@dynamicagents/core 0.9.0

package/dist/a2a/deliver.d.ts

@@ -0,0 +1,159 @@
+import type { WorkflowStep } from "cloudflare:workers";
+import { type TurnPushContext } from "./push.js";
+import type { PlainTask } from "./task.js";
+/** What {@link deliverTerminalTask} needs to finish a turn. */
+export interface DeliverTerminalOptions {
+    /** Which Task this is about, and where its callback goes. */
+    push: TurnPushContext;
+    /** The agent's card-signing key, for the callback JWT. */
+    signingKey: string;
+    /**
+     * The guarded write, and **the cancellation check**. Return whether it
+     * applied: `false` must mean the row was already terminal (canceled), which is
+     * what suppresses the callback.
+     *
+     * Resolve any Durable Object stub *inside* this function, never above it — a
+     * stub hoisted out of a step body is a live connection that a replay cannot
+     * reconnect.
+     */
+    saveTask: (task: PlainTask) => Promise<boolean>;
+    /**
+     * Build the terminal Task. Called **inside** the `complete` step so that what
+     * gets notified is exactly what was persisted: building it outside would
+     * re-stamp `new Date()` on every replay and post a Task that differs from the
+     * stored one.
+     */
+    terminal: () => PlainTask;
+    /**
+     * Optional best-effort cleanup, run after the write and before the callback.
+     * An agent with no managed children omits it and no `sweep` step appears.
+     */
+    sweep?: () => Promise<void>;
+    /**
+     * Prefix for this delivery's three step names. Empty by default, which is the
+     * only value an ordinary turn may use.
+     *
+     * **Step names are durable cache keys**, so this is not cosmetic. A workflow
+     * that delivers twice — an ordinary delivery, then
+     * {@link deliverAbandonedTask} from a `catch` above it — would otherwise call
+     * `step.do("complete")` a second time and be handed the *first* call's cached
+     * result, so the failed Task it built would never be written and the outcome
+     * would depend on Workflows' caching semantics for a step whose failure was
+     * caught. A distinct prefix makes the second delivery its own set of steps,
+     * where the guarded write decides the outcome as it is supposed to.
+     */
+    stepPrefix?: string;
+}
+/**
+ * Thrown when a delivery failed *after* its terminal Task was durably saved.
+ *
+ * The distinction it carries is the difference between "this turn produced
+ * nothing" and "this turn produced a result the gatekeeper has not heard about
+ * yet", and only the first of those is an abandoned task.
+ *
+ * Without it, an ordinary delivery whose `notify` step exhausted its retries
+ * would unwind into an abandoned-task recovery, which would write a generic
+ * failure over a real answer. The guarded write refuses that now
+ * ({@link file://../db/models/tasks.ts}), but refusing it is not enough on its
+ * own: the recovery would then succeed at doing nothing, swallow a genuine
+ * callback failure, and log the word "abandoned" about a turn that completed.
+ * So the two work together — this stops the recovery being attempted, and the
+ * guard is the backstop for the narrow window where a `complete` step throws
+ * without saying whether its write applied.
+ */
+export declare class TaskAlreadyTerminalError extends Error {
+    constructor(cause: unknown);
+}
+/**
+ * Persist a turn's terminal Task, then notify the gatekeeper.
+ *
+ * **The guarded write is the cancellation check.** `saveTask` refuses to write a
+ * terminal state over a `canceled` row and says so, doing that read and write in
+ * one synchronous pass inside the Durable Object. Probing first and saving
+ * second would leave a window — between the two calls, and again between this
+ * step and `notify` — in which a `tasks/cancel` lands and the gatekeeper still
+ * receives a `completed` callback. Keying the notify on "did the write apply"
+ * closes it, and that has already been got wrong once.
+ *
+ * In `/a2a` rather than `/round` because the shape is not a round's: an agent
+ * whose turn is a single inference ends it the same way, and importing this from
+ * `/round` would put the whole delegation engine in a bundle that must not carry
+ * it. Everything it calls already lives here.
