@loopingai/core 0.1.1 → 0.2.0

package/dist/worker/index.d.ts

@@ -18,20 +18,134 @@ import { type A2ASecretsEnv } from "../env.js";
  *
  * No secret is ever shared in either direction: trust flows entirely on domains
  * and asymmetric (Ed25519) signatures over public JWKS.
+ *
+ * **Several agents share one Worker, addressed by `tenant`.** They share one
+ * origin, one endpoint, one signing key and one card at the well-known path;
+ * what differs is the tenant id on every request. That is the A2A mechanism for
+ * exactly this — `AgentInterface.tenant` is "an opaque string used for routing
+ * requests to a specific agent or tenant when multiple agents are served behind
+ * a single A2A endpoint", and §8.3.2 requires a client to send the value the
+ * selected interface declared.
+ *
+ * A tenant is **required on every request**. There is no default and no
+ * implicit routing: an absent tenant is an error, because guessing one would
+ * mean picking an agent the caller never named.
+ *
+ * This replaces mounting a handler per path prefix. That could not work: the
+ * card is a **well-known URI**, which RFC 8615 defines per-authority, so only
+ * one card per origin is discoverable at the registered path — a gateway
+ * resolving `…/.well-known/agent-card.json` against the origin found whichever
+ * agent owned the bare path and pinned *its* key for all of them.
+ *
+ * Three routes:
+ *
+ *  1. `GET jwksPath` — the card-signing public JWKS, resolving every card's
+ *     `jku`.
+ *  2. `GET …/.well-known/agent-card.json` — the signed **stub** card for the
+ *     origin. Matched by suffix, since that path is fixed by the spec.
+ *  3. `POST rpcPath` — gateway-authenticated JSON-RPC, routed to the named
+ *     tenant. `GetExtendedAgentCard` returns that tenant's own signed card;
+ *     everything else runs a turn against its Durable Object.
+ *
+ * Two independent checks keep one tenant's traffic out of another's:
+ * `audience` proves the token was minted for this deployment, and
+ * {@link file://../a2a/verify.ts TENANT_CLAIM} proves it was minted for *this
+ * agent on it*. The second is what makes `tenant` more than an unauthenticated
+ * routing hint in the request body.
  */
 /** Default path serving the card-signing public JWKS (the card's `jku`). */
 export declare const JWKS_PATH = "/.well-known/jwks.json";
-export interface A2AWorkerOptions {
+/** The two secrets a mount signs and verifies with, already read off `env`. */
+export interface A2ASecrets {
+    /** Ed25519 private JWK, as JSON. See {@link A2ASecretsEnv.A2A_SIGNING_KEY}. */
+    signingKey: string;
+    /** Origin allowlist. See {@link A2ASecretsEnv.GATEWAY_ORIGINS}. */
+    gatewayOrigins: string;
+}
+/** One agent served on this origin — everything that differs between tenants. */
+export interface TenantAgent {
     /** The transport-independent half of this agent's card. */
     manifest: AgentManifest;
     /** Resolve the agent DO stub for a verified caller. */
     resolveAgent: AgentResolver;
     /** Start the durable turn. Must be idempotent — see {@link TurnStarter}. */
     startTurn: TurnStarter;
+}
+export interface A2AWorkerOptions<TEnv = A2ASecretsEnv> {
+    /**
+     * The **stub** card served at the well-known path.
+     *
+     * It describes the origin, not an agent. Every agent here is a tenant and its
+     * card is reached through `GetExtendedAgentCard`, so this card exists to be
+     * the one conformant, signed AgentCard at the URI RFC 8615 and the A2A IANA
+     * registration reserve — advertising the endpoint, the protocol binding and
+     * `extendedAgentCard`.
+     *
+     * It cannot enumerate the tenants: a card carries one interface entry and
+     * spec §8.3.2 has clients take the first, so listing siblings there would
+     * just make every client address the same one. Put their names in
+     * `description` for a human, and register them out of band.
+     */
+    manifest: AgentManifest;
+    /**
+     * The agents on this origin, keyed by tenant id. At least one.
