@cogitator-ai/a2a 0.3.11 → 0.4.0

package/dist/server.d.ts

@@ -1,5 +1,6 @@
 import type { A2AServerConfig, AgentCard, A2AStreamEvent } from './types.js';
 import type { JsonRpcResponse } from './json-rpc.js';
+type HeaderGetter = (name: string) => string | null | undefined;
 export declare class A2AServer {
     private agents;
     private cogitator;
@@ -12,13 +13,28 @@ export declare class A2AServer {
     private cardSigning?;
     private extendedCardGenerator?;
     private allowPrivateUrls;
+    private auth?;
     constructor(config: A2AServerConfig);
+    /**
+     * Extract the credential configured by `auth` from request headers:
+     * the token of an `Authorization: Bearer` header, or the API key header.
+     * Framework adapters call this and pass the result to handleJsonRpc / handleJsonRpcStream.
+     */
+    getAuthToken(getHeader: HeaderGetter): string | undefined;
     getAgentCard(agentName?: string): AgentCard;
     getAgentCards(): AgentCard[];
-    handleJsonRpc(body: unknown): Promise<JsonRpcResponse>;
-    handleJsonRpcStream(body: unknown): AsyncGenerator<A2AStreamEvent>;
+    handleJsonRpc(body: unknown, authToken?: string): Promise<JsonRpcResponse | null>;
+    handleJsonRpcStream(body: unknown, authToken?: string, signal?: AbortSignal): AsyncGenerator<A2AStreamEvent>;
+    private validateAuth;
     private routeMethod;
     private handleSendMessage;
+    private validateInitialPushConfig;
+    private registerInitialPushConfig;
+    private assertWebhookAllowed;
+    /**
+     * Apply historyLength / acceptedOutputModes from the request configuration
+     */
+    private shapeTask;
     private handleGetTask;
     private handleCancelTask;
     private handleListTasks;
@@ -28,4 +44,5 @@ export declare class A2AServer {
     private handleDeletePushNotification;
     private handleExtendedCard;
 }
+export {};
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,SAAS,EAIT,cAAc,EAOf,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,eAAe,CAAC;AAoBrE,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,WAAW,CAAC,CAA0B;IAC9C,OAAO,CAAC,qBAAqB,CAAC,CAA2C;IACzE,OAAO,CAAC,gBAAgB,CAAU;gBAEtB,MAAM,EAAE,eAAe;IA6CnC,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS;IAe3C,aAAa,IAAI,SAAS,EAAE;IAQtB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;IA6BrD,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAAC,cAAc,CAAC;YAkK3D,WAAW;YA2BX,iBAAiB;YAwBjB,aAAa;YAMb,gBAAgB;YAMhB,eAAe;YAMf,4BAA4B;YAe5B,yBAAyB;YAQzB,2BAA2B;YAM3B,4BAA4B;YAS5B,kBAAkB;CASjC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,SAAS,EAIT,cAAc,EAQf,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,eAAe,CAAC;AAoBrE,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAsChE,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,WAAW,CAAC,CAA0B;IAC9C,OAAO,CAAC,qBAAqB,CAAC,CAA2C;IACzE,OAAO,CAAC,gBAAgB,CAAU;IAClC,OAAO,CAAC,IAAI,CAAC,CAAgB;gBAEjB,MAAM,EAAE,eAAe;IA4DnC;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS;IAWzD,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS;IAe3C,aAAa,IAAI,SAAS,EAAE;IAQtB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA4ChF,mBAAmB,CACxB,IAAI,EAAE,OAAO,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,CAAC,cAAc,CAAC;YAiKnB,YAAY;YAWZ,WAAW;YA2BX,iBAAiB;IAqC/B,OAAO,CAAC,yBAAyB;YASnB,yBAAyB;IAiBvC,OAAO,CAAC,oBAAoB;IAS5B;;OAEG;IACH,OAAO,CAAC,SAAS;YAsBH,aAAa;YAOb,gBAAgB;YAMhB,eAAe;YAcf,4BAA4B;YAa5B,yBAAyB;YAQzB,2BAA2B;YAM3B,4BAA4B;YAS5B,kBAAkB;CASjC"}