+ */
+export declare function deliverTerminalTask(step: WorkflowStep, options: DeliverTerminalOptions): Promise<void>;
+/** What {@link deliverAbandonedTask} needs to end a turn nobody else will. */
+export interface AbandonedTaskOptions {
+    /** Which Task this is about, and where its callback goes. */
+    push: TurnPushContext;
+    /** The agent's card-signing key, for the callback JWT. */
+    signingKey: string;
+    /** The guarded write — same contract as {@link DeliverTerminalOptions.saveTask}. */
+    saveTask: (task: PlainTask) => Promise<boolean>;
+    /**
+     * The user-facing words. The host's, always: core ships no prompt copy and no
+     * user-facing copy, and a paraphrase invented at the failure site is exactly
+     * what this parameter exists to prevent.
+     */
+    text: string;
+    /** Best-effort child cleanup. Omitted by an agent that delegates to nothing. */
+    sweep?: () => Promise<void>;
+    /** Log prefix — conventionally the agent's tenant id. */
+    label?: string;
+}
+/**
+ * Turn an unrecoverable orchestration fault into a delivered failed Task.
+ *
+ * ## The failure this exists for
+ *
+ * A turn ends badly in two different ways. A **typed** failure — the models were
+ * tried and nothing usable came back — is a value, and the ordinary delivery
+ * path carries it. A **transient** fault instead throws, so the step retries and
+ * recovers without paying for a second inference. That is the right default.
+ *
+ * What neither covers is a transient fault that never stops being one. `step.do`
+ * retries a bounded number of times and then rethrows, and with nothing above it
+ * to catch that, the orchestration unwinds, the delivery path is never reached,
+ * and the Workflow instance errors with the Task still sitting in `working`. The
+ * user is told nothing at all — and because the instance dies mid-`run`, the
+ * runtime records it as *"your Worker's code had hung and would never generate a
+ * response"*, which reads like a bug in the workflow rather than a provider that
+ * was refusing every request.
+ *
+ * Observed exactly that way in a deployed agent on 2026-08-19: a turn step
+ * exhausted its four attempts against a rate-limited provider, and the agent
+ * simply went quiet.
+ *
+ * ## Three behaviours here are load-bearing
+ *
+ * **It resolves after a successful delivery — it does not rethrow.** Rethrowing
+ * would reproduce the very "hung Worker" record this exists to remove, and the
+ * instance genuinely has finished its job: the Task is terminal and the gatekeeper
+ * has been told.
+ *
+ * **It rethrows the *original* `cause` when the delivery itself fails.**
+ * Swallowing there would mark the instance successful while the user got
+ * nothing — strictly worse than the erroring instance being replaced, because it
+ * would also be silent in the Workflows console. `cause` is what an operator
+ * needs to see, not the delivery's own secondary fault.
+ *
+ * **It refuses to run at all once a terminal Task exists.** A
+ * {@link TaskAlreadyTerminalError} means the ordinary delivery persisted its
+ * result and only the callback failed, so the original fault is rethrown and
+ * nothing is written. An earlier draft of this claimed the guarded write alone
+ * made that safe; it did not. The write refused only cancellation conflicts, so
+ * `completed → failed` applied cleanly and a turn that succeeded would have been
+ * rewritten as a generic failure because a webhook was flaky. The guard now
+ * refuses any terminal-over-different-terminal write as a backstop, and this
+ * check is what stops the attempt being made in the first place — without it the
+ * recovery would quietly succeed at doing nothing, swallowing a real callback
+ * failure and logging "abandoned" about a completed turn.
+ *
+ * ## Why it is exported rather than private to `/round`
+ *
+ * `runHandleTask` wraps itself in it, so every round agent gets this without
+ * asking. But an agent whose turn is a single inference writes its own workflow
+ * body and has the identical exposure — and the alternative to exporting this is
+ * that each such host reimplements the delivery, which is precisely the mistake
+ * this function was extracted from.
+ */
+export declare function deliverAbandonedTask(step: WorkflowStep, cause: unknown, options: AbandonedTaskOptions): Promise<void>;

package/dist/a2a/deliver.js

@@ -0,0 +1,185 @@
+import { buildFailedTask } from "./notify.js";
+import { createPushChannel } from "./push.js";
+/**
+ * Thrown when a delivery failed *after* its terminal Task was durably saved.
+ *
+ * The distinction it carries is the difference between "this turn produced
+ * nothing" and "this turn produced a result the gatekeeper has not heard about
+ * yet", and only the first of those is an abandoned task.
+ *
+ * Without it, an ordinary delivery whose `notify` step exhausted its retries
+ * would unwind into an abandoned-task recovery, which would write a generic
+ * failure over a real answer. The guarded write refuses that now
+ * ({@link file://../db/models/tasks.ts}), but refusing it is not enough on its
+ * own: the recovery would then succeed at doing nothing, swallow a genuine
+ * callback failure, and log the word "abandoned" about a turn that completed.
