@hanphone/dsh-a2a 0.1.0

package/lib/index.js

@@ -0,0 +1,2073 @@
+import z from "@deepseek-ai/schemastery";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { mkdirSync } from "node:fs";
+import { z as z$1 } from "zod";
+import { defineDomain, domainTable } from "@deepseek-ai/dsh-storage-domain";
+import { Service } from "@deepseek-ai/cordis";
+//#region lib/types/server/card.js
+/**
+* AgentCard assembly for the inbound half: skills are DERIVED from the live
+* tool registry by an explicit id list (never invented), plus a built-in
+* `chat` skill so a fresh install is immediately exercisable end-to-end.
+* @module dsh-a2a/server/card
+*/
+/**
+* Derive the inbound skill list from the live tool registry.
+*
+* Every configured id must resolve to a registered tool — a missing referent
+* fails the derivation loudly (the plugin's misconfiguration contract) with
+* all missing ids listed. The built-in `chat` skill is always present so the
+* server answers before any tool is exposed.
+*
+* @param tools - the tool registry getter.
+* @param policy - explicit-id derivation policy.
+* @returns the derived skills, `chat` first, configured tools after, excludes applied.
+*/
+function deriveSkills(tools, policy) {
+	const excluded = new Set(policy.exclude);
+	const skills = [{
+		id: "chat",
+		name: "chat",
+		description: "Conversational assistance over a DSH agent session.",
+		tags: ["chat"]
+	}];
+	const missing = [];
+	for (const id of policy.ids) {
+		if (excluded.has(id)) continue;
+		const tool = tools.get(id);
+		if (tool === void 0) {
+			missing.push(id);
+			continue;
+		}
+		skills.push({
+			id,
+			name: id,
+			description: tool.description ?? `Expose the DSH tool \`${id}\` over A2A.`,
+			tags: ["tool"]
+		});
+	}
+	if (missing.length > 0) throw new Error(`dsh-a2a: server.skills.ids reference unregistered tools: ${missing.join(", ")}`);
+	return skills;
+}
+/** Assemble the AgentCard advertised by this DSH. */
+function buildCard(options) {
+	const iface = {
+		url: `${options.baseUrl.replace(/\/$/, "")}${options.endpointPath}`,
+		protocolBinding: "JSONRPC",
+		protocolVersion: "1.0"
+	};
+	return {
+		name: options.name,
+		description: options.description,
+		version: options.version,
+		provider: {
+			url: "https://deepseek.com",
+			organization: "DeepSeek"
+		},
+		capabilities: {
+			streaming: true,
+			pushNotifications: false,
+			extensions: []
+		},
+		defaultInputModes: ["text/plain"],
+		defaultOutputModes: ["text/plain"],
+		skills: options.skills,
+		supportedInterfaces: [iface],
+		...options.authToken !== void 0 ? {
+			securitySchemes: { bearerAuth: {
+				type: "http",
+				scheme: "bearer",
+				description: "Shared bearer token"
+			} },
+			securityRequirements: [{ bearerAuth: [] }]
+		} : {}
+	};
+}
+//#endregion
+//#region lib/types/protocol.js
+/**
+* Agent2Agent (A2A) Protocol v1.0 — types, task states, JSON-RPC methods and
+* error codes used by this plugin's JSON-RPC over HTTP binding.
+*
+* The surface mirrors the normative `a2a.proto` of the A2A project (Apache-2.0);
+* this file is the plugin's own transcription and the single source of protocol
+* truth. Bindings other than JSON-RPC over HTTP (gRPC, REST) are not provided.
+* @module dsh-a2a/protocol
+*/
+/** Task lifecycle states (spec `TaskState`). */
+var TaskState;
+(function(TaskState) {
+	TaskState["SUBMITTED"] = "SUBMITTED";
+	TaskState["WORKING"] = "WORKING";
+	TaskState["INPUT_REQUIRED"] = "INPUT_REQUIRED";
+	TaskState["AUTH_REQUIRED"] = "AUTH_REQUIRED";
+	TaskState["COMPLETED"] = "COMPLETED";
+	TaskState["FAILED"] = "FAILED";
+	TaskState["CANCELED"] = "CANCELED";
+	TaskState["REJECTED"] = "REJECTED";
+})(TaskState || (TaskState = {}));
+/** States that settle a task; a settled task no longer transitions. */
+const TERMINAL_STATES = new Set([
+	TaskState.COMPLETED,
+	TaskState.FAILED,
+	TaskState.CANCELED,
+	TaskState.REJECTED
+]);
+/** @returns whether the state settles the task. */
+function isTerminal(state) {
+	return TERMINAL_STATES.has(state);
+}
+/** Message sender role (spec `Role`). */
+var Role;
+(function(Role) {
+	Role["USER"] = "user";
+	Role["AGENT"] = "agent";
+})(Role || (Role = {}));
+/** A2A v1.0 JSON-RPC method names (canonical PascalCase as in a2a.proto). */
+const A2A_METHODS = {
+	sendMessage: "SendMessage",
+	sendStreamingMessage: "SendStreamingMessage",
+	getTask: "GetTask",
+	listTasks: "ListTasks",
+	cancelTask: "CancelTask",
+	subscribeToTask: "SubscribeToTask",
+	getExtendedAgentCard: "GetExtendedAgentCard"
+};
+/** JSON-RPC error codes for the A2A binding (spec §error codes). */
+const A2A_ERROR_CODES = {
+	INVALID_REQUEST: -32600,
+	METHOD_NOT_FOUND: -32601,
+	INVALID_PARAMS: -32602,
+	INTERNAL_ERROR: -32603,
+	UNAUTHORIZED: -32e3,
+	TASK_NOT_FOUND: -32001,
+	TASK_CANCEL_NOT_ALLOWED: -32002,
+	AGENT_CARD_NOT_FOUND: -32004,
+	AGENT_CARD_SIGNATURE_INVALID: -32005
+};
+/** Read a message's text parts as a single string (model-facing convenience). */
+function partsToText(parts) {
+	if (!parts) return "";
+	return parts.map((p) => {
+		if ("text" in p && p.text) return p.text;
+		if ("data" in p && p.data !== void 0) return JSON.stringify(p.data);
+		if ("file" in p) return p.file.uri ?? `[file ${p.file.name ?? p.file.mimeType ?? "binary"}]`;
+		return "";
+	}).filter(Boolean).join("\n");
+}
+//#endregion
+//#region lib/types/server/store.js
+/**
+* Durable task storage for the inbound half: one `a2a` domain over the routed
+* storage backend (the deployment picks the medium, normally SQLite). Records
+* are serialized JSON so the domain tables stay plain kv rows; the domain
+* SCHEMA_VERSION guards format evolution. A memory store keeps unit tests and
+* minimal embeddings free of a backend.
+* @module dsh-a2a/server/store
+*/
+/** JSON-encoded record schema shared by every `a2a` table. */
+const json$1 = z$1.string();
+/** The `a2a` storage domain: JSON-encoded records, one table per record kind. */
+const a2aDomainSpec = defineDomain({
+	name: "a2a",
+	version: 1,
+	tables: {
+		tasks: domainTable(json$1),
+		contexts: domainTable(json$1),
+		agents: domainTable(json$1)
+	}
+});
+/**
+* Serialize/deserialize helpers for the domain tables. Plain JSON round-trip
+* with shape assertions; `decodeRecord` returns undefined on any mismatch.
+*/
+function encodeRecord(value) {
+	return JSON.stringify(value);
+}
+function decodeRecord(raw) {
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+/**
+* Open the `a2a` domain on the mounted storage-domain facility and expose
+* its tables. The caller owns the returned handle and closes it on teardown.
