dsh-a2a-server 0.1.0

package/lib/security.js

@@ -0,0 +1,171 @@
+/**
+ * Authentication, rate limiting, inbound defanging, and outbound redaction.
+ *
+ * The real security boundary is not in this file: it is the sandbox scope and
+ * the deterministically-rejected approval an A2A agent runs under. Injection
+ * defanging here is noise reduction, and must never be cited as a reason to
+ * widen what a peer-driven agent is allowed to do.
+ *
+ * @module dsh-a2a/security
+ */
+import { timingSafeEqual } from 'node:crypto';
+/**
+ * Compare two secrets without leaking their relationship through timing.
+ * @param a - the presented value.
+ * @param b - the stored value.
+ * @returns whether they are byte-identical.
+ */
+export function constantTimeEqual(a, b) {
+    const left = Buffer.from(a, 'utf8');
+    const right = Buffer.from(b, 'utf8');
+    // timingSafeEqual requires equal lengths; comparing a digest of each keeps the
+    // length difference from short-circuiting before the comparison happens.
+    if (left.length !== right.length) {
+        // Still burn a comparison so a length mismatch is not measurably faster.
+        timingSafeEqual(left, left);
+        return false;
+    }
+    return timingSafeEqual(left, right);
+}
+/**
+ * Extract the bearer token from an Authorization header.
+ * @param header - the raw header value, if any.
+ * @returns the token, or undefined when absent or not a bearer scheme.
+ */
+export function parseBearer(header) {
+    if (header === undefined)
+        return undefined;
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match?.[1];
+}
+/**
+ * Resolve the presented token to a declared peer identity.
+ *
+ * Every candidate is compared even after a match, so response time does not
+ * reveal which peer matched or how many peers are declared.
+ * @param token - the presented bearer token, if any.
+ * @param credentials - declared peer name to its resolved secret.
+ * @returns the matched identity, or undefined.
+ */
+export function identifyPeer(token, credentials) {
+    if (token === undefined || token.length === 0)
+        return undefined;
+    let matched;
+    for (const [peer, secret] of credentials) {
+        if (constantTimeEqual(token, secret) && matched === undefined)
+            matched = peer;
+    }
+    return matched;
+}
+/** Sliding-window request counter, keyed by authenticated identity. */
+export class RateLimiter {
+    perMinute;
+    now;
+    hits = new Map();
+    /**
+     * @param perMinute - allowed requests per identity per rolling minute.
+     * @param now - clock injection point for tests.
+     */
+    constructor(perMinute, now = Date.now) {
+        this.perMinute = perMinute;
+        this.now = now;
+    }
+    /**
+     * Record a request and report whether it is within budget.
+     * @param identity - the authenticated peer.
+     * @returns true when the request may proceed.
+     */
+    allow(identity) {
+        const cutoff = this.now() - 60_000;
+        const window = (this.hits.get(identity) ?? []).filter(at => at > cutoff);
+        if (window.length >= this.perMinute) {
+            this.hits.set(identity, window);
+            return false;
+        }
+        window.push(this.now());
+        this.hits.set(identity, window);
+        return true;
+    }
+    /** Drop all counters; used on teardown. */
+    clear() {
+        this.hits.clear();
+    }
+}
+/** Per-context turn counter that stops one peer from looping a context forever. */
+export class TurnTracker {
+    turns = new Map();
+    /**
+     * Count one inbound message on a context.
+     * @param contextId - the context being extended.
+     * @returns the turn number this message occupies, starting at 1.
+     */
+    track(contextId) {
+        const next = (this.turns.get(contextId) ?? 0) + 1;
+        this.turns.set(contextId, next);
+        return next;
+    }
+    /**
+     * Reset a context's counter, as an explicit cancellation should.
+     * @param contextId - the context to reset.
+     */
+    reset(contextId) {
+        this.turns.delete(contextId);
+    }
+    /** Drop all counters; used on teardown. */
+    clear() {
+        this.turns.clear();
+    }
+}
+/**
+ * Markers an adversarial peer might embed to hijack the agent's turn.
+ *
+ * These are neutralized rather than rejected: a legitimate task that merely
+ * MENTIONS one still gets through, with the marker defanged.
+ */
+const INJECTION_PATTERNS = [
+    /<\|im_(start|end)\|>/gi,
+    /<\|(system|user|assistant|end|endoftext)\|>/gi,
+    /\[\/?(?:INST|SYS|SYSTEM)\]/gi,
+    /^\s*(system|assistant|developer)\s*:\s*/gim,
+    /ignore (?:all|any|the) (?:previous|prior|above) instructions/gi,
+    /disregard (?:all|any|the) (?:previous|prior|above)/gi,
+    /<\/?(?:system|assistant|tool)[^>]*>/gi,
+];
+/** What a defanged marker is replaced with. */
+export const FILTERED = '[filtered]';
+/**
+ * Defang prompt-injection markers in inbound task text.
+ * @param text - the peer's raw text.
+ * @returns the text with markers replaced.
+ */
+export function filterInbound(text) {
+    let out = text;
+    for (const pattern of INJECTION_PATTERNS)
+        out = out.replace(pattern, FILTERED);
+    return out;
+}
+/** Credential-shaped strings that must never reach a peer. */
+const REDACTIONS = [
+    [/sk-ant-[A-Za-z0-9_-]{16,}/g, 'sk-ant-[redacted]'],
+    [/sk-[A-Za-z0-9_-]{16,}/g, 'sk-[redacted]'],
+    [/ghp_[A-Za-z0-9]{20,}/g, 'ghp_[redacted]'],
+    [/xox[bapr]-[A-Za-z0-9-]{10,}/g, 'xox-[redacted]'],
+    [/AKIA[0-9A-Z]{16}/g, 'AKIA[redacted]'],
+    [/eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, '[redacted-jwt]'],
+    [/(?<=\b)[Bb]earer\s+[A-Za-z0-9._-]{20,}/g, 'Bearer [redacted]'],
+];
+/**
+ * Scrub credential-shaped substrings before text leaves this process.
+ *
+ * This applies to REPLIES, not just to a hypothetical outbound client: an
+ * inbound-only server still ships model-authored text to a peer.
+ * @param text - the text about to be sent.
+ * @returns the scrubbed text.
+ */
+export function redactOutbound(text) {
+    let out = text;
+    for (const [pattern, replacement] of REDACTIONS)
+        out = out.replace(pattern, replacement);
+    return out;
+}
+//# sourceMappingURL=security.js.map

