@agent-native/core 0.7.49 → 0.7.51

package/dist/a2a/agent-card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-card.d.ts","sourceRoot":"","sources":["../../src/a2a/agent-card.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,GACd,SAAS,CAqCX"}
+{"version":3,"file":"agent-card.d.ts","sourceRoot":"","sources":["../../src/a2a/agent-card.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,GACd,SAAS,CA6CX"}

package/dist/a2a/agent-card.js

@@ -1,4 +1,5 @@
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
+import { shouldAdvertiseJwtA2AAuth } from "./auth-policy.js";
 export function generateAgentCard(config, baseUrl) {
     const scopedUrl = withConfiguredAppBasePath(baseUrl);
     const card = {
@@ -14,25 +15,29 @@ export function generateAgentCard(config, baseUrl) {
         },
         skills: config.skills,
     };
-    // Advertise JWT-based A2A identity when A2A_SECRET is configured
-    if (process.env.A2A_SECRET) {
-        card.securitySchemes = {
-            jwtBearer: {
-                type: "http",
-                scheme: "bearer",
-                bearerFormat: "JWT",
-            },
+    const securitySchemes = {};
+    const security = [];
+    // Hosted production deployments require JWT-capable A2A even before card
+    // generation can prove whether auth will use the shared A2A_SECRET or an
+    // org-scoped secret from SQL.
+    if (shouldAdvertiseJwtA2AAuth()) {
+        securitySchemes.jwtBearer = {
+            type: "http",
+            scheme: "bearer",
+            bearerFormat: "JWT",
         };
-        card.security = [{ jwtBearer: [] }];
+        security.push({ jwtBearer: [] });
     }
-    else if (config.apiKeyEnv) {
-        card.securitySchemes = {
-            apiKey: {
-                type: "http",
-                scheme: "bearer",
-            },
+    if (config.apiKeyEnv) {
+        securitySchemes.apiKey = {
+            type: "http",
+            scheme: "bearer",
         };
-        card.security = [{ apiKey: [] }];
+        security.push({ apiKey: [] });
+    }
+    if (security.length > 0) {
+        card.securitySchemes = securitySchemes;
+        card.security = security;
     }
     return card;
 }

package/dist/a2a/agent-card.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-card.js","sourceRoot":"","sources":["../../src/a2a/agent-card.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,MAAM,UAAU,iBAAiB,CAC/B,MAAiB,EACjB,OAAe;IAEf,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAc;QACtB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,OAAO;QAClC,eAAe,EAAE,KAAK;QACtB,YAAY,EAAE;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;YACpC,iBAAiB,EAAE,KAAK;YACxB,sBAAsB,EAAE,IAAI;SAC7B;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;IAEF,iEAAiE;IACjE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,eAAe,GAAG;YACrB,SAAS,EAAE;gBACT,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,QAAQ;gBAChB,YAAY,EAAE,KAAK;aACpB;SACF,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,eAAe,GAAG;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,QAAQ;aACjB;SACF,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type { A2AConfig, AgentCard } from \"./types.js\";\nimport { withConfiguredAppBasePath } from \"../server/app-base-path.js\";\n\nexport function generateAgentCard(\n  config: A2AConfig,\n  baseUrl: string,\n): AgentCard {\n  const scopedUrl = withConfiguredAppBasePath(baseUrl);\n  const card: AgentCard = {\n    name: config.name,\n    description: config.description,\n    url: scopedUrl,\n    version: config.version ?? \"1.0.0\",\n    protocolVersion: \"0.3\",\n    capabilities: {\n      streaming: config.streaming ?? false,\n      pushNotifications: false,\n      stateTransitionHistory: true,\n    },\n    skills: config.skills,\n  };\n\n  // Advertise JWT-based A2A identity when A2A_SECRET is configured\n  if (process.env.A2A_SECRET) {\n    card.securitySchemes = {\n      jwtBearer: {\n        type: \"http\",\n        scheme: \"bearer\",\n        bearerFormat: \"JWT\",\n      },\n    };\n    card.security = [{ jwtBearer: [] }];\n  } else if (config.apiKeyEnv) {\n    card.securitySchemes = {\n      apiKey: {\n        type: \"http\",\n        scheme: \"bearer\",\n      },\n    };\n    card.security = [{ apiKey: [] }];\n  }\n\n  return card;\n}\n"]}
+{"version":3,"file":"agent-card.js","sourceRoot":"","sources":["../../src/a2a/agent-card.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,MAAM,UAAU,iBAAiB,CAC/B,MAAiB,EACjB,OAAe;IAEf,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAc;QACtB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,OAAO;QAClC,eAAe,EAAE,KAAK;QACtB,YAAY,EAAE;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;YACpC,iBAAiB,EAAE,KAAK;YACxB,sBAAsB,EAAE,IAAI;SAC7B;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;IAEF,MAAM,eAAe,GAA8C,EAAE,CAAC;IACtE,MAAM,QAAQ,GAAuC,EAAE,CAAC;IAExD,yEAAyE;IACzE,yEAAyE;IACzE,8BAA8B;IAC9B,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAChC,eAAe,CAAC,SAAS,GAAG;YAC1B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,KAAK;SACpB,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,eAAe,CAAC,MAAM,GAAG;YACvB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,QAAQ;SACjB,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type { A2AConfig, AgentCard } from \"./types.js\";\nimport { withConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { shouldAdvertiseJwtA2AAuth } from \"./auth-policy.js\";\n\nexport function generateAgentCard(\n  config: A2AConfig,\n  baseUrl: string,\n): AgentCard {\n  const scopedUrl = withConfiguredAppBasePath(baseUrl);\n  const card: AgentCard = {\n    name: config.name,\n    description: config.description,\n    url: scopedUrl,\n    version: config.version ?? \"1.0.0\",\n    protocolVersion: \"0.3\",\n    capabilities: {\n      streaming: config.streaming ?? false,\n      pushNotifications: false,\n      stateTransitionHistory: true,\n    },\n    skills: config.skills,\n  };\n\n  const securitySchemes: NonNullable<AgentCard[\"securitySchemes\"]> = {};\n  const security: NonNullable<AgentCard[\"security\"]> = [];\n\n  // Hosted production deployments require JWT-capable A2A even before card\n  // generation can prove whether auth will use the shared A2A_SECRET or an\n  // org-scoped secret from SQL.\n  if (shouldAdvertiseJwtA2AAuth()) {\n    securitySchemes.jwtBearer = {\n      type: \"http\",\n      scheme: \"bearer\",\n      bearerFormat: \"JWT\",\n    };\n    security.push({ jwtBearer: [] });\n  }\n\n  if (config.apiKeyEnv) {\n    securitySchemes.apiKey = {\n      type: \"http\",\n      scheme: \"bearer\",\n    };\n    security.push({ apiKey: [] });\n  }\n\n  if (security.length > 0) {\n    card.securitySchemes = securitySchemes;\n    card.security = security;\n  }\n\n  return card;\n}\n"]}

