@dynamicagents/core 0.9.0

package/dist/worker/index.js

@@ -0,0 +1,369 @@
+import { AGENT_CARD_PATH, SendMessageRequest } from "@a2a-js/sdk";
+import { DefaultRequestHandler, JsonRpcTransportHandler, validateVersion } from "@a2a-js/sdk/server";
+import { RequestMalformedError, toJsonRpcError } from "@a2a-js/sdk/errors";
+import { JWKS_PATH, endpointUrl } from "@dynamicagents/g2a-protocol";
+import { A2A_RPC_PATH, buildBaseCard, parsePrivateJwk, publicCardJwks, signCard, signCardInPlace } from "../a2a/card.js";
+import { buildCallContext, extensionHeaders } from "../a2a/context.js";
+import { GatekeeperAuthError, bearerToken, verifyGatekeeperToken } from "../a2a/verify.js";
+import { A2AExecutor } from "../a2a/executor.js";
+import { DurableTaskStore } from "../a2a/task-store.js";
+import { parseGatekeeperOrigins } from "../env.js";
+/**
+ * The A2A Worker: the zero-trust, no-shared-secrets edge every Dynamic Agents agent
+ * puts in front of its Durable Object.
+ *
+ * Trust flows entirely on domains and asymmetric (Ed25519) signatures over
+ * public JWKS: a gatekeeper verifies and pins this agent's identity from its signed
+ * card at registration ("G knows R"), and this Worker verifies the gatekeeper's
+ * identity JWT on every JSON-RPC call ("R knows G"). No secret is ever shared in
+ * either direction.
+ *
+ * **Several agents share one Worker, addressed by `tenant`.** They share one
+ * origin, one endpoint, one signing key and one card at the well-known path;
+ * what differs is the tenant id on every request. That is the A2A mechanism for
+ * exactly this — `AgentInterface.tenant` is "an opaque string used for routing
+ * requests to a specific agent or tenant when multiple agents are served behind
+ * a single A2A endpoint", and §8.3.2 requires a client to send the value the
+ * selected interface declared.
+ *
+ * A tenant is **required on every request**. There is no default and no
+ * implicit routing: an absent tenant is an error, because guessing one would
+ * mean picking an agent the caller never named.
+ *
+ * This replaces mounting a handler per path prefix. That could not work: the
+ * card is a **well-known URI**, which RFC 8615 defines per-authority, so only
+ * one card per origin is discoverable at the registered path — a gatekeeper
+ * resolving `…/.well-known/agent-card.json` against the origin found whichever
+ * agent owned the bare path and pinned *its* key for all of them.
+ *
+ * Three routes:
+ *
+ *  1. `GET jwksPath` — the card-signing public JWKS, resolving every card's
+ *     `jku`.
+ *  2. `GET …/.well-known/agent-card.json` — the signed **stub** card for the
+ *     origin. Matched by suffix, since that path is fixed by the spec.
+ *  3. `POST rpcPath` — gatekeeper-authenticated JSON-RPC, routed to the named
+ *     tenant. `GetExtendedAgentCard` returns that tenant's own signed card;
+ *     everything else runs a turn against its Durable Object.
+ *
+ * Two independent checks keep one tenant's traffic out of another's:
+ * `audience` proves the token was minted for this deployment, and
+ * {@link file://../a2a/verify.ts TENANT_CLAIM} proves it was minted for *this
+ * agent on it*. The second is what makes `tenant` more than an unauthenticated
+ * routing hint in the request body.
+ */
+export { defineAgent } from "./define-agent.js";
+/**
+ * Default path serving the card-signing public JWKS (the card's `jku`).
+ *
+ * From `@dynamicagents/g2a-protocol`, because the gatekeeper serves its own JWKS at
+ * the same path and fetches ours from whatever `jku` says — see
+ * {@link file://../a2a/verify.ts} for why the two sides share a package rather
+ * than a comment. Re-exported so this stays importable from
+ * `@dynamicagents/core/worker`, where it has always lived.