+     *
+     * The id is opaque to the protocol — "an opaque string used for routing
+     * requests to a specific agent or tenant when multiple agents are served
+     * behind a single A2A endpoint". A caller names one on every request and this
+     * Worker refuses a request that does not.
+     *
+     * The tenant chooses *which agent*; the verified `identity.key` still chooses
+     * *which instance of it*, so two callers of one tenant stay in separate
+     * Durable Objects exactly as before.
+     */
+    tenants: Record<string, TenantAgent>;
     /** Path serving the public JWKS. Defaults to {@link JWKS_PATH}. */
     jwksPath?: string;
     /** Path this agent answers JSON-RPC on. Defaults to `/a2a`. */
     rpcPath?: string;
+    /**
+     * Where to read this deployment's two secrets. Defaults to the documented
+     * names, `env.A2A_SIGNING_KEY` and `env.GATEWAY_ORIGINS`.
+     *
+     * There is **one signing key per origin**, not one per tenant: the card is
+     * per-origin now, so the key the gateway pins is too. Nothing was lost — the
+     * tenants share a Worker and an `env`, so they could always read each other's
+     * secrets, and separate keys never expressed a boundary that existed.
+     *
+     * ```ts
+     * secrets: (env) => ({
+     *   signingKey: env.AGENT_KEY,
+     *   gatewayOrigins: env.ALLOWED_GATEWAYS
+     * })
+     * ```
+     *
+     * Renaming does not weaken anything: the same key is still Ed25519, still
+     * signs the cards and every callback JWT, and its public half is still what
+     * the gateway pins. Only where it is read from changes.
+     */
+    secrets?: (env: TEnv) => A2ASecrets;
+    /**
+     * The audience a gateway JWT must carry.
+     *
+     * Defaults to this deployment's **own endpoint** — `${origin}${rpcPath}`, the
+     * same URL its cards advertise as their interface — and that default is
+     * almost certainly what you want. Setting this is for a gateway that mints
+     * something else.
+     *
+     * The audience is one half of a two-sided contract: whatever is required here
+     * has to be exactly what the calling gateway *mints*, and a mismatch is a 401
+     * on every request. looping-gateway mints
+     * `new URL(agent.a2aEndpoint).origin + pathname`, which is what this default
+     * matches.
+     *
+     * It proves the token was minted for **this deployment**, and deliberately
+     * says nothing about which agent on it — every tenant shares one endpoint and
+     * therefore one audience. {@link file://../a2a/verify.ts TENANT_CLAIM} is what
+     * separates them, and is the check to look at when reasoning about one agent
+     * spending another's token.
+     */
+    audience?: string | ((url: URL) => string);
     /**
      * Advertise `securitySchemes` on the card. **Defaults to `false`** — see
      * `BuildCardOptions.advertiseSecuritySchemes` for why, and read that note
@@ -40,6 +154,17 @@ export interface A2AWorkerOptions {
     advertiseSecuritySchemes?: boolean;
     /** Claim carrying the caller identity. Defaults to the Looping namespace. */
     identityClaim?: string;
+    /**
+     * Claim carrying the authorized tenant. Defaults to the Looping namespace.
+     *
+     * Both claim names are one side of the same contract as `audience`: whatever
+     * is named here has to be exactly what the calling gateway *mints*. Override
+     * them together, or not at all — a deployment fronted by something other than
+     * looping-gateway that renames only the identity claim keeps reading the
+     * tenant from a key its gateway never sets, and every request 401s on the
+     * empty-tenant comparison below.
+     */
+    tenantClaim?: string;
     /**
      * Require a `taskPushNotificationConfig` on every `SendMessage`.
      *
@@ -54,9 +179,23 @@ export interface A2AWorkerOptions {
  * Build the Worker `fetch` handler.
  *
  * ```ts
- * const handler = createA2AWorker({ manifest, resolveAgent: getAgent, startTurn });
+ * const handler = createA2AWorker({
+ *   manifest: hostManifest,
+ *   tenants: {
+ *     reactive: { manifest, resolveAgent: getAgent, startTurn }
+ *   }
+ * });
  * export default { fetch: handler } satisfies ExportedHandler<Env>;
  * ```
+ *
+ * Two overloads, because `secrets` is optional for exactly one shape of `env`.