package/dist/server.js

@@ -5,7 +5,35 @@ import { A2AError } from './errors.js';
 import * as errors from './errors.js';
 import { InMemoryTaskStore } from './task-store.js';
 import { InMemoryPushNotificationStore, PushNotificationSender, validateWebhookUrl, } from './push-notifications.js';
-import { isTerminalState } from './types.js';
+import { isStreamFinalState } from './types.js';
+const MAX_LIST_LIMIT = 1000;
+function failedStatusEvent(message, taskId = '') {
+    const timestamp = new Date().toISOString();
+    return {
+        type: 'status-update',
+        taskId,
+        status: { state: 'failed', timestamp, message },
+        timestamp,
+    };
+}
+function errorMessageOf(error) {
+    if (error instanceof A2AError)
+        return error.message;
+    return error instanceof Error ? error.message : String(error);
+}
+function isValidMessage(message) {
+    if (!message || typeof message !== 'object')
+        return false;
+    const m = message;
+    return (m.role === 'user' || m.role === 'agent') && Array.isArray(m.parts);
+}
+function assertOptionalNonNegativeInt(value, name) {
+    if (value === undefined)
+        return;
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {
+        throw new A2AError(errors.invalidParams(`${name} must be a non-negative integer`));
+    }
+}
 export class A2AServer {
     agents;
     cogitator;
@@ -18,6 +46,7 @@ export class A2AServer {
     cardSigning;
     extendedCardGenerator;
     allowPrivateUrls;
+    auth;
     constructor(config) {
         const agentNames = Object.keys(config.agents);
         if (agentNames.length === 0) {
@@ -30,9 +59,10 @@ export class A2AServer {
         this.cardSigning = config.cardSigning;
         this.extendedCardGenerator = config.extendedCardGenerator;
         this.allowPrivateUrls = config.allowPrivateUrls ?? false;
+        this.auth = config.auth;
         this.pushNotificationStore =
             config.pushNotificationStore ?? new InMemoryPushNotificationStore();
-        this.pushSender = new PushNotificationSender(this.pushNotificationStore);
+        this.pushSender = new PushNotificationSender(this.pushNotificationStore, this.allowPrivateUrls);
         this.taskManager = new TaskManager({
             taskStore: config.taskStore ?? new InMemoryTaskStore(),
         });
@@ -53,9 +83,38 @@ export class A2AServer {
                     extendedAgentCard: hasExtendedCard,
                 },
             });
+            if (this.auth) {
+                const schemeName = this.auth.type === 'bearer' ? 'bearer' : 'apiKey';
+                card.securitySchemes = {
+                    [schemeName]: this.auth.type === 'bearer'
+                        ? { type: 'http', scheme: 'bearer' }
+                        : {
+                            type: 'apiKey',
+                            location: 'header',
+                            parameterName: this.auth.headerName ?? 'x-api-key',
+                        },
+                };
+                card.security = [{ [schemeName]: [] }];
+            }
             this.agentCards.set(name, card);
         }
     }
+    /**
+     * Extract the credential configured by `auth` from request headers:
+     * the token of an `Authorization: Bearer` header, or the API key header.
+     * Framework adapters call this and pass the result to handleJsonRpc / handleJsonRpcStream.
