PyPI - asap-protocol - Versions diffs - 2.5.2__tar.gz → 2.5.3__tar.gz - Mend

asap-protocol 2.5.2tar.gz → 2.5.3tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (239) hide show

{asap_protocol-2.5.2 → asap_protocol-2.5.3}/.gitignore RENAMED Viewed

@@ -177,6 +177,8 @@ cython_debug/
 # Project specific
 !/.cursor/
+# Local Cursor slash-command workflows (dev process; keep on disk, do not commit)
+.cursor/commands/
 /drafts/
 /.claude/
 # Local agent state / tooling (ignore everywhere, not only repo root)

{asap_protocol-2.5.2 → asap_protocol-2.5.3}/CHANGELOG.md RENAMED Viewed

@@ -7,9 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
-### Follow-up (planned v2.5.3+)
+### Follow-up (planned v2.5.4+)
-- **Adapter Lab II** — enterprise/workflow adapters ([prd-v2.5.3-adapter-lab-ii.md](product/prd/prd-v2.5.3-adapter-lab-ii.md)).
 - **Distribution Loop** — homepage, templates, metrics ([prd-v2.5.4-distribution-loop.md](product/prd/prd-v2.5.4-distribution-loop.md)).
 - **Formal Spec & Interop** — RFC spec, introspection, privacy ([prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md)).
 - `@asap-protocol/mcp-auth` HTTP/SSE middleware (deferred from v2.5.0 — see [2.5.0] TypeScript note and [typescript-mcp-auth-spike.md](engineering/tasks/v2.5.0/typescript-mcp-auth-spike.md)).
@@ -18,6 +17,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ---
+## [2.5.3] - 2026-07-14
+> **Status:** merged to `main` ([#291](https://github.com/adriannoes/asap-protocol/pull/291), 2026-07-15);
+> **pending tag/publish**. PyPI still serves **2.5.2** until `v2.5.3` is tagged and the
+> release workflow completes.
+**Adapter Lab II** — workflow / enterprise adapters as **docs + examples** (no wire-format
+change). Scope: [prd-v2.5.3-adapter-lab-ii.md](product/prd/prd-v2.5.3-adapter-lab-ii.md).
+npm `@asap-protocol/*` packages remain at **2.4.1**.
+### Added
+- **Workflow connectors**: OpenAPI → ASAP skills for n8n-/Activepieces-shaped workflow
+  HTTP APIs — [guide](docs/integrations/workflow-connectors.md) +
+  `examples/workflow_asap_connector/` (Compliance Harness v2 score **1.0**).
+- **Automation connector security**: production baseline for OpenAPI-backed connectors
+  ([guide](docs/guides/automation-connector-security.md)).
+- **Microsoft Agent Framework**: research / experimental interop guide
+  ([guide](docs/integrations/microsoft-agent-framework.md)); no .NET SDK / NuGet sample.
+- **NeMo Agent Toolkit**: experimental Path A stdio demo
+  ([guide](docs/integrations/nemo-agent-toolkit.md),
+  `examples/nemo_agent_toolkit_asap/`); Path C third-party plugin remains deferred.
+- **Docs / web surface**: MkDocs Adapters + Lab II nav; marketplace WhatsNew ribbon and
+  developer-experience CTAs for Lab II guides.
+### Fixed
+- **Invalid envelope JSON-RPC errors**: URN / structure validation failures return
+  JSON-safe `-32602` with `validation_errors` (no longer escalate to `-32603` when
+  Pydantic embeds `ValueError` in `ctx`).
+- **MCP Auth Bridge example client**: self-contained path captures the demo Agent JWT
+  from the spawned child stderr (cross-process paste no longer required).
+- **`ASAPClient.health_check`**: `base_url` defaults to the client's HTTP base URL.
+### Security (deps)
+- Override `setuptools>=83.0.0` for **PYSEC-2026-3447** (transitive build/tooling path).
+  See [SECURITY.md](SECURITY.md).
+### Migration
+- **v2.5.2 → v2.5.3**: See [migration guide](docs/migration.md#upgrading-from-v252-to-v253).
+  No breaking wire-protocol changes; adopt new guides/examples as needed.
+---
 ## [2.5.2] - 2026-07-08
 **Security & correctness follow-up** — operator API auth, tighter ingress

