@agent-native/core 0.221.0-same-host-mcp-20261027-20261027081850 → 0.221.0

package/dist/a2a/server.js

@@ -13,7 +13,7 @@ import { readDeployCredentialEnv } from "../server/credential-provider.js";
 import { getH3App } from "../server/framework-request-handler.js";
 import { publicFrameworkPath } from "../server/framework-route-prefix.js";
 import { readBody } from "../server/h3-helpers.js";
-import { isSameOriginRequest } from "../server/request-origin.js";
+import { hasSameOriginBrowserEvidence } from "../server/request-origin.js";
 import { generateAgentCard } from "./agent-card.js";
 import { addAgentProfileExamples } from "./app-profile.js";
 import { canonicalA2AAudience } from "./audience.js";
@@ -577,8 +577,8 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
             setResponseStatus(event, 404);
             return { error: "Approval not found" };
         }
-        const { getSession } = await import("../server/auth.js");
-        const session = await getSession(event);
+        const { getBrowserCookieSession } = await import("../server/auth.js");
+        const session = await getBrowserCookieSession(event);
         if (!session?.email) {
             setResponseStatus(event, 401);
             return { error: "Sign in to review this approval" };
@@ -613,7 +613,7 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
         }
-        if (!isSameOriginRequest(event)) {
+        if (!hasSameOriginBrowserEvidence(event)) {
             setResponseStatus(event, 403);
             return { error: "Cross-origin approval denied" };
         }

package/dist/a2a/task-lifecycle.d.ts

@@ -1,20 +1,20 @@
-import { type Machine } from "../state-machine/index.js";
+import { type SqlFragment } from "../db/sql.js";
 import type { TaskState } from "./types.js";
-export declare const a2aTaskMachine: Machine<"canceled" | "completed" | "failed" | "input-required" | "processing" | "submitted" | "working", "cancel" | "claimForProcessing" | "completeApproval" | "completeProcessing" | "failApproval" | "failProcessing" | "failStale" | "failStuckProcessing" | "failStuckQueued" | "overwriteAsCanceled" | "overwriteAsCompleted" | "overwriteAsFailed" | "overwriteAsInputRequired" | "overwriteAsProcessing" | "overwriteAsSubmitted" | "overwriteAsWorking" | "requireInput" | "resumeAfterApproval" | "retryStuck">;
-export declare const a2aApprovalMachine: Machine<"completed" | "failed" | "pending" | "processing", "claim" | "complete" | "fail" | "reclaim">;
+export declare const a2aTaskMachine: import("../state-machine/index.js").SqlMachine<"canceled" | "completed" | "failed" | "input-required" | "processing" | "submitted" | "working", "cancel" | "claimForProcessing" | "completeApproval" | "completeProcessing" | "failApproval" | "failProcessing" | "failStale" | "failStuckProcessing" | "failStuckQueued" | "overwriteAsCanceled" | "overwriteAsCompleted" | "overwriteAsFailed" | "overwriteAsInputRequired" | "overwriteAsProcessing" | "overwriteAsSubmitted" | "overwriteAsWorking" | "requireInput" | "resumeAfterApproval" | "retryStuck">;
+export declare const a2aApprovalMachine: import("../state-machine/index.js").SqlMachine<"completed" | "failed" | "pending" | "processing", "claim" | "complete" | "fail" | "reclaim">;
 export type A2ATaskStatus = (typeof a2aTaskMachine.states)[number];
 export type A2ATaskEvent = (typeof a2aTaskMachine.events)[number];
 export type A2AApprovalStatus = (typeof a2aApprovalMachine.states)[number];
 export type A2AApprovalEvent = (typeof a2aApprovalMachine.events)[number];
 type Mutual<A, B> = [A] extends [B] ? ([B] extends [A] ? true : false) : false;
 export declare const taskStatesMatchTaskState: Mutual<A2ATaskStatus, TaskState>;
-/** `'a', 'b'` for an event's source states, in the order the SQL lists them. */
-export declare function taskIn(event: A2ATaskEvent): string;
-/** `'x'` for the state an event lands in. */
-export declare function taskTarget(event: A2ATaskEvent): string;
-/** `'x'` for one state, for single-state WHERE and SELECT predicates. */
-export declare function taskSql(state: A2ATaskStatus): string;
-export declare function approvalIn(event: A2AApprovalEvent): string;
-export declare function approvalTarget(event: A2AApprovalEvent): string;
-export declare function approvalSql(state: A2AApprovalStatus): string;
+/** Bound source states for an event's `IN` predicate. */
+export declare function taskIn(event: A2ATaskEvent): SqlFragment;
+/** Bound state value for the state an event lands in. */
+export declare function taskTarget(event: A2ATaskEvent): SqlFragment;
+/** Bound state value for single-state WHERE and SELECT predicates. */
+export declare function taskSql(state: A2ATaskStatus): SqlFragment;
+export declare function approvalIn(event: A2AApprovalEvent): SqlFragment;
+export declare function approvalTarget(event: A2AApprovalEvent): SqlFragment;
+export declare function approvalSql(state: A2AApprovalStatus): SqlFragment;
 export {};

package/dist/a2a/task-lifecycle.js

@@ -1,3 +1,4 @@
+import { sql } from "../db/sql.js";
 import { defineMachine } from "../state-machine/index.js";
 /**
  * Lifecycles of `a2a_tasks.status_state` and `a2a_approvals.status`.
