@arnilo/prism-supervisor 0.0.5

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## [Unreleased]
+
+## [0.0.5] - 2026-07-16
+
+- Added optional bounded child delegation and A2A 1.0 card/server/client interoperability.
+
+
+## [0.0.4] - 2026-07-14
+
+- Bounded explicit local child delegation with narrowing-only policy composition, derived memory scope IDs, hooks, nested delegation, cancellation, and event subscription.
+- A2A protocol 1.0 cards, ES256 JWS signing/verification, authorized web-standard JSON-RPC/SSE handler, and explicit allow-listed remote client.

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Arnilo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,31 @@
+# @arnilo/prism-supervisor
+
+Optional bounded local child delegation and A2A 1.0 interoperability for Prism.
+
+```bash
+npm install @arnilo/prism-supervisor @arnilo/prism
+```
+
+```ts
+import { createAgent, createMockProvider, providerDone, providerTextDelta } from "@arnilo/prism";
+import { createSupervisor } from "@arnilo/prism-supervisor";
+
+const supervisor = createSupervisor({
+  ownership: { tenantId: "tenant", userId: "user" },
+  children: {
+    research: {
+      createAgent: ({ resourceId, threadId, permission }) => createAgent({
+        model: { provider: "mock", model: "research" },
+        provider: createMockProvider([providerTextDelta(`${resourceId}:${threadId}`), providerDone()]),
+        permission,
+      }),
+    },
+  },
+});
+
+console.log((await supervisor.delegate({ childId: "research", input: "Check sources" })).text);
+```
+
+Also exports A2A 1.0 `createA2AAgentCard`, `signA2AAgentCard`, `verifyA2AAgentCard`, `createA2AHandler`, and `createA2AClient`. Only text parts and JSON-RPC `SendMessage`, `SendStreamingMessage`, and `GetExtendedAgentCard` are supported. Hosts own authentication, TLS, endpoint allow-lists, child credential resolution, and memory construction from package-derived resource/thread IDs.
+
+See [Supervisors](../../docs/supervisors.md) and [A2A interoperability](../../docs/a2a.md).

package/dist/a2a-card.d.ts

@@ -0,0 +1,17 @@
+import type { A2AAgentCard } from "./a2a-types.js";
+export interface SignA2AAgentCardOptions {
+    readonly privateKey: CryptoKey;
+    readonly keyId: string;
+    readonly expiresAt: string;
+    readonly issuedAt?: string;
+}
+export interface VerifyA2AAgentCardOptions {
+    readonly publicKey: CryptoKey;
+    readonly keyId?: string;
+    readonly now?: Date;
+    readonly maxAgeMs?: number;
+}
+export declare function createA2AAgentCard(card: A2AAgentCard): A2AAgentCard;
+export declare function signA2AAgentCard(card: A2AAgentCard, options: SignA2AAgentCardOptions): Promise<A2AAgentCard>;
+export declare function verifyA2AAgentCard(card: A2AAgentCard, options: VerifyA2AAgentCardOptions): Promise<void>;
+export declare function canonicalizeA2AAgentCard(card: A2AAgentCard): string;

package/dist/a2a-card.js

@@ -0,0 +1,129 @@
+import { A2AError } from "./errors.js";
+export function createA2AAgentCard(card) {
+    validateCard(card);
+    return deepFreeze(structuredClone(card));
+}
+export async function signA2AAgentCard(card, options) {
+    validateCard(card);
+    if (!options.keyId.trim())
+        throw new A2AError("keyId is required", 400, "ERR_PRISM_A2A_CARD");
+    const issuedAt = options.issuedAt ?? new Date().toISOString();
+    const issued = Date.parse(issuedAt);
+    const expires = Date.parse(options.expiresAt);
+    if (!Number.isFinite(issued) || !Number.isFinite(expires) || expires <= issued)
+        throw new A2AError("Card signature expiry is invalid", 400, "ERR_PRISM_A2A_CARD");
+    const protectedHeader = base64url(new TextEncoder().encode(canonicalJson({ alg: "ES256", typ: "JOSE", kid: options.keyId, iat: issuedAt, exp: options.expiresAt })));
+    const payload = base64url(new TextEncoder().encode(canonicalCard(card)));
+    const signature = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, options.privateKey, new TextEncoder().encode(`${protectedHeader}.${payload}`));