package/dist/a2a/auth-policy.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A2A auth policy helpers shared by discovery, the JSON-RPC gate, and task
+ * handlers. Serverless providers do not always expose `NODE_ENV=production`
+ * consistently at runtime, so production-like A2A checks also look at the
+ * provider flags those platforms set in deployed functions.
+ */
+export declare function isA2AProductionRuntime(): boolean;
+export declare function hasConfiguredA2ASecret(): boolean;
+export declare function shouldAdvertiseJwtA2AAuth(): boolean;
+//# sourceMappingURL=auth-policy.d.ts.map

package/dist/a2a/auth-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.d.ts","sourceRoot":"","sources":["../../src/a2a/auth-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAkBhD;AAED,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD"}

package/dist/a2a/auth-policy.js

@@ -0,0 +1,34 @@
+/**
+ * A2A auth policy helpers shared by discovery, the JSON-RPC gate, and task
+ * handlers. Serverless providers do not always expose `NODE_ENV=production`
+ * consistently at runtime, so production-like A2A checks also look at the
+ * provider flags those platforms set in deployed functions.
+ */
+export function isA2AProductionRuntime() {
+    if (process.env.NODE_ENV === "production")
+        return true;
+    if (process.env.NETLIFY === "true" && process.env.NETLIFY_LOCAL !== "true") {
+        return true;
+    }
+    if (process.env.AWS_LAMBDA_FUNCTION_NAME &&
+        process.env.NETLIFY_LOCAL !== "true") {
+        return true;
+    }
+    if (process.env.CF_PAGES === "1")
+        return true;
+    if ("__cf_env" in globalThis)
+        return true;
+    if (process.env.VERCEL || process.env.VERCEL_ENV)
+        return true;
+    if (process.env.RENDER || process.env.FLY_APP_NAME || process.env.K_SERVICE) {
+        return true;
+    }
+    return false;
+}
+export function hasConfiguredA2ASecret() {
+    return !!process.env.A2A_SECRET?.trim();
+}
+export function shouldAdvertiseJwtA2AAuth() {
+    return hasConfiguredA2ASecret() || isA2AProductionRuntime();
+}
+//# sourceMappingURL=auth-policy.js.map

package/dist/a2a/auth-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.js","sourceRoot":"","sources":["../../src/a2a/auth-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,EACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,UAAU,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,sBAAsB,EAAE,IAAI,sBAAsB,EAAE,CAAC;AAC9D,CAAC","sourcesContent":["/**\n * A2A auth policy helpers shared by discovery, the JSON-RPC gate, and task\n * handlers. Serverless providers do not always expose `NODE_ENV=production`\n * consistently at runtime, so production-like A2A checks also look at the\n * provider flags those platforms set in deployed functions.\n */\nexport function isA2AProductionRuntime(): boolean {\n  if (process.env.NODE_ENV === \"production\") return true;\n  if (process.env.NETLIFY === \"true\" && process.env.NETLIFY_LOCAL !== \"true\") {\n    return true;\n  }\n  if (\n    process.env.AWS_LAMBDA_FUNCTION_NAME &&\n    process.env.NETLIFY_LOCAL !== \"true\"\n  ) {\n    return true;\n  }\n  if (process.env.CF_PAGES === \"1\") return true;\n  if (\"__cf_env\" in globalThis) return true;\n  if (process.env.VERCEL || process.env.VERCEL_ENV) return true;\n  if (process.env.RENDER || process.env.FLY_APP_NAME || process.env.K_SERVICE) {\n    return true;\n  }\n  return false;\n}\n\nexport function hasConfiguredA2ASecret(): boolean {\n  return !!process.env.A2A_SECRET?.trim();\n}\n\nexport function shouldAdvertiseJwtA2AAuth(): boolean {\n  return hasConfiguredA2ASecret() || isA2AProductionRuntime();\n}\n"]}

package/dist/a2a/client.d.ts

@@ -9,11 +9,15 @@ export declare class A2ATaskTimeoutError extends Error {
 /**
  * Sign a JWT for A2A cross-app identity verification.
  *
- * Uses A2A_SECRET as an HMAC key. The token contains the caller's email
- * as `sub`, so the receiving app can verify who's calling.
+ * Uses an org-level secret by default for direct org-secret workflows. Callers
+ * that are doing ordinary hosted cross-app delegation can set
+ * `preferGlobalSecret` so deployments with a shared A2A_SECRET don't depend on
+ * every app database having an identical org row. The token contains the
+ * caller's email as `sub`, so the receiving app can verify who's calling.
  */
 export declare function signA2AToken(email: string, orgDomain?: string, orgSecret?: string, options?: {
     expiresIn?: string | number;
+    preferGlobalSecret?: boolean;
 }): Promise<string>;
 export declare class A2AClient {
     private baseUrl;

package/dist/a2a/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM;CAW9D;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GACxC,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;gBAGhC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;IAazC;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBtC,OAAO,CAAC,OAAO;YAQD,GAAG;IAqCX,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAQlC,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC;IAiBhB;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5C;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC;IA6BT,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC;YA6DT,wBAAwB;YAyBxB,QAAQ;CAmBvB;AA2DD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,MAAM,CAAC,CA4DjB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM;CAW9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GACtE,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;gBAGhC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;IAazC;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBtC,OAAO,CAAC,OAAO;YAQD,GAAG;IAqCX,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAQlC,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC;IAiBhB;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5C;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC;IA6BT,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC;YA6DT,wBAAwB;YAyBxB,QAAQ;CAmBvB;AA2DD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,MAAM,CAAC,CA6DjB"}

