@loopingai/core 0.3.1 → 0.4.0

package/README.md

@@ -147,39 +147,71 @@ wildcard.
 > interoperate across this change in either direction, so they deploy together and
 > registered agents are re-registered.
 
-### 3. Build the runtime in your Durable Object
+### 3. Write your Durable Object
 
-Everything that would otherwise be a module-level constant is resolved once per DO
-instance, from your config and your installed plugins:
+`LoopingAgent` is the DO body every agent has: the runtime and database built once
+per instance, one continuous Session per verified caller, the gateway callback
+channel, and the task lifecycle a Workflow drives. Three seams are yours.
 
 ```ts
-import { Agent } from "agents";
-import { createAgentRuntime } from "@loopingai/core";
-import { AgentDB } from "@loopingai/core/db";
-
-export class MyAgent extends Agent<Env> {
-  runtime!: ReturnType<typeof createAgentRuntime>;
-  db!: AgentDB;
-
-  async onStart() {
-    this.runtime = createAgentRuntime({
-      config: { model: { chatModelId: "@cf/zai-org/glm-5.2" } },
-      plugins: [scraper({ apiKey: this.env.SCRAPER_API_KEY })],
-      env: this.env // opt in to verifying every plugin's declared bindings exist
-    });
-
-    this.db = new AgentDB(this.ctx.storage, {
-      maxSubtasks: this.runtime.config.maxSubtasks,
-      stores: this.runtime.stores
-    });
-    await this.db.ensureReady();
+import { LoopingAgent, type PluginHost } from "@loopingai/core/host";
+
+export class MyAgent extends LoopingAgent<Env> {
+  protected agentConfig() {
+    return {
+      model: {
+        chatModelId: "@cf/zai-org/glm-5.2",
+        fallbackChatModelId: "@cf/meta/llama-4-scout-17b-16e-instruct"
+      }
+    };
+  }
+  protected agentPlugins(host: PluginHost<Env>) {
+    return [scraper({ apiKey: host.env.SCRAPER_API_KEY })];
+  }
+  protected agentSoul(capabilities: string) {
+    return soulPrompt(capabilities);
+  }
+}
+```
+
+Everything that would otherwise be a module-level constant is resolved from those,
+once per instance. Resolving a registry at _import_ time is the one thing this
+package exists to prevent: it freezes the registry before `env` exists (which on
+Workers is always), defeats tree-shaking, and makes runtime plugin selection
+impossible.
+
+`createAgentRuntime` and `AgentDB` are still exported and still work on a bare
+`Agent<Env>` — but everything the base class does is lifecycle with an ordering
+that is load-bearing and invisible (migrations awaited before the first RPC, the
+guarded terminal write, the cancellation verdict that must be read and not
+probed for), and hand-rolling it is how two agents in one repo drift apart.
+
+### 4. Delegate, if your agent delegates
+
+`@loopingai/core/round` adds the other half: a durable Subtask DAG, wave
+scheduling, isolated subagent execution, and the round loop over them.
+
+```ts
+import { RoundAgentBase, type RoundPolicy } from "@loopingai/core/round";
+
+export class MyAgent extends RoundAgentBase<Env> {
+  // …the three seams above, plus:
+  protected roundPolicy(): RoundPolicy {
+    return policy;
+  }
+  protected subagentClass() {
+    return MySubagent;
   }
 }
 ```
 
-Resolving a registry at _import_ time is the one thing this package exists to
-prevent: it freezes the registry before `env` exists (which on Workers is always),
-defeats tree-shaking, and makes runtime plugin selection impossible.
+#### The round policy
+
+Core ships the machine and none of the words. `RoundPolicy` is every string the
+loop emits — the round contract the model is held to, the note appended when the
+budget is spent, and the three user-facing messages. Nothing has a default: a
+lent-out round contract is exactly the house prompt copy this package refuses to
+have.
 