+ * An `env` carrying the two documented names needs no reader; anything else has
+ * to say where its keys live, and the type system is where that gets enforced —
+ * the alternative is a `parsePrivateJwk` failure on the first request, which is
+ * both later and much harder to read.
  */
-export declare function createA2AWorker<TEnv extends A2ASecretsEnv>(options: A2AWorkerOptions): (request: Request, env: TEnv) => Promise<Response>;
+export declare function createA2AWorker<TEnv extends A2ASecretsEnv>(options: A2AWorkerOptions<TEnv>): (request: Request, env: TEnv) => Promise<Response>;
+export declare function createA2AWorker<TEnv extends object>(options: A2AWorkerOptions<TEnv> & {
+    secrets: (env: TEnv) => A2ASecrets;
+}): (request: Request, env: TEnv) => Promise<Response>;
 //# sourceMappingURL=index.d.ts.map

package/dist/worker/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAEpE;;;;;;;;;;;;;;;;GAgBG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,SAAS,2BAA2B,CAAC;AAKlD,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,QAAQ,EAAE,aAAa,CAAC;IACxB,uDAAuD;IACvD,YAAY,EAAE,aAAa,CAAC;IAC5B,4EAA4E;IAC5E,SAAS,EAAE,WAAW,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AA2ED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS,aAAa,EACxD,OAAO,EAAE,gBAAgB,GACxB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,CAsHpD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,SAAS,2BAA2B,CAAC;AAKlD,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,QAAQ,EAAE,aAAa,CAAC;IACxB,uDAAuD;IACvD,YAAY,EAAE,aAAa,CAAC;IAC5B,4EAA4E;IAC5E,SAAS,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB,CAAC,IAAI,GAAG,aAAa;IACpD;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,aAAa,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC;IACpC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC;IAC3C;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AA2ED;;;;;;;;;;;;;;;;;;GAkBG;AAEH,wBAAgB,eAAe,CAAC,IAAI,SAAS,aAAa,EACxD,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAC9B,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEtD,wBAAgB,eAAe,CAAC,IAAI,SAAS,MAAM,EACjD,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG;IAChC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC;CACpC,GACA,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC"}

package/dist/worker/index.js

@@ -1,7 +1,7 @@
 import { AGENT_CARD_PATH, SendMessageRequest } from "@a2a-js/sdk";
 import { DefaultRequestHandler, JsonRpcTransportHandler, validateVersion } from "@a2a-js/sdk/server";
 import { RequestMalformedError, toJsonRpcError } from "@a2a-js/sdk/errors";
-import { buildBaseCard, parsePrivateJwk, publicCardJwks, signCard } from "../a2a/card.js";
+import { A2A_RPC_PATH, buildBaseCard, parsePrivateJwk, publicCardJwks, signCard, signCardInPlace } from "../a2a/card.js";
 import { buildCallContext, extensionHeaders } from "../a2a/context.js";
 import { GatewayAuthError, bearerToken, verifyGatewayToken } from "../a2a/verify.js";
 import { A2AExecutor } from "../a2a/executor.js";
@@ -23,6 +23,40 @@ import { parseGatewayOrigins } from "../env.js";
  *
  * No secret is ever shared in either direction: trust flows entirely on domains
  * and asymmetric (Ed25519) signatures over public JWKS.
+ *
+ * **Several agents share one Worker, addressed by `tenant`.** They share one
+ * origin, one endpoint, one signing key and one card at the well-known path;
+ * what differs is the tenant id on every request. That is the A2A mechanism for
+ * exactly this — `AgentInterface.tenant` is "an opaque string used for routing
+ * requests to a specific agent or tenant when multiple agents are served behind
+ * a single A2A endpoint", and §8.3.2 requires a client to send the value the
+ * selected interface declared.
+ *
+ * A tenant is **required on every request**. There is no default and no
+ * implicit routing: an absent tenant is an error, because guessing one would
+ * mean picking an agent the caller never named.