package/dist/a2a/client.js

@@ -17,11 +17,16 @@ export class A2ATaskTimeoutError extends Error {
 /**
  * Sign a JWT for A2A cross-app identity verification.
  *
- * Uses A2A_SECRET as an HMAC key. The token contains the caller's email
- * as `sub`, so the receiving app can verify who's calling.
+ * Uses an org-level secret by default for direct org-secret workflows. Callers
+ * that are doing ordinary hosted cross-app delegation can set
+ * `preferGlobalSecret` so deployments with a shared A2A_SECRET don't depend on
+ * every app database having an identical org row. The token contains the
+ * caller's email as `sub`, so the receiving app can verify who's calling.
  */
 export async function signA2AToken(email, orgDomain, orgSecret, options) {
-    const secret = orgSecret || process.env.A2A_SECRET;
+    const secret = options?.preferGlobalSecret
+        ? process.env.A2A_SECRET || orgSecret
+        : orgSecret || process.env.A2A_SECRET;
     if (!secret) {
         throw new Error("No A2A secret available. Set an org-level A2A secret in Team settings, " +
             "or set A2A_SECRET as an environment variable on all apps that need to verify identity.");
@@ -345,7 +350,7 @@ export async function callAgent(url, text, opts) {
         opts?.userEmail &&
         (opts?.orgSecret || process.env.A2A_SECRET)) {
         try {
-            apiKey = await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret);
+            apiKey = await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, { preferGlobalSecret: true });
         }
         catch {
             // Fall back to unsigned call

