@zhin.js/a2a 3.0.13 → 3.0.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +60 -0
- package/README.md +72 -0
- package/lib/agent-executor.js +1 -0
- package/lib/agent-executor.js.map +1 -1
- package/lib/index.d.ts +4 -1
- package/lib/index.d.ts.map +1 -1
- package/lib/index.js +3 -0
- package/lib/index.js.map +1 -1
- package/lib/runtime.d.ts +21 -0
- package/lib/runtime.d.ts.map +1 -1
- package/lib/runtime.js +3 -0
- package/lib/runtime.js.map +1 -1
- package/lib/workroom-auth-registry.d.ts +66 -0
- package/lib/workroom-auth-registry.d.ts.map +1 -0
- package/lib/workroom-auth-registry.js +210 -0
- package/lib/workroom-auth-registry.js.map +1 -0
- package/lib/workroom-callback-runtime.d.ts +43 -0
- package/lib/workroom-callback-runtime.d.ts.map +1 -0
- package/lib/workroom-callback-runtime.js +216 -0
- package/lib/workroom-callback-runtime.js.map +1 -0
- package/lib/workroom-remote-transport.d.ts +58 -0
- package/lib/workroom-remote-transport.d.ts.map +1 -0
- package/lib/workroom-remote-transport.js +429 -0
- package/lib/workroom-remote-transport.js.map +1 -0
- package/package.json +7 -7
- package/src/agent-executor.ts +1 -0
- package/src/index.ts +5 -0
- package/src/runtime.ts +42 -0
- package/src/workroom-auth-registry.ts +279 -0
- package/src/workroom-callback-runtime.ts +294 -0
- package/src/workroom-remote-transport.ts +555 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,65 @@
|
|
|
1
1
|
# @zhin.js/a2a
|
|
2
2
|
|
|
3
|
+
## 3.0.15
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies [f2c532f]
|
|
8
|
+
- Updated dependencies [3dbf990]
|
|
9
|
+
- @zhin.js/core@1.5.13
|
|
10
|
+
- @zhin.js/agent@1.1.15
|
|
11
|
+
- zhin.js@6.0.13
|
|
12
|
+
|
|
13
|
+
## 3.0.14
|
|
14
|
+
|
|
15
|
+
### Patch Changes
|
|
16
|
+
|
|
17
|
+
- 985fa22: Remove `ai.workrooms` as a restart-bound configuration surface. Workroom definitions now live in the persistent Workroom Catalog, are validated against the exact active Plugin Runtime generation, and can be managed through the Console without rewriting process configuration.
|
|
18
|
+
|
|
19
|
+
Remove the `AgentOrchestrator` and `ResourceHub` compatibility exports in favor of `AgentResourceHub`. The renamed resource hub is only the generation-scoped registry for Tool, Skill, SubAgent, MCP, and Hook capabilities; durable Workroom orchestration and Run/Task/Assignment state remain exclusively owned by the Workroom Kernel and its typed ports.
|
|
20
|
+
|
|
21
|
+
Route durable IM ingress through canonical Interaction Space bindings before commands or ordinary chat Agents. Workroom and Sponsor spaces produce content-free Project Inbox or Task Input proposals; they never fall through to the ordinary chat Agent authority path.
|
|
22
|
+
|
|
23
|
+
Add the authenticated Remote A2A callback host and the first durable outbound dispatch admission boundary. Remote dispatches preregister exact Assignment authority before transport, bind delivered remote task/context receipts before accepting callbacks, and recover crash windows without resending an already-bound dispatch. Missing or uncertain transport outcomes remain `reconcile_required` and cannot complete a Task.
|
|
24
|
+
|
|
25
|
+
Persist each Workroom member's Assignment locality in the Catalog. Omitted routes retain the legacy local meaning; remote routes name one exact A2A endpoint and remain deterministic when several endpoint transports are enabled. Catalog/Profile/Grant authority is rechecked before either local or remote claim, so local and remote providers can coexist without first-wins or lexicographic routing.
|
|
26
|
+
|
|
27
|
+
Replace the legacy file-backed Workroom Journal array format with content-addressed immutable v3 segments and database envelopes. The v3 schema uses an event-specific closed payload schema, stores only opaque control references beside governed payload receipts, and rejects unknown future fields before publication. Existing `.zhin/workroom-journal` data and database rows—including the blacklist-era v2 format—must be exported and migrated offline before starting this release; the runtime deliberately rejects legacy records instead of guessing their schema or silently upgrading historical `completed` work into accepted Project state.
|
|
28
|
+
|
|
29
|
+
Replace arbitrary Effect Sponsor decision `reason` text with the closed v2 `reasonCode` contract. An exact pending-Intent resubmission first publishes a content-free, digest-bound quarantine/supersession receipt, durably replaces the legacy plaintext slot with that tombstone, and then publishes to a dedicated v2 slot. Partial migrations fail closed and resume idempotently after restart, while existing v2 records in the former slot remain replay-compatible. Human rationale must use a governed payload surface and is never persisted in the content-free decision repository.
|
|
30
|
+
|
|
31
|
+
Require a full-scope token-bound principal plus current Catalog and P12 metadata authority for Portfolio Sponsor projections. Add the Root-authorized Data Steward/Privacy/Compliance Console plane for content-free lifecycle display, Hold review/release, subject erasure/export, retention purge, and reconciliation; identity and authority fields supplied by callers are rejected.
|
|
32
|
+
|
|
33
|
+
Add an optional persistent `sponsorConversation` delivery view to Workroom Catalog entries. Multiple Projects may share one portfolio-level Sponsor Room address, while controls require an explicit Project id and every outbound item remains Project-scoped. The Host bootstraps the exact current Endpoint binding before the first outbound alert; queued projections revalidate current Catalog membership/binding plus the Sponsor-specific P12 channel and manifest immediately before delivery.
|
|
34
|
+
|
|
35
|
+
Deliver content-free Portfolio lane, queue-head, grant/reclaim, budget, blocker, and fairness cards through that same governed Sponsor Room outbox. Strict Project-scoped Portfolio lane/status/budget-transfer controls use the authenticated Sponsor ingress path; a current card reply may supply the Project selector, switching Projects never rewrites a room-wide binding, and conflicting/stale explicit or reply targets are clarified without mutation.
|
|
36
|
+
|
|
37
|
+
Keep Local Assignment recovery scans independent from long-running executors, and use one locale-independent canonical comparator throughout Workroom, Portfolio, and Data Governance authority ordering.
