@axiom-lattice/gateway 6.1.0 → 8.0.0

package/dist/a2a-standard-VL5I7B4W.mjs

@@ -0,0 +1,4188 @@
+import {
+  buildAgentCardForAssistant,
+  deriveAgentSkills
+} from "./chunk-W3YH4S6G.mjs";
+import {
+  formatFileRefsSection,
+  getRunCancelRouter,
+  resolveRunTaskMaxActivePerTenant,
+  saveProjectFile,
+  wakeRunTaskQueue
+} from "./chunk-2SR4F3ZD.mjs";
+import {
+  A2AAuthError
+} from "./chunk-GPHOYR3X.mjs";
+import "./chunk-NFEGQTCC.mjs";
+
+// src/routes/a2a-standard.ts
+import { v4 as uuidv42 } from "uuid";
+import {
+  A2AError as A2AError3,
+  DefaultExecutionEventBus as DefaultExecutionEventBus2,
+  DefaultRequestHandler,
+  JsonRpcTransportHandler,
+  RequestContext
+} from "@a2a-js/sdk/server";
+import { AgentCard as AgentCardV1 } from "@a2a-js/sdk-v1";
+import {
+  agentInstanceManager as agentInstanceManager2,
+  ChunkCursorExpiredError,
+  chunkBufferStreamKey,
+  createTaskLifecycleService,
+  getChunkBuffer,
+  getStoreLattice
+} from "@axiom-lattice/core";
+import { MessageChunkTypes as MessageChunkTypes3 } from "@axiom-lattice/protocols";
+
+// src/services/a2a/A2AAgentCardBuilderV1.ts
+function buildAgentCardForAssistantV1(params) {
+  const { assistant, baseUrl } = params;
+  const v1Url = `${baseUrl}/a2a/v1/${assistant.id}`;
+  const v03Url = `${baseUrl}/a2a/${assistant.id}`;
+  const skills = deriveAgentSkills(assistant).map((skill) => ({
+    ...skill,
+    tags: skill.tags ?? [],
+    examples: skill.examples ?? [],
+    inputModes: [],
+    outputModes: [],
+    securityRequirements: []
+  }));
+  return {
+    name: assistant.name,
+    description: assistant.description ?? "",
+    supportedInterfaces: [
+      {
+        url: v1Url,
+        protocolBinding: "JSONRPC",
+        tenant: "",
+        protocolVersion: "1.0"
+      },
+      {
+        url: v03Url,
+        protocolBinding: "JSONRPC",
+        tenant: "",
+        protocolVersion: "0.3"
+      }
+    ],
+    provider: void 0,
+    version: "1.0.0",
+    capabilities: {
+      streaming: true,
+      pushNotifications: params.pushNotifications ?? true,
+      extensions: [
+        {
+          uri: "https://axiom-lattice.dev/a2a/extensions/push-notifications-experimental",
+          description: "Push notifications are experimental and best-effort. Delivery is at-most-once; clients should poll tasks/get or use SubscribeToTask for reliability.",
+          required: false,
+          params: {
+            experimental: true,
+            reliable: false,
+            delivery: "at-most-once"
+          }
+        }
+      ],
+      extendedAgentCard: true
+    },
+    securitySchemes: {
+      bearer: {
+        scheme: {
+          $case: "httpAuthSecurityScheme",
+          value: {
+            scheme: "Bearer",
+            description: "API key sent as an Authorization Bearer token",
+            bearerFormat: ""
+          }
+        }
+      },
+      apiKeyHeader: {
+        scheme: {
+          $case: "apiKeySecurityScheme",
+          value: {
+            location: "header",
+            name: "x-api-key",
+            description: "API key sent via the x-api-key header"
+          }
+        }
+      }
+    },
+    securityRequirements: [
+      { schemes: { bearer: { list: [] } } },
+      { schemes: { apiKeyHeader: { list: [] } } }
+    ],
+    defaultInputModes: ["text"],
+    defaultOutputModes: ["text"],
+    skills,
+    signatures: []
+  };
+}
+
+// src/services/a2a/a2aV1Wire.ts
+var V1_TO_V03_METHOD = {
+  SendMessage: "message/send",
+  SendStreamingMessage: "message/stream",
+  GetTask: "tasks/get",
+  ListTasks: "tasks/list",
+  CancelTask: "tasks/cancel",
+  SubscribeToTask: "tasks/resubscribe",
+  CreateTaskPushNotificationConfig: "tasks/pushNotificationConfig/set",
+  GetTaskPushNotificationConfig: "tasks/pushNotificationConfig/get",
+  ListTaskPushNotificationConfigs: "tasks/pushNotificationConfig/list",
+  DeleteTaskPushNotificationConfig: "tasks/pushNotificationConfig/delete",
+  GetExtendedAgentCard: "agent/getAuthenticatedExtendedCard"
+};
+var V1_TO_V03_STATE = {
+  TASK_STATE_SUBMITTED: "submitted",
+  TASK_STATE_WORKING: "working",
+  TASK_STATE_COMPLETED: "completed",
+  TASK_STATE_FAILED: "failed",
+  TASK_STATE_CANCELED: "canceled",
+  TASK_STATE_INPUT_REQUIRED: "input-required",
+  TASK_STATE_REJECTED: "rejected",
+  TASK_STATE_AUTH_REQUIRED: "auth-required",
+  TASK_STATE_UNSPECIFIED: "unknown"
+};
+var V03_TO_V1_STATE = {
+  submitted: "TASK_STATE_SUBMITTED",
+  working: "TASK_STATE_WORKING",
+  completed: "TASK_STATE_COMPLETED",
+  failed: "TASK_STATE_FAILED",
+  canceled: "TASK_STATE_CANCELED",
+  "input-required": "TASK_STATE_INPUT_REQUIRED",
+  rejected: "TASK_STATE_REJECTED",
+  "auth-required": "TASK_STATE_AUTH_REQUIRED",
+  unknown: "TASK_STATE_UNSPECIFIED"
+};
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function asString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : void 0;
+}
+function withMetadata(value, metadata) {
+  return typeof metadata === "object" && metadata !== null && !Array.isArray(metadata) ? { ...value, metadata } : value;
+}
+function v1TaskStateTo03(value) {
+  if (typeof value !== "string") return "unknown";
+  return V1_TO_V03_STATE[value] ?? value;
+}
+function v03TaskStateToV1(value) {
+  if (typeof value !== "string") return "TASK_STATE_UNSPECIFIED";
+  return V03_TO_V1_STATE[value] ?? "TASK_STATE_UNSPECIFIED";
+}
+function toV03Part(part) {
+  const record = asRecord(part);
+  if (!record) return void 0;
+  if (typeof record.text === "string") {
+    return withMetadata({ kind: "text", text: record.text }, record.metadata);
+  }
+  if (typeof record.raw === "string") {
+    return withMetadata({
+      kind: "file",
+      file: {
+        bytes: record.raw,
+        ...typeof record.mediaType === "string" ? { mimeType: record.mediaType } : {},
+        ...typeof record.filename === "string" ? { name: record.filename } : {}
+      }
+    }, record.metadata);
+  }
+  if (typeof record.url === "string") {
+    return withMetadata({
+      kind: "file",
+      file: {
+        uri: record.url,
+        ...typeof record.mediaType === "string" ? { mimeType: record.mediaType } : {},
+        ...typeof record.filename === "string" ? { name: record.filename } : {}
+      }
+    }, record.metadata);
+  }
+  if ("data" in record) {
+    return withMetadata({ kind: "data", data: record.data }, record.metadata);
+  }
+  if (record.kind === "text" && typeof record.text === "string") {
+    return withMetadata({ kind: "text", text: record.text }, record.metadata);
+  }
+  if (record.kind === "file") {
+    const file = asRecord(record.file);
+    if (!file) return void 0;
+    return withMetadata({ kind: "file", file }, record.metadata);
+  }
+  if (record.kind === "data") {
+    return withMetadata({ kind: "data", data: record.data }, record.metadata);
+  }
+  return void 0;
+}
+function toV1Part(part) {
+  if (part.kind === "text") {
+    return withMetadata({ text: part.text }, part.metadata);
+  }
+  if (part.kind === "data") {
+    return withMetadata({ data: part.data }, part.metadata);
+  }
+  const file = part.file;
+  const base = "uri" in file ? {
+    url: file.uri,
+    ...file.mimeType ? { mediaType: file.mimeType } : {},
+    ...file.name ? { filename: file.name } : {}
+  } : {
+    raw: file.bytes,
+    ...file.mimeType ? { mediaType: file.mimeType } : {},
+    ...file.name ? { filename: file.name } : {}
+  };
+  return withMetadata(base, part.metadata);
+}
+function v1RoleTo03(value) {
+  if (value === "ROLE_USER" || value === "user" || value === 1) return "user";
+  return "agent";
+}
+function v03RoleToV1(value) {
+  return value === "user" ? "ROLE_USER" : "ROLE_AGENT";
+}
+function toV03Message(value) {
+  const record = asRecord(value);
+  if (!record) return void 0;
+  const parts = (asArray(record.parts) ?? []).map(toV03Part).filter((part) => part !== void 0);
+  return {
+    kind: "message",
+    messageId: asString(record.messageId) ?? "",
+    role: v1RoleTo03(record.role),
+    parts,
+    ...asString(record.contextId) ? { contextId: asString(record.contextId) } : {},
+    ...asString(record.taskId) ? { taskId: asString(record.taskId) } : {},
+    ...typeof record.metadata === "object" && record.metadata !== null ? { metadata: record.metadata } : {},
+    ...asArray(record.extensions) ? { extensions: record.extensions } : {},
+    ...asArray(record.referenceTaskIds) ? { referenceTaskIds: record.referenceTaskIds } : {}
+  };
+}
+function toV1Message(message) {
+  return {
+    messageId: message.messageId,
+    ...message.contextId ? { contextId: message.contextId } : {},
+    ...message.taskId ? { taskId: message.taskId } : {},
+    role: v03RoleToV1(message.role),
+    parts: message.parts.map(toV1Part),
+    ...message.metadata ? { metadata: message.metadata } : {},
+    ...message.extensions?.length ? { extensions: message.extensions } : {},
+    ...message.referenceTaskIds?.length ? { referenceTaskIds: message.referenceTaskIds } : {}
+  };
+}
+function toV03Status(value) {
+  const record = asRecord(value);
+  if (!record) return void 0;
+  return {
+    state: v1TaskStateTo03(record.state),
+    ...asRecord(record.message) ? { message: toV03Message(record.message) } : {},
+    ...asString(record.timestamp) ? { timestamp: asString(record.timestamp) } : {}
+  };
+}
+function toV1Status(status) {
+  return {
+    state: v03TaskStateToV1(status.state),
+    ...status.message ? { message: toV1Message(status.message) } : {},
+    ...status.timestamp ? { timestamp: status.timestamp } : {}
+  };
+}
+function toV03Artifact(value) {
+  const record = asRecord(value);
+  if (!record) return void 0;
+  const parts = (asArray(record.parts) ?? []).map(toV03Part).filter((part) => part !== void 0);
+  return {
+    artifactId: asString(record.artifactId) ?? "",
+    ...asString(record.name) ? { name: asString(record.name) } : {},
+    ...asString(record.description) ? { description: asString(record.description) } : {},
+    parts,
+    ...typeof record.metadata === "object" && record.metadata !== null ? { metadata: record.metadata } : {}
+  };
+}
+function toV1Artifact(artifact) {
+  return {
+    artifactId: artifact.artifactId,
+    ...artifact.name ? { name: artifact.name } : {},
+    ...artifact.description ? { description: artifact.description } : {},
+    parts: artifact.parts.map(toV1Part),
+    ...artifact.metadata ? { metadata: artifact.metadata } : {}
+  };
+}
+function toV03Task(value) {
+  const record = asRecord(value);
+  if (!record) return void 0;
+  const status = toV03Status(record.status);
+  if (!status) return void 0;
+  const rawArtifacts = asArray(record.artifacts);
+  const rawHistory = asArray(record.history);
+  return {
+    kind: "task",
+    id: asString(record.id) ?? "",
+    contextId: asString(record.contextId) ?? "",
+    status,
+    ...rawArtifacts ? {
+      artifacts: rawArtifacts.map(toV03Artifact).filter((artifact) => artifact !== void 0)
+    } : {},
+    ...rawHistory ? {
+      history: rawHistory.map(toV03Message).filter((message) => message !== void 0)
+    } : {},
+    ...typeof record.metadata === "object" && record.metadata !== null ? { metadata: record.metadata } : {}
+  };
+}
+function toV1Task(task) {
+  return {
+    id: task.id,
+    contextId: task.contextId,
+    status: toV1Status(task.status),
+    ...task.artifacts?.length ? { artifacts: task.artifacts.map(toV1Artifact) } : {},
+    ...task.history?.length ? { history: task.history.map(toV1Message) } : {},
+    ...task.metadata ? { metadata: task.metadata } : {}
+  };
+}
+function toV03PushConfig(value) {
+  const record = asRecord(value);
+  if (!record) return void 0;
+  const authentication = asRecord(record.authentication);
+  return {
+    ...asString(record.id) ? { id: asString(record.id) } : {},
+    url: asString(record.url) ?? "",
+    ...asString(record.token) ? { token: asString(record.token) } : {},
+    ...authentication ? {
+      authentication: {
+        ...asString(authentication.scheme) ? { schemes: [authentication.scheme] } : {},
+        ...asString(authentication.credentials) ? { credentials: authentication.credentials } : {}
+      }
+    } : {}
+  };
+}
+function toV1PushConfig(value) {
+  const record = asRecord(value);
+  if (!record) return void 0;
+  const config = asRecord(record.pushNotificationConfig) ?? record;
+  const authentication = asRecord(config.authentication);
+  const schemes = asArray(authentication?.schemes);
+  return {
+    ...asString(record.taskId) ? { taskId: asString(record.taskId) } : {},
+    ...asString(config.id) ? { id: asString(config.id) } : {},
+    ...asString(config.url) ? { url: asString(config.url) } : {},
+    ...asString(config.token) ? { token: asString(config.token) } : {},
+    ...schemes?.[0] || asString(authentication?.credentials) ? {
+      authentication: {
+        ...typeof schemes?.[0] === "string" ? { scheme: schemes[0] } : {},
+        ...asString(authentication?.credentials) ? { credentials: asString(authentication?.credentials) } : {}
+      }
+    } : {}
+  };
+}
+function convertParams(method, params) {
+  const record = asRecord(params);
+  if (!record) return params;
+  if (method === "SendMessage" || method === "SendStreamingMessage") {
+    const configuration = asRecord(record.configuration);
+    const push = asRecord(configuration?.taskPushNotificationConfig);
+    return {
+      ...asRecord(record.message) ? { message: toV03Message(record.message) } : {},
+      ...configuration ? {
+        configuration: {
+          ...asArray(configuration.acceptedOutputModes) ? { acceptedOutputModes: configuration.acceptedOutputModes } : {},
+          blocking: configuration.returnImmediately !== true,
+          ...typeof configuration.historyLength === "number" ? { historyLength: configuration.historyLength } : {},
+          ...push ? { pushNotificationConfig: toV03PushConfig(push) } : {}
+        }
+      } : {},
+      ...typeof record.metadata === "object" && record.metadata !== null ? { metadata: record.metadata } : {}
+    };
+  }
+  if (method === "ListTasks") {
+    return {
+      ...asString(record.contextId) ? { contextId: asString(record.contextId) } : {},
+      ...record.status !== void 0 ? { status: v1TaskStateTo03(record.status) } : {},
+      ...typeof record.pageSize === "number" ? { pageSize: record.pageSize } : {},
+      ...asString(record.pageToken) ? { pageToken: asString(record.pageToken) } : {},
+      ...typeof record.historyLength === "number" ? { historyLength: record.historyLength } : {},
+      ...asString(record.statusTimestampAfter) ? { statusTimestampAfter: asString(record.statusTimestampAfter) } : {},
+      ...typeof record.includeArtifacts === "boolean" ? { includeArtifacts: record.includeArtifacts } : {}
+    };
+  }
+  if (method === "CreateTaskPushNotificationConfig") {
+    const config = toV03PushConfig(record);
+    return {
+      taskId: asString(record.taskId) ?? "",
+      ...config ? { pushNotificationConfig: config } : {}
+    };
+  }
+  if (method === "GetTaskPushNotificationConfig") {
+    return {
+      id: asString(record.taskId) ?? "",
+      ...asString(record.id) ? { pushNotificationConfigId: asString(record.id) } : {}
+    };
+  }
+  if (method === "ListTaskPushNotificationConfigs" || method === "DeleteTaskPushNotificationConfig") {
+    return {
+      id: asString(record.taskId) ?? "",
+      ...asString(record.id) ? { pushNotificationConfigId: asString(record.id) } : {}
+    };
+  }
+  return record;
+}
+function toA2A03JsonRpcRequest(body) {
+  const record = asRecord(body);
+  const method = asString(record?.method);
+  if (!record || !method) return body;
+  const mapped = V1_TO_V03_METHOD[method];
+  if (!mapped) return body;
+  return {
+    ...record,
+    method: mapped,
+    params: convertParams(method, record.params)
+  };
+}
+function toA2A11Result(value, method) {
+  const record = asRecord(value);
+  if (!record) return value;
+  if (record.kind === "task") {
+    const task = toV03Task(record);
+    return task ? toV1Task(task) : value;
+  }
+  if (record.kind === "message") {
+    const message = toV03Message(record);
+    return message ? toV1Message(message) : value;
+  }
+  if (method === "CreateTaskPushNotificationConfig" || method === "GetTaskPushNotificationConfig") {
+    return toV1PushConfig(record);
+  }
+  return value;
+}
+function toA2A11StreamResult(event) {
+  const record = asRecord(event);
+  if (!record) return event;
+  if (record.kind === "task") {
+    const task = toV03Task(record);
+    return task ? { task: toV1Task(task) } : event;
+  }
+  if (record.kind === "message") {
+    const message = toV03Message(record);
+    return message ? { message: toV1Message(message) } : event;
+  }
+  if (record.kind === "status-update") {
+    const status = toV03Status(record.status);
+    return {
+      statusUpdate: {
+        taskId: asString(record.taskId) ?? "",
+        contextId: asString(record.contextId) ?? "",
+        ...status ? { status: toV1Status(status) } : {},
+        ...typeof record.metadata === "object" && record.metadata !== null ? { metadata: record.metadata } : {}
+      }
+    };
+  }
+  if (record.kind === "artifact-update") {
+    const artifact = toV03Artifact(record.artifact);
+    return {
+      artifactUpdate: {
+        taskId: asString(record.taskId) ?? "",
+        contextId: asString(record.contextId) ?? "",
+        ...artifact ? { artifact: toV1Artifact(artifact) } : {},
+        ...record.append === true ? { append: true } : {},
+        ...record.lastChunk === true ? { lastChunk: true } : {},
+        ...typeof record.metadata === "object" && record.metadata !== null ? { metadata: record.metadata } : {}
+      }
+    };
+  }
+  return event;
+}
+function toA2A11ListResult(value, options = {}) {
+  const record = asRecord(value);
+  const tasks = asArray(record?.tasks) ?? [];
+  return {
+    tasks: tasks.map(toV03Task).filter((task) => task !== void 0).map((task) => {
+      const converted = toV1Task(task);
+      if (options.includeArtifacts !== true) delete converted.artifacts;
+      return converted;
+    }),
+    ...asString(record?.nextPageToken) ? { nextPageToken: asString(record?.nextPageToken) } : {}
+  };
+}
+function toA2A11PushListResult(value) {
+  const configs = asArray(value) ?? [];
+  return {
+    configs: configs.map(toV1PushConfig).filter((config) => config !== void 0)
+  };
+}
+function versionNotSupportedError(id, version) {
+  return {
+    jsonrpc: "2.0",
+    id: id ?? null,
+    error: {
+      code: -32009,
