@loopingai/core 0.1.1 → 0.2.0

package/README.md

@@ -68,22 +68,84 @@ const manifest = {
 
 export default {
   fetch: createA2AWorker({
-    manifest,
-    // One DO instance per verified caller — this is what makes a task
-    // unreachable from any other caller by construction.
-    resolveAgent: (identity) =>
-      env.MY_AGENT.get(env.MY_AGENT.idFromName(identity.key!)),
-    // Must be idempotent: the gateway retries dispatch.
-    startTurn: async (turn) => {
-      await env.TURN_WORKFLOW.create({ id: turn.messageId, params: turn });
+    // The stub card at /.well-known/agent-card.json. It describes the origin,
+    // not an agent — see below.
+    manifest: hostManifest,
+    tenants: {
+      "my-agent": {
+        manifest,
+        // One DO instance per verified caller — this is what makes a task
+        // unreachable from any other caller by construction.
+        resolveAgent: (identity) =>
+          env.MY_AGENT.get(env.MY_AGENT.idFromName(identity.key!)),
+        // Must be idempotent: the gateway retries dispatch.
+        startTurn: async (turn) => {
+          await env.TURN_WORKFLOW.create({ id: turn.messageId, params: turn });
+        }
+      }
     }
   })
 } satisfies ExportedHandler<Env>;
 ```
 
-That handler serves three routes: the public JWKS, a **signed** AgentCard at
-`/.well-known/agent-card.json`, and gateway-authenticated JSON-RPC. Every POST is
-verified before a Durable Object is ever addressed.
+That handler serves three routes: the public JWKS, a **signed** stub AgentCard at
+`/.well-known/agent-card.json`, and gateway-authenticated JSON-RPC. Every POST is verified
+before a Durable Object is ever addressed.
+
+#### Agents are tenants
+
+Agents are keyed by **tenant id**, and one is required on every request — there is no
+default agent and no implicit routing. This is the A2A mechanism for exactly this case:
+`AgentInterface.tenant` is _"an opaque string used for routing requests to a specific agent
+or tenant when multiple agents are served behind a single A2A endpoint"_, and §8.3.2
+requires a client to send the value the interface it selected declared.
+
+So one origin serves any number of agents over **one endpoint, one signing key and one
+card** at the well-known path. It works the same for one agent as for twenty; nothing about
+the shape changes.
+
+The card is the reason it has to be this way rather than a path prefix per agent. Its
+location is a **well-known URI**, which RFC 8615 defines per-authority, so exactly one card
+per origin is discoverable at the path A2A registered with IANA. A gateway resolving
+`/.well-known/agent-card.json` against the origin finds that one card whatever prefix an
+agent is mounted behind — and pins its key for all of them.
+
+Which is why the card served there is a **stub**: it describes the deployment, advertises
+the endpoint and `extendedAgentCard`, and names no tenant. A tenant's real card — its name,
+skills and signature — comes from `GetExtendedAgentCard`, the spec's own tenant-aware card
+method:
+
+```jsonc
+// POST /a2a
+{
+  "jsonrpc": "2.0",
+  "id": 1,
+  "method": "GetExtendedAgentCard",
+  "params": { "tenant": "my-agent" }
+}
+```
+
+A card carries one interface entry and clients take the first, so the stub cannot list its
+siblings — put their names in `description` for a human, and register them out of band.
+
+Two independent checks keep one tenant's traffic out of another's:
+
+| check        | proves                                       |
+| ------------ | -------------------------------------------- |
+| `aud`        | the token was minted for **this deployment** |
+| tenant claim | …and for **this agent on it**                |
+
+The second is load-bearing. Every tenant shares one endpoint and therefore one audience, so
+the audience cannot distinguish them: without the claim, `tenant` would be an
+unauthenticated field in the request body and a token minted for one agent could be replayed
+against any sibling. A token carrying no tenant claim is rejected rather than treated as a
+wildcard.
+
+> **Breaking.** Requires a gateway that mints both the endpoint audience and the tenant
+> claim, and registers agents with a tenant id — looping-gateway
+> [#62](https://github.com/Looping-AI/looping-gateway/pull/62). The two sides do not
+> interoperate across this change in either direction, so they deploy together and
+> registered agents are re-registered.
 
 ### 3. Build the runtime in your Durable Object
 
@@ -207,10 +269,40 @@ its cause.
 The contract is **additive-only within a major**: new capabilities arrive as optional
 fields on `AgentPlugin`.
 
-The one session hook core offers is `onMessagesDisplaced` — the raw messages a compaction
-is about to fold into a summary. Core performs the compaction, so core announces the loss;
-it neither stores the messages nor knows who wants them. An episodic-memory plugin, an
-audit log, and a cold-storage dump all want exactly this callback, and each gets it:
+### Plugin-owned tables
+
+A plugin owns its tables outright, through `store: PluginStore` — but it must stay out of
+core's migration journal. `drizzle-orm/durable-sqlite/migrator` keeps one flat integer
+journal and one global `__drizzle_migrations` table, and two independently-versioned
+packages cannot share that index space.
+
+That is a prohibition on exactly **one import**, not on drizzle. The query builder holds
+no journal and no connection state, so a plugin declares its tables with `sqliteTable`,
+writes idempotent DDL in `ensureTables`, and queries through its own handle:
+
+```ts
+export const scrapes = sqliteTable("scraper_scrapes", { url: text("url").primaryKey() });
+
+store: {
+  plugin: "scraper",
+  version: 1,
+  // Re-run on every hibernation wake-up, so it must be idempotent.
+  ensureTables: (sql) => sql.exec(`CREATE TABLE IF NOT EXISTS scraper_scrapes (…)`)
+}
+
+// …and anywhere the plugin queries:
+const db = drizzle(storage, { schema: { scrapes } });
+```
+
+Core records each store's version in a `plugin_migrations` row, so `ensureTables` receives
+the version last seen on disk and an upgrade path can branch on it.
+
+### Session hooks
+
+`onMessagesDisplaced` hands over the raw messages a compaction is about to fold into a
+summary. Core performs the compaction, so core announces the loss; it neither stores the
+messages nor knows who wants them. An episodic-memory plugin, an audit log, and a
+cold-storage dump all want exactly this callback, and each gets it:
 
