@ryubyte/dsh-a2a 0.2.0 → 0.3.0

package/lib/types/dashboard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../src/dashboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,KAAK,EAAE,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;IACrD,yFAAyF;IACzF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClE,0FAA0F;IAC1F,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,6EAA6E;IAC7E,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD,mFAAmF;IACnF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3D,oFAAoF;IACpF,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3G,0EAA0E;IAC1E,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClG,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,aAAa,CAAC;IACnC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAC;KACpF,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,CACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KACrE,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B;AAED,yDAAyD;AACzD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,MAAM,CAAoC;IAClD,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,GAAG,CAAK;IAEhB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAM5C,wEAAwE;IACxE,YAAY,CAAC,GAAG,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,MAAM;IAmCxG,uEAAuE;IACvE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAMhD,oCAAoC;IACpC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IAKtD,gEAAgE;IAChE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAM5B,wDAAwD;IACxD,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,MAAM;IAkClE,sDAAsD;IACtD,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAU1C,gCAAgC;IAChC,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI;IASxE,uCAAuC;IACvC,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAQtC,QAAQ,IAAI,iBAAiB;IAQvB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IA+FxG,OAAO,CAAC,cAAc;CAKvB;AAaD,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAUD,0EAA0E;AAC1E,wBAAgB,iBAAiB,IAAI,iBAAiB,CAGrD;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}
+{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../src/dashboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,KAAK,EAAE,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;IACrD,yFAAyF;IACzF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClE,0FAA0F;IAC1F,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,6EAA6E;IAC7E,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD,mFAAmF;IACnF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3D,oFAAoF;IACpF,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3G,0EAA0E;IAC1E,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClG,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,yFAAyF;IACzF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,aAAa,CAAC;IACnC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAC;KACpF,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,CACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KACrE,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B;AAED,yDAAyD;AACzD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,MAAM,CAAoC;IAClD,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,GAAG,CAAK;IAEhB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAM5C,wEAAwE;IACxE,YAAY,CAAC,GAAG,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,MAAM;IAmCxG,uEAAuE;IACvE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAMhD,oCAAoC;IACpC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IAKtD,gEAAgE;IAChE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAM5B,wDAAwD;IACxD,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,MAAM;IAkClE,sDAAsD;IACtD,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAU1C,gCAAgC;IAChC,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI;IASxE,uCAAuC;IACvC,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAQtC,QAAQ,IAAI,iBAAiB;IAQvB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAuGxG,OAAO,CAAC,cAAc;CAKvB;AAaD,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAUD,0EAA0E;AAC1E,wBAAgB,iBAAiB,IAAI,iBAAiB,CAGrD;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/lib/types/index.d.ts

@@ -41,6 +41,22 @@ export interface A2APluginConfig {
     execute?: ServerOptions['execute'];
     /** Optional shared bearer token protecting the inbound /a2a endpoint. */
     authToken?: string;
+    /**
+     * Browser origins allowed to call the inbound A2A routes cross-origin (CORS).
+     * An explicit allowlist of exact origins (scheme+host+port), e.g.
+     * `['http://localhost:8080', 'https://app.example.com']`.
+     *
+     * DEFAULT IS EMPTY = NO CORS: a browser page from another origin cannot call
+     * the endpoint, which is the safe default — with server mode's optional (and
+     * off-by-default) `authToken`, a wildcard would let any site the user visits
+     * drive their local agent. Each request's `Origin` is matched against this
+     * list; a hit echoes that exact origin back (with `Vary: Origin`), a miss
+     * sends no CORS headers. The literal `['*']` opts into a wildcard (logged as
+     * a warning) for fully-trusted local setups. Credentials are never allowed
+     * (auth rides the Bearer header, not cookies). Scoped to the A2A protocol
+     * routes only — the dashboard API (`/a2a/api`) stays loopback/same-origin.
+     */
+    corsOrigins?: string[];
     /** Serve the dashboard API on the webserver (default true). */
     dashboard?: boolean;
 }