+      message: `The requested A2A protocol version '${version}' is not supported. Supported versions: 1.0`
+    }
+  };
+}
+
+// src/services/a2a/A2APushNotificationStore.ts
+import { decrypt, encrypt } from "@axiom-lattice/core";
+
+// src/services/a2a/A2APushNotificationUrl.ts
+import { lookup } from "dns/promises";
+import { A2AError } from "@a2a-js/sdk/server";
+import { assertSafeUpstreamUrl } from "@axiom-lattice/core";
+var defaultA2APushHostResolver = async (hostname) => {
+  const records = await lookup(hostname, { all: true });
+  return records.map((record) => ({
+    address: record.address,
+    family: record.family
+  }));
+};
+function normalizeHost(value) {
+  return value.trim().toLowerCase().replace(/^\[/, "").replace(/\]$/, "").replace(/\.$/, "").split("%")[0] ?? "";
+}
+function ipv4Parts(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) return null;
+  const parts = match.slice(1).map(Number);
+  return parts.every((part) => part >= 0 && part <= 255) ? parts : null;
+}
+function isReservedIpv4(hostname) {
+  const parts = ipv4Parts(hostname);
+  if (!parts) return false;
+  const [a, b, c] = parts;
+  if (a === 0 || a === 10 || a === 127) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 0 && c === 0) return true;
+  if (a === 192 && b === 0 && c === 2) return true;
+  if (a === 192 && b === 88 && c === 99) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 198 && b === 51 && c === 100) return true;
+  if (a === 203 && b === 0 && c === 113) return true;
+  return a >= 224;
+}
+function isReservedIpv6(hostname) {
+  const host = normalizeHost(hostname);
+  if (!host.includes(":")) return false;
+  if (host.startsWith("::")) return true;
+  if (host.startsWith("fc") || host.startsWith("fd")) return true;
+  if (/^fe[89ab]/.test(host)) return true;
+  if (/^fec[0-9a-f]/.test(host)) return true;
+  if (host.startsWith("ff")) return true;
+  if (host.startsWith("100:")) return true;
+  if (host.startsWith("2001:db8")) return true;
+  return false;
+}
+function isBlockedPushAddress(address) {
+  const host = normalizeHost(address);
+  if (ipv4Parts(host)) return isReservedIpv4(host);
+  if (!host.includes(":")) return true;
+  return isReservedIpv6(host);
+}
+function isBlockedHostname(hostname) {
+  const host = normalizeHost(hostname);
+  if (host === "localhost" || host === "localhost.localdomain" || host.endsWith(".localhost") || host === "ip6-localhost" || host === "ip6-loopback") {
+    return true;
+  }
+  if (host === "metadata" || host === "metadata.google.internal" || host === "metadata.google.com" || host === "instance-data" || host === "instance-data.ec2.internal") {
+    return true;
+  }
+  return isReservedIpv4(host) || isReservedIpv6(host);
+}
+function toHostAddress(value) {
+  if (typeof value === "string") {
+    return { address: value, family: value.includes(":") ? 6 : 4 };
+  }
+  if (typeof value !== "object" || value === null) return null;
+  const record = value;
+  if (typeof record.address !== "string") return null;
+  return {
+    address: record.address,
+    family: typeof record.family === "number" ? record.family : record.address.includes(":") ? 6 : 4
+  };
+}
+async function assertSafePushNotificationUrl(raw, resolveHost = defaultA2APushHostResolver) {
+  let url;
+  try {
+    ({ url } = await assertSafeUpstreamUrl(raw));
+  } catch (error) {
+    throw A2AError.invalidParams(
+      error instanceof Error ? `Push notification URL is not allowed: ${error.message}` : "Push notification URL is not allowed"
+    );
+  }
+  if (url.protocol !== "https:") {
+    throw A2AError.invalidParams("Push notification URL must use HTTPS");
+  }
+  const hostname = normalizeHost(url.hostname);
+  if (isBlockedHostname(hostname)) {
+    throw A2AError.invalidParams(
+      "Push notification URL must not target a private, loopback, link-local, or metadata host"
+    );
+  }
+  let addresses;
+  try {
+    addresses = await resolveHost(hostname);
+  } catch (error) {
+    throw A2AError.invalidParams(
+      error instanceof Error ? `Push notification URL could not be resolved: ${error.message}` : "Push notification URL could not be resolved"
+    );
+  }
+  if (addresses.length === 0) {
+    throw A2AError.invalidParams("Push notification URL did not resolve");
+  }
+  const normalized = [];
+  for (const record of addresses) {
+    const resolved = toHostAddress(record);
+    if (!resolved) {
+      throw A2AError.invalidParams(
+        "Push notification URL resolved to an invalid address"
+      );
+    }
+    const address = normalizeHost(resolved.address);
+    if (isBlockedPushAddress(address)) {
+      throw A2AError.invalidParams(
+        "Push notification URL resolves to a private, loopback, link-local, or reserved address"
+      );
+    }
+    normalized.push({ address, family: resolved.family });
+  }
+  return { url, addresses: normalized };
+}
+
+// src/services/a2a/A2APushNotificationStore.ts
+var NAMESPACE_ROOT = "a2a-push";
+var PAGE_SIZE = 100;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeConfigId(taskId, value) {
+  if (typeof value !== "string") return taskId;
+  return value.trim() || taskId;
+}
+var A2APushNotificationStore = class {
+  constructor(options) {
+    this.store = options.store;
+    this.scope = options.scope;
+    this.resolveHost = options.resolveHost ?? defaultA2APushHostResolver;
+  }
+  namespace() {
+    return [NAMESPACE_ROOT, this.scope.tenantId, this.scope.assistantId];
+  }
+  key(taskId, configId) {
+    return `${taskId}:${configId}`;
+  }
+  async save(taskId, pushNotificationConfig) {
+    await assertSafePushNotificationUrl(
+      pushNotificationConfig.url,
+      this.resolveHost
+    );
+    const configId = normalizeConfigId(taskId, pushNotificationConfig.id);
+    const value = {
+      taskId,
+      configId,
+      url: pushNotificationConfig.url
+    };
+    const token = pushNotificationConfig.token;
+    if (typeof token === "string" && token.length > 0) {
+      value.tokenEnc = encrypt(token);
+    }
+    const authentication = pushNotificationConfig.authentication;
+    if (authentication) {
+      const schemes = Array.isArray(authentication.schemes) ? authentication.schemes.filter((scheme) => typeof scheme === "string") : [];
+      const storedAuth = { schemes };
+      if (typeof authentication.credentials === "string" && authentication.credentials.length > 0) {
+        storedAuth.credentialsEnc = encrypt(authentication.credentials);
+      }
+      value.authentication = storedAuth;
+    }
+    await this.store.put(this.scope.tenantId, {
+      namespace: this.namespace(),
+      key: this.key(taskId, configId),
+      value
+    });
+  }
+  async load(taskId) {
+    const prefix = `${taskId}:`;
+    const items = await this.searchTask(taskId);
+    const configs = [];
+    for (const item of items) {
+      if (!item.key.startsWith(prefix)) continue;
+      try {
+        configs.push(await this.parse(item, taskId));
+      } catch (error) {
+        console.warn(
+          `[a2a] skipping invalid push notification config "${item.key}"`,
+          error
+        );
+      }
+    }
+    return configs.sort((left, right) => (left.id ?? "").localeCompare(right.id ?? ""));
+  }
+  /**
+   * Read every config for a task. The generic store limit is only a page size;
+   * this walks offsets so a task with more than 1000 configs is never truncated.
+   */
+  async searchTask(taskId) {
+    const items = [];
+    let offset = 0;
+    for (; ; ) {
+      const page = await this.store.search(this.scope.tenantId, {
+        namespacePrefix: this.namespace(),
+        filter: { taskId },
+        limit: PAGE_SIZE,
+        offset
+      });
+      items.push(...page);
+      if (page.length < PAGE_SIZE) return items;
+      offset += page.length;
+    }
+  }
+  async parse(item, taskId) {
+    const value = item.value;
+    if (typeof value.url !== "string") {
+      throw new Error("stored config has no URL");
+    }
+    await assertSafePushNotificationUrl(value.url, this.resolveHost);
+    const configId = normalizeConfigId(
+      taskId,
+      typeof value.configId === "string" ? value.configId : item.key.slice(taskId.length + 1)
+    );
+    const config = { id: configId, url: value.url };
+    if (typeof value.tokenEnc === "string" && value.tokenEnc.length > 0) {
+      config.token = decrypt(value.tokenEnc);
+    }
+    if (isRecord(value.authentication)) {
+      const schemes = Array.isArray(value.authentication.schemes) ? value.authentication.schemes.filter(
+        (scheme) => typeof scheme === "string"
+      ) : [];
+      const authentication = {
+        schemes
+      };
+      if (typeof value.authentication.credentialsEnc === "string" && value.authentication.credentialsEnc.length > 0) {
+        authentication.credentials = decrypt(value.authentication.credentialsEnc);
+      }
+      config.authentication = authentication;
+    }
+    return config;
+  }
+  /**
+   * Delete one config. The SDK always supplies a config id; when it is omitted
+   * the default config is `${taskId}:${taskId}` (not every config for the task).
+   */
+  async delete(taskId, configId) {
+    await this.store.delete(
+      this.scope.tenantId,
+      this.namespace(),
+      this.key(taskId, normalizeConfigId(taskId, configId))
+    );
+  }
+};
+
+// src/services/a2a/A2APushNotificationSender.ts
+import { request as httpsRequest } from "https";
+var DEFAULT_TIMEOUT_MS = 5e3;
+var TOKEN_HEADER = "X-A2A-Notification-Token";
+function withTimeout(promise, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error("Push notification request timed out"));
+    }, timeoutMs);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error) => {
+        clearTimeout(timer);
+        reject(error);
+      }
+    );
+  });
+}
+function createPinnedLookup(address, family) {
+  return (_hostname, options, callback) => {
+    if (options?.all) {
+      callback(null, [{ address, family }]);
+      return;
+    }
+    callback(null, address, family);
+  };
+}
+function createPinnedHttpsRequester() {
+  return ({ url, addresses, headers, body, timeoutMs }) => new Promise((resolve, reject) => {
+    const pinned = addresses[0];
+    if (!pinned) {
+      reject(new Error("No validated push notification address"));
+      return;
+    }
+    const parsed = new URL(url);
+    const family = pinned.includes(":") ? 6 : 4;
+    const request = httpsRequest(parsed, {
+      method: "POST",
+      agent: false,
+      headers: {
+        ...headers,
+        "Content-Length": Buffer.byteLength(body)
+      },
+      lookup: createPinnedLookup(pinned, family),
+      servername: parsed.hostname
+    }, (response) => {
+      response.resume();
+      resolve({ statusCode: response.statusCode ?? 0 });
+    });
+    const timeout = setTimeout(() => {
+      request.destroy(new Error("Push notification request timed out"));
+    }, timeoutMs);
+    request.on("close", () => clearTimeout(timeout));
+    request.on("error", (error) => {
+      clearTimeout(timeout);
+      reject(error);
+    });
+    request.end(body);
+  });
+}
+var A2APushNotificationSender = class {
+  constructor(options) {
+    this.store = options.store;
+    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.request = options.request ?? createPinnedHttpsRequester();
+    this.resolveHost = options.resolveHost ?? defaultA2APushHostResolver;
+    this.logger = options.logger;
+  }
+  async send(task) {
+    let configs;
+    try {
+      configs = await this.store.load(task.id);
+    } catch (error) {
+      this.logger?.error?.(
+        `[a2a] failed to load push notification configs for task ${task.id}`,
+        error
+      );
+      return;
+    }
+    if (!configs || configs.length === 0) return;
+    await Promise.all(configs.map(async (config) => {
+      await this.deliver(task, config);
+    }));
+  }
+  async deliver(task, config) {
+    let target;
+    try {
+      target = await assertSafePushNotificationUrl(config.url, this.resolveHost);
+    } catch (error) {
+      this.logger?.warn?.(
+        `[a2a] skipping unsafe push notification URL for task ${task.id}`,
+        error
+      );
+      return;
+    }
+    try {
+      const headers = {
+        "Content-Type": "application/json"
+      };
+      if (config.token) {
+        headers[TOKEN_HEADER] = config.token;
+      }
+      const authentication = config.authentication;
+      if (authentication?.credentials) {
+        const schemes = authentication.schemes.map((scheme) => scheme.toLowerCase());
+        if (schemes.includes("bearer")) {
+          headers.Authorization = `Bearer ${authentication.credentials}`;
+        } else if (schemes.includes("basic")) {
+          headers.Authorization = `Basic ${authentication.credentials}`;
+        }
+      }
+      const response = await withTimeout(this.request({
+        url: target.url.toString(),
+        addresses: target.addresses.map((record) => record.address),
+        headers,
+        body: JSON.stringify(task),
+        timeoutMs: this.timeoutMs
+      }), this.timeoutMs);
+      if (response.statusCode < 200 || response.statusCode >= 300) {
+        throw new Error(
+          `Push notification endpoint returned HTTP ${response.statusCode}`
+        );
+      }
+    } catch (error) {
+      this.logger?.error?.(
+        `[a2a] push notification failed for task ${task.id} to ${config.url}`,
+        error
+      );
+    }
+  }
+};
+
+// src/services/a2a/A2ATaskStoreAdapter.ts
+import { createHash } from "crypto";
+import { isDeepStrictEqual } from "util";
+import {
+  createTaskRunBridge
+} from "@axiom-lattice/core";
+var TASK_STATUS_TO_A2A_STATE = {
+  pending: "submitted",
+  in_progress: "working",
+  review: "input-required",
+  interrupted: "input-required",
+  completed: "completed",
+  failed: "failed",
+  cancelled: "canceled"
+};
+var TITLE_MAX_LENGTH = 80;
+var A2ATaskScopeConflictError = class extends Error {
+  constructor(taskId) {
+    super(`A2A task ${taskId} belongs to another scope`);
+    this.code = "A2A_TASK_SCOPE_CONFLICT";
+    this.name = "A2ATaskScopeConflictError";
+    this.taskId = taskId;
+  }
+};
+function mapTaskStatusToA2AState(status) {
+  return TASK_STATUS_TO_A2A_STATE[status];
+}
+function asString2(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function asRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function asStringArray(value) {
+  if (!Array.isArray(value)) return void 0;
+  const strings = value.filter((item) => typeof item === "string");
+  return strings.length > 0 ? strings : void 0;
+}
+function extractText(parts) {
+  return parts.filter((part) => part.kind === "text").map((part) => part.text).join("\n");
+}
+function truncate(text, maxLength) {
+  if (text.length <= maxLength) return text;
+  return `${text.slice(0, maxLength)}\u2026`;
+}
+function extractTitleAndDescription(task) {
+  const firstUserMessage = task.history?.find((message) => message.role === "user");
+  const text = firstUserMessage ? extractText(firstUserMessage.parts) : "";
+  return {
+    title: truncate(text, TITLE_MAX_LENGTH),
+    description: text ? [
+      "## Objective",
+      "",
+      text,
+      "",
+      "## Acceptance Criteria",
+      "",
+      "Complete the requested work and return the result through A2A."
+    ].join("\n") : ""
+  };
+}
+function isFileRef(value) {
+  return typeof value === "object" && value !== null && typeof value.uri === "string";
+}
+function artifactFileRefs(artifacts) {
+  const refs = [];
+  for (const artifact of artifacts ?? []) {
+    for (const part of artifact.parts) {
+      if (part.kind !== "file") continue;
+      const file = part.file;
+      if (!("uri" in file)) continue;
+      refs.push({
+        uri: file.uri,
+        ...file.name ? { name: file.name } : {},
+        ...file.mimeType ? { mimeType: file.mimeType } : {},
+        addedBy: "agent"
+      });
+    }
+  }
+  return refs;
+}
+function extractFiles(task) {
+  const inputFiles = task.metadata?.inputFiles;
+  const inputRefs = Array.isArray(inputFiles) ? inputFiles.filter(isFileRef) : [];
+  return [...inputRefs, ...artifactFileRefs(task.artifacts)];
+}
+function extractArtifactText(artifacts) {
+  return (artifacts ?? []).map((artifact) => extractText(artifact.parts)).filter((text) => text.length > 0).join("\n");
+}
+function extractFinalTurnAgentText(history) {
+  const messages = history ?? [];
+  let lastUserIndex = -1;
+  for (let i = 0; i < messages.length; i += 1) {
+    if (messages[i].role === "user") lastUserIndex = i;
+  }
+  return messages.slice(lastUserIndex + 1).filter((message) => message.role === "agent").map((message) => extractText(message.parts)).filter((text) => text.length > 0).join("");
+}
+function isFailureState(state) {
+  return state === "failed" || state === "rejected";
+}
+function extractFailureReason(task) {
+  if (!isFailureState(task.status.state) || !task.status.message) return void 0;
+  return extractText(task.status.message.parts);
+}
+function observationEventKey(task, result, failureReason) {
+  const digest = createHash("sha256").update(JSON.stringify({
+    state: task.status.state,
+    timestamp: task.status.timestamp,
+    message: task.status.message,
+    result,
+    failureReason
+  })).digest("hex");
+  return `a2a-status-observation:${task.id}:${digest}`;
+}
+function snapshotEventKey(task) {
+  const digest = createHash("sha256").update(JSON.stringify(task)).digest("hex");
+  return `a2a-task-snapshot:${task.id}:${digest}`;
+}
+function isGovernedObservation(state) {
+  return state === "completed" || state === "failed" || state === "rejected" || state === "input-required" || state === "canceled";
+}
+function isA2ATaskSnapshot(value) {
+  return typeof value === "object" && value !== null && typeof value.id === "string" && typeof value.status === "object" && value.status !== null;
+}
+function snapshotSequence(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
+var A2ATaskStoreAdapter = class {
+  constructor(options) {
+    this.snapshotSequences = /* @__PURE__ */ new Map();
+    this.taskStore = options.taskStore;
+    this.workItemStore = options.workItemStore;
+    this.lifecycle = options.lifecycle;
+    this.scope = options.scope;
+    this.runBridge = createTaskRunBridge({
+      lifecycle: this.lifecycle,
+      taskStore: this.taskStore,
+      workItemStore: this.workItemStore
+    });
+  }
+  /**
+   * Persist an SDK task by projecting it onto a `TaskItem`, creating it when
+   * the id is unseen or updating it otherwise. A full snapshot of the SDK task
+   * is stored under `context.a2aTask` so `load` can restore it.
