nexus-ai-pro 2.19.0 → 2.20.2

package/dist-cjs/protocols/a2a.js

@@ -16,6 +16,7 @@ exports.A2A_ERRORS = {
     unsupportedOperation: -32004,
     extendedCardNotConfigured: -32007,
     versionNotSupported: -32009,
+    permissionDenied: -32099,
 };
 class A2aError extends Error {
     code;
@@ -55,7 +56,8 @@ class MemoryA2aTaskStore {
     list(query) {
         const matching = [...this.tasks.values()]
             .filter((record) => (query.contextId === undefined || record.task.contextId === query.contextId) &&
-            (query.state === undefined || record.task.status.state === query.state))
+            (query.state === undefined || record.task.status.state === query.state) &&
+            (query.tenant === undefined || record.tenant === query.tenant))
             .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
         return {
             records: matching.slice(query.offset, query.offset + query.limit).map((record) => structuredClone(record)),
@@ -94,6 +96,7 @@ function storeA2aTasks(store, options = {}) {
             const filter = {
                 ...(query.contextId === undefined ? {} : { 'task.contextId': query.contextId }),
                 ...(query.state === undefined ? {} : { 'task.status.state': query.state }),
+                ...(query.tenant === undefined ? {} : { tenant: query.tenant }),
             };
             const items = await store.search(tasks, {
                 limit: query.limit,
@@ -140,6 +143,7 @@ const ERROR_STATUS = {
     [-32007]: { httpStatus: 400, grpcStatus: 'FAILED_PRECONDITION', reason: 'EXTENDED_AGENT_CARD_NOT_CONFIGURED' },
     [-32008]: { httpStatus: 400, grpcStatus: 'FAILED_PRECONDITION', reason: 'EXTENSION_SUPPORT_REQUIRED' },
     [-32009]: { httpStatus: 400, grpcStatus: 'UNIMPLEMENTED', reason: 'VERSION_NOT_SUPPORTED' },
+    [-32099]: { httpStatus: 403, grpcStatus: 'PERMISSION_DENIED', reason: 'PERMISSION_DENIED' },
     [-32700]: { httpStatus: 400, grpcStatus: 'INVALID_ARGUMENT', reason: 'INVALID_PARAMS' },
     [-32600]: { httpStatus: 400, grpcStatus: 'INVALID_ARGUMENT', reason: 'INVALID_PARAMS' },
     [-32601]: { httpStatus: 404, grpcStatus: 'UNIMPLEMENTED', reason: 'METHOD_NOT_FOUND' },
@@ -195,7 +199,12 @@ function a2aHandler(graph, options) {
         defaultInputModes: options.card.defaultInputModes ?? ['text/plain', 'application/json'],
         defaultOutputModes: options.card.defaultOutputModes ?? ['text/plain'],
         skills: options.card.skills,
+        ...(options.card.securitySchemes ? { securitySchemes: options.card.securitySchemes } : {}),
+        ...(options.card.securityRequirements ? { securityRequirements: options.card.securityRequirements } : {}),
+        ...(options.card.signatures ? { signatures: options.card.signatures } : {}),
     };
+    const tenancy = options.tenants ? (options.tenants === true ? {} : options.tenants) : undefined;
+    const conversationKey = (record) => record.tenant === undefined ? record.task.contextId : `${record.tenant}\u0000${record.task.contextId}`;
     const store = options.store ?? new MemoryA2aTaskStore({ maxTasks: options.maxTasks ?? 10_000 });
     const owner = options.lease?.owner ?? (0, shared_js_1.protocolId)('replica');
     const leaseMs = options.lease?.ms ?? 30_000;
@@ -396,8 +405,8 @@ function a2aHandler(graph, options) {
                 const text = (0, shared_js_1.answerOf)(result.state);
                 const reply = agentMessage(task, text);
                 record.history.push(reply);
-                const before = (await store.conversation(task.contextId)) ?? [];
-                await store.saveConversation(task.contextId, (0, shared_js_1.transcriptOf)(result.state, [...before, (0, shared_js_1.messageOf)('assistant', text)]));
+                const before = (await store.conversation(conversationKey(record))) ?? [];
+                await store.saveConversation(conversationKey(record), (0, shared_js_1.transcriptOf)(result.state, [...before, (0, shared_js_1.messageOf)('assistant', text)]));
                 task.artifacts = [{ artifactId: `${task.id}:answer`, name: 'answer', parts: [{ text }] }];
                 if (streamed) {
                     const last = {
@@ -437,10 +446,10 @@ function a2aHandler(graph, options) {
         }
     };
     const startRun = async (record, message, runOptions) => {
-        const history = (await store.conversation(record.task.contextId)) ?? [];
+        const history = (await store.conversation(conversationKey(record))) ?? [];
         const said = (0, shared_js_1.messageOf)('user', textOfParts(message.parts));
         const result = await graph.invoke(options.input ? options.input(message, history) : { messages: [...history, said] }, runOptions);
-        await store.saveConversation(record.task.contextId, [...history, said]);
+        await store.saveConversation(conversationKey(record), [...history, said]);
         return result;
     };
     const carryOn = async (record, runOptions) => {
@@ -492,11 +501,12 @@ function a2aHandler(graph, options) {
             void recover().catch((error) => options.onError?.(error));
         }, options.recoverEveryMs);
     timer?.unref?.();
-    const taskFor = async (message, principal) => {
+    const taskFor = async (message, principal, mine, tenant) => {