+ */
+export { JWKS_PATH } from "@dynamicagents/g2a-protocol";
+/** The JSON-RPC method carrying a turn (v1.0 renamed v0.3's `message/send`). */
+const SEND_MESSAGE_METHOD = "SendMessage";
+function unauthorized(reason) {
+    return new Response(`unauthorized: ${reason}`, {
+        status: 401,
+        headers: { "www-authenticate": 'Bearer error="invalid_token"' }
+    });
+}
+/**
+ * A JSON-RPC error envelope for a failure raised before the SDK handler ran,
+ * echoing the request's `id` so a conformant client can correlate it. Errors are
+ * transported at HTTP 200 per JSON-RPC 2.0, matching what the SDK handler
+ * returns for the failures it maps itself.
+ *
+ * Takes an already-mapped `error` because the mapper has to match the error's
+ * origin: `@a2a-js/sdk/errors` and `@a2a-js/sdk/server` are separately bundled
+ * entry points that each carry their own copy of the error hierarchy, so a
+ * mapper only recognizes errors its own bundle constructed — the other one fails
+ * its `instanceof` check and flattens every semantic error to a generic internal
+ * error. Each call site below picks accordingly.
+ */
+function jsonRpcErrorResponse(body, error) {
+    const id = body?.id ?? null;
+    return Response.json({ jsonrpc: "2.0", id, error });
+}
+/**
+ * Why a `SendMessage` fails the async-only contract, or `undefined` when it
+ * holds. (Other methods carry no config and are always fine.)
+ *
+ * Checked here, before the SDK handler, rather than in the executor: an executor
+ * throw is turned into a `failed` task, which a client reads as an accepted turn
+ * that never calls back. A rejected send has to surface as a JSON-RPC error.
+ */
+function pushConfigError(rpcBody) {
+    if (rpcBody.method !== SEND_MESSAGE_METHOD)
+        return undefined;
+    // Decode through the generated codec rather than reading the raw body: the
+    // wire form is protobuf-JSON, so this is what normalizes field naming and
+    // oneof shapes into the typed request the SDK handler will also see.
+    let params;
+    try {
+        params = SendMessageRequest.fromJSON(rpcBody.params);
+    }
+    catch (err) {
+        return `params are not a valid SendMessageRequest: ${err.message}`;
+    }
+    const pushConfig = params.configuration?.taskPushNotificationConfig;
+    if (!pushConfig?.url) {
+        return ("configuration.taskPushNotificationConfig.url is required: this agent " +
+            "replies asynchronously via push notification (A2A §13.2)");
+    }
+    if (!pushConfig.token) {
+        return ("configuration.taskPushNotificationConfig.token is required: the gatekeeper " +
+            "uses it to correlate the callback to the pending task (A2A §13.2)");
+    }
+    try {
+        new URL(pushConfig.url);
+    }
+    catch {
+        return `configuration.taskPushNotificationConfig.url is not a valid URL: ${pushConfig.url}`;
+    }
+    return undefined;
+}
+export function createA2AWorker(options) {
+    // Normalized once, here, because each of these is used for two things that
+    // must agree: routing compares it against `url.pathname`, and `endpointUrl`
+    // composes it into the card's interface URL and the expected audience. A
+    // configured path written without its leading slash used to satisfy neither —
+    // `url.pathname` always has one, so the route simply never matched, and the
+    // audience came out as `https://hostpath`. Normalizing at the split keeps the
+    // two derivations from disagreeing whichever way it is written.
+    const withSlash = (path) => path.startsWith("/") ? path : `/${path}`;
+    const jwksPath = withSlash(options.jwksPath ?? JWKS_PATH);
+    const rpcPath = withSlash(options.rpcPath ?? A2A_RPC_PATH);
+    const requirePushConfig = options.requirePushConfig ?? true;
+    const declared = options.tenants ?? {};
+    const defined = options.agents ?? [];
+    // A tenant declared both ways is ambiguous, and silently letting one win is how
+    // a deployment serves an agent nobody meant to mount. Caught at startup.