package/lib/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAK7C;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACpC,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,yEAAyE;QACzE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC3B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAyB,EACzB,WAA8C;IAE9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC/D,IAAI,OAAiC,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QACzC,IAAI,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,GAAG,IAAI,CAAA;IAC/E,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,OAAO,WAAW;IAQH;IACA;IARF,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAA;IAEzD;;;OAGG;IACH,YACmB,SAAiB,EACjB,MAAoB,IAAI,CAAC,GAAG;QAD5B,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,QAAsB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAA;QAClC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,CAAA;QACxE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC/B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,2CAA2C;IAC3C,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;IACnB,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,WAAW;IACL,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IAElD;;;;OAIG;IACH,KAAK,CAAC,SAAiB;QACrB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAiB;QACrB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9B,CAAC;IAED,2CAA2C;IAC3C,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,wBAAwB;IACxB,+CAA+C;IAC/C,8BAA8B;IAC9B,4CAA4C;IAC5C,gEAAgE;IAChE,sDAAsD;IACtD,uCAAuC;CACxC,CAAA;AAED,+CAA+C;AAC/C,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAA;AAEpC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,MAAM,OAAO,IAAI,kBAAkB;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC9E,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,GAA2C;IACzD,CAAC,4BAA4B,EAAE,mBAAmB,CAAC;IACnD,CAAC,wBAAwB,EAAE,eAAe,CAAC;IAC3C,CAAC,uBAAuB,EAAE,gBAAgB,CAAC;IAC3C,CAAC,8BAA8B,EAAE,gBAAgB,CAAC;IAClD,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACvC,CAAC,gEAAgE,EAAE,gBAAgB,CAAC;IACpF,CAAC,yCAAyC,EAAE,mBAAmB,CAAC;CACjE,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,UAAU;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACxF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/lib/tasks.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Task slots and the three-stage turn correlation.
+ *
+ * The hard part of bridging A2A onto the harness is that ONE SUBMITTED MESSAGE
+ * IS NOT ONE TURN. A task spans from the message being accepted until the whole
+ * agent falls idle, which may be several turns if tools queue more work. Three
+ * hooks cooperate:
+ *
+ *   agent/inbox/claimed  →  bind this task's messageId to the turn that took it
+ *   turn/end             →  record that turn's ending (a model error fails now)
+ *   agent.whenIdle()     →  settle, using the recorded ending
+ *
+ * This mirrors what `dsh-acp` does for its prompts, and for the same reason:
+ * steering and injected work may contribute before quiescence, so the bridge
+ * does not claim a task-specific turn outcome.
+ *
+ * @module dsh-a2a/tasks
+ */
+import type { A2AArtifact, A2ATaskId, A2ATaskState } from './protocol/index.ts';
+/** How a task's final state was reached, for `Task.metadata.dsh.stopReason`. */
+export interface TaskSettlement {
+    state: A2ATaskState;
+    /** The harness's real turn ending, which A2A's state enum cannot express. */
+    stopReason?: string;
+    /** Text the agent committed during this task's span. */
+    artifacts: A2AArtifact[];
+}
+/** One in-flight task awaiting settlement. */
+export interface TaskSlot {
+    readonly taskId: A2ATaskId;
+    /** The user message id, used to correlate with the turn that claims it. */
+    readonly messageId: string;
+    /** Set by `agent/inbox/claimed` once a turn takes the message. */
+    turn: number | undefined;
+    /** Set at `turn/end` for the correlated turn; undefined means turnless. */
+    endReason: string | undefined;
+    /** Committed assistant text collected during this task's span. */
+    readonly texts: string[];
+    /** Resolves when the task reaches a terminal state. */
+    readonly settled: Promise<TaskSettlement>;
+    /** Fulfils `settled` exactly once. */
+    settle: (settlement: TaskSettlement) => void;
+    /** Whether `settle` has already run. */
+    done: boolean;
+}
+/**
+ * Create an unsettled task slot.
+ * @param taskId - the minted task id.
+ * @param messageId - the id of the user message this task submitted.
+ * @returns the slot, with its settlement promise already armed.
+ */
+export declare function createSlot(taskId: A2ATaskId, messageId: string): TaskSlot;
+/**
+ * Build the artifact list from the text a task's agent committed.
+ *
+ * A2A has artifacts; the harness has assistant messages. One text artifact per
+ * task keeps the mapping honest without inventing structure the agent never
+ * produced. Tool calls and results stay out — A2A's opaque-execution principle
+ * says a peer sees results, not how they were reached.
+ * @param taskId - used to derive a stable artifact id.
+ * @param texts - committed assistant texts, in order.
+ * @returns zero or one artifact.
+ */
+export declare function artifactsFromTexts(taskId: A2ATaskId, texts: readonly string[]): A2AArtifact[];
+/**
+ * Map a harness turn ending onto an A2A terminal state.
+ *
+ * A token ceiling is NOT a task-level failure: the agent stopped for its own
+ * reasons having produced real work, and A2A's `failed` would tell the peer to
+ * discard it. The true ending still travels in `Task.metadata.dsh.stopReason`.
+ * @param endReason - the harness turn ending kind, or undefined for a turnless slot.
+ * @returns the A2A state to settle with.
+ */
+export declare function stateFromEnding(endReason: string | undefined): A2ATaskState;
+//# sourceMappingURL=tasks.d.ts.map

