@loopingai/core 0.1.0

package/dist/testing/vcr.js

@@ -0,0 +1,211 @@
+import { MockAgent, SnapshotAgent } from "undici";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { VCR_CONTROL_ORIGIN, CASSETTE_NAME_RE } from "./vcr-shared.js";
+/**
+ * undici stamps every cassette entry with two volatile fields we never want
+ * committed: `callCount` — which its recorder *mutates on every replay* (to walk
+ * sequential responses) — and `timestamp`, the record-time clock. Neither is
+ * needed for playback (`callCount` defaults to 0 on load; `timestamp` is unused),
+ * so we delete them from a freshly recorded cassette. Removing them is also what
+ * stops a plain `npm test` from dirtying cassettes: with no persisted `callCount`
+ * there is nothing for a replay to bump — and {@link VcrAgent.close} no longer
+ * writes in playback anyway.
+ */
+function stripVolatileFields(file) {
+    const entries = JSON.parse(readFileSync(file, "utf8"));
+    for (const { snapshot } of entries) {
+        delete snapshot.callCount;
+        delete snapshot.timestamp;
+    }
+    writeFileSync(file, JSON.stringify(entries, null, 2));
+}
+function originHost(origin) {
+    if (!origin)
+        return null;
+    try {
+        return new URL(String(origin)).host;
+    }
+    catch {
+        return null;
+    }
+}
+const CONTROL_HOST = new URL(VCR_CONTROL_ORIGIN).host;
+/**
+ * The single agent Miniflare accepts as `fetchMock` (it allows only one), fanning
+ * outbound worker requests out by role:
+ *
+ *  - **Control channel** ({@link VCR_CONTROL_ORIGIN}) → ordinary MockAgent
+ *    interceptors whose reply callbacks flip the *active cassette*. This is how a
+ *    spec running in workerd (no filesystem) tells this Node-side agent which
+ *    test is running — see `setupRecording` (vcr-spec.ts).
+ *  - **Passthrough hosts** (the gateway JWKS) → ordinary MockAgent interceptors,
+ *    unchanged from before VCR existed.
+ *  - **Everything else, while a cassette is active** → that cassette's undici
+ *    {@link SnapshotAgent} record/replay. In playback a request with no matching
+ *    recording throws `No snapshot found` — offline, never the network.
+ *  - **Everything else, with no active cassette** → ordinary MockAgent behavior
+ *    (`disableNetConnect()` → offline error). A non-recorded test never reaches
+ *    the network.
+ *
+ * There is **no registry**: cassettes are keyed per test (file + describe + test
+ * name) by the spec helper, activated one at a time over the control channel. A
+ * new recorded spec touches only its own `.spec` file.
+ *
+ * Why `VcrAgent extends MockAgent` rather than `SnapshotAgent`: a `SnapshotAgent`'s
+ * `dispatch` fully overrides `MockAgent`'s (it never falls back to the interceptor
+ * path), so one `SnapshotAgent` cannot also serve the control/interceptor fixtures
+ * — and cannot serve more than one cassette. Keeping one internal `SnapshotAgent`
+ * per cassette and dispatching to the active one, with an ordinary
+ * `MockAgent.dispatch` fallback for control/passthrough/offline, leaves the
+ * interceptor path exactly as it always worked. Miniflare validates `fetchMock`
+ * with `instanceof MockAgent`, which `VcrAgent` satisfies directly.
+ */
+export class VcrAgent extends MockAgent {
+    #snapshotsDir;
+    #record;
+    #passthrough;
+    #excludeHeaders;
+    #ignoreHeaders;
+    /** One SnapshotAgent per cassette name, created lazily on first activation. */
+    #agents = new Map();
+    #active = null;
+    #activeName = null;
+    constructor(options) {
+        super();
+        this.#snapshotsDir = options.snapshotsDir;
+        this.#record = options.record;
+        this.#passthrough = new Set(options.passthroughHosts);
+        this.#excludeHeaders = options.excludeHeaders;
+        this.#ignoreHeaders = options.ignoreHeaders;
+        this.#registerControl();
+    }
+    /** Persistent interceptors backing the control channel (see class doc). */
+    #registerControl() {
+        const control = this.get(VCR_CONTROL_ORIGIN);
+        control
+            // RegExp path so any `?cassette=…` query matches; the name is read from
+            // opts.path (the body is a ReadableStream and can't be read synchronously).
