@kodax-ai/kodax 0.7.69 → 0.7.71

package/dist/sdk-a2a.d.ts

@@ -1,22 +1,22 @@
-import { ar as ExternalAgentRegistration, u as AgentEffectDeclaration, x as AgentExecutorFactory } from './types-chunks/types.d-BtC4yLYO.js';
+import { ax as ExternalAgentRegistration, u as AgentEffectDeclaration, x as AgentExecutorFactory, g as AgentArtifactPolicy } from './types-chunks/types.d-CRCaLt_s.js';
 import { RuntimeKodaXOptions, RuntimeWorkspaceBinding, RuntimeExecutionToolPolicy, RuntimeUserMarkdownAgentRef, KodaXRuntime, RuntimeExternalAgentsOptions } from './sdk-runtime.js';
 import { c as IntegrationConfigSnapshot, e as IntegrationConfigStatus } from './types-chunks/integration-config.d-ojG4swOP.js';
-import './types-chunks/types.d-TTvpAGWf.js';
-import './types-chunks/bash-prefix-extractor.d-BkIA8Wto.js';
+import './types-chunks/types.d-Cqaw71Ax.js';
+import './types-chunks/bash-prefix-extractor.d-YoiZl5yt.js';
 import './types-chunks/types.d-vJExiRje.js';
 import 'vscode-languageserver-protocol';
 import './types-chunks/cost-tracker.d-BeaenODW.js';
-import './types-chunks/capability.d-3C62G8Eq.js';
-import './types-chunks/base.d-CYjtB68X.js';
+import './types-chunks/capability.d-K664nHOS.js';
+import './types-chunks/base.d-Cz_rwpOi.js';
 import './types-chunks/config.d-CJy1WENT.js';
-import './types-chunks/manager.d-CoEuPRAo.js';
-import './types-chunks/run-manager.d-BaXtkryp.js';
-import './types-chunks/types.d-C9YHEAmA.js';
-import './types-chunks/utils.d-BbB5jzi1.js';
-import './types-chunks/guardrail.d-R7AiGfrI.js';
-import './types-chunks/guardrail.d-6ZDbNbHO.js';
+import './types-chunks/manager.d-B67TmPO1.js';
+import './types-chunks/run-manager.d-DxU3SSGR.js';
+import './types-chunks/types.d-CzsLFqmf.js';
+import './types-chunks/utils.d-Cb6vdvFM.js';
+import './types-chunks/guardrail.d-DdeDWnVu.js';
+import './types-chunks/guardrail.d-DilYC1dh.js';
 import 'readline';
-import './types-chunks/public-api.d-7G4--RZE.js';
+import './types-chunks/public-api.d-BvCp5VkW.js';
 import 'child_process';
 
 declare const A2A_PROTOCOL_VERSION = "1.0";
@@ -76,6 +76,13 @@ interface A2AAgentSkill {
     readonly examples?: readonly string[];
     readonly inputModes?: readonly string[];
     readonly outputModes?: readonly string[];
+    readonly securityRequirements?: readonly Readonly<Record<string, unknown>>[];
+}
+interface A2AAgentExtension {
+    readonly uri: string;
+    readonly description?: string;
+    readonly required?: boolean;
+    readonly params?: Readonly<Record<string, unknown>>;
 }
 interface A2AAgentCard {
     readonly name: string;
@@ -86,7 +93,7 @@ interface A2AAgentCard {
         readonly streaming?: boolean;
         readonly pushNotifications?: boolean;
         readonly extendedAgentCard?: boolean;
-        readonly extensions?: readonly Readonly<Record<string, unknown>>[];
+        readonly extensions?: readonly A2AAgentExtension[];
     };
     readonly securitySchemes?: Readonly<Record<string, unknown>>;
     readonly securityRequirements?: readonly Readonly<Record<string, unknown>>[];
@@ -120,15 +127,34 @@ interface A2ANetworkPolicy {
 }
 interface A2AClientOptions {
     readonly networkPolicy: A2ANetworkPolicy;
+    /** RPC/SSE task payload ceiling; Card/OAuth discovery keeps the stricter network limit. */
+    readonly maxTaskResponseBytes?: number;
     readonly pollIntervalMs: number;
     readonly authorization?: string;
     /** Trusted transport override. Supplying one opts out of the default DNS-pinned connector. */
     readonly fetch?: typeof globalThis.fetch;
 }
+type A2AClientAuthenticationInput = {
