@keycardai/a2a 0.1.0

package/dist/cjs/index.d.ts

@@ -0,0 +1,14 @@
+export { KeycardUser, keycardUserBuilder, getKeycardAuth } from "./auth.js";
+export type { KeycardUserBuilderOptions } from "./auth.js";
+export { createKeycardRequestHandler, buildAgentCard } from "./server.js";
+export type { AgentExecutor, RequestContext, ExecutionEventBus } from "./server.js";
+export { InMemoryTaskStore } from "./server.js";
+export type { AgentServiceConfig } from "./config.js";
+export { getAgentCardUrl, getJsonrpcUrl, getAuthServerUrl } from "./config.js";
+export { ServiceDiscovery } from "./discovery.js";
+export { DelegationClient } from "./delegation.js";
+export type { DelegationResult, InvokeOptions } from "./delegation.js";
+export { agentCardHandler, jsonRpcHandler, restHandler, UserBuilder, } from "@a2a-js/sdk/server/express";
+export type { AgentCard, Message, Task } from "@a2a-js/sdk";
+export { DefaultRequestHandler } from "@a2a-js/sdk/server";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC5E,YAAY,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAG3D,OAAO,EAAE,2BAA2B,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIvE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,WAAW,GACZ,MAAM,4BAA4B,CAAC;AAGpC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultRequestHandler = exports.UserBuilder = exports.restHandler = exports.jsonRpcHandler = exports.agentCardHandler = exports.DelegationClient = exports.ServiceDiscovery = exports.getAuthServerUrl = exports.getJsonrpcUrl = exports.getAgentCardUrl = exports.InMemoryTaskStore = exports.buildAgentCard = exports.createKeycardRequestHandler = exports.getKeycardAuth = exports.keycardUserBuilder = exports.KeycardUser = void 0;
+// Keycard auth adapter for @a2a-js/sdk
+var auth_js_1 = require("./auth.js");
+Object.defineProperty(exports, "KeycardUser", { enumerable: true, get: function () { return auth_js_1.KeycardUser; } });
+Object.defineProperty(exports, "keycardUserBuilder", { enumerable: true, get: function () { return auth_js_1.keycardUserBuilder; } });
+Object.defineProperty(exports, "getKeycardAuth", { enumerable: true, get: function () { return auth_js_1.getKeycardAuth; } });
+// Server convenience helpers (thin wrappers over @a2a-js/sdk)
+var server_js_1 = require("./server.js");
+Object.defineProperty(exports, "createKeycardRequestHandler", { enumerable: true, get: function () { return server_js_1.createKeycardRequestHandler; } });
+Object.defineProperty(exports, "buildAgentCard", { enumerable: true, get: function () { return server_js_1.buildAgentCard; } });
+var server_js_2 = require("./server.js");
+Object.defineProperty(exports, "InMemoryTaskStore", { enumerable: true, get: function () { return server_js_2.InMemoryTaskStore; } });
+var config_js_1 = require("./config.js");
+Object.defineProperty(exports, "getAgentCardUrl", { enumerable: true, get: function () { return config_js_1.getAgentCardUrl; } });
+Object.defineProperty(exports, "getJsonrpcUrl", { enumerable: true, get: function () { return config_js_1.getJsonrpcUrl; } });
+Object.defineProperty(exports, "getAuthServerUrl", { enumerable: true, get: function () { return config_js_1.getAuthServerUrl; } });
+// Discovery
+var discovery_js_1 = require("./discovery.js");
+Object.defineProperty(exports, "ServiceDiscovery", { enumerable: true, get: function () { return discovery_js_1.ServiceDiscovery; } });
+// Delegation client
+var delegation_js_1 = require("./delegation.js");
+Object.defineProperty(exports, "DelegationClient", { enumerable: true, get: function () { return delegation_js_1.DelegationClient; } });
+// Re-export the SDK's Express handlers and UserBuilder so customers
+// import from one place.
+var express_1 = require("@a2a-js/sdk/server/express");
+Object.defineProperty(exports, "agentCardHandler", { enumerable: true, get: function () { return express_1.agentCardHandler; } });
+Object.defineProperty(exports, "jsonRpcHandler", { enumerable: true, get: function () { return express_1.jsonRpcHandler; } });
+Object.defineProperty(exports, "restHandler", { enumerable: true, get: function () { return express_1.restHandler; } });
+Object.defineProperty(exports, "UserBuilder", { enumerable: true, get: function () { return express_1.UserBuilder; } });
+var server_1 = require("@a2a-js/sdk/server");
+Object.defineProperty(exports, "DefaultRequestHandler", { enumerable: true, get: function () { return server_1.DefaultRequestHandler; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,uCAAuC;AACvC,qCAA4E;AAAnE,sGAAA,WAAW,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,yGAAA,cAAc,OAAA;AAGxD,8DAA8D;AAC9D,yCAA0E;AAAjE,wHAAA,2BAA2B,OAAA;AAAE,2GAAA,cAAc,OAAA;AAEpD,yCAAgD;AAAvC,8GAAA,iBAAiB,OAAA;AAI1B,yCAA+E;AAAtE,4GAAA,eAAe,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAEzD,YAAY;AACZ,+CAAkD;AAAzC,gHAAA,gBAAgB,OAAA;AAEzB,oBAAoB;AACpB,iDAAmD;AAA1C,iHAAA,gBAAgB,OAAA;AAGzB,oEAAoE;AACpE,yBAAyB;AACzB,sDAKoC;AAJlC,2GAAA,gBAAgB,OAAA;AAChB,yGAAA,cAAc,OAAA;AACd,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AAKb,6CAA2D;AAAlD,+GAAA,qBAAqB,OAAA"}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type": "commonjs"}