+            .intercept({ path: /^\/use(\?|$)/, method: "POST" })
+            .reply((opts) => this.#onUse(opts))
+            .persist();
+        control
+            .intercept({ path: "/release", method: "POST" })
+            .reply(() => {
+            this.#active = null;
+            this.#activeName = null;
+            return { statusCode: 204 };
+        })
+            .persist();
+    }
+    /** Activate the named cassette (get-or-create its SnapshotAgent). `opts.path`
+     *  is undici's reply-callback request path, e.g. `/use?cassette=<name>`. */
+    #onUse(opts) {
+        const name = new URL(opts.path, VCR_CONTROL_ORIGIN).searchParams.get("cassette") ?? "";
+        if (!CASSETTE_NAME_RE.test(name)) {
+            return { statusCode: 400, data: `invalid cassette name: ${name}` };
+        }
+        // Cheap tripwire: recorded specs are expected to run sequentially, so a
+        // second cassette activating while another is held means parallel recorded
+        // tests are sharing this agent — surface it loudly rather than mis-record.
+        if (this.#activeName !== null && this.#activeName !== name) {
+            return {
+                statusCode: 409,
+                data: `cassette ${this.#activeName} still active`
+            };
+        }
+        const file = path.join(this.#snapshotsDir, name);
+        // Playback with no cassette → 404, which the spec turns into a "record it"
+        // error. In record mode the file is created on first write.
+        if (!this.#record && !existsSync(file)) {
+            return { statusCode: 404, data: `no cassette ${name}` };
+        }
+        this.#active = this.#agentFor(name, file);
+        this.#activeName = name;
+        return { statusCode: 204 };
+    }
+    #agentFor(name, file) {
+        let agent = this.#agents.get(name);
+        if (!agent) {
+            agent = new SnapshotAgent({
+                // `"record"`, not undici's `"update"`: update mode replays any request
+                // already in the cassette and only hits the network for new ones —
+                // silently stale the moment recorded traffic no longer matches live
+                // behavior (e.g. a re-used game id). `"record"` never loads or matches
+                // existing entries, so a recording run always reflects the live API.
+                mode: this.#record ? "record" : "playback",
+                snapshotPath: file,
+                excludeHeaders: this.#excludeHeaders,
+                ignoreHeaders: this.#ignoreHeaders,
+                autoFlush: this.#record
+            });
+            this.#agents.set(name, agent);
+        }
+        return agent;
+    }
+    dispatch(opts, handler) {
+        const host = originHost(opts.origin);
+        const vcr = host !== null &&
+            host !== CONTROL_HOST &&
+            !this.#passthrough.has(host) &&
+            this.#active !== null;
+        if (vcr)
+            return this.#active.dispatch(opts, handler);
+        return super.dispatch(opts, handler);
+    }
+    /**
+     * Closes every cassette's `SnapshotAgent`, then this agent.
+     *
+     * Record mode: `SnapshotAgent.close()` saves each cassette, stops its
+     * recorder's auto-flush timer, and closes its real sockets — all required (see
+     * {@link closeVcr}). We then {@link stripVolatileFields} from each saved file
+     * so the committed cassette carries no `callCount`/`timestamp`.
+     *
+     * Playback mode: undici's `SnapshotAgent.close()` *unconditionally* re-saves
+     * the cassette, writing back the `callCount` its recorder mutates on every
+     * replay — the side effect that dirtied cassettes on a plain `npm test`. There
+     * is nothing to save and no real socket in playback, so we skip that save
+     * entirely and only stop each recorder's timers.