         if (message.taskId) {
             const existing = await store.get(message.taskId);
-            if (!existing)
+            if (!existing || !mine(existing)) {
                 return { error: exports.A2A_ERRORS.taskNotFound, message: `Task ${message.taskId} was not found` };
+            }
             if (existing.task.status.state !== 'TASK_STATE_INPUT_REQUIRED') {
                 return { error: exports.A2A_ERRORS.unsupportedOperation, message: `Task ${message.taskId} is not waiting for input` };
             }
@@ -515,6 +525,7 @@ function a2aHandler(graph, options) {
             history: [said],
             run: { kind: 'invoke', message: said, ...(principal ? { principal } : {}) },
             updatedAt: new Date().toISOString(),
+            ...(tenant !== undefined ? { tenant } : {}),
         };
         await store.put(record);
         return record;
@@ -601,9 +612,29 @@ function a2aHandler(graph, options) {
     const pushAnswer = (taskId, config, binding) => binding === 'JSONRPC' ? { taskId, ...config, pushNotificationConfig: config } : { taskId, ...config };
     const fail = (code, message) => ({ error: { code, message } });
     const call = async (method, params, context = {}) => {
-        const principal = context.principal;
+        let principal = context.principal;
         const binding = context.binding ?? 'JSONRPC';
         const pushOn = Boolean(options.pushNotifications);
+        const named = typeof params.tenant === 'string' && params.tenant !== '' ? params.tenant : undefined;
+        if (tenancy) {
+            if (named === undefined) {
+                if (tenancy.required !== false)
+                    return fail(-32602, 'This agent serves several tenants: name one as tenant');
+            }
+            else {
+                const allowed = tenancy.authorize ? await tenancy.authorize(named, principal) : principal?.tenantId === named;
+                if (!allowed)
+                    return fail(exports.A2A_ERRORS.permissionDenied, `This caller may not act for tenant ${named}`);
+                if (principal?.tenantId !== named)
+                    principal = { ...principal, tenantId: named };
+            }
+        }
+        const tenant = tenancy ? named : undefined;
+        const mine = (record) => !tenancy || record.tenant === tenant;
+        const own = async (id) => {
+            const record = await store.get(id);
+            return record && mine(record) ? record : undefined;
+        };
         try {
             switch (method) {
                 case 'SendMessage':
@@ -616,7 +647,7 @@ function a2aHandler(graph, options) {
                     if (pushConfig && !pushOn) {
                         return fail(exports.A2A_ERRORS.pushNotificationNotSupported, 'This agent does not push notifications');
                     }
-                    const record = await taskFor(message, principal);
+                    const record = await taskFor(message, principal, mine, tenant);
                     if ('error' in record)
                         return fail(record.error, record.message);
                     if (pushConfig) {
@@ -634,7 +665,7 @@ function a2aHandler(graph, options) {
                     return { events: follow(record, () => execute(record, message, principal), context.signal) };
                 }
                 case 'GetTask': {
-                    const record = await store.get(String(params.id ?? ''));
+                    const record = await own(String(params.id ?? ''));
                     if (!record)
                         return fail(exports.A2A_ERRORS.taskNotFound, `Task ${String(params.id)} was not found`);
                     return { result: view(record, typeof params.historyLength === 'number' ? params.historyLength : undefined) };
@@ -650,6 +681,7 @@ function a2aHandler(graph, options) {
                     const listed = await store.list({
                         ...(typeof params.contextId === 'string' && params.contextId !== '' ? { contextId: params.contextId } : {}),
                         ...(filtered ? { state: status } : {}),
+                        ...(tenant !== undefined ? { tenant } : {}),
                         limit: pageSize,
                         offset,
                     });
@@ -659,6 +691,7 @@ function a2aHandler(graph, options) {
                     return {
                         result: {
                             tasks: listed.records
+                                .filter(mine)
                                 .filter((record) => !after || (record.task.status.timestamp ?? '') >= after)
                                 .map((record) => view(record, historyLength))
                                 .map(({ artifacts, ...task }) => params.includeArtifacts === false ? task : { ...task, ...(artifacts ? { artifacts } : {}) }),
@@ -669,7 +702,7 @@ function a2aHandler(graph, options) {
                     };
                 }
                 case 'SubscribeToTask': {
-                    const record = await store.get(String(params.id ?? ''));
+                    const record = await own(String(params.id ?? ''));
                     if (!record)
                         return fail(exports.A2A_ERRORS.taskNotFound, `Task ${String(params.id)} was not found`);