+ * So the two work together — this stops the recovery being attempted, and the
+ * guard is the backstop for the narrow window where a `complete` step throws
+ * without saying whether its write applied.
+ */
+export class TaskAlreadyTerminalError extends Error {
+    constructor(cause) {
+        super("the terminal Task was saved; the callback after it failed", {
+            cause
+        });
+        this.name = "TaskAlreadyTerminalError";
+    }
+}
+/**
+ * Persist a turn's terminal Task, then notify the gatekeeper.
+ *
+ * **The guarded write is the cancellation check.** `saveTask` refuses to write a
+ * terminal state over a `canceled` row and says so, doing that read and write in
+ * one synchronous pass inside the Durable Object. Probing first and saving
+ * second would leave a window — between the two calls, and again between this
+ * step and `notify` — in which a `tasks/cancel` lands and the gatekeeper still
+ * receives a `completed` callback. Keying the notify on "did the write apply"
+ * closes it, and that has already been got wrong once.
+ *
+ * In `/a2a` rather than `/round` because the shape is not a round's: an agent
+ * whose turn is a single inference ends it the same way, and importing this from
+ * `/round` would put the whole delegation engine in a bundle that must not carry
+ * it. Everything it calls already lives here.
+ */
+export async function deliverTerminalTask(step, options) {
+    const at = options.stepPrefix ?? "";
+    const task = await step.do(`${at}complete`, async () => {
+        const terminal = options.terminal();
+        return (await options.saveTask(terminal)) ? terminal : null;
+    });
+    if (!task)
+        return;
+    // Caught, not left to propagate: the terminal Task is already durably saved,
+    // so a sweep that still fails once the step's own retries are exhausted must
+    // not block the callback — the gatekeeper is owed its result either way.
+    if (options.sweep) {
+        const sweep = options.sweep;
+        try {
+            await step.do(`${at}sweep`, async () => {
+                await sweep();
+            });
+        }
+        catch (err) {
+            console.error("[deliver] sweep failed after retries", {
+                taskId: options.push.taskId,
+                err: String(err)
+            });
+        }
+    }
+    // A card-key-signed callback POST. Retried by the step on a non-2xx; the
+    // terminal messageId is deterministic and the gatekeeper is idempotent and
+    // single-use, so retries are safe. If it ultimately fails, the gatekeeper's own
+    // reaction backstop clears the pending marker.
+    //
+    // Wrapped, because by this line the Task is durably terminal: anything that
+    // fails from here is a callback that did not land, never a turn that produced
+    // nothing. See {@link TaskAlreadyTerminalError}.
+    try {
+        await step.do(`${at}notify`, async () => {
+            await createPushChannel(options.signingKey, options.push).deliver(task);
+        });
+    }
+    catch (err) {
+        throw new TaskAlreadyTerminalError(err);
+    }
+}
+/**
+ * The step-name prefix an abandoned delivery runs under.
+ *
+ * Its own namespace so it can never collide with the ordinary delivery's — see
+ * {@link DeliverTerminalOptions.stepPrefix}.
+ */
+const ABANDONED_PREFIX = "abandoned:";
+/**
+ * Turn an unrecoverable orchestration fault into a delivered failed Task.
+ *
+ * ## The failure this exists for
+ *
+ * A turn ends badly in two different ways. A **typed** failure — the models were
+ * tried and nothing usable came back — is a value, and the ordinary delivery
+ * path carries it. A **transient** fault instead throws, so the step retries and
+ * recovers without paying for a second inference. That is the right default.
+ *
+ * What neither covers is a transient fault that never stops being one. `step.do`
+ * retries a bounded number of times and then rethrows, and with nothing above it
+ * to catch that, the orchestration unwinds, the delivery path is never reached,
+ * and the Workflow instance errors with the Task still sitting in `working`. The
+ * user is told nothing at all — and because the instance dies mid-`run`, the
+ * runtime records it as *"your Worker's code had hung and would never generate a
+ * response"*, which reads like a bug in the workflow rather than a provider that
+ * was refusing every request.
+ *
+ * Observed exactly that way in a deployed agent on 2026-08-19: a turn step
+ * exhausted its four attempts against a rate-limited provider, and the agent
+ * simply went quiet.