+   */
+  async save(task) {
+    let lastError;
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      try {
+        return await this.saveOnce(task);
+      } catch (error) {
+        lastError = error;
+        if (!isA2AConcurrentWrite(error) || attempt === 2) throw error;
+        await new Promise((resolve) => setTimeout(resolve, 10 * (attempt + 1)));
+      }
+    }
+    throw lastError;
+  }
+  async saveOnce(task) {
+    const { tenantId } = this.scope;
+    const { title, description } = extractTitleAndDescription(task);
+    const files = extractFiles(task);
+    const result = task.status.state === "completed" ? extractArtifactText(task.artifacts) || extractFinalTurnAgentText(task.history) : void 0;
+    const failureReason = extractFailureReason(task);
+    const a2aRunId = asString2(task.metadata?.a2aRunId) ?? asString2(task.metadata?.runId);
+    const context = {
+      a2aContextId: task.contextId,
+      ...a2aRunId ? { a2aRunId } : {},
+      threadId: asString2(task.metadata?.threadId),
+      a2aTask: task
+    };
+    let existing = await this.taskStore.getById(tenantId, task.id);
+    if (existing) {
+      this.requireScope(existing, task.id);
+      await this.recordSnapshot(task, existing);
+      existing = await this.persistRunLink(existing, context, a2aRunId, task);
+    } else {
+      try {
+        existing = await this.taskStore.create({
+          id: task.id,
+          tenantId,
+          ownerType: "agent",
+          ownerId: this.scope.assistantId,
+          projectId: this.scope.projectId,
+          ...this.scope.workspaceId ? { workspaceId: this.scope.workspaceId } : {},
+          title,
+          description,
+          sourceId: "a2a",
+          status: "pending",
+          priority: "medium",
+          dependencies: asStringArray(task.metadata?.dependencies),
+          files,
+          context
+        });
+      } catch (error) {
+        existing = await this.taskStore.getById(tenantId, task.id);
+        if (!existing) throw error;
+        this.requireScope(existing, task.id);
+      }
+      await this.recordSnapshot(task, existing);
+    }
+    const actor = `a2a:${this.scope.assistantId}`;
+    const threadId = asString2(task.metadata?.threadId);
+    if (task.status.state === "working") {
+      existing = await this.refresh(existing);
+      const resumesInterruption = existing.status === "interrupted" && task.metadata?.a2aResume === true;
+      if (existing.status === "pending" || resumesInterruption) {
+        await this.requireLifecycleSuccess("start", task.id, await this.runBridge.beginRun({
+          tenantId,
+          task: existing,
+          actor,
+          ...threadId ? { threadId } : {}
+        }));
+      }
+      return;
+    }
+    if (!isGovernedObservation(task.status.state)) return;
+    existing = await this.refresh(existing);
+    await this.recordObservation(task, existing, result, failureReason);
+    if (["completed", "failed", "cancelled"].includes(existing.status)) return;
+    if (task.status.state === "input-required" && this.isExactInterruptionReplay(task, existing)) return;
+    if (task.status.state === "completed" && existing.status === "interrupted") {
+      const resumed = await this.lifecycle.resumeInterruption({
+        tenantId,
+        taskId: task.id,
+        actor,
+        ...threadId ? { threadId } : {}
+      });
+      await this.requireLifecycleSuccess("resume", task.id, resumed);
+      existing = await this.refresh(existing);
+    }
+    if (existing.status === "pending") {
+      const started = await this.requireLifecycleSuccess("start", task.id, await this.runBridge.beginRun({
+        tenantId,
+        task: existing,
+        actor,
+        ...threadId ? { threadId } : {}
+      }));
+      existing = started.task;
+    }
+    await this.applyObservation(task, existing, result, failureReason);
+  }
+  /** Re-read the canonical task immediately before a lifecycle write. */
+  async refresh(fallback) {
+    const current = await this.taskStore.getById(this.scope.tenantId, fallback.id);
+    if (!current) return fallback;
+    this.requireScope(current, fallback.id);
+    return current;
+  }
+  /**
+   * Persist the A2A↔run link on an existing TaskItem without replacing
+   * service-owned context (interruption audit, lifecycle fields, snapshots).
+   */
+  async persistRunLink(item, context, a2aRunId, task) {
+    if (a2aRunId === void 0) return item;
+    const current = item.context ?? {};
+    if (current.a2aRunId === a2aRunId) return item;
+    const next = {
+      ...current,
+      a2aContextId: context.a2aContextId,
+      threadId: context.threadId,
+      a2aRunId
+    };
+    const updated = await this.taskStore.update(this.scope.tenantId, task.id, { context: next });
+    return updated ?? item;
+  }
+  /**
+   * Complete a run result through the lifecycle, resuming an interrupted
+   * TaskItem first when the run succeeded after HITL.
+   *
+   * @throws When the canonical task cannot transition (for example a review
+   * interruption that still requires explicit approval).
+   */
+  async completeRun(task, result) {
+    const { tenantId } = this.scope;
+    const actor = `a2a:${this.scope.assistantId}`;
+    const threadId = asString2(task.metadata?.threadId);
+    let item = await this.taskStore.getById(tenantId, task.id);
+    if (!item) {
+      throw new Error(`A2A completed run cannot reconcile missing task ${task.id}`);
+    }
+    if (item.status === "interrupted") {
+      const resumed = await this.lifecycle.resumeInterruption({
+        tenantId,
+        taskId: task.id,
+        actor,
+        ...threadId ? { threadId } : {}
+      });
+      if (!resumed.success) {
+        throw new Error(
+          `A2A completed run cannot resume interruption: ${resumed.code}: ${resumed.error}`
+        );
+      }
+      item = await this.taskStore.getById(tenantId, task.id);
+      if (!item) throw new Error(`A2A task ${task.id} disappeared after resume`);
+    }
+    if (item.status === "pending") {
+      const started = await this.runBridge.beginRun({
+        tenantId,
+        task: item,
+        actor,
+        ...threadId ? { threadId } : {}
+      });
+      if (!started.success) {
+        throw new Error(
+          `A2A completed run cannot start task: ${started.code}: ${started.error}`
+        );
+      }
+      item = started.task;
+    }
+    if (item.status !== "in_progress" && item.status !== "completed") {
+      throw new Error(
+        `A2A completed run cannot complete canonical ${item.status} task ${task.id}`
+      );
+    }
+    const resultArtifact = {
+      artifactId: `${task.id}:result`,
+      name: "result",
+      parts: [{ kind: "text", text: result.trim() || "(no output)" }]
+    };
+    const completed = {
+      ...task,
+      artifacts: [
+        ...(task.artifacts ?? []).filter(
+          (artifact) => artifact.artifactId !== resultArtifact.artifactId && artifact.name !== "result"
+        ),
+        resultArtifact
+      ],
+      status: { state: "completed", timestamp: (/* @__PURE__ */ new Date()).toISOString() }
+    };
+    await this.save(completed);
+    const loaded = await this.load(task.id);
+    if (!loaded || loaded.status.state !== "completed") {
+      throw new Error(`A2A task ${task.id} did not persist as completed`);
+    }
+    return loaded;
+  }
+  async recordSnapshot(task, item) {
+    const incomingSequence = snapshotSequence(task.metadata?.snapshotSequence) ?? 0;
+    const currentSequence = this.snapshotSequences.get(task.id) ?? 0;
+    const sequence = Math.max(incomingSequence, currentSequence) + 1;
+    this.snapshotSequences.set(task.id, sequence);
+    const sequencedTask = {
+      ...task,
+      metadata: { ...task.metadata ?? {}, snapshotSequence: sequence }
+    };
+    const eventKey = snapshotEventKey(sequencedTask);
+    const workspaceId = item.workspaceId ?? this.scope.workspaceId;
+    await this.workItemStore.createIfAbsentByEventKey({
+      tenantId: this.scope.tenantId,
+      taskId: task.id,
+      projectId: this.scope.projectId,
+      action: "activity",
+      actor: `a2a:${this.scope.assistantId}`,
+      summary: "A2A task snapshot",
+      detail: { type: "a2a_task_snapshot", snapshotSequence: sequence, eventKey, task: sequencedTask },
+      eventKey,
+      ...asString2(task.metadata?.threadId) ? { threadId: asString2(task.metadata?.threadId) } : {},
+      ...workspaceId ? { workspaceId } : {}
+    });
+  }
+  async recordObservation(task, item, result, failureReason) {
+    const workspaceId = item.workspaceId ?? this.scope.workspaceId;
+    await this.workItemStore.createIfAbsentByEventKey({
+      tenantId: this.scope.tenantId,
+      taskId: task.id,
+      projectId: this.scope.projectId,
+      action: "activity",
+      actor: `a2a:${this.scope.assistantId}`,
+      summary: `A2A observed ${task.status.state}`,
+      detail: {
+        type: "a2a_status_observation",
+        state: task.status.state,
+        ...result === void 0 ? {} : { result },
+        ...failureReason === void 0 ? {} : { failureReason },
+        ...task.status.message ? { message: extractText(task.status.message.parts) } : {}
+      },
+      eventKey: observationEventKey(task, result, failureReason),
+      ...asString2(task.metadata?.threadId) ? { threadId: asString2(task.metadata?.threadId) } : {},
+      ...workspaceId ? { workspaceId } : {}
+    });
+  }
+  async applyObservation(task, item, result, failureReason) {
+    const actor = `a2a:${this.scope.assistantId}`;
+    item = await this.refresh(item);
+    const threadId = asString2(task.metadata?.threadId);
+    if (task.status.state === "canceled") {
+      await this.requireLifecycleSuccess("cancel", task.id, await this.runBridge.settleRun({
+        tenantId: this.scope.tenantId,
+        task: item,
+        actor,
+        ...threadId ? { threadId } : {},
+        outcome: { kind: "cancelled", summary: "A2A observed canceled" }
+      }));
+      return;
+    }
+    if (isFailureState(task.status.state)) {
+      await this.requireLifecycleSuccess("fail", task.id, await this.runBridge.settleRun({
+        tenantId: this.scope.tenantId,
+        task: item,
+        actor,
+        ...threadId ? { threadId } : {},
+        outcome: {
+          kind: "failed",
+          lifecycleHandled: false,
+          error: failureReason?.trim() || `A2A observed ${task.status.state}`
+        }
+      }));
+      return;
+    }
+    if (task.status.state === "input-required") {
+      const observed = asRecord2(task.metadata?.interruption);
+      const observedType = asString2(observed?.type);
+      const interruptionType = observedType === "review_required" || observedType === "user_decision" ? "user_decision" : "missing_input";
+      const summary = asString2(observed?.summary) || (task.status.message ? extractText(task.status.message.parts).trim() : "") || "A2A requires input";
+      await this.requireLifecycleSuccess("interrupt", task.id, await this.lifecycle.interruptTask({
+        tenantId: this.scope.tenantId,
+        taskId: task.id,
+        type: interruptionType,
+        summary,
+        actor,
+        ...threadId ? { threadId } : {}
+      }));
+      if (observedType === "review_required" && observed) {
+        await this.preserveObservedInterruption(task.id, observed);
+      }
+      return;
+    }
+    await this.requireLifecycleSuccess("complete", task.id, await this.lifecycle.completeAgentTask({
+      tenantId: this.scope.tenantId,
+      taskId: task.id,
+      result: result?.trim() || "(no output)",
+      beliefImpact: [],
+      actor,
+      ...threadId ? { threadId } : {}
+    }));
+  }
+  /**
+   * Preserve a review interruption's canonical type/metadata after the generic
+   * lifecycle interrupt (which only models missing_input/user_decision).
+   */
+  async preserveObservedInterruption(taskId, observed) {
+    const item = await this.taskStore.getById(this.scope.tenantId, taskId);
+    if (!item) return;
+    const context = item.context ?? {};
+    const current = asRecord2(context.interruption) ?? {};
+    await this.taskStore.update(this.scope.tenantId, taskId, {
+      context: {
+        ...context,
+        interruption: { ...current, ...observed, type: "review_required" }
+      }
+    });
+  }
+  async requireLifecycleSuccess(operation, taskId, result) {
+    if (result.success) {
+      if (result.warnings?.length) {
+        console.warn({ event: "a2a:lifecycle:warnings", operation, taskId, warnings: result.warnings });
+      }
+      return result;
+    }
+    throw new Error(`A2A lifecycle ${operation} failed: ${result.code}: ${result.error}`);
+  }
+  isExactInterruptionReplay(task, item) {
+    const observed = task.metadata?.interruption;
+    const canonical = item.context?.interruption;
+    if (item.status !== "interrupted" || !canonical || typeof canonical !== "object") return false;
+    if (observed && typeof observed === "object") return isDeepStrictEqual(observed, canonical);
+    const observedSummary = task.status.message ? extractText(task.status.message.parts).trim() : "";
+    return observedSummary.length > 0 && canonical.summary === observedSummary;
+  }
+  /**
+   * Restore an SDK task from the stored snapshot, overlaying the current
+   * `TaskItem.status` onto `task.status.state`. Returns `undefined` when the
+   * task is unknown to the tenant or has no A2A snapshot.
+   */
+  async load(taskId) {
+    const item = await this.taskStore.getById(this.scope.tenantId, taskId);
+    if (!item || !this.isInScope(item)) return void 0;
+    const pageSize = 100;
+    let selected;
+    for (let offset = 0; ; offset += pageSize) {
+      const activities = await this.workItemStore.list({
+        tenantId: this.scope.tenantId,
+        taskId,
+        action: "activity",
+        order: "desc",
+        limit: pageSize,
+        offset
+      });
+      for (const activity of activities) {
+        if (activity.detail?.type !== "a2a_task_snapshot" || !isA2ATaskSnapshot(activity.detail.task)) continue;
+        const sequence = snapshotSequence(activity.detail.snapshotSequence) ?? snapshotSequence(activity.detail.task.metadata?.snapshotSequence);
+        const candidate = {
+          task: activity.detail.task,
+          sequence,
+          eventKey: asString2(activity.detail.eventKey) ?? activity.eventKey ?? snapshotEventKey(activity.detail.task),
+          statusTimestamp: Date.parse(activity.detail.task.status.timestamp ?? ""),
+          createdAt: activity.createdAt,
+          id: activity.id
+        };
+        if (!selected || this.isLaterSnapshot(candidate, selected)) selected = candidate;
+      }
+      if (activities.length < pageSize) break;
+    }
+    const snapshot = selected?.task ?? item.context?.a2aTask;
+    if (!isA2ATaskSnapshot(snapshot)) return void 0;
+    const restoredSequence = selected?.sequence ?? snapshotSequence(snapshot.metadata?.snapshotSequence);
+    if (restoredSequence !== void 0) {
+      this.snapshotSequences.set(taskId, Math.max(this.snapshotSequences.get(taskId) ?? 0, restoredSequence));
+    }
+    const state = mapTaskStatusToA2AState(item.status);
+    const interruption = item.context?.interruption;
+    const contextRunId = asString2(item.context?.a2aRunId);
+    const contextThreadId = asString2(item.context?.threadId);
+    const metadata = {
+      ...snapshot.metadata ?? {},
+      ...contextRunId === void 0 ? {} : { a2aRunId: contextRunId },
+      ...contextThreadId === void 0 ? {} : { threadId: contextThreadId },
+      ...interruption && typeof interruption === "object" ? { interruption } : {}
+    };
+    const nonResultArtifacts = (snapshot.artifacts ?? []).filter((artifact) => artifact.name !== "result");
+    const artifacts = item.status === "completed" && item.result?.trim() ? [...nonResultArtifacts, {
+      artifactId: `${item.id}:result`,
+      name: "result",
+      parts: [{ kind: "text", text: item.result }]
+    }] : nonResultArtifacts;
+    const message = state === "failed" && item.failureReason?.trim() ? {
+      kind: "message",
+      messageId: `${item.id}:failure`,
+      role: "agent",
+      parts: [{ kind: "text", text: item.failureReason }]
+    } : interruption && typeof interruption === "object" && typeof interruption.summary === "string" ? {
+      kind: "message",
+      messageId: `${item.id}:interruption`,
+      role: "agent",
+      parts: [{ kind: "text", text: interruption.summary }]
+    } : snapshot.status.message;
+    return {
+      ...snapshot,
+      metadata,
+      ...artifacts.length > 0 ? { artifacts } : { artifacts: void 0 },
+      status: {
+        ...snapshot.status,
+        state,
+        ...message ? { message } : {}
+      }
+    };
+  }
+  isInScope(item) {
+    return item.tenantId === this.scope.tenantId && item.projectId === this.scope.projectId && item.ownerType === "agent" && item.ownerId === this.scope.assistantId && item.sourceId === "a2a";
+  }
+  requireScope(item, taskId) {
+    if (!this.isInScope(item)) throw new A2ATaskScopeConflictError(taskId);
+  }
+  isLaterSnapshot(candidate, selected) {
+    if (candidate.sequence !== void 0 || selected.sequence !== void 0) {
+      if (candidate.sequence === void 0) return false;
+      if (selected.sequence === void 0) return true;
+      if (candidate.sequence !== selected.sequence) return candidate.sequence > selected.sequence;
+      const candidateTimestamp = Number.isNaN(candidate.statusTimestamp) ? Number.NEGATIVE_INFINITY : candidate.statusTimestamp;
+      const selectedTimestamp = Number.isNaN(selected.statusTimestamp) ? Number.NEGATIVE_INFINITY : selected.statusTimestamp;
+      if (candidateTimestamp !== selectedTimestamp) return candidateTimestamp > selectedTimestamp;
+      return candidate.eventKey > selected.eventKey;
+    }
+    return candidate.createdAt.getTime() > selected.createdAt.getTime() || candidate.createdAt.getTime() === selected.createdAt.getTime() && candidate.id > selected.id;
+  }
+};
+function isA2AConcurrentWrite(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.includes("TASK_STATUS_CONFLICT") || message.includes("TASK_STORE_WRITE_FAILED") || message.includes("Task changed concurrently");
+}
+
+// src/services/a2a/AxiomAgentExecutor.ts
+import { v4 as uuidv4 } from "uuid";
+import { agentInstanceManager, isOfficialInterruptId } from "@axiom-lattice/core";
+import { MessageChunkTypes as MessageChunkTypes2 } from "@axiom-lattice/protocols";
+import { A2AError as A2AError2 } from "@a2a-js/sdk/server";
+
+// src/services/a2a/a2aFileRefs.ts
+function filePartsToRefs(parts, addedBy) {
+  const refs = [];
+  for (const part of parts) {
+    if (part.kind !== "file") continue;
+    const file = part.file;
+    if ("bytes" in file) {
+      throw new Error(
+        "A2A file parts with inline bytes are not supported by this pure function \u2014 bytes ingest requires filePartsToRefsWithIngest with an A2AFileIngestor; provide a file uri otherwise"
+      );
+    }
+    refs.push({
+      uri: file.uri,
+      ...file.name ? { name: file.name } : {},
+      ...file.mimeType ? { mimeType: file.mimeType } : {},
+      addedBy
+    });
+  }
+  return refs;
+}
+async function filePartsToRefsWithIngest(parts, addedBy, ingestor, dedupeKeyBase, projectId) {
+  if (!ingestor) {
+    return filePartsToRefs(parts, addedBy);
+  }
+  const refs = [];
+  for (let index = 0; index < parts.length; index += 1) {
+    const part = parts[index];
+    if (part.kind !== "file") continue;
+    const dedupeKey = `${dedupeKeyBase}:${index}`;
+    refs.push(await ingestor.ingest(part, dedupeKey, projectId, addedBy));
+  }
+  return refs;
+}
+
+// src/services/a2a/A2ARunService.ts
+import { randomUUID } from "crypto";
+import {
+  extractAgentRunInputMessageIds
+} from "@axiom-lattice/core";
+import { MessageChunkTypes } from "@axiom-lattice/protocols";
+var TERMINAL_STREAM_CHUNK_TYPES = /* @__PURE__ */ new Set([
+  MessageChunkTypes.MESSAGE_COMPLETED,
+  MessageChunkTypes.MESSAGE_FAILED,
+  MessageChunkTypes.INTERRUPT
+]);
+async function* stopAtTerminalChunks(source) {
+  for await (const chunk of source) {
+    yield chunk;
+    if (TERMINAL_STREAM_CHUNK_TYPES.has(chunk.type)) return;
+  }
+}
+var A2ARunNotFoundError = class extends Error {
+  constructor(runId) {
+    super(`A2A run not found: ${runId}`);
+    this.runId = runId;
+    /** Stable error code for API/protocol mapping. */
+    this.code = "A2A_RUN_NOT_FOUND";
+    this.name = "A2ARunNotFoundError";
+  }
+};
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+  "success",
+  "error",
+  "interrupted",
+  "cancelled",
+  "timeout"
+]);
+function isTerminal(status) {
+  return TERMINAL_STATUSES.has(status);
+}
+function mapStatus(status) {
+  switch (status) {
+    case "pending":
+    case "running":
+    case "success":
+    case "error":
+    case "interrupted":
+    case "timeout":
+      return status;
+    case "cancelled":
+      return "interrupted";
+  }
+}
+function messageIdFromRun(run) {
+  if (typeof run.input?.id === "string" && run.input.id.length > 0) {
+    return run.input.id;
+  }
+  if (run.inputMessageIds.length > 0) return run.inputMessageIds[0];
+  return run.runId;
+}
+var A2ARunService = class {
+  constructor(deps) {
+    this.ledger = deps.ledger;
+    this.chunkSource = deps.chunkSource;
+    this.wake = deps.wake ?? wakeRunTaskQueue;
+    this.getLatestCursor = deps.getLatestCursor;
+    this.getRunCancelRouter = deps.getRunCancelRouter ?? (() => getRunCancelRouter());
+    this.idFactory = deps.idFactory ?? randomUUID;
+    this.now = deps.now ?? Date.now;
+    this.sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    this.pollIntervalMs = deps.pollIntervalMs ?? 200;
+    this.joinTimeoutMs = deps.joinTimeoutMs ?? 3e4;
+    this.cancelTimeoutMs = deps.cancelTimeoutMs ?? 1e4;
+    this.maxActiveRunsForTenant = deps.maxActiveRunsForTenant;
+  }
+  /**
+   * Creates exactly one pending `run_api` row for an A2A request.