package/dist/a2a/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAS7B,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,QAAQ,CAAO;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAE3B,YAAY,MAAc,EAAE,QAAc,EAAE,SAAiB;QAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,KAAK,CACH,YAAY,MAAM,4BAA4B,SAAS,mBAAmB,SAAS,GAAG,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,SAAkB,EAClB,SAAkB,EAClB,OAAyC;IAEzC,MAAM,MAAM,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,uBAAuB,CAAC;IAE1B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,GAAG,EAAE,KAAK;QACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,EAAE;SACb,iBAAiB,CAAC,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;SAC9C,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,OAAO,SAAS;IACZ,OAAO,CAAS;IAChB,MAAM,CAAU;IAChB,kBAAkB,GAAa,EAAE,CAAC;IAClC,gBAAgB,GAAG,KAAK,CAAC;IACzB,gBAAgB,CAAU;IAElC,YACE,OAAe,EACf,MAAe,EACf,OAAuC;QAEvC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,UAAU,CAAC;QACvD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO;QAEhD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACzD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7C,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO;QACb,MAAM,CAAC,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,MAAc,EACd,MAA+B;QAE/B,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,MAAM;SACP,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAiB,IAAI,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,WAAW,MAAM,EAAE,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CACT,0BAA0B,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,CACtE,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChC,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;YAChD,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,MAAM,SAAS,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,8BAA8B,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAwB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAgB,EAChB,IAYC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;YAC9C,OAAO;YACP,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,OAAgB,EAChB,IASC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACzC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACpE,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjE,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6DAA6D;gBAC7D,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CACX,OAAgB,EAChB,IAAiE;QAEjE,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,OAAO;gBACP,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;aACzB;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,GAAG,GAAoB,IAAI,CAAC;QAChC,IAAI,SAAS,GAAiB,IAAI,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChD,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,SAAS,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,MAAM,QAAQ,GAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,MAAc,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,4BAA4B,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,gBAAgB,EAAE,CAAC;oBACrB,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAoB;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB;YACtC,CAAC,CAAC,IAAI,eAAe,EAAE;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GACT,UAAU,IAAI,IAAI,CAAC,gBAAgB;YACjC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;gBACvB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,EAAE,MAAM;aAC3B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAC/B,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACzE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YAC3D,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAoB,EAAE,OAAe;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CACnB,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAY,EACZ,IAcC;IAED,IAAI,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;IAE1B,8FAA8F;IAC9F,IACE,CAAC,MAAM;QACP,IAAI,EAAE,SAAS;QACf,CAAC,IAAI,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAC3C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CACzB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAEzD,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IACrC,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC;IAEF,IAAI,IAAU,CAAC;IACf,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACvC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ;YACR,SAAS,EAAE,IAAI,EAAE,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;YAChC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,iCAAiC;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IAC5C,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK;aACpC,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;aACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import * as jose from \"jose\";\nimport type {\n  AgentCard,\n  JsonRpcRequest,\n  JsonRpcResponse,\n  Message,\n  Task,\n} from \"./types.js\";\n\nexport class A2ATaskTimeoutError extends Error {\n  readonly taskId: string;\n  readonly lastTask: Task;\n  readonly lastState: string;\n  readonly timeoutMs: number;\n\n  constructor(taskId: string, lastTask: Task, timeoutMs: number) {\n    const lastState = lastTask.status.state;\n    super(\n      `A2A task ${taskId} did not complete within ${timeoutMs}ms (last state: ${lastState})`,\n    );\n    this.name = \"A2ATaskTimeoutError\";\n    this.taskId = taskId;\n    this.lastTask = lastTask;\n    this.lastState = lastState;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Sign a JWT for A2A cross-app identity verification.\n *\n * Uses A2A_SECRET as an HMAC key. The token contains the caller's email\n * as `sub`, so the receiving app can verify who's calling.\n */\nexport async function signA2AToken(\n  email: string,\n  orgDomain?: string,\n  orgSecret?: string,\n  options?: { expiresIn?: string | number },\n): Promise<string> {\n  const secret = orgSecret || process.env.A2A_SECRET;\n  if (!secret) {\n    throw new Error(\n      \"No A2A secret available. Set an org-level A2A secret in Team settings, \" +\n        \"or set A2A_SECRET as an environment variable on all apps that need to verify identity.\",\n    );\n  }\n\n  const appUrl =\n    process.env.APP_URL ||\n    process.env.BETTER_AUTH_URL ||\n    \"http://localhost:3000\";\n\n  return new jose.SignJWT({\n    sub: email,\n    ...(orgDomain ? { org_domain: orgDomain } : {}),\n  })\n    .setProtectedHeader({ alg: \"HS256\" })\n    .setIssuer(appUrl)\n    .setIssuedAt()\n    .setExpirationTime(options?.expiresIn ?? \"15m\")\n    .sign(new TextEncoder().encode(secret));\n}\n\nexport class A2AClient {\n  private baseUrl: string;\n  private apiKey?: string;\n  private endpointCandidates: string[] = [];\n  private endpointResolved = false;\n  private requestTimeoutMs?: number;\n\n  constructor(\n    baseUrl: string,\n    apiKey?: string,\n    options?: { requestTimeoutMs?: number },\n  ) {\n    const normalized = baseUrl.replace(/\\/$/, \"\");\n    const explicitEndpoint = splitExplicitA2AEndpoint(normalized);\n    this.baseUrl = explicitEndpoint?.baseUrl ?? normalized;\n    if (explicitEndpoint) {\n      this.endpointCandidates = [explicitEndpoint.endpointUrl];\n      this.endpointResolved = true;\n    }\n    this.apiKey = apiKey;\n    this.requestTimeoutMs = options?.requestTimeoutMs;\n  }\n\n  /**\n   * Detect which A2A path the target agent uses.\n   * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.\n   */\n  async resolveEndpoint(): Promise<void> {\n    await this.ensureEndpointCandidates();\n    if (this.endpointCandidates.length <= 1) return;\n\n    for (const endpoint of this.endpointCandidates) {\n      try {\n        const res = await fetch(endpoint, { method: \"OPTIONS\" });\n        if (res.status !== 404 && res.status !== 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n        if (res.status === 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n      } catch {\n        // Try the next candidate.\n      }\n    }\n  }\n\n  private headers(): Record<string, string> {\n    const h: Record<string, string> = { \"Content-Type\": \"application/json\" };\n    if (this.apiKey) {\n      h[\"Authorization\"] = `Bearer ${this.apiKey}`;\n    }\n    return h;\n  }\n\n  private async rpc(\n    method: string,\n    params: Record<string, unknown>,\n  ): Promise<JsonRpcResponse> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method,\n      params,\n    };\n\n    await this.ensureEndpointCandidates();\n    let lastError: Error | null = null;\n\n    for (const url of this.endpointCandidates) {\n      console.log(`[A2A Client] POST ${url} method=${method}`);\n      const startTime = Date.now();\n      const res = await this.postJson(url, body);\n      console.log(\n        `[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`,\n      );\n\n      if (res.ok) {\n        this.endpointCandidates = [url];\n        return res.json() as Promise<JsonRpcResponse>;\n      }\n\n      const text = await res.text();\n      lastError = new Error(`A2A request failed (${res.status}): ${text}`);\n      if (!shouldTryNextEndpoint(res.status)) {\n        throw lastError;\n      }\n    }\n\n    throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n  }\n\n  async getAgentCard(): Promise<AgentCard> {\n    const res = await fetch(`${this.baseUrl}/.well-known/agent-card.json`);\n    if (!res.ok) {\n      throw new Error(`Failed to fetch agent card (${res.status})`);\n    }\n    return res.json() as Promise<AgentCard>;\n  }\n\n  async send(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      /**\n       * If true, ask the server to return the task immediately in `working`\n       * state and process the handler in the background. The caller should\n       * then poll `getTask(taskId)` until `completed` / `failed` / `canceled`.\n       *\n       * Use this when you expect the handler may exceed a synchronous\n       * serverless request budget.