 ---
 
@@ -194,6 +226,8 @@ not drag in the A2A adapter, and the test harness cannot reach a production bund
 | `@loopingai/core/a2a`          | card signing, JWKS, gateway-JWT verify, push notify, task store, executor   |
 | `@loopingai/core/worker`       | `createA2AWorker()` — the whole zero-trust edge                             |
 | `@loopingai/core/agent`        | session, history, model runtime, inference, budget, control tools           |
+| `@loopingai/core/host`         | `LoopingAgent` — the Durable Object body — and `PluginHost`                 |
+| `@loopingai/core/round`        | the delegating round loop: `RoundAgentBase`, `runHandleTask`, `runTurn`     |
 | `@loopingai/core/subtasks`     | delegation types, decomposition, the `delegate` tool, wave scheduler        |
 | `@loopingai/core/subagent`     | `RecipeSubagentBase`, resumable runs, fingerprinting, workspace             |
 | `@loopingai/core/db`           | `AgentDB`, `notify_tasks` + `subtasks` schema, migrations, `PluginStore`    |
@@ -388,13 +422,34 @@ await withDb("accepts a turn once", async (db) => {
   (a scripted `LanguageModel`), so a loop can be driven with no model call at all.
 - **Fixtures** — Ed25519 keypairs and a gateway-JWT signer, so the zero-trust path is
   exercisable end to end without a real gateway.
+- **`createAgentHarness`** — the assembly of all of the above: send one A2A turn the
+  way a gateway does, and capture what comes back.
+
+  ```ts
+  const harness = createAgentHarness({ worker, env, tenant: "reactive" });
+  using _ = harness.interceptGateway();
+
+  const accepted = await harness.send("what's the weather?");
+  expect(accepted.status.state).toBe(TaskState.TASK_STATE_SUBMITTED);
+  ```
+
+  It exists because the pieces above were never the hard part. The audience is the
+  **endpoint**, not the origin; the tenant claim has to match the tenant in the
+  body; `SendMessage` is refused without a push config; and the gateway's JWKS has
+  to be reachable or every spec below it reports a 401 about something else. Four
+  facts, wrong the first time in every consumer that wrote this by hand.
 
 ---
 
 ## What core deliberately does _not_ contain
 
-- The turn loop, triage, and the DO / Workflow class bodies. Core ships the argument
-  and budget types; you write the loop.
+- **Prompt copy of any kind.** Not a soul, not a round contract, not a user-facing
+  failure message. `@loopingai/core/round` ships the whole delegating loop but takes
+  every word it says from a [`RoundPolicy`](#the-round-policy) you write, because a
+  run must never execute under an identity nobody chose.
+- **A loop you cannot replace.** `/round` is opt-in and its own subpath. An agent
+  whose turn is a single inference extends `LoopingAgent` directly, writes its own
+  loop, and carries none of the delegation machinery in its bundle.
 - The main agent's soul. Core ships no prompt copy.
 - Config _values_ — model ids, budgets, limits. Core ships the shapes and safe
   defaults, and `resolveConfig` validates your overrides.

package/dist/a2a/caller.d.ts

@@ -0,0 +1,24 @@
+import type { GatewayIdentity } from "./verify.js";
+/**
+ * Per-request system-prompt suffix describing the verified calling gateway-agent
+ * instance, from the gateway identity JWT.
+ *
+ * Core ships this and not a soul, and the line between them is the point: a soul
+ * is prompt copy expressing who an agent *is*, which nobody else can write for
+ * you. This is a **rendering of a protocol fact** — who the gateway proved it was
+ * — and that fact has one correct rendering. Two agents disagreeing about how to
+ * describe their caller would be a bug, not a personality. It is the same
+ * category as `renderSubagentPrompt`'s budget section, which core also owns.
+ *
+ * **Advisory context only.** This is the calling *agent instance*, not the human
+ * on the other end of it, so an agent's soul must never let the model read it as
+ * "who you're talking to" — point the model at whatever speaker wrapper the
+ * gateway applies instead.
+ *
+ * Deliberately neutral about what a workspace is: `GatewayIdentity.workspaceId`
+ * is whatever the calling gateway partitions by, and core does not know that it
+ * is a Slack team. Override `LoopingAgent.callerContext` for a deployment that
+ * wants to name it.
+ */
+export declare function callerContext(identity: GatewayIdentity): string;
+//# sourceMappingURL=caller.d.ts.map

package/dist/a2a/caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.d.ts","sourceRoot":"","sources":["../../src/a2a/caller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAW/D"}

package/dist/a2a/caller.js

@@ -0,0 +1,34 @@
+/**
+ * Per-request system-prompt suffix describing the verified calling gateway-agent
+ * instance, from the gateway identity JWT.
+ *
+ * Core ships this and not a soul, and the line between them is the point: a soul
+ * is prompt copy expressing who an agent *is*, which nobody else can write for
+ * you. This is a **rendering of a protocol fact** — who the gateway proved it was
+ * — and that fact has one correct rendering. Two agents disagreeing about how to
+ * describe their caller would be a bug, not a personality. It is the same
+ * category as `renderSubagentPrompt`'s budget section, which core also owns.
+ *
+ * **Advisory context only.** This is the calling *agent instance*, not the human
+ * on the other end of it, so an agent's soul must never let the model read it as
+ * "who you're talking to" — point the model at whatever speaker wrapper the
+ * gateway applies instead.
+ *
+ * Deliberately neutral about what a workspace is: `GatewayIdentity.workspaceId`
+ * is whatever the calling gateway partitions by, and core does not know that it
+ * is a Slack team. Override `LoopingAgent.callerContext` for a deployment that
+ * wants to name it.
+ */
+export function callerContext(identity) {
+    const label = identity.name ?? identity.key;
+    if (!label) {
+        return "\n\nCalling agent instance: unknown (the gateway did not include an agent identity).";
+    }
+    const withKind = identity.kind ? `${label} (${identity.kind})` : label;
+    const lines = ["", "", `Calling agent instance: ${withKind}.`];
+    if (identity.workspaceId != null) {
+        lines.push(`Calling workspace: ${identity.workspaceId}.`);
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=caller.js.map

package/dist/a2a/caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../src/a2a/caller.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,aAAa,CAAC,QAAyB;IACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,sFAAsF,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IACvE,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,2BAA2B,QAAQ,GAAG,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/a2a/card.d.ts