+     */
+    getAuthToken(getHeader) {
+        if (!this.auth)
+            return undefined;
+        if (this.auth.type === 'bearer') {
+            const header = getHeader('authorization');
+            const match = header ? /^Bearer\s+(.+)$/i.exec(header.trim()) : null;
+            return match ? match[1].trim() : undefined;
+        }
+        const key = getHeader(this.auth.headerName ?? 'x-api-key');
+        return key ? key.trim() || undefined : undefined;
+    }
     getAgentCard(agentName) {
         let card;
         if (agentName) {
@@ -79,7 +138,7 @@ export class A2AServer {
         }
         return cards;
     }
-    async handleJsonRpc(body) {
+    async handleJsonRpc(body, authToken) {
         let request;
         try {
             const parsed = parseJsonRpcRequest(body);
@@ -90,172 +149,195 @@ export class A2AServer {
         }
         catch (e) {
             if (e instanceof JsonRpcParseError) {
-                return createErrorResponse(null, errors.parseError(e.message));
+                return createErrorResponse(null, e.code === -32600 ? errors.invalidRequest(e.message) : errors.parseError(e.message));
             }
             return createErrorResponse(null, errors.internalError(String(e)));
         }
+        try {
+            await this.validateAuth(authToken);
+        }
+        catch (e) {
+            if (request.id === undefined)
+                return null;
+            if (e instanceof A2AError) {
+                return createErrorResponse(request.id, e.jsonRpcError);
+            }
+            return createErrorResponse(request.id, errors.internalError(String(e)));
+        }
         try {
             const result = await this.routeMethod(request.method, request.params);
+            if (request.id === undefined)
+                return null;
             return createSuccessResponse(request.id, result);
         }
         catch (e) {
+            if (request.id === undefined)
+                return null;
             if (e instanceof A2AError) {
                 return createErrorResponse(request.id, e.jsonRpcError);
             }
             return createErrorResponse(request.id, errors.internalError(e instanceof Error ? e.message : String(e)));
         }
     }
-    async *handleJsonRpcStream(body) {
+    async *handleJsonRpcStream(body, authToken, signal) {
         let request;
         try {
             const parsed = parseJsonRpcRequest(body);
             if (Array.isArray(parsed)) {
-                yield {
-                    type: 'status-update',
-                    taskId: '',
-                    status: {
-                        state: 'failed',
-                        timestamp: new Date().toISOString(),
-                        message: 'Batch requests are not supported',
-                    },
-                    timestamp: new Date().toISOString(),
-                };
+                yield failedStatusEvent('Batch requests are not supported');
                 return;
             }
             request = parsed;
         }
         catch (e) {
-            yield {
-                type: 'status-update',
-                taskId: '',
-                status: {
-                    state: 'failed',
-                    timestamp: new Date().toISOString(),
-                    message: e instanceof Error ? e.message : 'Invalid JSON-RPC request',
-                },
-                timestamp: new Date().toISOString(),
-            };
+            yield failedStatusEvent(e instanceof Error ? e.message : 'Invalid JSON-RPC request');
+            return;
+        }
+        try {
+            await this.validateAuth(authToken);
+        }
+        catch (e) {
+            yield failedStatusEvent(e instanceof Error ? e.message : 'Authentication failed');
             return;
         }
         if (request.method !== 'message/stream') {
-            yield {
-                type: 'status-update',
-                taskId: '',
-                status: {
-                    state: 'failed',
-                    timestamp: new Date().toISOString(),
-                    message: `Unsupported method for streaming: ${request.method}`,
-                },
-                timestamp: new Date().toISOString(),
-            };
+            yield failedStatusEvent(`Unsupported method for streaming: ${request.method}`);
             return;
         }
         const params = request.params;
-        if (!params?.message?.parts || !params.message.role) {
-            yield {
-                type: 'status-update',
-                taskId: '',
-                status: {
-                    state: 'failed',
-                    timestamp: new Date().toISOString(),
-                    message: 'Missing required parameter: message with role and parts',
-                },
-                timestamp: new Date().toISOString(),
