@hanphone/dsh-a2a 0.2.0 → 0.3.0

package/lib/types/index.d.ts

@@ -1,13 +1,18 @@
 /**
  * @hanphone/dsh-a2a — Cordis plugin entry.
  *
- * Mounts the A2A v1.0 dual-end plugin: the inbound server (AgentCard derived
- * from the live tool registry, JSON-RPC + SSE, durable SQLite task store,
- * session/subagent executors, the `a2a/inbound-task` policy gate + audit)
- * and the outbound client (persisted multi-agent registry, skills mapped to
- * model tools, sync calls with per-agent timeout). Optional services are
- * probed rather than injected so a composition lacking one half idles just
- * that half; only the storage domain is required.
+ * Mounts the A2A v1.0.1 dual-end plugin as a MULTI-INSTANCE composition: an
+ * arbitrary set of inbound A2A servers (each a preset-bound session pool, its
+ * own endpoint + AgentCard + creator-declared skills + auth) and an arbitrary
+ * set of outbound A2A connections (each a remote URL + preset + timeout).
+ * Instances are persisted in the `a2a` domain (`inbound_servers` /
+ * `outbound_servers` tables) and created/edited/started/stopped entirely from
+ * the GUI — the plugin `Config` is minimal and instance setup is not
+ * patch-config driven. The protocol surface is aligned with the official A2A
+ * v1.0.1 spec (see docs/design.md).
+ *
+ * Optional services are probed rather than injected so a composition lacking
+ * one half idles just that half; only the storage domain is required.
  *
  * Function-plugin export shape: named `name`/`inject`/`Config`/`apply`, no
  * default export (mixing forms makes the Loader drop the namespace).
@@ -15,39 +20,23 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
-import { type OutboundAgentSpec } from './outbound/registry.ts';
-import type { AgentSkill, TaskState } from './protocol.ts';
+import { type OpResult } from './service.ts';
 export declare const name = "a2a";
 /** Only the storage domain is required; the other halves are probed. */
 export declare const inject: readonly ["storageDomain"];
+/** Minimal host-level config; per-instance setup happens in the GUI/domain. */
 export interface A2AConfig {
-    server: {
-        enabled: boolean;
-        name: string;
-        description: string;
-        version: string;
-        /** Advertised base URL; null/absent lets the host webServer address be used. */
-        baseUrl?: string;
-        endpointPath: string;
-        /** Environment variable name for the inbound bearer token; absent = anonymous. */
-        authTokenEnv?: string;
-        skills: {
-            ids: string[];
-            exclude: string[];
-        };
-        executors: Record<string, 'session' | 'subagent'>;
-        subagentProvider: string;
-    };
-    client: {
-        agents: OutboundAgentSpec[];
-        toolPrefix: string;
-    };
+    /** Advertised base URL for every inbound card; absent lets a default stand. */
+    baseUrl?: string;
+    /** Subagent driver provider for the inbound subagent executors. */
+    subagentProvider: string;
+    /** Default outbound connection timeout (ms). */
+    defaultTimeoutMs: number;
 }
 /** Loader-validated config schema (defaults applied by the Loader). */
 export declare const Config: z<A2AConfig>;
 export declare function apply(ctx: Context, config: A2AConfig): void;
-export type { TaskState };
-export type { AgentSkill };
+export type { OpResult };
 export { A2AServer } from './server/a2a-server.ts';
 export { A2AClient, A2AError } from './outbound/calls.ts';
 export { A2AService } from './service.ts';

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAexC,OAAO,EAA2C,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAIxG,OAAO,KAAK,EAAa,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAErE,eAAO,MAAM,IAAI,QAAQ,CAAA;AAEzB,wEAAwE;AACxE,eAAO,MAAM,MAAM,4BAA6B,CAAA;AAEhD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE;QACN,OAAO,EAAE,OAAO,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,OAAO,EAAE,MAAM,CAAA;QACf,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,kFAAkF;QAClF,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,MAAM,EAAE;YAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,CAAA;SAAE,CAAA;QAC5C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;QACjD,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,MAAM,EAAE;QACN,MAAM,EAAE,iBAAiB,EAAE,CAAA;QAC3B,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAED,uEAAuE;AACvE,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,SAAS,CA0B9B,CAAA;AAiBF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,QAyKpD;AAyID,YAAY,EAAE,SAAS,EAAE,CAAA;AACzB,YAAY,EAAE,UAAU,EAAE,CAAA;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAQxC,OAAO,EAA8G,KAAK,QAAQ,EAAmC,MAAM,cAAc,CAAA;AAKzL,eAAO,MAAM,IAAI,QAAQ,CAAA;AAEzB,wEAAwE;AACxE,eAAO,MAAM,MAAM,4BAA6B,CAAA;AAEhD,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACxB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAA;IACxB,gDAAgD;IAChD,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,uEAAuE;AACvE,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,SAAS,CAI9B,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,QAoFpD;AAmKD,YAAY,EAAE,QAAQ,EAAE,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA"}

package/lib/types/index.js

@@ -1,13 +1,18 @@
 /**
  * @hanphone/dsh-a2a — Cordis plugin entry.