@@ -1,7 +1,12 @@
 import type { JWK } from "jose";
 import { AgentCard } from "@a2a-js/sdk";
-/** The default JSON-RPC path an agent answers on (the card's only interface). */
-export declare const A2A_RPC_PATH = "/a2a";
+/**
+ * The card signature uses the one algorithm every Looping A2A signature uses,
+ * and the default RPC path is the one the gateway also knows. Both come from
+ * `@loopingai/a2a-protocol` — see {@link file://./verify.ts} for why that is a
+ * separate package rather than a constant declared on each side.
+ */
+export { A2A_RPC_PATH } from "@loopingai/a2a-protocol";
 /**
  * The transport-independent half of an {@link AgentCard} — everything that does
  * not depend on the request origin. {@link buildBaseCard} adds

package/dist/a2a/card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"card.d.ts","sourceRoot":"","sources":["../../src/a2a/card.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,SAAS,EAEV,MAAM,aAAa,CAAC;AAKrB,iFAAiF;AACjF,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,SAAS,EACP,MAAM,GACN,aAAa,GACb,SAAS,GACT,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,QAAQ,CACX,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,UAAU,EAAE,GAAG,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAUD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,gBAAgB,GACrB,SAAS,CA6CX;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,aAAa,CAAC,CASxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,SAAS,CAAC,CAGpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAI5E;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,UAAU,EAAE,GAAG,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IACjE,IAAI,EAAE,GAAG,EAAE,CAAC;CACb,CAIA"}
+{"version":3,"file":"card.d.ts","sourceRoot":"","sources":["../../src/a2a/card.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,SAAS,EAEV,MAAM,aAAa,CAAC;AAOrB;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,SAAS,EACP,MAAM,GACN,aAAa,GACb,SAAS,GACT,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,QAAQ,CACX,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,UAAU,EAAE,GAAG,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAUD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,gBAAgB,GACrB,SAAS,CAkDX;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,aAAa,CAAC,CASxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,SAAS,CAAC,CAGpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAI5E;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,UAAU,EAAE,GAAG,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IACjE,IAAI,EAAE,GAAG,EAAE,CAAC;CACb,CAIA"}

package/dist/a2a/card.js

@@ -1,8 +1,12 @@
 import { A2A_PROTOCOL_VERSION, AgentCard, generateAgentCardSignature } from "@a2a-js/sdk";
-/** JWS algorithm for the card signature — must match the gateway (`EdDSA`). */
-const ALG = "EdDSA";
-/** The default JSON-RPC path an agent answers on (the card's only interface). */
-export const A2A_RPC_PATH = "/a2a";
+import { A2A_JWS_ALG, A2A_RPC_PATH, endpointUrl } from "@loopingai/a2a-protocol";
+/**
+ * The card signature uses the one algorithm every Looping A2A signature uses,
+ * and the default RPC path is the one the gateway also knows. Both come from
+ * `@loopingai/a2a-protocol` — see {@link file://./verify.ts} for why that is a
+ * separate package rather than a constant declared on each side.
+ */
+export { A2A_RPC_PATH } from "@loopingai/a2a-protocol";
 /**
  * The `httpAuthSecurityScheme` describing the gateway's Bearer JWT, and the
  * requirement that references it. Split out so the requirement can be advertised
@@ -40,7 +44,12 @@ export function buildBaseCard(manifest, opts) {
         },
         supportedInterfaces: [
             {
-                url: `${opts.origin}${rpcPath}`,
+                // The gateway reads this URL off the card and mints `aud` from it with
+                // `audienceFor`; this Worker derives its expected audience the same
+                // way. `endpointUrl` is what makes those provably equal — the protocol
+                // package pins `audienceFor(endpointUrl(o, p)) === endpointUrl(o, p)`
+                // for every path, rather than leaving both sides to concatenate.
+                url: endpointUrl(opts.origin, rpcPath),
                 protocolBinding: "JSONRPC",
                 protocolVersion: A2A_PROTOCOL_VERSION,
                 tenant: opts.tenant ?? ""
@@ -86,7 +95,7 @@ export function buildBaseCard(manifest, opts) {
  */
 export async function signCard(card, cfg) {
     const sign = generateAgentCardSignature(cfg.privateJwk, {
-        alg: ALG,
+        alg: A2A_JWS_ALG,
         kid: cfg.privateJwk.kid,
         typ: "JOSE",
         jku: cfg.jku
@@ -148,6 +157,6 @@ export function parsePrivateJwk(raw) {
 export function publicCardJwks(privateJwk) {
     const { d: _d, ...pub } = privateJwk;
     void _d;
-    return { keys: [{ ...pub, use: "sig", alg: ALG }] };
+    return { keys: [{ ...pub, use: "sig", alg: A2A_JWS_ALG }] };
 }
 //# sourceMappingURL=card.js.map