-            };
+        if (!params || !isValidMessage(params.message)) {
+            yield failedStatusEvent('Missing required parameter: message with role and parts');
             return;
         }
+        const message = params.message;
         const agentName = params.agentName ?? Object.keys(this.agents)[0];
         const agent = this.agents[agentName];
         if (!agent) {
-            yield {
-                type: 'status-update',
-                taskId: '',
-                status: {
-                    state: 'failed',
-                    timestamp: new Date().toISOString(),
-                    message: `Agent not found: ${agentName}`,
-                },
-                timestamp: new Date().toISOString(),
-            };
+            yield failedStatusEvent(`Agent not found: ${agentName}`);
             return;
         }
+        if (signal?.aborted)
+            return;
         const eventQueue = [];
-        let resolve = null;
-        let taskId = null;
+        let wake = null;
+        const notify = () => {
+            if (wake) {
+                wake();
+                wake = null;
+            }
+        };
+        let taskId = message.taskId ?? null;
         const onEvent = (event) => {
             if (taskId && event.taskId === taskId) {
                 eventQueue.push(event);
-                if (resolve) {
-                    resolve();
-                    resolve = null;
-                }
+                notify();
             }
         };
+        let executingTaskId = null;
+        const onAbort = () => {
+            if (executingTaskId)
+                this.taskManager.abortExecution(executingTaskId);
+            notify();
+        };
         this.taskManager.on('event', onEvent);
-        let task;
-        if (params.message.taskId) {
-            taskId = params.message.taskId;
-            task = await this.taskManager.continueTask(params.message.taskId, params.message);
-        }
-        else {
-            task = await this.taskManager.createTask(params.message, params.message.contextId);
-            taskId = task.id;
-        }
-        const onToken = (token) => {
-            const event = {
-                type: 'token',
-                taskId: task.id,
-                token,
-                timestamp: new Date().toISOString(),
-            };
-            eventQueue.push(event);
-            if (resolve) {
-                resolve();
-                resolve = null;
+        signal?.addEventListener('abort', onAbort, { once: true });
+        let executionPromise = null;
+        try {
+            let task;
+            const isContinued = !!message.taskId;
+            try {
+                this.validateInitialPushConfig(params.configuration);
+                if (isContinued) {
+                    task = await this.taskManager.continueTask(message.taskId, message);
+                }
+                else {
+                    task = await this.taskManager.createTask(message, message.contextId);
+                    taskId = task.id;
+                    await this.registerInitialPushConfig(task.id, params.configuration);
+                }
             }
-        };
-        let executionDone = false;
-        const executionPromise = this.taskManager
-            .executeTask(task, this.cogitator, agent, params.message, onToken)
-            .then(() => {
-            executionDone = true;
-            if (resolve) {
-                resolve();
-                resolve = null;
+            catch (error) {
+                yield failedStatusEvent(errorMessageOf(error), taskId ?? '');
+                return;
             }
-        });
-        try {
-            yield {
-                type: 'status-update',
-                taskId: task.id,
-                status: task.status,
-                timestamp: new Date().toISOString(),
+            const currentTaskId = task.id;
+            const onToken = (token) => {
+                const event = {
+                    type: 'token',
+                    taskId: currentTaskId,
+                    token,
+                    timestamp: new Date().toISOString(),
+                };
+                eventQueue.push(event);
+                notify();
             };
-            let done = false;
-            while (!done) {
-                if (eventQueue.length > 0) {
-                    const event = eventQueue.shift();
+            let executionDone = false;
+            let executionError;
+            executingTaskId = task.id;
+            executionPromise = this.taskManager
+                .executeTask(task, this.cogitator, agent, message, {
+                onToken,
+                timeout: params.configuration?.timeout,
+            })
+                .then(() => {
+                executionDone = true;
+                notify();