{asap_protocol-2.5.2 → asap_protocol-2.5.3}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asap-protocol
-Version: 2.5.2
+Version: 2.5.3
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/adriannoes/asap-protocol
 Project-URL: Documentation, https://adriannoes.github.io/asap-protocol
@@ -99,9 +99,9 @@ Description-Content-Type: text/markdown
 > A production-ready protocol for agent-to-agent communication and task coordination.
-**Quick Info**: [`v2.5.2`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.2) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.3`](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#253---2026-07-14) (merged · pending tag/publish) · PyPI [`v2.5.2`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
-> 📦 **Install** — [`asap-protocol` on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.2** on PyPI](https://pypi.org/project/asap-protocol/) (Python; **2.5.3** merged to `main`, pending tag/publish) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
@@ -148,24 +148,24 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 | Runtime | Integrations | Docs |
 | --- | --- | --- |
-| **Python** | LangChain, CrewAI, LlamaIndex, PydanticAI, SmolAgents, OpenClaw (`pip install "asap-protocol[extra]"`); Vercel AI SDK router; MCP; MCP Auth Bridge; A2H | [OpenClaw](docs/guides/openclaw-integration.md) · [Vercel AI SDK](docs/guides/vercel-ai-sdk.md) · [MCP](docs/mcp-integration.md) · [MCP Auth Bridge](docs/adapters/mcp-auth-bridge.md) |
-| **TypeScript** (npm) | `@asap-protocol/client` (Vercel AI / OpenAI / Anthropic adapters), `@asap-protocol/mastra`, `@asap-protocol/openai-agents` | [TypeScript SDK](docs/sdks/typescript.md) · [Mastra](docs/integrations/mastra.md) · [OpenAI Agents](docs/integrations/openai-agents.md) |
+| **Python** | LangChain, CrewAI, LlamaIndex, PydanticAI, SmolAgents, OpenClaw (`pip install "asap-protocol[extra]"`); Vercel AI SDK router; MCP; MCP Auth Bridge; A2H; OpenAPI workflow connectors (Lab II) | [OpenClaw](docs/guides/openclaw-integration.md) · [Vercel AI SDK](docs/guides/vercel-ai-sdk.md) · [MCP](docs/mcp-integration.md) · [MCP Auth Bridge](docs/adapters/mcp-auth-bridge.md) · [Workflow connectors](docs/integrations/workflow-connectors.md) · [NeMo Agent Toolkit](docs/integrations/nemo-agent-toolkit.md) (experimental) |
+| **TypeScript** (npm) | `@asap-protocol/client` (Vercel AI / OpenAI / Anthropic adapters), `@asap-protocol/mastra`, `@asap-protocol/openai-agents` | [TypeScript SDK](docs/sdks/typescript.md) · [Mastra](docs/integrations/mastra.md) · [OpenAI Agents](docs/integrations/openai-agents.md) · [Microsoft Agent Framework](docs/integrations/microsoft-agent-framework.md) (research) |
 ## Installation
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 ```bash
-uv add asap-protocol
+uv add asap-protocol  # latest on PyPI (currently 2.5.2)
 ```
 Or with pip:
 ```bash
-pip install asap-protocol
+pip install asap-protocol==2.5.2
 ```
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.2; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.3; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -177,7 +177,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
-**Python v2.5.2** (security follow-up): `uv add asap-protocol` or `pip install asap-protocol==2.5.2` — see [Migration (v2.5.1 → v2.5.2)](docs/migration.md#upgrading-from-v251).
+**Python v2.5.3** (Adapter Lab II) is **merged to `main`** and **pending tag/publish** — stay on `asap-protocol==2.5.2` from PyPI until the release is published; then see [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253).
 ## Quick Start
@@ -265,6 +265,7 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 | Version | What shipped |