+     */
+    async close() {
+        if (this.#record) {
+            await Promise.all([...this.#agents.values()].map((a) => a.close()));
+            for (const name of this.#agents.keys()) {
+                stripVolatileFields(path.join(this.#snapshotsDir, name));
+            }
+        }
+        else {
+            for (const a of this.#agents.values())
+                a.getRecorder().destroy();
+        }
+        await super.close();
+    }
+}
+export function createVcrAgent(options) {
+    const agent = new VcrAgent(options);
+    globalThis[VCR_KEY] = agent;
+    return agent;
+}
+/** globalThis slot so the Vitest globalSetup teardown can reach the live agent
+ *  created during config evaluation (same process, possibly a different module
+ *  realm — globalThis is the reliable channel). */
+const VCR_KEY = "__VCR_AGENT__";
+/**
+ * Flush and close the active VCR agent (all its cassettes). In record mode,
+ * undici's recorder arms a self-refreshing, non-`unref`ed auto-flush timer and
+ * the real `SnapshotAgent` keeps sockets open — both keep the process alive
+ * after tests finish and trip Vitest's "close timed out" at teardown. Calling
+ * this (from a Vitest `globalSetup` teardown, which runs before Vite closes its
+ * own server) stops them. A no-op if no agent was created, and in playback only
+ * stops recorder timers — {@link VcrAgent.close} deliberately does not re-save
+ * the cassette there (see its doc).
+ */
+export async function closeVcr() {
+    const g = globalThis;
+    const agent = g[VCR_KEY];
+    if (!agent)
+        return;
+    g[VCR_KEY] = undefined;
+    await agent.close();
+}
+//# sourceMappingURL=vcr.js.map

package/dist/testing/vcr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vcr.js","sourceRoot":"","sources":["../../src/testing/vcr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAmB,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEvE;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAElD,CAAC;IACJ,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC1B,OAAO,QAAQ,CAAC,SAAS,CAAC;IAC5B,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,MAAgC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAoBD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,QAAS,SAAQ,SAAS;IAC5B,aAAa,CAAS;IACtB,OAAO,CAAU;IACjB,YAAY,CAAc;IAC1B,eAAe,CAAY;IAC3B,cAAc,CAAY;IACnC,+EAA+E;IACtE,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpD,OAAO,GAAyB,IAAI,CAAC;IACrC,WAAW,GAAkB,IAAI,CAAC;IAElC,YAAY,OAA8B;QACxC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,2EAA2E;IAC3E,gBAAgB;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC7C,OAAO;YACL,wEAAwE;YACxE,4EAA4E;aAC3E,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;aACnD,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAClC,OAAO,EAAE,CAAC;QACb,OAAO;aACJ,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;aAC/C,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC,CAAC;aACD,OAAO,EAAE,CAAC;IACf,CAAC;IAED;gFAC4E;IAC5E,MAAM,CAAC,IAAsB;QAC3B,MAAM,IAAI,GACR,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC5E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,0BAA0B,IAAI,EAAE,EAAE,CAAC;QACrE,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC3D,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE,YAAY,IAAI,CAAC,WAAW,eAAe;aAClD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACjD,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC7B,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,IAAY;QAClC,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,aAAa,CAAC;gBACxB,uEAAuE;gBACvE,mEAAmE;gBACnE,oEAAoE;gBACpE,uEAAuE;gBACvE,qEAAqE;gBACrE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;gBAC1C,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,IAAI,CAAC,eAAe;gBACpC,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,SAAS,EAAE,IAAI,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CACN,IAAgC,EAChC,OAAmC;QAEnC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,GAAG,GACP,IAAI,KAAK,IAAI;YACb,IAAI,KAAK,YAAY;YACrB,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAC5B,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QACxB,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,OAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAY,CAAC;QACjE,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACpE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,UAAsC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;mDAEmD;AACnD,MAAM,OAAO,GAAG,eAAe,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,CAAC,GAAG,UAAqC,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAyB,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,CAAC,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IACvB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC"}

package/dist/worker/index.d.ts

@@ -0,0 +1,62 @@
+import { type AgentManifest } from "../a2a/card.js";
+import { type TurnStarter } from "../a2a/executor.js";
+import type { AgentResolver } from "../a2a/agent-stub.js";
+import { type A2ASecretsEnv } from "../env.js";
+/**
+ * The A2A Worker: the zero-trust, no-shared-secrets edge every Looping agent
+ * puts in front of its Durable Object.