                     if (TERMINAL.has(record.task.status.state)) {
@@ -681,7 +714,7 @@ function a2aHandler(graph, options) {
                     return { events: follow(record, undefined, context.signal) };
                 }
                 case 'CancelTask': {
-                    const record = await store.get(String(params.id ?? ''));
+                    const record = await own(String(params.id ?? ''));
                     if (!record)
                         return fail(exports.A2A_ERRORS.taskNotFound, `Task ${String(params.id)} was not found`);
                     if (TERMINAL.has(record.task.status.state)) {
@@ -701,7 +734,7 @@ function a2aHandler(graph, options) {
                     if (!pushOn)
                         return fail(exports.A2A_ERRORS.pushNotificationNotSupported, 'This agent does not push notifications');
                     const taskId = String(params.taskId ?? params.id ?? '');
-                    const record = await store.get(taskId);
+                    const record = await own(taskId);
                     if (!record)
                         return fail(exports.A2A_ERRORS.taskNotFound, `Task ${taskId} was not found`);
                     if (method === 'CreateTaskPushNotificationConfig') {
@@ -782,8 +815,21 @@ function a2aHandler(graph, options) {
             return rpcError(id, outcome.error.code, outcome.error.message);
         return rpcResult(id, outcome.result);
     };
-    const httpJson = async (request, route) => {
+    const httpJson = async (request, path) => {
         const verb = request.method;
+        const known = /^\/(?:message:send$|message:stream$|tasks(?:$|\/)|extendedAgentCard$)/;
+        let route = path;
+        let routedTenant;
+        const prefixed = /^\/([^/]+)(\/.*)$/.exec(path);
+        if (!known.test(path) && prefixed && known.test(prefixed[2])) {
+            try {
+                routedTenant = decodeURIComponent(prefixed[1]);
+            }
+            catch {
+                return restError(-32602, 'The tenant in the path is not valid percent-encoding');
+            }
+            route = prefixed[2];
+        }
         const query = new URL(request.url).searchParams;
         const number = (name) => (query.has(name) ? Number(query.get(name)) : undefined);
         const id = (value) => decodeURIComponent(value ?? '');
@@ -835,6 +881,8 @@ function a2aHandler(graph, options) {
         const refused = versionRefused(request);
         if (refused)
             return restError(exports.A2A_ERRORS.versionNotSupported, refused);
+        if (routedTenant !== undefined)
+            params = { ...params, tenant: routedTenant };
         if (body) {
             const text = await request.text();
             try {
@@ -1045,23 +1093,34 @@ function a2aClient(options) {
         });
         return cached;
     };
-    const endpoint = async () => isCard
-        ? ((await card()).supportedInterfaces.find((item) => item.protocolBinding === binding)?.url ?? options.url)
-        : options.url;
+    const target = async () => {
+        if (!isCard)
+            return { url: options.url, ...(options.tenant ? { tenant: options.tenant } : {}) };
+        const chosen = (await card()).supportedInterfaces.find((item) => item.protocolBinding === binding);
+        const tenant = options.tenant ?? chosen?.tenant;
+        return { url: chosen?.url ?? options.url, ...(tenant ? { tenant } : {}) };
+    };
     const headers = { 'content-type': 'application/json', 'a2a-version': exports.A2A_PROTOCOL_VERSION, ...options.headers };
     let ids = 0;
-    const rpc = async (method, params, signal) => fetcher(await endpoint(), {
-        method: 'POST',
-        headers,
-        body: JSON.stringify({ jsonrpc: '2.0', id: ++ids, method, params }),
-        ...(signal ? { signal } : {}),
-    });
-    const route = async (verb, path, body, signal) => fetcher(`${(await endpoint()).replace(/\/+$/, '')}${path}`, {
-        method: verb,
-        headers: body === undefined ? { ...headers, 'content-type': 'application/json' } : headers,
-        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-        ...(signal ? { signal } : {}),
-    });
+    const rpc = async (method, params, signal) => {
+        const { url, tenant } = await target();
+        return fetcher(url, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ jsonrpc: '2.0', id: ++ids, method, params: tenant ? { tenant, ...params } : params }),
+            ...(signal ? { signal } : {}),
+        });
+    };
+    const route = async (verb, path, body, signal) => {
+        const { url, tenant } = await target();
+        const under = tenant ? `/${encodeURIComponent(tenant)}` : '';
+        return fetcher(`${url.replace(/\/+$/, '')}${under}${path}`, {
+            method: verb,
+            headers: body === undefined ? { ...headers, 'content-type': 'application/json' } : headers,
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            ...(signal ? { signal } : {}),
+        });
+    };
     const restFailure = async (response) => {
         const body = (await response.json().catch(() => ({})));
         const reason = body.error?.details?.find((detail) => detail.reason)?.reason;