+ *
+ * ## Three behaviours here are load-bearing
+ *
+ * **It resolves after a successful delivery — it does not rethrow.** Rethrowing
+ * would reproduce the very "hung Worker" record this exists to remove, and the
+ * instance genuinely has finished its job: the Task is terminal and the gatekeeper
+ * has been told.
+ *
+ * **It rethrows the *original* `cause` when the delivery itself fails.**
+ * Swallowing there would mark the instance successful while the user got
+ * nothing — strictly worse than the erroring instance being replaced, because it
+ * would also be silent in the Workflows console. `cause` is what an operator
+ * needs to see, not the delivery's own secondary fault.
+ *
+ * **It refuses to run at all once a terminal Task exists.** A
+ * {@link TaskAlreadyTerminalError} means the ordinary delivery persisted its
+ * result and only the callback failed, so the original fault is rethrown and
+ * nothing is written. An earlier draft of this claimed the guarded write alone
+ * made that safe; it did not. The write refused only cancellation conflicts, so
+ * `completed → failed` applied cleanly and a turn that succeeded would have been
+ * rewritten as a generic failure because a webhook was flaky. The guard now
+ * refuses any terminal-over-different-terminal write as a backstop, and this
+ * check is what stops the attempt being made in the first place — without it the
+ * recovery would quietly succeed at doing nothing, swallowing a real callback
+ * failure and logging "abandoned" about a completed turn.
+ *
+ * ## Why it is exported rather than private to `/round`
+ *
+ * `runHandleTask` wraps itself in it, so every round agent gets this without
+ * asking. But an agent whose turn is a single inference writes its own workflow
+ * body and has the identical exposure — and the alternative to exporting this is
+ * that each such host reimplements the delivery, which is precisely the mistake
+ * this function was extracted from.
+ */
+export async function deliverAbandonedTask(step, cause, options) {
+    // Nothing was abandoned: the ordinary delivery already persisted a terminal
+    // Task and only its callback failed. Rethrow the fault that actually
+    // happened, so the instance still errors exactly as it did before any
+    // recovery existed and the gatekeeper's own backstop clears the pending marker.
+    //
+    // Checked **here** rather than in each caller's `catch` on purpose. This whole
+    // change exists because a recovery every host had to remember to wire was one
+    // three hosts forgot; a caveat every host had to remember to check would be
+    // the same mistake a second time.
+    if (cause instanceof TaskAlreadyTerminalError)
+        throw cause.cause;
+    const label = options.label ?? "agent";
+    // Logged before anything is attempted: if the delivery below also fails, this
+    // line is the only record of what actually went wrong.
+    console.error(`[${label}] task abandoned after retries were exhausted`, {
+        taskId: options.push.taskId,
+        error: String(cause)
+    });
+    try {
+        await deliverTerminalTask(step, {
+            push: options.push,
+            signingKey: options.signingKey,
+            saveTask: options.saveTask,
+            terminal: () => buildFailedTask(options.push.taskId, options.push.contextId, options.text),
+            sweep: options.sweep,
+            stepPrefix: ABANDONED_PREFIX
+        });
+    }
+    catch (deliveryFailed) {
+        console.error(`[${label}] could not deliver the failed Task`, {
+            taskId: options.push.taskId,
+            error: String(deliveryFailed)
+        });
+        throw cause;
+    }
+}

package/dist/a2a/executor.d.ts

@@ -0,0 +1,84 @@
+import { type AgentExecutor, type ExecutionEventBus, type RequestContext } from "@a2a-js/sdk/server";
+import type { GatekeeperIdentity } from "./verify.js";
+import type { AgentResolver } from "./agent-stub.js";
+/**
+ * Derive a deterministic workflow instance id for a turn. Keyed on the gatekeeper's
+ * `messageId` (stable across dispatch retries), so re-creating it is a no-op —
+ * the turn runs exactly once. Sanitized to the id charset.
+ */
+export declare function workflowIdForMessage(messageId: string, prefix?: string): string;
+/**
+ * Everything the executor knows about an accepted turn, handed to the
+ * consumer's {@link TurnStarter}.
+ *
+ * Core stops here deliberately: which workflow runs the turn, what else its
+ * params carry, and which binding it is created on are all the agent's, so core
+ * describes the turn and the agent starts it.