+    const duplicate = defined.find((a) => Object.hasOwn(declared, a.tenant));
+    if (duplicate) {
+        throw new Error(`createA2AWorker got tenant '${duplicate.tenant}' from both \`agents\` and ` +
+            "`tenants` — declare each agent once");
+    }
+    // …and the same ambiguity within `agents` alone, which the check above cannot
+    // see. `definedByTenant` below is a `Map`, so a repeated id silently keeps the
+    // *last* entry: two `defineAgent` calls sharing a tenant would mount one and
+    // discard the other with no signal anywhere. That is the identical failure the
+    // cross-check exists to prevent, reached by copy-pasting a declaration rather
+    // than by mixing the two forms — which is the likelier mistake of the two.
+    const seen = new Set();
+    for (const agent of defined) {
+        if (seen.has(agent.tenant)) {
+            throw new Error(`createA2AWorker got tenant '${agent.tenant}' twice in \`agents\` — ` +
+                "declare each agent once");
+        }
+        seen.add(agent.tenant);
+    }
+    // Nothing can be served without at least one agent, and a deployment that
+    // configured none is a startup mistake rather than a per-request one.
+    const tenantIds = [...Object.keys(declared), ...defined.map((a) => a.tenant)];
+    if (tenantIds.length === 0) {
+        throw new Error("createA2AWorker requires at least one agent — pass `agents` or `tenants`");
+    }
+    // …and one registered under `""` is the same mistake wearing a disguise. A
+    // request must name a tenant, and the empty string is how "named none" is
+    // spelled, so that agent is registered and permanently unreachable — every
+    // call to it is refused as a missing tenant before the lookup ever runs. The
+    // check above would otherwise report a deployment with no routable agent as
+    // satisfying "at least one tenant".
+    if (tenantIds.some((id) => !id)) {
+        throw new Error("createA2AWorker requires every tenant id to be non-empty: a request " +
+            "names its tenant, so an agent registered under '' can never be reached");
+    }
+    const definedByTenant = new Map(defined.map((a) => [a.tenant, a]));
+    // The tenant id is caller-controlled, so the lookup is by *own* property.
+    // Plain indexing reaches `Object.prototype`, and every inherited name —
+    // `toString`, `constructor`, `__proto__` — comes back truthy, so a tenant
+    // called one of those slips past an `if (!agent)` guard and only fails later
+    // when a function is read off it. That is a 500 where the whole point of the
+    // guard is a 400 naming the unknown tenant. (A `Map` has no such inheritance,
+    // so the `agents` half needs no equivalent guard.)
+    //
+    // Takes `env` because a `defineAgent` entry resolves its bindings from it —
+    // there is no `env` at module scope on Workers, so the closure is built per
+    // request rather than at construction.
+    const tenantAgent = (env, id) => {
+        if (Object.hasOwn(declared, id))
+            return declared[id];
+        const agent = definedByTenant.get(id);
+        if (!agent)
+            return undefined;
+        return {
+            manifest: agent.manifest,
+            resolveAgent: (identity) => agent.resolveAgent(env, identity),
+            startTurn: (turn) => agent.startTurn(env, turn)
+        };
+    };
+    // Only reachable through the first overload, which has already established
+    // that `TEnv` carries the two documented names.
+    const readSecrets = options.secrets ??
+        ((env) => ({
+            signingKey: env.A2A_SIGNING_KEY,
+            gatekeeperOrigins: env.GATEKEEPER_ORIGINS
+        }));
+    return async function fetch(request, env) {
+        const url = new URL(request.url);
+        const origin = url.origin;
+        const secrets = readSecrets(env);
+        // This agent's own endpoint, which is also exactly what its card advertises
+        // as its interface — so the value the gatekeeper was registered with and the
+        // value checked here are the same string by construction.
+        const audience = typeof options.audience === "function"
+            ? options.audience(url)
+            : (options.audience ?? endpointUrl(origin, rpcPath));
+        const privateJwk = parsePrivateJwk(secrets.signingKey);
+        const signing = { privateJwk, jku: endpointUrl(origin, jwksPath) };
+        const cardFor = (manifest, tenant) => buildBaseCard(manifest, {
+            origin,
+            rpcPath: options.rpcPath,
+            advertiseSecuritySchemes: options.advertiseSecuritySchemes,
+            tenant
+        });
+        // (1) Card-signing public JWKS — resolves every card's `jku` for the
+        // gatekeeper. One key per origin, so one JWKS for every tenant.
