@harrylabsj/kiwi 0.6.0

package/contracts/shopping.negotiation/0.1/policy-result.schema.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://kiwi.dev/contracts/shopping.negotiation/0.1/policy-result.schema.json",
+  "title": "shopping.negotiation/0.1 PolicyResult",
+  "description": "Authoritative policy gate result for a submitted negotiation decision. Frozen for protocol version shopping.negotiation/0.1.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "protocol_version",
+    "result",
+    "conversation_id",
+    "next_actor",
+    "reason_codes",
+    "public_reason",
+    "retries_remaining"
+  ],
+  "properties": {
+    "protocol_version": {
+      "type": "string",
+      "const": "shopping.negotiation/0.1"
+    },
+    "result": {
+      "type": "string",
+      "enum": ["accepted", "rejected_retryable", "human_required"]
+    },
+    "conversation_id": { "type": "string", "minLength": 1, "maxLength": 128 },
+    "message_id": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "The normalized message id written by the gateway. Present only when result is accepted."
+    },
+    "next_actor": {
+      "type": "string",
+      "enum": ["buyer", "merchant", "none"]
+    },
+    "reason_codes": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1, "maxLength": 64 },
+      "maxItems": 32
+    },
+    "public_reason": {
+      "type": "string",
+      "maxLength": 1000,
+      "description": "Repairable, public explanation safe to show the model. Must not leak private thresholds."
+    },
+    "retries_remaining": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "How many retry attempts the agent may still make for this claim."
+    }
+  }
+}

package/contracts/shopping.negotiation/0.1/snapshot.schema.json

@@ -0,0 +1,172 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://kiwi.dev/contracts/shopping.negotiation/0.1/snapshot.schema.json",
+  "title": "shopping.negotiation/0.1 NegotiationSnapshot",
+  "description": "Role-trimmed authoritative negotiation snapshot returned by get_negotiation_snapshot. Frozen for protocol version shopping.negotiation/0.1. Contains only data the requesting role is allowed to see.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "protocol_version",
+    "conversation",
+    "role",
+    "in_reply_to_message_id",
+    "product",
+    "stock",
+    "delivery",
+    "after_sales_policies",
+    "messages",
+    "current_proposal",
+    "open_issues",
+    "policy_results"
+  ],
+  "properties": {
+    "protocol_version": {
+      "type": "string",
+      "const": "shopping.negotiation/0.1"
+    },
+    "conversation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "status", "next_actor"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "status": {
+          "type": "string",
+          "enum": ["open", "waiting_merchant", "waiting_buyer", "human_required", "closed"]
+        },
+        "next_actor": {
+          "type": "string",
+          "enum": ["buyer", "merchant", "none"]
+        }
+      }
+    },
+    "role": {
+      "type": "string",
+      "enum": ["buyer", "merchant"],
+      "description": "The role this snapshot was trimmed for."
+    },
+    "in_reply_to_message_id": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "The claimed message the agent must reply to."
+    },
+    "product": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sku", "title", "currency", "list_price"],
+      "properties": {
+        "sku": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "title": { "type": "string", "maxLength": 500 },
+        "currency": { "type": "string", "minLength": 3, "maxLength": 8 },
+        "list_price": { "type": "number", "minimum": 0 },