 ```ts
 // in your DO, wiring the runtime's fan-out into the session
@@ -224,6 +316,30 @@ Best-effort in both directions — a listener that throws never aborts compactio
 must still shorten when a side store is down), and the fan-out is `Promise.allSettled`, so
 one plugin's outage cannot cost another its notification.
 
+`shouldHandleTurn` is the other side of the session: a gate that decides whether a turn
+runs at all, before the loop builds or calls anything. An agent that sees every message in
+its channels is mostly seeing messages that are not for it, and asking a model already
+trying to be helpful to stay quiet degrades _invisibly_ — failing to call a decline-tool
+looks identical to deciding not to. Every declaring plugin is consulted and the answers are
+AND-ed, so any one gate may decline.
+
+```ts
+if (!(await this.runtime.shouldHandleTurn({ history }))) return; // declined
+```
+
+It **fails open**: a gate that throws is counted as `true`. The two mistakes are not
+symmetric — a wrong reply is noise the user can see and ignore, while a wrong silence is
+invisible to the person who needed an answer.
+
+### The workspace backend
+
+Core declares the `WorkspaceBacking` shape and enforces the caps, but ships no backend —
+the predecessor's was `@cloudflare/shell`, which is experimental, and an agent that never
+delegates file work should not carry it. A plugin supplies one via `workspaceBacking`; at
+most one may, and an agent that installs none gets `memoryWorkspaceBacking`. So
+`runtime.workspaceBacking` is always defined and your `SubagentRuntime` never needs a null
+check.
+
 ---
 
 ## Testing

package/dist/a2a/card.d.ts

@@ -33,6 +33,18 @@ export interface BuildCardOptions {
     origin: string;
     /** Path this agent answers JSON-RPC on. Defaults to {@link A2A_RPC_PATH}. */
     rpcPath?: string;
+    /**
+     * The tenant this card describes, advertised on its interface entry.
+     *
+     * Several agents share one endpoint here, so `tenant` is what says *which*
+     * one — A2A spec §8.3.2 requires a client to echo the declared value on every
+     * request, and this Worker refuses a request that does not.
+     *
+     * Omitted for the **root stub card**, which describes the origin rather than
+     * any agent: it advertises the endpoint and `extendedAgentCard`, and a caller
+     * reaches a real agent by asking for its tenant.
+     */
+    tenant?: string;
     /**
      * Advertise the gateway's Bearer-JWT scheme in `securitySchemes`.
      *
@@ -93,6 +105,29 @@ export declare function buildBaseCard(manifest: AgentManifest, opts: BuildCardOp
  * (Trust-On-First-Use).
  */
 export declare function signCard(card: AgentCard, cfg: CardSigningConfig): Promise<WireAgentCard>;
+/**
+ * The same signature, attached to the **in-memory** card instead of the wire
+ * one — for a caller that hands the card to something which will encode it
+ * itself.
+ *
+ * That caller is `GetExtendedAgentCard`. The SDK's JSON-RPC transport runs
+ * `AgentCard.toJSON()` over whatever the extended-card provider returns, so
+ * returning {@link signCard}'s wire card means `toJSON` runs over a document
+ * that has already been encoded. For most cards that is a no-op and looks fine
+ * — which is the trap. `securitySchemes` is a protobuf *oneof*: encoding it
+ * twice collapses `{ gatewayJwt: { httpAuthSecurityScheme: … } }` to
+ * `{ gatewayJwt: {} }`, the served document stops matching the one that was
+ * signed, and every signature verification fails.
+ *
+ * So the double encode is latent today only because
+ * {@link BuildCardOptions.advertiseSecuritySchemes} defaults to `false`; it
+ * would surface the day that flag is flipped, as a signature failure with
+ * nothing pointing back here. Returning the in-memory card lets the SDK do the
+ * single encode the signature was computed over, and is correct either way.
+ *
+ * `card.spec.ts` pins both halves.
+ */
+export declare function signCardInPlace(card: AgentCard, cfg: CardSigningConfig): Promise<AgentCard>;
 /**
  * The card's protobuf-JSON encoding. Typed back as `AgentCard` for the SDK
  * signer, which is generic over "the document to canonicalize" rather than over