|
|
38
|
+
|
|
39
|
+
Add `zhin agent legacy-runs <input>` and `zhin agent legacy-payloads <input> --kind <kind>` as offline recovery aids. Both commands read legacy data without mutating it and write create-only audit/proposal output; they never promote a legacy `completed` Run to accepted state, write a new Workroom Journal, delete embedded payloads, or perform an automatic migration. Any replacement work still requires explicit admission through the new Kernel.
|
|
40
|
+
|
|
41
|
+
- Updated dependencies [5969c5b]
|
|
42
|
+
- Updated dependencies [d336a3f]
|
|
43
|
+
- Updated dependencies [0c82a7e]
|
|
44
|
+
- Updated dependencies [b9217e4]
|
|
45
|
+
- Updated dependencies [5969c5b]
|
|
46
|
+
- Updated dependencies [974772e]
|
|
47
|
+
- Updated dependencies [5969c5b]
|
|
48
|
+
- Updated dependencies [5969c5b]
|
|
49
|
+
- Updated dependencies [2f786bd]
|
|
50
|
+
- Updated dependencies [63d89f9]
|
|
51
|
+
- Updated dependencies [71c7cdd]
|
|
52
|
+
- Updated dependencies [3cca0ea]
|
|
53
|
+
- Updated dependencies [1312ca0]
|
|
54
|
+
- Updated dependencies [985fa22]
|
|
55
|
+
- Updated dependencies [04b861d]
|
|
56
|
+
- Updated dependencies [a23d544]
|
|
57
|
+
- Updated dependencies [8cddabf]
|
|
58
|
+
- Updated dependencies [dbe5081]
|
|
59
|
+
- @zhin.js/core@1.5.12
|
|
60
|
+
- @zhin.js/agent@1.1.14
|
|
61
|
+
- zhin.js@6.0.12
|
|
62
|
+
|
|
3
63
|
## 3.0.13
|
|
4
64
|
|
|
5
65
|
### Patch Changes
|
package/README.md
CHANGED
|
@@ -35,6 +35,78 @@ package is inert and only exposes the Runtime API.
|
|
|
35
35
|
Bearer `a2a.token` (or the fallback `http.token`) is required for inbound A2A
|
|
36
36
|
calls. Production requires one of these tokens.
|
|
37
37
|
|
|
38
|
+
## Workroom execution callbacks
|
|
39
|
+
|
|
40
|
+
Authoritative remote-execution observations use a separate exact route and a
|
|
41
|
+
separate credential registry. They never enter the ordinary Agent Card / JSON-RPC
|
|
42
|
+
handler and cannot directly change Task state:
|
|
43
|
+
|
|
44
|
+
```yaml
|
|
45
|
+
a2a:
|
|
46
|
+
enabled: true
|
|
47
|
+
workroomCallbacks:
|
|
48
|
+
enabled: true
|
|
49
|
+
path: /workroom-a2a/callback
|
|
50
|
+
maxBodyBytes: 1048576
|
|
51
|
+
maxSequenceGap: 32
|
|
52
|
+
bindings:
|
|
53
|
+
- endpointId: remote-reviewer
|
|
54
|
+
tenantId: engineering
|
|
55
|
+
cardDigest: sha256:${REMOTE_CARD_SHA256}
|
|
56
|
+
authBindingId: callback-auth-v1
|
|
57
|
+
trustDomain: agents.example.com
|
|
58
|
+
extensionDigest: sha256:${WORKROOM_EXTENSION_SHA256}
|
|
59
|
+
credentialId: remote-reviewer-callback-v1
|
|
60
|
+
credential:
|
|
61
|
+
source: config
|
|
62
|
+
value: ${A2A_CALLBACK_TOKEN}
|
|
63
|
+
enabled: true
|
|
64
|
+
# Transport bindings only. Workroom/Project definitions stay in the
|
|
65
|
+
# persistent Workroom Catalog and are never read from ai.workrooms.
|
|
66
|
+
workroomRemoteExecutors:
|
|
67
|
+
enabled: true
|
|
68
|
+
maxResponseBytes: 1048576
|
|
69
|
+
bindings:
|
|
70
|
+
- endpointId: remote-reviewer
|
|
71
|
+
cardDigest: sha256:${REMOTE_CARD_SHA256}
|
|
72
|
+
authBindingId: callback-auth-v1
|
|
73
|
+
dispatchUrl: https://agents.example.com/workroom-a2a/dispatch
|
|
74
|
+
pollUrl: https://agents.example.com/workroom-a2a/poll
|
|
75
|
+
credential:
|
|
76
|
+
source: config
|
|
77
|
+
value: ${A2A_REMOTE_TOKEN}
|
|
78
|
+
authority:
|
|
79
|
+
workroomExtension: https://zhin.dev/extensions/workroom-executor/v1
|
|
80
|
+
idempotentDispatch: true
|
|
81
|
+
typedCompletionEnvelope: true
|
|
82
|
+
workspaceProviders: [github_pull_request]
|
|
83
|
+
enabled: true
|
|
84
|
+
```
|
|
85
|
+
|
|
86
|
+
`workroomCallbacks` may remain enabled while ordinary `a2a.enabled` is false.
|
|
87
|
+
The callback credential is authenticated before request bytes are consumed; it
|
|
88
|
+
is distinct from `a2a.token`. A callback is first persisted in the durable Link
|
|
89
|
+
Registry / Callback Inbox, then translated through Assignment Observation
|
|
90
|
+
Ingress. Only the Workroom Kernel can append the resulting Assignment event.
|
|
91
|
+
|
|
92
|
+
At generation activation the Host enumerates every durable registered Link and
|
|
93
|
+
replays pending observations. When `workroomRemoteExecutors` is enabled, the
|
|
94
|
+
same fixed-generation transport is installed for durable dispatch and typed
|
|
95
|
+
poll recovery. Endpoint id, Agent Card digest, and auth binding must match the
|
|
96
|
+
persisted dispatch exactly. The persistent Workroom Catalog member must also
|
|
97
|
+
declare `assignmentRoute: { "kind": "remote", "endpointId": "remote-reviewer" }`;
|
|
98
|
+
this selects one endpoint even when multiple transports are enabled, while a
|
|
99
|
+
missing route retains the legacy local meaning. The optional `authority` block is required before
|
|
100
|
+
that endpoint can claim a new Workroom Assignment; its extension URI digest
|
|
101
|
+
must match `workroomCallbacks.bindings[].extensionDigest`. Omitting it keeps
|
|
102
|
+
callback/poll recovery available but makes new claim issuance fail closed.
|
|
103
|
+
A sequence gap or uncertain transport result stays
|
|
104
|
+
`reconcile_required` and never marks the Assignment or Task complete.
