@google/adk 1.5.0 → 2.0.0

package/dist/esm/a2a/a2a_remote_agent_run_processor.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -8,6 +10,7 @@ const require = topLevelCreateRequire(import.meta.url);
 import {
   createModelContent
 } from "@google/genai";
+import { requireAgent } from "../agents/invocation_context.js";
 import { createEvent } from "../events/event.js";
 import {
   getEventMetadata,
@@ -16,7 +19,7 @@ import {
   isTaskStatusUpdateEvent
 } from "./a2a_event.js";
 import { A2AMetadataKeys } from "./metadata_converter_utils.js";
-class A2ARemoteAgentRunProcessor {
+const _A2ARemoteAgentRunProcessor = class _A2ARemoteAgentRunProcessor {
   constructor(request) {
     this.request = request;
     this.aggregations = /* @__PURE__ */ new Map();
@@ -127,7 +130,7 @@ class A2ARemoteAgentRunProcessor {
   buildNonPartialAggregation(context, agg) {
     this.promoteTextBlocksToParts(agg);
     const result = createEvent({
-      author: context.agent.name,
+      author: requireAgent(context).name,
       invocationId: context.invocationId,
       content: agg.parts.length > 0 ? createModelContent([...agg.parts]) : void 0,
       customMetadata: agg.customMeta,
@@ -178,7 +181,9 @@ class A2ARemoteAgentRunProcessor {
       event.customMetadata[`a2a:${k}`] = v;
     }
   }
-}
+};
+__name(_A2ARemoteAgentRunProcessor, "A2ARemoteAgentRunProcessor");
+let A2ARemoteAgentRunProcessor = _A2ARemoteAgentRunProcessor;
 export {
   A2ARemoteAgentRunProcessor
 };

package/dist/esm/a2a/a2a_remote_agent_utils.js

@@ -1,10 +1,13 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { requireAgent } from "../agents/invocation_context.js";
 import { createEvent } from "../events/event.js";
 import { AdkMetadataKeys } from "./metadata_converter_utils.js";
 import { toA2AParts } from "./part_converter_utils.js";
@@ -37,6 +40,7 @@ function getUserFunctionCallAt(session, index) {
   }
   return void 0;
 }
+__name(getUserFunctionCallAt, "getUserFunctionCallAt");
 function isFunctionCallEvent(event, callId) {
   if (!event || !event.content || !event.content.parts) {
     return false;
@@ -45,6 +49,7 @@ function isFunctionCallEvent(event, callId) {
     (part) => part.functionCall && part.functionCall.id === callId
   );
 }
+__name(isFunctionCallEvent, "isFunctionCallEvent");
 function getFunctionResponseCallId(event) {
   var _a;
   if (!event || !event.content || !event.content.parts) {
@@ -55,13 +60,14 @@ function getFunctionResponseCallId(event) {
   );
   return (_a = responsePart == null ? void 0 : responsePart.functionResponse) == null ? void 0 : _a.id;
 }
+__name(getFunctionResponseCallId, "getFunctionResponseCallId");
 function toMissingRemoteSessionParts(ctx, session) {
   const events = session.events;
   let contextId = void 0;
   let lastRemoteResponseIndex = -1;
   for (let i = events.length - 1; i >= 0; i--) {
     const event = events[i];
-    if (event.author === ctx.agent.name) {
+    if (event.author === requireAgent(ctx).name) {
       lastRemoteResponseIndex = i;
       const metadata = event.customMetadata || {};
       contextId = metadata[AdkMetadataKeys.CONTEXT_ID];
@@ -71,7 +77,7 @@ function toMissingRemoteSessionParts(ctx, session) {
   const missingParts = [];
   for (let i = lastRemoteResponseIndex + 1; i < events.length; i++) {
     let event = events[i];
-    if (event.author !== "user" && event.author !== ctx.agent.name) {
+    if (event.author !== "user" && event.author !== requireAgent(ctx).name) {
       event = presentAsUserMessage(ctx, event);
     }
     if (!event.content || !event.content.parts || event.content.parts.length === 0) {
@@ -85,6 +91,7 @@ function toMissingRemoteSessionParts(ctx, session) {
     contextId
   };
 }
+__name(toMissingRemoteSessionParts, "toMissingRemoteSessionParts");
 function presentAsUserMessage(ctx, agentEvent) {
   const event = createEvent({
     author: "user",
@@ -124,6 +131,7 @@ function presentAsUserMessage(ctx, agentEvent) {
   }
   return event;
 }
+__name(presentAsUserMessage, "presentAsUserMessage");
 export {
   getFunctionResponseCallId,
   getUserFunctionCallAt,