\n       */\n      async?: boolean;\n    },\n  ): Promise<Task> {\n    const response = await this.rpc(\"message/send\", {\n      message,\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      ...(opts?.async ? { async: true } : {}),\n    });\n\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n\n    return response.result as Task;\n  }\n\n  /**\n   * Poll for a task by id. Used in async mode after `send({ async: true })`.\n   */\n  async getTask(taskId: string): Promise<Task> {\n    const response = await this.rpc(\"tasks/get\", { id: taskId });\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n    return response.result as Task;\n  }\n\n  /**\n   * Send a message in async mode and poll until the task reaches a terminal\n   * state. This is the recommended path on serverless hosts with short\n   * function timeouts (Netlify, Vercel) where a synchronous LLM-driven A2A\n   * call can exceed the gateway limit.\n   *\n   * Each individual fetch returns quickly; long-running work happens on the\n   * receiving side and is checked via `tasks/get`.\n   */\n  async sendAndWait(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      /** Total time to wait for completion. Default 5 min. */\n      timeoutMs?: number;\n      /** Poll interval. Default 2s. */\n      pollIntervalMs?: number;\n      /** Called with each polled task — useful for surfacing progress. */\n      onUpdate?: (task: Task) => void;\n    },\n  ): Promise<Task> {\n    const submitted = await this.send(message, {\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      async: true,\n    });\n\n    const terminalStates = new Set([\"completed\", \"failed\", \"canceled\"]);\n    if (terminalStates.has(submitted.status.state)) return submitted;\n\n    const timeoutMs = opts?.timeoutMs ?? 5 * 60_000;\n    const pollMs = opts?.pollIntervalMs ?? 2_000;\n    const deadline = Date.now() + timeoutMs;\n\n    let current = submitted;\n    while (Date.now() < deadline) {\n      await new Promise((r) => setTimeout(r, pollMs));\n      try {\n        current = await this.getTask(submitted.id);\n        opts?.onUpdate?.(current);\n      } catch (err) {\n        // Transient fetch failure — keep polling until the deadline.\n        continue;\n      }\n      if (terminalStates.has(current.status.state)) return current;\n    }\n    throw new A2ATaskTimeoutError(submitted.id, current, timeoutMs);\n  }\n\n  async *stream(\n    message: Message,\n    opts?: { contextId?: string; metadata?: Record<string, unknown> },\n  ): AsyncGenerator<Task> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method: \"message/stream\",\n      params: {\n        message,\n        contextId: opts?.contextId,\n        metadata: opts?.metadata,\n      },\n    };\n\n    await this.ensureEndpointCandidates();\n    let res: Response | null = null;\n    let lastError: Error | null = null;\n    for (const candidate of this.endpointCandidates) {\n      res = await this.postJson(candidate, body);\n      if (res.ok) {\n        this.endpointCandidates = [candidate];\n        break;\n      }\n      const text = await res.text();\n      lastError = new Error(`A2A stream failed (${res.status}): ${text}`);\n      if (!shouldTryNextEndpoint(res.status)) throw lastError;\n    }\n    if (!res?.ok) {\n      throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n    }\n\n    const reader = res.body?.getReader();\n    if (!reader) throw new Error(\"No response body\");\n\n    const decoder = new TextDecoder();\n    let buffer = \"\";\n\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n\n      buffer += decoder.decode(value, { stream: true });\n      const lines = buffer.split(\"\\n\");\n      buffer = lines.pop() ?? \"\";\n\n      for (const line of lines) {\n        if (!line.startsWith(\"data: \")) continue;\n        const json = line.slice(6).trim();\n        if (!json) continue;\n\n        const response: JsonRpcResponse = JSON.parse(json);\n        if (response.error) {\n          throw new Error(\n            `A2A error (${response.error.code}): ${response.error.message}`,\n          );\n        }\n        if (response.result) {\n          yield response.result as Task;\n        }\n      }\n    }\n  }\n\n  private async ensureEndpointCandidates(): Promise<void> {\n    if (this.endpointResolved) return;\n    this.endpointResolved = true;\n\n    const candidates: string[] = [];\n    addDefaultEndpointCandidates(candidates, this.baseUrl);\n\n    try {\n      const card = await this.getAgentCard();\n      const cardUrl = normalizeUrl(card.url, this.baseUrl);\n      if (cardUrl) {\n        const explicitEndpoint = splitExplicitA2AEndpoint(cardUrl);\n        if (explicitEndpoint) {\n          candidates.unshift(explicitEndpoint.endpointUrl);\n        } else {\n          addDefaultEndpointCandidates(candidates, cardUrl);\n        }\n      }\n    } catch {\n      // Agent cards are discovery hints. Fall back to conventional endpoints.\n    }\n\n    this.endpointCandidates = unique(candidates);\n  }\n\n  private async postJson(url: string, body: JsonRpcRequest): Promise<Response> {\n    const controller = this.requestTimeoutMs\n      ? new AbortController()\n      : undefined;\n    const timer =\n      controller && this.requestTimeoutMs\n        ? setTimeout(() => controller.abort(), this.requestTimeoutMs)\n        : undefined;\n    try {\n      return await fetch(url, {\n        method: \"POST\",\n        headers: this.headers(),\n        body: JSON.stringify(body),\n        signal: controller?.signal,\n      });\n    } finally {\n      if (timer) clearTimeout(timer);\n    }\n  }\n}\n\nfunction splitExplicitA2AEndpoint(\n  url: string,\n): { baseUrl: string; endpointUrl: string } | null {\n  try {\n    const parsed = new URL(url);\n    const pathname = parsed.pathname.replace(/\\/$/, \"\");\n    if (pathname.endsWith(\"/_agent-native/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/_agent-native/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n    if (pathname.endsWith(\"/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n  } catch {\n    // Relative or invalid URLs are handled by the caller's normal fetch path.\n  }\n  return null;\n}\n\nfunction addDefaultEndpointCandidates(candidates: string[], baseUrl: string) {\n  const base = baseUrl.replace(/\\/$/, \"\");\n  candidates.push(`${base}/_agent-native/a2a`, `${base}/a2a`);\n}\n\nfunction normalizeUrl(\n  value: string | undefined,\n  baseUrl: string,\n): string | null {\n  if (!value) return null;\n  try {\n    return new URL(value, `${baseUrl.replace(/\\/$/, \"\")}/`)\n      .toString()\n      .replace(/\\/$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction shouldTryNextEndpoint(status: number): boolean {\n  return status === 404 || status === 405;\n}\n\nfunction unique(values: string[]): string[] {\n  return Array.from(new Set(values));\n}\n\n/**\n * One-shot convenience function: send a text message and get a text response.\n *\n * When A2A_SECRET is set and userEmail is provided, outbound calls are signed\n * with a JWT so the receiving app can cryptographically verify the caller's\n * identity (instead of blindly trusting metadata).\n */\nexport async function callAgent(\n  url: string,\n  text: string,\n  opts?: {\n    apiKey?: string;\n    contextId?: string;\n    userEmail?: string;\n    orgDomain?: string;\n    orgSecret?: string;\n    /**\n     * Use async/poll instead of a single blocking POST. Recommended for\n     * cross-app calls that may exceed a synchronous serverless request budget.\n     * Defaults to true so callers get safe behavior out of the box.\n     */\n    async?: boolean;\n    /** Total time to wait for the polled task (default 5 min). */\n    timeoutMs?: number;\n  },\n): Promise<string> {\n  let apiKey = opts?.apiKey;\n\n  // Auto-sign with JWT when an A2A secret (org or global) is available and we have a user email\n  if (\n    !apiKey &&\n    opts?.userEmail &&\n    (opts?.orgSecret || process.env.A2A_SECRET)\n  ) {\n    try {\n      apiKey = await signA2AToken(\n        opts.userEmail,\n        opts.orgDomain,\n        opts.orgSecret,\n      );\n    } catch {\n      // Fall back to unsigned call\n    }\n  }\n\n  const client = new A2AClient(url, apiKey);\n  const metadata: Record<string, unknown> = {};\n  if (opts?.userEmail) metadata.userEmail = opts.userEmail;\n  if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;\n\n  // Default to async + poll. The receiving A2A server's `_process-task` route\n  // runs the handler in a fresh function execution (cross-platform queue\n  // pattern), so async mode now works on every host instead of relying on\n  // detached promises that get killed on Netlify/Vercel. Callers that\n  // explicitly want a single-shot blocking POST can pass `async: false`.\n  const useAsync = opts?.async ?? true;\n  const message: Message = {\n    role: \"user\",\n    parts: [{ type: \"text\", text }],\n  };\n\n  let task: Task;\n  if (useAsync) {\n    task = await client.sendAndWait(message, {\n      contextId: opts?.contextId,\n      metadata,\n      timeoutMs: opts?.timeoutMs,\n    });\n  } else {\n    task = await client.send(message, {\n      contextId: opts?.contextId,\n      metadata,\n    });\n  }\n\n  // Extract text from the response\n  const responseMessage = task.status.message;\n  if (responseMessage) {\n    const textParts = responseMessage.parts\n      .