+    const signed = { protected: protectedHeader, signature: base64url(new Uint8Array(signature)) };
+    return deepFreeze({ ...structuredClone(card), signatures: [...(card.signatures ?? []), signed] });
+}
+export async function verifyA2AAgentCard(card, options) {
+    validateCard(card);
+    if (!card.signatures?.length)
+        throw new A2AError("Agent card is unsigned", 403, "ERR_PRISM_A2A_CARD_SIGNATURE");
+    const payload = base64url(new TextEncoder().encode(canonicalCard(card)));
+    let matched = false;
+    for (const candidate of card.signatures) {
+        try {
+            const header = parseProtected(candidate.protected);
+            if (header.alg !== "ES256" || header.typ !== "JOSE")
+                continue;
+            if (options.keyId !== undefined && header.kid !== options.keyId)
+                continue;
+            const now = (options.now ?? new Date()).getTime();
+            const issued = Date.parse(header.iat);
+            const expires = Date.parse(header.exp);
+            if (!Number.isFinite(issued) || !Number.isFinite(expires) || now < issued || now >= expires)
+                continue;
+            if (options.maxAgeMs !== undefined && (options.maxAgeMs < 1 || now - issued > options.maxAgeMs))
+                continue;
+            const valid = await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, options.publicKey, fromBase64url(candidate.signature).buffer, new TextEncoder().encode(`${candidate.protected}.${payload}`));
+            if (valid) {
+                matched = true;
+                break;
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    if (!matched)
+        throw new A2AError("Agent card signature is invalid or expired", 403, "ERR_PRISM_A2A_CARD_SIGNATURE");
+}
+export function canonicalizeA2AAgentCard(card) {
+    validateCard(card);
+    return canonicalCard(card);
+}
+function canonicalCard(card) {
+    const { signatures: _signatures, ...unsigned } = card;
+    return canonicalJson(unsigned);
+}
+function validateCard(card) {
+    if (!card.name?.trim() || !card.description?.trim() || !card.version?.trim())
+        throw new A2AError("Agent card identity is incomplete", 400, "ERR_PRISM_A2A_CARD");
+    if (!card.supportedInterfaces.length || !card.supportedInterfaces.every((item) => item.protocolBinding === "JSONRPC" && item.protocolVersion === "1.0" && isHttpsUrl(item.url)))
+        throw new A2AError("Agent card requires an HTTPS JSONRPC 1.0 interface", 400, "ERR_PRISM_A2A_CARD");
+    if (!card.defaultInputModes.includes("text/plain") || !card.defaultOutputModes.includes("text/plain"))
+        throw new A2AError("Agent card must support text/plain", 400, "ERR_PRISM_A2A_CARD");
+    const ids = new Set();
+    for (const skill of card.skills) {
+        if (!skill.id.trim() || !skill.name.trim() || !skill.description.trim() || ids.has(skill.id))
+            throw new A2AError("Agent card skill is invalid", 400, "ERR_PRISM_A2A_CARD");
+        ids.add(skill.id);
+    }
+}
+function parseProtected(value) {
+    const parsed = JSON.parse(new TextDecoder().decode(fromBase64url(value)));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error("invalid protected header");
+    const record = parsed;
+    if (typeof record.alg !== "string" || typeof record.typ !== "string" || typeof record.kid !== "string" || typeof record.iat !== "string" || typeof record.exp !== "string")
+        throw new Error("invalid protected header");
+    return { alg: record.alg, typ: record.typ, kid: record.kid, iat: record.iat, exp: record.exp };
+}
+function canonicalJson(value) {
+    if (value === null || typeof value === "boolean" || typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new A2AError("Non-finite card number", 400, "ERR_PRISM_A2A_CARD");
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record).filter((key) => record[key] !== undefined).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+    }