package/dist/esm/a2a/agent_card.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -18,6 +20,7 @@ import { isSequentialAgent } from "../agents/sequential_agent.js";
 import { isBaseTool } from "../tools/base_tool.js";
 import { isBaseToolset } from "../tools/base_toolset.js";
 import { logger } from "../utils/logger.js";
+import { isWorkflow } from "../workflow/workflow.js";
 async function resolveAgentCard(agentCard) {
   if (typeof agentCard === "object") {
     return agentCard;
@@ -36,6 +39,7 @@ async function resolveAgentCard(agentCard) {
     );
   }
 }
+__name(resolveAgentCard, "resolveAgentCard");
 async function getA2AAgentCard(agent, transports) {
   return {
     name: agent.name,
@@ -56,6 +60,7 @@ async function getA2AAgentCard(agent, transports) {
     additionalInterfaces: transports
   };
 }
+__name(getA2AAgentCard, "getA2AAgentCard");
 async function buildAgentSkills(agent) {
   const [primarySkills, subAgentSkills] = await Promise.all([
     buildPrimarySkills(agent),
@@ -63,14 +68,26 @@ async function buildAgentSkills(agent) {
   ]);
   return [...primarySkills, ...subAgentSkills];
 }
+__name(buildAgentSkills, "buildAgentSkills");
 async function buildPrimarySkills(agent) {
+  if (isWorkflow(agent)) {
+    return [
+      {
+        id: agent.name,
+        name: "workflow",
+        description: agent.description || `Workflow ${agent.name}`,
+        tags: ["workflow"]
+      }
+    ];
+  }
   if (isLlmAgent(agent)) {
     return buildLLMAgentSkills(agent);
   }
   return buildNonLLMAgentSkills(agent);
 }
+__name(buildPrimarySkills, "buildPrimarySkills");
 async function buildSubAgentSkills(agent) {
-  const subAgents = agent.subAgents;
+  const subAgents = isWorkflow(agent) ? [] : agent.subAgents;
   const result = [];
   for (const sub of subAgents) {
     const skills = await buildPrimarySkills(sub);
@@ -86,6 +103,7 @@ async function buildSubAgentSkills(agent) {
   }
   return result;
 }
+__name(buildSubAgentSkills, "buildSubAgentSkills");
 async function buildLLMAgentSkills(agent) {
   const skills = [
     {
@@ -109,6 +127,7 @@ async function buildLLMAgentSkills(agent) {
   }
   return skills;
 }
+__name(buildLLMAgentSkills, "buildLLMAgentSkills");
 function toolToSkill(prefix, tool) {
   let description = tool.description;
   if (!description) {
@@ -121,6 +140,7 @@ function toolToSkill(prefix, tool) {
     tags: ["llm", "tools"]
   };
 }
+__name(toolToSkill, "toolToSkill");
 function buildNonLLMAgentSkills(agent) {
   const skills = [
     {
@@ -144,6 +164,7 @@ function buildNonLLMAgentSkills(agent) {
   }
   return skills;
 }
+__name(buildNonLLMAgentSkills, "buildNonLLMAgentSkills");
 function buildAgentDescription(agent) {
   const descriptionParts = [];
   if (agent.description) {