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,EAAa,KAAK,aAAa,EAA0B,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAY5G,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAEpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACjJ,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE;QACd,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E,GAAG,MAAM,IAAI,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,IAAI;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAClD;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,mDAAmD;QACnD,SAAS,EAAE,gBAAgB,CAAC;QAC5B,mEAAmE;QACnE,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;QAC7C,6DAA6D;QAC7D,YAAY,CAAC,EAAE,mBAAmB,CAAC;QACnC,0CAA0C;QAC1C,KAAK,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,IAAI,CAAA;SAAE,CAAC;QAC9C;;;;;WAKG;QACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;KAC5B;CACF;AAQD,eAAO,MAAM,IAAI,QAAQ,CAAC;AAE1B;;;;;GAKG;AACH,eAAO,MAAM,MAAM,iCAAkC,CAAC;AAEtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,QAkrB/D;AA2FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,EAAa,KAAK,aAAa,EAA0B,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAY5G,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAEpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACjJ,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE;QACd,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E,GAAG,MAAM,IAAI,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,IAAI;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAClD;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,mDAAmD;QACnD,SAAS,EAAE,gBAAgB,CAAC;QAC5B,mEAAmE;QACnE,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;QAC7C,6DAA6D;QAC7D,YAAY,CAAC,EAAE,mBAAmB,CAAC;QACnC,0CAA0C;QAC1C,KAAK,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,IAAI,CAAA;SAAE,CAAC;QAC9C;;;;;WAKG;QACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;KAC5B;CACF;AAQD,eAAO,MAAM,IAAI,QAAQ,CAAC;AAE1B;;;;;GAKG;AACH,eAAO,MAAM,MAAM,iCAAkC,CAAC;AAEtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,QAovB/D;AA2FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/D"}

package/lib/types/server.d.ts

@@ -149,6 +149,16 @@ export declare class A2AServer {
         endpointChanged: boolean;
     };
     private buildCard;
+    /**
+     * True when the request carries the configured bearer token. Public wrapper
+     * for transports that must decide response headers/status BEFORE streaming
+     * frames — see index.ts's SSE branch, which must send `content-type:
+     * text/event-stream` + CORS headers before the first `res.write()`, and
+     * therefore needs the auth outcome up front.
+     */
+    checkAuth(req: {
+        headers?: Record<string, string>;
+    }): boolean;
     /** True when the request carries the configured bearer token. */
     private authorized;
     private emit;
@@ -238,8 +248,7 @@ interface AgentUserMessage {
     readonly role: 'user';
     readonly content: AgentTextBlock[];
     readonly source: {
-        kind: 'plugin';
-        plugin: string;
+        kind: string;
     };
 }
 /** The slice of a live `Agent` we drive (mirrors `@deepseek-ai/dsh-agent` `Agent`). */
@@ -324,7 +333,7 @@ export interface DshAgentExecutorOptions {
      * absolute — pass `process.cwd()` (the profile's workspace) at wire time.
      */
     cwd: string;
-    /** `source.plugin` tag stamped on inbound messages (defaults to `'a2a'`). */
+    /** Producer tag stamped on inbound messages (defaults to `'a2a'`); serialized as `plugin:<name>` under session format v4. */
     plugin?: string;
     /** Optional static per-agent model routing forwarded to `create()`. */
     agentOptions?: {

