@sekuire/sdk 0.1.23 → 0.1.24

package/dist/a2a-client.d.ts

@@ -13,6 +13,10 @@ export interface A2AClientOptions {
     timeout?: number;
     /** Optional device fingerprint for API-key auth on task endpoints */
     deviceFingerprint?: string;
+    /** Optional runtime token resolver for per-request credential sync */
+    tokenResolver?: () => string | undefined;
+    /** Optional callback to refresh credentials after runtime-token 401 */
+    onUnauthorized?: () => Promise<void>;
 }
 /**
  * A2A Protocol Client
@@ -45,6 +49,8 @@ export declare class A2AClient {
     private runtimeToken;
     private timeout;
     private deviceFingerprint;
+    private tokenResolver?;
+    private onUnauthorized?;
     constructor(options: A2AClientOptions);
     setRuntimeToken(token: string): void;
     /**
@@ -110,6 +116,8 @@ export declare class A2AClient {
     private jsonRpc;
     private fetch;
     private fetchTask;
+    private doFetchTask;
+    private resolveRuntimeToken;
     private taskAuthHeaders;
     private isLikelyJwt;
 }

package/dist/a2a-delegator.d.ts

@@ -17,6 +17,8 @@ export interface DelegatorConfig {
     retryDelayMs?: number;
     retryBackoffMultiplier?: number;
     policyGateway?: PolicyGateway;
+    tokenResolver?: () => string | undefined;
+    onUnauthorized?: () => Promise<void>;
 }
 export interface DelegationRequest {
     skill: string;

package/dist/index.d.ts

@@ -305,6 +305,8 @@ interface DelegatorConfig {
     retryDelayMs?: number;
     retryBackoffMultiplier?: number;
     policyGateway?: PolicyGateway;
+    tokenResolver?: () => string | undefined;
+    onUnauthorized?: () => Promise<void>;
 }
 interface DelegationRequest {
     skill: string;
@@ -1079,6 +1081,9 @@ declare class SekuireSDK {
     createDelegator(options?: {
         timeout?: number;
         pollInterval?: number;
+        maxRetries?: number;
+        retryDelayMs?: number;
+        retryBackoffMultiplier?: number;
     }): A2ATaskDelegator;
     /**
      * Get the agent ID.
@@ -3362,6 +3367,10 @@ interface A2AClientOptions {
     timeout?: number;
     /** Optional device fingerprint for API-key auth on task endpoints */
     deviceFingerprint?: string;
+    /** Optional runtime token resolver for per-request credential sync */
+    tokenResolver?: () => string | undefined;
+    /** Optional callback to refresh credentials after runtime-token 401 */
+    onUnauthorized?: () => Promise<void>;
 }
 /**
  * A2A Protocol Client
@@ -3394,6 +3403,8 @@ declare class A2AClient {
     private runtimeToken;
     private timeout;
     private deviceFingerprint;
+    private tokenResolver?;
+    private onUnauthorized?;
     constructor(options: A2AClientOptions);
     setRuntimeToken(token: string): void;
     /**
@@ -3459,6 +3470,8 @@ declare class A2AClient {
     private jsonRpc;
     private fetch;
     private fetchTask;
+    private doFetchTask;
+    private resolveRuntimeToken;
     private taskAuthHeaders;
     private isLikelyJwt;
 }

package/dist/index.esm.js

@@ -69,6 +69,8 @@ class A2AClient {
             options.deviceFingerprint ||
                 process.env.SEKUIRE_DEVICE_FINGERPRINT ||
                 "sekuire-typescript-sdk";
+        this.tokenResolver = options.tokenResolver;
+        this.onUnauthorized = options.onUnauthorized;
     }
     setRuntimeToken(token) {
         this.runtimeToken = token;
@@ -78,7 +80,7 @@ class A2AClient {
      * The API will find an agent with the matching skill and forward the task.
      */
     async sendBySkill(request) {
-        const response = await this.fetch("/a2a/route", {
+        const response = await this.fetchTask("/a2a/route", {
             method: "POST",
             body: JSON.stringify(request),
         });
@@ -291,19 +293,37 @@ class A2AClient {
         });
     }
     async fetchTask(path, init) {
+        const runtimeToken = this.resolveRuntimeToken();
+        const response = await this.doFetchTask(path, init, runtimeToken);
+        const usedRuntimeToken = !!runtimeToken && runtimeToken.startsWith("srt_");
+        if (response.status === 401 && usedRuntimeToken && this.onUnauthorized) {
+            try {
+                await this.onUnauthorized();
+            }
+            catch {
+                return response;
+            }
+            return this.doFetchTask(path, init, this.resolveRuntimeToken());
+        }
+        return response;
+    }
+    async doFetchTask(path, init, runtimeToken) {
         return fetch(`${this.baseUrl}${path}`, {
             ...init,
             headers: {
                 "Content-Type": "application/json",
-                ...this.taskAuthHeaders(),
+                ...this.taskAuthHeaders(runtimeToken),
                 ...init.headers,
             },
             signal: AbortSignal.timeout(this.timeout),
         });
     }
-    taskAuthHeaders() {
-        if (this.runtimeToken) {
-            return { Authorization: `Bearer ${this.runtimeToken}` };
+    resolveRuntimeToken() {
+        return this.tokenResolver?.() ?? this.runtimeToken;
+    }
+    taskAuthHeaders(runtimeToken) {
+        if (runtimeToken) {
+            return { Authorization: `Bearer ${runtimeToken}` };
         }
         if (this.isLikelyJwt(this.authToken)) {
             return { Authorization: `Bearer ${this.authToken}` };
@@ -396,6 +416,8 @@ class A2ATaskDelegator {
             baseUrl: config.apiUrl,
             authToken: config.authToken,
             timeout: this.config.timeout,
+            tokenResolver: config.tokenResolver,
+            onUnauthorized: config.onUnauthorized,
         });
     }
     setRuntimeToken(token) {
@@ -3601,20 +3623,22 @@ class SekuireSDK {
      * task registration/completion can use runtime token if bootstrapped.
      */
     createDelegator(options) {
-        const credentials = this.getRuntimeCredentials();
-        const delegator = new A2ATaskDelegator({
+        return new A2ATaskDelegator({
             apiUrl: this.config.apiUrl,
             authToken: this.config.apiKey || "",
             workspaceId: this.config.workspaceId,
             agentId: this.config.agentId,
             timeout: options?.timeout,
             pollInterval: options?.pollInterval,
+            maxRetries: options?.maxRetries,
+            retryDelayMs: options?.retryDelayMs,
+            retryBackoffMultiplier: options?.retryBackoffMultiplier,
             policyGateway: this.policyGateway ?? undefined,
+            tokenResolver: () => this.credentialsStore.getRuntimeToken(),
+            onUnauthorized: async () => {
+                await this.credentialsStore.refreshRuntimeToken("A2AClient");
+            },
         });
-        if (credentials?.runtimeToken) {
-            delegator.setRuntimeToken(credentials.runtimeToken);
-        }
-        return delegator;
     }
     /**
      * Get the agent ID.