+ *
+ * This replaces mounting a handler per path prefix. That could not work: the
+ * card is a **well-known URI**, which RFC 8615 defines per-authority, so only
+ * one card per origin is discoverable at the registered path — a gateway
+ * resolving `…/.well-known/agent-card.json` against the origin found whichever
+ * agent owned the bare path and pinned *its* key for all of them.
+ *
+ * Three routes:
+ *
+ *  1. `GET jwksPath` — the card-signing public JWKS, resolving every card's
+ *     `jku`.
+ *  2. `GET …/.well-known/agent-card.json` — the signed **stub** card for the
+ *     origin. Matched by suffix, since that path is fixed by the spec.
+ *  3. `POST rpcPath` — gateway-authenticated JSON-RPC, routed to the named
+ *     tenant. `GetExtendedAgentCard` returns that tenant's own signed card;
+ *     everything else runs a turn against its Durable Object.
+ *
+ * Two independent checks keep one tenant's traffic out of another's:
+ * `audience` proves the token was minted for this deployment, and
+ * {@link file://../a2a/verify.ts TENANT_CLAIM} proves it was minted for *this
+ * agent on it*. The second is what makes `tenant` more than an unauthenticated
+ * routing hint in the request body.
  */
 /** Default path serving the card-signing public JWKS (the card's `jku`). */
 export const JWKS_PATH = "/.well-known/jwks.json";
@@ -89,49 +123,90 @@ function pushConfigError(rpcBody) {
     }
     return undefined;
 }
-/**
- * Build the Worker `fetch` handler.
- *
- * ```ts
- * const handler = createA2AWorker({ manifest, resolveAgent: getAgent, startTurn });
- * export default { fetch: handler } satisfies ExportedHandler<Env>;
- * ```
- */
 export function createA2AWorker(options) {
     const jwksPath = options.jwksPath ?? JWKS_PATH;
+    const rpcPath = options.rpcPath ?? A2A_RPC_PATH;
     const requirePushConfig = options.requirePushConfig ?? true;
+    // Nothing can be served without at least one agent, and a deployment that
+    // configured none is a startup mistake rather than a per-request one.
+    const tenantIds = Object.keys(options.tenants);
+    if (tenantIds.length === 0) {
+        throw new Error("createA2AWorker requires at least one tenant");
+    }
+    // …and one registered under `""` is the same mistake wearing a disguise. A
+    // request must name a tenant, and the empty string is how "named none" is
+    // spelled, so that agent is registered and permanently unreachable — every
+    // call to it is refused as a missing tenant before the lookup ever runs. The
+    // check above would otherwise report a deployment with no routable agent as
+    // satisfying "at least one tenant".
+    if (tenantIds.some((id) => !id)) {
+        throw new Error("createA2AWorker requires every tenant id to be non-empty: a request " +
+            "names its tenant, so an agent registered under '' can never be reached");
+    }
+    // The tenant id is caller-controlled, so the lookup is by *own* property.
+    // Plain indexing reaches `Object.prototype`, and every inherited name —
+    // `toString`, `constructor`, `__proto__` — comes back truthy, so a tenant
+    // called one of those slips past an `if (!agent)` guard and only fails later
+    // when a function is read off it. That is a 500 where the whole point of the
+    // guard is a 400 naming the unknown tenant.
+    const tenantAgent = (id) => Object.hasOwn(options.tenants, id) ? options.tenants[id] : undefined;
+    // Only reachable through the first overload, which has already established
+    // that `TEnv` carries the two documented names.
+    const readSecrets = options.secrets ??
+        ((env) => ({
+            signingKey: env.A2A_SIGNING_KEY,
+            gatewayOrigins: env.GATEWAY_ORIGINS
+        }));
     return async function fetch(request, env) {
         const url = new URL(request.url);
         const origin = url.origin;
-        const privateJwk = parsePrivateJwk(env.A2A_SIGNING_KEY);
-        const cardOptions = {
+        const secrets = readSecrets(env);
+        // This agent's own endpoint, which is also exactly what its card advertises
+        // as its interface — so the value the gateway was registered with and the
+        // value checked here are the same string by construction.