package/dist/a2a/card.js.map

@@ -1 +1 @@
-{"version":3,"file":"card.js","sourceRoot":"","sources":["../../src/a2a/card.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,SAAS,EACT,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAsFnC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAuB,EACvB,IAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC;IAC7C,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ,kEAAkE;YAClE,sEAAsE;YACtE,+DAA+D;YAC/D,UAAU,EAAE,EAAE;YACd,GAAG,QAAQ,CAAC,YAAY;YACxB,sEAAsE;YACtE,qDAAqD;YACrD,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,iBAAiB,EAAE,IAAI;SACxB;QACD,mBAAmB,EAAE;YACnB;gBACE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE;gBAC/B,eAAe,EAAE,SAAS;gBAC1B,eAAe,EAAE,oBAAoB;gBACrC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;aAC1B;SACF;QACD,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,SAAS;QAC3B,OAAO,EAAE,SAAS;QAClB,eAAe,EAAE,IAAI,CAAC,wBAAwB;YAC5C,CAAC,CAAC;gBACE,CAAC,iBAAiB,CAAC,EAAE;oBACnB,MAAM,EAAE;wBACN,KAAK,EAAE,wBAAwB;wBAC/B,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE;qBAClE;iBACF;aACF;YACH,CAAC,CAAC,EAAE;QACN,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,oBAAoB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC1E,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAe,EACf,GAAsB;IAEtB,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,UAAU,EAAE;QACtD,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG;QACvB,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAkC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,GAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAqC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAe;IACtC,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAc,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACtE,OAAO,GAAsC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,UAAiC;IAG9D,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC;IACrC,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"card.js","sourceRoot":"","sources":["../../src/a2a/card.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,SAAS,EACT,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,WAAW,EACZ,MAAM,yBAAyB,CAAC;AAEjC;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAsFvD;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAuB,EACvB,IAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC;IAC7C,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ,kEAAkE;YAClE,sEAAsE;YACtE,+DAA+D;YAC/D,UAAU,EAAE,EAAE;YACd,GAAG,QAAQ,CAAC,YAAY;YACxB,sEAAsE;YACtE,qDAAqD;YACrD,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,iBAAiB,EAAE,IAAI;SACxB;QACD,mBAAmB,EAAE;YACnB;gBACE,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,sEAAsE;gBACtE,iEAAiE;gBACjE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;gBACtC,eAAe,EAAE,SAAS;gBAC1B,eAAe,EAAE,oBAAoB;gBACrC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;aAC1B;SACF;QACD,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,SAAS;QAC3B,OAAO,EAAE,SAAS;QAClB,eAAe,EAAE,IAAI,CAAC,wBAAwB;YAC5C,CAAC,CAAC;gBACE,CAAC,iBAAiB,CAAC,EAAE;oBACnB,MAAM,EAAE;wBACN,KAAK,EAAE,wBAAwB;wBAC/B,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE;qBAClE;iBACF;aACF;YACH,CAAC,CAAC,EAAE;QACN,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,oBAAoB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC1E,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAe,EACf,GAAsB;IAEtB,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,UAAU,EAAE;QACtD,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG;QACvB,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAkC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,GAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAqC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAe;IACtC,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAc,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACtE,OAAO,GAAsC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,UAAiC;IAG9D,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC;IACrC,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/dist/a2a/index.d.ts

@@ -5,10 +5,25 @@
  * JWKS, prove ourselves with ours), the accept-and-notify task lifecycle, and the
  * narrowed task types that survive Durable Object RPC. Nothing here knows what an
  * agent *does* — past {@link A2AExecutor} everything is plain strings.
+ *
+ * ## The wire values come from `@loopingai/a2a-protocol`
+ *
+ * Claim names, the algorithm, the well-known paths and the audience rule are a
+ * two-sided contract with a token issuer, and the issuer — looping-gateway — is
+ * not an agent and must not import this package. They live in a zero-dependency
+ * leaf both sides depend on, and are re-exported here so an agent's imports are
+ * unchanged: `IDENTITY_CLAIM`, `TENANT_CLAIM`, `A2A_RPC_PATH` and
+ * `GatewayIdentity` still come from `@loopingai/core/a2a`.
+ *
+ * The pure helpers are re-exported too, because an agent that builds a URL by
+ * hand is an agent that can disagree with the gateway about it.
  */
+export { A2A_JWS_ALG, audienceFor, endpointUrl, jwksUrl } from "@loopingai/a2a-protocol";
 export { IDENTITY_CLAIM, TENANT_CLAIM, GatewayAuthError, bearerToken, normalizeGatewayOrigins, verifyGatewayToken, type GatewayIdentity, type VerifyOptions } from "./verify.js";
 export { A2A_RPC_PATH, buildBaseCard, signCard, wireCard, parsePrivateJwk, publicCardJwks, type AgentManifest, type BuildCardOptions, type CardSigningConfig, type WireAgentCard } from "./card.js";
 export { NOTIFICATION_TOKEN_HEADER, buildSubmittedTask, buildWorkingTask, buildCompletedTask, buildFailedTask, buildNoReplyCompletedTask, signCallbackJwt, postNotification } from "./notify.js";
+export { callerContext } from "./caller.js";
+export { createPushChannel, type PushChannel, type TurnPushContext } from "./push.js";
 export { taskStateLabel, type PlainArtifact, type PlainMessage, type PlainPart, type PlainStatus, type PlainTask } from "./task.js";
 export { textPart, partsText, textOf, agentTextMessage, inboundText, InboundPartError, MAX_INBOUND_TEXT_BYTES } from "./parts.js";
 export { buildCallContext, extensionHeaders } from "./context.js";