 | :-- | :-- |
+| **v2.5.3** | **Adapter Lab II** — **merged · pending tag/publish**. Workflow OpenAPI connectors + security guide, experimental MAF / NeMo guides, JSON-safe `-32602`, MCP example client DX. PyPI still **2.5.2**. See [CHANGELOG](CHANGELOG.md#253---2026-07-14), [PRD](product/prd/prd-v2.5.3-adapter-lab-ii.md), and [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253) |
 | **v2.5.2** | **Security & correctness follow-up** — opt-in operator API auth, `extra="forbid"` ingress, Redis JTI replay, web distributed rate limits, v2.5.1 CR follow-ups (#245–#249), registry signed-manifest/400 fixes. See [CHANGELOG](CHANGELOG.md#252---2026-07-08), [PRD](product/prd/prd-v2.5.2-security-follow-up.md), and [Migration (v2.5.1 → v2.5.2)](docs/migration.md#upgrading-from-v251) |
 | **v2.5.1** | **Code quality patch** — behavior-preserving refactor (transport/server, client, websocket, SQLite storage, auth, integrations) + six correctness/security fixes (atomic `revoke_cascade`, `usage_events` DDL, unified Host-JWT verifier, **WS now enforces OAuth2**, OpenAPI handler cleanup, client `correlation_id` binding). Deprecated import paths removed in v2.6.0. See [CHANGELOG](CHANGELOG.md#251---2026-06-25) and [Migration (v2.5.0 → v2.5.1)](docs/migration.md#upgrading-from-v250-to-v251) |
 | **v2.5.0.1** | **Compliance publish** — **[GitHub Release `v2.5.0.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.0.1)** · PyPI **`asap-compliance` 1.3.0** (`mcp-auth-bridge` profile; requires `asap-protocol>=2.5.0`). No `asap-protocol` API change. See [CHANGELOG](CHANGELOG.md#2501---2026-06-24) |
@@ -286,7 +287,6 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
-- **v2.5.3** — enterprise/workflow adapter spikes (Adapter Lab II)
 - **v2.5.4** — distribution loop (homepage templates, starter kits, adoption metrics)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** (v2.5.5) — introspection, privacy, cross-protocol interop on the path to v3.0 economy

{asap_protocol-2.5.2 → asap_protocol-2.5.3}/README.md RENAMED Viewed

@@ -7,9 +7,9 @@
 > A production-ready protocol for agent-to-agent communication and task coordination.
-**Quick Info**: [`v2.5.2`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.2) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.3`](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#253---2026-07-14) (merged · pending tag/publish) · PyPI [`v2.5.2`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
-> 📦 **Install** — [`asap-protocol` on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.2** on PyPI](https://pypi.org/project/asap-protocol/) (Python; **2.5.3** merged to `main`, pending tag/publish) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
@@ -56,24 +56,24 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 | Runtime | Integrations | Docs |
 | --- | --- | --- |
-| **Python** | LangChain, CrewAI, LlamaIndex, PydanticAI, SmolAgents, OpenClaw (`pip install "asap-protocol[extra]"`); Vercel AI SDK router; MCP; MCP Auth Bridge; A2H | [OpenClaw](docs/guides/openclaw-integration.md) · [Vercel AI SDK](docs/guides/vercel-ai-sdk.md) · [MCP](docs/mcp-integration.md) · [MCP Auth Bridge](docs/adapters/mcp-auth-bridge.md) |
-| **TypeScript** (npm) | `@asap-protocol/client` (Vercel AI / OpenAI / Anthropic adapters), `@asap-protocol/mastra`, `@asap-protocol/openai-agents` | [TypeScript SDK](docs/sdks/typescript.md) · [Mastra](docs/integrations/mastra.md) · [OpenAI Agents](docs/integrations/openai-agents.md) |