+ *
+ * Three routes, in order:
+ *
+ *  1. The card-signing **public** JWKS at the card's `jku`.
+ *  2. A **signed** AgentCard at `…/.well-known/agent-card.json`, so a gateway can
+ *     verify and pin this agent's identity at registration ("G knows R").
+ *  3. **Verify the gateway's identity JWT** on every JSON-RPC call against the
+ *     gateway's public JWKS ("R knows G"), then run the A2A JSON-RPC server for
+ *     that call. {@link A2AExecutor} dispatches into the caller's agent DO — one
+ *     instance per calling gateway-agent, keyed by the verified `identity.key`.
+ *
+ * No secret is ever shared in either direction: trust flows entirely on domains
+ * and asymmetric (Ed25519) signatures over public JWKS.
+ */
+/** Default path serving the card-signing public JWKS (the card's `jku`). */
+export declare const JWKS_PATH = "/.well-known/jwks.json";
+export interface A2AWorkerOptions {
+    /** The transport-independent half of this agent's card. */
+    manifest: AgentManifest;
+    /** Resolve the agent DO stub for a verified caller. */
+    resolveAgent: AgentResolver;
+    /** Start the durable turn. Must be idempotent — see {@link TurnStarter}. */
+    startTurn: TurnStarter;
+    /** Path serving the public JWKS. Defaults to {@link JWKS_PATH}. */
+    jwksPath?: string;
+    /** Path this agent answers JSON-RPC on. Defaults to `/a2a`. */
+    rpcPath?: string;
+    /**
+     * Advertise `securitySchemes` on the card. **Defaults to `false`** — see
+     * `BuildCardOptions.advertiseSecuritySchemes` for why, and read that note
+     * before turning it on.
+     */
+    advertiseSecuritySchemes?: boolean;
+    /** Claim carrying the caller identity. Defaults to the Looping namespace. */
+    identityClaim?: string;
+    /**
+     * Require a `taskPushNotificationConfig` on every `SendMessage`.
+     *
+     * Defaults to `true`, which is the accept-and-notify contract: the agent
+     * accepts synchronously and delivers out of band, so a send with nowhere to
+     * call back is a request that can never be answered. Set `false` only for an
+     * agent that replies inline.
+     */
+    requirePushConfig?: boolean;
+}
+/**
+ * Build the Worker `fetch` handler.
+ *
+ * ```ts
+ * const handler = createA2AWorker({ manifest, resolveAgent: getAgent, startTurn });
+ * export default { fetch: handler } satisfies ExportedHandler<Env>;
+ * ```
+ */
+export declare function createA2AWorker<TEnv extends A2ASecretsEnv>(options: A2AWorkerOptions): (request: Request, env: TEnv) => Promise<Response>;
+//# sourceMappingURL=index.d.ts.map

package/dist/worker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAEpE;;;;;;;;;;;;;;;;GAgBG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,SAAS,2BAA2B,CAAC;AAKlD,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,QAAQ,EAAE,aAAa,CAAC;IACxB,uDAAuD;IACvD,YAAY,EAAE,aAAa,CAAC;IAC5B,4EAA4E;IAC5E,SAAS,EAAE,WAAW,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AA2ED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS,aAAa,EACxD,OAAO,EAAE,gBAAgB,GACxB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,CAsHpD"}

package/dist/worker/index.js

@@ -0,0 +1,194 @@
+import { AGENT_CARD_PATH, SendMessageRequest } from "@a2a-js/sdk";
+import { DefaultRequestHandler, JsonRpcTransportHandler, validateVersion } from "@a2a-js/sdk/server";
+import { RequestMalformedError, toJsonRpcError } from "@a2a-js/sdk/errors";
+import { buildBaseCard, parsePrivateJwk, publicCardJwks, signCard } from "../a2a/card.js";
+import { buildCallContext, extensionHeaders } from "../a2a/context.js";
+import { GatewayAuthError, bearerToken, verifyGatewayToken } from "../a2a/verify.js";
+import { A2AExecutor } from "../a2a/executor.js";
+import { DurableTaskStore } from "../a2a/task-store.js";
+import { parseGatewayOrigins } from "../env.js";
+/**
+ * The A2A Worker: the zero-trust, no-shared-secrets edge every Looping agent
+ * puts in front of its Durable Object.