|
|
105
|
+
|
|
106
|
+
For a provider-style reference, use `source: secure_provider` with an
|
|
107
|
+
`env://VARIABLE_NAME` `secretRef`; the CLI resolves it once into the candidate
|
|
108
|
+
generation and never places the value in runtime snapshots or logs.
|
|
109
|
+
|
|
38
110
|
## Related
|
|
39
111
|
|
|
40
112
|
- [Agent Mesh](../../../docs/advanced/agent-mesh.md)
|
package/lib/agent-executor.js
CHANGED
|
@@ -126,6 +126,7 @@ function createA2aTurnRequest(context, text, signal) {
|
|
|
126
126
|
return Object.freeze({
|
|
127
127
|
identity: Object.freeze({ traceId: context.taskId, turnId: randomUUID() }),
|
|
128
128
|
origin: Object.freeze({ kind: 'a2a', taskId: context.taskId }),
|
|
129
|
+
intent: Object.freeze({ kind: 'new' }),
|
|
129
130
|
principal: Object.freeze({ subjectId: 'a2a-client', roles: Object.freeze(['user']) }),
|
|
130
131
|
input: Object.freeze({ text }),
|
|
131
132
|
session: Object.freeze({ key: `a2a:${context.contextId}` }),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"agent-executor.js","sourceRoot":"","sources":["../src/agent-executor.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAa,MAAM,aAAa,CAAC;AAEnD,OAAO,EACL,UAAU,GAIX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/E,SAAS,oBAAoB,CAAC,QAAsC;IAClE,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACzD,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,cAA8B,EAAE,SAAiB;IACpE,OAAO;QACL,EAAE,EAAE,cAAc,CAAC,MAAM;QACzB,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,MAAM,EAAE;YACN,KAAK,EAAE,SAAS,CAAC,kBAAkB;YACnC,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;QACD,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;QACrC,QAAQ,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,eAAe;IAGG;IAFZ,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE9D,YAA6B,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAEhE,KAAK,CAAC,OAAO,CAAC,cAA8B,EAAE,QAA2B;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE;aACjD,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,MAAM,GAAS;gBACnB,GAAG,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtD,MAAM,EAAE;oBACN,KAAK,EAAE,SAAS,CAAC,iBAAiB;oBAClC,OAAO,EAAE,gBAAgB,CACvB,UAAU,EAAE,EACZ,cAAc,CAAC,SAAS,EACxB,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,aAAa,EAC7C,cAAc,CAAC,MAAM,CACtB;oBACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;aACF,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1C,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,iBAAiB,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CACjD,IAAI,CAAC,OAAO,CAAC,SAAS,EACtB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAC3D,CAAC;YACF,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC;mBAC1C,yBAAyB,CAAC;YAE/B,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;gBACzC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE;oBACR,UAAU,EAAE,UAAU,EAAE;oBACxB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,EAAE;oBACf,KAAK,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;oBAC7B,QAAQ,EAAE,SAAS;oBACnB,UAAU,EAAE,EAAE;iBACf;gBACD,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC,CAAC;YAEJ,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE;oBACN,KAAK,EAAE,SAAS,CAAC,oBAAoB;oBACrC,OAAO,EAAE,gBAAgB,CACvB,UAAU,EAAE,EACZ,cAAc,CAAC,SAAS,EACxB,UAAU,EACV,IAAI,CAAC,EAAE,CACR;oBACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;gBACD,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO;YACjC,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE;oBACN,KAAK,EAAE,SAAS,CAAC,iBAAiB;oBAClC,OAAO,EAAE,gBAAgB,CACvB,UAAU,EAAE,EACZ,cAAc,CAAC,SAAS,EACxB,SAAS,EACT,IAAI,CAAC,EAAE,CACR;oBACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;gBACD,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC,CAAC;QACN,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC3C,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,QAA2B;QAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;YACvC,MAAM;YACN,SAAS,EAAE,EAAE;YACb,MAAM,EAAE;gBACN,KAAK,EAAE,SAAS,CAAC,mBAAmB;gBACpC,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;YACD,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;CACF;AAED,SAAS,oBAAoB,CAC3B,OAAuB,EACvB,IAAY,EACZ,MAAmB;IAEnB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;QAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAc,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACvE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACrF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACjF,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,OAAoB;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9D,CAAC"}
|
|
1
|
+
{"version":3,"file":"agent-executor.js","sourceRoot":"","sources":["../src/agent-executor.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAa,MAAM,aAAa,CAAC;AAEnD,OAAO,EACL,UAAU,GAIX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS/E,SAAS,oBAAoB,CAAC,QAAsC;IAClE,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACzD,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,cAA8B,EAAE,SAAiB;IACpE,OAAO;QACL,EAAE,EAAE,cAAc,CAAC,MAAM;QACzB,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,MAAM,EAAE;YACN,KAAK,EAAE,SAAS,CAAC,kBAAkB;YACnC,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;QACD,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;QACrC,QAAQ,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,eAAe;IAGG;IAFZ,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE9D,YAA6B,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAEhE,KAAK,CAAC,OAAO,CAAC,cAA8B,EAAE,QAA2B;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE;aACjD,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,MAAM,GAAS;gBACnB,GAAG,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtD,MAAM,EAAE;oBACN,KAAK,EAAE,SAAS,CAAC,iBAAiB;oBAClC,OAAO,EAAE,gBAAgB,CACvB,UAAU,EAAE,EACZ,cAAc,CAAC,SAAS,EACxB,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,aAAa,EAC7C,cAAc,CAAC,MAAM,CACtB;oBACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;aACF,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1C,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,iBAAiB,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CACjD,IAAI,CAAC,OAAO,CAAC,SAAS,EACtB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAC3D,CAAC;YACF,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC;mBAC1C,yBAAyB,CAAC;YAE/B,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;gBACzC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE;oBACR,UAAU,EAAE,UAAU,EAAE;oBACxB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,EAAE;oBACf,KAAK,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;oBAC7B,QAAQ,EAAE,SAAS;oBACnB,UAAU,EAAE,EAAE;iBACf;gBACD,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC,CAAC;YAEJ,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE;oBACN,KAAK,EAAE,SAAS,CAAC,oBAAoB;oBACrC,OAAO,EAAE,gBAAgB,CACvB,UAAU,EAAE,EACZ,cAAc,CAAC,SAAS,EACxB,UAAU,EACV,IAAI,CAAC,EAAE,CACR;oBACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;gBACD,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO;YACjC,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE;oBACN,KAAK,EAAE,SAAS,CAAC,iBAAiB;oBAClC,OAAO,EAAE,gBAAgB,CACvB,UAAU,EAAE,EACZ,cAAc,CAAC,SAAS,EACxB,SAAS,EACT,IAAI,CAAC,EAAE,CACR;oBACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;gBACD,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC,CAAC;QACN,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC3C,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,QAA2B;QAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;YACvC,MAAM;YACN,SAAS,EAAE,EAAE;YACb,MAAM,EAAE;gBACN,KAAK,EAAE,SAAS,CAAC,mBAAmB;gBACpC,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;YACD,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;CACF;AAED,SAAS,oBAAoB,CAC3B,OAAuB,EACvB,IAAY,EACZ,MAAmB;IAEnB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;QAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAc,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAc,EAAE,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACrF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACjF,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,OAAoB;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9D,CAAC"}
|
package/lib/index.d.ts
CHANGED
|
@@ -4,7 +4,10 @@
|
|
|
4
4
|
* A2A routes are installed by the CLI composition root. Importing this package
|
|
5
5
|
* is intentionally inert and cannot depend on the removed legacy router.