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n      .map((p) => p.text);\n    return textParts.join(\"\\n\");\n  }\n\n  return \"\";\n}\n"]}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAS7B,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,QAAQ,CAAO;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAE3B,YAAY,MAAc,EAAE,QAAc,EAAE,SAAiB;QAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,KAAK,CACH,YAAY,MAAM,4BAA4B,SAAS,mBAAmB,SAAS,GAAG,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,SAAkB,EAClB,SAAkB,EAClB,OAAuE;IAEvE,MAAM,MAAM,GAAG,OAAO,EAAE,kBAAkB;QACxC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS;QACrC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,uBAAuB,CAAC;IAE1B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,GAAG,EAAE,KAAK;QACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,EAAE;SACb,iBAAiB,CAAC,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;SAC9C,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,OAAO,SAAS;IACZ,OAAO,CAAS;IAChB,MAAM,CAAU;IAChB,kBAAkB,GAAa,EAAE,CAAC;IAClC,gBAAgB,GAAG,KAAK,CAAC;IACzB,gBAAgB,CAAU;IAElC,YACE,OAAe,EACf,MAAe,EACf,OAAuC;QAEvC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,UAAU,CAAC;QACvD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO;QAEhD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACzD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7C,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO;QACb,MAAM,CAAC,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,MAAc,EACd,MAA+B;QAE/B,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,MAAM;SACP,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAiB,IAAI,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,WAAW,MAAM,EAAE,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CACT,0BAA0B,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,CACtE,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChC,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;YAChD,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,MAAM,SAAS,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,8BAA8B,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAwB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAgB,EAChB,IAYC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;YAC9C,OAAO;YACP,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,OAAgB,EAChB,IASC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACzC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACpE,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjE,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6DAA6D;gBAC7D,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CACX,OAAgB,EAChB,IAAiE;QAEjE,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,OAAO;gBACP,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;aACzB;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,GAAG,GAAoB,IAAI,CAAC;QAChC,IAAI,SAAS,GAAiB,IAAI,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChD,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,SAAS,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,MAAM,QAAQ,GAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,MAAc,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,4BAA4B,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,gBAAgB,EAAE,CAAC;oBACrB,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAoB;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB;YACtC,CAAC,CAAC,IAAI,eAAe,EAAE;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GACT,UAAU,IAAI,IAAI,CAAC,gBAAgB;YACjC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;gBACvB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,EAAE,MAAM;aAC3B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAC/B,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACzE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YAC3D,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAoB,EAAE,OAAe;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CACnB,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAY,EACZ,IAcC;IAED,IAAI,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;IAE1B,8FAA8F;IAC9F,IACE,CAAC,MAAM;QACP,IAAI,EAAE,SAAS;QACf,CAAC,IAAI,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAC3C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CACzB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAEzD,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IACrC,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC;IAEF,IAAI,IAAU,CAAC;IACf,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACvC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ;YACR,SAAS,EAAE,IAAI,EAAE,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;YAChC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,iCAAiC;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IAC5C,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK;aACpC,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;aACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import * as jose from \"jose\";\nimport type {\n  AgentCard,\n  JsonRpcRequest,\n  JsonRpcResponse,\n  Message,\n  Task,\n} from \"./types.js\";\n\nexport class A2ATaskTimeoutError extends Error {\n  readonly taskId: string;\n  readonly lastTask: Task;\n  readonly lastState: string;\n  readonly timeoutMs: number;\n\n  constructor(taskId: string, lastTask: Task, timeoutMs: number) {\n    const lastState = lastTask.status.state;\n    super(\n      `A2A task ${taskId} did not complete within ${timeoutMs}ms (last state: ${lastState})`,\n    );\n    this.name = \"A2ATaskTimeoutError\";\n    this.taskId = taskId;\n    this.lastTask = lastTask;\n    this.lastState = lastState;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Sign a JWT for A2A cross-app identity verification.\n *\n * Uses an org-level secret by default for direct org-secret workflows. Callers\n * that are doing ordinary hosted cross-app delegation can set\n * `preferGlobalSecret` so deployments with a shared A2A_SECRET don't depend on\n * every app database having an identical org row. The token contains the\n * caller's email as `sub`, so the receiving app can verify who's calling.\n */\nexport async function signA2AToken(\n  email: string,\n  orgDomain?: string,\n  orgSecret?: string,\n  options?: { expiresIn?: string | number; preferGlobalSecret?: boolean },\n): Promise<string> {\n  const secret = options?.preferGlobalSecret\n    ? process.env.A2A_SECRET || orgSecret\n    : orgSecret || process.env.A2A_SECRET;\n  if (!secret) {\n    throw new Error(\n      \"No A2A secret available. Set an org-level A2A secret in Team settings, \" +\n        \"or set A2A_SECRET as an environment variable on all apps that need to verify identity.\",\n    );\n  }\n\n  const appUrl =\n    process.env.APP_URL ||\n    process.env.BETTER_AUTH_URL ||\n    \"http://localhost:3000\";\n\n  return new jose.SignJWT({\n    sub: email,\n    ...(orgDomain ? { org_domain: orgDomain } : {}),\n  })\n    .setProtectedHeader({ alg: \"HS256\" })\n    .setIssuer(appUrl)\n    .setIssuedAt()\n    .setExpirationTime(options?.expiresIn ?? \"15m\")\n    .sign(new TextEncoder().encode(secret));\n}\n\nexport class A2AClient {\n  private baseUrl: string;\n  private apiKey?: string;\n  private endpointCandidates: string[] = [];\n  private endpointResolved = false;\n  private requestTimeoutMs?: number;\n\n  constructor(\n    baseUrl: string,\n    apiKey?: string,\n    options?: { requestTimeoutMs?: number },\n  ) {\n    const normalized = baseUrl.replace(/\\/$/, \"\");\n    const explicitEndpoint = splitExplicitA2AEndpoint(normalized);\n    this.baseUrl = explicitEndpoint?.baseUrl ?? normalized;\n    if (explicitEndpoint) {\n      this.endpointCandidates = [explicitEndpoint.endpointUrl];\n      this.endpointResolved = true;\n    }\n    this.apiKey = apiKey;\n    this.requestTimeoutMs = options?.requestTimeoutMs;\n  }\n\n  /**\n   * Detect which A2A path the target agent uses.\n   * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.\n   */\n  async resolveEndpoint(): Promise<void> {\n    await this.ensureEndpointCandidates();\n    if (this.endpointCandidates.length <= 1) return;\n\n    for (const endpoint of this.endpointCandidates) {\n      try {\n        const res = await fetch(endpoint, { method: \"OPTIONS\" });\n        if (res.status !== 404 && res.status !== 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n        if (res.status === 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n      } catch {\n        // Try the next candidate.\n      }\n    }\n  }\n\n  private headers(): Record<string, string> {\n    const h: Record<string, string> = { \"Content-Type\": \"application/json\" };\n    if (this.apiKey) {\n      h[\"Authorization\"] = `Bearer ${this.apiKey}`;\n    }\n    return h;\n  }\n\n  private async rpc(\n    method: string,\n    params: Record<string, unknown>,\n  ): Promise<JsonRpcResponse> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method,\n      params,\n    };\n\n    await this.ensureEndpointCandidates();\n    let lastError: Error | null = null;\n\n    for (const url of this.endpointCandidates) {\n      console.log(`[A2A Client] POST ${url} method=${method}`);\n      const startTime = Date.now();\n      const res = await this.postJson(url, body);\n      console.log(\n        `[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`,\n      );\n\n      if (res.ok) {\n        this.endpointCandidates = [url];\n        return res.json() as Promise<JsonRpcResponse>;\n      }\n\n      const text = await res.text();\n      lastError = new Error(`A2A request failed (${res.status}): ${text}`);\n      if (!shouldTryNextEndpoint(res.status)) {\n        throw lastError;\n      }\n    }\n\n    throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n  }\n\n  async getAgentCard(): Promise<AgentCard> {\n    const res = await fetch(`${this.baseUrl}/.well-known/agent-card.json`);\n    if (!res.ok) {\n      throw new Error(`Failed to fetch agent card (${res.status})`);\n    }\n    return res.json() as Promise<AgentCard>;\n  }\n\n  async send(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      /**\n       * If true, ask the server to return the task immediately in `working`\n       * state and process the handler in the background. The caller should\n       * then poll `getTask(taskId)` until `completed` / `failed` / `canceled`.