+        const audience = typeof options.audience === "function"
+            ? options.audience(url)
+            : (options.audience ?? `${origin}${rpcPath}`);
+        const privateJwk = parsePrivateJwk(secrets.signingKey);
+        const signing = { privateJwk, jku: `${origin}${jwksPath}` };
+        const cardFor = (manifest, tenant) => buildBaseCard(manifest, {
             origin,
             rpcPath: options.rpcPath,
-            advertiseSecuritySchemes: options.advertiseSecuritySchemes
-        };
-        // (1) Card-signing public JWKS — resolves the card's `jku` for the gateway.
+            advertiseSecuritySchemes: options.advertiseSecuritySchemes,
+            tenant
+        });
+        // (1) Card-signing public JWKS — resolves every card's `jku` for the
+        // gateway. One key per origin, so one JWKS for every tenant.
         if (request.method === "GET" && url.pathname === jwksPath) {
             return Response.json(publicCardJwks(privateJwk), {
                 headers: { "cache-control": "public, max-age=3600" }
             });
         }
-        // (2) Signed AgentCard discovery. `signCard` returns the protobuf-JSON
-        // encoding — the exact document the signature is computed over.
+        // (2) The stub card, at the well-known path. `signCard` returns the
+        // protobuf-JSON encoding — the exact document the signature is computed
+        // over — so it is serialized here without re-encoding.
         if (request.method === "GET" && url.pathname.endsWith(AGENT_CARD_PATH)) {
-            const card = await signCard(buildBaseCard(options.manifest, cardOptions), { privateJwk, jku: `${origin}${jwksPath}` });
-            return Response.json(card);
+            return Response.json(await signCard(cardFor(options.manifest), signing));
         }
         // (3) A2A JSON-RPC — gateway-authenticated, dispatched into the caller's DO.
-        if (request.method === "POST") {
+        //
+        // Matched on `rpcPath`, not on the method alone. Accepting every POST made
+        // the path this agent advertises purely decorative: a call to any URL on the
+        // origin was served as JSON-RPC, so a mounted agent's isolation rested
+        // entirely on an outer router matching first, and a typo'd endpoint quietly
+        // worked instead of 404ing.
+        if (request.method === "POST" && url.pathname === rpcPath) {
             const token = bearerToken(request);
             if (!token)
                 return unauthorized("missing gateway bearer token");
             let identity;
+            let authorizedTenant;
             try {
-                ({ identity } = await verifyGatewayToken(token, {
-                    allowedOrigins: parseGatewayOrigins(env.GATEWAY_ORIGINS),
-                    audience: origin,
-                    identityClaim: options.identityClaim
+                ({ identity, tenant: authorizedTenant } = await verifyGatewayToken(token, {
+                    allowedOrigins: parseGatewayOrigins(secrets.gatewayOrigins),
+                    audience,
+                    identityClaim: options.identityClaim,
+                    tenantClaim: options.tenantClaim
                 }));
             }
             catch (err) {
@@ -152,8 +227,37 @@ export function createA2AWorker(options) {
             // throwing on the property reads below instead of reaching the SDK
             // handler, which maps it to the same -32602 that `[]` or a string gets.
             const rpcBody = (typeof body === "object" && body !== null ? body : {});
-            const card = buildBaseCard(options.manifest, cardOptions);
-            const context = buildCallContext(request, identity);
+            // Which agent this call is for. Read straight off the body rather than
+            // through a codec: every request message carries `tenant` in the same
+            // place, so decoding as one specific request type would mean knowing the
+            // method first, and the tenant is needed to pick the handler that would
+            // decide that.
+            const requestedTenant = rpcBody.params?.tenant ?? "";
+            if (typeof requestedTenant !== "string" || !requestedTenant) {
+                return jsonRpcErrorResponse(body, toJsonRpcError(new RequestMalformedError("params.tenant is required: this endpoint serves several agents " +
+                    "and none is the default. Use the tenant declared on the " +
+                    "interface of the agent's card (A2A §8.3.2), or call " +
+                    "GetExtendedAgentCard with it to fetch that card.")));
+            }
+            // The token names the tenant the gateway authorized; the body names the
+            // one the call addressed. They must agree.