|
|
6
6
|
*/
|
|
7
|
-
export { installRuntimeA2a, type InstallRuntimeA2aOptions, type RuntimeA2aConfig, } from './runtime.js';
|
|
7
|
+
export { installRuntimeA2a, type InstallRuntimeA2aOptions, type RuntimeA2aConfig, type RuntimeWorkroomCallbackConfig, type RuntimeWorkroomRemoteExecutorsConfig, } from './runtime.js';
|
|
8
8
|
export type { RuntimeA2aConfig as A2aConfig } from './runtime.js';
|
|
9
9
|
export { verifyA2aBearer } from './auth.js';
|
|
10
|
+
export * from './workroom-auth-registry.js';
|
|
11
|
+
export * from './workroom-callback-runtime.js';
|
|
12
|
+
export * from './workroom-remote-transport.js';
|
|
10
13
|
//# sourceMappingURL=index.d.ts.map
|
package/lib/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,6BAA6B,EAClC,KAAK,oCAAoC,GAC1C,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,gBAAgB,IAAI,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC"}
|
package/lib/index.js
CHANGED
|
@@ -6,4 +6,7 @@
|
|
|
6
6
|
*/
|
|
7
7
|
export { installRuntimeA2a, } from './runtime.js';
|
|
8
8
|
export { verifyA2aBearer } from './auth.js';
|
|
9
|
+
export * from './workroom-auth-registry.js';
|
|
10
|
+
export * from './workroom-callback-runtime.js';
|
|
11
|
+
export * from './workroom-remote-transport.js';
|
|
9
12
|
//# sourceMappingURL=index.js.map
|
package/lib/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,iBAAiB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,iBAAiB,GAKlB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC"}
|
package/lib/runtime.d.ts
CHANGED
|
@@ -1,10 +1,28 @@
|
|
|
1
1
|
import type { HttpRouteHost } from '@zhin.js/host-http-contract';
|
|
2
2
|
import type { AgentHostPort } from '@zhin.js/agent/runtime';
|
|
3
|
+
import type { WorkroomA2aAuthBindingInput } from './workroom-auth-registry.js';
|
|
4
|
+
import type { WorkroomA2aRemoteTransportBindingInput } from './workroom-remote-transport.js';
|
|
5
|
+
export interface RuntimeWorkroomCallbackConfig {
|
|
6
|
+
readonly enabled?: boolean;
|
|
7
|
+
/** Must remain outside the ordinary `/a2a/{agent}/*` route tree. */
|
|
8
|
+
readonly path?: string;
|
|
9
|
+
readonly maxBodyBytes?: number;
|
|
10
|
+
readonly maxSequenceGap?: number;
|
|
11
|
+
readonly bindings: readonly WorkroomA2aAuthBindingInput[];
|
|
12
|
+
}
|
|
13
|
+
export interface RuntimeWorkroomRemoteExecutorsConfig {
|
|
14
|
+
readonly enabled?: boolean;
|
|
15
|
+
readonly maxResponseBytes?: number;
|
|
16
|
+
readonly bindings: readonly WorkroomA2aRemoteTransportBindingInput[];
|
|
17
|
+
}
|
|
3
18
|
export interface RuntimeA2aConfig {
|
|
4
19
|
readonly enabled?: boolean;
|
|
5
20
|
readonly path?: string;
|
|
6
21
|
readonly token?: string;
|
|
7
22
|
readonly publicUrl?: string;
|
|
23
|
+
readonly workroomCallbacks?: RuntimeWorkroomCallbackConfig;
|
|
24
|
+
/** Transport endpoints only. Project/Workroom topology remains in the persistent Catalog. */
|
|
25
|
+
readonly workroomRemoteExecutors?: RuntimeWorkroomRemoteExecutorsConfig;
|
|
8
26
|
}
|
|
9
27
|
export interface InstallRuntimeA2aOptions {
|
|
10
28
|
readonly http: HttpRouteHost;
|
|
@@ -16,4 +34,7 @@ export interface InstallRuntimeA2aOptions {
|
|
|
16
34
|
}
|
|
17
35
|
/** Mount Agent Card, JSON-RPC, and HTTP+JSON routes on the Runtime HTTP Host. */
|
|
18
36
|
export declare function installRuntimeA2a(options: InstallRuntimeA2aOptions): () => void;
|
|
37
|
+
export { installRuntimeWorkroomCallbacks, type InstallRuntimeWorkroomCallbacksOptions, type RuntimeWorkroomCallbackDependencies, type RuntimeWorkroomCallbackInstallation, type RuntimeWorkroomCallbackRecoverySummary, } from './workroom-callback-runtime.js';
|
|
38
|
+
export { WorkroomA2aAuthRegistry, WorkroomA2aAuthenticationError, type WorkroomA2aAuthRegistryOptions, type WorkroomA2aEndpointAuthoritySnapshot, } from './workroom-auth-registry.js';
|
|
39
|
+
export { WorkroomA2aHttpRemoteTransport, type WorkroomA2aHttpRemoteTransportOptions, type WorkroomA2aPinnedNetworkPort, type WorkroomA2aPinnedRequest, type WorkroomA2aResolvedAddress, type WorkroomA2aRemoteTransportBindingInput, } from './workroom-remote-transport.js';
|
|
19
40
|
//# sourceMappingURL=runtime.d.ts.map
|
package/lib/runtime.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAK5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,gCAAgC,CAAC;AAE7F,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,2BAA2B,EAAE,CAAC;CAC3D;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,sCAAsC,EAAE,CAAC;CACtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;IAC3D,6FAA6F;IAC7F,QAAQ,CAAC,uBAAuB,CAAC,EAAE,oCAAoC,CAAC;CACzE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAOD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,IAAI,CAmD/E;AAwDD,OAAO,EACL,+BAA+B,EAC/B,KAAK,sCAAsC,EAC3C,KAAK,mCAAmC,EACxC,KAAK,mCAAmC,EACxC,KAAK,sCAAsC,GAC5C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,KAAK,8BAA8B,EACnC,KAAK,oCAAoC,GAC1C,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,KAAK,qCAAqC,EAC1C,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,sCAAsC,GAC5C,MAAM,gCAAgC,CAAC"}
|
package/lib/runtime.js
CHANGED
|
@@ -107,4 +107,7 @@ function normalizePath(path) {
|
|
|
107
107
|
const leading = path.startsWith('/') ? path : `/${path}`;