+ *
+ * Three routes, in order:
+ *
+ *  1. The card-signing **public** JWKS at the card's `jku`.
+ *  2. A **signed** AgentCard at `…/.well-known/agent-card.json`, so a gateway can
+ *     verify and pin this agent's identity at registration ("G knows R").
+ *  3. **Verify the gateway's identity JWT** on every JSON-RPC call against the
+ *     gateway's public JWKS ("R knows G"), then run the A2A JSON-RPC server for
+ *     that call. {@link A2AExecutor} dispatches into the caller's agent DO — one
+ *     instance per calling gateway-agent, keyed by the verified `identity.key`.
+ *
+ * No secret is ever shared in either direction: trust flows entirely on domains
+ * and asymmetric (Ed25519) signatures over public JWKS.
+ */
+/** Default path serving the card-signing public JWKS (the card's `jku`). */
+export const JWKS_PATH = "/.well-known/jwks.json";
+/** The JSON-RPC method carrying a turn (v1.0 renamed v0.3's `message/send`). */
+const SEND_MESSAGE_METHOD = "SendMessage";
+function unauthorized(reason) {
+    return new Response(`unauthorized: ${reason}`, {
+        status: 401,
+        headers: { "www-authenticate": 'Bearer error="invalid_token"' }
+    });
+}
+/**
+ * A JSON-RPC error envelope for a failure raised before the SDK handler ran,
+ * echoing the request's `id` so a conformant client can correlate it. Errors are
+ * transported at HTTP 200 per JSON-RPC 2.0, matching what the SDK handler
+ * returns for the failures it maps itself.
+ *
+ * Takes an already-mapped `error` because the mapper has to match the error's
+ * origin: `@a2a-js/sdk/errors` and `@a2a-js/sdk/server` are separately bundled
+ * entry points that each carry their own copy of the error hierarchy, so a
+ * mapper only recognizes errors its own bundle constructed — the other one fails
+ * its `instanceof` check and flattens every semantic error to a generic internal
+ * error. Each call site below picks accordingly.
+ */
+function jsonRpcErrorResponse(body, error) {
+    const id = body?.id ?? null;
+    return Response.json({ jsonrpc: "2.0", id, error });
+}
+/**
+ * Why a `SendMessage` fails the async-only contract, or `undefined` when it
+ * holds. (Other methods carry no config and are always fine.)
+ *
+ * Checked here, before the SDK handler, rather than in the executor: an executor
+ * throw is turned into a `failed` task, which a client reads as an accepted turn
+ * that never calls back. A rejected send has to surface as a JSON-RPC error.
+ */
+function pushConfigError(rpcBody) {
+    if (rpcBody.method !== SEND_MESSAGE_METHOD)
+        return undefined;
+    // Decode through the generated codec rather than reading the raw body: the
+    // wire form is protobuf-JSON, so this is what normalizes field naming and
+    // oneof shapes into the typed request the SDK handler will also see.