package/lib/tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../src/tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAE/E,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,YAAY,CAAA;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,SAAS,EAAE,WAAW,EAAE,CAAA;CACzB;AAED,8CAA8C;AAC9C,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,kEAAkE;IAClE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;IACxB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IACzC,sCAAsC;IACtC,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,IAAI,CAAA;IAC5C,wCAAwC;IACxC,IAAI,EAAE,OAAO,CAAA;CACd;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAkBzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAQ7F;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAK3E"}

package/lib/tasks.js

@@ -0,0 +1,84 @@
+/**
+ * Task slots and the three-stage turn correlation.
+ *
+ * The hard part of bridging A2A onto the harness is that ONE SUBMITTED MESSAGE
+ * IS NOT ONE TURN. A task spans from the message being accepted until the whole
+ * agent falls idle, which may be several turns if tools queue more work. Three
+ * hooks cooperate:
+ *
+ *   agent/inbox/claimed  →  bind this task's messageId to the turn that took it
+ *   turn/end             →  record that turn's ending (a model error fails now)
+ *   agent.whenIdle()     →  settle, using the recorded ending
+ *
+ * This mirrors what `dsh-acp` does for its prompts, and for the same reason:
+ * steering and injected work may contribute before quiescence, so the bridge
+ * does not claim a task-specific turn outcome.
+ *
+ * @module dsh-a2a/tasks
+ */
+/**
+ * Create an unsettled task slot.
+ * @param taskId - the minted task id.
+ * @param messageId - the id of the user message this task submitted.
+ * @returns the slot, with its settlement promise already armed.
+ */
+export function createSlot(taskId, messageId) {
+    let fulfil;
+    const settled = new Promise((resolve) => { fulfil = resolve; });
+    const slot = {
+        taskId,
+        messageId,
+        turn: undefined,
+        endReason: undefined,
+        texts: [],
+        settled,
+        done: false,
+        settle: (settlement) => {
+            if (slot.done)
+                return;
+            slot.done = true;
+            fulfil?.(settlement);
+        },
+    };
+    return slot;
+}
+/**
+ * Build the artifact list from the text a task's agent committed.
+ *
+ * A2A has artifacts; the harness has assistant messages. One text artifact per
+ * task keeps the mapping honest without inventing structure the agent never
+ * produced. Tool calls and results stay out — A2A's opaque-execution principle
+ * says a peer sees results, not how they were reached.
+ * @param taskId - used to derive a stable artifact id.
+ * @param texts - committed assistant texts, in order.
+ * @returns zero or one artifact.
+ */
+export function artifactsFromTexts(taskId, texts) {
+    const joined = texts.filter(text => text.length > 0).join('\n');
+    if (joined.length === 0)
+        return [];
+    return [{
+            artifactId: `${taskId}-result`,
+            name: 'result',
+            parts: [{ kind: 'text', text: joined }],
+        }];
+}
+/**
+ * Map a harness turn ending onto an A2A terminal state.
+ *
+ * A token ceiling is NOT a task-level failure: the agent stopped for its own
+ * reasons having produced real work, and A2A's `failed` would tell the peer to
+ * discard it. The true ending still travels in `Task.metadata.dsh.stopReason`.
+ * @param endReason - the harness turn ending kind, or undefined for a turnless slot.
+ * @returns the A2A state to settle with.
+ */
+export function stateFromEnding(endReason) {
+    if (endReason === undefined)
+        return 'canceled';
+    if (endReason === 'error')
+        return 'failed';
+    if (endReason === 'cancelled' || endReason === 'canceled')
+        return 'canceled';
+    return 'completed';
+}
+//# sourceMappingURL=tasks.js.map