  *
- * Mounts the A2A v1.0 dual-end plugin: the inbound server (AgentCard derived
- * from the live tool registry, JSON-RPC + SSE, durable SQLite task store,
- * session/subagent executors, the `a2a/inbound-task` policy gate + audit)
- * and the outbound client (persisted multi-agent registry, skills mapped to
- * model tools, sync calls with per-agent timeout). Optional services are
- * probed rather than injected so a composition lacking one half idles just
- * that half; only the storage domain is required.
+ * Mounts the A2A v1.0.1 dual-end plugin as a MULTI-INSTANCE composition: an
+ * arbitrary set of inbound A2A servers (each a preset-bound session pool, its
+ * own endpoint + AgentCard + creator-declared skills + auth) and an arbitrary
+ * set of outbound A2A connections (each a remote URL + preset + timeout).
+ * Instances are persisted in the `a2a` domain (`inbound_servers` /
+ * `outbound_servers` tables) and created/edited/started/stopped entirely from
+ * the GUI — the plugin `Config` is minimal and instance setup is not
+ * patch-config driven. The protocol surface is aligned with the official A2A
+ * v1.0.1 spec (see docs/design.md).
+ *
+ * Optional services are probed rather than injected so a composition lacking
+ * one half idles just that half; only the storage domain is required.
  *
  * Function-plugin export shape: named `name`/`inject`/`Config`/`apply`, no
  * default export (mixing forms makes the Loader drop the namespace).
@@ -17,189 +22,72 @@ import z from '@deepseek-ai/schemastery';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { mkdirSync } from 'node:fs';
-import { deriveSkills, buildCard } from "./server/card.js";
 import { openDomain, DomainTaskStore } from "./server/store.js";
-import { LiveInboundRegistry } from "./server/inbound-registry.js";
-import { cardOptionsFor, readIdentity, rebuildCardWithIdentity, writeIdentity } from "./server/identity.js";
-import { ExecutorSet } from "./server/executor.js";
-import { ContextSessionPool, probeService } from "./server/exec/agent-runtime.js";
-import { createSessionExecutor } from "./server/exec/session.js";
-import { createSubagentExecutor } from "./server/exec/subagent.js";
-import { A2AServer } from "./server/a2a-server.js";
-import { A2aRoutes } from "./server/routes.js";
+import { probeService } from "./server/exec/agent-runtime.js";
 import { handleApiRequest } from "./api.js";
-import { OutboundAgentRegistry, DomainAgentStore } from "./outbound/registry.js";
 import { A2AService } from "./service.js";
 import { buildA2aCommand } from "./commands.js";
+import { InboundServerManager, DomainInboundStore } from "./servers/inbound-manager.js";
+import { OutboundServerManager, DomainOutboundStore } from "./servers/outbound-manager.js";
 export const name = 'a2a';
 /** Only the storage domain is required; the other halves are probed. */
 export const inject = ['storageDomain'];
 /** Loader-validated config schema (defaults applied by the Loader). */
 export const Config = z.object({
-    server: z.object({
-        enabled: z.boolean().default(true),
-        name: z.string().default('My DSH Agent'),
-        description: z.string().default('A DeepSeek Harness agent exposed over A2A v1.0'),
-        version: z.string().default('0.1.0'),
-        baseUrl: z.string(),
-        endpointPath: z.string().default('/a2a'),
-        authTokenEnv: z.string(),
-        skills: z.object({
-            ids: z.array(z.string()).default([]),
-            exclude: z.array(z.string()).default([]),
-        }),
-        executors: z.dict(z.union(['session', 'subagent'])).default({ chat: 'session' }),
-        subagentProvider: z.string().default('in-process'),
-    }),
-    client: z.object({
-        agents: z.array(z.object({
-            name: z.string(),
-            agentCardUrl: z.string(),
-            bearerTokenEnv: z.string(),
-            enabled: z.boolean().default(true),
-            timeoutMs: z.number().default(60000),
-        })).default([]),
-        toolPrefix: z.string().default('a2a'),
-    }),
+    baseUrl: z.string(),
+    subagentProvider: z.string().default('in-process'),
+    defaultTimeoutMs: z.number().default(60_000),
 });
 export function apply(ctx, config) {
     const logger = ctx.logger('a2a');
-    const serverConfig = { ...config.server };
-    const clientConfig = { ...config.client };