+    let params;
+    try {
+        params = SendMessageRequest.fromJSON(rpcBody.params);
+    }
+    catch (err) {
+        return `params are not a valid SendMessageRequest: ${err.message}`;
+    }
+    const pushConfig = params.configuration?.taskPushNotificationConfig;
+    if (!pushConfig?.url) {
+        return ("configuration.taskPushNotificationConfig.url is required: this agent " +
+            "replies asynchronously via push notification (A2A §13.2)");
+    }
+    if (!pushConfig.token) {
+        return ("configuration.taskPushNotificationConfig.token is required: the gateway " +
+            "uses it to correlate the callback to the pending task (A2A §13.2)");
+    }
+    try {
+        new URL(pushConfig.url);
+    }
+    catch {
+        return `configuration.taskPushNotificationConfig.url is not a valid URL: ${pushConfig.url}`;
+    }
+    return undefined;
+}
+/**
+ * Build the Worker `fetch` handler.
+ *
+ * ```ts
+ * const handler = createA2AWorker({ manifest, resolveAgent: getAgent, startTurn });
+ * export default { fetch: handler } satisfies ExportedHandler<Env>;
+ * ```
+ */
+export function createA2AWorker(options) {
+    const jwksPath = options.jwksPath ?? JWKS_PATH;
+    const requirePushConfig = options.requirePushConfig ?? true;
+    return async function fetch(request, env) {
+        const url = new URL(request.url);
+        const origin = url.origin;
+        const privateJwk = parsePrivateJwk(env.A2A_SIGNING_KEY);
+        const cardOptions = {
+            origin,
+            rpcPath: options.rpcPath,
+            advertiseSecuritySchemes: options.advertiseSecuritySchemes
+        };
+        // (1) Card-signing public JWKS — resolves the card's `jku` for the gateway.
+        if (request.method === "GET" && url.pathname === jwksPath) {
+            return Response.json(publicCardJwks(privateJwk), {
+                headers: { "cache-control": "public, max-age=3600" }
+            });
+        }
+        // (2) Signed AgentCard discovery. `signCard` returns the protobuf-JSON
+        // encoding — the exact document the signature is computed over.
+        if (request.method === "GET" && url.pathname.endsWith(AGENT_CARD_PATH)) {
+            const card = await signCard(buildBaseCard(options.manifest, cardOptions), { privateJwk, jku: `${origin}${jwksPath}` });
+            return Response.json(card);
+        }
+        // (3) A2A JSON-RPC — gateway-authenticated, dispatched into the caller's DO.
+        if (request.method === "POST") {
+            const token = bearerToken(request);
+            if (!token)
+                return unauthorized("missing gateway bearer token");
+            let identity;
+            try {
+                ({ identity } = await verifyGatewayToken(token, {
+                    allowedOrigins: parseGatewayOrigins(env.GATEWAY_ORIGINS),
+                    audience: origin,
+                    identityClaim: options.identityClaim
+                }));
+            }
+            catch (err) {
+                const message = err instanceof GatewayAuthError ? err.message : "verification failed";
+                return unauthorized(message);
+            }
+            // The DO instance is keyed by the verified `identity.key`; without it the
+            // executor cannot route the call — refuse rather than fall back to a
+            // shared instance. Guaranteed non-null past this point.
+            if (!identity.key) {
+                return new Response("bad request: gateway identity missing key", {
+                    status: 400
+                });
+            }
+            const body = await request.json();
+            // `typeof null === "object"`, so the null check is load-bearing: a body of
+            // literal `null` is valid JSON and would otherwise make `rpcBody` null,
+            // throwing on the property reads below instead of reaching the SDK
+            // handler, which maps it to the same -32602 that `[]` or a string gets.
+            const rpcBody = (typeof body === "object" && body !== null ? body : {});
+            const card = buildBaseCard(options.manifest, cardOptions);
+            const context = buildCallContext(request, identity);
+            // v1.0 negotiates the protocol version per request via the `A2A-Version`
+            // header, and the SDK leaves enforcement to the transport binding (its
+            // Express handlers do it; this Worker is the equivalent seam). An absent
+            // header is treated as `0.3` by the SDK, which a v1.0-only card does not
+            // advertise — so a legacy caller is rejected here rather than silently
+            // mis-served.