+   *
+   * @param input Tenant/project/agent scope, A2A ids, and message or command.
+   * @returns The run id, chunk-stream anchor/cursor, and pending status.
+   * @remarks The stream cursor is captured before the row is committed so
+   * already-emitted chunks cannot be lost. The queue wake is best-effort and
+   * never awaited: a hung wake must not delay the protocol response.
+   */
+  async create(input) {
+    const streamCursor = await this.captureLatestCursor(
+      input.threadId,
+      input.assistantId
+    );
+    const runId = this.idFactory();
+    const hasCommand = input.command !== void 0;
+    const messageId = hasCommand ? runId : input.message.id?.trim() || this.idFactory();
+    const runInput = hasCommand ? null : { id: messageId, message: input.message.content };
+    await this.ledger.createPendingRun({
+      runId,
+      tenantId: input.tenantId,
+      ...input.workspaceId === void 0 ? {} : { workspaceId: input.workspaceId },
+      projectId: input.projectId,
+      assistantId: input.assistantId,
+      threadId: input.threadId,
+      input: runInput,
+      command: input.command ?? null,
+      config: input.config ?? null,
+      metadata: {
+        ...input.metadata ?? {},
+        a2aTaskId: input.a2aTaskId,
+        a2aContextId: input.threadId
+      },
+      inputMessageIds: runInput ? extractAgentRunInputMessageIds(runInput) : [],
+      ...this.maxActiveRunsForTenant === void 0 ? {} : { maxActiveRunsForTenant: this.maxActiveRunsForTenant }
+    });
+    this.wakeSafely();
+    return {
+      runId,
+      messageId,
+      ...streamCursor === void 0 ? {} : { streamCursor },
+      status: "pending",
+      terminal: false
+    };
+  }
+  /**
+   * Waits for a `run_api` run to reach a terminal lifecycle state.
+   *
+   * @param timeoutMs Blocking budget (default {@link joinTimeoutMs}).
+   * @returns The terminal handle, or a non-terminal `timeout` handle when the
+   * budget ends.
+   * @throws {A2ARunNotFoundError} When the run is absent, legacy-sourced, or out
+   * of scope.
+   */
+  async join(tenantId, threadId, assistantId, runId, timeoutMs) {
+    const budget = timeoutMs ?? this.joinTimeoutMs;
+    const deadline = this.now() + Math.max(0, budget);
+    for (; ; ) {
+      const run = await this.readScoped(tenantId, threadId, assistantId, runId);
+      if (!run) throw new A2ARunNotFoundError(runId);
+      if (isTerminal(run.status)) return this.toHandle(run);
+      const remaining = deadline - this.now();
+      if (remaining <= 0) {
+        return { ...this.toHandle(run), status: "timeout", terminal: false };
+      }
+      await this.sleep(Math.max(1, Math.min(this.pollIntervalMs, remaining)));
+    }
+  }
+  /**
+   * Requests cancellation of one exact `run_api` run and waits (bounded) for
+   * terminal state.
+   *
+   * @throws {A2ARunNotFoundError} When the run is absent, legacy-sourced, or out
+   * of scope.
+   */
+  async cancel(tenantId, threadId, assistantId, runId) {
+    const run = await this.readScoped(tenantId, threadId, assistantId, runId);
+    if (!run) throw new A2ARunNotFoundError(runId);
+    if (isTerminal(run.status)) return;
+    const router = this.getRunCancelRouter();
+    let result;
+    if (router) {
+      result = await router.requestCancelById({
+        tenantId,
+        assistantId,
+        threadId,
+        runId,
+        reason: "a2a.cancel"
+      });
+    } else {
+      result = await this.ledger.requestCancel(tenantId, runId);
+    }
+    if (result === "not_found") throw new A2ARunNotFoundError(runId);
+    if (result === "terminal") return;
+    await this.waitForTerminal(tenantId, threadId, assistantId, runId);
+  }
+  /**
+   * Attaches to the chunk stream for a run's message id.
+   *
+   * @param cursor Thread-stream position from the run handle. When supplied and
+   * supported, the cursor-backed thread stream is used instead of message-id
+   * anchoring (required for command runs).
+   * @param scope Optional exact `run_api` scope guard, validated on first read.
+   */
+  stream(threadId, assistantId, messageId, cursor, scope) {
+    const useCursorStream = typeof cursor === "string" && cursor.trim() !== "" && this.chunkSource.streamThread !== void 0;
+    const createSource = () => useCursorStream ? this.chunkSource.streamThread(threadId, assistantId, cursor) : this.chunkSource.stream(threadId, assistantId, messageId);
+    if (!scope) return createSource();
+    return this.guardStream(
+      createSource,
+      threadId,
+      assistantId,
+      scope
+    );
+  }
+  /**
+   * Reads the authoritative `run_api` ledger record.
+   *
+   * @param threadId Optional scope guard; legacy runs are always rejected.
+   * @param assistantId Optional scope guard.
+   */
+  async getRun(tenantId, runId, threadId, assistantId) {
+    const run = await this.ledger.getRun(tenantId, runId);
+    if (!run || run.source !== "run_api") return void 0;
+    if (run.tenantId !== tenantId) return void 0;
+    if (threadId !== void 0 && run.threadId !== threadId) return void 0;
+    if (assistantId !== void 0 && run.assistantId !== assistantId) {
+      return void 0;
+    }
+    return run;
+  }
+  async waitForTerminal(tenantId, threadId, assistantId, runId) {
+    const deadline = this.now() + this.cancelTimeoutMs;
+    for (; ; ) {
+      const run = await this.readScoped(tenantId, threadId, assistantId, runId);
+      if (!run || isTerminal(run.status)) return;
+      const remaining = deadline - this.now();
+      if (remaining <= 0) return;
+      await this.sleep(Math.max(1, Math.min(this.pollIntervalMs, remaining)));
+    }
+  }
+  async readScoped(tenantId, threadId, assistantId, runId) {
+    const run = await this.ledger.getRun(tenantId, runId);
+    if (!run || run.source !== "run_api" || run.tenantId !== tenantId || run.threadId !== threadId || run.assistantId !== assistantId) {
+      return void 0;
+    }
+    return run;
+  }
+  toHandle(run) {
+    return {
+      runId: run.runId,
+      messageId: messageIdFromRun(run),
+      status: mapStatus(run.status),
+      terminal: isTerminal(run.status)
+    };
+  }
+  async captureLatestCursor(threadId, assistantId) {
+    if (!this.getLatestCursor) return void 0;
+    try {
+      const cursor = await this.getLatestCursor(threadId, assistantId);
+      if (typeof cursor !== "string" || cursor.trim() === "") return void 0;
+      return cursor;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Lazily verifies the exact `run_api` scope before opening the chunk source.
+   * Validation is deferred so `stream()` remains synchronous and an unused
+   * stream never touches the ledger.
+   */
+  guardStream(createSource, threadId, assistantId, scope) {
+    return {
+      [Symbol.asyncIterator]: () => {
+        let validation;
+        let inner;
+        const validate = () => {
+          validation ?? (validation = (async () => {
+            const run = await this.readScoped(
+              scope.tenantId,
+              threadId,
+              assistantId,
+              scope.runId
+            );
+            if (!run) throw new A2ARunNotFoundError(scope.runId);
+          })());
+          return validation;
+        };
+        const source = () => {
+          inner ?? (inner = createSource()[Symbol.asyncIterator]());
+          return inner;
+        };
+        const settleValidation = async () => {
+          if (!validation) return;
+          try {
+            await validation;
+          } catch {
+          }
+        };
+        return {
+          next: async () => {
+            await validate();
+            return source().next();
+          },
+          return: async (value) => {
+            await settleValidation();
+            if (!inner) return { done: true, value };
+            return inner.return ? inner.return(value) : { done: true, value };
+          },
+          throw: async (error) => {
+            await settleValidation();
+            if (!inner) throw error;
+            return inner.throw ? inner.throw(error) : Promise.reject(error);
+          }
+        };
+      }
+    };
+  }
+  wakeSafely() {
+    try {
+      void this.wake().catch(() => void 0);
+    } catch {
+    }
+  }
+};
+
+// src/services/a2a/AxiomAgentExecutor.ts
+var A2ABlockingDeadlineError = class extends Error {
+  constructor() {
+    super("A2A blocking execution deadline expired");
+    this.name = "A2ABlockingDeadlineError";
+  }
+};
+var TERMINAL_A2A_STATES = /* @__PURE__ */ new Set([
+  "completed",
+  "failed",
+  "canceled",
+  "rejected"
+]);
+function isoNow() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function asString3(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function asRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function extractText2(parts) {
+  return parts.filter((part) => part.kind === "text").map((part) => part.text).join("\n");
+}
+function dataParts(parts) {
+  return parts.filter(
+    (part) => part.kind === "data"
+  );
+}
+function soleOfficialInterruptId(task) {
+  const ids = (task?.artifacts ?? []).filter((artifact) => artifact.name === "interrupt").flatMap((artifact) => artifact.parts).filter((part) => part.kind === "data").map((part) => asString3(part.data.id)).filter((id) => id !== void 0 && isOfficialInterruptId(id));
+  return ids.length === 1 ? ids[0] : void 0;
+}
+function agentMessage(text) {
+  return {
+    kind: "message",
+    messageId: uuidv4(),
+    role: "agent",
+    parts: [{ kind: "text", text }]
+  };
+}
+function assistantHasGovernedTask(assistant) {
+  const graph = assistant.graphDefinition;
+  const middleware = graph && typeof graph === "object" ? graph.middleware : void 0;
+  const taskMiddleware = Array.isArray(middleware) ? middleware.find((entry) => !!entry && typeof entry === "object" && entry.type === "task" && entry.enabled === true) : void 0;
+  const allowedTools = taskMiddleware?.allowedTools;
+  return !!taskMiddleware && (allowedTools === void 0 || Array.isArray(allowedTools) && (allowedTools.length === 0 || allowedTools.includes("manage_task")));
+}
+var AxiomAgentExecutor = class {
+  constructor(options) {
+    this.scope = options.scope;
+    this.assistant = options.assistant;
+    this.taskStore = options.taskStore;
+    this.runService = options.runService;
+    this.ingestor = options.ingestor;
+    this.blocking = options.blocking ?? true;
+    this.getInterrupts = options.getInterrupts ?? ((threadId) => agentInstanceManager.getAgent(this.agentParams(threadId)).getInterrupts());
+    this.joinTimeoutMs = options.joinTimeoutMs ?? 3e4;
+    this.overallTimeoutMs = this.blocking ? options.overallTimeoutMs ?? 10 * 6e4 : Number.POSITIVE_INFINITY;
+  }
+  /** Execute one A2A request through the durable run service. */
+  async execute(ctx, bus) {
+    const existing = ctx.task;
+    const threadId = asString3(existing?.metadata?.threadId) ?? ctx.contextId;
+    const dependencies = ctx.referenceTasks?.map((task) => task.id) ?? [];
+    const resume = this.isResume(existing);
+    const text = extractText2(ctx.userMessage.parts);
+    const governed = this.hasGovernedTaskCapability();
+    const resumeCanonicalTask = resume && !governed;
+    if (existing && !resume) {
+      throw A2AError2.invalidParams(
+        `Task ${existing.id} is not waiting for input and cannot be resumed`
+      );
+    }
+    if (!this.taskStore) {
+      const initialTask2 = this.taskFor(ctx, threadId, [], dependencies, {
+        handle: void 0,
+        resume: false
+      });
+      bus.publish(initialTask2);
+      await this.failTask(ctx, bus, initialTask2, new Error("A2A execution requires a canonical task store"));
+      return;
+    }
+    if (existing && TERMINAL_A2A_STATES.has(existing.status.state)) {
+      throw A2AError2.invalidParams(
+        `Task ${existing.id} is terminal (${existing.status.state}) and cannot be modified`
+      );
+    }
+    const interruption = asRecord3(existing?.metadata?.interruption);
+    const reviewInterruption = interruption?.type === "review_required";
+    const command = resume ? this.resumeCommand(
+      ctx.userMessage.parts,
+      text,
+      reviewInterruption,
+      soleOfficialInterruptId(existing)
+    ) : void 0;
+    if (reviewInterruption && !command) {
+      bus.publish(agentMessage("Review response must be exactly 'approve', 'reject', or 'reject: <note>'."));
+      return;
+    }
+    if (resume && !command) {
+      throw A2AError2.invalidParams(`Task ${ctx.taskId} resume requires text or one DataPart`);
+    }
+    let inputFiles;
+    try {
+      inputFiles = await filePartsToRefsWithIngest(
+        ctx.userMessage.parts,
+        "user",
+        this.ingestor,
+        ctx.taskId,
+        this.scope.projectId
+      );
+    } catch (err) {
+      const initialTask2 = this.taskFor(ctx, threadId, [], dependencies, {
+        handle: void 0,
+        resume: false
+      });
+      await this.taskStore.save(initialTask2);
+      bus.publish(initialTask2);
+      await this.failTask(ctx, bus, initialTask2, err);
+      return;
+    }
+    const requestText = this.requestText(ctx.taskId, text, inputFiles, governed, resume);
+    const runInput = {
+      tenantId: this.scope.tenantId,
+      projectId: this.scope.projectId,
+      ...this.scope.workspaceId ? { workspaceId: this.scope.workspaceId } : {},
+      assistantId: this.scope.assistantId,
+      threadId,
+      a2aTaskId: ctx.taskId,
+      message: { id: ctx.userMessage.messageId, role: "user", content: requestText },
+      ...command ? { command } : {},
+      config: {
+        taskId: ctx.taskId,
+        execution: { taskId: ctx.taskId }
+      }
+    };
+    let handle;
+    try {
+      handle = await this.runService.create(runInput);
+    } catch (err) {
+      const initialTask2 = this.taskFor(ctx, threadId, inputFiles, dependencies, {
+        handle: void 0,
+        resume: false
+      });
+      await this.taskStore.save(initialTask2);
+      bus.publish(initialTask2);
+      await this.failTask(ctx, bus, initialTask2, err);
+      return;
+    }
+    const projection = {
+      ctx,
+      ...existing ? { existing } : {},
+      threadId,
+      inputFiles,
+      dependencies,
+      handle,
+      governed,
+      resume: resumeCanonicalTask
+    };
+    const initialTask = this.taskFor(ctx, threadId, inputFiles, dependencies, {
+      handle,
+      resume: resumeCanonicalTask
+    });
+    await this.taskStore.save(initialTask);
+    bus.publish(initialTask);
+    if (!this.blocking) {
+      void this.projectRun(bus, projection).catch((err) => {
+        console.warn({
+          event: "a2a:run:background_projection_failed",
+          taskId: ctx.taskId,
+          runId: handle.runId,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      });
+      return;
+    }
+    await this.projectRun(bus, projection);
+  }
+  async projectRun(bus, projection) {
+    const { ctx, threadId, handle } = projection;
+    let outputText = "";
+    let streamError;
+    let dropChunks = false;
+    const iterator = this.runService.stream(
+      threadId,
+      this.scope.assistantId,
+      handle.messageId,
+      handle.streamCursor,
+      { tenantId: this.scope.tenantId, runId: handle.runId }
+    )[Symbol.asyncIterator]();
+    const consume = (async () => {
+      try {
+        for (; ; ) {
+          const next = await iterator.next();
+          if (next.done) return;
+          if (dropChunks) return;
+          const chunk = next.value;
+          const chunkText = chunk.data?.content ?? "";
+          if (chunk.type === MessageChunkTypes2.AI && chunkText) {
+            outputText += chunkText;
+          }
+          if ((chunk.type === MessageChunkTypes2.AI || chunk.type === MessageChunkTypes2.TOOL) && chunkText) {
+            bus.publish({
+              kind: "status-update",
+              taskId: ctx.taskId,
+              contextId: ctx.contextId,
+              status: {
+                state: "working",
+                message: agentMessage(chunkText),
+                timestamp: isoNow()
+              },
+              final: false
+            });
+          }
+        }
+      } catch (err) {
+        streamError = err;
+      }
+    })();
+    let terminal;
+    try {
+      terminal = await this.waitForTerminal(handle.runId, threadId);
+    } catch (err) {
+      await iterator.return?.();
+      await consume.catch(() => void 0);
+      const baseTask = this.taskFor(ctx, threadId, projection.inputFiles, projection.dependencies, projection);
+      if (err instanceof A2ABlockingDeadlineError) {
+        try {
+          await this.runService.cancel(
+            this.scope.tenantId,
+            threadId,
+            this.scope.assistantId,
+            handle.runId
+          );
+        } catch (cancelError) {
+          console.warn({
+            event: "a2a:timeout:cancel_failed",
+            taskId: ctx.taskId,
+            runId: handle.runId,