+*/
+async function openDomain(domain) {
+	return new A2aDomain(await domain.open(a2aDomainSpec));
+}
+/** A2a domain facade: typed JSON tables over the routed backend. */
+var A2aDomain = class {
+	handle;
+	constructor(handle) {
+		this.handle = handle;
+	}
+	get tasks() {
+		return this.handle.table("tasks");
+	}
+	get contexts() {
+		return this.handle.table("contexts");
+	}
+	get agents() {
+		return this.handle.table("agents");
+	}
+	async close() {
+		await this.handle.close();
+	}
+};
+function now() {
+	return (/* @__PURE__ */ new Date()).toISOString();
+}
+function recordKey(taskId) {
+	return `task:${taskId}`;
+}
+function contextKey(contextId) {
+	return `ctx:${contextId}`;
+}
+function appendArtifactRecord(artifacts, artifact) {
+	if (artifacts.find((a) => a.artifactId === artifact.artifactId)) return artifacts.map((a) => a.artifactId === artifact.artifactId ? {
+		...a,
+		parts: [...a.parts, ...artifact.parts]
+	} : a);
+	return [...artifacts, {
+		artifactId: artifact.artifactId,
+		...artifact.name !== void 0 ? { name: artifact.name } : {},
+		parts: artifact.parts
+	}];
+}
+/** Domain-backed TaskStore (persistent; the composition path). */
+var DomainTaskStore = class {
+	domain;
+	records = /* @__PURE__ */ new Map();
+	bindings = /* @__PURE__ */ new Map();
+	constructor(domain) {
+		this.domain = domain;
+		for (const [key, raw] of domain.tasks.entries()) {
+			if (!key.startsWith("task:")) continue;
+			const record = decodeRecord(raw);
+			if (record !== void 0) this.records.set(record.taskId, record);
+		}
+		for (const [key, raw] of domain.contexts.entries()) {
+			if (!key.startsWith("ctx:")) continue;
+			const binding = decodeRecord(raw);
+			if (binding !== void 0) this.bindings.set(key.slice(4), binding.sessionId);
+		}
+	}
+	create(input) {
+		const record = {
+			taskId: `a2a-${crypto.randomUUID()}`,
+			contextId: input.contextId,
+			skill: input.skill,
+			state: TaskState.SUBMITTED,
+			createdAt: now(),
+			updatedAt: now(),
+			sessionId: null,
+			remotePeerId: input.remotePeerId,
+			parts: input.parts,
+			artifacts: [],
+			executor: "session",
+			summary: null
+		};
+		this.records.set(record.taskId, record);
+		this.domain.tasks.put(recordKey(record.taskId), encodeRecord(record)).catch((err) => {
+			throw new Error(`a2a: task persistence failed: ${String(err)}`);
+		});
+		return record;
+	}
+	get(taskId) {
+		return this.records.get(taskId);
+	}
+	list() {
+		return [...this.records.values()];
+	}
+	setState(taskId, state, message) {
+		const current = this.records.get(taskId);
+		if (current === void 0) throw new Error(`task ${taskId} not found`);
+		const next = withState(current, state, message, now());
+		this.records.set(taskId, next);
+		this.domain.tasks.put(recordKey(taskId), encodeRecord(next)).catch((err) => {
+			throw new Error(`a2a: task persistence failed: ${String(err)}`);
+		});
+		return next;
+	}
+	appendArtifact(taskId, artifact) {
+		const current = this.records.get(taskId);
+		if (current === void 0) throw new Error(`task ${taskId} not found`);
+		const next = {
+			...current,
+			updatedAt: now(),
+			artifacts: appendArtifactRecord(current.artifacts, artifact)
+		};
+		this.records.set(taskId, next);
+		this.domain.tasks.put(recordKey(taskId), encodeRecord(next)).catch((err) => {
+			throw new Error(`a2a: task persistence failed: ${String(err)}`);
+		});
+		return next;
+	}
+	async setContextSession(contextId, sessionId) {
+		const binding = { sessionId };
+		this.bindings.set(contextId, sessionId);
+		await this.domain.contexts.put(contextKey(contextId), encodeRecord(binding));
+	}
+	async getContextSession(contextId) {
+		return this.bindings.get(contextId);
+	}
+	async close() {}
+};
+function withState(current, state, message, timestamp) {
+	return {
+		...current,
+		state,
+		updatedAt: timestamp,
+		...message ? { error: {
+			code: message.code,
+			message: message.text
+		} } : {}
+	};
+}
+//#endregion
+//#region lib/types/server/executor.js
+/**
+* Executor abstraction for inbound tasks: an executor turns one task into
+* output parts while reporting status and artifact updates. The registry is
+* INTERNAL (built by the plugin from config) — public registration was cut:
+* there is no external caller yet, so the seam stays an interface with two
+* built-in implementations (session, subagent).
+* @module dsh-a2a/server/executor
+*/
+/**
+* Skill → executor resolution. The subagent executor is absent on
+* compositions without the subagent seam; resolving a skill bound to a
+* missing kind fails loudly with a readable message.
+*/
+var ExecutorSet = class {
+	bySkill;
+	session;
+	subagent;
+	constructor(bySkill, session, subagent) {
+		this.bySkill = bySkill;
+		this.session = session;
+		this.subagent = subagent;
+	}
+	resolve(skill) {
+		if ((this.bySkill[skill] ?? "session") === "session") return this.session;
+		const subagent = this.subagent;
+		if (subagent === void 0) throw new Error(`a2a: skill "${skill}" is bound to the subagent executor but no subagent seam is mounted`);
+		return subagent;
+	}
+	async disposeAll() {
+		await this.session.disposeAll?.();
+		await this.subagent?.disposeAll?.();
+	}
+};
+//#endregion
+//#region lib/types/server/exec/agent-runtime.js
+/**
+* Shared agent machinery for the inbound executors: one DSH agent session per
+* A2A context (create, or resume a persisted one), serialized turns, and
+* optional agent-preset composition so a spawned session actually carries
+* tools. Adapted from the createDshAgentExecutor pattern pioneered by
+* dsh-a2a (MIT).
+* @module dsh-a2a/server/exec/agent-runtime
+*/
+/**
+* Per-context session pool: one live DSH agent per A2A contextId, created or
+* resumed through the registry, turns serialized per context, every session
+* disposeable on teardown.
+*/
+var ContextSessionPool = class ContextSessionPool {
+	agents;
+	opts;
+	handles = /* @__PURE__ */ new Map();
+	tails = /* @__PURE__ */ new Map();
+	constructor(agents, opts) {
+		this.agents = agents;
+		this.opts = opts;
+	}
+	/** Session id derived from the A2A context id (stable across restarts). */
+	static sessionIdFor(contextId) {
+		return `a2a-${contextId}`;
+	}
+	/** Get or open the live agent for a context; errors propagate. */
+	async agentFor(contextId) {
+		const sessionId = ContextSessionPool.sessionIdFor(contextId);
+		const existing = this.handles.get(contextId);
+		if (existing !== void 0) return {
+			agent: existing.agent,
+			sessionId,
+			justOpened: false
+		};
+		const agentOptions = this.opts.resolveAgentOptions?.();
+		const withModel = agentOptions ? { agentOptions } : {};
+		const presets = this.opts.agentPresets;
+		let presetId;
+		let setup;
+		if (presets !== void 0) {
+			presetId = (await presets.resolve()).id;
+			setup = async (agentCtx) => {
+				await presets.mount(agentCtx, presetId);
+			};
+		}
+		const createOptions = {
+			sessionId,
+			meta: presetId ? {
+				cwd: this.opts.cwd,
+				agentPreset: presetId
+			} : { cwd: this.opts.cwd },
+			...withModel,
+			...setup ? { setup } : {}
+		};
+		let handle;
+		try {
+			handle = await this.agents.create(createOptions);
+		} catch (err) {
+			if (/already (has|owns)|persisted/i.test(err.message)) handle = await this.agents.resume({
+				resumeSessionId: sessionId,
+				...withModel,
+				...setup ? { setup } : {}
+			});
+			else throw err;
+		}
+		this.handles.set(contextId, handle);
+		return {
+			agent: handle.agent,
+			sessionId,
+			justOpened: true
+		};
+	}
+	/** Run one turn on a context's session, serialized behind its tail. */
+	async runTurn(contextId, prompt, signal) {
+		const { agent, sessionId, justOpened } = await this.agentFor(contextId);
+		const onAbort = () => agent.cancel("a2a-canceled");
+		if (signal.aborted) onAbort();
+		else signal.addEventListener("abort", onAbort, { once: true });
+		const userMessage = {
+			id: crypto.randomUUID(),
+			role: "user",
+			content: [{
+				type: "text",
+				text: prompt
+			}],
+			source: {
+				kind: "plugin",
+				plugin: "a2a"
+			}
+		};
+		agent.send(userMessage, "next-turn", true);
+		if (justOpened) try {
+			await this.opts.onSessionOpened?.({
+				sessionId,
+				contextId,
+				firstPrompt: prompt
+			});
+		} catch {}
+		await agent.whenIdle();
+		return lastAssistantText(agent);
+	}
+	/** Dispose every live per-context session (called on plugin unload). */
+	async disposeAll() {
+		const live = [...this.handles.values()];
+		const pending = [...this.tails.values()];
+		this.handles.clear();
+		this.tails.clear();
+		await Promise.allSettled(pending);
+		await Promise.allSettled(live.map((h) => h.dispose()));
+	}
+};
+/** Read the last assistant message's text off the derived history. */
+function lastAssistantText(agent) {
+	const history = agent.session.deriveMessages();
+	for (let i = history.length - 1; i >= 0; i--) {
+		const message = history[i];
+		if (message === void 0) continue;
+		if (message.role === "assistant") return message.content.map((b) => "text" in b && typeof b.text === "string" ? b.text ?? "" : "").filter(Boolean).join("\n").trim();
+	}
+	return "";
+}
+/**
+* Probe for a readable service method via the reflection layer WITHOUT taking
+* an inject dependency (optional services). Returns undefined when the service
+* is absent or the method missing.
+*/
+function probeService(ctx, name, method) {
+	try {
+		const svc = ctx.reflect?.get(name, true);
+		if (svc !== void 0 && svc !== null && typeof svc[method] === "function") return svc;
+	} catch {}
+}
+//#endregion
+//#region lib/types/server/exec/session.js
+/**
+* The `session` executor: one inbound task is one turn on the context's DSH
+* agent session; reply text becomes the task's output part. Works on any
+* composition with an agent loop (the `chat` skill and the default path).
+* @module dsh-a2a/server/exec/session
+*/
+/** Build the session executor over a context session pool. */
+function createSessionExecutor(pool) {
+	return {
+		name: "session",
+		async execute(input) {
+			if (!input.prompt) return { parts: [{ text: "No prompt provided." }] };
+			const reply = await pool.runTurn(input.contextId, input.prompt, input.signal);
+			return { parts: [{ text: (input.signal.aborted && !reply ? "(canceled)" : reply) || "(no reply)" }] };
+		},
+		disposeAll: () => pool.disposeAll()
+	};
+}
+//#endregion
+//#region lib/types/server/exec/subagent.js
+/**
+* The `subagent` executor: one inbound task is delegated to a named one-shot
+* subagent under the context's parent session. The child runs with the
+* composition's own tools and the delegation boundary; its output becomes the
+* task's artifact. The subagent seam must be mounted, else the skill binding
+* fails loudly at resolution time.