-    const authToken = serverConfig.authTokenEnv !== undefined ? process.env[serverConfig.authTokenEnv] : undefined;
-    const toolPrefix = clientConfig.toolPrefix;
-    const subagentProvider = serverConfig.subagentProvider;
+    const subagentProvider = config.subagentProvider;
     const inboundCwd = inboundSessionCwd();
     ctx.inject(['storageDomain'], (ctx) => {
         ctx.effect(async () => {
             const domain = await openDomain(ctx.storageDomain);
             const store = new DomainTaskStore(domain);
-            const holder = {
-                domain,
-                store,
-                registry: undefined,
-                inbound: undefined,
-                server: undefined,
-                routes: undefined,
-                card: undefined,
-                executors: undefined,
-                enabled: serverConfig.enabled,
-                identityDefaults: {
-                    name: serverConfig.name ?? 'My DSH Agent',
-                    description: serverConfig.description ?? 'A DeepSeek Harness agent exposed over A2A v1.0',
-                    version: serverConfig.version ?? '0.1.0',
-                },
-            };
-            // ── inbound server half ────────────────────────────────────────────
+            // Probe the optional host services each half uses.
             const webServer = probeService(ctx, 'webServer', 'register');
-            if (webServer === undefined) {
-                logger.warn('a2a: webServer not mounted; inbound server idle');
-            }
-            else {
-                try {
-                    const skills = deriveSkills(probeService(ctx, 'tools', 'get') ?? { get: () => undefined }, { ids: serverConfig.skills.ids, exclude: serverConfig.skills.exclude });
-                    const baseUrl = serverConfig.baseUrl ?? `http://127.0.0.1:${process.env['DSH_A2A_PORT'] ?? '3000'}`;
-                    const endpointPath = serverConfig.endpointPath ?? '/a2a';
-                    const persistedIdentity = readIdentity(domain);
-                    const card = buildCard(cardOptionsFor(baseUrl, endpointPath, holder.identityDefaults, persistedIdentity, skills, authToken));
-                    holder.card = card;
-                    // Inbound connection registry (dashboard "who is talking to us").
-                    const inbound = new LiveInboundRegistry();
-                    holder.inbound = inbound;
-                    // Executors: probe the agent loop; refuse tasks readably without it.
-                    const agents = probeService(ctx, 'agents', 'create');
-                    const presets = probeService(ctx, 'agentPresets', 'resolve');
-                    const sessionPool = agents
-                        ? new ContextSessionPool(agents, {
-                            cwd: inboundCwd,
-                            ...(presets ? { agentPresets: presets } : {}),
-                            resolveAgentOptions: () => resolveDefaultModel(ctx),
-                        })
-                        : undefined;
-                    const sessionExecutor = sessionPool ? createSessionExecutor(sessionPool) : refuseExecutor('no agent loop mounted');
-                    const subagents = probeService(ctx, 'subagents', 'start');
-                    const subagentExecutor = sessionPool !== undefined && subagents !== undefined
-                        ? createSubagentExecutor({ pool: sessionPool, subagents, provider: subagentProvider })
-                        : undefined;
-                    const executors = new ExecutorSet(serverConfig.executors, sessionExecutor, subagentExecutor);
-                    holder.executors = executors;
-                    const skillIds = new Set(skills.map((s) => s.id));
-                    const gate = async (input) => {
-                        if (!skillIds.has(input.skill)) {
-                            return { ok: false, reason: `unknown skill "${input.skill}"` };
-                        }
-                        const decision = {
-                            contextId: input.contextId,
-                            skill: input.skill,
-                            parts: input.parts,
-                            remotePeerId: input.remotePeerId,
-                        };
-                        const decided = await ctx.waterfall('a2a/inbound-task', decision, async (d) => d);
-                        // Built-in audit: every task decision is logged with its source.