+            }, (error) => {
+                executionError = error;
+                executionDone = true;
+                notify();
+            });
+            if (!isContinued) {
+                yield {
+                    type: 'status-update',
+                    taskId: task.id,
+                    status: task.status,
+                    timestamp: new Date().toISOString(),
+                };
+            }
+            while (!signal?.aborted) {
+                const event = eventQueue.shift();
+                if (event) {
                     yield event;
-                    if (event.type === 'status-update' && isTerminalState(event.status.state)) {
-                        done = true;
+                    if (event.type === 'status-update' && isStreamFinalState(event.status.state)) {
+                        return;
                     }
+                    continue;
                 }
-                else if (executionDone) {
+                if (executionDone) {
+                    if (executionError !== undefined) {
+                        yield failedStatusEvent(errorMessageOf(executionError), task.id);
+                        return;
+                    }
                     const finalTask = await this.taskManager.getTask(task.id);
-                    if (isTerminalState(finalTask.status.state)) {
-                        done = true;
+                    if (!isStreamFinalState(finalTask.status.state)) {
+                        yield failedStatusEvent('Execution ended without reaching a terminal state', task.id);
                     }
+                    return;
                 }
-                else {
-                    await new Promise((r) => {
-                        resolve = r;
-                    });
-                }
+                await new Promise((r) => {
+                    wake = r;
+                });
             }
         }
         finally {
             this.taskManager.removeListener('event', onEvent);
-            await executionPromise.catch(() => { });
+            signal?.removeEventListener('abort', onAbort);
+            if (executingTaskId)
+                this.taskManager.abortExecution(executingTaskId);
+            if (executionPromise)
+                await executionPromise;
+        }
+    }
+    async validateAuth(authToken) {
+        if (!this.auth)
+            return;
+        if (!authToken) {
+            throw new A2AError(errors.unauthorized('Authentication required'));
+        }
+        const valid = await this.auth.validate(authToken);
+        if (!valid) {
+            throw new A2AError(errors.unauthorized('Invalid credentials'));
         }
     }
     async routeMethod(method, params) {
@@ -285,69 +367,139 @@ export class A2AServer {
         }
     }
     async handleSendMessage(params) {
-        const { message, agentName } = params;
-        if (!message?.parts || !message.role) {
+        const { message, agentName, configuration } = (params ?? {});
+        if (!isValidMessage(message)) {
             throw new A2AError(errors.invalidParams('message is required with role and parts'));
         }
+        assertOptionalNonNegativeInt(configuration?.historyLength, 'configuration.historyLength');
+        assertOptionalNonNegativeInt(configuration?.timeout, 'configuration.timeout');
         const resolvedAgentName = agentName ?? Object.keys(this.agents)[0];
         const agent = this.agents[resolvedAgentName];
         if (!agent)
             throw new A2AError(errors.agentNotFound(resolvedAgentName));
+        this.validateInitialPushConfig(configuration);
+        let task;
         if (message.taskId) {
-            const task = await this.taskManager.continueTask(message.taskId, message);
-            return await this.taskManager.executeTask(task, this.cogitator, agent, message);
+            task = await this.taskManager.continueTask(message.taskId, message);
+        }
+        else {
+            task = await this.taskManager.createTask(message, message.contextId);
+            await this.registerInitialPushConfig(task.id, configuration);
+        }
+        const execution = this.taskManager.executeTask(task, this.cogitator, agent, message, {
+            timeout: configuration?.timeout,
+        });
+        if (configuration?.blocking === false) {
+            execution.catch((error) => {
+                process.stderr.write(`[a2a] Background task ${task.id} failed: ${errorMessageOf(error)}\n`);
+            });
+            return this.shapeTask(task, configuration);
+        }
+        return this.shapeTask(await execution, configuration);
+    }
+    validateInitialPushConfig(configuration) {
+        const pushConfig = configuration?.pushNotificationConfig;
+        if (!pushConfig)
+            return;
+        if (!pushConfig.webhookUrl) {