+* @module dsh-a2a/server/exec/subagent
+*/
+/** Build a subagent executor delegating inbound tasks to one-shot children. */
+function createSubagentExecutor(opts) {
+	const { pool, subagents, provider } = opts;
+	return {
+		name: "subagent",
+		async execute(input, execCtx) {
+			if (!input.prompt) return { parts: [{ text: "No prompt provided." }] };
+			const { agent } = await pool.agentFor(input.contextId);
+			const text = (await (await subagents.start(provider, {
+				label: `a2a:${input.skill}`,
+				prompt: [{
+					type: "text",
+					text: input.prompt
+				}],
+				parent: agent,
+				signal: input.signal
+			})).result).output.filter((b) => typeof b.text === "string").map((b) => b.text).filter(Boolean).join("\n").trim();
+			execCtx.onEvent({
+				type: "artifact",
+				artifactId: "result",
+				parts: [{ text: text || "(subagent returned no output)" }],
+				name: input.skill,
+				lastChunk: true
+			});
+			return { parts: [{ text: text || "(subagent returned no output)" }] };
+		},
+		disposeAll: () => pool.disposeAll()
+	};
+}
+//#endregion
+//#region lib/types/jsonrpc.js
+/**
+* JSON-RPC 2.0 helpers and SSE framing for the A2A binding. Transport-agnostic:
+* the A2AServer consumes these, and the HTTP route layer only maps requests to
+* `handle` / `handleStream` and bytes back.
+* @module dsh-a2a/jsonrpc
+*/
+/** Parse a request body into a JSON-RPC request, or undefined on malformed input. */
+function parseRpc(body) {
+	let value;
+	try {
+		value = JSON.parse(body);
+	} catch {
+		return;
+	}
+	if (typeof value !== "object" || value === null) return void 0;
+	const rpc = value;
+	if (rpc.jsonrpc !== "2.0" || typeof rpc.method !== "string") return void 0;
+	return rpc;
+}
+/** Build a JSON-RPC error response object. */
+function rpcError(id, code, message, data) {
+	return {
+		jsonrpc: "2.0",
+		id: id ?? null,
+		error: {
+			code,
+			message,
+			...data === void 0 ? {} : { data }
+		}
+	};
+}
+/** Build a JSON-RPC success response object. */
+function rpcSuccess(id, result) {
+	return {
+		jsonrpc: "2.0",
+		id: id ?? null,
+		result
+	};
+}
+/** Invalid-method error for the SSE path (no request id on the wire). */
+function methodNotFound(method) {
+	return rpcError(null, A2A_ERROR_CODES.METHOD_NOT_FOUND, `Unknown method ${method}`);
+}
+//#endregion
+//#region lib/types/server/a2a-server.js
+/**
+* The inbound A2A server: JSON-RPC dispatch, the task lifecycle, and SSE
+* streaming. Transport-agnostic — `handle` / `handleStream` take a structural
+* request and return bytes; the HTTP binding lives in routes.ts.
+* @module dsh-a2a/server/a2a-server
+*/
+/** A2A JSON-RPC / SSE server over a structural request. */
+var A2AServer = class {
+	opts;
+	card;
+	listeners = /* @__PURE__ */ new Set();
+	waiters = /* @__PURE__ */ new Map();
+	running = /* @__PURE__ */ new Map();
+	constructor(opts) {
+		this.opts = opts;
+		this.card = opts.card;
+	}
+	/**
+	* Abort a running task by control path (facade /a2a task cancel): abort the
+	* executor's signal, settle the task CANCELED, and wake stream waiters.
+	* @returns false when the task is unknown or already terminal.
+	*/
+	abort(taskId) {
+		const record = this.opts.store.get(taskId);
+		if (record === void 0 || isTerminal(record.state)) return false;
+		this.running.get(taskId)?.abort();
+		this.opts.store.setState(taskId, TaskState.CANCELED, {
+			code: "canceled",
+			text: "Task canceled"
+		});
+		this.settle(taskId);
+		return true;
+	}
+	/** True when the request carries the configured bearer token. */
+	authorized(req) {
+		const token = this.opts.authToken;
+		if (!token) return true;
+		const header = req.headers?.["authorization"] ?? "";
+		const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+		return match !== null && match[1] === token;
+	}
+	/** Route one inbound HTTP request (GET card, POST JSON-RPC). */
+	async handle(req, body) {
+		const path = (req.url ?? "").split("?")[0] ?? "";
+		if (req.method === "GET" && path === "/.well-known/agent-card.json") return {
+			status: 200,
+			contentType: "application/json",
+			body: JSON.stringify(this.card)
+		};
+		if (req.method !== "POST" || path !== endpointOf(this.card)) return {
+			status: 404,
+			contentType: "text/plain",
+			body: "Not Found"
+		};
+		if (!this.authorized(req)) return {
+			status: 401,
+			contentType: "application/json",
+			body: JSON.stringify(rpcError(null, A2A_ERROR_CODES.UNAUTHORIZED, "Unauthorized")),
+			headers: { "WWW-Authenticate": "Bearer" }
+		};
+		const rpc = parseRpc(body);
+		if (rpc === void 0) return {
+			status: 200,
+			contentType: "application/json",
+			body: JSON.stringify(rpcError(null, A2A_ERROR_CODES.INVALID_REQUEST, "Invalid JSON-RPC request"))
+		};
+		try {
+			const result = await this.dispatch(rpc);
+			const source = sourceOf(req);
+			this.opts.onInbound?.({
+				method: rpc.method,
+				...source !== void 0 ? { source } : {},
+				taskIds: extractTaskIds(result),
+				streaming: false
+			});
+			return {
+				status: 200,
+				contentType: "application/json",
+				body: JSON.stringify(rpcSuccess(rpc.id, result))
+			};
+		} catch (err) {
+			const e = err;
+			return {
+				status: 200,
+				contentType: "application/json",
+				body: JSON.stringify(rpcError(rpc.id, typeof e.code === "number" ? e.code : A2A_ERROR_CODES.INTERNAL_ERROR, e.message ?? String(err), e.data))
+			};
+		}
+	}
+	/**
+	* Route one SSE request (SendStreamingMessage / SubscribeToTask). Frames are
+	* pushed to `onEvent` as they happen; the caller must have checked
+	* `authorized()` before writing 200 headers.
+	*/
+	async handleStream(req, body, onEvent) {
+		if (req.method !== "POST") {
+			onEvent(`event: error\ndata: ${JSON.stringify({
+				code: 404,
+				message: "Not Found"
+			})}\n\n`);
+			return { status: 200 };
+		}
+		if (!this.authorized(req)) return {
+			status: 401,
+			headers: { "WWW-Authenticate": "Bearer" }
+		};
+		const rpc = parseRpc(body);
+		if (rpc === void 0) {
+			onEvent(`event: error\ndata: ${JSON.stringify({
+				code: A2A_ERROR_CODES.INVALID_REQUEST,
+				message: "Invalid JSON-RPC request"
+			})}\n\n`);
+			return { status: 200 };
+		}
+		if (rpc.method !== A2A_METHODS.sendStreamingMessage && rpc.method !== A2A_METHODS.subscribeToTask) {
+			onEvent(`event: error\ndata: ${JSON.stringify(methodNotFound(rpc.method ?? ""))}\n\n`);
+			return { status: 200 };
+		}
+		const params = rpc.params ?? {};
+		let record;
+		if (rpc.method === A2A_METHODS.sendStreamingMessage) {
+			if (params.message === void 0) {
+				onEvent(`event: error\ndata: ${JSON.stringify({
+					code: A2A_ERROR_CODES.INVALID_PARAMS,
+					message: "Missing message"
+				})}\n\n`);
+				return { status: 200 };
+			}
+			const gateOutcome = await this.opts.gate(gateInputFrom(params.message, this.remotePeerOf(req)));
+			if (!gateOutcome.ok) {
+				onEvent(`event: error\ndata: ${JSON.stringify({
+					code: -32e3,
+					message: gateOutcome.reason
+				})}\n\n`);
+				return { status: 200 };
+			}
+			record = this.ensureTask(params.message, this.remotePeerOf(req));
+			this.noteInbound(req, rpc.method, [record.taskId], true);
+			this.runTask(record);
+		} else {
+			const id = params.id;
+			if (id === void 0) {
+				onEvent(`event: error\ndata: ${JSON.stringify({
+					code: A2A_ERROR_CODES.INVALID_PARAMS,
+					message: "Missing task id"
+				})}\n\n`);
+				return { status: 200 };
+			}
+			record = this.opts.store.get(id);
+			this.noteInbound(req, rpc.method, id ? [id] : [], true);
+			if (record === void 0) {
+				onEvent(`event: error\ndata: ${JSON.stringify({
+					code: A2A_ERROR_CODES.TASK_NOT_FOUND,
+					message: `Task ${id} not found`
+				})}\n\n`);
+				return { status: 200 };
+			}
+		}
+		const sub = (frame) => onEvent(`data: ${JSON.stringify(frame)}\n\n`);
+		this.listeners.add(sub);
+		try {
+			const current = this.opts.store.get(record.taskId);
+			if (current !== void 0) sub({ statusUpdate: {
+				taskId: record.taskId,
+				contextId: record.contextId,
+				status: statusOf(current)
+			} });
+			await this.waitTerminal(record.taskId);
+			const finalRecord = this.opts.store.get(record.taskId);