package/dist/cjs/server.d.ts

@@ -0,0 +1,32 @@
+import { DefaultRequestHandler, type AgentExecutor, type TaskStore } from "@a2a-js/sdk/server";
+import type { AgentCard } from "@a2a-js/sdk";
+import type { AgentServiceConfig } from "./config.js";
+export type { AgentExecutor, RequestContext, ExecutionEventBus } from "@a2a-js/sdk/server";
+export { InMemoryTaskStore } from "@a2a-js/sdk/server";
+/**
+ * Creates a `DefaultRequestHandler` from `@a2a-js/sdk` pre-wired with a
+ * `KeycardUser`-aware agent card and the provided executor.
+ *
+ * Pass the returned handler to the SDK's Express adapters alongside a
+ * `keycardUserBuilder` for auth:
+ *
+ * ```ts
+ * const requestHandler = createKeycardRequestHandler(executor, config, agentCard);
+ * const userBuilder = keycardUserBuilder({ issuer: "https://zone.keycard.cloud" });
+ *
+ * app.get("/.well-known/agent-card.json", agentCardHandler({ agentCardProvider: requestHandler }));
+ * app.post("/a2a/jsonrpc", jsonRpcHandler({ requestHandler, userBuilder }));
+ * ```
+ *
+ * Python equivalent: the composition of `create_agent_card_server`,
+ * `serve_agent`, and the `KeycardServerCallContextBuilder` from `keycardai-a2a`.
+ */
+export declare function createKeycardRequestHandler(executor: AgentExecutor, agentCard: AgentCard, options?: {
+    taskStore?: TaskStore;
+}): DefaultRequestHandler;
+/**
+ * Build an `AgentCard` from an `AgentServiceConfig` for use with
+ * `createKeycardRequestHandler`.
+ */
+export declare function buildAgentCard(config: AgentServiceConfig): AgentCard;
+//# sourceMappingURL=server.d.ts.map

package/dist/cjs/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EAErB,KAAK,aAAa,EAClB,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,aAAa,EACvB,SAAS,EAAE,SAAS,EACpB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAClC,qBAAqB,CAMvB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,CAiBpE"}