+    throw new A2AError("Agent card is not canonical JSON", 400, "ERR_PRISM_A2A_CARD");
+}
+function base64url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/u, "");
+}
+function fromBase64url(value) {
+    if (!/^[A-Za-z0-9_-]+$/u.test(value))
+        throw new Error("invalid base64url");
+    const binary = atob(value.replace(/-/g, "+").replace(/_/g, "/"));
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+function isHttpsUrl(value) {
+    try {
+        return new URL(value).protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+//# sourceMappingURL=a2a-card.js.map

package/dist/a2a-client.d.ts

@@ -0,0 +1,2 @@
+import { type A2AClient, type A2AClientOptions } from "./a2a-types.js";
+export declare function createA2AClient(options: A2AClientOptions): A2AClient;

package/dist/a2a-client.js

@@ -0,0 +1,312 @@
+import { createA2AAgentCard } from "./a2a-card.js";
+import { A2AError } from "./errors.js";
+import { A2A_PROTOCOL_VERSION } from "./a2a-types.js";
+const DEFAULTS = { maxRequestBytes: 64 * 1024, maxResponseBytes: 1024 * 1024, maxEventBytes: 64 * 1024, maxStreamBytes: 10 * 1024 * 1024, maxStreamEvents: 10_000, maxConcurrentRequests: 16, timeoutMs: 120_000, maxCardBytes: 64 * 1024 };
+const HARD = { maxRequestBytes: 1024 * 1024, maxResponseBytes: 8 * 1024 * 1024, maxEventBytes: 1024 * 1024, maxStreamBytes: 64 * 1024 * 1024, maxStreamEvents: 100_000, maxConcurrentRequests: 256, timeoutMs: 30 * 60_000, maxCardBytes: 1024 * 1024 };
+export function createA2AClient(options) {
+    const endpoint = requireAllowedHttpsUrl(options.endpoint, options.allowedOrigins);
+    const cardUrl = requireAllowedHttpsUrl(options.cardUrl ?? `${endpoint.origin}/.well-known/agent-card.json`, options.allowedOrigins);
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const limits = clientLimits(options.limits);
+    let active = 0;
+    let requestId = 0;
+    async function withRequest(signal, operation) {
+        if (active >= limits.maxConcurrentRequests)
+            throw new A2AError("A2A client concurrency exceeded", 429, "ERR_PRISM_A2A_CONCURRENCY");
+        active += 1;
+        const owned = ownedSignal(signal, limits.timeoutMs);
+        try {
+            return await operation(owned.signal);
+        }
+        finally {
+            owned.dispose();
+            active -= 1;
+        }
+    }
+    async function getCard(call = {}) {
+        return withRequest(call.signal, async (signal) => {
+            const response = await fetcher(cardUrl, { method: "GET", signal, redirect: "error", headers: { accept: "application/a2a+json, application/json" } });
+            if (!response.ok)
+                throw new A2AError("A2A card request failed", response.status, "ERR_PRISM_A2A_REMOTE");
+            const value = await readBoundedJson(response, limits.maxCardBytes, signal);
+            const card = parseCard(value);
+            if (!card.supportedInterfaces.some((item) => item.protocolBinding === "JSONRPC" && item.protocolVersion === A2A_PROTOCOL_VERSION && item.url === endpoint.href))
+                throw new A2AError("Agent card does not declare the selected endpoint", 403, "ERR_PRISM_A2A_CARD");
+            if (options.verifyCard)
+                await abortable(Promise.resolve(options.verifyCard(card)), signal);
+            return card;
+        });
+    }
+    async function send(input, call = {}) {
+        return withRequest(call.signal, async (signal) => {
+            assertInput(input, limits.maxRequestBytes);
+            await getCardWithin(signal);
+            const id = ++requestId;
+            const body = JSON.stringify(requestBody(id, "SendMessage", input));
+            if (new TextEncoder().encode(body).byteLength > limits.maxRequestBytes)
+                throw new A2AError("A2A request exceeds max bytes", 413, "ERR_PRISM_A2A_REQUEST_LIMIT");
+            const authHeaders = await abortable(Promise.resolve(options.authorize?.({ endpoint: endpoint.href, signal }) ?? {}), signal);