-                        logger.info(`[a2a] inbound skill=${decided.skill} remote=${decided.remotePeerId} rejected=${decided.rejected?.reason ?? 'no'}`);
-                        if (decided.rejected !== undefined)
-                            return { ok: false, reason: decided.rejected.reason };
-                        return { ok: true };
-                    };
-                    const server = new A2AServer({
-                        card,
-                        store,
-                        executors,
-                        ...(authToken ? { authToken } : {}),
-                        gate,
-                        onInbound: (facts) => inbound.note({
-                            method: facts.method,
-                            ...(facts.source !== undefined ? { source: facts.source } : {}),
-                            taskIds: facts.taskIds,
-                            streaming: facts.streaming,
-                        }),
-                        onTaskSettled: (taskId) => {
-                            logger.info(`[a2a] task settled ${taskId}`);
-                            inbound.settle(taskId);
-                        },
-                    });
-                    holder.server = server;
-                    const routes = new A2aRoutes(webServer, server);
-                    holder.routes = routes;
-                    if (holder.enabled)
-                        routes.enable();
-                }
-                catch (err) {
-                    logger.error(`a2a: server half failed to build: ${err.message}`);
-                }
-            }
-            // ── outbound client half (after the inbound routes exist, so a
-            // loopback agent can fetch this server's own card) ──────────────────
-            const toolsService = probeService(ctx, 'tools', 'get');
-            if (toolsService === undefined) {
-                logger.warn('a2a: tools service not mounted; outbound client idle');
-            }
-            else {
-                const registry = new OutboundAgentRegistry({
-                    registrar: { register: (def) => toolsService.register(def) },
-                    store: new DomainAgentStore(domain.agents),
-                    toolPrefix,
-                    tokenOf: (env) => (env ? process.env[env] : undefined),
-                    onError: (message) => logger.warn(message),
-                });
-                holder.registry = registry;
-                registry.loadAll();
-                // Declared agents seed the registry: the persisted store stays the
-                // runtime state, so a disabled or removed agent is not reconnected.
-                if (clientConfig.agents.length > 0)
-                    await registry.seed(clientConfig.agents);
-            }
-            // ── service facade + commands ──────────────────────────────────────
-            const impl = makeFacade(holder, logger.info.bind(logger));
+            const tools = probeService(ctx, 'tools', 'register');
+            const agents = probeService(ctx, 'agents', 'create');
+            const agentPresets = probeService(ctx, 'agentPresets', 'list');
+            const subagents = probeService(ctx, 'subagents', 'start');
+            const commandsRef = probeService(ctx, 'commands', 'register');
+            const baseUrl = config.baseUrl ?? `http://127.0.0.1:${webServerPort(webServer) ?? process.env['DSH_A2A_PORT'] ?? '3000'}`;
+            // ── inbound manager ───────────────────────────────────────────────
+            const inboundHost = {
+                ctx,
+                webServer: webServer ?? { register: noopRegister },
+                tasks: store,
+                logger,
+                ...(agents !== undefined ? { agents } : {}),
+                ...(agentPresets !== undefined ? { agentPresets } : {}),
+                ...(subagents !== undefined ? { subagents } : {}),
+                resolveDefaultModel: () => resolveDefaultModel(ctx),
+                sessionCwd: inboundCwd,
+                defaultBaseUrl: baseUrl,
+                subagentProvider,
+                newId: () => crypto.randomUUID().slice(0, 8),
+            };
+            const inboundManager = new InboundServerManager(inboundHost, new DomainInboundStore(domain.inbound_servers));
+            inboundManager.boot();