+			if (finalRecord !== void 0) onEvent(`data: ${JSON.stringify({ task: toTask(finalRecord) })}\n\n`);
+		} finally {
+			this.listeners.delete(sub);
+		}
+		return { status: 200 };
+	}
+	/** Dispatch one JSON-RPC request; throws {code, message} on errors. */
+	async dispatch(rpc) {
+		const method = rpc.method;
+		const params = rpc.params ?? {};
+		switch (method) {
+			case A2A_METHODS.sendMessage: {
+				const message = params["message"];
+				if (message === void 0) throw rpcFault(A2A_ERROR_CODES.INVALID_PARAMS, "Missing message");
+				const gateOutcome = await this.opts.gate(gateInputFrom(message, null));
+				if (!gateOutcome.ok) throw rpcFault(A2A_ERROR_CODES.INVALID_PARAMS, gateOutcome.reason);
+				const record = this.ensureTask(message, null);
+				this.noteInbound({ method }, method, [record.taskId], false);
+				await this.runTask(record);
+				return toTask(this.opts.store.get(record.taskId) ?? record);
+			}
+			case A2A_METHODS.getTask: {
+				const id = params["id"];
+				if (id === void 0) throw rpcFault(A2A_ERROR_CODES.INVALID_PARAMS, "Missing task id");
+				const record = this.opts.store.get(id);
+				if (record === void 0) throw rpcFault(A2A_ERROR_CODES.TASK_NOT_FOUND, `Task ${id} not found`);
+				return toTask(record);
+			}
+			case A2A_METHODS.listTasks: return this.opts.store.list().map(toTask);
+			case A2A_METHODS.cancelTask: {
+				const id = params["id"];
+				if (id === void 0) throw rpcFault(A2A_ERROR_CODES.INVALID_PARAMS, "Missing task id");
+				const record = this.opts.store.get(id);
+				if (record === void 0) throw rpcFault(A2A_ERROR_CODES.TASK_NOT_FOUND, `Task ${id} not found`);
+				if (isTerminal(record.state)) throw rpcFault(A2A_ERROR_CODES.TASK_CANCEL_NOT_ALLOWED, `Task ${id} already in terminal state ${record.state}`);
+				this.running.get(id)?.abort();
+				this.opts.store.setState(id, TaskState.CANCELED, {
+					code: "canceled",
+					text: "Task canceled by caller"
+				});
+				this.settle(id);
+				return toTask(this.opts.store.get(id));
+			}
+			case A2A_METHODS.getExtendedAgentCard: return this.card;
+			default: throw rpcFault(A2A_ERROR_CODES.METHOD_NOT_FOUND, `Unknown method ${method}`);
+		}
+	}
+	/** Create (or continue) the task record for one message. */
+	ensureTask(message, remotePeerId) {
+		if (message.taskId !== void 0) {
+			const existing = this.opts.store.get(message.taskId);
+			if (existing !== void 0) return this.opts.store.create({
+				contextId: existing.contextId,
+				skill: existing.skill,
+				parts: message.parts,
+				remotePeerId
+			});
+		}
+		const contextId = message.contextId ?? crypto.randomUUID();
+		const skill = message.metadata?.["skill"] ?? "chat";
+		return this.opts.store.create({
+			contextId,
+			skill,
+			parts: message.parts,
+			remotePeerId
+		});
+	}
+	/** Run one task to a terminal state, emitting status/artifact frames. */
+	async runTask(record) {
+		const controller = new AbortController();
+		this.running.set(record.taskId, controller);
+		this.opts.store.setState(record.taskId, TaskState.WORKING);
+		this.emit({ statusUpdate: {
+			taskId: record.taskId,
+			contextId: record.contextId,
+			status: statusOf(this.opts.store.get(record.taskId))
+		} });
+		const onEvent = this.eventSink(record.taskId, record.contextId);
+		try {
+			const output = await this.opts.executors.resolve(record.skill).execute({
+				taskId: record.taskId,
+				contextId: record.contextId,
+				skill: record.skill,
+				prompt: partsToText(record.parts),
+				signal: controller.signal
+			}, { onEvent });
+			const settled = this.opts.store.get(record.taskId);
+			if (settled !== void 0 && settled.state === TaskState.CANCELED) {} else {
+				this.opts.store.appendArtifact(record.taskId, {
+					artifactId: "result",
+					parts: output.parts,
+					lastChunk: true
+				});
+				this.opts.store.setState(record.taskId, TaskState.COMPLETED);
+			}
+		} catch (err) {
+			const settled = this.opts.store.get(record.taskId);
+			if (settled !== void 0 && settled.state === TaskState.CANCELED) {} else this.opts.store.setState(record.taskId, TaskState.FAILED, {
+				code: "executor",
+				text: err.message
+			});
+		} finally {
+			this.running.delete(record.taskId);
+			const terminal = this.opts.store.get(record.taskId);
+			if (terminal !== void 0) this.emit({ task: toTask(terminal) });
+			this.settle(record.taskId);
+			this.opts.onTaskSettled?.(record.taskId);
+		}
+	}
+	/** Build the event sink that folds executor events into store + frames. */
+	eventSink(taskId, contextId) {
+		return (ev) => {
+			if (ev.type === "status") {
+				this.opts.store.setState(taskId, ev.state ?? TaskState.WORKING);
+				this.emit({ statusUpdate: {
+					taskId,
+					contextId,
+					status: statusOf(this.opts.store.get(taskId))
+				} });
+			} else if (ev.type === "artifact" && ev.artifactId !== void 0 && ev.parts !== void 0) {
+				const artifact = this.opts.store.appendArtifact(taskId, {
+					artifactId: ev.artifactId,
+					...ev.name !== void 0 ? { name: ev.name } : {},
+					parts: ev.parts,
+					...ev.lastChunk !== void 0 ? { lastChunk: ev.lastChunk } : {}
+				}).artifacts.find((a) => a.artifactId === ev.artifactId);
+				if (artifact !== void 0) this.emit({ artifactUpdate: {
+					taskId,
+					contextId,
+					artifact: {
+						artifactId: artifact.artifactId,
+						...artifact.name !== void 0 ? { name: artifact.name } : {},
+						parts: artifact.parts
+					},
+					...ev.lastChunk !== void 0 ? { lastChunk: ev.lastChunk } : {}
+				} });
+			}
+		};
+	}
+	emit(frame) {
+		for (const listener of [...this.listeners]) listener(frame);
+	}
+	noteInbound(req, method, taskIds, streaming) {
+		const source = sourceOf(req);
+		this.opts.onInbound?.({
+			method,
+			...source !== void 0 ? { source } : {},
+			taskIds,
+			streaming
+		});
+	}
+	remotePeerOf(req) {
+		const source = sourceOf(req);
+		return source ? hashOf(source) : null;
+	}
+	async waitTerminal(taskId) {
+		const current = this.opts.store.get(taskId);
+		if (current !== void 0 && isTerminal(current.state)) return;
+		await new Promise((resolve) => {
+			this.waiters.set(taskId, resolve);
+		});
+	}
+	settle(taskId) {
+		const waiter = this.waiters.get(taskId);
+		if (waiter !== void 0) {
+			this.waiters.delete(taskId);
+			waiter();
+		}
+	}
+};
+/** Read the JSON-RPC endpoint path off the card's first interface. */
+function endpointOf(card) {
+	const url = card.supportedInterfaces?.[0]?.url;
+	if (!url) return "/a2a";
+	try {
+		return new URL(url).pathname;
+	} catch {
+		return url;
+	}
+}
+function sourceOf(req) {
+	const s = req.socket;
+	if (!s?.remoteAddress) return void 0;
+	return `${s.remoteAddress}:${s.remotePort ?? ""}`;
+}
+function hashOf(value) {
+	let h = 0;
+	for (let i = 0; i < value.length; i++) h = h * 31 + value.charCodeAt(i) >>> 0;
+	return `peer-${h.toString(16)}`;
+}
+function gateInputFrom(message, remotePeerId) {
+	return {
+		contextId: message.contextId ?? "new",
+		skill: message.metadata?.["skill"] ?? "chat",
+		parts: message.parts,
+		remotePeerId
+	};
+}
+function rpcFault(code, message) {
+	return {
+		code,
+		message
+	};
+}
+function statusOf(record) {
+	return {
+		state: record.state,
+		timestamp: record.updatedAt,
+		...record.error ? { message: {
+			messageId: `a2a-status-${record.taskId}`,
+			role: Role.AGENT,
+			parts: [{ text: record.error.message }]
+		} } : {}
+	};
+}
+function toTask(record) {
+	return {
+		id: record.taskId,
+		contextId: record.contextId,
+		status: statusOf(record),
+		artifacts: record.artifacts,
+		metadata: { skill: record.skill }
+	};
+}
+function extractTaskIds(result) {
+	if (result === null || typeof result !== "object") return [];
+	const value = result;
+	if (typeof value.id === "string") return [value.id];
+	if (typeof value.task?.id === "string") return [value.task.id];
+	if (Array.isArray(result)) return result.map((t) => t.id).filter((id) => typeof id === "string");
+	return [];
+}
+//#endregion
+//#region lib/types/server/routes.js
+/**
+* HTTP binding for the inbound server: registers the AgentCard route and the
+* JSON-RPC / SSE endpoint on a structural webServer (normally
+* `@deepseek-ai/dsh-host-webserver`), with runtime enable/disable.