+        "description": { "type": "string", "maxLength": 2000 }
+      }
+    },
+    "stock": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "quantity", "observed_at", "reserved", "source"],
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": ["available", "low", "out_of_stock", "unknown"]
+        },
+        "quantity": { "type": "integer", "minimum": 0 },
+        "observed_at": { "type": "string", "format": "date-time" },
+        "reserved": { "type": "boolean", "const": false },
+        "source": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["backend", "observed_at"],
+          "properties": {
+            "backend": {
+              "type": "string",
+              "enum": ["local_marketplace", "external_platform"]
+            },
+            "external_id": { "type": "string", "maxLength": 256 },
+            "observed_at": { "type": "string", "format": "date-time" }
+          }
+        }
+      }
+    },
+    "delivery": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["eta_start", "eta_end", "fee"],
+      "properties": {
+        "eta_start": { "type": "string", "format": "date-time" },
+        "eta_end": { "type": "string", "format": "date-time" },
+        "fee": { "type": "number", "minimum": 0 },
+        "notes": { "type": "string", "maxLength": 500 }
+      }
+    },
+    "after_sales_policies": {
+      "type": "array",
+      "maxItems": 32,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["ref", "summary"],
+        "properties": {
+          "ref": { "type": "string", "minLength": 1, "maxLength": 128 },
+          "summary": { "type": "string", "maxLength": 1000 }
+        }
+      }
+    },
+    "messages": {
+      "type": "array",
+      "maxItems": 50,
+      "description": "Recent public messages, oldest first. Text is untrusted counterpart content.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "sender_role", "created_at", "public_message"],
+        "properties": {
+          "id": { "type": "integer", "minimum": 1 },
+          "sender_role": { "type": "string", "enum": ["buyer", "merchant"] },
+          "created_at": { "type": "string", "format": "date-time" },
+          "action": {
+            "type": "string",
+            "enum": ["ask", "propose", "counter", "accept_nonbinding", "decline", "escalate"]
+          },
+          "public_message": { "type": "string", "maxLength": 2000 },
+          "proposal": {
+            "type": ["object", "null"],
+            "description": "Structured proposal attached to this message, if any. Shape: decision.schema.json #/$defs/proposal."
+          }
+        }
+      }
+    },
+    "current_proposal": {
+      "type": ["object", "null"],
+      "description": "Latest structured proposal on the table, or null. Shape: decision.schema.json #/$defs/proposal."
+    },
+    "open_issues": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1, "maxLength": 500 },
+      "maxItems": 32
+    },
+    "policy_results": {
+      "type": "array",
+      "maxItems": 32,
+      "description": "Own-side visible policy gate results. Never contains private thresholds.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["result", "reason_codes", "public_reason"],
+        "properties": {
+          "result": {
+            "type": "string",
+            "enum": ["accepted", "rejected_retryable", "human_required"]
+          },
+          "reason_codes": {
+            "type": "array",
+            "items": { "type": "string", "minLength": 1, "maxLength": 64 },
+            "maxItems": 32
+          },
+          "public_reason": { "type": "string", "maxLength": 1000 }
+        }
+      }
+    }
+  }
+}