\n       *\n       * Use this when you expect the handler may exceed a synchronous\n       * serverless request budget.\n       */\n      async?: boolean;\n    },\n  ): Promise<Task> {\n    const response = await this.rpc(\"message/send\", {\n      message,\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      ...(opts?.async ? { async: true } : {}),\n    });\n\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n\n    return response.result as Task;\n  }\n\n  /**\n   * Poll for a task by id. Used in async mode after `send({ async: true })`.\n   */\n  async getTask(taskId: string): Promise<Task> {\n    const response = await this.rpc(\"tasks/get\", { id: taskId });\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n    return response.result as Task;\n  }\n\n  /**\n   * Send a message in async mode and poll until the task reaches a terminal\n   * state. This is the recommended path on serverless hosts with short\n   * function timeouts (Netlify, Vercel) where a synchronous LLM-driven A2A\n   * call can exceed the gateway limit.\n   *\n   * Each individual fetch returns quickly; long-running work happens on the\n   * receiving side and is checked via `tasks/get`.\n   */\n  async sendAndWait(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      /** Total time to wait for completion. Default 5 min. */\n      timeoutMs?: number;\n      /** Poll interval. Default 2s. */\n      pollIntervalMs?: number;\n      /** Called with each polled task — useful for surfacing progress. */\n      onUpdate?: (task: Task) => void;\n    },\n  ): Promise<Task> {\n    const submitted = await this.send(message, {\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      async: true,\n    });\n\n    const terminalStates = new Set([\"completed\", \"failed\", \"canceled\"]);\n    if (terminalStates.has(submitted.status.state)) return submitted;\n\n    const timeoutMs = opts?.timeoutMs ?? 5 * 60_000;\n    const pollMs = opts?.pollIntervalMs ?? 2_000;\n    const deadline = Date.now() + timeoutMs;\n\n    let current = submitted;\n    while (Date.now() < deadline) {\n      await new Promise((r) => setTimeout(r, pollMs));\n      try {\n        current = await this.getTask(submitted.id);\n        opts?.onUpdate?.(current);\n      } catch (err) {\n        // Transient fetch failure — keep polling until the deadline.\n        continue;\n      }\n      if (terminalStates.has(current.status.state)) return current;\n    }\n    throw new A2ATaskTimeoutError(submitted.id, current, timeoutMs);\n  }\n\n  async *stream(\n    message: Message,\n    opts?: { contextId?: string; metadata?: Record<string, unknown> },\n  ): AsyncGenerator<Task> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method: \"message/stream\",\n      params: {\n        message,\n        contextId: opts?.contextId,\n        metadata: opts?.metadata,\n      },\n    };\n\n    await this.ensureEndpointCandidates();\n    let res: Response | null = null;\n    let lastError: Error | null = null;\n    for (const candidate of this.endpointCandidates) {\n      res = await this.postJson(candidate, body);\n      if (res.ok) {\n        this.endpointCandidates = [candidate];\n        break;\n      }\n      const text = await res.text();\n      lastError = new Error(`A2A stream failed (${res.status}): ${text}`);\n      if (!shouldTryNextEndpoint(res.status)) throw lastError;\n    }\n    if (!res?.ok) {\n      throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n    }\n\n    const reader = res.body?.getReader();\n    if (!reader) throw new Error(\"No response body\");\n\n    const decoder = new TextDecoder();\n    let buffer = \"\";\n\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n\n      buffer += decoder.decode(value, { stream: true });\n      const lines = buffer.split(\"\\n\");\n      buffer = lines.pop() ?? \"\";\n\n      for (const line of lines) {\n        if (!line.startsWith(\"data: \")) continue;\n        const json = line.slice(6).trim();\n        if (!json) continue;\n\n        const response: JsonRpcResponse = JSON.parse(json);\n        if (response.error) {\n          throw new Error(\n            `A2A error (${response.error.code}): ${response.error.message}`,\n          );\n        }\n        if (response.result) {\n          yield response.result as Task;\n        }\n      }\n    }\n  }\n\n  private async ensureEndpointCandidates(): Promise<void> {\n    if (this.endpointResolved) return;\n    this.endpointResolved = true;\n\n    const candidates: string[] = [];\n    addDefaultEndpointCandidates(candidates, this.baseUrl);\n\n    try {\n      const card = await this.getAgentCard();\n      const cardUrl = normalizeUrl(card.url, this.baseUrl);\n      if (cardUrl) {\n        const explicitEndpoint = splitExplicitA2AEndpoint(cardUrl);\n        if (explicitEndpoint) {\n          candidates.unshift(explicitEndpoint.endpointUrl);\n        } else {\n          addDefaultEndpointCandidates(candidates, cardUrl);\n        }\n      }\n    } catch {\n      // Agent cards are discovery hints. Fall back to conventional endpoints.\n    }\n\n    this.endpointCandidates = unique(candidates);\n  }\n\n  private async postJson(url: string, body: JsonRpcRequest): Promise<Response> {\n    const controller = this.requestTimeoutMs\n      ? new AbortController()\n      : undefined;\n    const timer =\n      controller && this.requestTimeoutMs\n        ? setTimeout(() => controller.abort(), this.requestTimeoutMs)\n        : undefined;\n    try {\n      return await fetch(url, {\n        method: \"POST\",\n        headers: this.headers(),\n        body: JSON.stringify(body),\n        signal: controller?.signal,\n      });\n    } finally {\n      if (timer) clearTimeout(timer);\n    }\n  }\n}\n\nfunction splitExplicitA2AEndpoint(\n  url: string,\n): { baseUrl: string; endpointUrl: string } | null {\n  try {\n    const parsed = new URL(url);\n    const pathname = parsed.pathname.replace(/\\/$/, \"\");\n    if (pathname.endsWith(\"/_agent-native/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/_agent-native/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n    if (pathname.endsWith(\"/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n  } catch {\n    // Relative or invalid URLs are handled by the caller's normal fetch path.\n  }\n  return null;\n}\n\nfunction addDefaultEndpointCandidates(candidates: string[], baseUrl: string) {\n  const base = baseUrl.replace(/\\/$/, \"\");\n  candidates.push(`${base}/_agent-native/a2a`, `${base}/a2a`);\n}\n\nfunction normalizeUrl(\n  value: string | undefined,\n  baseUrl: string,\n): string | null {\n  if (!value) return null;\n  try {\n    return new URL(value, `${baseUrl.replace(/\\/$/, \"\")}/`)\n      .toString()\n      .replace(/\\/$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction shouldTryNextEndpoint(status: number): boolean {\n  return status === 404 || status === 405;\n}\n\nfunction unique(values: string[]): string[] {\n  return Array.from(new Set(values));\n}\n\n/**\n * One-shot convenience function: send a text message and get a text response.\n *\n * When A2A_SECRET is set and userEmail is provided, outbound calls are signed\n * with a JWT so the receiving app can cryptographically verify the caller's\n * identity (instead of blindly trusting metadata).\n */\nexport async function callAgent(\n  url: string,\n  text: string,\n  opts?: {\n    apiKey?: string;\n    contextId?: string;\n    userEmail?: string;\n    orgDomain?: string;\n    orgSecret?: string;\n    /**\n     * Use async/poll instead of a single blocking POST. Recommended for\n     * cross-app calls that may exceed a synchronous serverless request budget.\n     * Defaults to true so callers get safe behavior out of the box.\n     */\n    async?: boolean;\n    /** Total time to wait for the polled task (default 5 min). */\n    timeoutMs?: number;\n  },\n): Promise<string> {\n  let apiKey = opts?.apiKey;\n\n  // Auto-sign with JWT when an A2A secret (org or global) is available and we have a user email\n  if (\n    !apiKey &&\n    opts?.userEmail &&\n    (opts?.orgSecret || process.env.A2A_SECRET)\n  ) {\n    try {\n      apiKey = await signA2AToken(\n        opts.userEmail,\n        opts.orgDomain,\n        opts.orgSecret,\n        { preferGlobalSecret: true },\n      );\n    } catch {\n      // Fall back to unsigned call\n    }\n  }\n\n  const client = new A2AClient(url, apiKey);\n  const metadata: Record<string, unknown> = {};\n  if (opts?.userEmail) metadata.userEmail = opts.userEmail;\n  if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;\n\n  // Default to async + poll. The receiving A2A server's `_process-task` route\n  // runs the handler in a fresh function execution (cross-platform queue\n  // pattern), so async mode now works on every host instead of relying on\n  // detached promises that get killed on Netlify/Vercel. Callers that\n  // explicitly want a single-shot blocking POST can pass `async: false`.\n  const useAsync = opts?.async ?? true;\n  const message: Message = {\n    role: \"user\",\n    parts: [{ type: \"text\", text }],\n  };\n\n  let task: Task;\n  if (useAsync) {\n    task = await client.sendAndWait(message, {\n      contextId: opts?.contextId,\n      metadata,\n      timeoutMs: opts?.timeoutMs,\n    });\n  } else {\n    task = await client.send(message, {\n      contextId: opts?.contextId,\n      metadata,\n    });\n  }\n\n  // Extract text from the response\n  const responseMessage = task.status.message;\n  if (responseMessage) {\n    const textParts = responseMessage.parts\n      .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n      .map((p) => p.text);\n    return textParts.join(\"\\n\");\n  }\n\n  return \"\";\n}\n"]}