+            const response = await fetcher(endpoint, { method: "POST", signal, redirect: "error", headers: { ...headersObject(authHeaders), "content-type": "application/a2a+json", accept: "application/a2a+json" }, body });
+            if (!response.ok)
+                throw new A2AError("A2A remote request failed", response.status, "ERR_PRISM_A2A_REMOTE");
+            const rpc = parseRpcResponse(await readBoundedJson(response, limits.maxResponseBytes, signal), id);
+            if (rpc.error)
+                throw new A2AError(safeRemote(rpc.error.message, options), 502, "ERR_PRISM_A2A_REMOTE");
+            return taskResult(parseTaskResult(rpc.result), options);
+        });
+    }
+    async function* stream(input, call = {}) {
+        if (active >= limits.maxConcurrentRequests)
+            throw new A2AError("A2A client concurrency exceeded", 429, "ERR_PRISM_A2A_CONCURRENCY");
+        active += 1;
+        const owned = ownedSignal(call.signal, limits.timeoutMs);
+        let reader;
+        try {
+            assertInput(input, limits.maxRequestBytes);
+            await getCardWithin(owned.signal);
+            const id = ++requestId;
+            const body = JSON.stringify(requestBody(id, "SendStreamingMessage", input));
+            if (new TextEncoder().encode(body).byteLength > limits.maxRequestBytes)
+                throw new A2AError("A2A request exceeds max bytes", 413, "ERR_PRISM_A2A_REQUEST_LIMIT");
+            const authHeaders = await abortable(Promise.resolve(options.authorize?.({ endpoint: endpoint.href, signal: owned.signal }) ?? {}), owned.signal);
+            const response = await fetcher(endpoint, { method: "POST", signal: owned.signal, redirect: "error", headers: { ...headersObject(authHeaders), "content-type": "application/a2a+json", accept: "text/event-stream" }, body });
+            if (!response.ok || !response.body || !response.headers.get("content-type")?.startsWith("text/event-stream"))
+                throw new A2AError("A2A stream request failed", response.status, "ERR_PRISM_A2A_REMOTE");
+            reader = response.body.getReader();
+            let buffered = "";
+            let totalBytes = 0;
+            let eventCount = 0;
+            let terminal = false;
+            while (true) {
+                owned.signal.throwIfAborted();
+                const next = await reader.read();
+                if (next.done)
+                    break;
+                totalBytes += next.value.byteLength;
+                if (totalBytes > limits.maxStreamBytes)
+                    throw new A2AError("A2A stream exceeds max bytes", 507, "ERR_PRISM_A2A_STREAM_LIMIT");
+                buffered += new TextDecoder().decode(next.value, { stream: true });
+                while (buffered.includes("\n\n")) {
+                    const split = buffered.indexOf("\n\n");
+                    const frame = buffered.slice(0, split);
+                    buffered = buffered.slice(split + 2);
+                    if (new TextEncoder().encode(frame).byteLength > limits.maxEventBytes)
+                        throw new A2AError("A2A event exceeds max bytes", 507, "ERR_PRISM_A2A_STREAM_LIMIT");
+                    eventCount += 1;
+                    if (eventCount > limits.maxStreamEvents)
+                        throw new A2AError("A2A stream exceeds max events", 507, "ERR_PRISM_A2A_STREAM_LIMIT");
+                    const data = frame.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+                    if (!data)
+                        continue;
+                    let parsed;
+                    try {
+                        parsed = JSON.parse(data);
+                    }
+                    catch {
+                        throw new A2AError("Malformed A2A stream event", 502, "ERR_PRISM_A2A_REMOTE");
+                    }
+                    const rpc = parseRpcResponse(parsed, id);
+                    if (rpc.error)