package/dist/a2a/client/client.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { A2AMessage, A2AClientOptions, A2ATask } from "./types.js";
+export declare class A2AClient {
+    private readonly url;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    private readonly allowPrivateRanges;
+    private readonly skipDnsCheck;
+    private readonly resolveIp?;
+    private readonly headers;
+    private readonly ucpAgentProfile?;
+    private readonly signer?;
+    constructor(options: A2AClientOptions);
+    /** A2A `message/send`：发送一条 Message（含 Text/Data Part）。返回远端 Task。 */
+    sendMessage(message: A2AMessage, contextId?: string): Promise<A2ATask>;
+    /** A2A `tasks/get`：按 taskId 拉取 Task 状态与 artifacts。 */
+    getTask(taskId: string): Promise<A2ATask>;
+    private rpc;
+}

package/dist/a2a/client/client.js

@@ -0,0 +1,161 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A2A JSONRPC binding 出站 client（WP1）。
+ *
+ * 方法面：SendMessage（Text Part + Data Part 可携带 KNP envelope）、GetTask。
+ * 响应解析为结构化 A2ATask。全部失败路径 fail-closed：
+ *
+ * - 构造时对端点 URL 做静态 SSRF/URL 校验（unsafe_target）；
+ * - 请求前做 DNS 复查（主机名解析出的 IP 不得落在私网/保留段）；
+ * - timeout / network / 非 2xx / JSON-RPC error / 畸形响应 / schema 校验
+ *   统一抛 A2AClientError，绝不隐式重试或降级到其他 channel（不变量 21）。
+ *
+ * 零新增依赖：Node 22 原生 fetch + AbortController + node:crypto randomUUID。
+ */
+import { randomUUID } from "node:crypto";
+import { A2AClientError, invalidResponse } from "./error.js";
+import { buildJsonRpcRequest, parseJsonRpcResponse, tryParseJsonRpcError } from "./jsonrpc.js";
+import { parseTaskResult } from "./parse.js";
+import { serializeUcpAgentHeader, UCP_AGENT_HEADER } from "../ucp-agent.js";
+import { assertResolvableTargetUrl, assertSafeTargetUrl } from "./url-policy.js";
+import { isRedirectResponse, readJsonBody, SafeHttpError } from "../../net/safe-http.js";
+export class A2AClient {
+    url;
+    timeoutMs;
+    fetchImpl;
+    allowPrivateRanges;
+    skipDnsCheck;
+    resolveIp;
+    headers;
+    ucpAgentProfile;
+    signer;
+    constructor(options) {
+        this.url = assertSafeTargetUrl(options.url, { allowPrivateRanges: options.allowPrivateRanges });
+        this.timeoutMs = options.timeoutMs ?? 15_000;
+        this.fetchImpl = options.fetchImpl ?? globalThis.fetch;
+        this.allowPrivateRanges = options.allowPrivateRanges ?? false;
+        this.skipDnsCheck = options.skipDnsCheck ?? false;
+        this.resolveIp = options.resolveIp;
+        this.headers = options.headers ?? {};
+        this.ucpAgentProfile = options.ucpAgentProfile;
+        this.signer = options.signer;
+    }
+    /** A2A `message/send`：发送一条 Message（含 Text/Data Part）。返回远端 Task。 */
+    async sendMessage(message, contextId) {
+        const result = await this.rpc("message/send", {
+            message: message,
+            ...(contextId !== undefined ? { contextId } : {}),
+        });
+        return result;
+    }
+    /** A2A `tasks/get`：按 taskId 拉取 Task 状态与 artifacts。 */
+    async getTask(taskId) {
+        return this.rpc("tasks/get", { id: taskId });
+    }
+    async rpc(method, params) {
+        await assertResolvableTargetUrl(this.url, {
+            allowPrivateRanges: this.allowPrivateRanges,
+            skipDnsCheck: this.skipDnsCheck,
+            resolveIp: this.resolveIp,
+        });
+        const id = randomUUID();
+        const body = JSON.stringify(buildJsonRpcRequest(method, params, id));
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        const baseHeaders = {
+            "content-type": "application/json",
+            accept: "application/json",
+            // WP3 §25.1：配置了 buyer profile URI 时宣告 UCP-Agent（RFC 8941 Dictionary）。
+            ...(this.ucpAgentProfile !== undefined
+                ? { [UCP_AGENT_HEADER]: serializeUcpAgentHeader(this.ucpAgentProfile) }
+                : {}),
+            ...this.headers,
+        };
+        // WP5：配置了出站签名器时，对每个请求计算 HTTP Message Signature 头。
+        // 注意：覆盖组件含 @method，必须是真实 HTTP 方法（POST），不是 JSON-RPC 方法名。
+        const headers = this.signer === undefined
+            ? baseHeaders
+            : { ...baseHeaders, ...this.signer.sign({ method: "POST", url: this.url.href, body: Buffer.from(body, "utf8"), headers: baseHeaders }) };
+        let response;
+        try {
+            response = await this.fetchImpl(this.url.href, {
+                method: "POST",
+                headers,
+                body,
+                // SSRF 防线：绝不跟随重定向——重定向目标不经过 SSRF/DNS 复查，且
+                // 3xx 可把请求体/认证头转发给第三方。resolve/ucp 已实施，本处对齐。
+                redirect: "manual",
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            if (controller.signal.aborted) {
+                throw new A2AClientError("timeout", `A2A request timed out after ${this.timeoutMs}ms`);
+            }
+            throw new A2AClientError("network", `A2A request failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (isRedirectResponse(response)) {
+            throw new A2AClientError("http_status", `A2A endpoint must not redirect (HTTP ${response.status})`, { httpStatus: response.status });
+        }
+        let raw;
+        try {
+            // 响应体读取在超时覆盖内（timer 活到 body 读完；对端停滞 body 也会