package/dist/a2a/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/a2a/handlers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EAKT,eAAe,EAGhB,MAAM,YAAY,CAAC;AA6FpB;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,EACjB,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,IAAI,CAAC,CA8Df;AAgnBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,GAAG,EACT,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,eAAe,CAAC,CAyC1B"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/a2a/handlers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EAKT,eAAe,EAGhB,MAAM,YAAY,CAAC;AAiGpB;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,EACjB,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,IAAI,CAAC,CA8Df;AAgnBD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,GAAG,EACT,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,eAAe,CAAC,CAyC1B"}

package/dist/a2a/handlers.js

@@ -3,6 +3,7 @@ import { createTask, getTask, getTaskOwner, updateTask, claimA2ATaskForProcessin
 import { agentChat } from "../shared/agent-chat.js";
 import { signInternalToken } from "../integrations/internal-token.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
+import { hasConfiguredA2ASecret, isA2AProductionRuntime, } from "./auth-policy.js";
 // Inlined to avoid pulling the entire core-routes-plugin (and its h3
 // transitive deps) into the a2a/handlers test boundary. Must stay in sync
 // with FRAMEWORK_ROUTE_PREFIX in `server/core-routes-plugin.ts`.
@@ -333,9 +334,9 @@ async function handleSend(params, config, event) {
         // with the lack of caller identity here would let any unauthenticated
         // attacker queue and trigger handler runs. In production, require some
         // form of auth so the verifiedEmail is bound to the task.
-        const hasA2ASecret = !!process.env.A2A_SECRET;
+        const hasA2ASecret = hasConfiguredA2ASecret();
         const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);
-        if (process.env.NODE_ENV === "production" && !hasA2ASecret && !hasApiKey) {
+        if (isA2AProductionRuntime() && !hasA2ASecret && !hasApiKey) {
             return {
                 ...jsonRpcError(0, -32001, "A2A async mode is not available — A2A_SECRET or apiKeyEnv must be configured."),
                 _id: 0,
@@ -518,9 +519,9 @@ function sanitizeTaskForResponse(task) {
  */
 function authorizeTaskAccess(taskOwnerEmail, event, config) {
     const verifiedEmail = event?.context?.__a2aVerifiedEmail ?? null;
-    const hasA2ASecret = !!process.env.A2A_SECRET;
+    const hasA2ASecret = hasConfiguredA2ASecret();
     const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);
-    const inProduction = process.env.NODE_ENV === "production";
+    const inProduction = isA2AProductionRuntime();
     if (inProduction && !hasA2ASecret && !hasApiKey) {
         // No way to authenticate the caller in production — refuse access.
         return jsonRpcError(0, -32001, "Task not found");