@@ -95,27 +96,24 @@ function targetOf(machine, event) {
     }
     return machine.transition(from, event);
 }
-/** `'a', 'b'` for an event's source states, in the order the SQL lists them. */
+/** Bound source states for an event's `IN` predicate. */
 export function taskIn(event) {
-    return a2aTaskMachine.sqlStateList(event);
+    return a2aTaskMachine.sqlIn(event);
 }
-/** `'x'` for the state an event lands in. */
+/** Bound state value for the state an event lands in. */
 export function taskTarget(event) {
-    return sqlLiteral(a2aTaskMachine, targetOf(a2aTaskMachine, event));
+    return sql `${sql.value(targetOf(a2aTaskMachine, event))}`;
 }
-/** `'x'` for one state, for single-state WHERE and SELECT predicates. */
+/** Bound state value for single-state WHERE and SELECT predicates. */
 export function taskSql(state) {
-    return sqlLiteral(a2aTaskMachine, state);
+    return sql `${sql.value(a2aTaskMachine.parseState(state))}`;
 }
 export function approvalIn(event) {
-    return a2aApprovalMachine.sqlStateList(event);
+    return a2aApprovalMachine.sqlIn(event);
 }
 export function approvalTarget(event) {
-    return sqlLiteral(a2aApprovalMachine, targetOf(a2aApprovalMachine, event));
+    return sql `${sql.value(targetOf(a2aApprovalMachine, event))}`;
 }
 export function approvalSql(state) {
-    return sqlLiteral(a2aApprovalMachine, state);
-}
-function sqlLiteral(machine, state) {
-    return `'${machine.parseState(state)}'`;
+    return sql `${sql.value(a2aApprovalMachine.parseState(state))}`;
 }

package/dist/a2a/task-store.js

@@ -2,6 +2,7 @@ import crypto from "crypto";
 import { currentExecutionFence, withFencedExecutionWrite, } from "../agent/execution-fence.js";
 import { getDbExec } from "../db/client.js";
 import { ensureTableExists, ensureColumnExists, ensureIndexExists, } from "../db/ddl-guard.js";
+import { sql } from "../db/sql.js";
 import { defineStore } from "../db/store-registry.js";
 import { assertA2APersistablePayload } from "./persistence-safety.js";
 import { a2aApprovalMachine, a2aTaskMachine, approvalSql, approvalTarget, taskIn, taskSql, taskTarget, } from "./task-lifecycle.js";
@@ -127,22 +128,7 @@ export async function createA2AApproval(input) {
     const id = crypto.randomUUID();
     const now = Date.now();
     const expiresAt = now + (input.ttlMs ?? 15 * 60_000);
-    await withFencedExecutionWrite((tx) => tx.execute({
-        sql: `INSERT INTO a2a_approvals (id, task_id, owner_email, org_id, tool_name, tool_input, approval_key, call_id, status, expires_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ${approvalSql(a2aApprovalMachine.initial)}, ?, ?, ?)`,
-        args: [
-            id,
-            input.taskId,
-            input.ownerEmail,
-            input.orgId ?? null,
-            input.tool,
-            JSON.stringify(input.toolInput ?? {}),
-            input.approvalKey,
-            input.callId,
-            expiresAt,
-            now,
-            now,
-        ],
-    }), { threadId: a2aTaskLeaseThreadId(input.taskId), turnId: input.taskId });
+    await withFencedExecutionWrite((tx) => tx.execute(sql `INSERT INTO a2a_approvals (id, task_id, owner_email, org_id, tool_name, tool_input, approval_key, call_id, status, expires_at, created_at, updated_at) VALUES (${sql.value(id)}, ${sql.value(input.taskId)}, ${sql.value(input.ownerEmail)}, ${sql.value(input.orgId ?? null)}, ${sql.value(input.tool)}, ${sql.value(JSON.stringify(input.toolInput ?? {}))}, ${sql.value(input.approvalKey)}, ${sql.value(input.callId)}, ${approvalSql(a2aApprovalMachine.initial)}, ${sql.value(expiresAt)}, ${sql.value(now)}, ${sql.value(now)})`), { threadId: a2aTaskLeaseThreadId(input.taskId), turnId: input.taskId });
     return {
         id,
         taskId: input.taskId,
@@ -180,16 +166,10 @@ export async function claimA2AApproval(id, ownerEmail, orgId) {
     }
     try {
         return await withFencedExecutionWrite(async (tx) => {
-            const approvalUpdate = await tx.execute({
-                sql: `UPDATE a2a_approvals SET status = ${approvalTarget("claim")}, updated_at = ? WHERE id = ? AND owner_email = ? AND ((status = ${approvalSql("pending")} AND expires_at > ?) OR status = ${approvalSql("processing")}) AND (org_id IS NULL OR org_id = ?)`,
