or set A2A_SECRET as an environment variable on all apps that need to verify identity.\",\n    );\n  }\n\n  const appUrl =\n    process.env.APP_URL ||\n    process.env.BETTER_AUTH_URL ||\n    \"http://localhost:3000\";\n\n  return new jose.SignJWT({\n    ...(options?.extraClaims ?? {}),\n    // `sub` / `org_domain` are spread AFTER extraClaims so a caller-supplied\n    // map can never override the verified identity claims.\n    sub: email,\n    ...(orgDomain ? { org_domain: orgDomain } : {}),\n  })\n    .setProtectedHeader({ alg: \"HS256\" })\n    .setIssuer(appUrl)\n    .setIssuedAt()\n    .setExpirationTime(options?.expiresIn ?? \"15m\")\n    .sign(new TextEncoder().encode(secret));\n}\n\nexport class A2AClient {\n  private baseUrl: string;\n  private apiKey?: string;\n  private endpointCandidates: string[] = [];\n  private endpointResolved = false;\n  private requestTimeoutMs?: number;\n\n  constructor(\n    baseUrl: string,\n    apiKey?: string,\n    options?: { requestTimeoutMs?: number },\n  ) {\n    const normalized = baseUrl.replace(/\\/$/, \"\");\n    const explicitEndpoint = splitExplicitA2AEndpoint(normalized);\n    this.baseUrl = explicitEndpoint?.baseUrl ?? normalized;\n    if (explicitEndpoint) {\n      this.endpointCandidates = [explicitEndpoint.endpointUrl];\n      this.endpointResolved = true;\n    }\n    this.apiKey = apiKey;\n    this.requestTimeoutMs = options?.requestTimeoutMs;\n  }\n\n  /**\n   * Detect which A2A path the target agent uses.\n   * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.\n   */\n  async resolveEndpoint(): Promise<void> {\n    await this.ensureEndpointCandidates();\n    if (this.endpointCandidates.length <= 1) return;\n\n    for (const endpoint of this.endpointCandidates) {\n      try {\n        const res = await fetch(endpoint, { method: \"OPTIONS\" });\n        if (res.status !== 404 && res.status !== 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n        if (res.status === 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n      } catch {\n        // Try the next candidate.\n      }\n    }\n  }\n\n  private headers(): Record<string, string> {\n    const h: Record<string, string> = { \"Content-Type\": \"application/json\" };\n    if (this.apiKey) {\n      h[\"Authorization\"] = `Bearer ${this.apiKey}`;\n    }\n    return h;\n  }\n\n  private async rpc(\n    method: string,\n    params: Record<string, unknown>,\n  ): Promise<JsonRpcResponse> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method,\n      params,\n    };\n\n    await this.ensureEndpointCandidates();\n    let lastError: Error | null = null;\n\n    for (const url of this.endpointCandidates) {\n      console.log(`[A2A Client] POST ${url} method=${method}`);\n      const startTime = Date.now();\n      const res = await this.postJson(url, body);\n      console.log(\n        `[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`,\n      );\n\n      if (res.ok) {\n        this.endpointCandidates = [url];\n        return res.json() as Promise<JsonRpcResponse>;\n      }\n\n      const text = await res.text();\n      lastError = new Error(`A2A request failed (${res.status}): ${text}`);\n      if (!shouldTryNextEndpoint(res.status)) {\n        throw lastError;\n      }\n    }\n\n    throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n  }\n\n  async getAgentCard(): Promise<AgentCard> {\n    const res = await fetch(`${this.baseUrl}/.well-known/agent-card.json`);\n    if (!res.ok) {\n      throw new Error(`Failed to fetch agent card (${res.status})`);\n    }\n    return res.json() as Promise<AgentCard>;\n  }\n\n  async send(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      /**\n       * If true, ask the server to return the task immediately in `working`\n       * state and process the handler in the background. The caller should\n       * then poll `getTask(taskId)` until `completed` / `failed` / `canceled`.\n       *\n       * Use this when you expect the handler may exceed a synchronous\n       * serverless request budget.\n       */\n      async?: boolean;\n    },\n  ): Promise<Task> {\n    const response = await this.rpc(\"message/send\", {\n      message,\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      ...(opts?.async ? { async: true } : {}),\n    });\n\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n\n    return response.result as Task;\n  }\n\n  /**\n   * Poll for a task by id. Used in async mode after `send({ async: true })`.\n   */\n  async getTask(taskId: string): Promise<Task> {\n    const response = await this.rpc(\"tasks/get\", { id: taskId });\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n    return response.result as Task;\n  }\n\n  /**\n   * Send a message in async mode and poll until the task reaches a terminal\n   * state. This is the recommended path on serverless hosts with short\n   * function timeouts (Netlify, Vercel) where a synchronous LLM-driven A2A\n   * call can exceed the gateway limit.