+            // ── outbound manager ──────────────────────────────────────────────
+            const outboundHost = {
+                registrar: { register: (def) => tools?.register(def) },
+                tokenOf: (env) => (env ? process.env[env] : undefined),
+                onError: (message) => logger.warn(message),
+                defaultTimeoutMs: config.defaultTimeoutMs,
+            };
+            const outboundManager = new OutboundServerManager(outboundHost, domain.agents, new DomainOutboundStore(domain.outbound_servers), () => `out-${crypto.randomUUID().slice(0, 12)}`);
+            outboundManager.boot();
+            // ── service facade + commands + GUI API ───────────────────────────
+            const impl = makeFacade({ domain, store, inboundManager, outboundManager, agentPresets, logger: logger.info.bind(logger) });
             new A2AService(ctx, impl);
-            const commands = probeService(ctx, 'commands', 'register');
-            if (commands !== undefined) {
-                ctx.effect(() => commands.register(buildA2aCommand(impl)), 'a2a: command');
+            if (commandsRef !== undefined) {
+                ctx.effect(() => commandsRef.register(buildA2aCommand(impl)), 'a2a: command');
             }
-            // ── GUI dashboard API (loopback-only /a2a/api) ─────────────────────
-            const dashboardWebServer = probeService(ctx, 'webServer', 'register');
-            if (dashboardWebServer !== undefined) {
-                ctx.effect(() => dashboardWebServer.register({
+            if (webServer !== undefined) {
+                ctx.effect(() => webServer.register({
                     kind: 'prefix',
                     path: '/a2a/api',
                     handler: (req, res) => handleApiRequest(req, res, impl),
@@ -209,131 +97,133 @@ export function apply(ctx, config) {
                 logger.warn('a2a: webServer not mounted; GUI dashboard API idle');
             }
             return async () => {
-                holder.routes?.dispose();
-                await holder.executors?.disposeAll();
-                await holder.registry?.disposeAll();
+                inboundManager.disposeAll();
+                await outboundManager.disposeAll();
                 await domain.close();
             };
-        }, 'a2a: domain + halves');
+        }, 'a2a: multi-instance composition');
     });
 }
-/** Facade closure over the shared holder (commands and `ctx.a2a` consumers). */
-function makeFacade(holder, log) {
-    const serverEnabled = () => holder.routes?.active ?? false;
+/** Facade closure over the two managers (commands and `ctx.a2a` consumers). */
+function makeFacade(host) {
+    const inboundView = (id) => {
+        const live = host.inboundManager.get(id);
+        if (live === undefined)
+            return undefined;
+        const r = live.record;
+        return {
+            id: r.id,
+            name: r.name,
+            description: r.description,
+            version: r.version,
+            endpointPath: live.endpointPath,
+            ...(r.preset !== undefined ? { preset: r.preset } : {}),
+            ...(r.authTokenEnv !== undefined ? { authTokenEnv: r.authTokenEnv } : {}),
+            cardPath: live.cardPath,
+            ...(live.card.supportedInterfaces?.[0]?.url !== undefined ? { cardUrl: live.card.supportedInterfaces[0].url } : {}),
+            enabled: live.routes.active,
+            skills: r.skills.map((s) => ({ id: s.id, name: s.name, ...(s.description != null ? { description: s.description } : {}) })),
+        };
+    };
     return {
         status() {
             return {
-                server: {
-                    enabled: serverEnabled(),
-                    cardUrl: holder.card?.supportedInterfaces?.[0]?.url,
-                    skills: holder.card?.skills?.map((s) => s.id) ?? [],
-                    executors: holder.executors ? ['session', ...(holder.executors['subagent'] !== undefined ? ['subagent'] : [])] : [],
-                    name: holder.card?.name,
-                    description: holder.card?.description,
-                    version: holder.card?.version,
-                    // True when a persisted identity override exists (the dashboard has
-                    // been configured); guides the first-run onboarding.