+ */
+export interface AcceptedTurn {
+    /** The gatekeeper's message id — the idempotency key for the whole turn. */
+    messageId: string;
+    taskId: string;
+    contextId: string;
+    /** The caller's message, flattened to text. */
+    text: string;
+    identity: GatekeeperIdentity;
+    /** Webhook the terminal task is POSTed to. */
+    pushUrl: string;
+    /** Per-task validation token echoed on the callback. */
+    pushToken: string;
+    /** This agent's card-signing JWKS URL — the callback JWT `jku`. */
+    jku: string;
+}
+/**
+ * Start the durable turn. **Must be idempotent**: a dispatch retry calls it
+ * again with the same {@link AcceptedTurn.messageId}, and the conventional
+ * implementation swallows the workflow's "instance already exists" race — see
+ * {@link workflowIdForMessage} and {@link ignoreAlreadyExists}.
+ */
+export type TurnStarter = (turn: AcceptedTurn) => Promise<void>;
+export interface ExecutorConfig {
+    identity: GatekeeperIdentity;
+    /** This agent's card-signing JWKS URL — the callback JWT `jku`. */
+    jku: string;
+    resolveAgent: AgentResolver;
+    startTurn: TurnStarter;
+}
+/**
+ * Run `create` and swallow the "instance already exists" retry race, so a
+ * {@link TurnStarter} is idempotent in the one way that actually happens.
+ *
+ * ```ts
+ * startTurn: (turn) =>
+ *   ignoreAlreadyExists(() =>
+ *     env.HANDLE_TASK_WORKFLOW.create({
+ *       id: workflowIdForMessage(turn.messageId),
+ *       params: { ...turn }
+ *     })
+ *   )
+ * ```
+ */
+export declare function ignoreAlreadyExists(create: () => Promise<unknown>): Promise<void>;
+/**
+ * A2A executor for the **async accept + notify** contract. On `SendMessage` it
+ * does not block on generation: it records a `submitted` task in the caller's DO
+ * (idempotent on `messageId`), hands the turn to a durable workflow, and
+ * publishes the accepted task immediately as the response. The workflow
+ * generates the reply and POSTs it to the gatekeeper's push-notification webhook
+ * out of band.
+ *
+ * The verified caller identity comes from the config — the outer Worker builds
+ * one executor per verified request. The push config comes from the request
+ * itself: v1.0 hands the executor the whole `SendMessageRequest` via
+ * {@link RequestContext.request}, so nothing has to be threaded around it.
+ */
+export declare class A2AExecutor implements AgentExecutor {
+    private readonly config;
+    constructor(config: ExecutorConfig);
+    execute: (requestContext: RequestContext, eventBus: ExecutionEventBus) => Promise<void>;
+    /**
+     * `CancelTask`: best-effort mark the task canceled in the DO and publish the
+     * canceled task. The in-flight workflow's `notify` step skips a canceled task.
+     */
+    cancelTask: (taskId: string, eventBus: ExecutionEventBus) => Promise<void>;
+}

package/dist/a2a/executor.js

@@ -0,0 +1,106 @@
+import { AgentEvent } from "@a2a-js/sdk/server";
+import { textOf } from "./parts.js";
+/**
+ * Derive a deterministic workflow instance id for a turn. Keyed on the gatekeeper's
+ * `messageId` (stable across dispatch retries), so re-creating it is a no-op —
+ * the turn runs exactly once. Sanitized to the id charset.
+ */
+export function workflowIdForMessage(messageId, prefix = "turn") {
+    return `${prefix}-${messageId.replace(/[^A-Za-z0-9_-]/g, "-")}`;
+}
+/**
+ * Run `create` and swallow the "instance already exists" retry race, so a
+ * {@link TurnStarter} is idempotent in the one way that actually happens.
+ *
+ * ```ts
+ * startTurn: (turn) =>
+ *   ignoreAlreadyExists(() =>
+ *     env.HANDLE_TASK_WORKFLOW.create({
+ *       id: workflowIdForMessage(turn.messageId),
+ *       params: { ...turn }
+ *     })
+ *   )
+ * ```
+ */
+export async function ignoreAlreadyExists(create) {
+    try {
+        await create();
+    }
+    catch (err) {
+        if (err instanceof Error && /already exists|exist/i.test(err.message)) {
+            return;
+        }
+        throw err;
+    }
+}
+/**
+ * A2A executor for the **async accept + notify** contract. On `SendMessage` it
+ * does not block on generation: it records a `submitted` task in the caller's DO
+ * (idempotent on `messageId`), hands the turn to a durable workflow, and
+ * publishes the accepted task immediately as the response. The workflow
+ * generates the reply and POSTs it to the gatekeeper's push-notification webhook
+ * out of band.