+            error: cancelError instanceof Error ? cancelError.message : String(cancelError)
+          });
+        }
+        await this.failTask(ctx, bus, baseTask, new Error("A2A run timed out"));
+        return;
+      }
+      await this.failTask(ctx, bus, baseTask, err);
+      return;
+    }
+    const run = await this.runService.getRun(
+      this.scope.tenantId,
+      handle.runId,
+      threadId,
+      this.scope.assistantId
+    ).catch(() => void 0);
+    const runRecord = asRecord3(run);
+    const abortStream = runRecord?.cancelRequested === true || terminal.status === "timeout";
+    if (abortStream) {
+      dropChunks = true;
+      await iterator.return?.();
+    }
+    await consume.catch(() => void 0);
+    if (runRecord?.cancelRequested === true) {
+      await this.finishCanceled(bus, projection);
+      return;
+    }
+    switch (terminal.status) {
+      case "success":
+        await this.finishCompleted(bus, projection, outputText);
+        return;
+      case "interrupted":
+        await this.finishInputRequired(bus, projection);
+        return;
+      case "error": {
+        const canonical = this.taskStore ? await this.taskStore.load(ctx.taskId) : void 0;
+        const canonicalMessage = canonical?.status.state === "failed" && canonical.status.message ? extractText2(canonical.status.message.parts).trim() : "";
+        const message = canonicalMessage || asString3(runRecord?.error) || (streamError instanceof Error ? streamError.message : void 0) || "A2A run failed";
+        await this.failTask(
+          ctx,
+          bus,
+          this.taskFor(ctx, threadId, projection.inputFiles, projection.dependencies, projection),
+          new Error(message)
+        );
+        return;
+      }
+      case "timeout":
+        await this.failTask(
+          ctx,
+          bus,
+          this.taskFor(ctx, threadId, projection.inputFiles, projection.dependencies, projection),
+          new Error("A2A run timed out")
+        );
+        return;
+      default:
+        await this.failTask(
+          ctx,
+          bus,
+          this.taskFor(ctx, threadId, projection.inputFiles, projection.dependencies, projection),
+          new Error(`A2A run ended in unexpected state ${terminal.status}`)
+        );
+    }
+  }
+  async waitForTerminal(runId, threadId) {
+    const deadline = Date.now() + Math.max(0, this.overallTimeoutMs);
+    for (; ; ) {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) {
+        throw new A2ABlockingDeadlineError();
+      }
+      const handle = await this.runService.join(
+        this.scope.tenantId,
+        threadId,
+        this.scope.assistantId,
+        runId,
+        Math.min(this.joinTimeoutMs, remaining)
+      );
+      if (handle.terminal) return handle;
+    }
+  }
+  async finishCompleted(bus, projection, outputText) {
+    const { ctx, threadId, existing } = projection;
+    const canonical = this.taskStore ? await this.taskStore.load(ctx.taskId) : void 0;
+    const canonicalState = canonical?.status.state;
+    if (canonicalState === "failed" || canonicalState === "rejected" || canonicalState === "canceled") {
+      bus.publish({
+        kind: "status-update",
+        taskId: ctx.taskId,
+        contextId: ctx.contextId,
+        status: {
+          state: canonicalState === "canceled" ? "canceled" : "failed",
+          ...canonical?.status.message ? { message: canonical.status.message } : {},
+          timestamp: isoNow()
+        },
+        final: true
+      });
+      return;
+    }
+    const canonicalResult = canonical?.artifacts?.find((artifact) => artifact.name === "result");
+    const canonicalText = canonicalResult ? extractText2(canonicalResult.parts).trim() : "";
+    const resultText = canonicalText || outputText;
+    const resultArtifact = {
+      artifactId: uuidv4(),
+      name: "result",
+      parts: [{ kind: "text", text: resultText }]
+    };
+    const completed = {
+      ...this.taskFor(ctx, threadId, projection.inputFiles, projection.dependencies, projection),
+      artifacts: [...existing?.artifacts ?? [], resultArtifact],
+      status: { state: "completed", timestamp: isoNow() }
+    };
+    if (this.taskStore) await this.taskStore.save(completed);
+    bus.publish({
+      kind: "artifact-update",
+      taskId: ctx.taskId,
+      contextId: ctx.contextId,
+      artifact: resultArtifact
+    });
+    bus.publish({
+      kind: "status-update",
+      taskId: ctx.taskId,
+      contextId: ctx.contextId,
+      status: { state: "completed", timestamp: isoNow() },
+      final: true
+    });
+  }
+  async finishInputRequired(bus, projection) {
+    const { ctx, threadId } = projection;
+    let interrupts = [];
+    try {
+      interrupts = await this.getInterrupts(threadId) ?? [];
+    } catch (err) {
+      console.warn({
+        event: "a2a:interrupts:read_failed",
+        taskId: ctx.taskId,
+        threadId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+    const canonical = this.taskStore ? await this.taskStore.load(ctx.taskId) : void 0;
+    const summary = canonical?.status.message ? extractText2(canonical.status.message.parts).trim() : "";
+    const interruptArtifact = interrupts.length === 0 ? void 0 : {
+      artifactId: `${ctx.taskId}:interrupt`,
+      name: "interrupt",
+      parts: interrupts.map((interrupt) => {
+        const payload = asRecord3(interrupt.payload);
+        const schema = asRecord3(payload?.response_schema) ?? payload?.response_schema;
+        return {
+          kind: "data",
+          data: {
+            id: interrupt.interruptId,
+            value: interrupt.payload,
+            ...schema === void 0 ? {} : { response_schema: schema }
+          }
+        };
+      })
+    };
+    const baseTask = this.taskFor(
+      ctx,
+      threadId,
+      projection.inputFiles,
+      projection.dependencies,
+      projection
+    );
+    const pending = {
+      ...baseTask,
+      ...interruptArtifact ? {
+        artifacts: [
+          ...(baseTask.artifacts ?? []).filter(
+            (artifact) => artifact.artifactId !== interruptArtifact.artifactId
+          ),
+          interruptArtifact
+        ]
+      } : {},
+      status: {
+        state: "input-required",
+        ...summary ? { message: agentMessage(summary) } : {},
+        timestamp: isoNow()
+      }
+    };
+    if (this.taskStore) await this.taskStore.save(pending);
+    if (interruptArtifact) {
+      bus.publish({
+        kind: "artifact-update",
+        taskId: ctx.taskId,
+        contextId: ctx.contextId,
+        artifact: interruptArtifact
+      });
+    }
+    bus.publish({
+      kind: "status-update",
+      taskId: ctx.taskId,
+      contextId: ctx.contextId,
+      status: {
+        state: "input-required",
+        ...summary ? { message: agentMessage(summary) } : {},
+        timestamp: isoNow()
+      },
+      final: true
+    });
+  }
+  async finishCanceled(bus, projection) {
+    await this.persistCanceled(projection.ctx.taskId, projection.existing, projection);
+    bus.publish({
+      kind: "status-update",
+      taskId: projection.ctx.taskId,
+      contextId: projection.ctx.contextId,
+      status: { state: "canceled", timestamp: isoNow() },
+      final: true
+    });
+  }
+  async failTask(ctx, bus, baseTask, err) {
+    const failedTask = {
+      ...baseTask,
+      status: {
+        state: "failed",
+        message: agentMessage(err instanceof Error ? err.message : String(err)),
+        timestamp: isoNow()
+      }
+    };
+    if (this.taskStore) {
+      try {
+        await this.taskStore.save(failedTask);
+      } catch (saveError) {
+        console.warn({
+          event: "a2a:settle:save_failed",
+          taskId: ctx.taskId,
+          error: saveError instanceof Error ? saveError.message : String(saveError)
+        });
+      }
+    }
+    bus.publish({
+      kind: "status-update",
+      taskId: ctx.taskId,
+      contextId: ctx.contextId,
+      status: failedTask.status,
+      final: true
+    });
+  }
+  taskFor(ctx, threadId, inputFiles, dependencies, projection) {
+    const existing = ctx.task;
+    const metadata = {
+      ...existing?.metadata ?? {},
+      threadId,
+      dependencies,
+      inputFiles,
+      ...projection?.handle ? { a2aRunId: projection.handle.runId } : {},
+      ...projection?.handle?.messageId !== void 0 ? { a2aMessageId: projection.handle.messageId } : {},
+      ...projection?.resume ? { a2aResume: true } : {}
+    };
+    if (projection?.handle) {
+      if (projection.handle.streamCursor !== void 0) {
+        metadata.a2aStreamCursor = projection.handle.streamCursor;
+      } else {
+        delete metadata.a2aStreamCursor;
+      }
+    }
+    return {
+      kind: "task",
+      id: ctx.taskId,
+      contextId: ctx.contextId,
+      ...existing?.history ? { history: existing.history } : {},
+      ...existing?.artifacts ? { artifacts: existing.artifacts } : {},
+      status: { state: "working", timestamp: isoNow() },
+      metadata
+    };
+  }
+  requestText(taskId, text, inputFiles, governed, resume) {
+    const requestText = inputFiles.length > 0 ? `${text}
+
+${formatFileRefsSection(inputFiles)}` : text;
+    if (!governed || resume) return requestText;
+    return [
+      `A2A governed task instruction: get and update the existing TaskItem ${taskId}; do not create a replacement task.`,
+      "Before doing the requested work, initialize its canonical description through manage_task with ## Objective, ## Acceptance Criteria, and ## Belief State sections.",
+      "Keep lifecycle status truthful. Change status only through manage_task set_status; complete with a nonblank result and structured beliefImpact, and use interrupted, failed, or cancelled when appropriate. Use manage_task update for content fields only.",
+      "",
+      requestText
+    ].join("\n");
+  }
+  isResume(task) {
+    return task?.status.state === "input-required";
+  }
+  resumeCommand(parts, text, reviewInterruption, soleInterruptId) {
+    if (reviewInterruption) return this.reviewCommand(text);
+    const data = dataParts(parts);
+    if (data.length > 0) {
+      const officialIds = data.map((part) => {
+        const id = asString3(part.data.id);
+        return id !== void 0 && isOfficialInterruptId(id) ? id : void 0;
+      });
+      if (data.length > 1 && officialIds.every((id) => id !== void 0)) {
+        const resume = {};
+        for (let index = 0; index < data.length; index += 1) {
+          resume[officialIds[index]] = data[index].data.value;
+        }
+        return { resume };
+      }
+      const sole = data[0];
+      if (sole && "value" in sole.data) {
+        if (data.length === 1 && officialIds[0] !== void 0) {
+          return { resume: { [officialIds[0]]: sole.data.value } };
+        }
+        return { resume: sole.data.value };
+      }
+    }
+    if (text.trim().length > 0) {
+      return {
+        resume: soleInterruptId === void 0 ? text : { [soleInterruptId]: text }
+      };
+    }
+    return void 0;
+  }
+  reviewCommand(text) {
+    const trimmed = text.trim();
+    const normalized = trimmed.toLowerCase();
+    if (normalized === "approve") return { resume: { action: "approve" } };
+    if (normalized === "reject") {
+      return { resume: { action: "reject", data: { note: "Changes requested." } } };
+    }
+    const prefixedNote = /^reject:\s*(.+)$/is.exec(trimmed)?.[1]?.trim();
+    if (prefixedNote) {
+      return { resume: { action: "reject", data: { note: prefixedNote } } };
+    }
+    return void 0;
+  }
+  agentParams(threadId) {
+    return {
+      assistant_id: this.scope.assistantId,
+      thread_id: threadId,
+      tenant_id: this.scope.tenantId,
+      project_id: this.scope.projectId,
+      ...this.scope.workspaceId ? { workspace_id: this.scope.workspaceId } : {}
+    };
+  }
+  hasGovernedTaskCapability() {
+    return assistantHasGovernedTask(this.assistant);
+  }
+  /**
+   * Cancel the exact durable run persisted on the A2A task, then persist the
+   * terminal canceled state. No agent instance is aborted directly.
+   */
+  async cancelTask(taskId, bus) {
+    const task = this.taskStore ? await this.taskStore.load(taskId) : void 0;
+    const threadId = asString3(task?.metadata?.threadId);
+    const runId = asString3(task?.metadata?.a2aRunId) ?? asString3(task?.metadata?.runId);
+    if (threadId && runId) {
+      try {
+        await this.runService.cancel(
+          this.scope.tenantId,
+          threadId,
+          this.scope.assistantId,
+          runId
+        );
+      } catch (err) {
+        if (!(err instanceof A2ARunNotFoundError)) {
+          console.warn({
+            event: "a2a:cancel:failed",
+            taskId,
+            threadId,
+            runId,
+            error: err instanceof Error ? err.message : String(err)
+          });
+        }
+      }
+    }
+    await this.persistCanceled(taskId, task);
+    bus.publish({
+      kind: "status-update",
+      taskId,
+      contextId: task?.contextId ?? "",
+      status: { state: "canceled", timestamp: isoNow() },
+      final: true
+    });
+  }
+  async persistCanceled(taskId, task, projection) {
+    const canceledTask = {
+      ...task ?? {
+        kind: "task",
+        id: taskId,
+        contextId: "",
+        status: { state: "working" }
+      },
+      ...projection ? {
+        metadata: {
+          ...task?.metadata ?? {},
+          threadId: projection.threadId,
+          dependencies: projection.dependencies,
+          inputFiles: projection.inputFiles,
+          ...projection.handle ? { a2aRunId: projection.handle.runId } : {}
+        }
+      } : {},
+      status: { state: "canceled", timestamp: isoNow() }
+    };
+    if (this.taskStore) {
+      try {
+        await this.taskStore.save(canceledTask);
+      } catch (saveError) {
+        console.warn({
+          event: "a2a:settle:save_failed",
+          taskId,
+          error: saveError instanceof Error ? saveError.message : String(saveError)
+        });
+      }
+    }
+    return canceledTask;
+  }
+};
+
+// src/services/a2a/A2AFileIngestor.ts
+var DEFAULT_MAX_BYTES = 100 * 1024 * 1024;
+var EXECUTABLE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".exe",
+  ".sh",
+  ".bat",
+  ".cmd",
+  ".com",
+  ".msi",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".ps1",
+  ".vbs",
+  ".dll",
+  ".so",
+  ".dylib"
+]);
+var EXECUTABLE_MIME_TYPES = /* @__PURE__ */ new Set([
+  "application/x-msdownload",
+  "application/x-msdos-program",
+  "application/x-executable",
+  "application/x-sh",
+  "application/x-bat",
+  "application/x-shellscript",
+  "text/x-shellscript",
+  "application/javascript",
+  "application/x-javascript",
+  "text/javascript"
+]);
+function decodeBase64(value) {
+  return new Uint8Array(Buffer.from(value, "base64"));
+}
+function maxEncodedLengthFor(maxBytes) {
+  return Math.ceil(maxBytes * 4 / 3) + 4;
+}
+function sanitizePathSegment(segment, fallback) {
+  const cleaned = segment.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/\.{2,}/g, ".").replace(/^[.-]+|[.-]+$/g, "");
+  return cleaned.length > 0 ? cleaned : fallback;
+}
+function storageLocationFor(dedupeKey, name) {
+  const separatorIndex = dedupeKey.lastIndexOf(":");
+  const keyBase = separatorIndex >= 0 ? dedupeKey.slice(0, separatorIndex) : dedupeKey;
+  const keyIndex = separatorIndex >= 0 ? dedupeKey.slice(separatorIndex + 1) : "0";
+  return {
+    path: `a2a/${sanitizePathSegment(keyBase, "task")}`,
+    name: `${sanitizePathSegment(keyIndex, "0")}-${sanitizePathSegment(name, "file")}`
+  };
+}
+function extensionOf(name) {
+  return name.includes(".") ? name.slice(name.lastIndexOf(".")).toLowerCase() : "";
+}
+function assertAllowedFileType(name, mimeType) {
+  if (EXECUTABLE_EXTENSIONS.has(extensionOf(name))) {
+    throw new Error(`Refusing to ingest executable file "${name}"`);
+  }
+  if (mimeType && EXECUTABLE_MIME_TYPES.has(mimeType.toLowerCase())) {
+    throw new Error(`Refusing to ingest executable file "${name}"`);
+  }
+}
+var A2AFileIngestor = class {
+  constructor(options) {
+    this.cache = /* @__PURE__ */ new Map();
+    this.saveProjectFile = options.saveProjectFile;
+    this.maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+  }
+  /**
+   * Project a single file part onto a {@link TaskFileRef}, ingesting bytes when
+   * present. Idempotent per `dedupeKey`: a repeated key returns the cached URI
+   * without re-writing storage, and even across ingestor instances the key
+   * maps to a deterministic storage path (`a2a/<taskId>/<partIndex>-<name>`),
+   * so request retries overwrite the same object.
+   *
+   * NOTE: the key is based on `taskId` + part index rather than the internal
+   * message id because the executor must ingest files *before* `addMessage`
+   * returns a messageId. A client retrying with a different taskId for the
+   * same message writes a second copy; that is accepted and documented.