package/dist/cjs/server.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryTaskStore = void 0;
+exports.createKeycardRequestHandler = createKeycardRequestHandler;
+exports.buildAgentCard = buildAgentCard;
+const server_1 = require("@a2a-js/sdk/server");
+const config_js_1 = require("./config.js");
+var server_2 = require("@a2a-js/sdk/server");
+Object.defineProperty(exports, "InMemoryTaskStore", { enumerable: true, get: function () { return server_2.InMemoryTaskStore; } });
+/**
+ * Creates a `DefaultRequestHandler` from `@a2a-js/sdk` pre-wired with a
+ * `KeycardUser`-aware agent card and the provided executor.
+ *
+ * Pass the returned handler to the SDK's Express adapters alongside a
+ * `keycardUserBuilder` for auth:
+ *
+ * ```ts
+ * const requestHandler = createKeycardRequestHandler(executor, config, agentCard);
+ * const userBuilder = keycardUserBuilder({ issuer: "https://zone.keycard.cloud" });
+ *
+ * app.get("/.well-known/agent-card.json", agentCardHandler({ agentCardProvider: requestHandler }));
+ * app.post("/a2a/jsonrpc", jsonRpcHandler({ requestHandler, userBuilder }));
+ * ```
+ *
+ * Python equivalent: the composition of `create_agent_card_server`,
+ * `serve_agent`, and the `KeycardServerCallContextBuilder` from `keycardai-a2a`.
+ */
+function createKeycardRequestHandler(executor, agentCard, options) {
+    return new server_1.DefaultRequestHandler(agentCard, options?.taskStore ?? new server_1.InMemoryTaskStore(), executor);
+}
+/**
+ * Build an `AgentCard` from an `AgentServiceConfig` for use with
+ * `createKeycardRequestHandler`.
+ */
+function buildAgentCard(config) {
+    return {
+        name: config.serviceName,
+        description: config.description ?? "",
+        url: (0, config_js_1.getJsonrpcUrl)(config),
+        version: "0.1",
+        protocolVersion: "0.3",
+        capabilities: {},
+        defaultInputModes: ["text/plain"],
+        defaultOutputModes: ["text/plain"],
+        skills: config.skills?.map((s) => ({
+            id: s.id,
+            name: s.name,
+            description: s.description,
+            tags: s.tags ?? [],
+        })) ?? [],
+    };
+}
+//# sourceMappingURL=server.js.map

package/dist/cjs/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":";;;AA+BA,kEAUC;AAMD,wCAiBC;AAhED,+CAK4B;AAG5B,2CAA4C;AAG5C,6CAAuD;AAA9C,2GAAA,iBAAiB,OAAA;AAE1B;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,2BAA2B,CACzC,QAAuB,EACvB,SAAoB,EACpB,OAAmC;IAEnC,OAAO,IAAI,8BAAqB,CAC9B,SAAS,EACT,OAAO,EAAE,SAAS,IAAI,IAAI,0BAAiB,EAAE,EAC7C,QAAQ,CACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAA0B;IACvD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,WAAW;QACxB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;QACrC,GAAG,EAAE,IAAA,yBAAa,EAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,KAAK;QACtB,YAAY,EAAE,EAAE;QAChB,iBAAiB,EAAE,CAAC,YAAY,CAAC;QACjC,kBAAkB,EAAE,CAAC,YAAY,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;SACnB,CAAC,CAAC,IAAI,EAAE;KACV,CAAC;AACJ,CAAC"}