-                args: [now, id, ownerEmail, now, orgId ?? null],
-            });
+            const approvalUpdate = await tx.execute(sql `UPDATE a2a_approvals SET status = ${approvalTarget("claim")}, updated_at = ${sql.value(now)} WHERE id = ${sql.value(id)} AND owner_email = ${sql.value(ownerEmail)} AND ((status = ${approvalSql("pending")} AND expires_at > ${sql.value(now)}) OR status = ${approvalSql("processing")}) AND (org_id IS NULL OR org_id = ${sql.value(orgId ?? null)})`);
             if (getAffectedRowCount(approvalUpdate) === 0)
                 throw new ClaimRejected();
-            const { rows } = await tx.execute({
-                sql: `SELECT * FROM a2a_approvals WHERE id = ? AND owner_email = ? AND status = ${approvalSql("processing")}`,
-                args: [id, ownerEmail],
-            });
+            const { rows } = await tx.execute(sql `SELECT * FROM a2a_approvals WHERE id = ${sql.value(id)} AND owner_email = ${sql.value(ownerEmail)} AND status = ${approvalSql("processing")}`);
             if (!rows[0])
                 throw new ClaimRejected();
             const approval = approvalFromRow(rows[0]);
@@ -198,16 +178,7 @@ export async function claimA2AApproval(id, ownerEmail, orgId) {
                 role: "agent",
                 parts: [{ type: "text", text: "Approved action is running." }],
             };
-            const taskUpdate = await tx.execute({
-                sql: `UPDATE a2a_tasks SET status_state = ${taskTarget("resumeAfterApproval")}, status_message = ?, status_timestamp = ?, updated_at = ? WHERE id = ? AND owner_email = ? AND status_state IN (${taskIn("resumeAfterApproval")})`,
-                args: [
-                    JSON.stringify(runningMessage),
-                    timestamp,
-                    now,
-                    approval.taskId,
-                    ownerEmail,
-                ],
-            });
+            const taskUpdate = await tx.execute(sql `UPDATE a2a_tasks SET status_state = ${taskTarget("resumeAfterApproval")}, status_message = ${sql.value(JSON.stringify(runningMessage))}, status_timestamp = ${sql.value(timestamp)}, updated_at = ${sql.value(now)} WHERE id = ${sql.value(approval.taskId)} AND owner_email = ${sql.value(ownerEmail)} AND status_state IN ${taskIn("resumeAfterApproval")}`);
             if (getAffectedRowCount(taskUpdate) === 0)
                 throw new ClaimRejected();
             return approval;
@@ -232,10 +203,7 @@ export async function settleA2AApproval(id, status, resultText) {
     }
     await ensureTable();
     const client = getDbExec();
-    const { rows: approvalRows } = await client.execute({
-        sql: `SELECT task_id FROM a2a_approvals WHERE id = ? AND status = ${approvalSql("processing")}`,
-        args: [id],
-    });
+    const { rows: approvalRows } = await client.execute(sql `SELECT task_id FROM a2a_approvals WHERE id = ${sql.value(id)} AND status = ${approvalSql("processing")}`);
     if (!approvalRows[0])
         throw new Error("Approval is not processing");
     const taskId = String(approvalRows[0].task_id);
@@ -246,17 +214,11 @@ export async function settleA2AApproval(id, status, resultText) {
         parts: [{ type: "text", text: settledText }],
     };
     await withFencedExecutionWrite(async (tx) => {
-        const { rows } = await tx.execute({
-            sql: `SELECT task_id FROM a2a_approvals WHERE id = ? AND status = ${approvalSql("processing")}`,
-            args: [id],
-        });
+        const { rows } = await tx.execute(sql `SELECT task_id FROM a2a_approvals WHERE id = ${sql.value(id)} AND status = ${approvalSql("processing")}`);
         if (!rows[0])
             throw new Error("Approval is not processing");
         const taskId = String(rows[0].task_id);
-        const { rows: taskRows } = await tx.execute({
-            sql: `SELECT history FROM a2a_tasks WHERE id = ? AND status_state = ${taskSql("working")}`,
-            args: [taskId],
-        });
+        const { rows: taskRows } = await tx.execute(sql `SELECT history FROM a2a_tasks WHERE id = ${sql.value(taskId)} AND status_state = ${taskSql("working")}`);
         if (!taskRows[0]) {
             throw new Error("Approval task is no longer awaiting settlement");