+ *
+ * The verified caller identity comes from the config — the outer Worker builds
+ * one executor per verified request. The push config comes from the request
+ * itself: v1.0 hands the executor the whole `SendMessageRequest` via
+ * {@link RequestContext.request}, so nothing has to be threaded around it.
+ */
+export class A2AExecutor {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    execute = async (requestContext, eventBus) => {
+        const pushConfig = requestContext.request.configuration?.taskPushNotificationConfig;
+        // Defensive: the Worker validates url + token before the executor runs, and
+        // must keep doing so — a throw here is turned into a `failed` task by the
+        // request handler, not into the JSON-RPC error the caller needs to see.
+        if (!pushConfig?.url || !pushConfig.token) {
+            throw new Error("taskPushNotificationConfig url and token are required");
+        }
+        const text = textOf(requestContext.userMessage);
+        const messageId = requestContext.userMessage.messageId;
+        const contextId = requestContext.contextId;
+        // `identity.key` is guaranteed non-null: the Worker rejects a keyless
+        // identity (400) before constructing this executor.
+        const stub = this.config.resolveAgent(this.config.identity);
+        // Record (or reuse) the submitted task, then start the durable turn. Both
+        // are idempotent, so a dispatch retry heals a crash between the two.
+        const accepted = await stub.beginTask({
+            messageId,
+            taskId: requestContext.taskId,
+            contextId
+        });
+        // Widened in one explicit step: DO-stub returns come back through
+        // Cloudflare's RPC type mapping, and letting that mapped type flow into a
+        // generic SDK call site instead exceeds TypeScript's instantiation depth on
+        // the v1.0 (proto-generated) model.
+        const task = accepted;
+        await this.config.startTurn({
+            messageId,
+            taskId: accepted.id,
+            contextId,
+            text,
+            identity: this.config.identity,
+            pushUrl: pushConfig.url,
+            pushToken: pushConfig.token,
+            jku: this.config.jku
+        });
+        // The accept ack: a `submitted` task, not a Message. Returned synchronously.
+        eventBus.publish(AgentEvent.task(task));
+        eventBus.finished();
+    };
+    /**
+     * `CancelTask`: best-effort mark the task canceled in the DO and publish the
+     * canceled task. The in-flight workflow's `notify` step skips a canceled task.
+     */
+    cancelTask = async (taskId, eventBus) => {
+        const task = await this.config
+            .resolveAgent(this.config.identity)
+            .cancelTask(taskId);
+        if (task)
+            eventBus.publish(AgentEvent.task(task));
+        eventBus.finished();
+    };
+}

package/dist/a2a/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * `@dynamicagents/core/a2a` — the A2A protocol adapter.
+ *
+ * The zero-trust contract in both directions (verify the gatekeeper with its public
+ * JWKS, prove ourselves with ours), the accept-and-notify task lifecycle, and the
+ * narrowed task types that survive Durable Object RPC. Nothing here knows what an
+ * agent *does* — past {@link A2AExecutor} everything is plain strings.
+ *
+ * ## The wire values come from `@dynamicagents/g2a-protocol`
+ *
+ * Claim names, the algorithm, the well-known paths and the audience rule are a
+ * two-sided contract with a token issuer, and the issuer — slack-gatekeeper — is
+ * not an agent and must not import this package. They live in a zero-dependency
+ * leaf both sides depend on, and are re-exported here so an agent's imports are
+ * unchanged: `IDENTITY_CLAIM`, `TENANT_CLAIM`, `A2A_RPC_PATH` and
+ * `GatekeeperIdentity` still come from `@dynamicagents/core/a2a`.
+ *
+ * The pure helpers are re-exported too, because an agent that builds a URL by
+ * hand is an agent that can disagree with the gatekeeper about it.