package/dist-cjs/version.d.ts

@@ -2,4 +2,4 @@
  * This package's version, recorded where provenance matters, such as on every experiment. A test
  * keeps it equal to `package.json`.
  */
-export declare const NEXUS_VERSION = "2.19.0";
+export declare const NEXUS_VERSION = "2.20.2";

package/dist-cjs/version.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NEXUS_VERSION = void 0;
-exports.NEXUS_VERSION = '2.19.0';
+exports.NEXUS_VERSION = '2.20.2';

package/llms.txt

@@ -5,7 +5,7 @@
 Import only what you use. The root import is the client and nothing else, and every other capability has its own entry point with a size budget CI enforces; [the packaging guide](https://raw.githubusercontent.com/mkhitar-abrahamyan/nexus-ai/main/docs/packaging.md) publishes what each one costs. The package has no required dependencies: a graph-only application loads 81 KB, and installs nothing but this package. The client, the provider adapters, graphs, agents, and the agent protocols run on Node.js, Deno, Bun, edge runtimes, and browsers; [the runtimes guide](https://raw.githubusercontent.com/mkhitar-abrahamyan/nexus-ai/main/docs/runtimes.md) lists the entry points that need Node.js, and why.
 
 - Install with `npm install nexus-ai-pro`. It needs Node.js 22 or newer, and ships ESM and CommonJS builds with shared types. License: MIT.
-- It has 198 entry points. `nexus-ai-pro` itself is the client, and every other capability has its own subpath, such as `nexus-ai-pro/graph`.
+- It has 199 entry points. `nexus-ai-pro` itself is the client, and every other capability has its own subpath, such as `nexus-ai-pro/graph`.
 - Nothing is a required dependency. Install only the optional peers you use: `@anthropic-ai/sdk`, `@types/node`, `ajv`, `ajv-formats`, `ollama`, `openai`, `zod`.
 - Each guide explains every export of its entry points, then lists them in a reference generated from the doc comments.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexus-ai-pro",
-  "version": "2.19.0",
+  "version": "2.20.2",
   "description": "Typed AI framework for TypeScript: provider routing and failover, durable agent graphs and workflows, retrieval over any vector store, MCP, evals, guardrails, and cost control",
   "type": "module",
   "main": "dist-cjs/index.js",
@@ -670,6 +670,16 @@
         "default": "./dist-cjs/agent/middleware/index.js"
       }
     },
+    "./agent/openapi": {
+      "import": {
+        "types": "./dist/agent/openapi.d.ts",
+        "default": "./dist/agent/openapi.js"
+      },
+      "require": {
+        "types": "./dist-cjs/agent/openapi.d.ts",
+        "default": "./dist-cjs/agent/openapi.js"
+      }
+    },
     "./deep-agent": {
       "import": {
         "types": "./dist/deep-agent/index.d.ts",
@@ -2412,6 +2422,9 @@
       "agent/middleware": [
         "dist-cjs/agent/middleware/index.d.ts"
       ],
+      "agent/openapi": [
+        "dist-cjs/agent/openapi.d.ts"
+      ],
       "deep-agent": [
         "dist-cjs/deep-agent/index.d.ts"
       ],