+        if (request.method === "GET" && url.pathname === jwksPath) {
+            return Response.json(publicCardJwks(privateJwk), {
+                headers: { "cache-control": "public, max-age=3600" }
+            });
+        }
+        // (2) The stub card, at the well-known path. `signCard` returns the
+        // protobuf-JSON encoding — the exact document the signature is computed
+        // over — so it is serialized here without re-encoding.
+        if (request.method === "GET" && url.pathname.endsWith(AGENT_CARD_PATH)) {
+            return Response.json(await signCard(cardFor(options.manifest), signing));
+        }
+        // (3) A2A JSON-RPC — gatekeeper-authenticated, dispatched into the caller's DO.
+        //
+        // Matched on `rpcPath`, not on the method alone. Accepting every POST made
+        // the path this agent advertises purely decorative: a call to any URL on the
+        // origin was served as JSON-RPC, so a mounted agent's isolation rested
+        // entirely on an outer router matching first, and a typo'd endpoint quietly
+        // worked instead of 404ing.
+        if (request.method === "POST" && url.pathname === rpcPath) {
+            const token = bearerToken(request);
+            if (!token)
+                return unauthorized("missing gatekeeper bearer token");
+            let identity;
+            let authorizedTenant;
+            try {
+                ({ identity, tenant: authorizedTenant } = await verifyGatekeeperToken(token, {
+                    allowedOrigins: parseGatekeeperOrigins(secrets.gatekeeperOrigins),
+                    audience,
+                    identityClaim: options.identityClaim,
+                    tenantClaim: options.tenantClaim
+                }));
+            }
+            catch (err) {
+                const message = err instanceof GatekeeperAuthError
+                    ? err.message
+                    : "verification failed";
+                return unauthorized(message);
+            }
+            // The DO instance is keyed by the verified `identity.key`; without it the
+            // executor cannot route the call — refuse rather than fall back to a
+            // shared instance. Guaranteed non-null past this point.
+            if (!identity.key) {
+                return new Response("bad request: gatekeeper identity missing key", {
+                    status: 400
+                });
+            }
+            const body = await request.json();
+            // `typeof null === "object"`, so the null check is load-bearing: a body of
+            // literal `null` is valid JSON and would otherwise make `rpcBody` null,
+            // throwing on the property reads below instead of reaching the SDK
+            // handler, which maps it to the same -32602 that `[]` or a string gets.
+            const rpcBody = (typeof body === "object" && body !== null ? body : {});
+            // Which agent this call is for. Read straight off the body rather than
+            // through a codec: every request message carries `tenant` in the same
+            // place, so decoding as one specific request type would mean knowing the
+            // method first, and the tenant is needed to pick the handler that would
+            // decide that.
+            const requestedTenant = rpcBody.params?.tenant ?? "";
+            if (typeof requestedTenant !== "string" || !requestedTenant) {
+                return jsonRpcErrorResponse(body, toJsonRpcError(new RequestMalformedError("params.tenant is required: this endpoint serves several agents " +
+                    "and none is the default. Use the tenant declared on the " +
+                    "interface of the agent's card (A2A §8.3.2), or call " +
+                    "GetExtendedAgentCard with it to fetch that card.")));
+            }
+            // The token names the tenant the gatekeeper authorized; the body names the
+            // one the call addressed. They must agree.
+            //
+            // This is the check that makes `tenant` more than a routing hint. Every
+            // tenant here shares one endpoint and so one `aud`, which means the
+            // audience cannot tell them apart — without this, a token legitimately
+            // minted for one agent could be replayed against any of its siblings by
+            // editing a field in the request body. An absent claim is a rejection
+            // rather than a wildcard for the same reason.