package/lib/tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tasks.js","sourceRoot":"","sources":["../src/tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgCH;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,SAAiB;IAC7D,IAAI,MAA0D,CAAA;IAC9D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,GAAG,OAAO,CAAA,CAAC,CAAC,CAAC,CAAA;IAC9E,MAAM,IAAI,GAAa;QACrB,MAAM;QACN,SAAS;QACT,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE,EAAE;QACT,OAAO;QACP,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE;YACrB,IAAI,IAAI,CAAC,IAAI;gBAAE,OAAM;YACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;YAChB,MAAM,EAAE,CAAC,UAAU,CAAC,CAAA;QACtB,CAAC;KACF,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,KAAwB;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAClC,OAAO,CAAC;YACN,UAAU,EAAE,GAAG,MAAM,SAAS;YAC9B,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACxC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,SAA6B;IAC3D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,UAAU,CAAA;IAC9C,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAA;IAC1C,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,UAAU,CAAA;IAC5E,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/lib/types.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Vocabulary this plugin merges into the harness's own type surfaces.
+ *
+ * Two declaration merges carry the whole durable contract:
+ *
+ * - `a2a/task` extends `SessionEventMap` so a task's state lives in the
+ *   append-only log. `tasks/get` after a restart therefore has an answer,
+ *   which a process-local task table could never give.
+ * - `a2aPeer` extends `MessageSourceMap` so an inbound message carries
+ *   structured provenance instead of a warning string glued onto its text.
+ *   The prose banner approach costs tokens on every message AND varies the
+ *   reusable request prefix by peer name; a source field does neither.
+ *
+ * @module dsh-a2a/types
+ */
+import type { A2ATaskId, A2ATaskState } from './protocol/index.ts';
+declare module '@deepseek-ai/dsh-session/types' {
+    interface SessionEventMap {
+        /**
+         * One A2A task lifecycle edge. Log-only: no surface operation, absent from
+         * model history, retained by the append-only log across compaction.
+         *
+         * `contextId` is deliberately absent — it IS the SessionId this event is
+         * logged under, and recording it twice would create two truths that can
+         * disagree.
+         */
+        'a2a/task': {
+            /** The task this edge belongs to. */
+            taskId: A2ATaskId;
+            /** The authenticated peer that submitted it. Never body-asserted. */
+            peer: string;
+            /** The state this edge transitions to. */
+            state: A2ATaskState;
+            /** The turn this task correlates with, once one has claimed its message. */
+            turn?: number;
+            /** Terminal edges only: the real harness turn ending, for Task.metadata. */
+            stopReason?: string;
+            /**
+             * Terminal edges only: the committed assistant text this task produced.
+             *
+             * Carried on the edge rather than derived later because of the
+             * projection contract's whole-value rule — a state-carrying event must
+             * hold the complete post-change state. Without it a peer polling
+             * `tasks/get` gets `completed` and an empty artifact list, which reads as
+             * "it worked and produced nothing" rather than "ask again".
+             */
+            output?: string;
+        };
+    }
+}
+declare module '@deepseek-ai/dsh-llm' {
+    interface MessageSourceMap {
+        /**
+         * A message a remote A2A peer addressed to this agent.
+         *
+         * `form: 'relay'` is the harness's own vocabulary for exactly this — its
+         * documented meaning is "a message another agent addressed to this one" —
+         * so no new context form is invented here.
+         */
+        a2aPeer: {
+            kind: 'a2a-peer';
+            /** Authenticated identity, resolved from the presented credential only. */
+            peer: string;
+            /** The task whose submission carried this message. */
+            taskId: A2ATaskId;
+            form: 'relay';
+        };
+    }
+}
+export {};
+//# sourceMappingURL=types.d.ts.map