+                        throw new A2AError(safeRemote(rpc.error.message, options), 502, "ERR_PRISM_A2A_REMOTE");
+                    const task = parseTaskResult(rpc.result);
+                    if (task.status.state === "TASK_STATE_FAILED" || task.status.state === "TASK_STATE_CANCELED")
+                        throw new A2AError("Remote A2A stream task failed", 502, "ERR_PRISM_A2A_REMOTE");
+                    if (task.status.state === "TASK_STATE_COMPLETED")
+                        terminal = true;
+                    for (const artifact of task.artifacts ?? [])
+                        for (const part of artifact.parts)
+                            yield options.redactor?.redact(part.text) ?? part.text;
+                }
+            }
+            if (!terminal)
+                throw new A2AError("A2A stream ended before terminal task state", 502, "ERR_PRISM_A2A_REMOTE");
+            if (buffered.trim())
+                throw new A2AError("Truncated A2A stream", 502, "ERR_PRISM_A2A_REMOTE");
+        }
+        finally {
+            await reader?.cancel().catch(() => undefined);
+            owned.dispose();
+            active -= 1;
+        }
+    }
+    async function getCardWithin(signal) {
+        const response = await fetcher(cardUrl, { method: "GET", signal, redirect: "error", headers: { accept: "application/a2a+json, application/json" } });
+        if (!response.ok)
+            throw new A2AError("A2A card request failed", response.status, "ERR_PRISM_A2A_REMOTE");
+        const card = parseCard(await readBoundedJson(response, limits.maxCardBytes, signal));
+        if (!card.supportedInterfaces.some((item) => item.protocolBinding === "JSONRPC" && item.protocolVersion === A2A_PROTOCOL_VERSION && item.url === endpoint.href))
+            throw new A2AError("Agent card does not declare the selected endpoint", 403, "ERR_PRISM_A2A_CARD");
+        if (options.verifyCard)
+            await abortable(Promise.resolve(options.verifyCard(card)), signal);
+        return card;
+    }
+    return { getCard, send, stream };
+}
+function requestBody(id, method, input) {
+    return { jsonrpc: "2.0", id, method, params: { message: { role: "user", messageId: `message-${id}`, parts: [{ text: input }] } } };
+}
+function taskResult(task, options) {
+    if (task.status.state === "TASK_STATE_SUBMITTED" || task.status.state === "TASK_STATE_WORKING")
+        throw new A2AError("A2A response task is not terminal", 502, "ERR_PRISM_A2A_REMOTE");
+    const text = (task.artifacts ?? []).flatMap((artifact) => artifact.parts.map((part) => part.text)).join("");
+    const safeText = options.redactor?.redact(text) ?? text;
+    const status = task.status.state === "TASK_STATE_COMPLETED" ? "succeeded" : task.status.state === "TASK_STATE_CANCELED" ? "aborted" : "failed";
+    const content = safeText ? [{ type: "text", text: safeText }] : [];
+    const message = safeText ? { role: "assistant", content } : undefined;
+    return Object.freeze({ sessionId: task.contextId, runId: task.id, status, text: safeText, content, message, error: status === "failed" ? { message: "Remote A2A task failed" } : undefined, abortReason: status === "aborted" ? "Remote A2A task canceled" : undefined });
+}
+function parseTaskResult(value) {
+    if (!isRecord(value) || !isRecord(value.task))
+        throw new A2AError("Malformed A2A task result", 502, "ERR_PRISM_A2A_REMOTE");
+    const task = value.task;
+    if (typeof task.id !== "string" || typeof task.contextId !== "string" || !isRecord(task.status) || typeof task.status.state !== "string")
+        throw new A2AError("Malformed A2A task", 502, "ERR_PRISM_A2A_REMOTE");
+    const states = new Set(["TASK_STATE_SUBMITTED", "TASK_STATE_WORKING", "TASK_STATE_COMPLETED", "TASK_STATE_FAILED", "TASK_STATE_CANCELED"]);
+    if (!states.has(task.status.state))
+        throw new A2AError("Unknown A2A task state", 502, "ERR_PRISM_A2A_REMOTE");
+    const artifacts = task.artifacts === undefined ? undefined : parseArtifacts(task.artifacts);