+            if (authorizedTenant !== requestedTenant) {
+                return unauthorized(`gatekeeper token authorizes tenant '${authorizedTenant || "<none>"}', ` +
+                    `but the request addressed '${requestedTenant}'`);
+            }
+            const agent = tenantAgent(env, requestedTenant);
+            if (!agent) {
+                return jsonRpcErrorResponse(body, toJsonRpcError(new RequestMalformedError(`unknown tenant '${requestedTenant}'`)));
+            }
+            const card = cardFor(agent.manifest, requestedTenant);
+            const context = buildCallContext(request, identity, requestedTenant);
+            // v1.0 negotiates the protocol version per request via the `A2A-Version`
+            // header, and the SDK leaves enforcement to the transport binding (its
+            // Express handlers do it; this Worker is the equivalent seam). An absent
+            // header is treated as `0.3` by the SDK, which a v1.0-only card does not
+            // advertise — so a legacy caller is rejected here rather than silently
+            // mis-served.
+            try {
+                validateVersion(context.requestedVersion, card, "JSONRPC");
+            }
+            catch (err) {
+                // Thrown by the server bundle — map it with the server bundle's mapper.
+                return jsonRpcErrorResponse(body, JsonRpcTransportHandler.mapToJSONRPCError(err));
+            }
+            if (requirePushConfig) {
+                const contractError = pushConfigError(rpcBody);
+                if (contractError) {
+                    // Constructed from the errors bundle — map it with that bundle's.
+                    return jsonRpcErrorResponse(body, toJsonRpcError(new RequestMalformedError(contractError)));
+                }
+            }
+            const handler = new DefaultRequestHandler(card, new DurableTaskStore(identity, agent.resolveAgent), new A2AExecutor({
+                identity,
+                jku: `${origin}${jwksPath}`,
+                resolveAgent: agent.resolveAgent,
+                startTurn: agent.startTurn
+            }), undefined, undefined, undefined, 
+            // `GetExtendedAgentCard` — how a caller gets a *tenant's* card, since
+            // only the stub is discoverable at the well-known path.
+            //
+            // Returns the in-memory card and lets the SDK encode it: its JSON-RPC
+            // transport runs `AgentCard.toJSON()` over whatever comes back, so
+            // handing it `signCard`'s already-encoded wire card would encode twice
+            // and silently break the signature. See {@link signCardInPlace}.
+            //
+            // The tenant is read off the context rather than the request params
+            // because that is all the SDK passes; it is the value this Worker
+            // already authorized and routed on.
+            async (ctx) => {
+                const requested = ctx.tenant ?? "";
+                const target = tenantAgent(env, requested);
+                if (!target) {
+                    throw new RequestMalformedError(`unknown tenant '${requested}'`);
+                }
+                return signCardInPlace(cardFor(target.manifest, requested), signing);
+            });
+            const rpc = new JsonRpcTransportHandler(handler);
+            const result = await rpc.handle(body, context);
+            // Streaming is not advertised; reject async generators outright.
+            if (Symbol.asyncIterator in result) {
+                return new Response("streaming not supported", { status: 501 });
+            }
+            return Response.json(result, { headers: extensionHeaders(context) });
+        }
+        return new Response("not found", { status: 404 });
+    };
+}

package/eslint-rules/index.js

@@ -0,0 +1,31 @@
+import { noDeprecatedObjectProperties } from "./no-deprecated-object-properties.js";
+
+/**
+ * `@dynamicagents/core/eslint` — the lint rules this stack needs that no upstream
+ * plugin provides.
+ *
+ * Consume as a flat-config plugin:
+ *
+ * ```js
+ * import da from "@dynamicagents/core/eslint";
+ *
+ * export default [
+ *   {
+ *     files: ["src/**\/*.ts"],
+ *     plugins: { da },
+ *     languageOptions: {
+ *       parserOptions: { projectService: true, tsconfigRootDir: import.meta.dirname }
+ *     },
+ *     rules: { "da/no-deprecated-object-properties": "error" }
+ *   }
+ * ];
+ * ```
+ *
+ * `no-deprecated-object-properties` is type-aware, so the consuming config must
+ * enable `projectService` (or `project`) for it to see anything.