+* @module dsh-a2a/server/routes
+*/
+const CARD_PATH = "/.well-known/agent-card.json";
+/** Runtime-registered HTTP routes for one A2A server. */
+var A2aRoutes = class {
+	webServer;
+	server;
+	disposers = [];
+	registered = false;
+	constructor(webServer, server) {
+		this.webServer = webServer;
+		this.server = server;
+	}
+	get active() {
+		return this.registered;
+	}
+	/** Register the AgentCard + endpoint routes (idempotent). */
+	enable() {
+		if (this.registered) return;
+		this.disposers.push(this.webServer.register({
+			kind: "exact",
+			path: CARD_PATH,
+			handler: (_req, res) => {
+				res.writeHead(200, { "content-type": "application/json" });
+				res.end(JSON.stringify(this.server.card));
+			}
+		}));
+		this.disposers.push(this.webServer.register({
+			kind: "prefix",
+			path: endpointPathOf(this.server),
+			handler: (req, res) => this.onRequest(req, res)
+		}));
+		this.registered = true;
+	}
+	/** Unregister the routes (idempotent). */
+	disable() {
+		for (const disposer of this.disposers.splice(0)) disposer();
+		this.registered = false;
+	}
+	dispose() {
+		this.disable();
+	}
+	async onRequest(req, res) {
+		const path = (req.url ?? "").split("?")[0] ?? "";
+		const streaming = req.method === "POST" && (req.headers.accept ?? "").includes("text/event-stream");
+		if (req.method === "POST" && path === endpointPathOf(this.server)) {
+			const body = await readBody$1(req);
+			if (streaming) {
+				if (!this.server.authorized(toServerReq(req))) {
+					res.writeHead(401, {
+						"content-type": "text/plain",
+						"WWW-Authenticate": "Bearer"
+					});
+					res.end("Unauthorized");
+					return;
+				}
+				res.writeHead(200, {
+					"content-type": "text/event-stream",
+					"cache-control": "no-cache",
+					connection: "keep-alive",
+					"x-accel-buffering": "no"
+				});
+				const outcome = await this.server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
+				if (outcome.status !== 200) {
+					res.writeHead(outcome.status, {
+						"content-type": "text/plain",
+						...outcome.headers ?? {}
+					});
+					res.end("Unauthorized");
+					return;
+				}
+				res.end();
+				return;
+			}
+			const out = await this.server.handle(toServerReq(req), body);
+			res.writeHead(out.status, {
+				"content-type": out.contentType,
+				...out.headers ?? {}
+			});
+			res.end(out.body);
+			return;
+		}
+		const out = await this.server.handle(toServerReq(req), path === CARD_PATH ? "" : "");
+		res.writeHead(out.status, {
+			"content-type": out.contentType,
+			...out.headers ?? {}
+		});
+		res.end(out.body);
+	}
+};
+function endpointPathOf(server) {
+	const url = server.card.supportedInterfaces?.[0]?.url;
+	if (!url) return "/a2a";
+	try {
+		return new URL(url).pathname;
+	} catch {
+		return "/a2a";
+	}
+}
+function readBody$1(req) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		req.on("data", (chunk) => chunks.push(chunk));
+		req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+		req.once("error", reject);
+	});
+}
+function toServerReq(req) {
+	const headers = {};
+	for (const [key, value] of Object.entries(req.headers)) if (typeof value === "string") headers[key] = value;
+	else if (Array.isArray(value)) headers[key] = value.join(", ");
+	const method = req.method;
+	const url = req.url;
+	const socket = req.socket;
+	return {
+		...method !== void 0 ? { method } : {},
+		...url !== void 0 ? { url } : {},
+		headers,
+		...socket ? { socket: {
+			...socket.remoteAddress !== void 0 ? { remoteAddress: socket.remoteAddress } : {},
+			...socket.remotePort !== void 0 ? { remotePort: socket.remotePort } : {}
+		} } : {}
+	};
+}
+//#endregion
+//#region lib/types/api.js
+/**
+* GUI control API for the A2A settings dashboard: one `GET /a2a/api`
+* snapshot plus `POST /a2a/api` control actions (server toggle, outbound
+* agent management, task view). The browser half talks only to this route;
+* it carries no protocol knowledge. Loopback-only by default so the
+* dashboard cannot be driven from the wire.
+*
+* The route body is bound to the same `A2AServiceImpl` facade the `/a2a`
+* command surface uses, so GUI actions and commands cannot disagree.
+* @module dsh-a2a/api
+*/
+function readBody(req) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		req.on("data", (chunk) => chunks.push(chunk));
+		req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+		req.once("error", reject);
+	});
+}
+/** The caller is the local machine (never a remote peer). */
+function isLoopback(req) {
+	const address = req.socket?.remoteAddress;
+	return address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+}
+function json(res, status, value) {
+	res.writeHead(status, {
+		"content-type": "application/json",
+		"cache-control": "no-cache"
+	});
+	res.end(JSON.stringify(value));
+}
+/** Handle one dashboard API request against the service facade. */
+async function handleApiRequest(req, res, impl) {
+	if (!isLoopback(req)) {
+		res.writeHead(403, { "content-type": "text/plain" });
+		res.end("forbidden");
+		return;
+	}
+	if (req.method === "GET") {
+		json(res, 200, snapshotOf(impl));
+		return;
+	}
+	if (req.method === "POST") {
+		let payload;
+		try {
+			payload = JSON.parse(await readBody(req));
+		} catch {
+			json(res, 400, {
+				ok: false,
+				message: "invalid JSON body"
+			});
+			return;
+		}
+		const result = await dispatch(payload, impl);
+		json(res, result.ok ? 200 : 409, result);
+		return;
+	}
+	res.writeHead(405, { "content-type": "text/plain" });
+	res.end("Method Not Allowed");
+}
+function snapshotOf(impl) {
+	return {
+		server: impl.status().server,
+		tasks: impl.listTasks(),
+		agents: impl.agents()
+	};
+}
+async function dispatch(payload, impl) {
+	switch (payload.action) {
+		case "server.enable": return impl.enableServer(true);
+		case "server.disable": return impl.enableServer(false);
+		case "agent.add": return impl.addAgent({
+			name: payload.name,
+			agentCardUrl: payload.agentCardUrl,
+			...payload.bearerTokenEnv ? { bearerTokenEnv: payload.bearerTokenEnv } : {}
+		});
+		case "agent.remove": return impl.removeAgent(payload.id);
+		case "agent.enable": return impl.setAgentEnabled(payload.id, true);
+		case "agent.disable": return impl.setAgentEnabled(payload.id, false);
+		case "agent.refresh": return impl.refreshAgentCard(payload.id);
+		case "task.cancel": return impl.cancelTask(payload.id);
+		default: return {
+			ok: false,
+			message: `unknown action ${String(payload.action)}`
+		};
+	}
+}
+//#endregion
+//#region lib/types/outbound/calls.js
+/**
+* Outbound A2A client: AgentCard discovery plus the JSON-RPC methods the
+* tools layer needs. Sync-by-polling for P0 (each tool call waits for the
+* task to settle up to a timeout); passive result injection replaces this in
+* P1 without changing the transport.
+* @module dsh-a2a/client/calls
+*/
+/** Error carrying the remote JSON-RPC error code. */
+var A2AError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "A2AError";
+	}
+};
+/** A connected remote A2A agent (one AgentCard endpoint). */
+var A2AClient = class A2AClient {
+	opts;
+	card;
+	endpoint;
+	constructor(card, endpoint, opts) {
+		this.opts = opts;
+		this.card = card;
+		this.endpoint = endpoint;
+	}
+	/** Fetch and validate an AgentCard, then connect to its JSON-RPC endpoint. */
+	static async connect(agentCardUrl, opts = {}) {
+		const timeoutMs = opts.timeoutMs ?? 6e4;
+		const response = await (opts.fetchImpl ?? fetch)(agentCardUrl, {
+			headers: {
+				accept: "application/json",
+				...opts.bearerToken ? { authorization: `Bearer ${opts.bearerToken}` } : {}
+			},
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+		if (!response.ok) throw new A2AError(A2A_ERROR_CODES.AGENT_CARD_NOT_FOUND, `agent card fetch failed: HTTP ${response.status}`);
+		const card = await response.json();
+		if (typeof card.name !== "string" || typeof card.description !== "string") throw new A2AError(A2A_ERROR_CODES.AGENT_CARD_SIGNATURE_INVALID, `invalid agent card at ${agentCardUrl}`);
+		const endpoint = (card.supportedInterfaces?.find((i) => (i.protocolBinding ?? "JSONRPC") === "JSONRPC") ?? card.supportedInterfaces?.[0])?.url ?? card.url;
+		if (!endpoint) throw new A2AError(A2A_ERROR_CODES.AGENT_CARD_NOT_FOUND, `agent card at ${agentCardUrl} advertises no JSON-RPC interface`);
+		return new A2AClient(card, endpoint, opts);
+	}
+	/** Send a message and wait (or poll) until the task settles. */
+	async sendMessage(message) {
+		const task = await this.call(A2A_METHODS.sendMessage, { message });
+		if (isTerminal(task.status.state)) return task;
+		return this.pollTask(task.id);
+	}
+	async getTask(taskId) {
+		return this.call(A2A_METHODS.getTask, { id: taskId });
+	}
+	async listTasks() {
+		return this.call(A2A_METHODS.listTasks, {});
+	}
+	async cancelTask(taskId) {
+		return this.call(A2A_METHODS.cancelTask, { id: taskId });
+	}
+	/** Poll a task until terminal or the overall timeout elapses. */
+	async pollTask(taskId) {
+		const budget = this.opts.timeoutMs ?? 6e4;
+		const deadline = Date.now() + budget;
+		for (;;) {
+			const task = await this.getTask(taskId);
+			if (isTerminal(task.status.state)) return task;
+			if (Date.now() >= deadline) throw new A2AError(-32e3, `task ${taskId} did not settle within ${budget}ms`);
+			await new Promise((resolve) => setTimeout(resolve, 250));
+		}
+	}
+	async call(method, params) {
+		const timeoutMs = this.opts.timeoutMs ?? 6e4;
+		const fetchImpl = this.opts.fetchImpl ?? fetch;
+		let response;
+		try {
+			response = await fetchImpl(this.endpoint, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					accept: "application/json",
+					...this.opts.bearerToken ? { authorization: `Bearer ${this.opts.bearerToken}` } : {}
+				},
+				body: JSON.stringify({
+					jsonrpc: "2.0",
+					id: crypto.randomUUID(),
+					method,
+					params
+				}),
+				signal: AbortSignal.timeout(timeoutMs)
+			});
+		} catch (err) {
+			if (err instanceof Error && err.name === "TimeoutError") throw new A2AError(-32e3, `A2A call ${method} timed out after ${timeoutMs}ms`);
+			throw err;
+		}
+		if (response.status === 401) throw new A2AError(A2A_ERROR_CODES.UNAUTHORIZED, "remote agent rejected credentials (401)");
+		if (!response.ok) throw new A2AError(A2A_ERROR_CODES.INTERNAL_ERROR, `A2A call ${method} failed: HTTP ${response.status}`);
+		const payload = await response.json();
+		if ("error" in payload) {
+			const error = payload.error;
+			throw new A2AError(error.code, error.message);
+		}
+		return payload.result;
+	}
+};
+//#endregion
+//#region lib/types/outbound/tools.js
+/**
+* Outbound half: register one remote agent's skills as model-facing tools on
+* `ctx.tools`. Tool names are `a2a__<agent>__<skill>` normalized to the DSH
+* function-name contract (≤64 chars, collision hash), mirroring the naming
+* rule of dsh-mcp-client. An agent advertising zero skills registers nothing.