+    readonly type: 'http-bearer';
+    readonly scheme: string;
+    readonly credentialRef: string;
+} | {
+    readonly type: 'oauth2-client-credentials';
+    readonly scheme: string;
+    readonly issuer: string;
+    readonly tokenUrl: string;
+    readonly clientId: string;
+    readonly clientSecretRef: string;
+    readonly scopes: readonly string[];
+    readonly resource?: string;
+    readonly clientAuthentication: 'client-secret-basic' | 'client-secret-post';
+};
 interface A2ARegistrationInput {
     readonly agentId: string;
     readonly agentCardUrl: string;
+    /** Legacy shorthand for HTTP Bearer; prefer authentication. */
     readonly credentialRef?: string;
+    readonly authentication?: A2AClientAuthenticationInput;
     readonly effects: Pick<AgentEffectDeclaration, 'remote'>;
 }
 interface A2ADiscoveredRegistration {
@@ -141,6 +167,11 @@ interface A2APrincipal {
     readonly scopes: readonly string[];
 }
 interface A2AAuthentication {
+    /**
+     * Non-secret authority identifier used to namespace durable task ownership.
+     * Keep it stable across credential rotation; change it when the identity authority changes.
+     */
+    readonly securityRealm: string;
     readonly securitySchemes: Readonly<Record<string, unknown>>;
     readonly securityRequirements: readonly Readonly<Record<string, unknown>>[];
     authenticate(request: Request): Promise<A2APrincipal | null>;
@@ -242,11 +273,14 @@ declare class A2AError extends Error {
     readonly code: number;
     readonly httpStatus: number;
     readonly data?: unknown | undefined;
-    constructor(code: number, message: string, httpStatus?: number, data?: unknown | undefined);
+    readonly headers?: Readonly<Record<string, string>> | undefined;
+    constructor(code: number, message: string, httpStatus?: number, data?: unknown | undefined, headers?: Readonly<Record<string, string>> | undefined);
 }
 declare function errorMessage(error: unknown): string;
 
 declare function isRecord(value: unknown): value is Record<string, unknown>;
+declare function isJsonMediaType(value: string | null): boolean;
+declare function isEventStreamMediaType(value: string | null): boolean;
 declare function parseA2AAgentCard(value: unknown): A2AAgentCard;
 declare function parseA2APart(value: unknown): A2APart;
 declare function parseA2AMessage(value: unknown): A2AMessage;
@@ -266,16 +300,107 @@ declare function discoverA2ARegistration(input: A2ARegistrationInput, options: A
 type A2AClientOptionsResolver = (registration: ExternalAgentRegistration) => A2AClientOptions;
 declare function createA2AAgentExecutorFactory(options: A2AClientOptions | A2AClientOptionsResolver): AgentExecutorFactory;
 
+interface OAuth2ClientCredentialsTokenManagerOptions {
+    readonly issuer: string;
+    readonly tokenUrl: string;
+    readonly clientId: string;
+    readonly scopes?: readonly string[];
+    readonly resource?: string;
+    readonly clientAuthenticationMethod: 'basic' | 'post';
+    readonly networkPolicy: A2ANetworkPolicy;
+    /** Trusted transport override. Safe URL validation is still applied before it is invoked. */
+    readonly fetch?: typeof globalThis.fetch;
+    /** Clock injection for deterministic expiry tests. */
+    readonly now?: () => number;
+}
+interface OAuth2ClientCredentialsTokenManager {
+    getAuthorization(clientSecret: string): Promise<string>;
+    /** Pass a rejected value for compare-and-clear; omit it only for an explicit full reset. */
+    invalidate(rejectedAuthorization?: string): void;
+}
+/**
+ * Creates a process-local client-credentials token manager.