package/dist/a2a/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,QAAQ,EACR,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,aAAa,EACb,SAAS,EACT,YAAY,EACZ,aAAa,EACd,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,OAAO,EACR,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,QAAQ,EACR,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,aAAa,EACb,SAAS,EACT,YAAY,EACZ,aAAa,EACd,MAAM,iBAAiB,CAAC"}

package/dist/a2a/index.js

@@ -5,10 +5,25 @@
  * JWKS, prove ourselves with ours), the accept-and-notify task lifecycle, and the
  * narrowed task types that survive Durable Object RPC. Nothing here knows what an
  * agent *does* — past {@link A2AExecutor} everything is plain strings.
+ *
+ * ## The wire values come from `@loopingai/a2a-protocol`
+ *
+ * Claim names, the algorithm, the well-known paths and the audience rule are a
+ * two-sided contract with a token issuer, and the issuer — looping-gateway — is
+ * not an agent and must not import this package. They live in a zero-dependency
+ * leaf both sides depend on, and are re-exported here so an agent's imports are
+ * unchanged: `IDENTITY_CLAIM`, `TENANT_CLAIM`, `A2A_RPC_PATH` and
+ * `GatewayIdentity` still come from `@loopingai/core/a2a`.
+ *
+ * The pure helpers are re-exported too, because an agent that builds a URL by
+ * hand is an agent that can disagree with the gateway about it.
  */
+export { A2A_JWS_ALG, audienceFor, endpointUrl, jwksUrl } from "@loopingai/a2a-protocol";
 export { IDENTITY_CLAIM, TENANT_CLAIM, GatewayAuthError, bearerToken, normalizeGatewayOrigins, verifyGatewayToken } from "./verify.js";
 export { A2A_RPC_PATH, buildBaseCard, signCard, wireCard, parsePrivateJwk, publicCardJwks } from "./card.js";
 export { NOTIFICATION_TOKEN_HEADER, buildSubmittedTask, buildWorkingTask, buildCompletedTask, buildFailedTask, buildNoReplyCompletedTask, signCallbackJwt, postNotification } from "./notify.js";
+export { callerContext } from "./caller.js";
+export { createPushChannel } from "./push.js";
 export { taskStateLabel } from "./task.js";
 export { textPart, partsText, textOf, agentTextMessage, inboundText, InboundPartError, MAX_INBOUND_TEXT_BYTES } from "./parts.js";
 export { buildCallContext, extensionHeaders } from "./context.js";

package/dist/a2a/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAGnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,cAAc,EAKf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,cAAc,EAMf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,QAAQ,EACR,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EAIpB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,OAAO,EACR,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAGnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,cAAc,EAKf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EACL,iBAAiB,EAGlB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,cAAc,EAMf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,QAAQ,EACR,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EAIpB,MAAM,eAAe,CAAC"}