package/dist/a2a/card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"card.d.ts","sourceRoot":"","sources":["../../src/a2a/card.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,SAAS,EAEV,MAAM,aAAa,CAAC;AAKrB,iFAAiF;AACjF,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,SAAS,EACP,MAAM,GACN,aAAa,GACb,SAAS,GACT,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,QAAQ,CACX,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,UAAU,EAAE,GAAG,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAUD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,gBAAgB,GACrB,SAAS,CAiCX;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,aAAa,CAAC,CASxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAI5E;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,UAAU,EAAE,GAAG,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IACjE,IAAI,EAAE,GAAG,EAAE,CAAC;CACb,CAIA"}
+{"version":3,"file":"card.d.ts","sourceRoot":"","sources":["../../src/a2a/card.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,SAAS,EAEV,MAAM,aAAa,CAAC;AAKrB,iFAAiF;AACjF,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,SAAS,EACP,MAAM,GACN,aAAa,GACb,SAAS,GACT,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,QAAQ,CACX,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,UAAU,EAAE,GAAG,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAUD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,gBAAgB,GACrB,SAAS,CA6CX;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,aAAa,CAAC,CASxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,SAAS,CAAC,CAGpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAI5E;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,UAAU,EAAE,GAAG,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IACjE,IAAI,EAAE,GAAG,EAAE,CAAC;CACb,CAIA"}

package/dist/a2a/card.js

@@ -24,14 +24,26 @@ export function buildBaseCard(manifest, opts) {
     const rpcPath = opts.rpcPath ?? A2A_RPC_PATH;
     return {
         ...manifest,
+        capabilities: {
+            // `extensions` is required on the proto type but absent from most
+            // hand-written manifests, so it is defaulted before the spread rather
+            // than after — a manifest that declares extensions keeps them.
+            extensions: [],
+            ...manifest.capabilities,
+            // Forced on, not inherited from the manifest: an agent here is *only*
+            // reachable as a tenant, and its card *only* through
+            // `GetExtendedAgentCard`. The SDK gates that method on this flag, reading
+            // it off whichever card the request handler was built with (spec §3.3.4 —
+            // it MUST return `UnsupportedOperationError` when unset), so every card
+            // this Worker serves has to carry it, the stub and the tenants alike.
+            extendedAgentCard: true
+        },
         supportedInterfaces: [
             {
                 url: `${opts.origin}${rpcPath}`,
                 protocolBinding: "JSONRPC",
                 protocolVersion: A2A_PROTOCOL_VERSION,
-                // Single-tenant agent: one DO per verified gateway identity, so the
-                // protocol-level tenant slot goes unused.
-                tenant: ""
+                tenant: opts.tenant ?? ""
             }
         ],
         provider: undefined,
@@ -82,6 +94,32 @@ export async function signCard(card, cfg) {
     const signed = await sign(wireCard(card));
     return signed;
 }
+/**
+ * The same signature, attached to the **in-memory** card instead of the wire
+ * one — for a caller that hands the card to something which will encode it
+ * itself.
+ *
+ * That caller is `GetExtendedAgentCard`. The SDK's JSON-RPC transport runs
+ * `AgentCard.toJSON()` over whatever the extended-card provider returns, so
+ * returning {@link signCard}'s wire card means `toJSON` runs over a document
+ * that has already been encoded. For most cards that is a no-op and looks fine
+ * — which is the trap. `securitySchemes` is a protobuf *oneof*: encoding it
+ * twice collapses `{ gatewayJwt: { httpAuthSecurityScheme: … } }` to
+ * `{ gatewayJwt: {} }`, the served document stops matching the one that was
+ * signed, and every signature verification fails.
+ *
+ * So the double encode is latent today only because
+ * {@link BuildCardOptions.advertiseSecuritySchemes} defaults to `false`; it
+ * would surface the day that flag is flipped, as a signature failure with
+ * nothing pointing back here. Returning the in-memory card lets the SDK do the
+ * single encode the signature was computed over, and is correct either way.
+ *
+ * `card.spec.ts` pins both halves.
+ */
+export async function signCardInPlace(card, cfg) {
+    const signed = await signCard(card, cfg);
+    return { ...card, signatures: signed.signatures };
+}
 /**
  * The card's protobuf-JSON encoding. Typed back as `AgentCard` for the SDK
  * signer, which is generic over "the document to canonicalize" rather than over