         }
@@ -264,24 +226,11 @@ export async function settleA2AApproval(id, status, resultText) {
         history.push(message);
         assertA2APersistablePayload(history, "A2A task history");
         const timestamp = new Date(now).toISOString();
-        const taskUpdate = await tx.execute({
-            sql: `UPDATE a2a_tasks SET status_state = ?, status_message = ?, status_timestamp = ?, history = ?, updated_at = ? WHERE id = ? AND status_state = ${taskSql("working")}`,
-            args: [
-                settledStatus,
-                JSON.stringify(message),
-                timestamp,
-                JSON.stringify(history),
-                now,
-                taskId,
-            ],
-        });
+        const taskUpdate = await tx.execute(sql `UPDATE a2a_tasks SET status_state = ${sql.value(settledStatus)}, status_message = ${sql.value(JSON.stringify(message))}, status_timestamp = ${sql.value(timestamp)}, history = ${sql.value(JSON.stringify(history))}, updated_at = ${sql.value(now)} WHERE id = ${sql.value(taskId)} AND status_state = ${taskSql("working")}`);
         if (getAffectedRowCount(taskUpdate) === 0) {
             throw new Error("Approval task settlement lost its state claim");
         }
-        const approvalUpdate = await tx.execute({
-            sql: `UPDATE a2a_approvals SET status = ?, result = ?, updated_at = ? WHERE id = ? AND status = ${approvalSql("processing")}`,
-            args: [settledStatus, settledText, now, id],
-        });
+        const approvalUpdate = await tx.execute(sql `UPDATE a2a_approvals SET status = ${sql.value(settledStatus)}, result = ${sql.value(settledText)}, updated_at = ${sql.value(now)} WHERE id = ${sql.value(id)} AND status = ${approvalSql("processing")}`);
         if (getAffectedRowCount(approvalUpdate) === 0) {
             throw new Error("Approval settlement lost its state claim");
         }
@@ -299,10 +248,7 @@ export async function pauseProcessingA2ATask(id, message) {
     assertA2APersistablePayload(message, "A2A task status message");
     await ensureTable();
     return withFencedExecutionWrite(async (tx) => {
-        const { rows } = await tx.execute({
-            sql: `SELECT * FROM a2a_tasks WHERE id = ? AND status_state = ${taskSql("processing")}`,
-            args: [id],
-        });
+        const { rows } = await tx.execute(sql `SELECT * FROM a2a_tasks WHERE id = ${sql.value(id)} AND status_state = ${taskSql("processing")}`);
         if (!rows[0])
             return null;
         const task = taskFromRow(rows[0]);
@@ -310,16 +256,7 @@ export async function pauseProcessingA2ATask(id, message) {
         assertA2APersistablePayload(task.history, "A2A task history");
         const now = Date.now();
         const timestamp = new Date(now).toISOString();
-        const result = await tx.execute({
-            sql: `UPDATE a2a_tasks SET status_state = ${taskTarget("requireInput")}, status_message = ?, status_timestamp = ?, history = ?, updated_at = ? WHERE id = ? AND status_state = ${taskSql("processing")}`,
-            args: [
-                JSON.stringify(message),
-                timestamp,
-                JSON.stringify(task.history ?? []),
-                now,
-                id,
-            ],
-        });
+        const result = await tx.execute(sql `UPDATE a2a_tasks SET status_state = ${taskTarget("requireInput")}, status_message = ${sql.value(JSON.stringify(message))}, status_timestamp = ${sql.value(timestamp)}, history = ${sql.value(JSON.stringify(task.history ?? []))}, updated_at = ${sql.value(now)} WHERE id = ${sql.value(id)} AND status_state = ${taskSql("processing")}`);
         if (getAffectedRowCount(result) === 0)
             return null;
         task.status = { state: "input-required", message, timestamp };
@@ -432,10 +369,7 @@ export async function createOrReuseTask(message, contextId, metadata, ownerEmail
         const reused = task.id !== id;
         if (reused &&
             (task.status.state === "failed" || task.status.state === "canceled")) {
-            await client.execute({
-                sql: `UPDATE a2a_tasks SET idempotency_key = NULL, updated_at = ? WHERE id = ? AND idempotency_key = ? AND status_state IN (${taskSql("failed")}, ${taskSql("canceled")})`,