package/dist/cjs/types.d.ts

@@ -0,0 +1,84 @@
+/**
+ * A2A (Agent-to-Agent) protocol types.
+ * Reference: https://google.github.io/A2A
+ */
+export interface AgentSkill {
+    id: string;
+    name: string;
+    description?: string;
+    tags?: readonly string[];
+}
+export interface AgentCapabilities {
+    streaming?: boolean;
+    pushNotifications?: boolean;
+    stateTransitionHistory?: boolean;
+}
+/**
+ * Agent card served at `GET /.well-known/agent-card.json`.
+ * Describes the agent's identity, capabilities, and endpoint.
+ */
+export interface AgentCard {
+    name: string;
+    description?: string;
+    url: string;
+    version: string;
+    capabilities?: AgentCapabilities;
+    skills?: AgentSkill[];
+    defaultInputModes?: readonly string[];
+    defaultOutputModes?: readonly string[];
+}
+export interface TextPart {
+    type: "text";
+    text: string;
+}
+export interface DataPart {
+    type: "data";
+    data: Record<string, unknown>;
+}
+export type Part = TextPart | DataPart;
+export type MessageRole = "user" | "agent";
+export interface A2AMessage {
+    messageId: string;
+    role: MessageRole;
+    parts: readonly Part[];
+    metadata?: Record<string, unknown>;
+}
+export interface A2ARequest {
+    jsonrpc: "2.0";
+    id: string;
+    method: "message/send";
+    params: {
+        message: A2AMessage;
+    };
+}
+export interface A2ASuccessResponse {
+    jsonrpc: "2.0";
+    id: string;
+    result: {
+        message: A2AMessage;
+    };
+}
+export interface A2AErrorResponse {
+    jsonrpc: "2.0";
+    id: string;
+    error: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+export type A2AResponse = A2ASuccessResponse | A2AErrorResponse;
+export declare const A2A_JSONRPC_VERSION: "2.0";
+export declare const A2A_PROTOCOL_VERSION: "1.0";
+export declare const A2A_VERSION_HEADER: "x-a2a-protocol-version";
+export declare const A2A_JSONRPC_PATH: "/a2a/jsonrpc";
+export declare const A2A_AGENT_CARD_PATH: "/.well-known/agent-card.json";
+export declare const A2A_ERROR_CODES: {
+    readonly PARSE_ERROR: -32700;
+    readonly INVALID_REQUEST: -32600;
+    readonly METHOD_NOT_FOUND: -32601;
+    readonly INVALID_PARAMS: -32602;
+    readonly INTERNAL_ERROR: -32603;
+    readonly UNAUTHORIZED: -32001;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/cjs/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAMD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEvC,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3C,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAMD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE;QACN,OAAO,EAAE,UAAU,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE;QACN,OAAO,EAAE,UAAU,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,MAAM,MAAM,WAAW,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;AAEhE,eAAO,MAAM,mBAAmB,EAAG,KAAc,CAAC;AAClD,eAAO,MAAM,oBAAoB,EAAG,KAAc,CAAC;AACnD,eAAO,MAAM,kBAAkB,EAAG,wBAAiC,CAAC;AACpE,eAAO,MAAM,gBAAgB,EAAG,cAAuB,CAAC;AACxD,eAAO,MAAM,mBAAmB,EAAG,8BAAuC,CAAC;AAE3E,eAAO,MAAM,eAAe;;;;;;;CAOlB,CAAC"}

package/dist/cjs/types.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * A2A (Agent-to-Agent) protocol types.
+ * Reference: https://google.github.io/A2A
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.A2A_ERROR_CODES = exports.A2A_AGENT_CARD_PATH = exports.A2A_JSONRPC_PATH = exports.A2A_VERSION_HEADER = exports.A2A_PROTOCOL_VERSION = exports.A2A_JSONRPC_VERSION = void 0;
+exports.A2A_JSONRPC_VERSION = "2.0";
+exports.A2A_PROTOCOL_VERSION = "1.0";
+exports.A2A_VERSION_HEADER = "x-a2a-protocol-version";
+exports.A2A_JSONRPC_PATH = "/a2a/jsonrpc";
+exports.A2A_AGENT_CARD_PATH = "/.well-known/agent-card.json";
+exports.A2A_ERROR_CODES = {
+    PARSE_ERROR: -32700,
+    INVALID_REQUEST: -32600,
+    METHOD_NOT_FOUND: -32601,
+    INVALID_PARAMS: -32602,
+    INTERNAL_ERROR: -32603,
+    UNAUTHORIZED: -32001,
+};
+//# sourceMappingURL=types.js.map

package/dist/cjs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAwFU,QAAA,mBAAmB,GAAG,KAAc,CAAC;AACrC,QAAA,oBAAoB,GAAG,KAAc,CAAC;AACtC,QAAA,kBAAkB,GAAG,wBAAiC,CAAC;AACvD,QAAA,gBAAgB,GAAG,cAAuB,CAAC;AAC3C,QAAA,mBAAmB,GAAG,8BAAuC,CAAC;AAE9D,QAAA,eAAe,GAAG;IAC7B,WAAW,EAAE,CAAC,KAAK;IACnB,eAAe,EAAE,CAAC,KAAK;IACvB,gBAAgB,EAAE,CAAC,KAAK;IACxB,cAAc,EAAE,CAAC,KAAK;IACtB,cAAc,EAAE,CAAC,KAAK;IACtB,YAAY,EAAE,CAAC,KAAK;CACZ,CAAC"}