+ *
+ * The secret is supplied only when a refresh is needed so callers can resolve a
+ * rotated credential immediately before use. Tokens and secrets are never persisted.
+ */
+declare function createOAuth2ClientCredentialsTokenManager(options: OAuth2ClientCredentialsTokenManagerOptions): OAuth2ClientCredentialsTokenManager;
+
+type SupportedSecurityKind = 'http-bearer' | 'oauth2-client-credentials';
+interface A2AHttpBearerSecurityScheme {
+    readonly name: string;
+    readonly kind: 'http-bearer';
+    readonly bearerFormat?: string;
+}
+interface A2AOAuth2ClientCredentialsSecurityScheme {
+    readonly name: string;
+    readonly kind: 'oauth2-client-credentials';
+    readonly tokenUrl: string;
+    readonly scopes: readonly string[];
+}
+interface A2AUnsupportedSecurityScheme {
+    readonly name: string;
+    readonly kind: 'unsupported';
+    readonly protocol: string;
+    readonly oauthScopes?: readonly string[];
+    readonly acceptsOAuthScopes?: boolean;
+}
+type A2ASecurityScheme = A2AHttpBearerSecurityScheme | A2AOAuth2ClientCredentialsSecurityScheme | A2AUnsupportedSecurityScheme;
+interface A2ARequiredSecurityScheme {
+    readonly scheme: A2ASecurityScheme;
+    readonly scopes: readonly string[];
+}
+interface A2ASecurityRequirement {
+    readonly schemes: readonly A2ARequiredSecurityScheme[];
+}
+interface A2ASecurityDeclaration {
+    readonly schemes: Readonly<Record<string, A2ASecurityScheme>>;
+    readonly requirements: readonly A2ASecurityRequirement[];
+}
+interface A2AClientSecurityCapability {
+    readonly schemeName: string;
+    readonly kind: SupportedSecurityKind;
+    readonly scopes?: readonly string[];
+}
+declare function assertOAuthScopeToken(value: string, label: string): void;
+declare function parseOAuthScopeValue(value: string, label: string): readonly string[];
+declare function parseOAuthScopeList(value: unknown, label: string): readonly string[];
+declare function requireNonEmptyString(value: unknown, label: string): string;
+declare function isExactOAuthLoopbackHostname(hostname: string): boolean;
+declare function parseOAuthIssuerIdentifier(value: unknown, label: string): string;
+declare function parseOAuthEndpointUrl(value: unknown, label: string): URL;
+declare function parseOAuthResourceIdentifier(value: unknown, label: string): string;
+declare function parseA2ASecurity(rawSchemes: unknown, rawRequirements: unknown): A2ASecurityDeclaration;
+declare function selectA2ASecurityRequirement(security: A2ASecurityDeclaration, capabilities: readonly A2AClientSecurityCapability[]): A2ASecurityRequirement | null;
+declare function satisfiableA2ASecurityRequirements(security: A2ASecurityDeclaration, capabilities: readonly A2AClientSecurityCapability[]): readonly A2ASecurityRequirement[];
+
 declare function createKodaXA2AServer(options: A2AServerOptions): KodaXA2AServer;
 /** Prepare an immutable Runtime execution binding before exposing an A2A handler. */
 declare function prepareKodaXA2AServer(options: A2AServerOptions): Promise<KodaXA2AServer>;
 
 type A2AOutboundEffect = 'none' | 'read' | 'write' | 'unknown';
+interface A2AOAuth2ClientCredentialsConfig {