package/dist/a2a/notify.d.ts

@@ -2,12 +2,34 @@ import { type JWK } from "jose";
 import { type Task } from "@a2a-js/sdk";
 import type { PlainTask } from "./task.js";
 /**
- * Header carrying the per-task validation `token` the gateway set in the
- * `taskPushNotificationConfig`. Echoed verbatim so the gateway can correlate the
- * callback to its pending task row. Must match looping-gateway's
- * `NOTIFICATION_TOKEN_HEADER` (`src/a2a/notifications/remote.ts`).
+ * Outbound push-notification (accept + notify) helpers — the "notify" half of the
+ * async A2A contract. The gateway dispatches `SendMessage` with a
+ * `taskPushNotificationConfig` (webhook `url` + validation `token`), we accept
+ * immediately with a `submitted` Task, and later POST the terminal Task back to
+ * that webhook. This module builds the Task shapes and signs + sends that
+ * callback.
+ *
+ * The callback is authenticated exactly like the AgentCard: a short-lived EdDSA
+ * JWT signed by `A2A_SIGNING_KEY`, whose protected header `kid`+`jku` must equal
+ * the card's signing `kid`+`jku` (see {@link file://./card.ts} `signCard`) — the
+ * gateway pinned those at registration (Trust-On-First-Use) and verifies the
+ * callback token against that same public JWKS. No shared secret crosses the
+ * boundary; only our public key is ever used to verify.
+ */
+/**
+ * The two shared values on this hop — the signature algorithm and the header
+ * carrying the per-task validation `token` — come from
+ * `@loopingai/a2a-protocol`, the same package the gateway reads them from.
+ *
+ * The header used to be declared here and again in looping-gateway, each with a
+ * comment naming the other file. It is a slightly different case from the claim
+ * names: the value is `@a2a-js/sdk`'s own default for `tokenHeaderName`, not
+ * Looping's choice, but the SDK never *exports* it — it exists only as an
+ * inline fallback — so neither side could import it and both wrote it down.
+ *
+ * Re-exported so `@loopingai/core/a2a` keeps being where an agent finds it.
  */
-export declare const NOTIFICATION_TOKEN_HEADER = "x-a2a-notification-token";
+export { NOTIFICATION_TOKEN_HEADER } from "@loopingai/a2a-protocol";
 /**
  * The `submitted` Task we return synchronously to accept a turn (A2A §7.2). The
  * gateway only requires a non-empty `id`; the actual reply follows later via the

package/dist/a2a/notify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/a2a/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAa,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAqB3C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAqCpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,SAAS,CAEX;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,SAAS,CAEX;AAwBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,SAAS,CAQX;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,SAAS,CAQX;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,SAAS,CAQX;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,GAAG,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACjC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,CAAC,CAanB"}
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/a2a/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAa,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AAOnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAqCpE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,SAAS,CAEX;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,SAAS,CAEX;AAwBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,SAAS,CAQX;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,SAAS,CAQX;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,SAAS,CAQX;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,GAAG,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACjC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,CAAC,CAanB"}

package/dist/a2a/notify.js

@@ -1,6 +1,7 @@
 import { SignJWT } from "jose";
 import { TaskState } from "@a2a-js/sdk";
 import { V1PushNotificationSerializer } from "@a2a-js/sdk/server";
+import { A2A_JWS_ALG, NOTIFICATION_TOKEN_HEADER } from "@loopingai/a2a-protocol";
 import { agentTextMessage } from "./parts.js";
 /**
  * Outbound push-notification (accept + notify) helpers — the "notify" half of the
@@ -17,15 +18,20 @@ import { agentTextMessage } from "./parts.js";
  * callback token against that same public JWKS. No shared secret crosses the
  * boundary; only our public key is ever used to verify.
  */
-/** JWS algorithm — must match the card + gateway (`EdDSA`). */
-const ALG = "EdDSA";
 /**
- * Header carrying the per-task validation `token` the gateway set in the
- * `taskPushNotificationConfig`. Echoed verbatim so the gateway can correlate the
- * callback to its pending task row. Must match looping-gateway's
- * `NOTIFICATION_TOKEN_HEADER` (`src/a2a/notifications/remote.ts`).
+ * The two shared values on this hop — the signature algorithm and the header
+ * carrying the per-task validation `token` — come from
+ * `@loopingai/a2a-protocol`, the same package the gateway reads them from.
+ *
+ * The header used to be declared here and again in looping-gateway, each with a
+ * comment naming the other file. It is a slightly different case from the claim
+ * names: the value is `@a2a-js/sdk`'s own default for `tokenHeaderName`, not
+ * Looping's choice, but the SDK never *exports* it — it exists only as an
+ * inline fallback — so neither side could import it and both wrote it down.
+ *
+ * Re-exported so `@loopingai/core/a2a` keeps being where an agent finds it.
  */
-export const NOTIFICATION_TOKEN_HEADER = "x-a2a-notification-token";
+export { NOTIFICATION_TOKEN_HEADER } from "@loopingai/a2a-protocol";
 /**
  * Callback-JWT lifetime. The gateway enforces `maxTokenAge: 10m` with a 60s clock
  * tolerance, so keep this comfortably under that.
@@ -142,7 +148,11 @@ export function buildFailedTask(taskId, contextId, text) {
  */
 export async function signCallbackJwt(privateJwk, opts) {
     return new SignJWT({})
-        .setProtectedHeader({ alg: ALG, kid: privateJwk.kid, jku: opts.jku })
+        .setProtectedHeader({
+        alg: A2A_JWS_ALG,
+        kid: privateJwk.kid,
+        jku: opts.jku
+    })
         .setAudience(opts.aud)
         .setIssuedAt()
         .setExpirationTime(CALLBACK_TOKEN_TTL)