package/dist/esm/auth.d.ts

@@ -0,0 +1,48 @@
+import type { User } from "@a2a-js/sdk/server";
+import type { UserBuilder } from "@a2a-js/sdk/server/express";
+import type { TokenVerifierOptions } from "@keycardai/oauth/server/tokenVerifier";
+import type { AccessToken } from "@keycardai/oauth/server/accessToken";
+import type { RequestContext } from "@a2a-js/sdk/server";
+/**
+ * A Keycard-verified user. Implements `@a2a-js/sdk`'s `User` interface
+ * and carries the full `AccessToken` for downstream delegation.
+ *
+ * Python equivalent: the `KeycardUser` injected into `ServerCallContext.state`
+ * by `KeycardServerCallContextBuilder`.
+ */
+export declare class KeycardUser implements User {
+    readonly accessToken: AccessToken;
+    constructor(accessToken: AccessToken);
+    get isAuthenticated(): boolean;
+    get userName(): string;
+}
+export type KeycardUserBuilderOptions = Pick<TokenVerifierOptions, "issuer" | "audience" | "enableMultiZone" | "keyring" | "requiredScopes">;
+/**
+ * Returns a `UserBuilder` for `@a2a-js/sdk`'s Express handlers that validates
+ * Keycard-issued JWTs and injects a `KeycardUser` into the request context.
+ *
+ * Python equivalent: `KeycardServerCallContextBuilder`, the auth extension
+ * point of `a2a-sdk` where Keycard auth is wired in.
+ *
+ * ```ts
+ * const userBuilder = keycardUserBuilder({ issuer: "https://zone.keycard.cloud" });
+ * app.post("/a2a/jsonrpc", jsonRpcHandler({ requestHandler, userBuilder }));
+ * ```
+ *
+ * On a valid token the SDK receives a `KeycardUser`; on an invalid or missing
+ * token it receives an `UnauthenticatedUser`, and the SDK rejects the request
+ * with a 401.
+ */
+export declare function keycardUserBuilder(options: KeycardUserBuilderOptions): UserBuilder;
+/**
+ * Extract the `AccessToken` from an A2A `RequestContext`.
+ * Returns `null` if the request was not authenticated with a Keycard token.
+ *
+ * ```ts
+ * const auth = getKeycardAuth(requestContext);
+ * if (!auth) throw new Error("unauthenticated");
+ * // use auth.token for downstream delegation
+ * ```
+ */
+export declare function getKeycardAuth(requestContext: RequestContext): AccessToken | null;
+//# sourceMappingURL=auth.d.ts.map

package/dist/esm/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD;;;;;;GAMG;AACH,qBAAa,WAAY,YAAW,IAAI;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;gBAEtB,WAAW,EAAE,WAAW;IAIpC,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;CACF;AAED,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAC1C,oBAAoB,EACpB,QAAQ,GAAG,UAAU,GAAG,iBAAiB,GAAG,SAAS,GAAG,gBAAgB,CACzE,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,WAAW,CAsBlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,cAAc,EAAE,cAAc,GAAG,WAAW,GAAG,IAAI,CAMjF"}