+   */
+  async ingest(part, dedupeKey, projectId, addedBy) {
+    const file = part.file;
+    if ("uri" in file) {
+      return {
+        uri: file.uri,
+        ...file.name ? { name: file.name } : {},
+        ...file.mimeType ? { mimeType: file.mimeType } : {},
+        addedBy
+      };
+    }
+    const name = file.name ?? "file";
+    assertAllowedFileType(name, file.mimeType);
+    if (file.bytes.length > maxEncodedLengthFor(this.maxBytes)) {
+      throw new Error(
+        `A2A file part exceeds the ${this.maxBytes} byte ingest limit`
+      );
+    }
+    const bytes = decodeBase64(file.bytes);
+    if (bytes.length > this.maxBytes) {
+      throw new Error(
+        `A2A file part exceeds the ${this.maxBytes} byte ingest limit`
+      );
+    }
+    const cached = this.cache.get(dedupeKey);
+    if (cached !== void 0) {
+      return {
+        uri: cached,
+        ...file.name ? { name: file.name } : {},
+        ...file.mimeType ? { mimeType: file.mimeType } : {},
+        addedBy
+      };
+    }
+    const location = storageLocationFor(dedupeKey, name);
+    const { uri } = await this.saveProjectFile({
+      projectId,
+      name: location.name,
+      path: location.path,
+      bytes,
+      ...file.mimeType ? { mimeType: file.mimeType } : {}
+    });
+    this.cache.set(dedupeKey, uri);
+    return {
+      uri,
+      ...file.name ? { name: file.name } : {},
+      ...file.mimeType ? { mimeType: file.mimeType } : {},
+      addedBy
+    };
+  }
+};
+
+// src/services/a2a/A2ARuntimeRegistry.ts
+import {
+  DefaultExecutionEventBus
+} from "@a2a-js/sdk/server";
+var DEFAULT_MAX_SCOPES = 1e3;
+var DEFAULT_IDLE_TTL_MS = 15 * 60 * 1e3;
+var A2ARuntimeCapacityError = class extends Error {
+  constructor(maxScopes) {
+    super(`A2A runtime scope capacity of ${maxScopes} is exhausted`);
+    this.name = "A2ARuntimeCapacityError";
+  }
+};
+var ScopedExecutionEventBusManager = class {
+  constructor(touch) {
+    this.buses = /* @__PURE__ */ new Map();
+    this.touch = touch;
+  }
+  createOrGetByTaskId(taskId) {
+    this.touch();
+    const existing = this.buses.get(taskId);
+    if (existing) return existing;
+    const bus = new DefaultExecutionEventBus();
+    this.buses.set(taskId, bus);
+    return bus;
+  }
+  getByTaskId(taskId) {
+    this.touch();
+    return this.buses.get(taskId);
+  }
+  cleanupByTaskId(taskId) {
+    this.touch();
+    const bus = this.buses.get(taskId);
+    bus?.removeAllListeners();
+    this.buses.delete(taskId);
+  }
+  get activeBusCount() {
+    return this.buses.size;
+  }
+  close() {
+    for (const bus of this.buses.values()) {
+      bus.removeAllListeners();
+    }
+    this.buses.clear();
+  }
+};
+var A2ARuntimeRegistry = class {
+  constructor(options = {}) {
+    this.entries = /* @__PURE__ */ new Map();
+    this.closed = false;
+    this.maxScopes = options.maxScopes ?? DEFAULT_MAX_SCOPES;
+    this.idleTtlMs = options.idleTtlMs ?? DEFAULT_IDLE_TTL_MS;
+    this.now = options.now ?? Date.now;
+  }
+  /**
+   * Acquire and pin the runtime manager for an authorization scope.
+   *
+   * @param scope Exact tenant, project, and assistant authorization scope.
+   * @returns A lease whose manager is shared only within that scope.
+   */
+  acquire(scope) {
+    if (this.closed) throw new Error("A2A runtime registry is closed");
+    const now = this.now();
+    this.pruneExpired(now);
+    const key = JSON.stringify([
+      scope.tenantId,
+      scope.projectId,
+      scope.assistantId
+    ]);
+    const existing = this.entries.get(key);
+    const entry = existing ?? this.createEntry(key, now);
+    entry.lastAccessedAt = now;
+    entry.leaseCount += 1;
+    let released = false;
+    return {
+      manager: entry.manager,
+      release: () => {
+        if (released) return;
+        released = true;
+        entry.leaseCount -= 1;
+        entry.lastAccessedAt = this.now();
+      }
+    };
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    for (const entry of this.entries.values()) {
+      entry.manager.close();
+    }
+    this.entries.clear();
+  }
+  pruneExpired(now) {
+    for (const [key, entry] of this.entries) {
+      if (!this.isActive(entry) && now - entry.lastAccessedAt > this.idleTtlMs) {
+        entry.manager.close();
+        this.entries.delete(key);
+      }
+    }
+  }
+  makeCapacity() {
+    if (this.entries.size < this.maxScopes) return;
+    let oldest;
+    for (const candidate of this.entries) {
+      if (this.isActive(candidate[1])) continue;
+      if (!oldest || candidate[1].lastAccessedAt < oldest[1].lastAccessedAt) {
+        oldest = candidate;
+      }
+    }
+    if (!oldest) throw new A2ARuntimeCapacityError(this.maxScopes);
+    oldest[1].manager.close();
+    this.entries.delete(oldest[0]);
+  }
+  createEntry(key, now) {
+    this.makeCapacity();
+    const entry = {
+      lastAccessedAt: now,
+      leaseCount: 0,
+      manager: new ScopedExecutionEventBusManager(() => {
+        entry.lastAccessedAt = this.now();
+      })
+    };
+    this.entries.set(key, entry);
+    return entry;
+  }
+  isActive(entry) {
+    return entry.leaseCount > 0 || entry.manager.activeBusCount > 0;
+  }
+};
+
+// src/routes/a2a-standard.ts
+var TERMINAL_A2A_STATES2 = /* @__PURE__ */ new Set([
+  "completed",
+  "failed",
+  "canceled",
+  "rejected"
+]);
+function agentParamsFor(scope, threadId, assistantId) {
+  return {
+    assistant_id: assistantId,
+    thread_id: threadId,
+    tenant_id: scope.tenantId,
+    project_id: scope.projectId,
+    ...scope.workspaceId ? { workspace_id: scope.workspaceId } : {}
+  };
+}
+function chunksFromThreadStream(buffer, key, cursor) {
+  return (async function* () {
+    for await (const record of buffer.streamThread(
+      key,
+      cursor === void 0 ? {} : { cursor }
+    )) {
+      if (record.kind === "end") return;
+      if (record.kind !== "chunk") continue;
+      yield record.chunk;
+      if (record.chunk.type === MessageChunkTypes3.MESSAGE_COMPLETED || record.chunk.type === MessageChunkTypes3.MESSAGE_FAILED || record.chunk.type === MessageChunkTypes3.INTERRUPT) {
+        return;
+      }
+    }
+  })();
+}
+function runServiceChunkSource(scope) {
+  return {
+    stream: (threadId, assistantId, messageId) => {
+      const buffer = getChunkBuffer("default");
+      if (buffer) {
+        return stopAtTerminalChunks(
+          chunksFromThreadStream(
+            buffer,
+            chunkBufferStreamKey(scope.tenantId, assistantId, threadId)
+          )
+        );
+      }
+      return stopAtTerminalChunks(
+        agentInstanceManager2.getAgent(agentParamsFor(scope, threadId, assistantId)).chunkStream(
+          messageId,
+          [MessageChunkTypes3.MESSAGE_COMPLETED, MessageChunkTypes3.MESSAGE_FAILED]
+        )
+      );
+    },
+    streamThread: (threadId, assistantId, cursor) => {
+      const buffer = getChunkBuffer("default");
+      if (!buffer) return (async function* () {
+      })();
+      return chunksFromThreadStream(
+        buffer,
+        chunkBufferStreamKey(scope.tenantId, assistantId, threadId),
+        cursor
+      );
+    }
+  };
+}
+function messageText(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content.map((part) => {
+    if (typeof part === "string") return part;
+    if (typeof part !== "object" || part === null) return "";
+    const record = part;
+    if (typeof record.text === "string") return record.text;
+    if (record.type === "text" && typeof record.value === "string") {
+      return record.value;
+    }
+    return "";
+  }).join("");
+}
+function normalizeCheckpointMessages(messages) {
+  if (!Array.isArray(messages)) return [];
+  const normalized = [];
+  messages.forEach((message, index) => {
+    if (typeof message !== "object" || message === null) return;
+    const record = message;
+    const type = typeof record.getType === "function" ? record.getType() : asString4(record.type) ?? asString4(record.role);
+    const role = type === "human" || type === "user" ? "user" : type === "ai" || type === "assistant" ? "agent" : void 0;
+    if (!role) return;
+    const text = messageText(record.content);
+    if (!text) return;
+    normalized.push({
+      kind: "message",
+      messageId: asString4(record.id) ?? `a2a-checkpoint:${index}`,
+      role,
+      parts: [{ kind: "text", text }]
+    });
+  });
+  return normalized;
+}
+function defaultStateResolver() {
+  return {
+    getCurrentMessages: async (threadId, assistantId, scope) => {
+      const agent = agentInstanceManager2.getAgent(
+        agentParamsFor(scope, threadId, assistantId)
+      );
+      const state = await agent.getCurrentState();
+      return normalizeCheckpointMessages(state?.values?.messages);
+    },
+    getInterrupts: async (threadId, assistantId, scope) => await agentInstanceManager2.getAgent(agentParamsFor(scope, threadId, assistantId)).getInterrupts() ?? []
+  };
+}
+function blockingFor(body) {
+  const params = typeof body === "object" && body !== null ? body.params : void 0;
+  const configuration = typeof params === "object" && params !== null ? params.configuration : void 0;
+  const blocking = typeof configuration === "object" && configuration !== null ? configuration.blocking : void 0;
+  return blocking !== false;
+}
+async function resumeValidationError(taskStore, body) {
+  const method = typeof body === "object" && body !== null ? body.method : void 0;
+  if (method !== "message/send" && method !== "message/stream") return void 0;
+  const params = body.params;
+  const message = typeof params === "object" && params !== null ? params.message : void 0;
+  const taskId = typeof message === "object" && message !== null ? message.taskId : void 0;
+  if (typeof taskId !== "string" || taskId.length === 0) return void 0;
+  const task = await taskStore.load(taskId);
+  if (!task) return void 0;
+  if (task.status.state === "input-required") return void 0;
+  if (TERMINAL_A2A_STATES2.has(task.status.state)) return void 0;
+  return `Task ${taskId} is not waiting for input and cannot be resumed`;
+}
+var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set([
+  "success",
+  "error",
+  "interrupted",
+  "cancelled",
+  "timeout"
+]);
+var RESUBSCRIBE_SETTLE_TIMEOUT_MS = 1e4;
+function asString4(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function requestMethod(body) {
+  return typeof body === "object" && body !== null ? asString4(body.method) : void 0;
+}
+function requestTaskId(body) {
+  if (typeof body !== "object" || body === null) return void 0;
+  const record = body;
+  const params = typeof record.params === "object" && record.params !== null ? record.params : void 0;
+  if (!params) return void 0;
+  if (record.method === "tasks/get" || record.method === "tasks/cancel" || record.method === "tasks/resubscribe") {
+    return asString4(params.id);
+  }
+  if (record.method === "message/send" || record.method === "message/stream") {
+    const message = typeof params.message === "object" && params.message !== null ? params.message : void 0;
+    return asString4(message?.taskId);
+  }
+  return void 0;
+}
+function isTerminalA2AState(state) {
+  return TERMINAL_A2A_STATES2.has(state);
+}
+function agentMessage2(text) {
+  return {
+    kind: "message",
+    messageId: `a2a-run-projection:${Date.now()}`,
+    role: "agent",
+    parts: [{ kind: "text", text }]
+  };
+}
+function projectRunState(run) {
+  if (run.cancelRequested === true || run.status === "cancelled") {
+    return { state: "canceled" };
+  }
+  switch (run.status) {
+    case "success":
+      return { state: "completed" };
+    case "interrupted":
+      return { state: "input-required" };
+    case "error":
+    case "timeout":
+      return {
+        state: "failed",
+        ...asString4(run.error) ? { message: agentMessage2(asString4(run.error)) } : {}
+      };
+    default:
+      return void 0;
+  }
+}
+function resultTextFromTask(task) {
+  const artifact = task.artifacts?.find((item) => item.name === "result");
+  if (!artifact) return "";
+  return artifact.parts.filter((part) => part.kind === "text").map((part) => part.text).join("");
+}
+function resultArtifactFor(task, result) {
+  return {
+    artifactId: `${task.id}:result`,
+    name: "result",
+    parts: [{ kind: "text", text: result.trim() || "(no output)" }]
+  };
+}
+function withResult(task, result, runId, threadId) {
+  const artifact = resultArtifactFor(task, result);
+  return {
+    ...task,
+    metadata: { ...task.metadata ?? {}, a2aRunId: runId, threadId },
+    artifacts: [
+      ...(task.artifacts ?? []).filter(
+        (item) => item.artifactId !== artifact.artifactId && item.name !== "result"
+      ),
+      artifact
+    ],
+    status: { state: "completed", timestamp: (/* @__PURE__ */ new Date()).toISOString() }
+  };
+}
+function deriveInterruption(task, interrupts) {
+  const existing = task.metadata?.interruption;
+  if (existing && typeof existing === "object") {
+    return existing;
+  }
+  if (interrupts.length === 0) return void 0;
+  const review = interrupts.some((interrupt) => interrupt.type === "task_review");
+  const clarify = interrupts.some((interrupt) => interrupt.type === "clarify");
+  const summary = task.status.message ? task.status.message.parts.filter((part) => part.kind === "text").map((part) => part.text).join("").trim() : "";
+  return {
+    type: review ? "review_required" : clarify ? "missing_input" : "user_decision",
+    summary: summary || "A2A requires input"
+  };
+}
+function interruptArtifactFor(task, interrupts) {
+  if (interrupts.length === 0) return void 0;
+  return {
+    artifactId: `${task.id}:interrupt`,
+    name: "interrupt",
+    parts: interrupts.map((interrupt) => {
+      const payload = interrupt.payload;
+      const record = typeof payload === "object" && payload !== null && !Array.isArray(payload) ? payload : void 0;
+      const schema = record?.response_schema;
+      return {
+        kind: "data",
+        data: {
+          id: interrupt.interruptId,
+          value: payload,
+          ...schema === void 0 ? {} : { response_schema: schema }
+        }
+      };
+    })
+  };
+}
+async function reconcileTaskFromRun(taskStore, runService, stateResolver, scope, body) {
+  const taskId = requestTaskId(body);
+  if (!taskId) return void 0;
+  let task;
+  try {
+    task = await taskStore.load(taskId);
+  } catch {
+    return void 0;
+  }
+  if (!task) return void 0;
+  if (isTerminalA2AState(task.status.state)) {
+    if (task.status.state !== "completed") return task;
+  }
+  const runId = asString4(task.metadata?.a2aRunId);
+  if (!runId) return task;
+  const threadId = asString4(task.metadata?.threadId) ?? task.contextId;
+  const run = await runService.getRun(
+    scope.tenantId,
+    runId,
+    threadId,
+    scope.assistantId
+  ).catch(() => void 0);
+  if (!run || !TERMINAL_RUN_STATUSES.has(run.status)) return task;
+  const projection = projectRunState(run);
+  if (!projection) return task;
+  if (projection.state === "completed") {
+    const existingResult = resultTextFromTask(task).trim();
+    const missingResult = existingResult === "" || existingResult.toLowerCase() === "(no output)";
+    let result = existingResult;
+    if (missingResult) {
+      try {
+        const messages = await stateResolver.getCurrentMessages(
+          threadId,
+          scope.assistantId,
+          scope
+        );
+        const finalAgent = [...messages].reverse().find((message) => message.role === "agent");
+        const text = finalAgent ? finalAgent.parts.filter((part) => part.kind === "text").map((part) => part.text).join("").trim() : "";
+        if (text) result = text;
+      } catch {
+      }
+    }
+    if (task.status.state === "completed" && !missingResult) return task;
+    const completedTask = withResult(task, result || "(no output)", runId, threadId);
+    if (taskStore.completeRun) {
+      return taskStore.completeRun(completedTask, result || "(no output)");
+    }
+    await taskStore.save(completedTask);
+    return await taskStore.load(taskId) ?? completedTask;
+  }
+  if (projection.state === "input-required") {
+    let interrupts = [];
+    try {
+      const resolved = await stateResolver.getInterrupts(
+        threadId,
+        scope.assistantId,
+        scope
+      );
+      interrupts = Array.isArray(resolved) ? resolved : [];
+    } catch {
+    }
+    const interruption = deriveInterruption(task, interrupts);
+    const artifact = interruptArtifactFor(task, interrupts);
+    const next2 = {
+      ...task,
+      metadata: {
+        ...task.metadata ?? {},
+        a2aRunId: runId,
+        threadId,
+        ...interruption ? { interruption } : {}
+      },
+      ...artifact ? {
+        artifacts: [
+          ...(task.artifacts ?? []).filter(
+            (item) => item.artifactId !== artifact.artifactId
+          ),
+          artifact
+        ]
+      } : {},
+      status: {
+        state: "input-required",
+        ...task.status.message ? { message: task.status.message } : {},
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+    await taskStore.save(next2);
+    return await taskStore.load(taskId) ?? next2;
+  }
+  if (task.status.state === projection.state) return task;
+  const next = {
+    ...task,
+    metadata: { ...task.metadata ?? {}, a2aRunId: runId, threadId },
+    status: {
+      state: projection.state,
+      ...projection.message ? { message: projection.message } : {},
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+  await taskStore.save(next);