package/dist/index.js

@@ -93,6 +93,8 @@ class A2AClient {
             options.deviceFingerprint ||
                 process.env.SEKUIRE_DEVICE_FINGERPRINT ||
                 "sekuire-typescript-sdk";
+        this.tokenResolver = options.tokenResolver;
+        this.onUnauthorized = options.onUnauthorized;
     }
     setRuntimeToken(token) {
         this.runtimeToken = token;
@@ -102,7 +104,7 @@ class A2AClient {
      * The API will find an agent with the matching skill and forward the task.
      */
     async sendBySkill(request) {
-        const response = await this.fetch("/a2a/route", {
+        const response = await this.fetchTask("/a2a/route", {
             method: "POST",
             body: JSON.stringify(request),
         });
@@ -315,19 +317,37 @@ class A2AClient {
         });
     }
     async fetchTask(path, init) {
+        const runtimeToken = this.resolveRuntimeToken();
+        const response = await this.doFetchTask(path, init, runtimeToken);
+        const usedRuntimeToken = !!runtimeToken && runtimeToken.startsWith("srt_");
+        if (response.status === 401 && usedRuntimeToken && this.onUnauthorized) {
+            try {
+                await this.onUnauthorized();
+            }
+            catch {
+                return response;
+            }
+            return this.doFetchTask(path, init, this.resolveRuntimeToken());
+        }
+        return response;
+    }
+    async doFetchTask(path, init, runtimeToken) {
         return fetch(`${this.baseUrl}${path}`, {
             ...init,
             headers: {
                 "Content-Type": "application/json",
-                ...this.taskAuthHeaders(),
+                ...this.taskAuthHeaders(runtimeToken),
                 ...init.headers,
             },
             signal: AbortSignal.timeout(this.timeout),
         });
     }
-    taskAuthHeaders() {
-        if (this.runtimeToken) {
-            return { Authorization: `Bearer ${this.runtimeToken}` };
+    resolveRuntimeToken() {
+        return this.tokenResolver?.() ?? this.runtimeToken;
+    }
+    taskAuthHeaders(runtimeToken) {
+        if (runtimeToken) {
+            return { Authorization: `Bearer ${runtimeToken}` };
         }
         if (this.isLikelyJwt(this.authToken)) {
             return { Authorization: `Bearer ${this.authToken}` };
@@ -420,6 +440,8 @@ class A2ATaskDelegator {
             baseUrl: config.apiUrl,
             authToken: config.authToken,
             timeout: this.config.timeout,
+            tokenResolver: config.tokenResolver,
+            onUnauthorized: config.onUnauthorized,
         });
     }
     setRuntimeToken(token) {
@@ -3625,20 +3647,22 @@ class SekuireSDK {
      * task registration/completion can use runtime token if bootstrapped.
      */
     createDelegator(options) {
-        const credentials = this.getRuntimeCredentials();
-        const delegator = new A2ATaskDelegator({
+        return new A2ATaskDelegator({
             apiUrl: this.config.apiUrl,
             authToken: this.config.apiKey || "",
             workspaceId: this.config.workspaceId,
             agentId: this.config.agentId,
             timeout: options?.timeout,
             pollInterval: options?.pollInterval,
+            maxRetries: options?.maxRetries,
+            retryDelayMs: options?.retryDelayMs,
+            retryBackoffMultiplier: options?.retryBackoffMultiplier,
             policyGateway: this.policyGateway ?? undefined,
+            tokenResolver: () => this.credentialsStore.getRuntimeToken(),
+            onUnauthorized: async () => {
+                await this.credentialsStore.refreshRuntimeToken("A2AClient");
+            },
         });
-        if (credentials?.runtimeToken) {
-            delegator.setRuntimeToken(credentials.runtimeToken);
-        }
-        return delegator;
     }
     /**
      * Get the agent ID.

package/dist/sdk.d.ts

@@ -205,6 +205,9 @@ export declare class SekuireSDK {
     createDelegator(options?: {
         timeout?: number;
         pollInterval?: number;
+        maxRetries?: number;
+        retryDelayMs?: number;
+        retryBackoffMultiplier?: number;
     }): A2ATaskDelegator;
     /**
      * Get the agent ID.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sekuire/sdk",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "Sekuire Identity Protocol SDK for TypeScript/JavaScript",
   "type": "module",
   "main": "dist/index.js",