package/lib/types/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,SAAS,EAET,UAAU,EAGV,OAAO,EACP,IAAI,EAEJ,IAAI,EACL,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,SAAS,EAKV,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,WAAY,SAAQ,UAAU;CAAG;AAElD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,wDAAwD;IACxD,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1C,+EAA+E;IAC/E,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzG;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,6DAA6D;AAC7D,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,QAAQ,CAA8B;IAE9C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAgB9B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS;IAIjC,IAAI,IAAI,IAAI,EAAE;IAId,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI;IAWpE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAYxI,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;CAG5C;AASD,yEAAyE;AACzE,qBAAa,SAAS;IACpB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,SAAS,CAA2C;IAC5D,OAAO,CAAC,OAAO,CAAS;IACxB,mFAAmF;IACnF,OAAO,CAAC,OAAO,CAAsC;gBAEzC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAkB;IAa3D;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKjC,0DAA0D;IAC1D,UAAU,IAAI,MAAM;IAIpB,+EAA+E;IAC/E,OAAO,CAAC,oBAAoB;IAO5B;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAYlC,6DAA6D;IAC7D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;;;;;;;OAUG;IACH,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE;IA8BlE,OAAO,CAAC,SAAS;IA0BjB,iEAAiE;IACjE,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,IAAI;IAIZ,gEAAgE;IAC1D,MAAM,CAAC,GAAG,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IA4D/P,YAAY,CAAC,GAAG,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;YA6DvP,UAAU;YASV,YAAY;IAQ1B,2EAA2E;YAC7D,OAAO;YAkCP,QAAQ;IAoDtB,OAAO,CAAC,YAAY;CAIrB;AAwBD,eAAO,MAAM,aAAa,EAAE,WAAW,EAStC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,YAYnC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,EAAE,YAmC3B,CAAC;AACF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,YAA4B,CAAC;AAmB3D,sEAAsE;AACtE,KAAK,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;AAE7C,8EAA8E;AAC9E,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kFAAkF;AAClF,UAAU,YAAY;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,4EAA4E;AAC5E,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED,uFAAuF;AACvF,UAAU,SAAS;IACjB,QAAQ,CAAC,OAAO,EAAE;QAAE,cAAc,IAAI,YAAY,EAAE,CAAA;KAAE,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,iEAAiE;AACjE,UAAU,WAAW;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,OAAO,EAAE;QACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACzE,QAAQ,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzB,MAAM,CAAC,OAAO,EAAE;QACd,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED,uFAAuF;AACvF,UAAU,gBAAiB,SAAQ,YAAY;IAC7C,oEAAoE;IACpE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,MAAM;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAClG;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/I;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;CACjC;AA+BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,uBAAuB,GAC5B,gBAAgB,CAsIlB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,SAAS,EAET,UAAU,EAGV,OAAO,EACP,IAAI,EAEJ,IAAI,EACL,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,SAAS,EAKV,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,WAAY,SAAQ,UAAU;CAAG;AAElD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,wDAAwD;IACxD,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1C,+EAA+E;IAC/E,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzG;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,6DAA6D;AAC7D,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,QAAQ,CAA8B;IAE9C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAgB9B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS;IAIjC,IAAI,IAAI,IAAI,EAAE;IAId,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI;IAWpE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAYxI,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;CAG5C;AASD,yEAAyE;AACzE,qBAAa,SAAS;IACpB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,SAAS,CAA2C;IAC5D,OAAO,CAAC,OAAO,CAAS;IACxB,mFAAmF;IACnF,OAAO,CAAC,OAAO,CAAsC;gBAEzC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAkB;IAa3D;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKjC,0DAA0D;IAC1D,UAAU,IAAI,MAAM;IAIpB,+EAA+E;IAC/E,OAAO,CAAC,oBAAoB;IAO5B;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAYlC,6DAA6D;IAC7D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;;;;;;;OAUG;IACH,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE;IA8BlE,OAAO,CAAC,SAAS;IA0BjB;;;;;;OAMG;IACH,SAAS,CAAC,GAAG,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO;IAI7D,iEAAiE;IACjE,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,IAAI;IAIZ,gEAAgE;IAC1D,MAAM,CAAC,GAAG,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IA4D/P,YAAY,CAAC,GAAG,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;YA6DvP,UAAU;YASV,YAAY;IAQ1B,2EAA2E;YAC7D,OAAO;YAkCP,QAAQ;IAoDtB,OAAO,CAAC,YAAY;CAIrB;AAwBD,eAAO,MAAM,aAAa,EAAE,WAAW,EAStC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,YAYnC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,EAAE,YAmC3B,CAAC;AACF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,YAA4B,CAAC;AAmB3D,sEAAsE;AACtE,KAAK,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;AAE7C,8EAA8E;AAC9E,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kFAAkF;AAClF,UAAU,YAAY;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,4EAA4E;AAC5E,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAED,uFAAuF;AACvF,UAAU,SAAS;IACjB,QAAQ,CAAC,OAAO,EAAE;QAAE,cAAc,IAAI,YAAY,EAAE,CAAA;KAAE,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,iEAAiE;AACjE,UAAU,WAAW;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,OAAO,EAAE;QACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACzE,QAAQ,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzB,MAAM,CAAC,OAAO,EAAE;QACd,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED,uFAAuF;AACvF,UAAU,gBAAiB,SAAQ,YAAY;IAC7C,oEAAoE;IACpE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,6HAA6H;IAC7H,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,MAAM;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAClG;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/I;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;CACjC;AA+BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,uBAAuB,GAC5B,gBAAgB,CAsIlB"}

package/package.json

@@ -1,7 +1,23 @@
 {
   "name": "@ryubyte/dsh-a2a",
   "description": "Agent2Agent (A2A) protocol v1.0 plugin for DeepSeek Harness (DSH): outbound client (remote AgentCard skills as ctx.tools), inbound server (A2A JSON-RPC + AgentCard endpoint), and a settings dashboard of live A2A connections",
-  "version": "0.2.0",
+  "version": "0.3.0",
+  "keywords": [
+    "a2a",
+    "agent2agent",
+    "agent-to-agent",
+    "a2a-protocol",
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "dsh-bundle",
+    "agent",
+    "ai-agent",
+    "agent-card",
+    "json-rpc",
+    "sse",
+    "interoperability"
+  ],
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -33,12 +49,12 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.7-rc.2",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
@@ -56,7 +72,7 @@
   "dsh": {
     "client": {
       "inject": [
-        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-renderer",
         "@deepseek-ai/dsh-client-ui-slots",
         "@deepseek-ai/dsh-client-ui-settings"
       ],