+ */
+export const rules = {
+  "no-deprecated-object-properties": noDeprecatedObjectProperties
+};
+
+export default { rules };

package/eslint-rules/no-deprecated-object-properties.js

@@ -0,0 +1,81 @@
+import { ESLintUtils } from "@typescript-eslint/utils";
+
+/**
+ * Flags `@deprecated` properties used as keys in object literals.
+ *
+ * `@typescript-eslint/no-deprecated` cannot see these. For an object literal it
+ * calls `getTypeAtLocation(objectExpression)`, which yields the literal's own
+ * *inferred* type — an anonymous type whose properties carry no JSDoc — rather
+ * than the contextual type that actually declares the deprecation. (Its JSX
+ * branch uses `getContextualType` and does work.) So member access like
+ * `opts.system` is reported, but `generateText({ system })` is silently allowed,
+ * even when the object is written to an explicitly annotated variable.
+ *
+ * That blind spot covers essentially every options-bag API — the AI SDK's
+ * `generateText`/`streamText` among them — so this rule closes it by resolving
+ * the contextual type itself and checking each key against it.
+ *
+ * Upstream issue: typescript-eslint#10883.
+ */
+export const noDeprecatedObjectProperties = ESLintUtils.RuleCreator.withoutDocs(
+  {
+    meta: {
+      type: "problem",
+      docs: {
+        description:
+          "Disallow `@deprecated` properties as keys in object literals"
+      },
+      messages: {
+        deprecated: "`{{name}}` is deprecated.{{reason}}"
+      },
+      schema: []
+    },
+    defaultOptions: [],
+    create(context) {
+      const services = ESLintUtils.getParserServices(context);
+      const checker = services.program.getTypeChecker();
+
+      /** Property name for a non-computed key, or undefined if not statically known. */
+      const staticName = (property) => {
+        if (property.computed) return undefined;
+        const { key } = property;
+        if (key.type === "Identifier") return key.name;
+        if (key.type === "Literal" && typeof key.value === "string")
+          return key.value;
+        return undefined;
+      };
+
+      return {
+        ObjectExpression(node) {
+          const tsNode = services.esTreeNodeToTSNodeMap.get(node);
+          // Undefined whenever the literal is not contextually typed (e.g. an
+          // unannotated `const`), in which case there is no declared property to
+          // consult and nothing to report.
+          const contextualType = checker.getContextualType(tsNode);
+          if (contextualType === undefined) return;
+
+          for (const property of node.properties) {
+            if (property.type !== "Property") continue; // skip SpreadElement
+            const name = staticName(property);
+            if (name === undefined) continue;
+
+            const symbol = contextualType.getProperty(name);
+            if (symbol === undefined) continue;
+
+            const tag = symbol
+              .getJsDocTags(checker)
+              .find((t) => t.name === "deprecated");
+            if (tag === undefined) continue;
+
+            const text = (tag.text ?? []).map((part) => part.text).join("");
+            context.report({
+              node: property.key,
+              messageId: "deprecated",
+              data: { name, reason: text ? ` ${text}` : "" }
+            });
+          }
+        }
+      };
+    }
+  }
+);

package/package.json

@@ -0,0 +1,178 @@
+{
+  "name": "@dynamicagents/core",
+  "version": "0.9.0",
+  "description": "Shared, mandatory foundation for Dynamic Agents on Cloudflare Workers: zero-trust A2A, durable task lifecycle, delegation and subagent runtime, test harness.",
+  "keywords": [
+    "a2a",
+    "agent2agent",
+    "ai-agents",
+    "cloudflare-workers",
+    "durable-objects",
+    "agents-sdk",
+    "zero-trust",
+    "jwks",
+    "eddsa",
+    "workflows"
+  ],
+  "license": "Apache-2.0",
+  "author": "Dynamic Agents",
+  "homepage": "https://github.com/dynamicagents/core#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dynamicagents/core.git"