-                args: [Date.now(), task.id, idempotencyKey],
-            });
+            await client.execute(sql `UPDATE a2a_tasks SET idempotency_key = NULL, updated_at = ${sql.value(Date.now())} WHERE id = ${sql.value(task.id)} AND idempotency_key = ${sql.value(idempotencyKey)} AND status_state IN (${taskSql("failed")}, ${taskSql("canceled")})`);
             continue;
         }
         return { task, reused };
@@ -444,11 +378,8 @@ export async function createOrReuseTask(message, contextId, metadata, ownerEmail
 }
 function taskAccessPredicate(scope) {
     if (!scope)
-        return { sql: "", args: [] };
-    return {
-        sql: " AND LOWER(COALESCE(owner_email, '')) = LOWER(?) AND LOWER(COALESCE(owner_scope, '')) = LOWER(?)",
-        args: [scope.ownerEmail, scope.ownerScope ?? ""],
-    };
+        return sql ``;
+    return sql ` AND LOWER(COALESCE(owner_email, '')) = LOWER(${sql.value(scope.ownerEmail)}) AND LOWER(COALESCE(owner_scope, '')) = LOWER(${sql.value(scope.ownerScope ?? "")})`;
 }
 export async function getTaskOwner(id) {
     return (await getTaskOwnership(id)).ownerEmail;
@@ -474,16 +405,13 @@ export async function claimA2ATaskForProcessing(id) {
     const now = Date.now();
     const timestamp = new Date().toISOString();
     return withFencedExecutionWrite(async (tx) => {
-        const { rows } = await tx.execute({
-            sql: `UPDATE a2a_tasks
+        const { rows } = await tx.execute(sql `UPDATE a2a_tasks
             SET status_state = ${taskTarget("claimForProcessing")},
-                status_timestamp = ?,
-                updated_at = ?
-          WHERE id = ?
-            AND status_state IN (${taskIn("claimForProcessing")})
-          RETURNING *`,
-            args: [timestamp, now, id],
-        });
+                status_timestamp = ${sql.value(timestamp)},
+                updated_at = ${sql.value(now)}
+          WHERE id = ${sql.value(id)}
+            AND status_state IN ${taskIn("claimForProcessing")}
+          RETURNING *`);
         return rows.length > 0 ? taskFromRow(rows[0]) : null;
     }, { threadId: a2aTaskLeaseThreadId(id), turnId: id });
 }
@@ -509,26 +437,20 @@ export async function touchQueuedA2ATaskDispatch(id) {
     await ensureTable();
     const client = getDbExec();
     const now = Date.now();
-    const result = await client.execute({
-        sql: `UPDATE a2a_tasks
-            SET updated_at = ?
-          WHERE id = ?
-            AND status_state IN (${taskIn("claimForProcessing")})`,
-        args: [now, id],
-    });
+    const result = await client.execute(sql `UPDATE a2a_tasks
+            SET updated_at = ${sql.value(now)}
+          WHERE id = ${sql.value(id)}
+            AND status_state IN ${taskIn("claimForProcessing")}`);
     const affected = getAffectedRowCount(result);
     return affected !== 0;
 }
 export async function touchProcessingA2ATask(id) {
     await ensureTable();
     const now = Date.now();
-    const result = await withFencedExecutionWrite((tx) => tx.execute({
-        sql: `UPDATE a2a_tasks
-            SET updated_at = ?
-          WHERE id = ?
-            AND status_state = ${taskSql("processing")}`,
-        args: [now, id],
-    }), { threadId: a2aTaskLeaseThreadId(id), turnId: id });
+    const result = await withFencedExecutionWrite((tx) => tx.execute(sql `UPDATE a2a_tasks
+            SET updated_at = ${sql.value(now)}
+          WHERE id = ${sql.value(id)}
+            AND status_state = ${taskSql("processing")}`), { threadId: a2aTaskLeaseThreadId(id), turnId: id });
     const affected = getAffectedRowCount(result);
     return affected !== 0;
 }
@@ -536,16 +458,13 @@ export async function resetStuckA2ATaskForRetry(id, processingCutoff) {
     await ensureTable();
     const now = Date.now();
     const timestamp = new Date().toISOString();
-    const result = await withFencedExecutionWrite((tx) => tx.execute({
-        sql: `UPDATE a2a_tasks
+    const result = await withFencedExecutionWrite((tx) => tx.execute(sql `UPDATE a2a_tasks
             SET status_state = ${taskTarget("retryStuck")},
-                status_timestamp = ?,
-                updated_at = ?
-          WHERE id = ?