package/src/a2a-config.ts

@@ -49,6 +49,8 @@ export interface PersistedServerConfig {
   endpointPath?: string;
   /** Optional shared bearer token protecting the inbound /a2a endpoint. */
   authToken?: string;
+  /** Browser origins allowed to call the inbound A2A routes (CORS allowlist); empty/absent = no CORS. `["*"]` opts into wildcard. */
+  corsOrigins?: string[];
   skills?: Array<{ id: string; name: string; description: string; tags?: string[]; examples?: string[] }>;
 }
 
@@ -247,6 +249,7 @@ export function mergePersisted(base: A2APluginConfig, persisted: PersistedA2ACon
     if (pServer.agentVersion) merged.agentVersion = pServer.agentVersion;
     if (pServer.endpointPath) merged.endpointPath = pServer.endpointPath;
     if (pServer.authToken !== undefined) merged.authToken = pServer.authToken;
+    if (pServer.corsOrigins !== undefined) merged.corsOrigins = pServer.corsOrigins;
     if (pServer.skills) merged.skills = pServer.skills;
   }
   return merged;

package/src/client/dashboard.css.ts

@@ -193,6 +193,11 @@ const css = String.raw`
 .a2a-auth-state[data-on='false'] { color: var(--dsw-alias-label-tertiary, #81858c); }
 .a2a-auth-input-row { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
 .a2a-auth-input-row .a2a-input { flex: 1; min-width: 220px; }
+.a2a-cors-list { display: flex; flex-wrap: wrap; gap: 6px; }
+.a2a-cors-chip { display: inline-flex; align-items: center; gap: 6px; font-size: 12px; font-family: var(--ds-font-family-code, ui-monospace, monospace); padding: 2px 6px 2px 8px; border-radius: var(--dsw-radius-sm, 6px); background: var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.05)); border: .5px solid var(--dsw-alias-border-l3, #d0d3d9); color: var(--dsw-alias-label-secondary, #4a4f57); }
+.a2a-cors-chip-x { border: none; background: none; cursor: pointer; font-size: 14px; line-height: 1; padding: 0 2px; color: var(--dsw-alias-label-tertiary, #81858c); }
+.a2a-cors-chip-x:hover:not(:disabled) { color: var(--dsw-alias-state-error-primary, #f04438); }
+.a2a-cors-chip-x:disabled { cursor: default; opacity: .4; }
 
 /* ---- inbound table ---- */
 .a2a-table-wrap { overflow-x: auto; border: 1px solid var(--dsw-alias-border-l1, rgba(127,127,127,.12)); border-radius: 10px; }

package/src/client/index.ts

@@ -14,7 +14,10 @@
  * narrow-window layouts follow the DSH shell. No inline styles.
  */
 
-import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client';
+import type { Context as ClientContext } from '@deepseek-ai/cordis';
+// Side-effect type import: augments cordis `Context` with `slots` (the renderer
+// owns that service; the retired `dsh-client-runtime` used to re-export it).
+import type {} from '@deepseek-ai/dsh-client-ui-renderer/client';
 import type {} from '@deepseek-ai/dsh-client-ui-settings/client';
 import type { PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
 import { createElement, useEffect, useState, type ReactElement } from 'react';
@@ -30,24 +33,28 @@ export function apply(ctx: ClientContext): void {
     return () => dispose();
   }, 'dsh-a2a: dashboard styles');
 
-  ctx.effect(() => {
-    try {
-      const off = ctx.slots.register(
-        {
-          name: 'settings.section',
-          id: 'a2a',
-          order: 90,
-          label: () => 'A2A 连接',
-          inject: () => ({}),
-        },
-        DashboardSection,
-      );
-      return () => off();
-    } catch (err) {
-      console.error('[dsh-a2a] failed to register settings section:', err);
-      return () => {};
-    }
-  }, 'dsh-a2a: settings section');
+  // Contribute the "A2A 连接" settings section. The `settings.section` slot is
+  // declared by `dsh-client-ui-settings`, which may activate AFTER this plugin.
+  // A bare `slots.register` throws "slot not declared" when it wins that race
+  // (silently swallowed here, so the section never appears). `slots.inject`
+  // defers the register until the declaration is committed and re-runs it across
+  // declaration lifetimes — the pattern every first-party settings section uses.
+  ctx.effect(
+    () =>
+      ctx.slots.inject('settings.section', () =>
+        ctx.slots.register(
+          {
+            name: 'settings.section',
+            id: 'a2a',
+            order: 90,
+            label: () => 'A2A 连接',
+            inject: () => ({}),
+          },
+          DashboardSection,
+        ),
+      ),
+    'dsh-a2a: settings section',
+  );
 }
 