+            //
+            // This is the check that makes `tenant` more than a routing hint. Every
+            // tenant here shares one endpoint and so one `aud`, which means the
+            // audience cannot tell them apart — without this, a token legitimately
+            // minted for one agent could be replayed against any of its siblings by
+            // editing a field in the request body. An absent claim is a rejection
+            // rather than a wildcard for the same reason.
+            if (authorizedTenant !== requestedTenant) {
+                return unauthorized(`gateway token authorizes tenant '${authorizedTenant || "<none>"}', ` +
+                    `but the request addressed '${requestedTenant}'`);
+            }
+            const agent = tenantAgent(requestedTenant);
+            if (!agent) {
+                return jsonRpcErrorResponse(body, toJsonRpcError(new RequestMalformedError(`unknown tenant '${requestedTenant}'`)));
+            }
+            const card = cardFor(agent.manifest, requestedTenant);
+            const context = buildCallContext(request, identity, requestedTenant);
             // v1.0 negotiates the protocol version per request via the `A2A-Version`
             // header, and the SDK leaves enforcement to the transport binding (its
             // Express handlers do it; this Worker is the equivalent seam). An absent
@@ -174,12 +278,31 @@ export function createA2AWorker(options) {
                     return jsonRpcErrorResponse(body, toJsonRpcError(new RequestMalformedError(contractError)));
                 }
             }
-            const handler = new DefaultRequestHandler(card, new DurableTaskStore(identity, options.resolveAgent), new A2AExecutor({
+            const handler = new DefaultRequestHandler(card, new DurableTaskStore(identity, agent.resolveAgent), new A2AExecutor({
                 identity,
                 jku: `${origin}${jwksPath}`,
-                resolveAgent: options.resolveAgent,
-                startTurn: options.startTurn
-            }));
+                resolveAgent: agent.resolveAgent,
+                startTurn: agent.startTurn
+            }), undefined, undefined, undefined, 
+            // `GetExtendedAgentCard` — how a caller gets a *tenant's* card, since
+            // only the stub is discoverable at the well-known path.
+            //
+            // Returns the in-memory card and lets the SDK encode it: its JSON-RPC
+            // transport runs `AgentCard.toJSON()` over whatever comes back, so
+            // handing it `signCard`'s already-encoded wire card would encode twice
+            // and silently break the signature. See {@link signCardInPlace}.
+            //
+            // The tenant is read off the context rather than the request params
+            // because that is all the SDK passes; it is the value this Worker
+            // already authorized and routed on.
+            async (ctx) => {
+                const requested = ctx.tenant ?? "";
+                const target = tenantAgent(requested);
+                if (!target) {
+                    throw new RequestMalformedError(`unknown tenant '${requested}'`);
+                }
+                return signCardInPlace(cardFor(target.manifest, requested), signing);
+            });
             const rpc = new JsonRpcTransportHandler(handler);
             const result = await rpc.handle(body, context);
             // Streaming is not advertised; reject async generators outright.

package/dist/worker/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,aAAa,EACb,eAAe,EACf,cAAc,EACd,QAAQ,EAET,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAEnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,WAAW,CAAC;AAEpE;;;;;;;;;;;;;;;;GAgBG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAElD,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAgC1C,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,IAAI,QAAQ,CAAC,iBAAiB,MAAM,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE;KAChE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAC3B,IAAa,EACb,KAAwC;IAExC,MAAM,EAAE,GAAI,IAA+C,EAAE,EAAE,IAAI,IAAI,CAAC;IACxE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAGxB;IACC,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAE7D,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,8CAA+C,GAAa,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;IACpE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QACrB,OAAO,CACL,uEAAuE;YACvE,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,CACL,0EAA0E;YAC1E,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