+  return await taskStore.load(taskId) ?? next;
+}
+async function cancelTaskFromRun(taskStore, runService, scope, body) {
+  if (requestMethod(body) !== "tasks/cancel") return void 0;
+  const taskId = requestTaskId(body);
+  if (!taskId) return void 0;
+  const task = await taskStore.load(taskId);
+  if (!task || isTerminalA2AState(task.status.state)) return void 0;
+  const runId = asString4(task.metadata?.a2aRunId);
+  if (!runId) return void 0;
+  const threadId = asString4(task.metadata?.threadId) ?? task.contextId;
+  const before = await runService.getRun(
+    scope.tenantId,
+    runId,
+    threadId,
+    scope.assistantId
+  );
+  if (!before) throw A2AError3.taskNotCancelable(taskId);
+  if (TERMINAL_RUN_STATUSES.has(before.status)) {
+    if (before.status !== "interrupted" && before.cancelRequested !== true) {
+      throw A2AError3.taskNotCancelable(taskId);
+    }
+  } else {
+    await runService.cancel(scope.tenantId, threadId, scope.assistantId, runId);
+    const after = await runService.getRun(
+      scope.tenantId,
+      runId,
+      threadId,
+      scope.assistantId
+    );
+    if (!after) throw A2AError3.taskNotCancelable(taskId);
+    if (!TERMINAL_RUN_STATUSES.has(after.status)) {
+      throw new Error(`Run ${runId} did not reach a terminal state after cancellation`);
+    }
+    if (after.status !== "interrupted" && after.status !== "cancelled" && after.cancelRequested !== true) {
+      throw A2AError3.taskNotCancelable(taskId);
+    }
+  }
+  const canceled = {
+    ...task,
+    metadata: { ...task.metadata ?? {}, a2aRunId: runId, threadId },
+    status: { state: "canceled", timestamp: (/* @__PURE__ */ new Date()).toISOString() }
+  };
+  await taskStore.save(canceled);
+  return await taskStore.load(taskId) ?? canceled;
+}
+function getHeader(value) {
+  if (Array.isArray(value)) return value[0];
+  return value;
+}
+function getSessionUser(request) {
+  return request.user;
+}
+function buildBaseUrl(request) {
+  const protocol = getHeader(request.headers["x-forwarded-proto"]) ?? request.protocol;
+  const forwardedHost = getHeader(request.headers["x-forwarded-host"]);
+  const host = forwardedHost ? forwardedHost.split(",")[0].trim() : request.host;
+  return `${protocol}://${host}`;
+}
+function makeFileIngestor(tenantId, maxFileBytes) {
+  return new A2AFileIngestor({
+    saveProjectFile: (params) => saveProjectFile({ tenantId, ...params }),
+    ...maxFileBytes !== void 0 ? { maxBytes: maxFileBytes } : {}
+  });
+}
+async function resolveWorkspaceId(getProjectStore, tenantId, projectId) {
+  if (!projectId) return void 0;
+  try {
+    const project = await getProjectStore().getProjectById(tenantId, projectId);
+    return project?.workspaceId;
+  } catch {
+    return void 0;
+  }
+}
+function extractRequestId(body) {
+  if (typeof body === "object" && body !== null && "id" in body) {
+    const id = body.id;
+    if (typeof id === "string" || typeof id === "number" || id === null) {
+      return id;
+    }
+  }
+  return null;
+}
+function authErrorToRpcCode(statusCode) {
+  switch (statusCode) {
+    case 401:
+      return -32001;
+    case 403:
+      return -32002;
+    case 404:
+      return -32003;
+    default:
+      return -32603;
+  }
+}
+function jsonRpcError(id, code, message) {
+  return { jsonrpc: "2.0", id, error: { code, message } };
+}
+var DEFAULT_A2A_TASKS_PAGE_SIZE = 50;
+var MAX_A2A_TASKS_PAGE_SIZE = 200;
+var TASKS_LIST_STATUSES = {
+  submitted: ["pending"],
+  working: ["in_progress"],
+  "input-required": ["interrupted", "review"],
+  completed: ["completed"],
+  failed: ["failed"],
+  canceled: ["cancelled"],
+  rejected: ["failed"],
+  pending: ["pending"],
+  in_progress: ["in_progress"],
+  review: ["review"],
+  interrupted: ["interrupted"],
+  cancelled: ["cancelled"]
+};
+function asRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function encodePageToken(offset) {
+  return Buffer.from(String(offset), "utf8").toString("base64url");
+}
+function decodePageToken(token) {
+  if (!/^[A-Za-z0-9_-]+$/.test(token)) return void 0;
+  const text = Buffer.from(token, "base64url").toString("utf8");
+  if (!/^\d+$/.test(text)) return void 0;
+  const offset = Number(text);
+  return Number.isSafeInteger(offset) && offset >= 0 ? offset : void 0;
+}
+function parseTasksListQuery(body) {
+  const record = asRecord4(body);
+  const rawParams = record?.params;
+  if (rawParams !== void 0 && rawParams !== null && asRecord4(rawParams) === void 0) {
+    return { ok: false, message: "params must be an object" };
+  }
+  const params = asRecord4(rawParams) ?? {};
+  let pageSize = DEFAULT_A2A_TASKS_PAGE_SIZE;
+  if (params.pageSize !== void 0) {
+    const value = params.pageSize;
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > MAX_A2A_TASKS_PAGE_SIZE) {
+      return {
+        ok: false,
+        message: `pageSize must be an integer between 1 and ${MAX_A2A_TASKS_PAGE_SIZE}`
+      };
+    }
+    pageSize = value;
+  }
+  let offset = 0;
+  if (params.pageToken !== void 0) {
+    const token = params.pageToken;
+    const decoded = typeof token === "string" ? decodePageToken(token) : void 0;
+    if (decoded === void 0) {
+      return { ok: false, message: "pageToken is invalid" };
+    }
+    offset = decoded;
+  }
+  let contextId;
+  if (params.contextId !== void 0) {
+    if (typeof params.contextId !== "string") {
+      return { ok: false, message: "contextId must be a string" };
+    }
+    contextId = params.contextId;
+  }
+  let statusTimestampAfter;
+  if (params.statusTimestampAfter !== void 0) {
+    if (typeof params.statusTimestampAfter !== "string") {
+      return { ok: false, message: "statusTimestampAfter must be a string" };
+    }
+    statusTimestampAfter = params.statusTimestampAfter;
+  }
+  let statuses;
+  if (params.status !== void 0) {
+    const value = params.status;
+    if (typeof value !== "string" || !Object.prototype.hasOwnProperty.call(TASKS_LIST_STATUSES, value)) {
+      return { ok: false, message: "status is invalid" };
+    }
+    statuses = TASKS_LIST_STATUSES[value];
+  }
+  return {
+    ok: true,
+    query: {
+      pageSize,
+      offset,
+      ...statuses ? { statuses } : {},
+      ...contextId ? { contextId } : {},
+      ...statusTimestampAfter ? { statusTimestampAfter } : {}
+    }
+  };
+}
+function isA2ATaskSnapshot2(value, id) {
+  return typeof value === "object" && value !== null && value.id === id && typeof value.status === "object" && value.status !== null;
+}
+function isCanonicalA2ATaskItem(item, scope) {
+  return item.tenantId === scope.tenantId && item.ownerType === "agent" && item.ownerId === scope.assistantId && item.projectId === scope.projectId && item.sourceId === "a2a";
+}
+async function listCanonicalA2ATasks(internalTasks, taskStore, scope, query) {
+  const statuses = query.statuses;
+  const storeStatus = statuses?.length === 1 ? statuses[0] : void 0;
+  const fetchSize = query.pageSize + 1;
+  const tasks = [];
+  const seen = /* @__PURE__ */ new Set();
+  let cursor = query.offset;
+  for (; ; ) {
+    const rows = await internalTasks.list({
+      tenantId: scope.tenantId,
+      ownerType: "agent",
+      ownerId: scope.assistantId,
+      projectId: scope.projectId,
+      sourceId: "a2a",
+      ...storeStatus ? { status: storeStatus } : {},
+      limit: fetchSize,
+      offset: cursor
+    });
+    if (rows.length === 0) break;
+    let nextPageToken;
+    for (let index = 0; index < rows.length; index += 1) {
+      const item = rows[index];
+      if (!isCanonicalA2ATaskItem(item, scope)) continue;
+      if (statuses && !statuses.includes(item.status)) continue;
+      const restored = await taskStore.load(item.id).catch(() => void 0);
+      if (!restored || !isA2ATaskSnapshot2(restored, item.id)) continue;
+      if (query.contextId && restored.contextId !== query.contextId) continue;
+      if (query.statusTimestampAfter && (!restored.status.timestamp || restored.status.timestamp <= query.statusTimestampAfter)) continue;
+      if (seen.has(restored.id)) continue;
+      if (tasks.length < query.pageSize) {
+        seen.add(restored.id);
+        tasks.push(restored);
+        continue;
+      }
+      nextPageToken = encodePageToken(cursor + index);
+      break;
+    }
+    if (nextPageToken !== void 0) {
+      return { tasks, nextPageToken };
+    }
+    cursor += rows.length;
+    if (rows.length < fetchSize) break;
+  }
+  return { tasks };
+}
+function isAsyncGenerator(value) {
+  return typeof value === "object" && value !== null && typeof value[Symbol.asyncIterator] === "function";
+}
+var SSE_HEADERS = {
+  "Content-Type": "text/event-stream",
+  "Cache-Control": "no-cache",
+  Connection: "keep-alive",
+  "Access-Control-Allow-Origin": "*",
+  "A2A-Version": "0.3"
+};
+function registerA2AStandardRoutes(app, deps) {
+  const authService = deps.authService;
+  const resolveTasks = deps.getTaskStoreLattice ?? (() => getStoreLattice("default", "task").store);
+  const resolveTaskWorkItems = deps.getTaskWorkItemStore ?? (() => getStoreLattice("default", "taskWorkItem").store);
+  const getAssistantStore = deps.getAssistantStore ?? (() => getStoreLattice("default", "assistant").store);
+  const getProjectStore = deps.getProjectStore ?? (() => getStoreLattice("default", "project").store);
+  const resolveRunLedger = deps.getAgentRunLedger ?? (() => getStoreLattice("default", "agentRun").store);
+  const resolveStore = deps.getStore ?? (() => getStoreLattice("default", "store").store);
+  const hasPushStore = () => {
+    try {
+      return Boolean(resolveStore());
+    } catch {
+      return false;
+    }
+  };
+  const createPushStore = (scope) => {
+    const store = resolveStore();
+    if (!store) return void 0;
+    return new A2APushNotificationStore({
+      store,
+      scope: {
+        tenantId: scope.tenantId,
+        assistantId: scope.assistantId
+      },
+      ...deps.resolvePushHost ? { resolveHost: deps.resolvePushHost } : {}
+    });
+  };
+  const unavailableRunLedger = () => ({
+    createPendingRun: async () => {
+      throw new Error("A2A run ledger is not configured");
+    },
+    getRun: async () => void 0,
+    requestCancel: async () => "not_found"
+  });
+  const runServiceFor = (scope) => {
+    if (deps.createRunService) return deps.createRunService(scope);
+    let ledger;
+    try {
+      ledger = resolveRunLedger();
+    } catch {
+      ledger = unavailableRunLedger();
+    }
+    const maxActiveRunsForTenant = resolveRunTaskMaxActivePerTenant();
+    return new A2ARunService({
+      ledger,
+      chunkSource: runServiceChunkSource(scope),
+      ...maxActiveRunsForTenant === void 0 ? {} : { maxActiveRunsForTenant },
+      getLatestCursor: async (threadId, assistantId) => {
+        const buffer = getChunkBuffer("default");
+        if (!buffer) return void 0;
+        const key = chunkBufferStreamKey(scope.tenantId, assistantId, threadId);
+        const status = await buffer.getThreadStatus(key);
+        if (status !== "active") return void 0;
+        return buffer.latestCursor(key);
+      }
+    });
+  };
+  const stateResolver = deps.stateResolver ?? defaultStateResolver();
+  const runtimeRegistry = deps.runtimeRegistry ?? new A2ARuntimeRegistry();
+  const taskStoreFor = (scope, internalTasks, workItems) => new A2ATaskStoreAdapter({
+    taskStore: internalTasks,
+    workItemStore: workItems,
+    lifecycle: createTaskLifecycleService({
+      taskStore: internalTasks,
+      workItemStore: workItems
+    }),
+    scope
+  });
+  app.addHook("onClose", async () => {
+    runtimeRegistry.close();
+  });
+  const handleTaskResubscribe = async (request, reply, requestId, scope, taskStore, options = {}) => {
+    const version = options.version ?? "0.3";
+    reply.header("A2A-Version", version);
+    const body = asRecord4(options.body ?? request.body);
+    const params = asRecord4(body?.params);
+    const taskId = asString4(params?.id);
+    if (!taskId) {
+      reply.send(jsonRpcError(requestId, -32602, "Invalid params: id is required"));
+      return;
+    }
+    let task;
+    try {
+      task = await taskStore.load(taskId);
+    } catch (err) {
+      request.log.error({ err }, "a2a:jsonrpc:resubscribe");
+      reply.status(500).send(jsonRpcError(requestId, -32603, "Internal error"));
+      return;
+    }
+    if (!task) {
+      reply.send({
+        jsonrpc: "2.0",
+        id: requestId,
+        error: A2AError3.taskNotFound(taskId).toJSONRPCError()
+      });
+      return;
+    }
+    let runtimeLease;
+    try {
+      runtimeLease = runtimeRegistry.acquire(scope);
+    } catch (err) {
+      if (err instanceof A2ARuntimeCapacityError) {
+        request.log.error({ err, scope }, "a2a:jsonrpc:runtime_capacity");
+        reply.status(503).send(jsonRpcError(requestId, -32603, "A2A runtime capacity exhausted"));
+        return;
+      }
+      throw err;
+    }
+    reply.hijack();
+    reply.raw.writeHead(200, { ...SSE_HEADERS, "A2A-Version": version });
+    const writeFrame = async (frame, event) => {
+      if (reply.raw.writableEnded || reply.raw.destroyed) return;
+      const data = `${event ? `event: ${event}
+` : ""}data: ${JSON.stringify(frame)}
+
+`;
+      if (reply.raw.write(data)) return;
+      await new Promise((resolve) => {
+        const done = () => {
+          reply.raw.off("drain", done);
+          reply.raw.off("close", done);
+          resolve();
+        };
+        reply.raw.once("drain", done);
+        reply.raw.once("close", done);
+      });
+    };
+    const resultFrame = (result) => ({
+      jsonrpc: "2.0",
+      id: requestId,
+      result: version === "1.0" ? toA2A11StreamResult(result) : result
+    });
+    let disconnected = false;
+    let iterator;
+    const closeIterator = async () => {
+      if (!iterator) return;
+      const current = iterator;
+      iterator = void 0;
+      try {
+        await current.return?.();
+      } catch {
+      }
+    };
+    const onClose = () => {
+      disconnected = true;
+      void closeIterator();
+    };
+    reply.raw.once("close", onClose);
+    try {
+      await writeFrame(resultFrame(task));
+      if (disconnected || isTerminalA2AState(task.status.state)) return;
+      const runId = asString4(task.metadata?.a2aRunId);
+      if (!runId) return;
+      const threadId = asString4(task.metadata?.threadId) ?? task.contextId;
+      const messageId = asString4(task.metadata?.a2aMessageId);
+      const cursor = asString4(task.metadata?.a2aStreamCursor);
+      const runService = runServiceFor(scope);
+      const reconcileCanonicalTask = async () => {
+        const reconciled = await reconcileTaskFromRun(
+          taskStore,
+          runService,
+          stateResolver,
+          scope,
+          options.body ?? request.body
+        ).catch(() => void 0);
+        return reconciled ?? taskStore.load(taskId).catch(() => void 0);
+      };
+      const run = await runService.getRun(scope.tenantId, runId, threadId, scope.assistantId).catch(() => void 0);
+      if (!run) return;
+      if (TERMINAL_RUN_STATUSES.has(run.status)) {
+        const canonical2 = await reconcileCanonicalTask();
+        if (canonical2 && !disconnected) await writeFrame(resultFrame(canonical2));
+        return;
+      }
+      if (!messageId) return;
+      const source = runService.stream(
+        threadId,
+        scope.assistantId,
+        messageId,
+        cursor,
+        { tenantId: scope.tenantId, runId }
+      );
+      iterator = source[Symbol.asyncIterator]();
+      try {
+        for (; ; ) {
+          if (disconnected) return;
+          const next = await iterator.next();
+          if (next.done) break;
+          const chunk = next.value;
+          const text = chunk.data?.content ?? "";
+          if (chunk.type === MessageChunkTypes3.AI && text) {
+            await writeFrame(resultFrame({
+              kind: "status-update",
+              taskId: task.id,
+              contextId: task.contextId,
+              status: {
+                state: "working",
+                message: agentMessage2(text),
+                timestamp: (/* @__PURE__ */ new Date()).toISOString()
+              },
+              final: false
+            }));
+          }
+          if (chunk.type === MessageChunkTypes3.MESSAGE_COMPLETED || chunk.type === MessageChunkTypes3.MESSAGE_FAILED || chunk.type === MessageChunkTypes3.INTERRUPT) {
+            break;
+          }
+        }
+      } finally {
+        await closeIterator();
+      }
+      if (disconnected) return;
+      await runService.join(
+        scope.tenantId,
+        threadId,
+        scope.assistantId,
+        runId,
+        RESUBSCRIBE_SETTLE_TIMEOUT_MS
+      ).catch(() => void 0);
+      if (disconnected) return;
+      const canonical = await reconcileCanonicalTask();
+      if (canonical) await writeFrame(resultFrame(canonical));
+    } catch (err) {
+      if (err instanceof ChunkCursorExpiredError) {
+        await writeFrame({
+          jsonrpc: "2.0",
+          id: requestId,
+          error: {
+            code: -32603,
+            message: "CURSOR_EXPIRED",
+            data: { code: "CURSOR_EXPIRED" }
+          }
+        }, "error");
+        return;
+      }
+      request.log.error({ err }, "a2a:jsonrpc:resubscribe:stream");
+      await writeFrame({
+        jsonrpc: "2.0",
+        id: requestId,
+        error: A2AError3.internalError(
+          err instanceof Error ? err.message : "Streaming error."