+* @module dsh-a2a/client/tools
+*/
+function normalizeToolName(raw) {
+	const norm = raw.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 64);
+	if (norm.length > 0 && /^[A-Za-z0-9_-]+$/.test(norm)) return norm;
+	let hash = 0;
+	for (let i = 0; i < raw.length; i++) hash = hash * 31 + raw.charCodeAt(i) >>> 0;
+	return `_${hash.toString(16)}`;
+}
+/** Register one tool per advertised skill; empty skills register nothing. */
+function registerAgentTools(registrar, opts) {
+	const prefix = opts.toolPrefix ?? "a2a";
+	const skills = opts.client.card.skills ?? [];
+	const out = [];
+	for (const skill of skills) {
+		const raw = `${prefix}__${opts.agentName}__${skill.id}`;
+		const name = normalizeToolName(raw);
+		let toolName = name;
+		if (out.some((t) => t.name === toolName)) {
+			let hash = 0;
+			for (let i = 0; i < raw.length; i++) hash = hash * 31 + raw.charCodeAt(i) >>> 0;
+			toolName = `${name.slice(0, 56)}_${hash.toString(16)}`;
+		}
+		const dispose = registrar.register(makeTool(toolName, opts.client, skill, opts.contextFor));
+		if (dispose) out.push({
+			name: toolName,
+			dispose
+		});
+	}
+	return out;
+}
+function makeTool(name, client, skill, contextFor) {
+	return {
+		name,
+		description: [skill.description, ...skill.examples?.length ? [`Examples: ${skill.examples.join(" | ")}`] : []].filter(Boolean).join("\n"),
+		parameters: {
+			type: "object",
+			properties: { prompt: {
+				type: "string",
+				description: "The task or instruction to send to the remote agent."
+			} },
+			required: ["prompt"]
+		},
+		output: {
+			schema: { type: "string" },
+			render: (_args, value) => [{
+				type: "text",
+				text: String(value)
+			}]
+		},
+		async execute(args, exec) {
+			const message = {
+				messageId: crypto.randomUUID(),
+				role: Role.USER,
+				contextId: contextFor(exec.agent?.id),
+				parts: [{ text: args.prompt }]
+			};
+			const task = await client.sendMessage(message);
+			return textOf(task.artifacts, task.status.state, task.status.message?.parts);
+		}
+	};
+}
+/** Render a settled task's output as tool text (INPUT_REQUIRED surfaced, not thrown). */
+function textOf(artifacts, state, statusParts) {
+	const output = partsToText(artifacts?.flatMap((a) => a.parts ?? []));
+	if (state === "FAILED") throw new A2AError(-32e3, `Remote agent task failed: ${output || partsToText(statusParts) || "no detail"}`);
+	if (state === "INPUT_REQUIRED" || state === "AUTH_REQUIRED") return `[remote agent ${state}] ${partsToText(statusParts) || output || "agent awaits input"}`;
+	return output || "(remote agent returned no output)";
+}
+//#endregion
+//#region lib/types/outbound/registry.js
+/**
+* Outbound agent registry: the persisted list of connected remote agents,
+* their connection state, and the tool-registration disposers for each live
+* connection. Loaded at boot, mutations persist through the agent store.
+* @module dsh-a2a/client/registry
+*/
+/** Domain-backed agent store: one JSON array under the `agents` table key. */
+var DomainAgentStore = class DomainAgentStore {
+	table;
+	static KEY = "records";
+	constructor(table) {
+		this.table = table;
+	}
+	list() {
+		const raw = this.table.get(DomainAgentStore.KEY);
+		if (raw === void 0) return [];
+		try {
+			const parsed = JSON.parse(raw);
+			return Array.isArray(parsed) ? parsed : [];
+		} catch {
+			return [];
+		}
+	}
+	async save(records) {
+		await this.table.put(DomainAgentStore.KEY, JSON.stringify(records));
+	}
+};
+/** A list of remote agents, each with live tool registrations when enabled. */
+var OutboundAgentRegistry = class {
+	opts;
+	live = /* @__PURE__ */ new Map();
+	views = /* @__PURE__ */ new Map();
+	seedRecords;
+	constructor(opts) {
+		this.opts = opts;
+	}
+	/** Load persisted records and connect every enabled agent (background). */
+	loadAll() {
+		const records = this.opts.store.list();
+		this.seedRecords = records;
+		for (const record of records) if (record.enabled) this.connectRecord(record).catch((err) => {
+			this.opts.onError?.(`[a2a] failed to connect "${record.name}": ${err.message}`);
+		});
+	}
+	/**
+	* Seed configured agents that the persisted store does not know yet. The
+	* store is the runtime state: an existing record (enabled or disabled,
+	* present or removed) keeps its state — a disabled agent stays
+	* disconnected and a removed one is not resurrected. Only specs with a name
+	* absent from the store (and not already live this boot) connect and
+	* persist.
+	* @param specs - declared agents from the profile config.
+	*/
+	async seed(specs) {
+		const known = new Set(this.opts.store.list().map((r) => r.name));
+		for (const connection of this.live.values()) known.add(connection.record.name);
+		for (const spec of specs) {
+			if (known.has(spec.name)) continue;
+			const result = await this.add(spec);
+			if (result.ok) known.add(spec.name);
+			else this.opts.onError?.(`[a2a] seed agent "${spec.name}": ${result.message}`);
+		}
+	}
+	list() {
+		return [...this.views.values()];
+	}
+	/** Add and connect an agent, persisting the record on success. */
+	async add(spec) {
+		const record = {
+			id: `agent-${crypto.randomUUID()}`,
+			name: spec.name,
+			agentCardUrl: spec.agentCardUrl,
+			...spec.bearerTokenEnv ? { bearerTokenEnv: spec.bearerTokenEnv } : {},
+			enabled: spec.enabled ?? true,
+			timeoutMs: spec.timeoutMs ?? this.opts.defaultTimeoutMs ?? 6e4,
+			lastCardAt: null
+		};
+		try {
+			await this.connectRecord(record);
+		} catch (err) {
+			this.views.set(record.id, {
+				id: record.id,
+				name: record.name,
+				agentCardUrl: record.agentCardUrl,
+				enabled: record.enabled,
+				state: "failed",
+				skillCount: 0,
+				toolCount: 0,
+				lastError: err.message
+			});
+			return {
+				ok: false,
+				message: `failed to connect to ${record.agentCardUrl}: ${err.message}`
+			};
+		}
+		this.persist(record);
+		return {
+			ok: true,
+			message: `agent "${record.name}" connected`
+		};
+	}
+	async remove(id) {
+		const live = this.live.get(id);
+		const view = this.views.get(id);
+		if (live === void 0 && view === void 0) return {
+			ok: false,
+			message: `agent ${id} not found`
+		};
+		for (const disposer of live?.disposers ?? []) disposer.dispose();
+		this.live.delete(id);
+		this.views.delete(id);
+		await this.persistAll();
+		return {
+			ok: true,
+			message: `agent ${id} removed`
+		};
+	}
+	async setEnabled(id, enabled) {
+		const live = this.live.get(id);
+		const view = this.views.get(id);
+		if (live === void 0 && view === void 0) return {
+			ok: false,
+			message: `agent ${id} not found`
+		};
+		if (enabled && live === void 0) {
+			const record = this.findRecord(id);
+			if (record === void 0) return {
+				ok: false,
+				message: `agent ${id} has no persisted record`
+			};
+			try {
+				await this.connectRecord(record);
+			} catch (err) {
+				return {
+					ok: false,
+					message: `failed to connect: ${err.message}`
+				};
+			}
+			await this.persistAll();
+			return {
+				ok: true,
+				message: `agent ${id} enabled`
+			};
+		}
+		if (!enabled && live !== void 0) {
+			for (const disposer of live.disposers) disposer.dispose();
+			this.live.delete(id);
+			const current = this.views.get(id);
+			if (current !== void 0) this.views.set(id, {
+				...current,
+				enabled: false,
+				state: "disconnected",
+				toolCount: 0,
+				skillCount: 0
+			});
+			await this.persistAll();
+			return {
+				ok: true,
+				message: `agent ${id} disabled`
+			};
+		}
+		return {
+			ok: true,
+			message: `agent ${id} already ${enabled ? "enabled" : "disabled"}`
+		};
+	}
+	async refresh(id) {
+		const record = this.findRecord(id) ?? this.live.get(id)?.record;
+		if (record === void 0) return {
+			ok: false,