+                status_timestamp = ${sql.value(timestamp)},
+                updated_at = ${sql.value(now)}
+          WHERE id = ${sql.value(id)}
             AND status_state = ${taskSql("processing")}
-            AND updated_at <= ?`,
-        args: [timestamp, now, id, processingCutoff],
-    }), { threadId: a2aTaskLeaseThreadId(id), turnId: id });
+            AND updated_at <= ${sql.value(processingCutoff)}`), { threadId: a2aTaskLeaseThreadId(id), turnId: id });
     const affected = getAffectedRowCount(result);
     return affected !== 0;
 }
@@ -562,31 +481,19 @@ export async function failStuckA2ATask(id, processingCutoff, reason, createdAtCu
         parts: [{ type: "text", text: reason }],
     };
     const ageCondition = createdAtCutoff !== undefined
-        ? `AND (updated_at <= ? OR created_at <= ?)`
-        : `AND updated_at <= ?`;
+        ? sql `AND (updated_at <= ${sql.value(processingCutoff)} OR created_at <= ${sql.value(createdAtCutoff)})`
+        : sql `AND updated_at <= ${sql.value(processingCutoff)}`;
     return withDbTransaction(client, async (tx) => {
         const leaseThreadId = a2aTaskLeaseThreadId(id);
         await lockTaskExecutionLease(tx, leaseThreadId, id);
-        const result = await tx.execute({
-            sql: `UPDATE a2a_tasks
+        const result = await tx.execute(sql `UPDATE a2a_tasks
               SET status_state = ${taskTarget("failStuckProcessing")},
-                  status_message = ?,
-                  status_timestamp = ?,
-                  updated_at = ?
-            WHERE id = ?
+                  status_message = ${sql.value(JSON.stringify(message))},
+                  status_timestamp = ${sql.value(timestamp)},
+                  updated_at = ${sql.value(now)}
+            WHERE id = ${sql.value(id)}
               AND status_state = ${taskSql("processing")}
-              ${ageCondition}`,
-            args: createdAtCutoff !== undefined
-                ? [
-                    JSON.stringify(message),
-                    timestamp,
-                    now,
-                    id,
-                    processingCutoff,
-                    createdAtCutoff,
-                ]
-                : [JSON.stringify(message), timestamp, now, id, processingCutoff],
-        });
+              ${ageCondition}`);
         const affected = getAffectedRowCount(result);
         if (affected === 1) {
             await revokeTaskExecutionLease(tx, leaseThreadId, id);
@@ -609,17 +516,14 @@ export async function failStuckQueuedA2ATask(id, createdAtCutoff, reason) {
     return withDbTransaction(client, async (tx) => {
         const leaseThreadId = a2aTaskLeaseThreadId(id);
         await lockTaskExecutionLease(tx, leaseThreadId, id);
-        const result = await tx.execute({
-            sql: `UPDATE a2a_tasks
+        const result = await tx.execute(sql `UPDATE a2a_tasks
               SET status_state = ${taskTarget("failStuckQueued")},
-                  status_message = ?,
-                  status_timestamp = ?,
-                  updated_at = ?
-            WHERE id = ?
-              AND status_state IN (${taskIn("failStuckQueued")})
-              AND created_at <= ?`,
-            args: [JSON.stringify(message), timestamp, now, id, createdAtCutoff],
-        });
+                  status_message = ${sql.value(JSON.stringify(message))},
+                  status_timestamp = ${sql.value(timestamp)},
+                  updated_at = ${sql.value(now)}
+            WHERE id = ${sql.value(id)}
+              AND status_state IN ${taskIn("failStuckQueued")}
+              AND created_at <= ${sql.value(createdAtCutoff)}`);
         const affected = getAffectedRowCount(result);
         if (affected === 1) {
             await revokeTaskExecutionLease(tx, leaseThreadId, id);
@@ -644,25 +548,15 @@ export async function failStaleA2ATask(id, staleBefore, reason, errorCode) {
     return withDbTransaction(client, async (tx) => {
         const leaseThreadId = a2aTaskLeaseThreadId(id);
         await lockTaskExecutionLease(tx, leaseThreadId, id);
-        const result = await tx.execute({
-            sql: `UPDATE a2a_tasks
+        const result = await tx.execute(sql `UPDATE a2a_tasks
               SET status_state = ${taskTarget("failStale")},
-                  status_message = ?,
-                  status_timestamp = ?,
-                  updated_at = ?
-            WHERE id = ?
-              AND status_state IN (${taskIn("failStale")})
-              AND created_at < ?