+  },
+  "bugs": {
+    "url": "https://github.com/dynamicagents/core/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "bin": {
+    "da-keys": "scripts/generate-keys.mjs"
+  },
+  "files": [
+    "dist",
+    "eslint-rules",
+    "scripts/generate-keys.mjs",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./a2a": {
+      "types": "./dist/a2a/index.d.ts",
+      "import": "./dist/a2a/index.js"
+    },
+    "./worker": {
+      "types": "./dist/worker/index.d.ts",
+      "import": "./dist/worker/index.js"
+    },
+    "./agent": {
+      "types": "./dist/agent/index.d.ts",
+      "import": "./dist/agent/index.js"
+    },
+    "./host": {
+      "types": "./dist/host/index.d.ts",
+      "import": "./dist/host/index.js"
+    },
+    "./alarm": {
+      "types": "./dist/alarm/index.d.ts",
+      "import": "./dist/alarm/index.js"
+    },
+    "./job": {
+      "types": "./dist/job/index.d.ts",
+      "import": "./dist/job/index.js"
+    },
+    "./round": {
+      "types": "./dist/round/index.d.ts",
+      "import": "./dist/round/index.js"
+    },
+    "./subtasks": {
+      "types": "./dist/subtasks/index.d.ts",
+      "import": "./dist/subtasks/index.js"
+    },
+    "./subagent": {
+      "types": "./dist/subagent/index.d.ts",
+      "import": "./dist/subagent/index.js"
+    },
+    "./db": {
+      "types": "./dist/db/index.d.ts",
+      "import": "./dist/db/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "import": "./dist/testing/index.js"
+    },
+    "./testing/fixtures": {
+      "types": "./dist/testing/fixtures.d.ts",
+      "import": "./dist/testing/fixtures.js"
+    },
+    "./testing/node": {
+      "types": "./dist/testing/node.d.ts",
+      "import": "./dist/testing/node.js"
+    },
+    "./testing/vcr-global-setup": {
+      "types": "./dist/testing/vcr-global-setup.d.ts",
+      "import": "./dist/testing/vcr-global-setup.js"
+    },
+    "./eslint": "./eslint-rules/index.js",
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "db:generate": "drizzle-kit generate && node scripts/build-migrations.mjs",
+    "keys": "node scripts/generate-keys.mjs",
+    "types": "wrangler types --include-env=false",
+    "types:check": "wrangler types --include-env=false --check && node scripts/verify-runtime-types.mjs",
+    "format": "prettier --write .",
+    "lint": "eslint .",
+    "check": "npm run types:check && prettier --check . && eslint . && tsc && tsc -p test/tsconfig.json && npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "verify:exports": "node scripts/verify-exports.mjs",
+    "prepack": "npm run build && npm run verify:exports",
+    "prepublishOnly": "npm run check && npm test && npm run verify:exports",
+    "prepare": "husky"
+  },
+  "dependencies": {
+    "@a2a-js/sdk": "^1.0.1",
+    "@dynamicagents/g2a-protocol": "^0.3.0",
+    "drizzle-orm": "^0.45.2",
+    "jose": "^6.2.10",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "@cloudflare/vitest-pool-workers": ">=0.18",
+    "@typescript-eslint/utils": ">=8",
+    "agents": "^0.21.0",
+    "ai": "^7.0.77",
+    "vitest": ">=4",
+    "workers-ai-provider": "^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@cloudflare/vitest-pool-workers": {
+      "optional": true
+    },
+    "@typescript-eslint/utils": {
+      "optional": true
+    },
+    "vitest": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@cloudflare/vitest-pool-workers": "^0.22.0",
+    "@types/node": "^26.2.0",
+    "agents": "^0.21.0",
+    "ai": "^7.0.77",
+    "drizzle-kit": "^0.31.10",
+    "eslint": "^10.9.0",
+    "husky": "^9.1.7",
+    "prettier": "^3.9.6",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.67.0",
+    "vitest": "^4.1.11",
+    "workers-ai-provider": "^4.0.0",
+    "wrangler": "^4.125.0"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "overrides": {
+    "@esbuild-kit/core-utils": {
+      "esbuild": "^0.25.0"
+    }
+  },
+  "allowScripts": {
+    "esbuild": false,
+    "fsevents": false,
+    "sharp": false,
+    "workerd": false,
+    "core-js-pure": false
+  }
+}