-                    configured: readIdentity(holder.domain) !== undefined,
-                },
-                tasks: holder.store.list().length,
-                agents: holder.registry?.list() ?? [],
-                inbounds: holder.inbound?.list() ?? [],
+                inbounds: host.inboundManager.list().map((live) => inboundView(live.id)).filter((v) => v !== undefined),
+                outbounds: host.outboundManager.list(),
+                tasks: host.store.list().length,
             };
         },
-        async enableServer(enable) {
-            if (holder.routes === undefined)
-                return { ok: false, message: 'inbound server is not mounted (no webServer)' };
-            if (enable)
-                holder.routes.enable();
-            else
-                holder.routes.disable();
-            log(`[a2a] server ${enable ? 'enabled' : 'disabled'}`);
-            return { ok: true, message: `server ${enable ? 'enabled' : 'disabled'}` };
+        async presets() {
+            if (host.agentPresets === undefined)
+                return [];
+            try {
+                return (await host.agentPresets.list()).map((p) => ({
+                    id: p.id,
+                    ...(p.name !== undefined ? { name: p.name } : {}),
+                    ...(p.description !== undefined ? { description: p.description } : {}),
+                    ...(p.isDefault === true ? { isDefault: true } : {}),
+                }));
+            }
+            catch {
+                return [];
+            }
         },
-        getTask(taskId) {
-            return holder.store.get(taskId);
+        // ── inbound ─────────────────────────────────────────────────────────
+        listInboundServers() {
+            return host.inboundManager.list().map((live) => inboundView(live.id)).filter((v) => v !== undefined);
         },
-        listTasks() {
-            return holder.store.list();
+        async createInboundServer(input) {
+            const result = await host.inboundManager.add({
+                name: input.name,
+                description: input.description,
+                version: input.version,
+                ...(input.endpointPath !== undefined ? { endpointPath: input.endpointPath } : {}),
+                ...(input.preset !== undefined ? { preset: input.preset } : {}),
+                ...(input.authTokenEnv !== undefined ? { authTokenEnv: input.authTokenEnv } : {}),
+                ...(input.skills !== undefined ? { skills: input.skills } : {}),
+                ...(input.enabled !== undefined ? { enabled: input.enabled } : {}),
+            });
+            host.logger(`[a2a] inbound created: ${result.message}`);
+            return result;
         },
-        async cancelTask(taskId) {
-            const record = holder.store.get(taskId);
-            if (record === undefined)
-                return { ok: false, message: `task ${taskId} not found` };
-            const aborted = holder.server?.abort?.(taskId) ?? false;
-            return { ok: true, message: aborted ? `task ${taskId} canceled` : `task ${taskId} already terminal` };
+        async removeInboundServer(id) {
+            return host.inboundManager.remove(id);
         },
-        agents() {
-            return holder.registry?.list() ?? [];
+        async setInboundServerEnabled(id, enabled) {
+            return host.inboundManager.setEnabled(id, enabled);
         },
-        async addAgent(spec) {
-            const registry = holder.registry;
-            if (registry === undefined)
-                return { ok: false, message: 'outbound client not mounted (no tools service)' };
-            const result = await registry.add({ ...spec, enabled: true, timeoutMs: 60000 });
-            return result;
+        async updateInboundServer(id, patch) {
+            return host.inboundManager.update(id, patch);
         },
-        async removeAgent(id) {
-            return holder.registry?.remove(id) ?? { ok: false, message: 'outbound client not mounted' };
+        // ── outbound ────────────────────────────────────────────────────────
+        listOutboundServers() {
+            return [...host.outboundManager.list()];
         },
-        async setAgentEnabled(id, enabled) {
-            return holder.registry?.setEnabled(id, enabled) ?? { ok: false, message: 'outbound client not mounted' };
+        async createOutboundServer(input) {
+            return host.outboundManager.add({
+                ...(input.id !== undefined ? { id: input.id } : {}),
+                name: input.name,
+                agentCardUrl: input.agentCardUrl,
+                ...(input.bearerTokenEnv !== undefined ? { bearerTokenEnv: input.bearerTokenEnv } : {}),
+                ...(input.preset !== undefined ? { preset: input.preset } : {}),
+                enabled: input.enabled ?? true,
+                timeoutMs: input.timeoutMs ?? host.outboundManager.defaultTimeoutMs,
+            });
         },
-        async refreshAgentCard(id) {
-            return holder.registry?.refresh(id) ?? { ok: false, message: 'outbound client not mounted' };
+        async removeOutboundServer(id) {
+            return host.outboundManager.remove(id);
         },
-        identity() {
-            const current = holder.card;
-            const persisted = readIdentity(holder.domain);
-            return {
-                ...(persisted ?? {}),
-                // Composition defaults shown when nothing is persisted yet.