+| **Python** | LangChain, CrewAI, LlamaIndex, PydanticAI, SmolAgents, OpenClaw (`pip install "asap-protocol[extra]"`); Vercel AI SDK router; MCP; MCP Auth Bridge; A2H; OpenAPI workflow connectors (Lab II) | [OpenClaw](docs/guides/openclaw-integration.md) · [Vercel AI SDK](docs/guides/vercel-ai-sdk.md) · [MCP](docs/mcp-integration.md) · [MCP Auth Bridge](docs/adapters/mcp-auth-bridge.md) · [Workflow connectors](docs/integrations/workflow-connectors.md) · [NeMo Agent Toolkit](docs/integrations/nemo-agent-toolkit.md) (experimental) |
+| **TypeScript** (npm) | `@asap-protocol/client` (Vercel AI / OpenAI / Anthropic adapters), `@asap-protocol/mastra`, `@asap-protocol/openai-agents` | [TypeScript SDK](docs/sdks/typescript.md) · [Mastra](docs/integrations/mastra.md) · [OpenAI Agents](docs/integrations/openai-agents.md) · [Microsoft Agent Framework](docs/integrations/microsoft-agent-framework.md) (research) |
 ## Installation
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 ```bash
-uv add asap-protocol
+uv add asap-protocol  # latest on PyPI (currently 2.5.2)
 ```
 Or with pip:
 ```bash
-pip install asap-protocol
+pip install asap-protocol==2.5.2
 ```
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.2; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.3; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -85,7 +85,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
-**Python v2.5.2** (security follow-up): `uv add asap-protocol` or `pip install asap-protocol==2.5.2` — see [Migration (v2.5.1 → v2.5.2)](docs/migration.md#upgrading-from-v251).
+**Python v2.5.3** (Adapter Lab II) is **merged to `main`** and **pending tag/publish** — stay on `asap-protocol==2.5.2` from PyPI until the release is published; then see [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253).
 ## Quick Start
@@ -173,6 +173,7 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 | Version | What shipped |
 | :-- | :-- |
+| **v2.5.3** | **Adapter Lab II** — **merged · pending tag/publish**. Workflow OpenAPI connectors + security guide, experimental MAF / NeMo guides, JSON-safe `-32602`, MCP example client DX. PyPI still **2.5.2**. See [CHANGELOG](CHANGELOG.md#253---2026-07-14), [PRD](product/prd/prd-v2.5.3-adapter-lab-ii.md), and [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253) |
 | **v2.5.2** | **Security & correctness follow-up** — opt-in operator API auth, `extra="forbid"` ingress, Redis JTI replay, web distributed rate limits, v2.5.1 CR follow-ups (#245–#249), registry signed-manifest/400 fixes. See [CHANGELOG](CHANGELOG.md#252---2026-07-08), [PRD](product/prd/prd-v2.5.2-security-follow-up.md), and [Migration (v2.5.1 → v2.5.2)](docs/migration.md#upgrading-from-v251) |
 | **v2.5.1** | **Code quality patch** — behavior-preserving refactor (transport/server, client, websocket, SQLite storage, auth, integrations) + six correctness/security fixes (atomic `revoke_cascade`, `usage_events` DDL, unified Host-JWT verifier, **WS now enforces OAuth2**, OpenAPI handler cleanup, client `correlation_id` binding). Deprecated import paths removed in v2.6.0. See [CHANGELOG](CHANGELOG.md#251---2026-06-25) and [Migration (v2.5.0 → v2.5.1)](docs/migration.md#upgrading-from-v250-to-v251) |
 | **v2.5.0.1** | **Compliance publish** — **[GitHub Release `v2.5.0.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.0.1)** · PyPI **`asap-compliance` 1.3.0** (`mcp-auth-bridge` profile; requires `asap-protocol>=2.5.0`). No `asap-protocol` API change. See [CHANGELOG](CHANGELOG.md#2501---2026-06-24) |
@@ -194,7 +195,6 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
-- **v2.5.3** — enterprise/workflow adapter spikes (Adapter Lab II)
 - **v2.5.4** — distribution loop (homepage templates, starter kits, adoption metrics)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** (v2.5.5) — introspection, privacy, cross-protocol interop on the path to v3.0 economy