package/dist/a2a/card.js.map

@@ -1 +1 @@
-{"version":3,"file":"card.js","sourceRoot":"","sources":["../../src/a2a/card.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,SAAS,EACT,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AA0EnC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAuB,EACvB,IAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC;IAC7C,OAAO;QACL,GAAG,QAAQ;QACX,mBAAmB,EAAE;YACnB;gBACE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE;gBAC/B,eAAe,EAAE,SAAS;gBAC1B,eAAe,EAAE,oBAAoB;gBACrC,oEAAoE;gBACpE,0CAA0C;gBAC1C,MAAM,EAAE,EAAE;aACX;SACF;QACD,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,SAAS;QAC3B,OAAO,EAAE,SAAS;QAClB,eAAe,EAAE,IAAI,CAAC,wBAAwB;YAC5C,CAAC,CAAC;gBACE,CAAC,iBAAiB,CAAC,EAAE;oBACnB,MAAM,EAAE;wBACN,KAAK,EAAE,wBAAwB;wBAC/B,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE;qBAClE;iBACF;aACF;YACH,CAAC,CAAC,EAAE;QACN,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,oBAAoB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC1E,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAe,EACf,GAAsB;IAEtB,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,UAAU,EAAE;QACtD,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG;QACvB,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAkC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAe;IACtC,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAc,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACtE,OAAO,GAAsC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,UAAiC;IAG9D,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC;IACrC,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"card.js","sourceRoot":"","sources":["../../src/a2a/card.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,SAAS,EACT,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAsFnC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAuB,EACvB,IAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC;IAC7C,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ,kEAAkE;YAClE,sEAAsE;YACtE,+DAA+D;YAC/D,UAAU,EAAE,EAAE;YACd,GAAG,QAAQ,CAAC,YAAY;YACxB,sEAAsE;YACtE,qDAAqD;YACrD,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,iBAAiB,EAAE,IAAI;SACxB;QACD,mBAAmB,EAAE;YACnB;gBACE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE;gBAC/B,eAAe,EAAE,SAAS;gBAC1B,eAAe,EAAE,oBAAoB;gBACrC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;aAC1B;SACF;QACD,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,SAAS;QAC3B,OAAO,EAAE,SAAS;QAClB,eAAe,EAAE,IAAI,CAAC,wBAAwB;YAC5C,CAAC,CAAC;gBACE,CAAC,iBAAiB,CAAC,EAAE;oBACnB,MAAM,EAAE;wBACN,KAAK,EAAE,wBAAwB;wBAC/B,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE;qBAClE;iBACF;aACF;YACH,CAAC,CAAC,EAAE;QACN,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,oBAAoB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC1E,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAe,EACf,GAAsB;IAEtB,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,UAAU,EAAE;QACtD,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG;QACvB,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAkC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,GAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAqC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAe;IACtC,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAc,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACtE,OAAO,GAAsC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,UAAiC;IAG9D,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC;IACrC,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC"}

package/dist/a2a/context.d.ts

@@ -5,10 +5,16 @@ import type { GatewayIdentity } from "./verify.js";
  * stashes the raw headers in the context's state bag, so an executor can reach
  * them the same way it would under the Express binding.
  *
- * `tenant` is deliberately unset: one agent DO instance *is* the tenant, keyed
- * by the verified caller, so there is no second axis to scope on.
+ * `tenant` names which agent on this origin the call is for. The SDK's
+ * `JsonRpcTransportHandler` would also lift it off `params.tenant` on its own,
+ * but only when the context arrives without one — so passing it here is not
+ * redundant: this Worker has already parsed, authorized and routed on the
+ * tenant before a handler exists to receive the context, and setting it keeps
+ * the value the executor and task store see identical to the one that chose
+ * them. It is also what reaches the extended-card provider, which the SDK calls
+ * with the context alone.
  */
-export declare function buildCallContext(request: Request, identity: GatewayIdentity): ServerCallContext;
+export declare function buildCallContext(request: Request, identity: GatewayIdentity, tenant: string): ServerCallContext;
 /** Echo back the extensions the handler actually activated (spec §14.2.2). */
 export declare function extensionHeaders(context: ServerCallContext): HeadersInit;
 //# sourceMappingURL=context.d.ts.map

package/dist/a2a/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/a2a/context.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA6BnD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,eAAe,GACxB,iBAAiB,CAYnB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,CAIxE"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/a2a/context.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA6BnD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,MAAM,GACb,iBAAiB,CAanB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,CAIxE"}