+        ).toJSONRPCError()
+      }, "error");
+    } finally {
+      reply.raw.off("close", onClose);
+      await closeIterator();
+      runtimeLease.release();
+      if (!reply.raw.writableEnded) reply.raw.end();
+    }
+  };
+  const handleAgentCard = async (request, reply) => {
+    const auth = await authService.authenticate(
+      getHeader(request.headers.authorization) ?? getHeader(request.headers["x-api-key"])
+    );
+    if (!auth.authenticated) {
+      reply.status(401).send({ error: "Unauthorized" });
+      return;
+    }
+    let assistant;
+    try {
+      assistant = await authService.assertAgentAccess(
+        auth,
+        request.params.assistantId
+      );
+    } catch (err) {
+      if (err instanceof A2AAuthError) {
+        reply.status(err.statusCode).send({ error: err.message });
+        return;
+      }
+      request.log.error({ err }, "a2a:agent-card:auth");
+      reply.status(500).send({ error: "Internal error" });
+      return;
+    }
+    reply.header("A2A-Version", "0.3");
+    const officialAlias = request.url.split("?")[0].startsWith("/a2a/");
+    reply.status(200).send(
+      buildAgentCardForAssistant({
+        assistant,
+        baseUrl: buildBaseUrl(request),
+        pushNotifications: hasPushStore(),
+        ...officialAlias ? { jsonRpcPath: `/a2a/${assistant.id}` } : {}
+      })
+    );
+  };
+  app.get(
+    "/api/a2a/agents/:assistantId/.well-known/agent-card.json",
+    handleAgentCard
+  );
+  app.get(
+    "/a2a/:assistantId/.well-known/agent-card.json",
+    handleAgentCard
+  );
+  const handleJsonRpc = async (request, reply) => {
+    const requestId = extractRequestId(request.body);
+    const auth = await authService.authenticate(
+      getHeader(request.headers.authorization) ?? getHeader(request.headers["x-api-key"])
+    );
+    if (!auth.authenticated) {
+      reply.status(401).send(jsonRpcError(requestId, -32001, "Unauthorized"));
+      return;
+    }
+    let assistant;
+    try {
+      assistant = await authService.assertAgentAccess(
+        auth,
+        request.params.assistantId
+      );
+    } catch (err) {
+      if (err instanceof A2AAuthError) {
+        reply.status(err.statusCode).send(
+          jsonRpcError(
+            requestId,
+            authErrorToRpcCode(err.statusCode),
+            err.message
+          )
+        );
+        return;
+      }
+      request.log.error({ err }, "a2a:jsonrpc:auth");
+      reply.status(500).send(jsonRpcError(requestId, -32603, "Internal error"));
+      return;
+    }
+    const tenantId = auth.tenantId ?? "default";
+    const scope = {
+      tenantId,
+      projectId: auth.projectId ?? "",
+      workspaceId: await resolveWorkspaceId(getProjectStore, tenantId, auth.projectId),
+      assistantId: assistant.id
+    };
+    const internalTasks = resolveTasks();
+    const workItems = resolveTaskWorkItems();
+    const taskStore = taskStoreFor(scope, internalTasks, workItems);
+    const method = requestMethod(request.body);
+    if (method === "tasks/list" || method === "agent/getExtendedAgentCard" || method === "agent/getAuthenticatedExtendedCard") {
+      reply.header("A2A-Version", "0.3");
+      if (method === "tasks/list") {
+        const parsed = parseTasksListQuery(request.body);
+        if (!parsed.ok) {
+          reply.send(jsonRpcError(requestId, -32602, parsed.message));
+          return;
+        }
+        try {
+          const result2 = await listCanonicalA2ATasks(
+            internalTasks,
+            taskStore,
+            scope,
+            parsed.query
+          );
+          reply.send({ jsonrpc: "2.0", id: requestId, result: result2 });
+        } catch (err) {
+          request.log.error({ err }, "a2a:jsonrpc:tasks-list");
+          reply.send(jsonRpcError(requestId, -32603, "Internal error"));
+        }
+        return;
+      }
+      const extendedCard = buildAgentCardForAssistant({
+        assistant,
+        baseUrl: buildBaseUrl(request),
+        pushNotifications: hasPushStore(),
+        ...request.url.split("?")[0].startsWith("/a2a/") ? { jsonRpcPath: `/a2a/${assistant.id}` } : {}
+      });
+      reply.send({ jsonrpc: "2.0", id: requestId, result: extendedCard });
+      return;
+    }
+    if (method === "tasks/resubscribe") {
+      await handleTaskResubscribe(request, reply, requestId, scope, taskStore);
+      return;
+    }
+    const ingestor = makeFileIngestor(scope.tenantId, deps.maxFileBytes);
+    const runService = runServiceFor(scope);
+    const executor = new AxiomAgentExecutor({
+      scope,
+      assistant,
+      taskStore,
+      ingestor,
+      runService,
+      blocking: blockingFor(request.body),
+      getInterrupts: (threadId) => stateResolver.getInterrupts(threadId, assistant.id, scope)
+    });
+    try {
+      await reconcileTaskFromRun(
+        taskStore,
+        runService,
+        stateResolver,
+        scope,
+        request.body
+      );
+      const canceled = await cancelTaskFromRun(
+        taskStore,
+        runService,
+        scope,
+        request.body
+      );
+      if (canceled) {
+        reply.header("A2A-Version", "0.3");
+        reply.send({ jsonrpc: "2.0", id: requestId, result: canceled });
+        return;
+      }
+    } catch (err) {
+      if (err instanceof A2AError3) {
+        reply.send(jsonRpcError(requestId, err.code, err.message));
+        return;
+      }
+      request.log.error({ err }, "a2a:jsonrpc:reconcile");
+      reply.status(500).send(jsonRpcError(requestId, -32603, "Internal error"));
+      return;
+    }
+    const resumeError = await resumeValidationError(taskStore, request.body).catch(() => void 0);
+    if (resumeError !== void 0) {
+      reply.send(jsonRpcError(requestId, -32602, resumeError));
+      return;
+    }
+    let pushStore;
+    try {
+      pushStore = createPushStore(scope);
+    } catch (err) {
+      request.log.warn({ err }, "a2a:jsonrpc:push-store-unavailable");
+    }
+    const card = buildAgentCardForAssistant({
+      assistant,
+      baseUrl: buildBaseUrl(request),
+      pushNotifications: pushStore !== void 0,
+      ...request.url.split("?")[0].startsWith("/a2a/") ? { jsonRpcPath: `/a2a/${assistant.id}` } : {}
+    });
+    let runtimeLease;
+    try {
+      runtimeLease = runtimeRegistry.acquire(scope);
+    } catch (err) {
+      if (err instanceof A2ARuntimeCapacityError) {
+        request.log.error({ err, scope }, "a2a:jsonrpc:runtime_capacity");
+        reply.status(503).send(jsonRpcError(requestId, -32603, "A2A runtime capacity exhausted"));
+        return;
+      }
+      throw err;
+    }
+    let result;
+    try {
+      const pushSender = pushStore ? deps.getPushNotificationSender?.(pushStore) ?? new A2APushNotificationSender({
+        store: pushStore,
+        ...deps.resolvePushHost ? { resolveHost: deps.resolvePushHost } : {}
+      }) : void 0;
+      const handler = new DefaultRequestHandler(
+        card,
+        taskStore,
+        executor,
+        runtimeLease.manager,
+        pushStore,
+        pushSender
+      );
+      const transport = new JsonRpcTransportHandler(handler);
+      reply.header("A2A-Version", "0.3");
+      result = await transport.handle(request.body);
+    } catch (err) {
+      runtimeLease.release();
+      if (err instanceof A2AError3) {
+        reply.send(jsonRpcError(requestId, err.code, err.message));
+        return;
+      }
+      request.log.error({ err }, "a2a:jsonrpc:handler");
+      reply.status(500).send(jsonRpcError(requestId, -32603, "Internal error"));
+      return;
+    }
+    if (isAsyncGenerator(result)) {
+      reply.hijack();
+      reply.raw.writeHead(200, SSE_HEADERS);
+      try {
+        for await (const evt of result) {
+          reply.raw.write(`data: ${JSON.stringify(evt)}
+
+`);
+        }
+      } catch (err) {
+        request.log.error({ err }, "a2a:jsonrpc:stream");
+        const errorResponse = {
+          jsonrpc: "2.0",
+          id: requestId,
+          error: A2AError3.internalError(
+            err instanceof Error ? err.message : "Streaming error."
+          ).toJSONRPCError()
+        };
+        reply.raw.write(`event: error
+data: ${JSON.stringify(errorResponse)}
+
+`);
+      } finally {
+        runtimeLease.release();
+        reply.raw.end();
+      }
+      return;
+    }
+    runtimeLease.release();
+    reply.send(result);
+  };
+  app.post(
+    "/api/a2a/agents/:assistantId/jsonrpc",
+    handleJsonRpc
+  );
+  app.post(
+    "/a2a/:assistantId",
+    handleJsonRpc
+  );
+  app.post(
+    "/api/a2a/agents/:assistantId/test-call",
+    async (request, reply) => {
+      const user = getSessionUser(request);
+      if (!user?.tenantId) {
+        reply.status(401).send({ success: false, error: "Unauthorized" });
+        return;
+      }
+      const tenantId = user.tenantId;
+      const body = request.body ?? {};
+      const { projectId, message } = body;
+      if (!projectId) {
+        reply.status(400).send({ error: "projectId is required" });
+        return;
+      }
+      if (!message || !message.trim()) {
+        reply.status(400).send({ error: "message is required" });
+        return;
+      }
+      const assistant = await getAssistantStore().getAssistantById(
+        tenantId,
+        request.params.assistantId
+      );
+      if (!assistant) {
+        reply.status(404).send({ error: "Assistant not found" });
+        return;
+      }
+      const project = await getProjectStore().getProjectById(
+        tenantId,
+        projectId
+      );
+      if (!project || project.tenantId !== tenantId) {
+        reply.status(403).send({ error: "Project not found" });
+        return;
+      }
+      const scope = {
+        tenantId,
+        projectId,
+        workspaceId: project.workspaceId,
+        assistantId: assistant.id
+      };
+      const ingestor = makeFileIngestor(scope.tenantId, deps.maxFileBytes);
+      const internalTasks = resolveTasks();
+      const workItems = resolveTaskWorkItems();
+      const taskStore = taskStoreFor(scope, internalTasks, workItems);
+      const executor = new AxiomAgentExecutor({
+        scope,
+        assistant,
+        taskStore,
+        ingestor,
+        runService: runServiceFor(scope),
+        blocking: true,
+        getInterrupts: (threadId) => stateResolver.getInterrupts(threadId, assistant.id, scope)
+      });
+      const taskId = uuidv42();
+      const contextId = uuidv42();
+      const userMessage = {
+        kind: "message",
+        messageId: uuidv42(),
+        role: "user",
+        parts: [{ kind: "text", text: message }]
+      };
+      const requestContext = new RequestContext(userMessage, taskId, contextId);
+      const bus = new DefaultExecutionEventBus2();
+      reply.hijack();
+      reply.raw.writeHead(200, SSE_HEADERS);
+      const sendEvent = (event, data) => {
+        reply.raw.write(`event: ${event}
+data: ${JSON.stringify(data)}
+
+`);
+      };
+      bus.on("event", (event) => {
+        sendEvent(event.kind, event);
+      });
+      try {
+        await executor.execute(requestContext, bus);
+      } catch (err) {
+        request.log.error({ err }, "a2a:test-call:execution");
+        try {
+          await taskStore.save({
+            kind: "task",
+            id: taskId,
+            contextId,
+            status: { state: "failed", timestamp: (/* @__PURE__ */ new Date()).toISOString() }
+          });
+        } catch (saveError) {
+          request.log.error({ err: saveError }, "a2a:test-call:settle");
+        }
+        sendEvent("status-update", {
+          kind: "status-update",
+          taskId,
+          contextId,
+          status: { state: "failed", timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+          final: true
+        });
+      } finally {
+        reply.raw.end();
+      }
+    }
+  );
+  const v1CardFor = (request, assistant, pushNotifications) => buildAgentCardForAssistantV1({
+    assistant,
+    baseUrl: buildBaseUrl(request),
+    pushNotifications
+  });
+  const authenticateV1 = async (request) => {
+    const auth = await authService.authenticate(
+      getHeader(request.headers.authorization) ?? getHeader(request.headers["x-api-key"])
+    );
+    if (!auth.authenticated) {
+      return { ok: false, status: 401, message: "Unauthorized" };
+    }
+    try {
+      const assistant = await authService.assertAgentAccess(
+        auth,
+        request.params.assistantId
+      );
+      return { ok: true, assistant, auth };
+    } catch (err) {
+      if (err instanceof A2AAuthError) {
+        return { ok: false, status: err.statusCode, message: err.message };
+      }
+      throw err;
+    }
+  };
+  app.get(
+    "/a2a/v1/:assistantId/.well-known/agent-card.json",
+    async (request, reply) => {
+      const auth = await authenticateV1(request);
+      if (!auth.ok) {
+        reply.status(auth.status).send({ error: auth.message });
+        return;
+      }
+      reply.header("A2A-Version", "1.0");
+      reply.status(200).send(
+        AgentCardV1.toJSON(
+          v1CardFor(request, auth.assistant, hasPushStore())
+        )
+      );
+    }
+  );
+  app.post(
+    "/a2a/v1/:assistantId",
+    async (request, reply) => {
+      const requestBody = asRecord4(request.body) ?? {};
+      const requestId = extractRequestId(requestBody);
+      reply.header("A2A-Version", "1.0");
+      const requestedVersion = getHeader(request.headers["a2a-version"]);
+      if (requestedVersion !== void 0 && !requestedVersion.startsWith("1.0")) {
+        reply.header("A2A-Version", "1.0").send(versionNotSupportedError(requestId, requestedVersion));
+        return;
+      }
+      const auth = await authenticateV1(request);
+      if (!auth.ok) {
+        reply.status(auth.status).send(jsonRpcError(requestId, authErrorToRpcCode(auth.status), auth.message));
+        return;
+      }
+      const rawMethod = asString4(requestBody.method);
+      const tenantId = auth.auth.tenantId ?? "default";
+      const scope = {
+        tenantId,
+        projectId: auth.auth.projectId ?? "",
+        workspaceId: await resolveWorkspaceId(getProjectStore, tenantId, auth.auth.projectId),
+        assistantId: auth.assistant.id
+      };
+      const internalTasks = resolveTasks();
+      const workItems = resolveTaskWorkItems();
+      const taskStore = taskStoreFor(scope, internalTasks, workItems);
+      if (rawMethod === "ListTasks") {
+        const v03Body2 = toA2A03JsonRpcRequest(requestBody);
+        const parsed = parseTasksListQuery(v03Body2);
+        if (!parsed.ok) {
+          reply.send(jsonRpcError(requestId, -32602, parsed.message));
+          return;
+        }
+        try {
+          const result2 = await listCanonicalA2ATasks(
+            internalTasks,
+            taskStore,
+            scope,
+            parsed.query
+          );
+          const listParams = asRecord4(requestBody.params);
+          reply.send({
+            jsonrpc: "2.0",
+            id: requestId,
+            result: toA2A11ListResult(result2, {
+              includeArtifacts: listParams?.includeArtifacts === true
+            })
+          });
+        } catch (err) {
+          request.log.error({ err }, "a2a:v1:list");
+          reply.send(jsonRpcError(requestId, -32603, "Internal error"));
+        }
+        return;
+      }
+      if (rawMethod === "GetExtendedAgentCard") {
+        reply.send({
+          jsonrpc: "2.0",
+          id: requestId,
+          result: AgentCardV1.toJSON(
+            v1CardFor(request, auth.assistant, hasPushStore())
+          )
+        });
+        return;
+      }
+      const v03Body = toA2A03JsonRpcRequest(requestBody);
+      if (rawMethod === "SubscribeToTask") {
+        await handleTaskResubscribe(
+          request,
+          reply,
+          requestId,
+          scope,
+          taskStore,
+          { version: "1.0", body: v03Body }
+        );
+        return;
+      }
+      const ingestor = makeFileIngestor(scope.tenantId, deps.maxFileBytes);
+      const runService = runServiceFor(scope);
+      const executor = new AxiomAgentExecutor({
+        scope,
+        assistant: auth.assistant,
+        taskStore,
+        ingestor,
+        runService,
+        blocking: blockingFor(v03Body),
+        getInterrupts: (threadId) => stateResolver.getInterrupts(threadId, auth.assistant.id, scope)
+      });
+      try {
+        await reconcileTaskFromRun(
+          taskStore,
+          runService,
+          stateResolver,
+          scope,
+          v03Body
+        );
+        const canceled = await cancelTaskFromRun(
+          taskStore,
+          runService,
+          scope,
+          v03Body
+        );
+        if (canceled) {
+          reply.send({
+            jsonrpc: "2.0",
+            id: requestId,
+            result: toA2A11Result(canceled, rawMethod)
+          });
+          return;
+        }
+      } catch (err) {
+        if (err instanceof A2AError3) {
+          reply.send(jsonRpcError(requestId, err.code, err.message));
+          return;
+        }
+        request.log.error({ err }, "a2a:v1:reconcile");
+        reply.send(jsonRpcError(requestId, -32603, "Internal error"));
+        return;
+      }
+      const resumeError = await resumeValidationError(taskStore, v03Body).catch(() => void 0);
+      if (resumeError !== void 0) {
+        reply.send(jsonRpcError(requestId, -32602, resumeError));
+        return;
+      }
+      let pushStore;
+      try {
+        pushStore = createPushStore(scope);
+      } catch (err) {
+        request.log.warn({ err }, "a2a:v1:push-store-unavailable");
+      }
+      const card = buildAgentCardForAssistant({
+        assistant: auth.assistant,
+        baseUrl: buildBaseUrl(request),
+        pushNotifications: pushStore !== void 0,
+        jsonRpcPath: `/a2a/v1/${auth.assistant.id}`
+      });
+      let runtimeLease;
+      try {
+        runtimeLease = runtimeRegistry.acquire(scope);
+      } catch (err) {
+        if (err instanceof A2ARuntimeCapacityError) {
+          request.log.error({ err, scope }, "a2a:v1:runtime_capacity");
+          reply.status(503).send(jsonRpcError(requestId, -32603, "A2A runtime capacity exhausted"));
+          return;
+        }
+        throw err;
+      }
+      let result;
+      try {
+        const pushSender = pushStore ? deps.getPushNotificationSender?.(pushStore) ?? new A2APushNotificationSender({
+          store: pushStore,
+          ...deps.resolvePushHost ? { resolveHost: deps.resolvePushHost } : {}
+        }) : void 0;
+        const handler = new DefaultRequestHandler(
+          card,
+          taskStore,
+          executor,
+          runtimeLease.manager,
+          pushStore,
+          pushSender
+        );
+        const transport = new JsonRpcTransportHandler(handler);
+        result = await transport.handle(v03Body);
+      } catch (err) {
+        runtimeLease.release();
+        if (err instanceof A2AError3) {
+          reply.send(jsonRpcError(requestId, err.code, err.message));
+          return;
+        }
+        request.log.error({ err }, "a2a:v1:handler");
+        reply.send(jsonRpcError(requestId, -32603, "Internal error"));
+        return;
+      }
+      const convertResult = (value) => {
+        if (rawMethod === "ListTaskPushNotificationConfigs") {
+          return toA2A11PushListResult(value);
+        }
+        const converted = toA2A11Result(value, rawMethod);
+        if (rawMethod === "SendMessage") {
+          if (value && typeof value === "object" && value.kind === "task") {
+            return { task: converted };
+          }
+          if (value && typeof value === "object" && value.kind === "message") {
+            return { message: converted };
+          }
+        }
+        return converted;
+      };
+      if (isAsyncGenerator(result)) {
+        reply.hijack();
+        reply.raw.writeHead(200, SSE_HEADERS);
+        try {
+          for await (const frame of result) {
+            const converted = {
+              ...frame,
+              ..."result" in frame ? { result: toA2A11StreamResult(frame.result) } : {}
+            };
+            reply.raw.write(`data: ${JSON.stringify(converted)}
+
+`);
+          }
+        } catch (err) {
+          request.log.error({ err }, "a2a:v1:stream");
+          const errorResponse = jsonRpcError(
+            requestId,
+            -32603,
+            err instanceof Error ? err.message : "Streaming error."
+          );
+          reply.raw.write(`event: error
+data: ${JSON.stringify(errorResponse)}
+
+`);
+        } finally {
+          runtimeLease.release();
+          reply.raw.end();
+        }
+        return;
+      }
+      runtimeLease.release();
+      reply.send(
+        "result" in result ? { ...result, result: convertResult(result.result) } : result
+      );
+    }
+  );
+}
+export {
+  registerA2AStandardRoutes
+};
+//# sourceMappingURL=a2a-standard-VL5I7B4W.mjs.map