\n   *\n   * Each individual fetch returns quickly; long-running work happens on the\n   * receiving side and is checked via `tasks/get`.\n   */\n  async sendAndWait(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      /** Total time to wait for completion. Default 5 min. */\n      timeoutMs?: number;\n      /** Poll interval. Default 2s. */\n      pollIntervalMs?: number;\n      /** Called with each polled task — useful for surfacing progress. */\n      onUpdate?: (task: Task) => void;\n    },\n  ): Promise<Task> {\n    const submitted = await this.send(message, {\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      async: true,\n    });\n\n    const terminalStates = new Set([\"completed\", \"failed\", \"canceled\"]);\n    if (terminalStates.has(submitted.status.state)) return submitted;\n\n    const timeoutMs = opts?.timeoutMs ?? 5 * 60_000;\n    const pollMs = opts?.pollIntervalMs ?? 2_000;\n    const deadline = Date.now() + timeoutMs;\n\n    let current = submitted;\n    while (Date.now() < deadline) {\n      await new Promise((r) => setTimeout(r, pollMs));\n      try {\n        current = await this.getTask(submitted.id);\n        opts?.onUpdate?.(current);\n      } catch (err) {\n        // Transient fetch failure — keep polling until the deadline.\n        continue;\n      }\n      if (terminalStates.has(current.status.state)) return current;\n    }\n    throw new A2ATaskTimeoutError(submitted.id, current, timeoutMs);\n  }\n\n  async *stream(\n    message: Message,\n    opts?: { contextId?: string; metadata?: Record<string, unknown> },\n  ): AsyncGenerator<Task> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method: \"message/stream\",\n      params: {\n        message,\n        contextId: opts?.contextId,\n        metadata: opts?.metadata,\n      },\n    };\n\n    await this.ensureEndpointCandidates();\n    let res: Response | null = null;\n    let lastError: Error | null = null;\n    for (const candidate of this.endpointCandidates) {\n      res = await this.postJson(candidate, body);\n      if (res.ok) {\n        this.endpointCandidates = [candidate];\n        break;\n      }\n      const text = await res.text();\n      lastError = new Error(`A2A stream failed (${res.status}): ${text}`);\n      if (!shouldTryNextEndpoint(res.status)) throw lastError;\n    }\n    if (!res?.ok) {\n      throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n    }\n\n    const reader = res.body?.getReader();\n    if (!reader) throw new Error(\"No response body\");\n\n    const decoder = new TextDecoder();\n    let buffer = \"\";\n\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n\n      buffer += decoder.decode(value, { stream: true });\n      const lines = buffer.split(\"\\n\");\n      buffer = lines.pop() ?? \"\";\n\n      for (const line of lines) {\n        if (!line.startsWith(\"data: \")) continue;\n        const json = line.slice(6).trim();\n        if (!json) continue;\n\n        const response: JsonRpcResponse = JSON.parse(json);\n        if (response.error) {\n          throw new Error(\n            `A2A error (${response.error.code}): ${response.error.message}`,\n          );\n        }\n        if (response.result) {\n          yield response.result as Task;\n        }\n      }\n    }\n  }\n\n  private async ensureEndpointCandidates(): Promise<void> {\n    if (this.endpointResolved) return;\n    this.endpointResolved = true;\n\n    const candidates: string[] = [];\n    addDefaultEndpointCandidates(candidates, this.baseUrl);\n\n    try {\n      const card = await this.getAgentCard();\n      const cardUrl = normalizeUrl(card.url, this.baseUrl);\n      if (cardUrl) {\n        const explicitEndpoint = splitExplicitA2AEndpoint(cardUrl);\n        if (explicitEndpoint) {\n          candidates.unshift(explicitEndpoint.endpointUrl);\n        } else {\n          addDefaultEndpointCandidates(candidates, cardUrl);\n        }\n      }\n    } catch {\n      // Agent cards are discovery hints. Fall back to conventional endpoints.\n    }\n\n    this.endpointCandidates = unique(candidates);\n  }\n\n  private async postJson(url: string, body: JsonRpcRequest): Promise<Response> {\n    const controller = this.requestTimeoutMs\n      ? new AbortController()\n      : undefined;\n    const timer =\n      controller && this.requestTimeoutMs\n        ? setTimeout(() => controller.abort(), this.requestTimeoutMs)\n        : undefined;\n    try {\n      return await fetch(url, {\n        method: \"POST\",\n        headers: this.headers(),\n        body: JSON.stringify(body),\n        signal: controller?.signal,\n      });\n    } finally {\n      if (timer) clearTimeout(timer);\n    }\n  }\n}\n\nfunction splitExplicitA2AEndpoint(\n  url: string,\n): { baseUrl: string; endpointUrl: string } | null {\n  try {\n    const parsed = new URL(url);\n    const pathname = parsed.pathname.replace(/\\/$/, \"\");\n    if (pathname.endsWith(\"/_agent-native/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/_agent-native/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n    if (pathname.endsWith(\"/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n  } catch {\n    // Relative or invalid URLs are handled by the caller's normal fetch path.