+    return { id: task.id, contextId: task.contextId, status: { state: task.status.state, timestamp: typeof task.status.timestamp === "string" ? task.status.timestamp : new Date(0).toISOString() }, artifacts };
+}
+function parseArtifacts(value) {
+    if (!Array.isArray(value) || value.length > 32)
+        throw new A2AError("Malformed A2A artifacts", 502, "ERR_PRISM_A2A_REMOTE");
+    return value.map((artifact) => {
+        if (!isRecord(artifact) || typeof artifact.artifactId !== "string" || !Array.isArray(artifact.parts) || artifact.parts.length > 32)
+            throw new A2AError("Malformed A2A artifact", 502, "ERR_PRISM_A2A_REMOTE");
+        return { artifactId: artifact.artifactId, parts: artifact.parts.map((part) => {
+                if (!isRecord(part) || typeof part.text !== "string")
+                    throw new A2AError("Unsupported A2A artifact part", 502, "ERR_PRISM_A2A_REMOTE");
+                return { text: part.text };
+            }) };
+    });
+}
+function parseRpcResponse(value, id) {
+    if (!isRecord(value) || value.jsonrpc !== "2.0" || value.id !== id)
+        throw new A2AError("Malformed A2A JSON-RPC response", 502, "ERR_PRISM_A2A_REMOTE");
+    const error = value.error;
+    if (error !== undefined && (!isRecord(error) || typeof error.code !== "number" || typeof error.message !== "string"))
+        throw new A2AError("Malformed A2A JSON-RPC error", 502, "ERR_PRISM_A2A_REMOTE");
+    return { jsonrpc: "2.0", id, result: value.result, error: error };
+}
+function parseCard(value) {
+    if (!isRecord(value) || typeof value.name !== "string" || typeof value.description !== "string" || typeof value.version !== "string" || !Array.isArray(value.supportedInterfaces) || !Array.isArray(value.skills) || !stringArray(value.defaultInputModes) || !stringArray(value.defaultOutputModes) || !isRecord(value.capabilities) || typeof value.capabilities.streaming !== "boolean")
+        throw new A2AError("Malformed A2A agent card", 502, "ERR_PRISM_A2A_CARD");
+    const supportedInterfaces = value.supportedInterfaces.map((item) => {
+        if (!isRecord(item) || typeof item.url !== "string" || item.protocolBinding !== "JSONRPC" || item.protocolVersion !== "1.0")
+            throw new A2AError("Malformed A2A agent interface", 502, "ERR_PRISM_A2A_CARD");
+        return { url: item.url, protocolBinding: "JSONRPC", protocolVersion: "1.0" };
+    });
+    const skills = value.skills.map((skill) => {
+        if (!isRecord(skill) || typeof skill.id !== "string" || typeof skill.name !== "string" || typeof skill.description !== "string" || !stringArray(skill.tags))
+            throw new A2AError("Malformed A2A agent skill", 502, "ERR_PRISM_A2A_CARD");
+        return { id: skill.id, name: skill.name, description: skill.description, tags: skill.tags, examples: stringArray(skill.examples) ? skill.examples : undefined, inputModes: stringArray(skill.inputModes) ? skill.inputModes : undefined, outputModes: stringArray(skill.outputModes) ? skill.outputModes : undefined };
+    });
+    const signatures = value.signatures === undefined ? undefined : Array.isArray(value.signatures) ? value.signatures.map((signature) => {
+        if (!isRecord(signature) || typeof signature.protected !== "string" || typeof signature.signature !== "string")
+            throw new A2AError("Malformed A2A card signature", 502, "ERR_PRISM_A2A_CARD");
+        return { protected: signature.protected, signature: signature.signature, header: isRecord(signature.header) ? signature.header : undefined };
+    }) : (() => { throw new A2AError("Malformed A2A card signatures", 502, "ERR_PRISM_A2A_CARD"); })();
+    return createA2AAgentCard({
+        name: value.name,
+        description: value.description,
+        version: value.version,
+        supportedInterfaces,