+    readonly type: 'oauth2-client-credentials';
+    readonly scheme: string;
+    readonly issuer: string;
+    readonly tokenUrl: string;
+    readonly clientId: string;
+    readonly clientSecretEnv: string;
+    readonly scopes: readonly string[];
+    readonly resource?: string;
+    readonly clientAuthentication: 'client-secret-basic' | 'client-secret-post';
+}
 interface A2AOutboundAgentConfig {
     readonly cardUrl: string;
+    readonly enabled: boolean;
     readonly credentialEnv?: string;
+    readonly authentication?: A2AOAuth2ClientCredentialsConfig;
     readonly effect: A2AOutboundEffect;
 }
+/** Backward-compatible public mutation input; omitted `enabled` means active. */
+type A2AOutboundAgentInput = Omit<A2AOutboundAgentConfig, 'enabled'> & {
+    readonly enabled?: boolean;
+};
 type A2AWorkspaceConfig = {
     readonly mode: 'managed';
 } | {
@@ -330,6 +455,17 @@ interface A2ABearerAuthenticationConfig {
     readonly tokenEnv: string;
     readonly principalId: string;
 }
+interface A2AOAuth2JwtAuthenticationConfig {
+    readonly type: 'oauth2-jwt';
+    readonly scheme: string;
+    readonly issuer: string;
+    readonly audience: string;
+    readonly jwksUrl: string;
+    readonly tokenUrl: string;
+    readonly metadataUrl?: string;
+    readonly requiredScopes: readonly string[];
+}
+type A2AServerAuthenticationConfig = A2ABearerAuthenticationConfig | A2AOAuth2JwtAuthenticationConfig;
 interface A2AServerLimitsConfig {
     readonly maxRequestBytes: number;
     readonly maxPartBytes: number;
@@ -345,27 +481,54 @@ interface A2AServerConfig {
     readonly execution: A2AServerExecutionConfig;
     readonly published: A2APublishedAgentConfig;
     readonly publicBaseUrl?: string;
-    readonly authentication: A2ABearerAuthenticationConfig;
+    readonly authentication: A2AServerAuthenticationConfig;
     readonly limits: A2AServerLimitsConfig;
     readonly dataDir: string;
 }
 interface A2AIntegrationDocument {
-    readonly version: 1;
+    readonly version: 2;
     readonly agents: Readonly<Record<string, A2AOutboundAgentConfig>>;
     readonly server?: A2AServerConfig;
 }
+interface A2AIntegrationMigrationResult {
+    readonly migrated: boolean;
+    readonly snapshot: IntegrationConfigSnapshot<A2AIntegrationDocument>;
+}
+interface A2AIntegrationInspection {
+    readonly sourceVersion: 1 | 2;
+    readonly snapshot: IntegrationConfigSnapshot<A2AIntegrationDocument>;
+}
 interface A2AServerConfigChange {
     readonly kind: 'none' | 'hot' | 'restart-required';
     readonly fields: readonly string[];
 }
 declare function parseA2AIntegrationDocument(value: unknown): A2AIntegrationDocument;
 declare function readA2AIntegration(configHome: string): IntegrationConfigSnapshot<A2AIntegrationDocument>;
-declare function upsertA2AOutboundAgent(configHome: string, name: string, agent: A2AOutboundAgentConfig, expectedRevision?: string): IntegrationConfigSnapshot<A2AIntegrationDocument>;
-declare function removeA2AOutboundAgent(configHome: string, name: string, expectedRevision?: string): boolean;