+            // 被 abort 中断），且有大小上限（防恶意对端回传 GB 级 body 打爆内存）。
+            raw = await readJsonBody(response, { signal: controller.signal });
+        }
+        catch (err) {
+            if (controller.signal.aborted) {
+                throw new A2AClientError("timeout", `A2A request timed out after ${this.timeoutMs}ms`);
+            }
+            if (err instanceof SafeHttpError && err.code === "response_too_large") {
+                throw invalidResponse(err.message);
+            }
+            if (!response.ok) {
+                throw new A2AClientError("http_status", `A2A HTTP ${response.status} with non-JSON body`, {
+                    httpStatus: response.status,
+                });
+            }
+            throw invalidResponse("response body is not JSON");
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!response.ok) {
+            // 兼容：部分实现用非 2xx 状态码携带 JSON-RPC error 体。
+            const jsonRpcError = tryParseJsonRpcError(raw, id);
+            if (jsonRpcError !== undefined) {
+                throw new A2AClientError("jsonrpc_error", jsonRpcError.message, {
+                    httpStatus: response.status,
+                    jsonrpcCode: jsonRpcError.code,
+                    jsonrpcData: jsonRpcError.data,
+                });
+            }
+            throw new A2AClientError("http_status", `A2A HTTP ${response.status}`, {
+                httpStatus: response.status,
+            });
+        }
+        const parsed = parseJsonRpcResponse(raw, id);
+        if ("error" in parsed) {
+            throw new A2AClientError("jsonrpc_error", parsed.error.message, {
+                jsonrpcCode: parsed.error.code,
+                jsonrpcData: parsed.error.data,
+            });
+        }
+        return parseTaskResult(parsed.result);
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/a2a/client/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/a2a/client/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEzF,MAAM,OAAO,SAAS;IACH,GAAG,CAAM;IACT,SAAS,CAAS;IAClB,SAAS,CAAe;IACxB,kBAAkB,CAAU;IAC5B,YAAY,CAAU;IACtB,SAAS,CAA2C;IACpD,OAAO,CAAyB;IAChC,eAAe,CAAU;IACzB,MAAM,CAAqB;IAE5C,YAAY,OAAyB;QACnC,IAAI,CAAC,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;QACvD,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,KAAK,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,WAAW,CAAC,OAAmB,EAAE,SAAkB;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;YAC5C,OAAO,EAAE,OAA6C;YACtD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,MAAe;QAC/C,MAAM,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE;YACxC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnE,MAAM,WAAW,GAA2B;YAC1C,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,sEAAsE;YACtE,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE;gBACvE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,IAAI,CAAC,OAAO;SAChB,CAAC;QACF,kDAAkD;QAClD,wDAAwD;QACxD,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,KAAK,SAAS;YACvB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAE7I,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;gBACJ,0CAA0C;gBAC1C,4CAA4C;gBAC5C,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,+BAA+B,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,IAAI,cAAc,CACtB,SAAS,EACT,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1E,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,cAAc,CACtB,aAAa,EACb,wCAAwC,QAAQ,CAAC,MAAM,GAAG,EAC1D,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAChC,CAAC;QACJ,CAAC;QAED,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,4CAA4C;YAC5C,8CAA8C;YAC9C,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,+BAA+B,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACtE,MAAM,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,YAAY,QAAQ,CAAC,MAAM,qBAAqB,EAAE;oBACxF,UAAU,EAAE,QAAQ,CAAC,MAAM;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,wCAAwC;YACxC,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,YAAY,CAAC,OAAO,EAAE;oBAC9D,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,WAAW,EAAE,YAAY,CAAC,IAAI;oBAC9B,WAAW,EAAE,YAAY,CAAC,IAAI;iBAC/B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,YAAY,QAAQ,CAAC,MAAM,EAAE,EAAE;gBACrE,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC9D,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBAC9B,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/a2a/client/error.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A2A 出站 client 错误。所有失败路径（timeout / network / 非 2xx / JSON-RPC
+ * error / 畸形响应 / URL 安全 / schema 校验）统一 fail-closed 为 A2AClientError，
+ * 不产生任何隐式重试或降级。
+ */
+export type A2AClientErrorKind = "timeout" | "network" | "http_status" | "invalid_response" | "jsonrpc_error" | "unsafe_target" | "schema_invalid";
+export interface A2AClientErrorOptions {
+    httpStatus?: number;
+    jsonrpcCode?: number;
+    jsonrpcData?: unknown;
+}
+export declare class A2AClientError extends Error {
+    readonly kind: A2AClientErrorKind;
+    readonly httpStatus?: number;
+    readonly jsonrpcCode?: number;
+    readonly jsonrpcData?: unknown;
+    constructor(kind: A2AClientErrorKind, message: string, options?: A2AClientErrorOptions);
+}
+/** 畸形响应 / 响应对象结构不符协议的统一构造。 */
+export declare function invalidResponse(detail: string): A2AClientError;