@@ -164,6 +185,7 @@ function buildAgentDescription(agent) {
     return getDefaultAgentDescription(agent);
   }
 }
+__name(buildAgentDescription, "buildAgentDescription");
 function buildSequentialAgentDescription(agent) {
   const subAgents = agent.subAgents;
   const descriptions = [];
@@ -182,6 +204,7 @@ function buildSequentialAgentDescription(agent) {
   });
   return descriptions.join(" ");
 }
+__name(buildSequentialAgentDescription, "buildSequentialAgentDescription");
 function buildParallelAgentDescription(agent) {
   const subAgents = agent.subAgents;
   const descriptions = [];
@@ -200,6 +223,7 @@ function buildParallelAgentDescription(agent) {
   });
   return `${descriptions.join(" ")} simultaneously.`;
 }
+__name(buildParallelAgentDescription, "buildParallelAgentDescription");
 function buildLoopAgentDescription(agent) {
   const maxIterationsVal = agent.maxIterations;
   let maxIterations = "unlimited";
@@ -223,6 +247,7 @@ function buildLoopAgentDescription(agent) {
   });
   return `${descriptions.join(" ")} in a loop (max ${maxIterations} iterations).`;
 }
+__name(buildLoopAgentDescription, "buildLoopAgentDescription");
 async function buildDescriptionFromInstructions(agent) {
   const descriptionParts = [];
   if (agent.description) {
@@ -280,6 +305,7 @@ async function buildDescriptionFromInstructions(agent) {
     return getDefaultAgentDescription(agent);
   }
 }
+__name(buildDescriptionFromInstructions, "buildDescriptionFromInstructions");
 function replacePronouns(instruction) {
   const substitutions = [
     { original: "you were", target: "I was" },
@@ -297,6 +323,7 @@ function replacePronouns(instruction) {
   }
   return result;
 }
+__name(replacePronouns, "replacePronouns");
 function getDefaultAgentDescription(agent) {
   if (isLoopAgent(agent)) {
     return "A loop workflow agent";
@@ -310,6 +337,7 @@ function getDefaultAgentDescription(agent) {
     return "A custom agent";
   }
 }
+__name(getDefaultAgentDescription, "getDefaultAgentDescription");
 function getAgentTypeTag(agent) {
   if (isLoopAgent(agent)) {
     return "loop_workflow";
@@ -323,18 +351,21 @@ function getAgentTypeTag(agent) {
     return "custom_agent";
   }
 }
+__name(getAgentTypeTag, "getAgentTypeTag");
 function getAgentSkillName(agent) {
   if (isLlmAgent(agent)) {
     return "model";
   }
-  if (isWorkflowAgent(agent)) {
+  if (isCompositeShellAgent(agent) || isWorkflow(agent)) {
     return "workflow";
   }
   return "custom";
 }
-function isWorkflowAgent(agent) {
+__name(getAgentSkillName, "getAgentSkillName");
+function isCompositeShellAgent(agent) {
   return isLoopAgent(agent) || isSequentialAgent(agent) || isParallelAgent(agent);
 }
+__name(isCompositeShellAgent, "isCompositeShellAgent");
 export {
   buildAgentSkills,
   getA2AAgentCard,