-declare function setA2AServerConfig(configHome: string, server: A2AServerConfig | undefined, expectedRevision?: string): IntegrationConfigSnapshot<A2AIntegrationDocument>;
+declare function inspectA2AIntegration(configHome: string): A2AIntegrationInspection;
 declare function classifyA2AServerChange(current: A2AServerConfig | undefined, next: A2AServerConfig | undefined): A2AServerConfigChange;
 
-declare function createBearerEnvA2AAuthentication(config: A2AServerConfig['authentication'], env?: NodeJS.ProcessEnv): A2AAuthentication;
+declare function createOAuth2JwtA2AAuthentication(config: A2AOAuth2JwtAuthenticationConfig, fetchImpl?: typeof globalThis.fetch): A2AAuthentication;
+
+interface A2ALegacyTaskOwnerMapping {
+    readonly subject: string;
+    readonly tenant?: string;
+    readonly securityRealm: string;
+}
+interface A2ALegacyTaskOwnerMigrationOptions {
+    readonly dataDir: string;
+    readonly mappings: readonly A2ALegacyTaskOwnerMapping[];
+    readonly apply: boolean;
+}
+interface A2ALegacyTaskOwnerMigrationResult {
+    readonly dataDir: string;
+    readonly applied: boolean;
+    readonly matchedLegacyTaskCount: number;
+    readonly matchedCurrentTaskCount: number;
+    readonly unmatchedUnversionedTaskCount: number;
+}
+declare function migrateA2ALegacyTaskOwners(options: A2ALegacyTaskOwnerMigrationOptions): A2ALegacyTaskOwnerMigrationResult;
+
+declare function createBearerEnvA2AAuthentication(config: A2ABearerAuthenticationConfig, env?: NodeJS.ProcessEnv): A2AAuthentication;
 declare function createA2AServerOptionsFromConfig(input: {
     readonly runtime: KodaXRuntime;
     readonly config: A2AServerConfig;
@@ -387,11 +550,13 @@ interface ConfiguredA2ARuntimeIntegration {
     readonly runtimeOptions: RuntimeExternalAgentsOptions;
     start(runtime: KodaXRuntime): Promise<ConfiguredA2ARuntimeHandle>;
 }
+declare const CONFIGURED_A2A_TASK_RESPONSE_BYTES: number;
+declare const configuredA2AArtifactPolicy: AgentArtifactPolicy;
 declare function createConfiguredA2ARuntimeIntegration(input: {
     readonly configHome: string;
     readonly fetch?: typeof globalThis.fetch;
     readonly onEvent?: (message: string) => void;
 }): ConfiguredA2ARuntimeIntegration;
 
-export { A2AError, A2A_EXECUTOR_ID, A2A_PROTOCOL_VERSION, assertSafeA2AUrl, classifyA2AServerChange, createA2AAgentExecutorFactory, createA2AServerHotOptions, createA2AServerOptionsFromConfig, createBearerEnvA2AAuthentication, createConfiguredA2ARuntimeIntegration, createKodaXA2AServer, decodeUtf8, discoverA2ARegistration, errorMessage, isRecord, parseA2AAgentCard, parseA2AIntegrationDocument, parseA2AMessage, parseA2APart, parseA2ATask, parseJsonRpcRequest, prepareKodaXA2AServer, readA2AIntegration, removeA2AOutboundAgent, safeA2AFetch, setA2AServerConfig, upsertA2AOutboundAgent };