+ */
+export { A2A_JWS_ALG, audienceFor, endpointUrl, jwksUrl } from "@dynamicagents/g2a-protocol";
+export { IDENTITY_CLAIM, TENANT_CLAIM, GatekeeperAuthError, bearerToken, normalizeGatekeeperOrigins, verifyGatekeeperToken, type GatekeeperIdentity, type VerifyOptions } from "./verify.js";
+export { A2A_RPC_PATH, buildBaseCard, signCard, wireCard, parsePrivateJwk, publicCardJwks, type AgentManifest, type BuildCardOptions, type CardSigningConfig, type WireAgentCard } from "./card.js";
+export { NOTIFICATION_TOKEN_HEADER, buildSubmittedTask, buildWorkingTask, buildCompletedTask, buildFailedTask, buildNoReplyCompletedTask, signCallbackJwt, postNotification } from "./notify.js";
+export { deliverTerminalTask, deliverAbandonedTask, TaskAlreadyTerminalError, type DeliverTerminalOptions, type AbandonedTaskOptions } from "./deliver.js";
+export { signCallerToken, type CallerTokenOptions } from "./caller-token.js";
+export { SelfOrigin } from "./self-origin.js";
+export { callerContext } from "./caller.js";
+export { createPushChannel, type PushChannel, type TurnPushContext } from "./push.js";
+export { taskStateLabel, type PlainArtifact, type PlainMessage, type PlainPart, type PlainStatus, type PlainTask } from "./task.js";
+export { textPart, partsText, textOf, agentTextMessage, inboundText, InboundPartError, MAX_INBOUND_TEXT_BYTES } from "./parts.js";
+export { buildCallContext, extensionHeaders } from "./context.js";
+export { DurableTaskStore } from "./task-store.js";
+export { A2AExecutor, workflowIdForMessage, ignoreAlreadyExists, type AcceptedTurn, type ExecutorConfig, type TurnStarter } from "./executor.js";
+export type { AgentResolver, TaskAgent, TaskListPage, TaskListQuery } from "./agent-stub.js";

package/dist/a2a/index.js

@@ -0,0 +1,34 @@
+/**
+ * `@dynamicagents/core/a2a` — the A2A protocol adapter.
+ *
+ * The zero-trust contract in both directions (verify the gatekeeper with its public
+ * JWKS, prove ourselves with ours), the accept-and-notify task lifecycle, and the
+ * narrowed task types that survive Durable Object RPC. Nothing here knows what an
+ * agent *does* — past {@link A2AExecutor} everything is plain strings.
+ *
+ * ## The wire values come from `@dynamicagents/g2a-protocol`
+ *
+ * Claim names, the algorithm, the well-known paths and the audience rule are a
+ * two-sided contract with a token issuer, and the issuer — slack-gatekeeper — is
+ * not an agent and must not import this package. They live in a zero-dependency
+ * leaf both sides depend on, and are re-exported here so an agent's imports are
+ * unchanged: `IDENTITY_CLAIM`, `TENANT_CLAIM`, `A2A_RPC_PATH` and
+ * `GatekeeperIdentity` still come from `@dynamicagents/core/a2a`.
+ *
+ * The pure helpers are re-exported too, because an agent that builds a URL by
+ * hand is an agent that can disagree with the gatekeeper about it.
+ */
+export { A2A_JWS_ALG, audienceFor, endpointUrl, jwksUrl } from "@dynamicagents/g2a-protocol";
+export { IDENTITY_CLAIM, TENANT_CLAIM, GatekeeperAuthError, bearerToken, normalizeGatekeeperOrigins, verifyGatekeeperToken } from "./verify.js";
+export { A2A_RPC_PATH, buildBaseCard, signCard, wireCard, parsePrivateJwk, publicCardJwks } from "./card.js";
+export { NOTIFICATION_TOKEN_HEADER, buildSubmittedTask, buildWorkingTask, buildCompletedTask, buildFailedTask, buildNoReplyCompletedTask, signCallbackJwt, postNotification } from "./notify.js";
+export { deliverTerminalTask, deliverAbandonedTask, TaskAlreadyTerminalError } from "./deliver.js";
+export { signCallerToken } from "./caller-token.js";
+export { SelfOrigin } from "./self-origin.js";
+export { callerContext } from "./caller.js";
+export { createPushChannel } from "./push.js";
+export { taskStateLabel } from "./task.js";
+export { textPart, partsText, textOf, agentTextMessage, inboundText, InboundPartError, MAX_INBOUND_TEXT_BYTES } from "./parts.js";
+export { buildCallContext, extensionHeaders } from "./context.js";
+export { DurableTaskStore } from "./task-store.js";
+export { A2AExecutor, workflowIdForMessage, ignoreAlreadyExists } from "./executor.js";