 // ── wire types (mirror the host dashboard.ts) ──────────────────────────────
@@ -129,6 +136,8 @@ interface ServeStatus {
   executor?: 'custom' | 'dsh-agent' | 'none';
   /** Whether the inbound endpoint is token-gated (never the token value). */
   authConfigured?: boolean;
+  /** Browser origins allowed to call inbound cross-origin (CORS allowlist); empty = no CORS. */
+  corsOrigins?: string[];
 }
 
 interface DiscoveredCard {
@@ -227,6 +236,8 @@ export function DashboardSection(_props: SectionProps): ReactElement {
   const [addToken, setAddToken] = useState('');
   /** Inbound authToken input (serve tab); empty string means "clear". */
   const [authInput, setAuthInput] = useState('');
+  /** New-origin input for the inbound CORS allowlist editor (serve tab). */
+  const [corsInput, setCorsInput] = useState('');
   /** Serve-identity edit mode + form draft (server tab). All hooks stay at the
    * top level in fixed order; a single shared draft avoids per-card hooks. */
   const [editingServe, setEditingServe] = useState(false);
@@ -511,7 +522,7 @@ export function DashboardSection(_props: SectionProps): ReactElement {
               ? serveEditPanel(serveDraft, setServeDraft, (also) => void saveServeIdentity(also), () => setEditingServe(false), busy, false)
               : needsServeSetup(serve)
                 ? serveEditPanel(serveDraft, setServeDraft, (also) => void saveServeIdentity(also), () => setEditingServe(false), busy, true)
-                : serveViewPanel(serve, busy, act, authInput, setAuthInput, startEditServe)
+                : serveViewPanel(serve, busy, act, authInput, setAuthInput, corsInput, setCorsInput, startEditServe)
             : null,
           // (2) inbound connections — who is calling this DSH's A2A endpoint
           createElement(
@@ -857,6 +868,8 @@ function serveViewPanel(
   act: (a: string, t: string, p?: Record<string, unknown>) => Promise<void>,
   authInput: string,
   setAuthInput: (v: string) => void,
+  corsInput: string,
+  setCorsInput: (v: string) => void,
   onEdit: () => void,
 ): ReactElement {
   return createElement(
@@ -926,6 +939,7 @@ function serveViewPanel(
     ),
     serve.enabled ? executorNote(serve) : null,
     serve.enabled ? authControl(serve, busy, act, authInput, setAuthInput) : null,
+    serve.enabled ? corsControl(serve, busy, act, corsInput, setCorsInput) : null,
   );
 }
 