package/dist/esm/a2a/agent_executor.js

@@ -1,5 +1,7 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -16,7 +18,7 @@ import {
 } from "./a2a_event.js";
 import {
   getFinalTaskStatusUpdate,
-  getTaskInputRequiredEvent
+  getUnansweredRequestEvent
 } from "./event_processor_utils.js";
 import { createExecutorContext } from "./executor_context.js";
 import {
@@ -24,7 +26,7 @@ import {
   getA2ASessionMetadata
 } from "./metadata_converter_utils.js";
 import { toA2AParts, toGenAIContent } from "./part_converter_utils.js";
-class A2AAgentExecutor {
+const _A2AAgentExecutor = class _A2AAgentExecutor {
   constructor(config) {
     this.config = config;
     this.agentPartialArtifactIdsMap = {};
@@ -54,19 +56,20 @@ class A2AAgentExecutor {
       if (this.config.beforeExecuteCallback) {
         await this.config.beforeExecuteCallback(ctx);
       }
-      if (ctx.task) {
-        const inputRequiredEvent = getTaskInputRequiredEvent(
-          ctx.task,
-          genAIUserMessage
-        );
-        if (inputRequiredEvent) {
-          await this.publishFinalTaskStatus({
-            executorContext,
-            eventBus,
-            event: inputRequiredEvent
-          });
-          return;
-        }
+      const unansweredRequestEvent = getUnansweredRequestEvent({
+        taskId: ctx.taskId,
+        contextId: ctx.contextId,
+        task: ctx.task,
+        sessionEvents: session.events,
+        genAIContent: genAIUserMessage
+      });
+      if (unansweredRequestEvent) {
+        await this.publishFinalTaskStatus({
+          executorContext,
+          eventBus,
+          event: unansweredRequestEvent
+        });
+        return;
       }
       if (!ctx.task) {
         eventBus.publish(
@@ -88,7 +91,10 @@ class A2AAgentExecutor {
         userId,
         sessionId,
         newMessage: genAIUserMessage,
-        runConfig: this.config.runConfig
+        // Marked remote so the run knows this message came from a peer rather
+        // than from the operator: a human-in-the-loop gate is not answerable
+        // over A2A unless the deployment opts in.
+        runConfig: { ...this.config.runConfig, remoteDelivered: true }
       })) {
         adkEvents.push(adkEvent);
         const a2aEvent = this.convertAdkEventToA2AEvent(
@@ -173,7 +179,9 @@ class A2AAgentExecutor {
     }
     eventBus.publish(event);
   }
-}
+};
+__name(_A2AAgentExecutor, "A2AAgentExecutor");
+let A2AAgentExecutor = _A2AAgentExecutor;
 async function getAdkSession(userId, sessionId, sessionService, appName) {
   const session = await sessionService.getSession({
     appName,
@@ -189,6 +197,7 @@ async function getAdkSession(userId, sessionId, sessionService, appName) {
     sessionId
   });
 }
+__name(getAdkSession, "getAdkSession");
 async function getAdkRunner(runnerOrConfig) {
   if (typeof runnerOrConfig === "function") {
     const result = await runnerOrConfig();
@@ -199,6 +208,7 @@ async function getAdkRunner(runnerOrConfig) {
   }
   return new Runner(runnerOrConfig);
 }
+__name(getAdkRunner, "getAdkRunner");
 export {
   A2AAgentExecutor
 };