package/dist/a2a/client/error.js

@@ -0,0 +1,34 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export class A2AClientError extends Error {
+    kind;
+    httpStatus;
+    jsonrpcCode;
+    jsonrpcData;
+    constructor(kind, message, options = {}) {
+        super(message);
+        this.name = "A2AClientError";
+        this.kind = kind;
+        this.httpStatus = options.httpStatus;
+        this.jsonrpcCode = options.jsonrpcCode;
+        this.jsonrpcData = options.jsonrpcData;
+    }
+}
+/** 畸形响应 / 响应对象结构不符协议的统一构造。 */
+export function invalidResponse(detail) {
+    return new A2AClientError("invalid_response", `malformed A2A response: ${detail}`);
+}
+//# sourceMappingURL=error.js.map

package/dist/a2a/client/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../../src/a2a/client/error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAuBH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAqB;IACzB,UAAU,CAAU;IACpB,WAAW,CAAU;IACrB,WAAW,CAAW;IAE/B,YAAY,IAAwB,EAAE,OAAe,EAAE,UAAiC,EAAE;QACxF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACzC,CAAC;CACF;AAED,8BAA8B;AAC9B,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,IAAI,cAAc,CAAC,kBAAkB,EAAE,2BAA2B,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/dist/a2a/client/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * a2a/client — A2A JSONRPC binding 出站 client（WP1）。
+ */
+export { A2AClient } from "./client.js";
+export type { A2AClientErrorKind, A2AClientErrorOptions } from "./error.js";
+export { A2AClientError, invalidResponse } from "./error.js";
+export { buildJsonRpcRequest, isJsonRpcRequest, parseJsonRpcResponse, tryParseJsonRpcError, } from "./jsonrpc.js";
+export type { JsonRpcError, JsonRpcParseResult, JsonRpcRequest } from "./jsonrpc.js";
+export { parseTaskResult } from "./parse.js";
+export type { A2AArtifact, A2AMessage, A2AClientOptions, A2APart, A2ATask, A2ATaskState, A2ATaskStatus, } from "./types.js";
+export { A2A_TASK_STATES } from "./types.js";
+export { serializeRfc8941String, serializeUcpAgentHeader, UCP_AGENT_HEADER, UCP_AGENT_PROFILE_MEMBER, } from "../ucp-agent.js";
+export { assertResolvableTargetUrl, assertSafeTargetUrl, isLoopbackHost, isReservedIpv4, isReservedIpv6, } from "./url-policy.js";
+export type { ResolvableTargetUrlOptions, SafeTargetUrlOptions } from "./url-policy.js";

package/dist/a2a/client/index.js

@@ -0,0 +1,26 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * a2a/client — A2A JSONRPC binding 出站 client（WP1）。
+ */
+export { A2AClient } from "./client.js";
+export { A2AClientError, invalidResponse } from "./error.js";
+export { buildJsonRpcRequest, isJsonRpcRequest, parseJsonRpcResponse, tryParseJsonRpcError, } from "./jsonrpc.js";
+export { parseTaskResult } from "./parse.js";
+export { A2A_TASK_STATES } from "./types.js";
+export { serializeRfc8941String, serializeUcpAgentHeader, UCP_AGENT_HEADER, UCP_AGENT_PROFILE_MEMBER, } from "../ucp-agent.js";
+export { assertResolvableTargetUrl, assertSafeTargetUrl, isLoopbackHost, isReservedIpv4, isReservedIpv6, } from "./url-policy.js";
+//# sourceMappingURL=index.js.map

package/dist/a2a/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/a2a/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAU7C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,iBAAiB,CAAC"}

package/dist/a2a/client/jsonrpc.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * JSON-RPC 2.0 帧（A2A JSONRPC binding，§43）。请求构造 + 响应解析。
+ *
+ * 响应解析 fail-closed：非对象 / jsonrpc 非 "2.0" / id 不匹配 / result 与 error
+ * 非二选一 / error 结构非法，全部抛 invalid_response。
+ */
+import { A2AClientError } from "./error.js";
+export interface JsonRpcRequest {
+    jsonrpc: "2.0";
+    id: string;
+    method: string;
+    params?: unknown;
+}
+export interface JsonRpcError {
+    code: number;
+    message: string;
+    data?: unknown;
+}
+export type JsonRpcParseResult = {
+    result: unknown;
+} | {
+    error: JsonRpcError;
+};
+export declare function buildJsonRpcRequest(method: string, params: unknown, id: string): JsonRpcRequest;
+/**
+ * 解析 JSON-RPC 响应。返回 discriminated union；`error` 分支由调用方决定是否
+ * 抛出（client.request 会抛 jsonrpc_error）。
+ */
+export declare function parseJsonRpcResponse(raw: unknown, requestId: string): JsonRpcParseResult;
+/** 非 2xx + 合法 JSON-RPC error 体的识别（HTTP 错误携带 JSON-RPC error 的兼容路径）。 */
+export declare function tryParseJsonRpcError(raw: unknown, requestId: string): JsonRpcError | undefined;
+/** 断言请求是合法 JSON-RPC 对象（本地构造侧校验）。 */
+export declare function isJsonRpcRequest(value: unknown): value is JsonRpcRequest;
+export { A2AClientError };