+            try {
+                validateVersion(context.requestedVersion, card, "JSONRPC");
+            }
+            catch (err) {
+                // Thrown by the server bundle — map it with the server bundle's mapper.
+                return jsonRpcErrorResponse(body, JsonRpcTransportHandler.mapToJSONRPCError(err));
+            }
+            if (requirePushConfig) {
+                const contractError = pushConfigError(rpcBody);
+                if (contractError) {
+                    // Constructed from the errors bundle — map it with that bundle's.
+                    return jsonRpcErrorResponse(body, toJsonRpcError(new RequestMalformedError(contractError)));
+                }
+            }
+            const handler = new DefaultRequestHandler(card, new DurableTaskStore(identity, options.resolveAgent), new A2AExecutor({
+                identity,
+                jku: `${origin}${jwksPath}`,
+                resolveAgent: options.resolveAgent,
+                startTurn: options.startTurn
+            }));
+            const rpc = new JsonRpcTransportHandler(handler);
+            const result = await rpc.handle(body, context);
+            // Streaming is not advertised; reject async generators outright.
+            if (Symbol.asyncIterator in result) {
+                return new Response("streaming not supported", { status: 501 });
+            }
+            return Response.json(result, { headers: extensionHeaders(context) });
+        }
+        return new Response("not found", { status: 404 });
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/worker/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,aAAa,EACb,eAAe,EACf,cAAc,EACd,QAAQ,EAET,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAEnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,WAAW,CAAC;AAEpE;;;;;;;;;;;;;;;;GAgBG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAElD,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAgC1C,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,IAAI,QAAQ,CAAC,iBAAiB,MAAM,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE;KAChE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAC3B,IAAa,EACb,KAAwC;IAExC,MAAM,EAAE,GAAI,IAA+C,EAAE,EAAE,IAAI,IAAI,CAAC;IACxE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAGxB;IACC,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAE7D,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,8CAA+C,GAAa,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;IACpE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QACrB,OAAO,CACL,uEAAuE;YACvE,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,CACL,0EAA0E;YAC1E,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oEAAoE,UAAU,CAAC,GAAG,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAyB;IAEzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC/C,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAE5D,OAAO,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,GAAS;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG;YAClB,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;SAC3D,CAAC;QAEF,4EAA4E;QAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;gBAC/C,OAAO,EAAE,EAAE,eAAe,EAAE,sBAAsB,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,EAC5C,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,QAAQ,EAAE,EAAE,CAC5C,CAAC;YACF,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,6EAA6E;QAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,8BAA8B,CAAC,CAAC;YAEhE,IAAI,QAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE;oBAC9C,cAAc,EAAE,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC;oBACxD,QAAQ,EAAE,MAAM;oBAChB,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GACX,GAAG,YAAY,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;gBACxE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAED,0EAA0E;YAC1E,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAClB,OAAO,IAAI,QAAQ,CAAC,2CAA2C,EAAE;oBAC/D,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAoC,CAAC;YACpE,2EAA2E;YAC3E,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,MAAM,OAAO,GAAG,CACd,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACb,CAAC;YAC3C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAEpD,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,cAAc;YACd,IAAI,CAAC;gBACH,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,OAAO,oBAAoB,CACzB,IAAI,EACJ,uBAAuB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAC/C,CAAC;YACJ,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAC/C,IAAI,aAAa,EAAE,CAAC;oBAClB,kEAAkE;oBAClE,OAAO,oBAAoB,CACzB,IAAI,EACJ,cAAc,CAAC,IAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC,CACzD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,qBAAqB,CACvC,IAAI,EACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EACpD,IAAI,WAAW,CAAC;gBACd,QAAQ;gBACR,GAAG,EAAE,GAAG,MAAM,GAAG,QAAQ,EAAE;gBAC3B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAE/C,iEAAiE;YACjE,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;gBACnC,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC"}

package/eslint-rules/index.js

@@ -0,0 +1,31 @@
+import { noDeprecatedObjectProperties } from "./no-deprecated-object-properties.js";
+
+/**
+ * `@loopingai/core/eslint` — the lint rules this stack needs that no upstream
+ * plugin provides.