|
|
108
108
|
return trimTrailingSlashes(leading) || '/a2a';
|
|
109
109
|
}
|
|
110
|
+
export { installRuntimeWorkroomCallbacks, } from './workroom-callback-runtime.js';
|
|
111
|
+
export { WorkroomA2aAuthRegistry, WorkroomA2aAuthenticationError, } from './workroom-auth-registry.js';
|
|
112
|
+
export { WorkroomA2aHttpRemoteTransport, } from './workroom-remote-transport.js';
|
|
110
113
|
//# sourceMappingURL=runtime.js.map
|
package/lib/runtime.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAG9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAG9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AA2C5C,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IACnE,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE7C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;QAC/B,MAAM,IAAI,GAAG,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;YACnC,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;YACpB,IAAI;YACJ,OAAO,EAAE,IAAI,qBAAqB,CAAC,IAAI,EAAE,IAAI,iBAAiB,EAAE,EAAE,QAAQ,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,QAAQ,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;QAC7F,IAAI,KAAK,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAC9C,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,KAAK,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE1D,OAAO,GAAG,EAAE;QACV,UAAU,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAOD,SAAS,UAAU,CAAC,QAAgB,EAAE,QAAgB;IACpD,MAAM,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,eAAe,eAAe,EAAE,IAAI,IAAI,KAAK,6BAA6B,EAAE,CAAC;QACxF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,SAAS;YACT,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,QAA4C,EAAE,MAAc,EAAE,IAAa;IAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;QACzB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;KACrD,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,CAAC,EAAE,CAAC;IACtC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACzD,OAAO,mBAAmB,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;AAChD,CAAC;AAED,OAAO,EACL,+BAA+B,GAKhC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uBAAuB,EACvB,8BAA8B,GAG/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,GAM/B,MAAM,gCAAgC,CAAC"}
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
export type WorkroomA2aCredentialReference = Readonly<{
|
|
2
|
+
source: 'config';
|
|
3
|
+
value: string;
|
|
4
|
+
}> | Readonly<{
|
|
5
|
+
source: 'secure_provider';
|
|
6
|
+
secretRef: string;
|
|
7
|
+
}>;
|
|
8
|
+
export interface WorkroomA2aAuthBindingInput {
|
|
9
|
+
readonly endpointId: string;
|
|
10
|
+
readonly tenantId: string;
|
|
11
|
+
readonly cardDigest: string;
|
|
12
|
+
readonly authBindingId: string;
|
|
13
|
+
readonly trustDomain: string;
|
|
14
|
+
readonly extensionDigest: string;
|
|
15
|
+
readonly credentialId: string;
|
|
16
|
+
readonly credential: WorkroomA2aCredentialReference;
|
|
17
|
+
readonly enabled: boolean;
|
|
18
|
+
readonly expiresAt?: number;
|
|
19
|
+
}
|
|
20
|
+
export interface WorkroomA2aSecureCredentialProvider {
|
|
21
|
+
resolve(secretRef: string): string | undefined;
|
|
22
|
+
}
|
|
23
|
+
export interface WorkroomA2aAuthRegistryOptions {
|
|
24
|
+
readonly generation: number;
|
|
25
|
+
readonly bindings: readonly WorkroomA2aAuthBindingInput[];
|
|
26
|
+
readonly secureCredentialProvider?: WorkroomA2aSecureCredentialProvider;
|
|
27
|
+
readonly now?: () => number;
|
|
28
|
+
}
|
|
29
|
+
export interface WorkroomA2aEndpointAuthoritySnapshot {
|
|
30
|
+
readonly version: 1;
|
|
31
|
+
readonly endpointId: string;
|
|
32
|
+
readonly tenantId: string;
|
|
33
|
+
readonly cardDigest: string;
|
|
34
|
+
readonly authBindingId: string;
|
|
35
|
+
readonly trustDomain: string;
|
|
36
|
+
readonly generation: number;
|
|
37
|
+
readonly extensionDigest: string;
|
|
38
|
+
readonly credentialIdDigest: string;
|
|
39
|
+
}
|
|
40
|
+
export interface WorkroomA2aRegisteredAuthBindingSnapshot extends WorkroomA2aEndpointAuthoritySnapshot {
|
|
41
|
+
readonly enabled: boolean;
|
|
42
|
+
readonly expiresAt?: number;
|
|
43
|
+
}
|
|
44
|
+
export interface WorkroomA2aAuthRegistrySnapshot {
|
|
45
|
+
readonly version: 1;
|
|
46
|
+
readonly generation: number;
|
|
47
|
+
readonly bindings: readonly WorkroomA2aRegisteredAuthBindingSnapshot[];
|
|
48
|
+
}
|
|
49
|
+
export declare class WorkroomA2aAuthenticationError extends Error {
|
|
50
|
+
constructor();
|
|
51
|
+
}
|
|
52
|
+
/** Generation-owned immutable credential-to-endpoint authority registry. */
|
|
53
|
+
export declare class WorkroomA2aAuthRegistry {
|
|
54
|
+
#private;
|
|
55
|
+
readonly snapshot: WorkroomA2aAuthRegistrySnapshot;
|
|
56
|
+
constructor(options: WorkroomA2aAuthRegistryOptions);
|
|
57
|
+
/** Only the transport credential participates; callback claims are not an input. */
|
|
58
|
+
authenticate(requestCredential: string): WorkroomA2aEndpointAuthoritySnapshot;
|
|
59
|
+
/**
|
|
60
|
+
* Issues the callback credential only to the trusted outbound transport.
|
|
61
|
+
* The endpoint id is resolved against this exact generation and inactive
|
|
62
|
+
* credentials fail closed just like inbound authentication.