+			message: `agent ${id} not found`
+		};
+		const live = this.live.get(id);
+		for (const disposer of live?.disposers ?? []) disposer.dispose();
+		this.live.delete(id);
+		try {
+			await this.connectRecord(record);
+		} catch (err) {
+			return {
+				ok: false,
+				message: `refresh failed: ${err.message}`
+			};
+		}
+		await this.persistAll();
+		return {
+			ok: true,
+			message: `agent "${record.name}" reconnected`
+		};
+	}
+	async disposeAll() {
+		for (const connection of this.live.values()) for (const disposer of connection.disposers) disposer.dispose();
+		this.live.clear();
+		this.views.clear();
+	}
+	async connectRecord(record) {
+		const token = this.opts.tokenOf(record.bearerTokenEnv);
+		const client = await A2AClient.connect(record.agentCardUrl, {
+			...token ? { bearerToken: token } : {},
+			timeoutMs: record.timeoutMs
+		});
+		const contextByAgent = /* @__PURE__ */ new Map();
+		const fallback = `a2a-out-${crypto.randomUUID()}`;
+		const contextFor = (agentId) => {
+			const key = agentId ?? "\0fallback";
+			const existing = contextByAgent.get(key);
+			if (existing !== void 0) return existing;
+			const id = agentId ? `a2a-out-${crypto.randomUUID()}` : fallback;
+			contextByAgent.set(key, id);
+			return id;
+		};
+		const disposers = registerAgentTools(this.opts.registrar, {
+			agentName: record.name,
+			client,
+			...this.opts.toolPrefix !== void 0 ? { toolPrefix: this.opts.toolPrefix } : {},
+			contextFor
+		});
+		const skillCount = client.card.skills?.length ?? 0;
+		this.live.set(record.id, {
+			record,
+			client,
+			disposers,
+			skillCount
+		});
+		this.views.set(record.id, {
+			id: record.id,
+			name: record.name,
+			agentCardUrl: record.agentCardUrl,
+			enabled: record.enabled,
+			state: "connected",
+			skillCount,
+			toolCount: disposers.length
+		});
+	}
+	findRecord(id) {
+		const current = () => this.opts.store.list().find((r) => r.id === id);
+		return current() ?? this.seedRecords?.find((r) => r.id === id);
+	}
+	persist(record) {
+		const next = [...this.opts.store.list().filter((r) => r.id !== record.id), record];
+		this.opts.store.save(next).catch((err) => {
+			this.opts.onError?.(`[a2a] failed to persist agent list: ${String(err)}`);
+		});
+	}
+	async persistAll() {
+		const liveRecords = [...this.live.values()].map((c) => c.record);
+		const liveIds = new Set(liveRecords.map((r) => r.id));
+		const kept = this.opts.store.list().filter((r) => !liveIds.has(r.id) && this.views.has(r.id)).map((r) => {
+			const view = this.views.get(r.id);
+			return view === void 0 ? r : {
+				...r,
+				enabled: view.enabled
+			};
+		});
+		await this.opts.store.save([...kept, ...liveRecords]);
+	}
+};
+//#endregion
+//#region lib/types/service.js
+/**
+* The `ctx.a2a` service facade: the thin read/control surface commands and
+* other plugins use. Registered as a Cordis Service so the key disappears
+* with the plugin fiber.
+* @module dsh-a2a/service
+*/
+/** The service other plugins read as `ctx.a2a`. */
+var A2AService = class extends Service {
+	impl;
+	constructor(ctx, impl) {
+		super(ctx, "a2a");
+		this.impl = impl;
+	}
+	status() {
+		return this.impl.status();
+	}
+	async enableServer(enable) {
+		return this.impl.enableServer(enable);
+	}
+	getTask(taskId) {
+		return this.impl.getTask(taskId);
+	}
+	listTasks() {
+		return this.impl.listTasks();
+	}
+	async cancelTask(taskId) {
+		return this.impl.cancelTask(taskId);
+	}
+	agents() {
+		return this.impl.agents();
+	}
+	async addAgent(spec) {
+		return this.impl.addAgent(spec);
+	}
+	async removeAgent(id) {
+		return this.impl.removeAgent(id);
+	}
+	async setAgentEnabled(id, enabled) {
+		return this.impl.setAgentEnabled(id, enabled);
+	}
+	async refreshAgentCard(id) {
+		return this.impl.refreshAgentCard(id);
+	}
+};
+//#endregion
+//#region lib/types/commands.js
+/**
+* The `/a2a` command surface: status, server enable/disable, card, agents,
+* and task control — the P0 operations surface (the settings panel is P1).
+* @module dsh-a2a/commands
+*/
+/** Build the `/a2a` command definition over the service facade. */
+function buildA2aCommand(impl) {
+	return {
+		name: "a2a",
+		description: "Manage the A2A plugin: status, server, agents, tasks, card.",
+		handler: async (invocation) => {
+			const [verb, ...rest] = invocation.rawInput.trim().split(/\s+/);
+			switch (verb ?? "") {
+				case "": {
+					const status = impl.status();
+					return success(`A2A status\n${JSON.stringify(status, null, 2)}`);
+				}
+				case "status": return success(JSON.stringify(impl.status(), null, 2));
+				case "enable": return outcome(await impl.enableServer(true));
+				case "disable": return outcome(await impl.enableServer(false));
+				case "card": return success(JSON.stringify(impl.listTasks(), null, 2).slice(0, 4e3));
+				case "agents": return success(JSON.stringify(impl.agents(), null, 2));
+				case "agent": {
+					const [action, ...args] = rest;
+					switch (action ?? "") {
+						case "add": {
+							const url = args[0];
+							if (!url) return error("usage: /a2a agent add <agentCardUrl> [name]");
+							const name = args[1] ?? url;
+							return outcome(await impl.addAgent({
+								name,
+								agentCardUrl: url
+							}));
+						}
+						case "remove": {
+							const id = args[0];
+							if (!id) return error("usage: /a2a agent remove <id>");
+							return outcome(await impl.removeAgent(id));
+						}
+						case "enable": {
+							const id = args[0];
+							if (!id) return error("usage: /a2a agent enable <id>");
+							return outcome(await impl.setAgentEnabled(id, true));
+						}
+						case "disable": {
+							const id = args[0];
+							if (!id) return error("usage: /a2a agent disable <id>");
+							return outcome(await impl.setAgentEnabled(id, false));
+						}
+						case "refresh": {
+							const id = args[0];
+							if (!id) return error("usage: /a2a agent refresh <id>");
+							return outcome(await impl.refreshAgentCard(id));
+						}
+						default: return error("usage: /a2a agent add|remove|enable|disable|refresh ...");
+					}
+				}
+				case "tasks": return success(JSON.stringify(impl.listTasks(), null, 2));
+				case "task": {
+					const [action, id] = rest;
+					if (action === "get" && id) return success(JSON.stringify(impl.getTask(id), null, 2));
+					if (action === "cancel" && id) return outcome(await impl.cancelTask(id));
+					return error("usage: /a2a task get|cancel <taskId>");
+				}
+				case "help": return success("a2a commands: status | enable | disable | card | agents | agent add/remove/enable/disable/refresh | tasks | task get/cancel <id> | help");
+				default: return error(`unknown a2a verb "${verb}" (try /a2a help)`);
+			}
+		}
+	};
+}
+function success(text) {
+	return {
+		kind: "success",
+		text
+	};
+}
+function error(text) {
+	return {
+		kind: "error",
+		text
+	};
+}
+function outcome(result) {
+	return result.ok ? success(result.message) : error(result.message);
+}
+//#endregion
+//#region lib/types/index.js
+/**
+* @hanphone/dsh-a2a — Cordis plugin entry.
+*
+* Mounts the A2A v1.0 dual-end plugin: the inbound server (AgentCard derived
+* from the live tool registry, JSON-RPC + SSE, durable SQLite task store,
+* session/subagent executors, the `a2a/inbound-task` policy gate + audit)
+* and the outbound client (persisted multi-agent registry, skills mapped to
+* model tools, sync calls with per-agent timeout). Optional services are
+* probed rather than injected so a composition lacking one half idles just
+* that half; only the storage domain is required.
+*
+* Function-plugin export shape: named `name`/`inject`/`Config`/`apply`, no
+* default export (mixing forms makes the Loader drop the namespace).