-              AND updated_at < ?`,
-            args: [
-                JSON.stringify(message),
-                timestamp,
-                now,
-                id,
-                staleBefore,
-                staleBefore,
-            ],
-        });
+                  status_message = ${sql.value(JSON.stringify(message))},
+                  status_timestamp = ${sql.value(timestamp)},
+                  updated_at = ${sql.value(now)}
+            WHERE id = ${sql.value(id)}
+              AND status_state IN ${taskIn("failStale")}
+              AND created_at < ${sql.value(staleBefore)}
+              AND updated_at < ${sql.value(staleBefore)}`);
         const affected = getAffectedRowCount(result);
         if (affected === 1) {
             await revokeTaskExecutionLease(tx, leaseThreadId, id);
@@ -674,10 +568,7 @@ export async function getTask(id, accessScope) {
     await ensureTable();
     const client = getDbExec();
     const predicate = taskAccessPredicate(accessScope);
-    const { rows } = await client.execute({
-        sql: `SELECT * FROM a2a_tasks WHERE id = ?${predicate.sql}`,
-        args: [id, ...predicate.args],
-    });
+    const { rows } = await client.execute(sql `SELECT * FROM a2a_tasks WHERE id = ${sql.value(id)}${predicate}`);
     if (rows.length === 0)
         return null;
     return taskFromRow(rows[0]);
@@ -688,10 +579,7 @@ export async function updateTask(id, update, accessScope) {
     await ensureTable();
     const predicate = taskAccessPredicate(accessScope);
     return withFencedExecutionWrite(async (tx) => {
-        const { rows } = await tx.execute({
-            sql: `SELECT * FROM a2a_tasks WHERE id = ?${predicate.sql}`,
-            args: [id, ...predicate.args],
-        });
+        const { rows } = await tx.execute(sql `SELECT * FROM a2a_tasks WHERE id = ${sql.value(id)}${predicate}`);
         if (rows.length === 0)
             return null;
         const task = taskFromRow(rows[0]);
@@ -712,27 +600,12 @@ export async function updateTask(id, update, accessScope) {
         assertA2APersistablePayload(task.status.message, "A2A task status message");
         assertA2APersistablePayload(task.history, "A2A task history");
         assertA2APersistablePayload(task.artifacts, "A2A task artifacts");
-        const result = await tx.execute({
-            sql: `UPDATE a2a_tasks SET status_state = ?, status_message = ?, status_timestamp = ?, history = ?, artifacts = ?, updated_at = ? WHERE id = ?${predicate.sql} AND status_state <> ${taskSql("canceled")}`,
-            args: [
-                task.status.state,
-                task.status.message ? JSON.stringify(task.status.message) : null,
-                task.status.timestamp,
-                JSON.stringify(task.history),
-                JSON.stringify(task.artifacts),
-                now,
-                id,
-                ...predicate.args,
-            ],
-        });
+        const result = await tx.execute(sql `UPDATE a2a_tasks SET status_state = ${sql.value(task.status.state)}, status_message = ${sql.value(task.status.message ? JSON.stringify(task.status.message) : null)}, status_timestamp = ${sql.value(task.status.timestamp)}, history = ${sql.value(JSON.stringify(task.history))}, artifacts = ${sql.value(JSON.stringify(task.artifacts))}, updated_at = ${sql.value(now)} WHERE id = ${sql.value(id)}${predicate} AND status_state <> ${taskSql("canceled")}`);
         if (getAffectedRowCount(result) === 1)
             return task;
         // Zero rows: the task is missing, outside the access scope, or canceled.
         // Only a canceled row is a cancel win; the others stay null.
-        const { rows: current } = await tx.execute({
-            sql: `SELECT * FROM a2a_tasks WHERE id = ?${predicate.sql}`,
-            args: [id, ...predicate.args],
-        });
+        const { rows: current } = await tx.execute(sql `SELECT * FROM a2a_tasks WHERE id = ${sql.value(id)}${predicate}`);
         if (current[0]) {
             const stored = taskFromRow(current[0]);
             if (stored.status.state === "canceled") {
@@ -752,23 +625,17 @@ export async function cancelA2ATask(id, accessScope) {
     return withDbTransaction(client, async (tx) => {
         const leaseThreadId = a2aTaskLeaseThreadId(id);
         await lockTaskExecutionLease(tx, leaseThreadId, id);
-        const { rows } = await tx.execute({
-            sql: `SELECT * FROM a2a_tasks WHERE id = ?${predicate.sql} FOR UPDATE`,
-            args: [id, ...predicate.args],
-        });
+        const { rows } = await tx.execute(sql `SELECT * FROM a2a_tasks WHERE id = ${sql.value(id)}${predicate} FOR UPDATE`);
         if (!rows[0])
             return { status: "not_found" };
         // The row lock from FOR UPDATE means the guarded UPDATE below sees this
         // same state, so a zero-row update always means "not cancelable".
         const current = taskFromRow(rows[0]);
         const timestamp = new Date().toISOString();
-        const result = await tx.execute({
-            sql: `UPDATE a2a_tasks
-            SET status_state = ${taskTarget("cancel")}, status_timestamp = ?, updated_at = ?