|
|
63
|
+
*/
|
|
64
|
+
callbackAuthorization(endpointId: string): string;
|
|
65
|
+
}
|
|
66
|
+
//# sourceMappingURL=workroom-auth-registry.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"workroom-auth-registry.d.ts","sourceRoot":"","sources":["../src/workroom-auth-registry.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,8BAA8B,GACtC,QAAQ,CAAC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7C,QAAQ,CAAC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/D,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,8BAA8B,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mCAAmC;IAClD,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC1D,QAAQ,CAAC,wBAAwB,CAAC,EAAE,mCAAmC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,wCACjB,SAAQ,oCAAoC;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,wCAAwC,EAAE,CAAC;CACxE;AAWD,qBAAa,8BAA+B,SAAQ,KAAK;;CAKxD;AAED,4EAA4E;AAC5E,qBAAa,uBAAuB;;IAGlC,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,CAAC;gBAEvC,OAAO,EAAE,8BAA8B;IA4DnD,oFAAoF;IACpF,YAAY,CAAC,iBAAiB,EAAE,MAAM,GAAG,oCAAoC;IAkB7E;;;;OAIG;IACH,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;CAWlD"}
|
|
@@ -0,0 +1,210 @@
|
|
|
1
|
+
import { createHash, timingSafeEqual } from 'node:crypto';
|
|
2
|
+
export class WorkroomA2aAuthenticationError extends Error {
|
|
3
|
+
constructor() {
|
|
4
|
+
super('Workroom A2A credential is unknown or inactive');
|
|
5
|
+
this.name = 'WorkroomA2aAuthenticationError';
|
|
6
|
+
}
|
|
7
|
+
}
|
|
8
|
+
/** Generation-owned immutable credential-to-endpoint authority registry. */
|
|
9
|
+
export class WorkroomA2aAuthRegistry {
|
|
10
|
+
#bindings;
|
|
11
|
+
#now;
|
|
12
|
+
snapshot;
|
|
13
|
+
constructor(options) {
|
|
14
|
+
validateOptions(options);
|
|
15
|
+
this.#now = options.now ?? Date.now;
|
|
16
|
+
const endpointIds = new Set();
|
|
17
|
+
const authBindingIds = new Set();
|
|
18
|
+
const credentialIds = new Set();
|
|
19
|
+
const credentialDigests = new Set();
|
|
20
|
+
const bindings = [];
|
|
21
|
+
for (const input of options.bindings) {
|
|
22
|
+
validateBinding(input);
|
|
23
|
+
if (endpointIds.has(input.endpointId)) {
|
|
24
|
+
throw new Error(`Workroom A2A endpoint binding drift: ${input.endpointId}`);
|
|
25
|
+
}
|
|
26
|
+
if (credentialIds.has(input.credentialId)) {
|
|
27
|
+
throw new Error(`Workroom A2A duplicate credentialId: ${input.credentialId}`);
|
|
28
|
+
}
|
|
29
|
+
if (authBindingIds.has(input.authBindingId)) {
|
|
30
|
+
throw new Error(`Workroom A2A authBindingId drift: ${input.authBindingId}`);
|
|
31
|
+
}
|
|
32
|
+
endpointIds.add(input.endpointId);
|
|
33
|
+
authBindingIds.add(input.authBindingId);
|
|
34
|
+
credentialIds.add(input.credentialId);
|
|
35
|
+
const credential = resolveCredential(input.credential, options.secureCredentialProvider);
|
|
36
|
+
const credentialDigest = hash(credential);
|
|
37
|
+
const digestKey = credentialDigest.toString('hex');
|
|
38
|
+
if (credentialDigests.has(digestKey)) {
|
|
39
|
+
throw new Error('Workroom A2A duplicate credential value');
|
|
40
|
+
}
|
|
41
|
+
credentialDigests.add(digestKey);
|
|
42
|
+
const authority = deepFreeze({
|
|
43
|
+
version: 1,
|
|
44
|
+
endpointId: input.endpointId,
|
|
45
|
+
tenantId: input.tenantId,
|
|
46
|
+
cardDigest: input.cardDigest,
|
|
47
|
+
authBindingId: input.authBindingId,
|
|
48
|
+
trustDomain: input.trustDomain,
|
|
49
|
+
generation: options.generation,
|
|
50
|
+
extensionDigest: input.extensionDigest,
|
|
51
|
+
credentialIdDigest: digestString(input.credentialId),
|
|
52
|
+
});
|
|
53
|
+
bindings.push({
|
|
54
|
+
credentialDigest,
|
|
55
|
+
credential,
|
|
56
|
+
authority,
|
|
57
|
+
enabled: input.enabled,
|
|
58
|
+
...(input.expiresAt === undefined ? {} : { expiresAt: input.expiresAt }),
|
|
59
|
+
});
|
|
60
|
+
}
|
|
61
|
+
this.#bindings = Object.freeze(bindings);
|
|
62
|
+
this.snapshot = deepFreeze({
|
|
63
|
+
version: 1,
|
|
64
|
+
generation: options.generation,
|
|
65
|
+
bindings: bindings.map(binding => ({
|
|
66
|
+
...binding.authority,
|
|
67
|
+
enabled: binding.enabled,
|
|
68
|
+
...(binding.expiresAt === undefined ? {} : { expiresAt: binding.expiresAt }),
|
|
69
|
+
})),
|
|
70
|
+
});
|
|
71
|
+
}
|
|
72
|
+
/** Only the transport credential participates; callback claims are not an input. */
|
|
73
|
+
authenticate(requestCredential) {
|
|
74
|
+
if (typeof requestCredential !== 'string' || requestCredential.length === 0) {
|
|
75
|
+
throw new WorkroomA2aAuthenticationError();
|
|
76
|
+
}
|
|
77
|
+
const candidate = hash(requestCredential);
|
|
78
|
+
let matched;
|
|
79
|
+
for (const binding of this.#bindings) {
|
|
80
|
+
if (timingSafeEqual(candidate, binding.credentialDigest))
|
|
81
|
+
matched = binding;
|
|
82
|
+
}
|
|
83
|
+
const now = this.#now();
|
|
84
|
+
if (!Number.isFinite(now))
|
|
85
|
+
throw new Error('Workroom A2A authentication clock must be finite');
|
|
86
|
+
if (!matched || !matched.enabled
|
|
87
|
+
|| (matched.expiresAt !== undefined && now >= matched.expiresAt)) {
|
|
88
|
+
throw new WorkroomA2aAuthenticationError();
|
|
89
|
+
}
|
|
90
|
+
return matched.authority;
|
|
91
|
+
}
|
|
92
|
+
/**
|
|
93
|
+
* Issues the callback credential only to the trusted outbound transport.