package/dist/a2a/context.js

@@ -31,10 +31,16 @@ class GatewayUser {
  * stashes the raw headers in the context's state bag, so an executor can reach
  * them the same way it would under the Express binding.
  *
- * `tenant` is deliberately unset: one agent DO instance *is* the tenant, keyed
- * by the verified caller, so there is no second axis to scope on.
+ * `tenant` names which agent on this origin the call is for. The SDK's
+ * `JsonRpcTransportHandler` would also lift it off `params.tenant` on its own,
+ * but only when the context arrives without one — so passing it here is not
+ * redundant: this Worker has already parsed, authorized and routed on the
+ * tenant before a handler exists to receive the context, and setting it keeps
+ * the value the executor and task store see identical to the one that chose
+ * them. It is also what reaches the extended-card provider, which the SDK calls
+ * with the context alone.
  */
-export function buildCallContext(request, identity) {
+export function buildCallContext(request, identity, tenant) {
     const headers = {};
     for (const [name, value] of request.headers)
         headers[name] = value;
@@ -42,7 +48,8 @@ export function buildCallContext(request, identity) {
         extensions: Extensions.parseServiceParameter(request.headers.get(HTTP_EXTENSION_HEADER) ?? undefined),
         user: new GatewayUser(identity),
         headers,
-        requestedVersion: request.headers.get(A2A_VERSION_HEADER) ?? undefined
+        requestedVersion: request.headers.get(A2A_VERSION_HEADER) ?? undefined,
+        tenant
     });
 }
 /** Echo back the extensions the handler actually activated (spec §14.2.2). */

package/dist/a2a/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/a2a/context.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,+BAA+B,EAIhC,MAAM,oBAAoB,CAAC;AAG5B;;;;;;GAMG;AAEH;;;;;GAKG;AACH,MAAM,WAAW;IACc;IAA7B,YAA6B,QAAyB;QAAzB,aAAQ,GAAR,QAAQ,CAAiB;IAAG,CAAC;IAE1D,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ;QACV,yEAAyE;QACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgB,EAChB,QAAyB;IAEzB,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAEnE,OAAO,+BAA+B,CAAC;QACrC,UAAU,EAAE,UAAU,CAAC,qBAAqB,CAC1C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,SAAS,CACxD;QACD,IAAI,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC;QAC/B,OAAO;QACP,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS;KACvE,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAC9C,IAAI,CAAC,SAAS,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,EAAE,CAAC,qBAAqB,CAAC,EAAE,UAAU,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/a2a/context.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,+BAA+B,EAIhC,MAAM,oBAAoB,CAAC;AAG5B;;;;;;GAMG;AAEH;;;;;GAKG;AACH,MAAM,WAAW;IACc;IAA7B,YAA6B,QAAyB;QAAzB,aAAQ,GAAR,QAAQ,CAAiB;IAAG,CAAC;IAE1D,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ;QACV,yEAAyE;QACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgB,EAChB,QAAyB,EACzB,MAAc;IAEd,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAEnE,OAAO,+BAA+B,CAAC;QACrC,UAAU,EAAE,UAAU,CAAC,qBAAqB,CAC1C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,SAAS,CACxD;QACD,IAAI,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC;QAC/B,OAAO;QACP,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS;QACtE,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAC9C,IAAI,CAAC,SAAS,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,EAAE,CAAC,qBAAqB,CAAC,EAAE,UAAU,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;AAC/E,CAAC"}

package/dist/a2a/index.d.ts

@@ -6,7 +6,7 @@
  * narrowed task types that survive Durable Object RPC. Nothing here knows what an
  * agent *does* — past {@link A2AExecutor} everything is plain strings.
  */
-export { IDENTITY_CLAIM, GatewayAuthError, bearerToken, normalizeGatewayOrigins, verifyGatewayToken, type GatewayIdentity, type VerifyOptions } from "./verify.js";
+export { IDENTITY_CLAIM, TENANT_CLAIM, GatewayAuthError, bearerToken, normalizeGatewayOrigins, verifyGatewayToken, type GatewayIdentity, type VerifyOptions } from "./verify.js";
 export { A2A_RPC_PATH, buildBaseCard, signCard, wireCard, parsePrivateJwk, publicCardJwks, type AgentManifest, type BuildCardOptions, type CardSigningConfig, type WireAgentCard } from "./card.js";
 export { NOTIFICATION_TOKEN_HEADER, buildSubmittedTask, buildWorkingTask, buildCompletedTask, buildFailedTask, buildNoReplyCompletedTask, signCallbackJwt, postNotification } from "./notify.js";
 export { taskStateLabel, type PlainArtifact, type PlainMessage, type PlainPart, type PlainStatus, type PlainTask } from "./task.js";

package/dist/a2a/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,QAAQ,EACR,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,aAAa,EACb,SAAS,EACT,YAAY,EACZ,aAAa,EACd,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,QAAQ,EACR,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,aAAa,EACb,SAAS,EACT,YAAY,EACZ,aAAa,EACd,MAAM,iBAAiB,CAAC"}

package/dist/a2a/index.js

@@ -6,7 +6,7 @@
  * narrowed task types that survive Durable Object RPC. Nothing here knows what an
  * agent *does* — past {@link A2AExecutor} everything is plain strings.
  */
-export { IDENTITY_CLAIM, GatewayAuthError, bearerToken, normalizeGatewayOrigins, verifyGatewayToken } from "./verify.js";
+export { IDENTITY_CLAIM, TENANT_CLAIM, GatewayAuthError, bearerToken, normalizeGatewayOrigins, verifyGatewayToken } from "./verify.js";
 export { A2A_RPC_PATH, buildBaseCard, signCard, wireCard, parsePrivateJwk, publicCardJwks } from "./card.js";
 export { NOTIFICATION_TOKEN_HEADER, buildSubmittedTask, buildWorkingTask, buildCompletedTask, buildFailedTask, buildNoReplyCompletedTask, signCallbackJwt, postNotification } from "./notify.js";
 export { taskStateLabel } from "./task.js";