@@ -1097,6 +1111,99 @@ function authControl(
   );
 }
 
+/**
+ * Inbound CORS allowlist control for the serve tab: shows the allowed browser
+ * origins and lets the operator add/remove them. Empty = no CORS (default),
+ * so cross-origin browser clients are blocked. Origins are exact
+ * scheme+host+port strings; the literal `*` opens it to any site (warned).
+ * Applies live (persisted to a2a.json) — no restart needed.
+ */
+function corsControl(
+  serve: { corsOrigins?: string[] },
+  busy: string | null,
+  act: (a: string, t: string, p?: Record<string, unknown>) => Promise<void>,
+  corsInput: string,
+  setCorsInput: (v: string) => void,
+): ReactElement {
+  const origins = serve.corsOrigins ?? [];
+  const hasWildcard = origins.includes('*');
+  const isBusy = busy === 'set-server-cors:';
+  const save = (next: string[]): void => {
+    void act('set-server-cors', '', { corsOrigins: next });
+  };
+  const addOrigin = (): void => {
+    const v = corsInput.trim();
+    if (!v || origins.includes(v)) { setCorsInput(''); return; }
+    save([...origins, v]);
+    setCorsInput('');
+  };
+  return createElement(
+    'div',
+    { className: 'a2a-auth' },
+    createElement(
+      'div',
+      { className: 'a2a-auth-row' },
+      createElement('span', { className: 'a2a-auth-label' }, '跨域访问 (CORS)'),
+      stateDot(origins.length > 0 ? (hasWildcard ? 'reconnecting' : 'connected') : 'disabled'),
+      createElement(
+        'span',
+        { className: 'a2a-auth-state', 'data-on': String(origins.length > 0) },
+        origins.length === 0
+          ? '未开启(浏览器跨源调用被拒)'
+          : hasWildcard
+            ? '允许任意来源(*)'
+            : `已允许 ${origins.length} 个来源`,
+      ),
+    ),
+    // Current allowlist as removable chips.
+    origins.length > 0
+      ? createElement(
+          'div',
+          { className: 'a2a-cors-list' },
+          ...origins.map((o) =>
+            createElement(
+              'span',
+              { key: o, className: 'a2a-cors-chip' },
+              o,
+              createElement(
+                'button',
+                {
+                  className: 'a2a-cors-chip-x',
+                  title: '移除',
+                  disabled: isBusy,
+                  onClick: () => save(origins.filter((x) => x !== o)),
+                },
+                '×',
+              ),
+            ),
+          ),
+        )
+      : null,
+    createElement(
+      'div',
+      { className: 'a2a-auth-input-row' },
+      createElement('input', {
+        className: 'a2a-input',
+        type: 'text',
+        placeholder: '添加来源,如 http://localhost:8080 或 *',
+        value: corsInput,
+        disabled: isBusy,
+        onChange: (e: { target: { value: string } }) => setCorsInput(e.target.value),
+        onKeyDown: (e: { key: string }) => { if (e.key === 'Enter') addOrigin(); },
+      }),
+      actionBtn('添加', true, addOrigin, isBusy || !corsInput.trim()),
+      origins.length > 0 ? actionBtn('清空', false, () => save([]), isBusy) : null,
+    ),
+    createElement(
+      'div',
+      { className: 'a2a-hint' },
+      hasWildcard
+        ? '⚠️ 已允许任意来源(*):用户浏览器打开的任何网站都能跨源调用本入站端点。仅在完全可信的本机环境使用,并建议同时配置入站鉴权 token。'
+        : '填入完整来源(协议+主机+端口,精确匹配)。留空则默认禁止浏览器跨源调用;写 * 可放开任意来源(不推荐)。跨域配置明文存入 a2a.json,实时生效。',
+    ),
+  );
+}
+
 function inboundRow(p: InboundPeerApi, busy: string | null, act: (a: string, t: string) => void): ReactElement {
   return createElement(
     'tr',

package/src/dashboard.ts

@@ -98,6 +98,8 @@ export interface DashboardControlHooks {
   setServerEnabled?: (enabled: boolean) => Promise<ControlResult>;
   /** Set or clear the inbound server's shared bearer token at runtime (persisted). */
   setServerAuthToken?: (token?: string) => Promise<ControlResult>;
+  /** Replace the inbound CORS origin allowlist at runtime (persisted); empty = no CORS. */
+  setServerCors?: (origins: string[]) => Promise<ControlResult>;
   /** Read current inbound server status (for the serve panel). */
   serverStatus?: () => ControlResult;
   /** Runtime-remove an outbound agent by its connection id. */
@@ -321,6 +323,14 @@ export class DashboardRegistry {
           ? this.hooks.setServerAuthToken(token)
           : { ok: false, message: 'set-server-auth is not wired (server mode not mounted)' };
       }
+      case 'set-server-cors': {
+        // Replace the CORS origin allowlist wholesale; empty array = no CORS.
+        const raw = payload?.corsOrigins;
+        const origins = Array.isArray(raw) ? raw.filter((o): o is string => typeof o === 'string') : [];
+        return this.hooks.setServerCors
+          ? this.hooks.setServerCors(origins)
+          : { ok: false, message: 'set-server-cors is not wired (server mode not mounted)' };
+      }
       case 'server-status':
         return this.hooks.serverStatus
           ? Promise.resolve(this.hooks.serverStatus())