|
|
94
|
+
* The endpoint id is resolved against this exact generation and inactive
|
|
95
|
+
* credentials fail closed just like inbound authentication.
|
|
96
|
+
*/
|
|
97
|
+
callbackAuthorization(endpointId) {
|
|
98
|
+
text(endpointId, 'endpointId');
|
|
99
|
+
const matched = this.#bindings.find(binding => binding.authority.endpointId === endpointId);
|
|
100
|
+
const now = this.#now();
|
|
101
|
+
if (!Number.isFinite(now))
|
|
102
|
+
throw new Error('Workroom A2A authentication clock must be finite');
|
|
103
|
+
if (!matched || !matched.enabled
|
|
104
|
+
|| (matched.expiresAt !== undefined && now >= matched.expiresAt)) {
|
|
105
|
+
throw new WorkroomA2aAuthenticationError();
|
|
106
|
+
}
|
|
107
|
+
return `Bearer ${matched.credential}`;
|
|
108
|
+
}
|
|
109
|
+
}
|
|
110
|
+
function validateOptions(options) {
|
|
111
|
+
if (!options || typeof options !== 'object' || Array.isArray(options)) {
|
|
112
|
+
throw new Error('Workroom A2A auth registry options must be an object');
|
|
113
|
+
}
|
|
114
|
+
assertExactKeys(options, ['generation', 'bindings', 'secureCredentialProvider', 'now'], 'options');
|
|
115
|
+
positiveInteger(options.generation, 'generation');
|
|
116
|
+
if (!Array.isArray(options.bindings))
|
|
117
|
+
throw new Error('Workroom A2A bindings must be an array');
|
|
118
|
+
if (options.now !== undefined && typeof options.now !== 'function') {
|
|
119
|
+
throw new Error('Workroom A2A now must be a function');
|
|
120
|
+
}
|
|
121
|
+
if (options.secureCredentialProvider !== undefined
|
|
122
|
+
&& (!options.secureCredentialProvider
|
|
123
|
+
|| typeof options.secureCredentialProvider !== 'object'
|
|
124
|
+
|| typeof options.secureCredentialProvider.resolve !== 'function')) {
|
|
125
|
+
throw new Error('Workroom A2A secure credential provider resolve must be a function');
|
|
126
|
+
}
|
|
127
|
+
}
|
|
128
|
+
function validateBinding(input) {
|
|
129
|
+
if (!input || typeof input !== 'object' || Array.isArray(input)) {
|
|
130
|
+
throw new Error('Workroom A2A auth binding must be an object');
|
|
131
|
+
}
|
|
132
|
+
assertExactKeys(input, [
|
|
133
|
+
'endpointId', 'tenantId', 'cardDigest', 'authBindingId', 'trustDomain',
|
|
134
|
+
'extensionDigest', 'credentialId', 'credential', 'enabled', 'expiresAt',
|
|
135
|
+
], 'binding');
|
|
136
|
+
for (const [label, value] of Object.entries({
|
|
137
|
+
endpointId: input.endpointId,
|
|
138
|
+
tenantId: input.tenantId,
|
|
139
|
+
authBindingId: input.authBindingId,
|
|
140
|
+
trustDomain: input.trustDomain,
|
|
141
|
+
credentialId: input.credentialId,
|
|
142
|
+
}))
|
|
143
|
+
text(value, label);
|
|
144
|
+
canonicalDigest(input.cardDigest, 'cardDigest');
|
|
145
|
+
canonicalDigest(input.extensionDigest, 'extensionDigest');
|
|
146
|
+
if (typeof input.enabled !== 'boolean')
|
|
147
|
+
throw new Error('Workroom A2A enabled must be boolean');
|
|
148
|
+
if (input.expiresAt !== undefined && !Number.isFinite(input.expiresAt)) {
|
|
149
|
+
throw new Error('Workroom A2A expiresAt must be finite');
|
|
150
|
+
}
|
|
151
|
+
}
|
|
152
|
+
function resolveCredential(reference, provider) {
|
|
153
|
+
if (!reference || typeof reference !== 'object' || Array.isArray(reference)) {
|
|
154
|
+
throw new Error('Workroom A2A credential reference must be an object');
|
|
155
|
+
}
|
|
156
|
+
if (reference.source === 'config') {
|
|
157
|
+
assertExactKeys(reference, ['source', 'value'], 'config credential');
|
|
158
|
+
return credential(reference.value);
|
|
159
|
+
}
|
|
160
|
+
if (reference.source === 'secure_provider') {
|
|
161
|
+
assertExactKeys(reference, ['source', 'secretRef'], 'secure credential');
|
|
162
|
+
text(reference.secretRef, 'credential secretRef');
|
|
163
|
+
if (!provider)
|
|
164
|
+
throw new Error('Workroom A2A secure credential provider is required');
|
|
165
|
+
return credential(provider.resolve(reference.secretRef));
|
|
166
|
+
}
|
|
167
|
+
throw new Error('Workroom A2A credential source is unsupported');
|
|
168
|
+
}
|
|
169
|
+
function credential(value) {
|
|
170
|
+
text(value, 'credential value');
|
|
171
|
+
const result = value;
|
|
172
|
+
if (result.length > 8_192 || /\s/u.test(result)) {
|
|
173
|
+
throw new Error('Workroom A2A credential must be a bounded token without whitespace');
|
|
174
|
+
}
|
|
175
|
+
return result;
|
|
176
|
+
}
|
|
177
|
+
function hash(value) {
|
|
178
|
+
return createHash('sha256').update(value).digest();
|
|
179
|
+
}
|
|
180
|
+
function digestString(value) {
|
|
181
|
+
return `sha256:${hash(value).toString('hex')}`;
|
|
182
|
+
}
|
|
183
|
+
function assertExactKeys(value, allowed, label) {
|
|
184
|
+
const unexpected = Object.keys(value).find(key => !allowed.includes(key));
|
|
185
|
+
if (unexpected)
|
|
186
|
+
throw new Error(`Workroom A2A ${label} contains forbidden field ${unexpected}`);
|
|
187
|
+
}
|
|
188
|
+
function text(value, label) {
|
|
189
|
+
if (typeof value !== 'string' || value.trim().length === 0) {
|
|
190
|
+
throw new Error(`Workroom A2A ${label} must be non-empty text`);
|
|
191
|
+
}
|
|
192
|
+
}
|
|
193
|
+
function positiveInteger(value, label) {
|
|
194
|
+
if (!Number.isSafeInteger(value) || value < 1) {
|
|
195
|
+
throw new Error(`Workroom A2A ${label} must be a positive safe integer`);
|
|
196
|
+
}
|
|
197
|
+
}
|
|
198
|
+
function canonicalDigest(value, label) {
|
|
199
|
+
if (typeof value !== 'string' || !/^sha256:[a-f0-9]{64}$/u.test(value)) {
|
|
200
|
+
throw new Error(`Workroom A2A ${label} must be a canonical sha256 digest`);
|
|
201
|
+
}
|
|
202
|
+
}
|
|
203
|
+
function deepFreeze(value) {
|
|
204
|
+
if (!value || typeof value !== 'object' || Object.isFrozen(value))
|
|
205
|
+
return value;
|
|
206
|
+
for (const item of Object.values(value))
|
|
207
|
+
deepFreeze(item);
|
|
208
|
+
return Object.freeze(value);