package/dist/a2a/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAGnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,cAAc,EAKf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,cAAc,EAMf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,QAAQ,EACR,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EAIpB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAGnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,cAAc,EAKf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,cAAc,EAMf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,QAAQ,EACR,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EAIpB,MAAM,eAAe,CAAC"}

package/dist/a2a/notify.d.ts

@@ -29,10 +29,19 @@ export declare function buildNoReplyCompletedTask(taskId: string, contextId: str
 /**
  * A non-terminal `working` Task snapshot carrying an intermediate content message.
  * Streamed live from the DO as the tool loop emits content before the final reply.
- * `messageId` is derived from `${taskId}:${stepIndex}` — stable across re-runs (see
+ *
+ * `messageId` is derived from `${taskId}:${key}` — stable across re-runs (see
  * {@link agentTextMessage}) so the gateway dedupes correctly on workflow replay.
+ *
+ * `key` is a **semantic** string, not a step counter, and the distinction is
+ * load-bearing: an agent that runs several rounds per task emits progress from
+ * each, so a bare index makes round 0's third step and round 1's third step the
+ * same message to the gateway — it dedupes the second away and the user watches
+ * a task go quiet. A caller that genuinely has one flat sequence can pass
+ * `String(i)`; one with rounds should key on both (`r1:step:3`), and milestones
+ * on what they are (`ack:1`).
  */
-export declare function buildWorkingTask(taskId: string, contextId: string, text: string, stepIndex: number): PlainTask;
+export declare function buildWorkingTask(taskId: string, contextId: string, text: string, key: string): PlainTask;
 /**
  * The terminal `completed` Task POSTed to the gateway callback. The `messageId` is
  * deterministic (`${taskId}:final`, not a fresh UUID) because this is built in the

package/dist/a2a/notify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/a2a/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAa,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAqB3C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAqCpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,SAAS,CAEX;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,SAAS,CAEX;AAwBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,SAAS,CAQX;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,SAAS,CAQX;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,SAAS,CAQX;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,GAAG,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACjC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,CAAC,CAanB"}
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/a2a/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAa,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAqB3C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAqCpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,SAAS,CAEX;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,SAAS,CAEX;AAwBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,SAAS,CAQX;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,SAAS,CAQX;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,SAAS,CAQX;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,GAAG,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACjC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,CAAC,CAanB"}

package/dist/a2a/notify.js

@@ -94,11 +94,20 @@ function buildTaskUpdate(taskId, contextId, state, text, messageId) {
 /**
  * A non-terminal `working` Task snapshot carrying an intermediate content message.
  * Streamed live from the DO as the tool loop emits content before the final reply.
- * `messageId` is derived from `${taskId}:${stepIndex}` — stable across re-runs (see
+ *
+ * `messageId` is derived from `${taskId}:${key}` — stable across re-runs (see
  * {@link agentTextMessage}) so the gateway dedupes correctly on workflow replay.
+ *
+ * `key` is a **semantic** string, not a step counter, and the distinction is
+ * load-bearing: an agent that runs several rounds per task emits progress from
+ * each, so a bare index makes round 0's third step and round 1's third step the
+ * same message to the gateway — it dedupes the second away and the user watches
+ * a task go quiet. A caller that genuinely has one flat sequence can pass
+ * `String(i)`; one with rounds should key on both (`r1:step:3`), and milestones
+ * on what they are (`ack:1`).
  */
-export function buildWorkingTask(taskId, contextId, text, stepIndex) {
-    return buildTaskUpdate(taskId, contextId, TaskState.TASK_STATE_WORKING, text, `${taskId}:${stepIndex}`);
+export function buildWorkingTask(taskId, contextId, text, key) {
+    return buildTaskUpdate(taskId, contextId, TaskState.TASK_STATE_WORKING, text, `${taskId}:${key}`);
 }
 /**
  * The terminal `completed` Task POSTed to the gateway callback. The `messageId` is