+* @module dsh-a2a
+*/
+const name = "a2a";
+/** Only the storage domain is required; the other halves are probed. */
+const inject = ["storageDomain"];
+/** Loader-validated config schema (defaults applied by the Loader). */
+const Config = z.object({
+	server: z.object({
+		enabled: z.boolean().default(true),
+		name: z.string().default("My DSH Agent"),
+		description: z.string().default("A DeepSeek Harness agent exposed over A2A v1.0"),
+		version: z.string().default("0.1.0"),
+		baseUrl: z.string(),
+		endpointPath: z.string().default("/a2a"),
+		authTokenEnv: z.string(),
+		skills: z.object({
+			ids: z.array(z.string()).default([]),
+			exclude: z.array(z.string()).default([])
+		}),
+		executors: z.dict(z.union(["session", "subagent"])).default({ chat: "session" }),
+		subagentProvider: z.string().default("in-process")
+	}),
+	client: z.object({
+		agents: z.array(z.object({
+			name: z.string(),
+			agentCardUrl: z.string(),
+			bearerTokenEnv: z.string(),
+			enabled: z.boolean().default(true),
+			timeoutMs: z.number().default(6e4)
+		})).default([]),
+		toolPrefix: z.string().default("a2a")
+	})
+});
+function apply(ctx, config) {
+	const logger = ctx.logger("a2a");
+	const serverConfig = { ...config.server };
+	const clientConfig = { ...config.client };
+	const authToken = serverConfig.authTokenEnv !== void 0 ? process.env[serverConfig.authTokenEnv] : void 0;
+	const toolPrefix = clientConfig.toolPrefix;
+	const subagentProvider = serverConfig.subagentProvider;
+	const inboundCwd = inboundSessionCwd();
+	ctx.inject(["storageDomain"], (ctx) => {
+		ctx.effect(async () => {
+			const domain = await openDomain(ctx.storageDomain);
+			const store = new DomainTaskStore(domain);
+			const holder = {
+				domain,
+				store,
+				registry: void 0,
+				server: void 0,
+				routes: void 0,
+				card: void 0,
+				executors: void 0,
+				enabled: serverConfig.enabled
+			};
+			const webServer = probeService(ctx, "webServer", "register");
+			if (webServer === void 0) logger.warn("a2a: webServer not mounted; inbound server idle");
+			else try {
+				const skills = deriveSkills(probeService(ctx, "tools", "get") ?? { get: () => void 0 }, {
+					ids: serverConfig.skills.ids,
+					exclude: serverConfig.skills.exclude
+				});
+				const card = buildCard({
+					baseUrl: serverConfig.baseUrl ?? `http://127.0.0.1:${process.env["DSH_A2A_PORT"] ?? "3000"}`,
+					endpointPath: serverConfig.endpointPath ?? "/a2a",
+					name: serverConfig.name ?? "My DSH Agent",
+					description: serverConfig.description ?? "A DeepSeek Harness agent exposed over A2A v1.0",
+					version: serverConfig.version ?? "0.1.0",
+					skills,
+					...authToken ? { authToken } : {}
+				});
+				holder.card = card;
+				const agents = probeService(ctx, "agents", "create");
+				const presets = probeService(ctx, "agentPresets", "resolve");
+				const sessionPool = agents ? new ContextSessionPool(agents, {
+					cwd: inboundCwd,
+					...presets ? { agentPresets: presets } : {},
+					resolveAgentOptions: () => resolveDefaultModel(ctx)
+				}) : void 0;
+				const sessionExecutor = sessionPool ? createSessionExecutor(sessionPool) : refuseExecutor("no agent loop mounted");
+				const subagents = probeService(ctx, "subagents", "start");
+				const subagentExecutor = sessionPool !== void 0 && subagents !== void 0 ? createSubagentExecutor({
+					pool: sessionPool,
+					subagents,
+					provider: subagentProvider
+				}) : void 0;
+				const executors = new ExecutorSet(serverConfig.executors, sessionExecutor, subagentExecutor);
+				holder.executors = executors;
+				const skillIds = new Set(skills.map((s) => s.id));
+				const gate = async (input) => {
+					if (!skillIds.has(input.skill)) return {
+						ok: false,
+						reason: `unknown skill "${input.skill}"`
+					};
+					const decision = {
+						contextId: input.contextId,
+						skill: input.skill,
+						parts: input.parts,
+						remotePeerId: input.remotePeerId
+					};
+					const decided = await ctx.waterfall("a2a/inbound-task", decision, async (d) => d);
+					logger.info(`[a2a] inbound skill=${decided.skill} remote=${decided.remotePeerId} rejected=${decided.rejected?.reason ?? "no"}`);
+					if (decided.rejected !== void 0) return {
+						ok: false,
+						reason: decided.rejected.reason
+					};
+					return { ok: true };
+				};
+				const server = new A2AServer({
+					card,
+					store,
+					executors,
+					...authToken ? { authToken } : {},
+					gate,
+					onTaskSettled: (taskId) => logger.info(`[a2a] task settled ${taskId}`)
+				});
+				holder.server = server;
+				const routes = new A2aRoutes(webServer, server);
+				holder.routes = routes;
+				if (holder.enabled) routes.enable();
+			} catch (err) {
+				logger.error(`a2a: server half failed to build: ${err.message}`);
+			}
+			const toolsService = probeService(ctx, "tools", "get");
+			if (toolsService === void 0) logger.warn("a2a: tools service not mounted; outbound client idle");
+			else {
+				const registry = new OutboundAgentRegistry({
+					registrar: { register: (def) => toolsService.register(def) },
+					store: new DomainAgentStore(domain.agents),
+					toolPrefix,
+					tokenOf: (env) => env ? process.env[env] : void 0,
+					onError: (message) => logger.warn(message)
+				});
+				holder.registry = registry;
+				registry.loadAll();
+				if (clientConfig.agents.length > 0) await registry.seed(clientConfig.agents);
+			}
+			const impl = makeFacade(holder, logger.info.bind(logger));
+			new A2AService(ctx, impl);
+			const commands = probeService(ctx, "commands", "register");
+			if (commands !== void 0) ctx.effect(() => commands.register(buildA2aCommand(impl)), "a2a: command");
+			const dashboardWebServer = probeService(ctx, "webServer", "register");
+			if (dashboardWebServer !== void 0) ctx.effect(() => dashboardWebServer.register({
+				kind: "prefix",
+				path: "/a2a/api",
+				handler: (req, res) => handleApiRequest(req, res, impl)
+			}), "a2a: dashboard api");
+			else logger.warn("a2a: webServer not mounted; GUI dashboard API idle");
+			return async () => {
+				holder.routes?.dispose();
+				await holder.executors?.disposeAll();
+				await holder.registry?.disposeAll();
+				await domain.close();
+			};
+		}, "a2a: domain + halves");
+	});
+}
+/** Facade closure over the shared holder (commands and `ctx.a2a` consumers). */
+function makeFacade(holder, log) {
+	const serverEnabled = () => holder.routes?.active ?? false;
+	return {
+		status() {
+			return {
+				server: {
+					enabled: serverEnabled(),
+					cardUrl: holder.card?.supportedInterfaces?.[0]?.url,
+					skills: holder.card?.skills?.map((s) => s.id) ?? [],
+					executors: holder.executors ? ["session", ...holder.executors["subagent"] !== void 0 ? ["subagent"] : []] : []
+				},
+				tasks: holder.store.list().length,
+				agents: holder.registry?.list() ?? []
+			};
+		},
+		async enableServer(enable) {
+			if (holder.routes === void 0) return {
+				ok: false,
+				message: "inbound server is not mounted (no webServer)"
+			};
+			if (enable) holder.routes.enable();
+			else holder.routes.disable();
+			log(`[a2a] server ${enable ? "enabled" : "disabled"}`);
+			return {
+				ok: true,
+				message: `server ${enable ? "enabled" : "disabled"}`
+			};
+		},
+		getTask(taskId) {
+			return holder.store.get(taskId);
+		},
+		listTasks() {
+			return holder.store.list();
+		},
+		async cancelTask(taskId) {
+			if (holder.store.get(taskId) === void 0) return {
+				ok: false,
+				message: `task ${taskId} not found`
+			};
+			return {
+				ok: true,
+				message: holder.server?.abort?.(taskId) ?? false ? `task ${taskId} canceled` : `task ${taskId} already terminal`
+			};
+		},
+		agents() {
+			return holder.registry?.list() ?? [];
+		},
+		async addAgent(spec) {
+			const registry = holder.registry;
+			if (registry === void 0) return {
+				ok: false,
+				message: "outbound client not mounted (no tools service)"
+			};
+			return await registry.add({
+				...spec,
+				enabled: true,
+				timeoutMs: 6e4
+			});
+		},
+		async removeAgent(id) {
+			return holder.registry?.remove(id) ?? {
+				ok: false,
+				message: "outbound client not mounted"
+			};
+		},
+		async setAgentEnabled(id, enabled) {
+			return holder.registry?.setEnabled(id, enabled) ?? {
+				ok: false,
+				message: "outbound client not mounted"
+			};
+		},
+		async refreshAgentCard(id) {
+			return holder.registry?.refresh(id) ?? {
+				ok: false,
+				message: "outbound client not mounted"
+			};
+		}
+	};
+}
+/** A task that refuses readably on compositions without an agent loop. */
+function refuseExecutor(reason) {
+	return {
+		name: "refuse",
+		async execute() {
+			throw new Error(`a2a: ${reason}; refusing inbound task`);
+		}
+	};
+}
+function resolveDefaultModel(ctx) {
+	return probeService(ctx, "agentDefaultModel", "currentSelection")?.currentSelection();
+}
+/** Absolute stable cwd for inbound per-context sessions (never profile root). */
+function inboundSessionCwd() {
+	const home = join(homedir(), ".dsh");
+	const dir = join(process.env["DSH_HOME"] ?? home, "a2a-sessions");
+	try {
+		mkdirSync(dir, { recursive: true });
+	} catch {}
+	return dir;
+}
+//#endregion
+export { A2AClient, A2AError, A2AServer, A2AService, Config, apply, inject, name };