-            WHERE id = ?${predicate.sql}
-              AND status_state IN (${taskIn("cancel")})`,
-            args: [timestamp, Date.now(), id, ...predicate.args],
-        });
+        const result = await tx.execute(sql `UPDATE a2a_tasks
+            SET status_state = ${taskTarget("cancel")}, status_timestamp = ${sql.value(timestamp)}, updated_at = ${sql.value(Date.now())}
+            WHERE id = ${sql.value(id)}${predicate}
+              AND status_state IN ${taskIn("cancel")}`);
         if (getAffectedRowCount(result) !== 1) {
             return { status: "not_cancelable", state: current.status.state };
         }
@@ -821,26 +688,15 @@ export async function settleProcessingA2ATask(id, update) {
         assertA2APersistablePayload(task.status.message, "A2A task status message");
         assertA2APersistablePayload(task.history, "A2A task history");
         assertA2APersistablePayload(task.artifacts, "A2A task artifacts");
-        const result = await tx.execute({
-            sql: `UPDATE a2a_tasks
-            SET status_state = ?,
-                status_message = ?,
-                status_timestamp = ?,
-                history = ?,
-                artifacts = ?,
-                updated_at = ?
-          WHERE id = ?
-            AND status_state = ${taskSql("processing")}`,
-            args: [
-                task.status.state,
-                task.status.message ? JSON.stringify(task.status.message) : null,
-                task.status.timestamp,
-                JSON.stringify(task.history),
-                JSON.stringify(task.artifacts),
-                now,
-                id,
-            ],
-        });
+        const result = await tx.execute(sql `UPDATE a2a_tasks
+            SET status_state = ${sql.value(task.status.state)},
+                status_message = ${sql.value(task.status.message ? JSON.stringify(task.status.message) : null)},
+                status_timestamp = ${sql.value(task.status.timestamp)},
+                history = ${sql.value(JSON.stringify(task.history))},
+                artifacts = ${sql.value(JSON.stringify(task.artifacts))},
+                updated_at = ${sql.value(now)}
+          WHERE id = ${sql.value(id)}
+            AND status_state = ${taskSql("processing")}`);
         const affected = getAffectedRowCount(result);
         if (affected === 0)
             return null;
@@ -852,15 +708,12 @@ export async function updateTaskStatusMessage(id, message) {
     await ensureTable();
     const now = Date.now();
     const timestamp = new Date().toISOString();
-    await withFencedExecutionWrite((tx) => tx.execute({
-        sql: `UPDATE a2a_tasks
-            SET status_message = ?,
-                status_timestamp = ?,
-                updated_at = ?
-          WHERE id = ?
-            AND status_state IN (${taskIn("failStale")})`,
-        args: [JSON.stringify(message), timestamp, now, id],
-    }), { threadId: a2aTaskLeaseThreadId(id), turnId: id });
+    await withFencedExecutionWrite((tx) => tx.execute(sql `UPDATE a2a_tasks
+            SET status_message = ${sql.value(JSON.stringify(message))},
+                status_timestamp = ${sql.value(timestamp)},
+                updated_at = ${sql.value(now)}
+          WHERE id = ${sql.value(id)}
+            AND status_state IN ${taskIn("failStale")}`), { threadId: a2aTaskLeaseThreadId(id), turnId: id });
 }
 export async function listTasksPage(contextId, options = {}) {
     await ensureTable();

package/dist/action-caller.d.ts

@@ -0,0 +1,3 @@
+import type { ActionRunContext } from "./action.js";
+/** Classify provenance for approval policy; this does not authenticate a caller. */
+export declare function isOutsideAgentCall(ctx?: Pick<ActionRunContext, "caller" | "networkProtocol" | "automation">): boolean;

package/dist/action-caller.js

@@ -0,0 +1,8 @@
+/** Classify provenance for approval policy; this does not authenticate a caller. */
+export function isOutsideAgentCall(ctx) {
+    // CLI defaults to outside because coding agents drive it; Alice's decision is pending.
+    // Automation has no trusted origin in ctx yet; #8070's mcpManaged is job frontmatter.
+    return (ctx?.networkProtocol !== undefined ||
+        ctx?.automation !== undefined ||
+        (ctx?.caller !== "frontend" && ctx?.caller !== "tool"));
+}

package/dist/action.d.ts

@@ -369,6 +369,7 @@ export interface ActionMcpAppResourceConfig {
     title?: string;
     description?: string;
     html: string | ActionMcpAppHtmlBuilder;
+    requiresEmbedSession?: boolean;
     mimeType?: typeof MCP_APP_MIME_TYPE;
     _meta?: Record<string, unknown>;
     csp?: ActionMcpAppCsp | ActionMcpAppCspBuilder;