package/dist/a2a/notify.js.map

@@ -1 +1 @@
-{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/a2a/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,SAAS,EAAa,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AAEH,+DAA+D;AAC/D,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAEpE;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,IAAI,4BAA4B,EAAE,CAAC;AAE3D,4FAA4F;AAC5F,SAAS,aAAa,CACpB,MAAc,EACd,SAAiB,EACjB,KAAgB;IAEhB,OAAO;QACL,EAAE,EAAE,MAAM;QACV,SAAS;QACT,MAAM,EAAE;YACN,KAAK;YACL,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;QACD,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB;IAEjB,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,SAAiB;IAEjB,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,MAAc,EACd,SAAiB,EACjB,KAAgB,EAChB,IAAY,EACZ,SAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,gBAAgB,CAAC;QACrC,SAAS;QACT,IAAI;QACJ,SAAS;QACT,MAAM;KACP,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,SAAiB,EACjB,IAAY,EACZ,SAAiB;IAEjB,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,kBAAkB,EAC5B,IAAI,EACJ,GAAG,MAAM,IAAI,SAAS,EAAE,CACzB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB,EACjB,KAAa;IAEb,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,oBAAoB,EAC9B,KAAK,EACL,GAAG,MAAM,QAAQ,CAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,SAAiB,EACjB,IAAY;IAEZ,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,iBAAiB,EAC3B,IAAI,EACJ,GAAG,MAAM,QAAQ,CAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAiC,EACjC,IAAkC;IAElC,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACpE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;SACrB,WAAW,EAAE;SACb,iBAAiB,CAAC,kBAAkB,CAAC;SACrC,IAAI,CAAC,UAAU,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,KAAa,EACb,GAAW,EACX,IAAU;IAEV,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC;QACtD,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;KACxC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,GAAG,EAAE;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,WAAW;YAC3B,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,CAAC,yBAAyB,CAAC,EAAE,KAAK;SACnC;QACD,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/a2a/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,SAAS,EAAa,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AAEH,+DAA+D;AAC/D,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAEpE;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,IAAI,4BAA4B,EAAE,CAAC;AAE3D,4FAA4F;AAC5F,SAAS,aAAa,CACpB,MAAc,EACd,SAAiB,EACjB,KAAgB;IAEhB,OAAO;QACL,EAAE,EAAE,MAAM;QACV,SAAS;QACT,MAAM,EAAE;YACN,KAAK;YACL,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;QACD,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB;IAEjB,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,SAAiB;IAEjB,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,MAAc,EACd,SAAiB,EACjB,KAAgB,EAChB,IAAY,EACZ,SAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,gBAAgB,CAAC;QACrC,SAAS;QACT,IAAI;QACJ,SAAS;QACT,MAAM;KACP,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,SAAiB,EACjB,IAAY,EACZ,GAAW;IAEX,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,kBAAkB,EAC5B,IAAI,EACJ,GAAG,MAAM,IAAI,GAAG,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB,EACjB,KAAa;IAEb,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,oBAAoB,EAC9B,KAAK,EACL,GAAG,MAAM,QAAQ,CAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,SAAiB,EACjB,IAAY;IAEZ,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,iBAAiB,EAC3B,IAAI,EACJ,GAAG,MAAM,QAAQ,CAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAiC,EACjC,IAAkC;IAElC,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACpE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;SACrB,WAAW,EAAE;SACb,iBAAiB,CAAC,kBAAkB,CAAC;SACrC,IAAI,CAAC,UAAU,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,KAAa,EACb,GAAW,EACX,IAAU;IAEV,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC;QACtD,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;KACxC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,GAAG,EAAE;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,WAAW;YAC3B,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,CAAC,yBAAyB,CAAC,EAAE,KAAK;SACnC;QACD,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/a2a/verify.d.ts

@@ -6,7 +6,20 @@ import { type JWTPayload } from "jose";
  * isn't behind looping-gateway; the default is the Looping namespace so an
  * agent built on this package needs no configuration to interoperate.
  */
-export declare const IDENTITY_CLAIM = "https://looping.ai/identity";
+export declare const IDENTITY_CLAIM = "https://loopingai.org/identity";
+/**
+ * Default namespaced claim naming the **tenant** the gateway minted this token
+ * for — which of the agents on this origin it authorizes the call to reach.
+ *
+ * Several agents share one endpoint, so they also share an `aud`: the audience
+ * proves the token was minted for *this deployment*, and can say nothing about
+ * which agent on it. This claim is the only thing that can, which is why the
+ * Worker refuses a token that omits it rather than falling back to a default.
+ * Without it `tenant` would be an unauthenticated field in the request body,
+ * and a token legitimately issued for one agent could be replayed against any
+ * of its siblings.
+ */
+export declare const TENANT_CLAIM = "https://loopingai.org/tenant";
 /**
  * The gateway-agent instance identity forwarded by the gateway — i.e. which
  * registered agent instance dispatched this call, not the human end user.
@@ -41,6 +54,8 @@ export interface VerifyOptions {
     audience: string;
     /** Claim carrying the caller identity. Defaults to {@link IDENTITY_CLAIM}. */
     identityClaim?: string;
+    /** Claim carrying the authorized tenant. Defaults to {@link TENANT_CLAIM}. */
+    tenantClaim?: string;
 }
 /**
  * Normalize configured gateway origins to the HTTPS origins emitted in gateway
@@ -49,16 +64,22 @@ export interface VerifyOptions {
  */
 export declare function normalizeGatewayOrigins(origins: string[]): string[];
 /**
- * Verify a gateway JWT and return its payload + parsed identity.
+ * Verify a gateway JWT and return its payload, parsed identity and authorized
+ * tenant.
  *
  * The `jku` JWK Set URL is read directly from the token's protected header
  * (RFC 7515 §4.1.2) and validated against the allowlist before fetching, so no
  * separate JWKS URL configuration is needed on the remote side.
  *
+ * `tenant` is returned rather than enforced: this function stays a pure
+ * signature/origin question, and only the caller knows which tenant the request
+ * actually addressed. {@link createA2AWorker} compares the two.
+ *
  * Throws {@link GatewayAuthError} on any failure.
  */
 export declare function verifyGatewayToken(token: string, opts: VerifyOptions): Promise<{
     payload: JWTPayload;
     identity: GatewayIdentity;
+    tenant: string;
 }>;
 //# sourceMappingURL=verify.d.ts.map