package/lib/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,QAAQ,gCAAgC,CAAC;IAC9C,UAAU,eAAe;QACvB;;;;;;;WAOG;QACH,UAAU,EAAE;YACV,qCAAqC;YACrC,MAAM,EAAE,SAAS,CAAA;YACjB,qEAAqE;YACrE,IAAI,EAAE,MAAM,CAAA;YACZ,0CAA0C;YAC1C,KAAK,EAAE,YAAY,CAAA;YACnB,4EAA4E;YAC5E,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,4EAA4E;YAC5E,UAAU,CAAC,EAAE,MAAM,CAAA;YACnB;;;;;;;;eAQG;YACH,MAAM,CAAC,EAAE,MAAM,CAAA;SAChB,CAAA;KACF;CACF;AAED,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAU,gBAAgB;QACxB;;;;;;WAMG;QACH,OAAO,EAAE;YACP,IAAI,EAAE,UAAU,CAAA;YAChB,2EAA2E;YAC3E,IAAI,EAAE,MAAM,CAAA;YACZ,sDAAsD;YACtD,MAAM,EAAE,SAAS,CAAA;YACjB,IAAI,EAAE,OAAO,CAAA;SACd,CAAA;KACF;CACF;AAED,OAAO,EAAE,CAAA"}

package/lib/types.js

@@ -0,0 +1,17 @@
+/**
+ * Vocabulary this plugin merges into the harness's own type surfaces.
+ *
+ * Two declaration merges carry the whole durable contract:
+ *
+ * - `a2a/task` extends `SessionEventMap` so a task's state lives in the
+ *   append-only log. `tasks/get` after a restart therefore has an answer,
+ *   which a process-local task table could never give.
+ * - `a2aPeer` extends `MessageSourceMap` so an inbound message carries
+ *   structured provenance instead of a warning string glued onto its text.
+ *   The prose banner approach costs tokens on every message AND varies the
+ *   reusable request prefix by peer name; a source field does neither.
+ *
+ * @module dsh-a2a/types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/lib/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA2DH,OAAO,EAAE,CAAA"}

package/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "dsh-a2a-server",
+  "version": "0.1.0",
+  "description": "Inbound A2A (Agent2Agent) protocol server for DeepSeek Harness: publish an Agent Card and let any A2A-compliant peer submit tasks to a harness agent",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "a2a",
+    "agent2agent",
+    "cordis"
+  ],
+  "license": "MIT",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./protocol": {
+      "types": "./lib/protocol/index.d.ts",
+      "default": "./lib/protocol/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "serve": "tsx example/serve.ts",
+    "probe": "node example/probe.mjs",
+    "prepublishOnly": "pnpm typecheck && pnpm test && pnpm build"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.6"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "3.18.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.2",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-agent-loop": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-agent-loop-testkit": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-brand": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-credentials-local": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm-replay": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-scope": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-session-projection": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@types/node": "^22.10.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8",
+    "zod": "^4.4.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/huangjuhua-aigc/dsh-a2a.git"
+  },
+  "homepage": "https://github.com/huangjuhua-aigc/dsh-a2a#readme",
+  "bugs": {
+    "url": "https://github.com/huangjuhua-aigc/dsh-a2a/issues"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  }
+}