oEAAoE,UAAU,CAAC,GAAG,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAyB;IAEzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC/C,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAE5D,OAAO,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,GAAS;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG;YAClB,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;SAC3D,CAAC;QAEF,4EAA4E;QAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;gBAC/C,OAAO,EAAE,EAAE,eAAe,EAAE,sBAAsB,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,EAC5C,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,QAAQ,EAAE,EAAE,CAC5C,CAAC;YACF,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,6EAA6E;QAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,8BAA8B,CAAC,CAAC;YAEhE,IAAI,QAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE;oBAC9C,cAAc,EAAE,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC;oBACxD,QAAQ,EAAE,MAAM;oBAChB,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GACX,GAAG,YAAY,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;gBACxE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAED,0EAA0E;YAC1E,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAClB,OAAO,IAAI,QAAQ,CAAC,2CAA2C,EAAE;oBAC/D,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAoC,CAAC;YACpE,2EAA2E;YAC3E,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,MAAM,OAAO,GAAG,CACd,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACb,CAAC;YAC3C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAEpD,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,cAAc;YACd,IAAI,CAAC;gBACH,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,OAAO,oBAAoB,CACzB,IAAI,EACJ,uBAAuB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAC/C,CAAC;YACJ,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAC/C,IAAI,aAAa,EAAE,CAAC;oBAClB,kEAAkE;oBAClE,OAAO,oBAAoB,CACzB,IAAI,EACJ,cAAc,CAAC,IAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC,CACzD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,qBAAqB,CACvC,IAAI,EACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EACpD,IAAI,WAAW,CAAC;gBACd,QAAQ;gBACR,GAAG,EAAE,GAAG,MAAM,GAAG,QAAQ,EAAE;gBAC3B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAE/C,iEAAiE;YACjE,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;gBACnC,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,cAAc,EACd,QAAQ,EACR,eAAe,EAEhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAEnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,WAAW,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAElD,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AA6H1C,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,IAAI,QAAQ,CAAC,iBAAiB,MAAM,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE;KAChE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAC3B,IAAa,EACb,KAAwC;IAExC,MAAM,EAAE,GAAI,IAA+C,EAAE,EAAE,IAAI,IAAI,CAAC;IACxE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAGxB;IACC,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB;QAAE,OAAO,SAAS,CAAC;IAE7D,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,8CAA+C,GAAa,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;IACpE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC;QACrB,OAAO,CACL,uEAAuE;YACvE,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,CACL,0EAA0E;YAC1E,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oEAAoE,UAAU,CAAC,GAAG,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA+BD,MAAM,UAAU,eAAe,CAC7B,OAA+B;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC;IAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAC5D,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,oCAAoC;IACpC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,WAAW,GAAG,CAAC,EAAU,EAA2B,EAAE,CAC1D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,2EAA2E;IAC3E,gDAAgD;IAChD,MAAM,WAAW,GACf,OAAO,CAAC,OAAO;QACf,CAAC,CAAC,GAAS,EAAc,EAAE,CAAC,CAAC;YAC3B,UAAU,EAAG,GAAqB,CAAC,eAAe;YAClD,cAAc,EAAG,GAAqB,CAAC,eAAe;SACvD,CAAC,CAAC,CAAC;IAEN,OAAO,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,GAAS;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,4EAA4E;QAC5E,0EAA0E;QAC1E,0DAA0D;QAC1D,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU;YACpC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,QAAQ,EAAE,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,CAAC,QAAuB,EAAE,MAAe,EAAE,EAAE,CAC3D,aAAa,CAAC,QAAQ,EAAE;YACtB,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;YAC1D,MAAM;SACP,CAAC,CAAC;QAEL,qEAAqE;QACrE,6DAA6D;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;gBAC/C,OAAO,EAAE,EAAE,eAAe,EAAE,sBAAsB,