package/dist/a2a/notify.js.map

@@ -1 +1 @@
-{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/a2a/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,SAAS,EAAa,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AAEH,+DAA+D;AAC/D,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAEpE;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,IAAI,4BAA4B,EAAE,CAAC;AAE3D,4FAA4F;AAC5F,SAAS,aAAa,CACpB,MAAc,EACd,SAAiB,EACjB,KAAgB;IAEhB,OAAO;QACL,EAAE,EAAE,MAAM;QACV,SAAS;QACT,MAAM,EAAE;YACN,KAAK;YACL,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;QACD,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB;IAEjB,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,SAAiB;IAEjB,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,MAAc,EACd,SAAiB,EACjB,KAAgB,EAChB,IAAY,EACZ,SAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,gBAAgB,CAAC;QACrC,SAAS;QACT,IAAI;QACJ,SAAS;QACT,MAAM;KACP,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,SAAiB,EACjB,IAAY,EACZ,GAAW;IAEX,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,kBAAkB,EAC5B,IAAI,EACJ,GAAG,MAAM,IAAI,GAAG,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB,EACjB,KAAa;IAEb,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,oBAAoB,EAC9B,KAAK,EACL,GAAG,MAAM,QAAQ,CAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,SAAiB,EACjB,IAAY;IAEZ,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,iBAAiB,EAC3B,IAAI,EACJ,GAAG,MAAM,QAAQ,CAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAiC,EACjC,IAAkC;IAElC,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACpE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;SACrB,WAAW,EAAE;SACb,iBAAiB,CAAC,kBAAkB,CAAC;SACrC,IAAI,CAAC,UAAU,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,KAAa,EACb,GAAW,EACX,IAAU;IAEV,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC;QACtD,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;KACxC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,GAAG,EAAE;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,WAAW;YAC3B,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,CAAC,yBAAyB,CAAC,EAAE,KAAK;SACnC;QACD,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/a2a/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,SAAS,EAAa,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EACL,WAAW,EACX,yBAAyB,EAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,IAAI,4BAA4B,EAAE,CAAC;AAE3D,4FAA4F;AAC5F,SAAS,aAAa,CACpB,MAAc,EACd,SAAiB,EACjB,KAAgB;IAEhB,OAAO;QACL,EAAE,EAAE,MAAM;QACV,SAAS;QACT,MAAM,EAAE;YACN,KAAK;YACL,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;QACD,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB;IAEjB,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,SAAiB;IAEjB,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,MAAc,EACd,SAAiB,EACjB,KAAgB,EAChB,IAAY,EACZ,SAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,gBAAgB,CAAC;QACrC,SAAS;QACT,IAAI;QACJ,SAAS;QACT,MAAM;KACP,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,SAAiB,EACjB,IAAY,EACZ,GAAW;IAEX,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,kBAAkB,EAC5B,IAAI,EACJ,GAAG,MAAM,IAAI,GAAG,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB,EACjB,KAAa;IAEb,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,oBAAoB,EAC9B,KAAK,EACL,GAAG,MAAM,QAAQ,CAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,SAAiB,EACjB,IAAY;IAEZ,OAAO,eAAe,CACpB,MAAM,EACN,SAAS,EACT,SAAS,CAAC,iBAAiB,EAC3B,IAAI,EACJ,GAAG,MAAM,QAAQ,CAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAiC,EACjC,IAAkC;IAElC,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC;QAClB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC;SACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;SACrB,WAAW,EAAE;SACb,iBAAiB,CAAC,kBAAkB,CAAC;SACrC,IAAI,CAAC,UAAU,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,KAAa,EACb,GAAW,EACX,IAAU;IAEV,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC;QACtD,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;KACxC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,GAAG,EAAE;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,WAAW;YAC3B,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,CAAC,yBAAyB,CAAC,EAAE,KAAK;SACnC;QACD,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/a2a/push.d.ts