\n  }\n  return null;\n}\n\nfunction addDefaultEndpointCandidates(candidates: string[], baseUrl: string) {\n  const base = baseUrl.replace(/\\/$/, \"\");\n  candidates.push(`${base}/_agent-native/a2a`, `${base}/a2a`);\n}\n\nfunction normalizeUrl(\n  value: string | undefined,\n  baseUrl: string,\n): string | null {\n  if (!value) return null;\n  try {\n    return new URL(value, `${baseUrl.replace(/\\/$/, \"\")}/`)\n      .toString()\n      .replace(/\\/$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction shouldTryNextEndpoint(status: number): boolean {\n  return status === 404 || status === 405;\n}\n\nfunction unique(values: string[]): string[] {\n  return Array.from(new Set(values));\n}\n\n/**\n * One-shot convenience function: send a text message and get a text response.\n *\n * When A2A_SECRET is set and userEmail is provided, outbound calls are signed\n * with a JWT so the receiving app can cryptographically verify the caller's\n * identity (instead of blindly trusting metadata).\n */\nexport async function callAgent(\n  url: string,\n  text: string,\n  opts?: {\n    apiKey?: string;\n    contextId?: string;\n    userEmail?: string;\n    orgDomain?: string;\n    orgSecret?: string;\n    /**\n     * Use async/poll instead of a single blocking POST. Recommended for\n     * cross-app calls that may exceed a synchronous serverless request budget.\n     * Defaults to true so callers get safe behavior out of the box.\n     */\n    async?: boolean;\n    /** Total time to wait for the polled task (default 5 min). */\n    timeoutMs?: number;\n  },\n): Promise<string> {\n  let apiKey = opts?.apiKey;\n\n  // Auto-sign with JWT when an A2A secret (org or global) is available and we have a user email\n  if (\n    !apiKey &&\n    opts?.userEmail &&\n    (opts?.orgSecret || process.env.A2A_SECRET)\n  ) {\n    try {\n      apiKey = await signA2AToken(\n        opts.userEmail,\n        opts.orgDomain,\n        opts.orgSecret,\n        { preferGlobalSecret: !opts.orgSecret },\n      );\n    } catch {\n      // Fall back to unsigned call\n    }\n  }\n\n  const client = new A2AClient(url, apiKey);\n  const metadata: Record<string, unknown> = {};\n  if (opts?.userEmail) metadata.userEmail = opts.userEmail;\n  if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;\n\n  // Default to async + poll. The receiving A2A server's `_process-task` route\n  // runs the handler in a fresh function execution (cross-platform queue\n  // pattern), so async mode now works on every host instead of relying on\n  // detached promises that get killed on Netlify/Vercel. Callers that\n  // explicitly want a single-shot blocking POST can pass `async: false`.\n  const useAsync = opts?.async ?? true;\n  const message: Message = {\n    role: \"user\",\n    parts: [{ type: \"text\", text }],\n  };\n\n  let task: Task;\n  if (useAsync) {\n    try {\n      task = await client.sendAndWait(message, {\n        contextId: opts?.contextId,\n        metadata,\n        timeoutMs: opts?.timeoutMs,\n      });\n    } catch (err) {\n      if (err instanceof A2ATaskTimeoutError) {\n        const recoverableText = extractRecoverableArtifactText(err.lastTask);\n        if (recoverableText) return recoverableText;\n      }\n      throw err;\n    }\n  } else {\n    task = await client.send(message, {\n      contextId: opts?.contextId,\n      metadata,\n    });\n  }\n\n  // Extract text from the response\n  const responseMessage = task.status.message;\n  if (responseMessage) {\n    const textParts = responseMessage.parts\n      .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n      .map((p) => p.text);\n    return textParts.join(\"\\n\");\n  }\n\n  return \"\";\n}\n\nfunction extractRecoverableArtifactText(task: Task): string {\n  if (!task.status.message?.metadata?.agentNativeRecoverableArtifacts) {\n    return \"\";\n  }\n  return extractMessageText(task.status.message);\n}\n\nfunction extractMessageText(message: Message): string {\n  return message.parts\n    .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n    .map((p) => p.text)\n    .join(\"\\n\");\n}\n"]}

package/dist/cli/connect.d.ts

@@ -0,0 +1,94 @@
+/**
+ * `agent-native connect <url>` — wire your local Claude Code / Codex / Cowork
+ * to a DEPLOYED agent-native app using a browser device-code flow. No token
+ * copying: open the verification URL, approve in the browser, and the minted
+ * HTTP MCP server entry is written into your client config(s) idempotently.