package/dist/esm/auth.js

@@ -0,0 +1,84 @@
+import { TokenVerifier } from "@keycardai/oauth/server/tokenVerifier";
+import { A2AError } from "@a2a-js/sdk/server";
+/**
+ * A Keycard-verified user. Implements `@a2a-js/sdk`'s `User` interface
+ * and carries the full `AccessToken` for downstream delegation.
+ *
+ * Python equivalent: the `KeycardUser` injected into `ServerCallContext.state`
+ * by `KeycardServerCallContextBuilder`.
+ */
+export class KeycardUser {
+    constructor(accessToken) {
+        this.accessToken = accessToken;
+    }
+    get isAuthenticated() {
+        return true;
+    }
+    get userName() {
+        return this.accessToken.clientId;
+    }
+}
+/**
+ * Returns a `UserBuilder` for `@a2a-js/sdk`'s Express handlers that validates
+ * Keycard-issued JWTs and injects a `KeycardUser` into the request context.
+ *
+ * Python equivalent: `KeycardServerCallContextBuilder`, the auth extension
+ * point of `a2a-sdk` where Keycard auth is wired in.
+ *
+ * ```ts
+ * const userBuilder = keycardUserBuilder({ issuer: "https://zone.keycard.cloud" });
+ * app.post("/a2a/jsonrpc", jsonRpcHandler({ requestHandler, userBuilder }));
+ * ```
+ *
+ * On a valid token the SDK receives a `KeycardUser`; on an invalid or missing
+ * token it receives an `UnauthenticatedUser`, and the SDK rejects the request
+ * with a 401.
+ */
+export function keycardUserBuilder(options) {
+    const verifier = new TokenVerifier({
+        issuer: options.issuer,
+        audience: options.audience,
+        enableMultiZone: options.enableMultiZone,
+        keyring: options.keyring,
+        requiredScopes: options.requiredScopes,
+    });
+    return async (req) => {
+        const authorization = req.headers.authorization;
+        if (!authorization?.startsWith("Bearer ")) {
+            // -32001 is the A2A unauthorized error code
+            throw new A2AError(-32001, "Missing or invalid Authorization header");
+        }
+        const token = authorization.slice(7);
+        const accessToken = await verifier.verifyToken(token);
+        if (!accessToken) {
+            throw new A2AError(-32001, "Invalid or expired token");
+        }
+        return new KeycardUser(accessToken);
+    };
+}
+/**
+ * Extract the `AccessToken` from an A2A `RequestContext`.
+ * Returns `null` if the request was not authenticated with a Keycard token.
+ *
+ * ```ts
+ * const auth = getKeycardAuth(requestContext);
+ * if (!auth) throw new Error("unauthenticated");
+ * // use auth.token for downstream delegation
+ * ```
+ */
+export function getKeycardAuth(requestContext) {
+    const user = requestContext.context?.user;
+    if (user instanceof KeycardUser) {
+        return user.accessToken;
+    }
+    return null;
+}
+class UnauthenticatedUser {
+    get isAuthenticated() {
+        return false;
+    }
+    get userName() {
+        return "anonymous";
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/esm/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAItE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IAGtB,YAAY,WAAwB;QAClC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;IACnC,CAAC;CACF;AAOD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IAEH,OAAO,KAAK,EAAE,GAAY,EAAiB,EAAE;QAC3C,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,4CAA4C;YAC5C,MAAM,IAAI,QAAQ,CAAC,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,QAAQ,CAAC,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,cAA8B;IAC3D,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;IAC1C,IAAI,IAAI,YAAY,WAAW,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,mBAAmB;IACvB,IAAI,eAAe;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ;QACV,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}

package/dist/esm/config.d.ts

@@ -0,0 +1,35 @@
+import type { AgentSkill } from "@a2a-js/sdk";
+export type { AgentSkill } from "@a2a-js/sdk";
+/**
+ * Configuration for a Keycard-protected A2A agent service.
+ *
+ * Python equivalent: `keycardai.a2a.AgentServiceConfig`
+ */
+export interface AgentServiceConfig {
+    /** Human-readable service name, used as the agent card `name`. */
+    serviceName: string;
+    /** Keycard client ID for service-to-service token exchange. */
+    clientId: string;
+    /** Keycard client secret. */
+    clientSecret: string;
+    /**
+     * Public URL of this agent service, e.g. "https://my-agent.example.com".
+     * Used to construct the JSONRPC endpoint URL.
+     */
+    identityUrl: string;
+    /** Keycard zone ID, e.g. "abc1234". Constructs the auth server URL. */
+    zoneId?: string;
+    /**
+     * Explicit authorization server URL. Defaults to
+     * `https://{zoneId}.keycard.cloud` when `zoneId` is provided.
+     */
+    authorizationServerUrl?: string;
+    /** Description for the agent card. */
+    description?: string;
+    /** Skills advertised in the agent card. */
+    skills?: readonly AgentSkill[];
+}
+export declare function getAgentCardUrl(config: AgentServiceConfig): string;
+export declare function getJsonrpcUrl(config: AgentServiceConfig): string;
+export declare function getAuthServerUrl(config: AgentServiceConfig): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/esm/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,6BAA6B;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CAChC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAElE;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAEhE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAMnE"}