+        capabilities: { streaming: value.capabilities.streaming, pushNotifications: typeof value.capabilities.pushNotifications === "boolean" ? value.capabilities.pushNotifications : undefined, extendedAgentCard: typeof value.capabilities.extendedAgentCard === "boolean" ? value.capabilities.extendedAgentCard : undefined },
+        defaultInputModes: value.defaultInputModes,
+        defaultOutputModes: value.defaultOutputModes,
+        skills,
+        securitySchemes: isRecord(value.securitySchemes) ? value.securitySchemes : undefined,
+        security: parseSecurity(value.security),
+        signatures,
+    });
+}
+async function readBoundedJson(response, maxBytes, signal) {
+    const contentType = response.headers.get("content-type");
+    if (contentType && !contentType.includes("json"))
+        throw new A2AError("Unexpected A2A response content type", 502, "ERR_PRISM_A2A_REMOTE");
+    if (!response.body)
+        throw new A2AError("A2A response body is missing", 502, "ERR_PRISM_A2A_REMOTE");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            signal.throwIfAborted();
+            const next = await reader.read();
+            if (next.done)
+                break;
+            size += next.value.byteLength;
+            if (size > maxBytes)
+                throw new A2AError("A2A response exceeds max bytes", 507, "ERR_PRISM_A2A_RESPONSE_LIMIT");
+            chunks.push(next.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch {
+        throw new A2AError("Malformed A2A JSON response", 502, "ERR_PRISM_A2A_REMOTE");
+    }
+}
+function requireAllowedHttpsUrl(value, origins) {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || !origins.includes(url.origin))
+        throw new A2AError("A2A endpoint origin is not allow-listed HTTPS", 403, "ERR_PRISM_A2A_ORIGIN");
+    return url;
+}
+function clientLimits(input = {}) {
+    const output = {};
+    for (const key of Object.keys(DEFAULTS)) {
+        const value = input[key] ?? DEFAULTS[key];
+        if (!Number.isSafeInteger(value) || value < 1 || value > HARD[key])
+            throw new A2AError(`${key} is invalid`, 400, "ERR_PRISM_A2A_CONFIG");
+        output[key] = value;
+    }
+    return output;
+}
+function ownedSignal(parent, timeoutMs) {
+    const controller = new AbortController();
+    const abort = () => controller.abort(parent?.reason);
+    if (parent?.aborted)
+        abort();
+    else
+        parent?.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(() => controller.abort(new DOMException("A2A request timed out", "AbortError")), timeoutMs);
+    return { signal: controller.signal, dispose: () => { clearTimeout(timer); parent?.removeEventListener("abort", abort); } };
+}
+function abortable(promise, signal) {
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+function assertInput(input, maxBytes) { if (new TextEncoder().encode(input).byteLength > maxBytes)
+    throw new A2AError("A2A input exceeds max bytes", 413, "ERR_PRISM_A2A_REQUEST_LIMIT"); }
+function headersObject(headers) { return Object.fromEntries(new Headers(headers).entries()); }
+function isRecord(value) { return !!value && typeof value === "object" && !Array.isArray(value); }
+function stringArray(value) { return Array.isArray(value) && value.every((item) => typeof item === "string"); }
+function parseSecurity(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value))
+        throw new A2AError("Malformed A2A card security", 502, "ERR_PRISM_A2A_CARD");
+    return value.map((entry) => {
+        if (!isRecord(entry) || !Object.values(entry).every(stringArray))
+            throw new A2AError("Malformed A2A card security", 502, "ERR_PRISM_A2A_CARD");
+        return entry;
+    });
+}
+function safeRemote(message, options) { return options.redactor?.redact(message.slice(0, 1024)) ?? message.slice(0, 1024); }
+//# sourceMappingURL=a2a-client.js.map

package/dist/a2a-server.d.ts

@@ -0,0 +1,2 @@
+import type { CreateA2AHandlerOptions } from "./a2a-types.js";
+export declare function createA2AHandler(options: CreateA2AHandlerOptions): (request: Request) => Promise<Response>;