package/dist/esm/a2a/agent_to_a2a.js

@@ -1,5 +1,28 @@
 import {createRequire as topLevelCreateRequire} from 'module';
 const require = topLevelCreateRequire(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -7,19 +30,22 @@ const require = topLevelCreateRequire(import.meta.url);
  */
 import { AGENT_CARD_PATH } from "@a2a-js/sdk";
 import { DefaultRequestHandler, InMemoryTaskStore } from "@a2a-js/sdk/server";
-import {
-  agentCardHandler,
-  jsonRpcHandler,
-  restHandler,
-  UserBuilder
-} from "@a2a-js/sdk/server/express";
-import express from "express";
 import { StreamingMode } from "../agents/run_config.js";
 import { InMemorySessionService } from "../sessions/in_memory_session_service.js";
 import { logger } from "../utils/logger.js";
+import { loadOptionalPeer } from "../utils/optional_peer.js";
 import { getA2AAgentCard, resolveAgentCard } from "./agent_card.js";
 import { A2AAgentExecutor } from "./agent_executor.js";
-function resolveA2aUserBuilder(options) {
+async function loadExpressBindings() {
+  const expressModule = await loadOptionalPeer(
+    { packageName: "express", feature: "toA2a" },
+    () => Promise.resolve().then(() => __toESM(require("express"), 1))
+  );
+  const a2aExpress = await Promise.resolve().then(() => __toESM(require("@a2a-js/sdk/server/express"), 1));
+  return { express: expressModule.default, a2aExpress };
+}
+__name(loadExpressBindings, "loadExpressBindings");
+function resolveA2aUserBuilder(options, a2aExpress) {
   if (options.authentication) {
     return options.authentication;
   }
@@ -27,15 +53,17 @@ function resolveA2aUserBuilder(options) {
     logger.warn(
       "SECURITY WARNING: Mounting the A2A server WITHOUT authentication because `allowUnauthenticated: true` was set. The agent and all of its tools are exposed to any network-reachable caller, which can invoke them with arbitrary input and read the output. Do NOT use this outside of local, trusted development."
     );
-    return UserBuilder.noAuthentication;
+    return a2aExpress.UserBuilder.noAuthentication;
   }
   throw new Error(
     "toA2a: refusing to mount the A2A server without authentication. The A2A surface lets any network-reachable caller invoke this agent and its tools with arbitrary input and read the output, so it must be authenticated. Provide `authentication` (a UserBuilder that validates the request, e.g. a bearer token or OIDC credential) or, only for local/trusted development, explicitly set `allowUnauthenticated: true`."
   );
 }
+__name(resolveA2aUserBuilder, "resolveA2aUserBuilder");
 async function toA2a(agent, options = {}) {
   var _a, _b, _c, _d;
-  const userBuilder = resolveA2aUserBuilder(options);
+  const { express: expressFactory, a2aExpress } = await loadExpressBindings();
+  const userBuilder = resolveA2aUserBuilder(options, a2aExpress);
   const host = (_a = options.host) != null ? _a : "localhost";
   const port = (_b = options.port) != null ? _b : 8e3;
   const protocol = (_c = options.protocol) != null ? _c : "http";
@@ -68,31 +96,31 @@ async function toA2a(agent, options = {}) {
     new InMemoryTaskStore(),
     agentExecutor
   );
-  const app = (_d = options.app) != null ? _d : express();
+  const app = (_d = options.app) != null ? _d : expressFactory();
   if (!options.app) {
-    app.use(express.urlencoded({ limit: "50mb", extended: true }));
-    app.use(express.json({ limit: "50mb" }));
+    app.use(expressFactory.json({ limit: "50mb" }));
   }
   app.use(
     `${basePath}/${AGENT_CARD_PATH}`,
-    agentCardHandler({ agentCardProvider: requestHandler })
+    a2aExpress.agentCardHandler({ agentCardProvider: requestHandler })
   );
   app.use(
     `${basePath}/rest`,
-    restHandler({
+    a2aExpress.restHandler({
       requestHandler,
       userBuilder
     })
   );
   app.use(
     `${basePath}/jsonrpc`,
-    jsonRpcHandler({
+    a2aExpress.jsonRpcHandler({
       requestHandler,
       userBuilder
     })
   );
   return app;
 }
+__name(toA2a, "toA2a");
 export {
   toA2a
 };

package/dist/esm/a2a/auth.js

@@ -0,0 +1,41 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { timingSafeEqual } from "node:crypto";
+const AUTHENTICATED_USER_NAME = "a2a-bearer-token";
+const BEARER_SCHEME_PREFIX = "bearer ";
+function timingSafeEqualStrings(a, b) {
+  const left = Buffer.from(a, "utf8");
+  const right = Buffer.from(b, "utf8");
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+__name(timingSafeEqualStrings, "timingSafeEqualStrings");
+function bearerTokenUserBuilder(token) {
+  const expected = token.trim();
+  if (!expected) {
+    throw new Error(
+      "bearerTokenUserBuilder: an empty A2A bearer token is not a valid authenticator. Supply a real shared secret, or configure no token at all to run the A2A surface unauthenticated."
+    );
+  }
+  return async (req) => {
+    var _a;
+    const header = (_a = req.headers.authorization) != null ? _a : "";
+    const credential = header.toLowerCase().startsWith(BEARER_SCHEME_PREFIX) ? header.slice(BEARER_SCHEME_PREFIX.length) : "";
+    if (!timingSafeEqualStrings(credential, expected)) {
+      throw new Error(
+        "A2A request rejected: missing or invalid `Authorization: Bearer` credential."
+      );
+    }
+    return { isAuthenticated: true, userName: AUTHENTICATED_USER_NAME };
+  };
+}
+__name(bearerTokenUserBuilder, "bearerTokenUserBuilder");
+export {
+  bearerTokenUserBuilder
+};