package/dist/esm/config.js

@@ -0,0 +1,14 @@
+export function getAgentCardUrl(config) {
+    return `${config.identityUrl}/.well-known/agent-card.json`;
+}
+export function getJsonrpcUrl(config) {
+    return `${config.identityUrl}/a2a/jsonrpc`;
+}
+export function getAuthServerUrl(config) {
+    if (config.authorizationServerUrl)
+        return config.authorizationServerUrl;
+    if (config.zoneId)
+        return `https://${config.zoneId}.keycard.cloud`;
+    throw new Error("AgentServiceConfig: either `authorizationServerUrl` or `zoneId` is required");
+}
+//# sourceMappingURL=config.js.map

package/dist/esm/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAkCA,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,OAAO,GAAG,MAAM,CAAC,WAAW,8BAA8B,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAA0B;IACtD,OAAO,GAAG,MAAM,CAAC,WAAW,cAAc,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,IAAI,MAAM,CAAC,sBAAsB;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,WAAW,MAAM,CAAC,MAAM,gBAAgB,CAAC;IACnE,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;AACJ,CAAC"}

package/dist/esm/delegation.d.ts

@@ -0,0 +1,56 @@
+import type { AgentCard } from "@a2a-js/sdk";
+import type { Message } from "@a2a-js/sdk";
+import { ServiceDiscovery } from "./discovery.js";
+import type { AgentServiceConfig } from "./config.js";
+export interface DelegationResult {
+    /** The agent's response message. */
+    message: Message;
+    /** Resolved agent card for the target service. */
+    agentCard: AgentCard;
+}
+export interface InvokeOptions {
+    /**
+     * Keycard bearer token from the current request context. Pass
+     * `getKeycardAuth(requestContext)?.token` from the executor.
+     * Required for all delegation flows.
+     *
+     * For service-to-service delegation without a user token (equivalent to
+     * Python's client-credentials fallback in `DelegationClient`), first
+     * acquire a service access token from Keycard, then pass it here.
+     * A convenience method for this path is a planned follow-up.
+     */
+    subjectToken: string;
+    /** Timeout in ms for the JSONRPC call. Default: 30 000. */
+    timeoutMs?: number;
+    /** Arbitrary metadata to attach to the A2A message. */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Client for delegating tasks to remote A2A agent services with
+ * Keycard token exchange.
+ *
+ * ```ts
+ * const client = new DelegationClient(config);
+ *
+ * // Inside your AgentExecutor.execute():
+ * const auth = getKeycardAuth(requestContext);
+ * const result = await client.invokeService(targetUrl, "summarize this", {
+ *   subjectToken: auth!.token,
+ * });
+ * eventBus.publish(result.message);
+ * eventBus.finished();
+ * ```
+ *
+ * Python equivalent: `keycardai.a2a.DelegationClient`
+ */
+export declare class DelegationClient {
+    #private;
+    constructor(config: AgentServiceConfig, options?: {
+        discovery?: ServiceDiscovery;
+    });
+    /**
+     * Discover, authenticate, and invoke a remote A2A agent in one call.
+     */
+    invokeService(serviceUrl: string, task: string, options: InvokeOptions): Promise<DelegationResult>;
+}
+//# sourceMappingURL=delegation.d.ts.map

package/dist/esm/delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.d.ts","sourceRoot":"","sources":["../../src/delegation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtD,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAgB;;gBAKf,MAAM,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,gBAAgB,CAAA;KAAE;IAQlF;;OAEG;IACG,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,gBAAgB,CAAC;CAsE7B"}