package/dist/a2a/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AAyBd;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,gCAAgC,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oEAAoE;AACpE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAcD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAenE;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,CAAC,CAyC7D"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AAyBd;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,mCAAmC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,iCAAiC,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oEAAoE;AACpE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAcD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAenE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IACT,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CA8CD"}

package/dist/a2a/verify.js

@@ -27,7 +27,20 @@ const ALG = "EdDSA";
  * isn't behind looping-gateway; the default is the Looping namespace so an
  * agent built on this package needs no configuration to interoperate.
  */
-export const IDENTITY_CLAIM = "https://looping.ai/identity";
+export const IDENTITY_CLAIM = "https://loopingai.org/identity";
+/**
+ * Default namespaced claim naming the **tenant** the gateway minted this token
+ * for — which of the agents on this origin it authorizes the call to reach.
+ *
+ * Several agents share one endpoint, so they also share an `aud`: the audience
+ * proves the token was minted for *this deployment*, and can say nothing about
+ * which agent on it. This claim is the only thing that can, which is why the
+ * Worker refuses a token that omits it rather than falling back to a default.
+ * Without it `tenant` would be an unauthenticated field in the request body,
+ * and a token legitimately issued for one agent could be replayed against any
+ * of its siblings.
+ */
+export const TENANT_CLAIM = "https://loopingai.org/tenant";
 /** Thrown when a gateway token is missing or fails verification. */
 export class GatewayAuthError extends Error {
     constructor(message) {
@@ -73,12 +86,17 @@ export function normalizeGatewayOrigins(origins) {
     });
 }
 /**
- * Verify a gateway JWT and return its payload + parsed identity.
+ * Verify a gateway JWT and return its payload, parsed identity and authorized
+ * tenant.
  *
  * The `jku` JWK Set URL is read directly from the token's protected header
  * (RFC 7515 §4.1.2) and validated against the allowlist before fetching, so no
  * separate JWKS URL configuration is needed on the remote side.
  *
+ * `tenant` is returned rather than enforced: this function stays a pure
+ * signature/origin question, and only the caller knows which tenant the request
+ * actually addressed. {@link createA2AWorker} compares the two.
+ *
  * Throws {@link GatewayAuthError} on any failure.
  */
 export async function verifyGatewayToken(token, opts) {
@@ -111,7 +129,12 @@ export async function verifyGatewayToken(token, opts) {
         });
         const claim = opts.identityClaim ?? IDENTITY_CLAIM;
         const identity = payload[claim] ?? {};
-        return { payload, identity };
+        const tenant = payload[opts.tenantClaim ?? TENANT_CLAIM];
+        return {
+            payload,
+            identity,
+            tenant: typeof tenant === "string" ? tenant : ""
+        };
     }
     catch (err) {
         if (err instanceof GatewayAuthError)

package/dist/a2a/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,qBAAqB,EACrB,SAAS,EAEV,MAAM,MAAM,CAAC;AAEd;;;;;;;;;;;;;;;;;;GAkBG;AAEH,+DAA+D;AAC/D,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAyB5D,oEAAoE;AACpE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAC3E,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,MAAM,MAAM,OAAO,EAAE,CACzD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,IAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAqB,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,yCAAyC,CAClE,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,gCAAgC,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACvD,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,GAAG,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC;QACnD,MAAM,QAAQ,GAAI,OAAO,CAAC,KAAK,CAAiC,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,MAAM,IAAI,gBAAgB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,qBAAqB,EACrB,SAAS,EAEV,MAAM,MAAM,CAAC;AAEd;;;;;;;;;;;;;;;;;;GAkBG;AAEH,+DAA+D;AAC/D,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAyB3D,oEAAoE;AACpE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAC3E,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,MAAM,MAAM,OAAO,EAAE,CACzD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,IAAmB;IAMnB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAqB,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,yCAAyC,CAClE,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,gCAAgC,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACvD,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,GAAG,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC;QACnD,MAAM,QAAQ,GAAI,OAAO,CAAC,KAAK,CAAiC,IAAI,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;QACzD,OAAO;YACL,OAAO;YACP,QAAQ;YACR,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACjD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,MAAM,IAAI,gBAAgB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}