+ *
+ *   agent-native connect <url> [--client all|claude-code|claude-code-cli|
+ *                               codex|cowork] [--scope user|project]
+ *                               [--name <serverName>]
+ *   agent-native connect <url> --token <token>   (no-browser fallback)
+ *   agent-native connect --all  [--client ...]   (every first-party app)
+ *
+ * Server contract (implemented by another agent on `<url>`):
+ *   POST <url>/_agent-native/mcp/connect/device/start  (no auth)
+ *     body { client?, app? }
+ *     → { device_code, user_code, verification_uri,
+ *         verification_uri_complete, interval, expires_in }
+ *   POST <url>/_agent-native/mcp/connect/device/poll   (no auth)
+ *     body { device_code }
+ *     → { status: "pending" }
+ *     | { status: "approved", token, mcpUrl, serverName, mcpServerEntry }
+ *     | { status: "expired" }
+ *     | { status: "consumed" }
+ *     | { status: "error" | "not_found", message? }
+ *
+ * Node-only CLI module. No new npm deps (Node built-ins + global fetch only).
+ */
+import { ClientId } from "./mcp-config-writers.js";
+export interface ParsedConnectArgs {
+    /** Positional URL (the deployed app origin). Undefined for `--all`. */
+    url?: string;
+    /** all | claude-code | claude-code-cli | codex | cowork (default "all"). */
+    client: string;
+    /** user | project (default "user"). */
+    scope: string;
+    /** Override the minted MCP server name. */
+    name?: string;
+    /** No-browser fallback: skip device flow, use this token directly. */
+    token?: string;
+    /** Connect every first-party hosted app. */
+    all: boolean;
+}
+export declare function parseConnectArgs(argv: string[]): ParsedConnectArgs;
+/**
+ * Normalize a user-supplied app URL: trim, require http/https, strip the
+ * trailing slash. Throws a friendly Error otherwise.
+ */
+export declare function normalizeUrl(raw: string): string;
+/** Resolve the requested clients list. "all" → every supported client. */
+export declare function resolveClients(client: string): ClientId[];
+/** Injectable hooks so the poll state machine is unit-testable. */
+export interface ConnectDeps {
+    /** Defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+    /** Sleep between polls (ms). Defaults to real setTimeout. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Open the verification URL. Defaults to the platform browser opener. */
+    openBrowser?: (url: string) => void;
+    /** Override "now" for the expiry cap (ms epoch). Defaults to Date.now. */
+    now?: () => number;
+}
+/**
+ * Run the device-code flow against `baseUrl` and return the approved grant.
+ * Resolves with `null` (and prints a clear message) on expired/consumed or
+ * other terminal failure — the caller maps that to a non-zero exit.
+ */
+export declare function runDeviceFlow(baseUrl: string, appSlug: string, clientArg: string, deps?: ConnectDeps): Promise<{
+    token: string;
+    mcpUrl: string;
+    serverName: string;
+} | null>;
+/**
+ * Write the HTTP MCP entry into every requested client config idempotently.
+ * Returns the list of files written so the caller can print them.
+ */
+export declare function writeConfigs(clients: ClientId[], serverName: string, mcpUrl: string, token: string, scope: string, baseDir?: string): {
+    client: ClientId;
+    file: string;
+}[];
+/** Hosted first-party apps: visible (non-hidden) templates with a prodUrl. */
+export declare function hostedApps(): {
+    name: string;
+    url: string;
+}[];
+/**
+ * `agent-native connect` entry point. `deps` is injectable for tests; the
+ * dispatcher in index.ts calls it with just `args`.
+ *
+ * Sets `process.exitCode = 1` on failure (so the process exits non-zero
+ * once the event loop drains) rather than calling `process.exit`, keeping
+ * the function testable — same pattern as `audit-agent-web`.
+ */
+export declare function runConnect(args: string[], deps?: ConnectDeps): Promise<void>;
+//# sourceMappingURL=connect.d.ts.map

package/dist/cli/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/cli/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,OAAO,EAEL,QAAQ,EAET,MAAM,yBAAyB,CAAC;AAkBjC,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,OAAO,CAAC;CACd;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAsBlE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAmChD;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAOzD;AAuED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AA4CD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAkHvE;AAWD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,QAAQ,EAAE,EACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,MAAyB,GACjC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CActC;AAmDD,8EAA8E;AAC9E,wBAAgB,UAAU,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,CAI5D;AA8DD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CA6Bf"}