package/src/index.ts

@@ -60,6 +60,22 @@ export interface A2APluginConfig {
   execute?: ServerOptions['execute'];
   /** Optional shared bearer token protecting the inbound /a2a endpoint. */
   authToken?: string;
+  /**
+   * Browser origins allowed to call the inbound A2A routes cross-origin (CORS).
+   * An explicit allowlist of exact origins (scheme+host+port), e.g.
+   * `['http://localhost:8080', 'https://app.example.com']`.
+   *
+   * DEFAULT IS EMPTY = NO CORS: a browser page from another origin cannot call
+   * the endpoint, which is the safe default — with server mode's optional (and
+   * off-by-default) `authToken`, a wildcard would let any site the user visits
+   * drive their local agent. Each request's `Origin` is matched against this
+   * list; a hit echoes that exact origin back (with `Vary: Origin`), a miss
+   * sends no CORS headers. The literal `['*']` opts into a wildcard (logged as
+   * a warning) for fully-trusted local setups. Credentials are never allowed
+   * (auth rides the Bearer header, not cookies). Scoped to the A2A protocol
+   * routes only — the dashboard API (`/a2a/api`) stays loopback/same-origin.
+   */
+  corsOrigins?: string[];
   // dashboard
   /** Serve the dashboard API on the webserver (default true). */
   dashboard?: boolean;
@@ -671,15 +687,37 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
         // keeps routes off until the UI enables the server.
         let enabled = wantsServer;
         let disposers: Array<() => void> = [];
+        // Mutable CORS allowlist, read per-request so a UI change takes effect
+        // live (like authToken) without rebuilding routes. Normalized to unique,
+        // trimmed, non-empty entries. Empty = no CORS (safe default).
+        let corsAllowlist: string[] = normalizeOrigins(mergedConfig.corsOrigins);
+        if (corsAllowlist.includes('*')) {
+          logger?.warn?.(
+            '[a2a] corsOrigins includes "*": the inbound A2A endpoint accepts cross-origin browser calls from ANY site. ' +
+              'Set an explicit origin allowlist unless this host is fully trusted and, ideally, gate it with authToken.',
+          );
+        }
 
         const registerRoutes = (): void => {
+          // CORS for the A2A protocol routes so allowlisted browser clients
+          // (Flutter Web, plain fetch()) can call cross-origin. Resolved
+          // per-request against `corsAllowlist` (read live so a UI change lands
+          // without a route rebuild); empty allowlist = no CORS. Scoped to these
+          // routes only — /a2a/api stays loopback-fenced.
+          const cors = (req: IncomingMessage): Record<string, string> =>
+            corsHeadersFor(req.headers.origin, corsAllowlist);
           // AgentCard discovery route.
           disposers.push(
             webServer.register({
               kind: 'exact',
               path: '/.well-known/agent-card.json',
-              handler: async (_req: IncomingMessage, res: ServerResponse) => {
-                res.writeHead(200, { 'content-type': 'application/json' });
+              handler: async (req: IncomingMessage, res: ServerResponse) => {
+                if (req.method === 'OPTIONS') {
+                  res.writeHead(204, cors(req));
+                  res.end();
+                  return;
+                }
+                res.writeHead(200, { 'content-type': 'application/json', ...cors(req) });
                 res.end(JSON.stringify(server.card));
               },
             }),
@@ -690,30 +728,49 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
               kind: 'prefix',
               path: server.endpointPath,
               handler: async (req: IncomingMessage, res: ServerResponse) => {
+                const ch = cors(req);
+                // Answer the CORS preflight before any routing — a browser sends
+                // OPTIONS first and refuses the real request without these headers.
+                if (req.method === 'OPTIONS') {
+                  res.writeHead(204, ch);
+                  res.end();
+                  return;
+                }
                 const isStream = (req.headers.accept ?? '').includes('text/event-stream');
                 if (req.method === 'GET' && (req.url ?? '').startsWith(server.endpointPath + '/card')) {
-                  res.writeHead(200, { 'content-type': 'application/json' });
+                  res.writeHead(200, { 'content-type': 'application/json', ...ch });
                   res.end(JSON.stringify(server.card));
                   return;
                 }
                 if (req.method !== 'POST') {
-                  res.writeHead(405, { 'content-type': 'text/plain' });
+                  res.writeHead(405, { 'content-type': 'text/plain', ...ch });
                   res.end('Method Not Allowed');
                   return;
                 }
                 const body = await readBody(req);
                 if (isStream) {
-                  const stream = await server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
-                  if (stream.status !== 200) {
-                    res.writeHead(stream.status, { 'content-type': 'text/plain', ...(stream.headers ?? {}) });
+                  // Auth must be decided BEFORE the first frame: the SSE success
+                  // path writes frames via the onEvent callback, and the first
+                  // res.write() implicitly flushes headers — so we cannot set
+                  // text/event-stream + CORS afterward. Gate here, write the
+                  // stream headers up front, then stream.
+                  if (!server.checkAuth(toServerReq(req))) {
+                    res.writeHead(401, { 'content-type': 'text/plain', ...ch, 'WWW-Authenticate': 'Bearer' });
                     res.end('Unauthorized');
                     return;
                   }
+                  res.writeHead(200, {
+                    'content-type': 'text/event-stream',
+                    'cache-control': 'no-cache',
+                    connection: 'keep-alive',
+                    ...ch,
+                  });
+                  await server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
                   res.end();
                   return;
                 }
                 const out = await server.handle(toServerReq(req), body);
-                res.writeHead(out.status, { 'content-type': out.contentType, ...(out.headers ?? {}) });
+                res.writeHead(out.status, { 'content-type': out.contentType, ...ch, ...(out.headers ?? {}) });
                 res.end(out.body);
               },
             }),
@@ -830,9 +887,34 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
             logger?.info?.(`[a2a] inbound authToken ${token ? 'set' : 'cleared'} (saved to ${res.path})`);
             return { ok: true, message: token ? '已设置入站鉴权 token' : '已清除入站鉴权 token' };
           },
+          setServerCors: async (origins) => {
+            // Replace the allowlist wholesale; read live by the route handlers,
+            // so this takes effect on the next request without a route rebuild.
+            corsAllowlist = normalizeOrigins(origins);
+            if (corsAllowlist.includes('*')) {
+              logger?.warn?.(
+                '[a2a] corsOrigins set to include "*": the inbound A2A endpoint now accepts cross-origin browser calls from ANY site.',
+              );
+            }
+            const next: PersistedA2AConfig = loadPersistedA2A();
+            next.server = {
+              ...(next.server ?? {}),
+              corsOrigins: corsAllowlist.length > 0 ? corsAllowlist : undefined,
+            };
+            const res = savePersistedA2A(next);
+            if (!res.ok) {
+              logger?.error?.(`[a2a] failed to persist corsOrigins to ${res.path}: ${res.message}`);
+              return { ok: false, message: `applied in-memory but failed to save: ${res.message}` };
+            }
+            logger?.info?.(`[a2a] inbound CORS allowlist updated (${corsAllowlist.length} origin(s), saved to ${res.path})`);
+            return {
+              ok: true,
+              message: corsAllowlist.length > 0 ? `已更新跨域白名单 (${corsAllowlist.length} 个来源)` : '已清空跨域白名单(默认禁止跨源)',
+            };
+          },
           serverStatus: () => ({
             ok: true,
-            message: JSON.stringify({ enabled, ...serverCard() }),
+            message: JSON.stringify({ enabled, ...serverCard(), corsOrigins: corsAllowlist }),
           }),
         });
 