|
|
209
|
+
}
|
|
210
|
+
//# sourceMappingURL=workroom-auth-registry.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"workroom-auth-registry.js","sourceRoot":"","sources":["../src/workroom-auth-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA+D1D,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,OAAO,uBAAuB;IACzB,SAAS,CAA6B;IACtC,IAAI,CAAe;IACnB,QAAQ,CAAkC;IAEnD,YAAY,OAAuC;QACjD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5C,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAClC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACxC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtC,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;YACzF,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,UAAU,CAAC;gBAC3B,OAAO,EAAE,CAAU;gBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;aACrD,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC;gBACZ,gBAAgB;gBAChB,UAAU;gBACV,SAAS;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aACzE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;YACzB,OAAO,EAAE,CAAU;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACjC,GAAG,OAAO,CAAC,SAAS;gBACpB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC7E,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAED,oFAAoF;IACpF,YAAY,CAAC,iBAAyB;QACpC,IAAI,OAAO,iBAAiB,KAAK,QAAQ,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1C,IAAI,OAAoC,CAAC;QACzC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC;gBAAE,OAAO,GAAG,OAAO,CAAC;QAC9E,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;eAC3B,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,qBAAqB,CAAC,UAAkB;QACtC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;eAC3B,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,UAAU,OAAO,CAAC,UAAU,EAAE,CAAC;IACxC,CAAC;CACF;AAED,SAAS,eAAe,CAAC,OAAuC;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,eAAe,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,0BAA0B,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IACnG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,wBAAwB,KAAK,SAAS;WAC7C,CAAC,CAAC,OAAO,CAAC,wBAAwB;eAChC,OAAO,OAAO,CAAC,wBAAwB,KAAK,QAAQ;eACpD,OAAO,OAAO,CAAC,wBAAwB,CAAC,OAAO,KAAK,UAAU,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAkC;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,eAAe,CAAC,KAAK,EAAE;QACrB,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa;QACtE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW;KACxE,EAAE,SAAS,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC;QAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvB,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAChD,eAAe,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAyC,EACzC,QAAyD;IAEzD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,eAAe,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC3C,eAAe,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACtF,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,OAA0B,EAAE,KAAa;IAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,6BAA6B,UAAU,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,yBAAyB,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,kCAAkC,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,oCAAoC,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}
|
|
@@ -0,0 +1,43 @@
|
|
|
1
|
+
import type { HttpRouteHost } from '@zhin.js/host-http-contract';
|
|
2
|
+
import type { RemoteCallbackApplicationOutcome, RemoteExecutionLinkRecord, WorkroomCallbackAuthRegistry, WorkroomRemoteCallbackGatewayResult, WorkroomRemoteCallbackRequest } from '@zhin.js/agent';
|
|
3
|
+
export interface RuntimeWorkroomCallbackDependencies {
|
|
4
|
+
readonly authRegistry: Pick<WorkroomCallbackAuthRegistry, 'authenticate'>;
|
|
5
|
+
readonly gateway: Readonly<{
|
|
6
|
+
handle(request: WorkroomRemoteCallbackRequest, signal: AbortSignal): Promise<WorkroomRemoteCallbackGatewayResult>;
|
|
7
|
+
}>;
|
|
8
|
+
readonly linkRegistry: Readonly<{
|
|
9
|
+
listRegistered(): Promise<readonly Pick<RemoteExecutionLinkRecord, 'id'>[]>;
|
|
10
|
+
}>;
|
|
11
|
+
readonly application: Readonly<{
|
|
12
|
+
runOnce(linkId: string, signal: AbortSignal): Promise<RemoteCallbackApplicationOutcome>;
|
|
13
|
+
}>;
|
|
14
|
+
}
|
|
15
|
+
export interface InstallRuntimeWorkroomCallbacksOptions {
|
|
16
|
+
readonly http: HttpRouteHost;
|
|
17
|
+
/** Exact route, intentionally separate from `/a2a/{agent}/*`. */
|
|
18
|
+
readonly path?: string;
|
|
19
|
+
readonly ordinaryA2aBasePath?: string;
|
|
20
|
+
readonly dependencies: RuntimeWorkroomCallbackDependencies;
|
|
21
|
+
readonly maxBodyBytes: number;
|
|
22
|
+
readonly signal?: AbortSignal;
|
|
23
|
+
/** Root handoff uses this so database-backed Workroom state activates first. */
|
|
24
|
+
readonly deferRecovery?: boolean;
|
|
25
|
+
readonly onRecoveryError?: (linkId: string, error: unknown) => void;
|
|
26
|
+
}
|
|
27
|
+
export interface RuntimeWorkroomCallbackRecoverySummary {
|
|
28
|
+
readonly registered: number;
|
|
29
|
+
readonly recovered: number;
|
|
30
|
+
readonly failed: number;
|
|
31
|
+
}
|
|
32
|
+
export interface RuntimeWorkroomCallbackInstallation {
|
|
33
|
+
readonly recovery: RuntimeWorkroomCallbackRecoverySummary | undefined;
|
|
34
|
+
recover(signal?: AbortSignal): Promise<RuntimeWorkroomCallbackRecoverySummary>;
|
|
35
|
+
dispose(): void;
|
|
36
|
+
}
|
|
37
|
+
/**
|
|
38
|
+
* Installs the authority-isolated Workroom callback ingress. This route never
|
|
39
|
+
* invokes the ordinary A2A Agent executor; accepted observations can reach
|
|
40
|
+
* Workroom state only through the injected Callback Application.
|
|
41
|
+
*/
|
|
42
|
+
export declare function installRuntimeWorkroomCallbacks(options: InstallRuntimeWorkroomCallbacksOptions): Promise<RuntimeWorkroomCallbackInstallation>;
|
|
43
|
+
//# sourceMappingURL=workroom-callback-runtime.d.ts.map
|