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QAED,oEAAoE;QACpE,wEAAwE;QACxE,uDAAuD;QACvD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACvE,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,6EAA6E;QAC7E,EAAE;QACF,2EAA2E;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,4EAA4E;QAC5E,4BAA4B;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,8BAA8B,CAAC,CAAC;YAEhE,IAAI,QAAyB,CAAC;YAC9B,IAAI,gBAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,kBAAkB,CAChE,KAAK,EACL;oBACE,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC;oBAC3D,QAAQ;oBACR,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GACX,GAAG,YAAY,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;gBACxE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAED,0EAA0E;YAC1E,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAClB,OAAO,IAAI,QAAQ,CAAC,2CAA2C,EAAE;oBAC/D,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAoC,CAAC;YACpE,2EAA2E;YAC3E,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,MAAM,OAAO,GAAG,CACd,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACb,CAAC;YAE3C,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,eAAe;YACf,MAAM,eAAe,GAClB,OAAO,CAAC,MAA2C,EAAE,MAAM,IAAI,EAAE,CAAC;YACrE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC5D,OAAO,oBAAoB,CACzB,IAAI,EACJ,cAAc,CACZ,IAAI,qBAAqB,CACvB,iEAAiE;oBAC/D,0DAA0D;oBAC1D,sDAAsD;oBACtD,kDAAkD,CACrD,CACF,CACF,CAAC;YACJ,CAAC;YAED,wEAAwE;YACxE,2CAA2C;YAC3C,EAAE;YACF,wEAAwE;YACxE,oEAAoE;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,8CAA8C;YAC9C,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;gBACzC,OAAO,YAAY,CACjB,oCAAoC,gBAAgB,IAAI,QAAQ,KAAK;oBACnE,8BAA8B,eAAe,GAAG,CACnD,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,oBAAoB,CACzB,IAAI,EACJ,cAAc,CACZ,IAAI,qBAAqB,CAAC,mBAAmB,eAAe,GAAG,CAAC,CACjE,CACF,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;YAErE,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,cAAc;YACd,IAAI,CAAC;gBACH,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,OAAO,oBAAoB,CACzB,IAAI,EACJ,uBAAuB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAC/C,CAAC;YACJ,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBAC/C,IAAI,aAAa,EAAE,CAAC;oBAClB,kEAAkE;oBAClE,OAAO,oBAAoB,CACzB,IAAI,EACJ,cAAc,CAAC,IAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC,CACzD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,qBAAqB,CACvC,IAAI,EACJ,IAAI,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,EAClD,IAAI,WAAW,CAAC;gBACd,QAAQ;gBACR,GAAG,EAAE,GAAG,MAAM,GAAG,QAAQ,EAAE;gBAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,EACF,SAAS,EACT,SAAS,EACT,SAAS;YACT,sEAAsE;YACtE,wDAAwD;YACxD,EAAE;YACF,sEAAsE;YACtE,mEAAmE;YACnE,uEAAuE;YACvE,iEAAiE;YACjE,EAAE;YACF,oEAAoE;YACpE,kEAAkE;YAClE,oCAAoC;YACpC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,SAAS,GAAG,CAAC,CAAC;gBACnE,CAAC;gBACD,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;YACvE,CAAC,CACF,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAE/C,iEAAiE;YACjE,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;gBACnC,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loopingai/core",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Shared, mandatory foundation for Looping agents on Cloudflare Workers: zero-trust A2A, durable task lifecycle, delegation and subagent runtime, test harness.",
   "keywords": [
     "a2a",
@@ -69,6 +69,10 @@
       "types": "./dist/testing/index.d.ts",
       "import": "./dist/testing/index.js"
     },
+    "./testing/fixtures": {
+      "types": "./dist/testing/fixtures.d.ts",
+      "import": "./dist/testing/fixtures.js"
+    },
     "./testing/node": {
       "types": "./dist/testing/node.d.ts",
       "import": "./dist/testing/node.js"
@@ -102,13 +106,17 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
+    "@cloudflare/vitest-pool-workers": "^0.18.8",
     "agents": "^0.20.0",
     "ai": "^7.0.40",
-    "undici": ">=8",
+    "undici": "^7.28.0",
     "vitest": ">=4",
     "workers-ai-provider": "^4.0.0"
   },
   "peerDependenciesMeta": {
+    "@cloudflare/vitest-pool-workers": {
+      "optional": true
+    },
     "undici": {
       "optional": true
     },
@@ -117,7 +125,7 @@
     }
   },
   "devDependencies": {
-    "@cloudflare/vitest-pool-workers": "^0.20.1",
+    "@cloudflare/vitest-pool-workers": "^0.18.8",
     "@types/node": "^26.1.1",
     "agents": "^0.20.0",
     "ai": "^7.0.40",
@@ -126,7 +134,7 @@
     "prettier": "^3.9.6",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.65.0",
-    "undici": "8.9.0",
+    "undici": "7.28.0",
     "vitest": "^4.1.10",
     "workers-ai-provider": "^4.0.0",
     "wrangler": "^4.114.0"