-                defaults: holder.identityDefaults,
-                name: current?.name ?? holder.identityDefaults.name,
-                description: current?.description ?? holder.identityDefaults.description,
-                version: current?.version ?? holder.identityDefaults.version,
-            };
+        async setOutboundServerEnabled(id, enabled) {
+            return host.outboundManager.setEnabled(id, enabled);
         },
-        async updateIdentity(patch) {
-            const card = holder.card;
-            const server = holder.server;
-            if (card === undefined || server === undefined)
-                return { ok: false, message: 'inbound server not mounted (no card)' };
-            const persisted = readIdentity(holder.domain);
-            const base = persisted ?? holder.identityDefaults;
-            const next = {
-                name: patch.name?.trim() || base.name,
-                description: patch.description?.trim() || base.description,
-                version: patch.version?.trim() || base.version,
-            };
-            writeIdentity(holder.domain, next);
-            const rebuilt = rebuildCardWithIdentity(card, next, card.skills ?? []);
-            server.setCard(rebuilt);
-            holder.card = rebuilt;
-            log(`[a2a] identity updated: ${next.name}`);
-            return { ok: true, message: `service identity updated (${next.name})` };
+        async refreshOutboundServer(id) {
+            return host.outboundManager.refresh(id);
         },
-        async closeInbound(peerId) {
-            const inbound = holder.inbound;
-            if (inbound === undefined)
-                return { ok: false, message: 'inbound registry not mounted' };
-            // Cancel the peer's active tasks, then drop the record.
-            for (const taskId of inbound.activeTasksOf(peerId)) {
-                await holder.server?.abort?.(taskId);
-            }
-            return inbound.closePeer(peerId);
+        // ── tasks ───────────────────────────────────────────────────────────
+        getTask(taskId) {
+            return host.store.get(taskId);
+        },
+        listTasks() {
+            return host.store.list();
         },
+        async cancelTask(taskId) {
+            const live = host.inboundManager.list().find((l) => l.server.abort(taskId));
+            return { ok: live !== undefined, message: live !== undefined ? `task ${taskId} canceled` : `task ${taskId} not found or already terminal` };
+        },
+        // ── inbound peers (aggregated across instances) ─────────────────────
         inbounds() {
-            return holder.inbound?.list() ?? [];
+            return host.inboundManager.list().flatMap((live) => live.inbound.list());
         },
-    };
-}
-/** A task that refuses readably on compositions without an agent loop. */
-function refuseExecutor(reason) {
-    return {
-        name: 'refuse',
-        async execute() {
-            throw new Error(`a2a: ${reason}; refusing inbound task`);
+        async closeInbound(peerId) {
+            for (const live of host.inboundManager.list()) {
+                const peers = live.inbound.activeTasksOf(peerId);
+                for (const taskId of peers)
+                    live.server.abort(taskId);
+                const result = live.inbound.closePeer(peerId);
+                if (result)
+                    return { ok: true, message: `inbound peer ${peerId} closed` };
+            }
+            return { ok: false, message: `inbound peer ${peerId} not found` };
         },
     };
 }
@@ -354,6 +244,17 @@ function inboundSessionCwd() {
     }
     return dir;
 }
+function noopRegister() {
+    return () => { };
+}
+/** The listening port of a mounted webServer (undefined when unavailable). */
+function webServerPort(webServer) {
+    const candidate = webServer;
+    if (candidate === undefined)
+        return undefined;
+    const value = typeof candidate.port === 'function' ? candidate.port() : candidate.port;
+    return typeof value === 'number' && Number.isFinite(value) ? String(value) : undefined;
+}
 export { A2AServer } from "./server/a2a-server.js";
 export { A2AClient, A2AError } from "./outbound/calls.js";
 export { A2AService } from "./service.js";