@@ -0,0 +1,71 @@
+import type { Task } from "@a2a-js/sdk";
+import type { OnContent } from "../agent/inference.js";
+/**
+ * The gateway callback channel for one accepted turn.
+ *
+ * Every agent that accepts asynchronously has to do the same four things with
+ * the push config the gateway handed it: sign a callback JWT against the
+ * deployment's card key, POST `working` snapshots as the model reasons, POST the
+ * terminal Task, and never let a failed progress post take down a turn. That was
+ * written out longhand in four places across two agents in the starter — twice as
+ * a `streamWorking` closure inside a Durable Object, twice as a `notify` step
+ * inside a Workflow — with the signing, the header names and the swallow-and-log
+ * discipline duplicated each time.
+ *
+ * It is one object here because none of it is per-agent. What *is* per-agent is
+ * the notification **key**, and that is the one thing a caller supplies.
+ */
+/**
+ * Everything needed to call a gateway back about one task.
+ *
+ * RPC-serializable by construction: it crosses the Workflow → Durable Object
+ * boundary on every turn, so it holds only strings.
+ */
+export interface TurnPushContext {
+    /** The accepted task id (echoed on every callback of this turn). */
+    taskId: string;
+    /** A2A context id, echoed on every callback. */
+    contextId: string;
+    /** Gateway push-notification webhook (also the callback JWT `aud`). */
+    pushUrl: string;
+    /** Per-task validation token the gateway set; echoed in the callback header. */
+    pushToken: string;
+    /** This agent's card-signing JWKS URL — the callback JWT `jku` (pinned key). */
+    jku: string;
+}
+export interface PushChannel {
+    /**
+     * POST one `working` Task snapshot, keyed by a stable semantic `key`.
+     *
+     * **Best-effort**: every failure is logged and swallowed, so a progress post
+     * can never abort generation or fail a durable step. The key is what lets the
+     * gateway dedupe a re-posted event on replay, so it must be derived from
+     * position (`r2:step:3`), never from content or a clock.
+     */
+    working(text: string, key: string): Promise<void>;
+    /**
+     * An {@link OnContent} sink that posts each intermediate message as a
+     * `working` snapshot, signing the JWT once and reusing it across the turn.
+     *
+     * `key` maps a 0-based step ordinal to its notification key. An agent running
+     * one turn per task can use the bare index; an agent with rounds **must**
+     * include the round, or two rounds of one task collide on the gateway.
+     */
+    stream(key: (stepIndex: number) => string): OnContent;
+    /**
+     * POST the terminal Task. **Throws on a non-2xx** so the calling Workflow step
+     * retries — the opposite of {@link working}, because this is the delivery the
+     * whole turn exists for.
+     */
+    deliver(task: Task): Promise<void>;
+}
+/**
+ * Build the callback channel for one turn.
+ *
+ * `signingKey` is the deployment's Ed25519 private JWK as JSON — `A2A_SIGNING_KEY`
+ * by default. There is one per origin, not one per agent: the card sits at a
+ * well-known URI, which RFC 8615 defines per-authority, so this origin publishes
+ * one card and the gateway pins one key for every agent on it.
+ */
+export declare function createPushChannel(signingKey: string, push: TurnPushContext): PushChannel;
+//# sourceMappingURL=push.d.ts.map

package/dist/a2a/push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/a2a/push.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQvD;;;;;;;;;;;;;;GAcG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,GACpB,WAAW,CAkDb"}

package/dist/a2a/push.js

@@ -0,0 +1,54 @@
+import { parsePrivateJwk } from "./card.js";
+import { buildWorkingTask, postNotification, signCallbackJwt } from "./notify.js";
+/**
+ * Build the callback channel for one turn.
+ *
+ * `signingKey` is the deployment's Ed25519 private JWK as JSON — `A2A_SIGNING_KEY`
+ * by default. There is one per origin, not one per agent: the card sits at a
+ * well-known URI, which RFC 8615 defines per-authority, so this origin publishes
+ * one card and the gateway pins one key for every agent on it.
+ */
+export function createPushChannel(signingKey, push) {
+    // Signed lazily and reused: one turn can post many progress snapshots, and
+    // re-signing per message costs a key import each time for no benefit.
+    let jwt;
+    const sign = () => (jwt ??= signCallbackJwt(parsePrivateJwk(signingKey), {
+        jku: push.jku,
+        aud: push.pushUrl
+    }));
+    const post = async (task) => postNotification(push.pushUrl, push.pushToken, await sign(), task);
+    const working = async (text, key) => {
+        try {
+            const res = await post(buildWorkingTask(push.taskId, push.contextId, text, key));
+            if (!res.ok) {
+                console.warn("[push] working notification non-2xx", {
+                    taskId: push.taskId,
+                    key,
+                    status: res.status
+                });
+            }
+        }
+        catch (err) {
+            // Swallowed on purpose, including a signing failure: a turn that cannot
+            // report its progress is still a turn that should deliver its answer.
+            console.warn("[push] working notification failed", {
+                taskId: push.taskId,
+                key,
+                err: String(err)
+            });
+        }
+    };
+    return {
+        working,
+        stream(key) {
+            return (text, stepIndex) => working(text, key(stepIndex));
+        },
+        async deliver(task) {
+            const res = await post(task);
+            if (!res.ok) {
+                throw new Error(`gateway notification failed: HTTP ${res.status}`);
+            }
+        }
+    };
+}
+//# sourceMappingURL=push.js.map

package/dist/a2a/push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../src/a2a/push.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EAChB,MAAM,aAAa,CAAC;AAgErB;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,IAAqB;IAErB,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,GAAgC,CAAC;IACrC,MAAM,IAAI,GAAG,GAAoB,EAAE,CACjC,CAAC,GAAG,KAAK,eAAe,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE;QACpD,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,OAAO;KAClB,CAAC,CAAC,CAAC;IAEN,MAAM,IAAI,GAAG,KAAK,EAAE,IAAU,EAAqB,EAAE,CACnD,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,GAAW,EAAiB,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CACzD,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,qCAAqC,EAAE;oBAClD,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG;oBACH,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,sEAAsE;YACtE,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBACjD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG;gBACH,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QAEP,MAAM,CAAC,GAAG;YACR,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}