+ *
+ * Consume as a flat-config plugin:
+ *
+ * ```js
+ * import looping from "@loopingai/core/eslint";
+ *
+ * export default [
+ *   {
+ *     files: ["src/**\/*.ts"],
+ *     plugins: { looping },
+ *     languageOptions: {
+ *       parserOptions: { projectService: true, tsconfigRootDir: import.meta.dirname }
+ *     },
+ *     rules: { "looping/no-deprecated-object-properties": "error" }
+ *   }
+ * ];
+ * ```
+ *
+ * `no-deprecated-object-properties` is type-aware, so the consuming config must
+ * enable `projectService` (or `project`) for it to see anything.
+ */
+export const rules = {
+  "no-deprecated-object-properties": noDeprecatedObjectProperties
+};
+
+export default { rules };

package/eslint-rules/no-deprecated-object-properties.js

@@ -0,0 +1,81 @@
+import { ESLintUtils } from "@typescript-eslint/utils";
+
+/**
+ * Flags `@deprecated` properties used as keys in object literals.
+ *
+ * `@typescript-eslint/no-deprecated` cannot see these. For an object literal it
+ * calls `getTypeAtLocation(objectExpression)`, which yields the literal's own
+ * *inferred* type — an anonymous type whose properties carry no JSDoc — rather
+ * than the contextual type that actually declares the deprecation. (Its JSX
+ * branch uses `getContextualType` and does work.) So member access like
+ * `opts.system` is reported, but `generateText({ system })` is silently allowed,
+ * even when the object is written to an explicitly annotated variable.
+ *
+ * That blind spot covers essentially every options-bag API — the AI SDK's
+ * `generateText`/`streamText` among them — so this rule closes it by resolving
+ * the contextual type itself and checking each key against it.
+ *
+ * Upstream issue: typescript-eslint#10883.
+ */
+export const noDeprecatedObjectProperties = ESLintUtils.RuleCreator.withoutDocs(
+  {
+    meta: {
+      type: "problem",
+      docs: {
+        description:
+          "Disallow `@deprecated` properties as keys in object literals"
+      },
+      messages: {
+        deprecated: "`{{name}}` is deprecated.{{reason}}"
+      },
+      schema: []
+    },
+    defaultOptions: [],
+    create(context) {
+      const services = ESLintUtils.getParserServices(context);
+      const checker = services.program.getTypeChecker();
+
+      /** Property name for a non-computed key, or undefined if not statically known. */
+      const staticName = (property) => {
+        if (property.computed) return undefined;
+        const { key } = property;
+        if (key.type === "Identifier") return key.name;
+        if (key.type === "Literal" && typeof key.value === "string")
+          return key.value;
+        return undefined;
+      };
+
+      return {
+        ObjectExpression(node) {
+          const tsNode = services.esTreeNodeToTSNodeMap.get(node);
+          // Undefined whenever the literal is not contextually typed (e.g. an
+          // unannotated `const`), in which case there is no declared property to
+          // consult and nothing to report.
+          const contextualType = checker.getContextualType(tsNode);
+          if (contextualType === undefined) return;
+
+          for (const property of node.properties) {
+            if (property.type !== "Property") continue; // skip SpreadElement
+            const name = staticName(property);
+            if (name === undefined) continue;
+
+            const symbol = contextualType.getProperty(name);
+            if (symbol === undefined) continue;
+
+            const tag = symbol
+              .getJsDocTags(checker)
+              .find((t) => t.name === "deprecated");
+            if (tag === undefined) continue;
+
+            const text = (tag.text ?? []).map((part) => part.text).join("");
+            context.report({
+              node: property.key,
+              messageId: "deprecated",
+              data: { name, reason: text ? ` ${text}` : "" }
+            });
+          }
+        }
+      };
+    }
+  }
+);