+            throw new A2AError(errors.invalidParams('pushNotificationConfig.webhookUrl is required'));
         }
-        const task = await this.taskManager.createTask(message, message.contextId);
-        return await this.taskManager.executeTask(task, this.cogitator, agent, message);
+        this.assertWebhookAllowed(pushConfig.webhookUrl);
+    }
+    async registerInitialPushConfig(taskId, configuration) {
+        const pushConfig = configuration?.pushNotificationConfig;
+        if (!pushConfig)
+            return;
+        try {
+            await this.pushNotificationStore.create(taskId, pushConfig);
+        }
+        catch (error) {
+            await this.taskManager.failTask(taskId, `Failed to register push notification: ${errorMessageOf(error)}`);
+            throw error;
+        }
+    }
+    assertWebhookAllowed(webhookUrl) {
+        if (this.allowPrivateUrls)
+            return;
+        try {
+            validateWebhookUrl(webhookUrl);
+        }
+        catch (e) {
+            throw new A2AError(errors.invalidParams(e instanceof Error ? e.message : String(e)));
+        }
+    }
+    /**
+     * Apply historyLength / acceptedOutputModes from the request configuration
+     */
+    shapeTask(task, configuration) {
+        let shaped = task;
+        const historyLength = configuration?.historyLength;
+        if (historyLength !== undefined) {
+            shaped = {
+                ...shaped,
+                history: historyLength === 0 ? [] : shaped.history.slice(-historyLength),
+            };
+        }
+        const accepted = configuration?.acceptedOutputModes;
+        if (accepted && accepted.length > 0) {
+            shaped = {
+                ...shaped,
+                artifacts: shaped.artifacts.filter((a) => !a.mimeType || accepted.includes(a.mimeType)),
+            };
+        }
+        return shaped;
     }
     async handleGetTask(params) {
-        const { id } = params;
+        const { id, historyLength } = (params ?? {});
         if (!id)
             throw new A2AError(errors.invalidParams('id is required'));
-        return this.taskManager.getTask(id);
+        assertOptionalNonNegativeInt(historyLength, 'historyLength');
+        return this.shapeTask(await this.taskManager.getTask(id), { historyLength });
     }
     async handleCancelTask(params) {
-        const { id } = params;
+        const { id } = (params ?? {});
         if (!id)
             throw new A2AError(errors.invalidParams('id is required'));
         return this.taskManager.cancelTask(id);
     }
     async handleListTasks(params) {
-        const filter = (params ?? {});
+        const raw = (params ?? {});
+        assertOptionalNonNegativeInt(raw.limit, 'limit');
+        assertOptionalNonNegativeInt(raw.offset, 'offset');
+        const filter = {
+            contextId: raw.contextId,
+            state: raw.state,
+            offset: raw.offset,
+            limit: Math.min(raw.limit ?? MAX_LIST_LIMIT, MAX_LIST_LIMIT),
+        };
         const tasks = await this.taskManager.listTasks(filter);
         return { tasks };
     }
     async handleCreatePushNotification(params) {
-        const { taskId, config } = params;
+        const { taskId, config } = (params ?? {});
         if (!taskId)
             throw new A2AError(errors.invalidParams('taskId is required'));
         if (!config?.webhookUrl)
             throw new A2AError(errors.invalidParams('config.webhookUrl is required'));
-        if (!this.allowPrivateUrls) {
-            try {
-                validateWebhookUrl(config.webhookUrl);
-            }
-            catch (e) {
-                throw new A2AError(errors.invalidParams(e instanceof Error ? e.message : String(e)));
-            }
-        }
+        this.assertWebhookAllowed(config.webhookUrl);
+        await this.taskManager.getTask(taskId);
         return this.pushNotificationStore.create(taskId, config);
     }
     async handleGetPushNotification(params) {
-        const { taskId, configId } = params;
+        const { taskId, configId } = (params ?? {});
         if (!taskId || !configId) {
             throw new A2AError(errors.invalidParams('taskId and configId are required'));
         }
         return this.pushNotificationStore.get(taskId, configId);
     }
     async handleListPushNotifications(params) {
-        const { taskId } = params;
+        const { taskId } = (params ?? {});
         if (!taskId)
             throw new A2AError(errors.invalidParams('taskId is required'));
         return this.pushNotificationStore.list(taskId);
     }
     async handleDeletePushNotification(params) {
-        const { taskId, configId } = params;
+        const { taskId, configId } = (params ?? {});
         if (!taskId || !configId) {
             throw new A2AError(errors.invalidParams('taskId and configId are required'));
         }