@@ -1008,6 +1090,47 @@ async function readBody(req: IncomingMessage): Promise<string> {
   });
 }
 
+/** Normalize a CORS origin allowlist: trim, drop empties, de-duplicate. */
+function normalizeOrigins(origins: readonly string[] | undefined): string[] {
+  if (!origins) return [];
+  const seen = new Set<string>();
+  for (const o of origins) {
+    const t = typeof o === 'string' ? o.trim() : '';
+    if (t) seen.add(t);
+  }
+  return [...seen];
+}
+
+/**
+ * Resolve CORS headers for one inbound A2A request against the configured
+ * origin allowlist. Returns `{}` (no CORS) when the request has no `Origin`,
+ * the allowlist is empty, or the origin isn't allowed — so a disallowed
+ * cross-origin browser call is blocked by the browser exactly as before this
+ * feature existed. An allowed origin is echoed back verbatim (never `*` unless
+ * the operator explicitly configured `['*']`), with `Vary: Origin` so shared
+ * caches don't leak one origin's response to another. Credentials are never
+ * allowed: inbound auth is a Bearer header, not a cookie.
+ */
+function corsHeadersFor(reqOrigin: string | undefined, allowed: readonly string[]): Record<string, string> {
+  if (allowed.length === 0) return {};
+  const wildcard = allowed.includes('*');
+  // `*` echoes the caller's origin when present (so the value is still concrete
+  // and future credentialed use stays possible), else the literal `*`.
+  let allowOrigin: string | undefined;
+  if (wildcard) allowOrigin = reqOrigin ?? '*';
+  else if (reqOrigin && allowed.includes(reqOrigin)) allowOrigin = reqOrigin;
+  if (!allowOrigin) return {};
+  const headers: Record<string, string> = {
+    'Access-Control-Allow-Origin': allowOrigin,
+    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+    'Access-Control-Max-Age': '86400',
+  };
+  // Vary on Origin whenever the value is request-dependent (i.e. not a static `*`).
+  if (allowOrigin !== '*') headers['Vary'] = 'Origin';
+  return headers;
+}
+
 /** Loopback/same-origin trust fence for the dashboard API (no remote write). */
 function trustedLoopback(req: IncomingMessage): boolean {
   const host = req.headers.host;