-export type { A2AAgentCard, A2AAgentInterface, A2AAgentSkill, A2AArtifact, A2AAuthentication, A2AAuthorizationInput, A2ABearerAuthenticationConfig, A2AClientOptions, A2AClientOptionsResolver, A2ADiscoveredRegistration, A2AIntegrationDocument, A2AJsonRpcError, A2AJsonRpcRequest, A2AJsonRpcResponse, A2AMessage, A2ANetworkPolicy, A2AOperation, A2AOutboundAgentConfig, A2AOutboundEffect, A2APart, A2APrincipal, A2APublishedAgent, A2APublishedAgentConfig, A2APublishedSkill, A2APublishedSkillConfig, A2ARegistrationInput, A2AServerConfig, A2AServerConfigChange, A2AServerEvent, A2AServerExecution, A2AServerExecutionConfig, A2AServerHotOptions, A2AServerLimits, A2AServerLimitsConfig, A2AServerOptions, A2ATask, A2ATaskState, A2ATaskStatus, A2AToolPolicyConfig, A2AUserMarkdownAgentConfigRef, A2AWorkspaceConfig, ConfiguredA2ARuntimeHandle, ConfiguredA2ARuntimeIntegration, CreateA2AAgentExecutorFactory, KodaXA2AServer, SafeFetchResult };
+export { A2AError, A2A_EXECUTOR_ID, A2A_PROTOCOL_VERSION, CONFIGURED_A2A_TASK_RESPONSE_BYTES, assertOAuthScopeToken, assertSafeA2AUrl, classifyA2AServerChange, configuredA2AArtifactPolicy, createA2AAgentExecutorFactory, createA2AServerHotOptions, createA2AServerOptionsFromConfig, createBearerEnvA2AAuthentication, createConfiguredA2ARuntimeIntegration, createKodaXA2AServer, createOAuth2ClientCredentialsTokenManager, createOAuth2JwtA2AAuthentication, decodeUtf8, discoverA2ARegistration, errorMessage, inspectA2AIntegration, isEventStreamMediaType, isExactOAuthLoopbackHostname, isJsonMediaType, isRecord, migrateA2ALegacyTaskOwners, parseA2AAgentCard, parseA2AIntegrationDocument, parseA2AMessage, parseA2APart, parseA2ASecurity, parseA2ATask, parseJsonRpcRequest, parseOAuthEndpointUrl, parseOAuthIssuerIdentifier, parseOAuthResourceIdentifier, parseOAuthScopeList, parseOAuthScopeValue, prepareKodaXA2AServer, readA2AIntegration, requireNonEmptyString, safeA2AFetch, satisfiableA2ASecurityRequirements, selectA2ASecurityRequirement };
+export type { A2AAgentCard, A2AAgentExtension, A2AAgentInterface, A2AAgentSkill, A2AArtifact, A2AAuthentication, A2AAuthorizationInput, A2ABearerAuthenticationConfig, A2AClientAuthenticationInput, A2AClientOptions, A2AClientOptionsResolver, A2AClientSecurityCapability, A2ADiscoveredRegistration, A2AHttpBearerSecurityScheme, A2AIntegrationDocument, A2AIntegrationInspection, A2AIntegrationMigrationResult, A2AJsonRpcError, A2AJsonRpcRequest, A2AJsonRpcResponse, A2ALegacyTaskOwnerMapping, A2ALegacyTaskOwnerMigrationOptions, A2ALegacyTaskOwnerMigrationResult, A2AMessage, A2ANetworkPolicy, A2AOAuth2ClientCredentialsConfig, A2AOAuth2ClientCredentialsSecurityScheme, A2AOAuth2JwtAuthenticationConfig, A2AOperation, A2AOutboundAgentConfig, A2AOutboundAgentInput, A2AOutboundEffect, A2APart, A2APrincipal, A2APublishedAgent, A2APublishedAgentConfig, A2APublishedSkill, A2APublishedSkillConfig, A2ARegistrationInput, A2ARequiredSecurityScheme, A2ASecurityDeclaration, A2ASecurityRequirement, A2ASecurityScheme, A2AServerAuthenticationConfig, A2AServerConfig, A2AServerConfigChange, A2AServerEvent, A2AServerExecution, A2AServerExecutionConfig, A2AServerHotOptions, A2AServerLimits, A2AServerLimitsConfig, A2AServerOptions, A2ATask, A2ATaskState, A2ATaskStatus, A2AToolPolicyConfig, A2AUnsupportedSecurityScheme, A2AUserMarkdownAgentConfigRef, A2AWorkspaceConfig, ConfiguredA2ARuntimeHandle, ConfiguredA2ARuntimeIntegration, CreateA2AAgentExecutorFactory, KodaXA2AServer, OAuth2ClientCredentialsTokenManager, OAuth2ClientCredentialsTokenManagerOptions, SafeFetchResult };