{asap_protocol-2.5.2 → asap_protocol-2.5.3}/pyproject.toml RENAMED Viewed

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.5.2"
+version = "2.5.3"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -127,7 +127,8 @@ Issues = "https://github.com/adriannoes/asap-protocol/issues"
 # - tinytag>=2.2.1 for CVE-2026-32889
 # - cryptography>=48.0.1 for GHSA-537c-gmf6-5ccf (CVE-2026-39892 / CVE-2026-34073 baseline at 46.0.7)
 # - requests>=2.33.0 for CVE-2026-25645 (extract_zipped_paths temp file)
-# - pillow>=12.2.0 for CVE-2026-40192 (transitive, e.g. pdf/vision stacks)
+# - pillow>=12.3.0 for PYSEC-2026-2253–2257 (prior: CVE-2026-40192 at >=12.2.0; transitive, e.g. pdf/vision stacks)
+# - click>=8.3.3 for PYSEC-2026-2132 (transitive, e.g. typer / uvicorn / mkdocs stacks)
 # - pytest>=9.0.3 for CVE-2025-71176 (dev)
 # - python-multipart>=0.0.31 for CVE-2026-53538–53540 (FastAPI stack; prior floor 0.0.27)
 # - starlette>=1.3.1 for CVE-2026-54282 / CVE-2026-54283 (FastAPI stack)
@@ -145,6 +146,7 @@ Issues = "https://github.com/adriannoes/asap-protocol/issues"
 # - joserfc>=1.6.7 for CVE-2026-48990 (JWT/JWS primitives; direct + override)
 # - python-engineio>=4.13.2 for CVE-2026-48802 / CVE-2026-48809 (transitive, locust stack)
 # - python-socketio>=5.16.2 for CVE-2026-48804 (transitive, locust stack)
+# - setuptools>=83.0.0 for PYSEC-2026-3447 (transitive build/tooling path)
 [tool.uv]
 override-dependencies = [
     "aiohttp>=3.14.0,<4",
@@ -153,7 +155,8 @@ override-dependencies = [
     "tinytag>=2.2.1",
     "cryptography>=48.0.1,<49",
     "requests>=2.33.0",
-    "pillow>=12.2.0",
+    "pillow>=12.3.0",
+    "click>=8.3.3",
     "pytest>=9.0.3",
     "python-multipart>=0.0.31",
     "starlette>=1.3.1",
@@ -172,6 +175,7 @@ override-dependencies = [
     "joserfc>=1.6.7,<2",
     "python-engineio>=4.13.2",
     "python-socketio>=5.16.2",
+    "setuptools>=83.0.0",
 ]
 [project.scripts]

{asap_protocol-2.5.2 → asap_protocol-2.5.3}/src/asap/__init__.py RENAMED Viewed

@@ -8,7 +8,7 @@ from __future__ import annotations
 from typing import Any
-__version__ = "2.5.2"
+__version__ = "2.5.3"
 __all__ = ["__version__", "create_from_openapi"]

{asap_protocol-2.5.2 → asap_protocol-2.5.3}/src/asap/examples/README.md RENAMED Viewed

@@ -8,7 +8,7 @@ Examples cover:
 - **Core flow**: Echo agent, coordinator, and a full demo (run_demo).
 - **Advanced patterns**: Multi-agent orchestration, long-running tasks with checkpoints, error recovery, MCP integration, state migration, auth, rate limiting.
-- **Concepts**: WebSocket (not implemented), streaming responses, multi-step workflows.
+- **Concepts**: WebSocket (`/asap/ws` on `create_app`), streaming responses (`streaming_agent`), multi-step workflows.
 Run any example from the repository root with:
@@ -97,16 +97,17 @@ Run agents individually:
 | **auth_patterns** | Bearer auth, custom token validators, OAuth2 concept (manifest + create_app) | `uv run python -m asap.examples.auth_patterns` |
 | **rate_limiting** | Per-sender and per-endpoint rate limit patterns (create_limiter, ASAP_RATE_LIMIT) | `uv run python -m asap.examples.rate_limiting` |
-### Concepts (no full implementation)
+### Concepts
 | Module | Description | Usage |
 |--------|-------------|--------|
-| **websocket_concept** | How WebSocket would work with ASAP (comments/pseudocode only) | `uv run python -m asap.examples.websocket_concept` |
+| **websocket_concept** | Educational notes; live transport is WebSocket `/asap/ws` (see `docs/transport.md`) | `uv run python -m asap.examples.websocket_concept` |
 ### Streaming and workflows
 | Module | Description | Usage |
 |--------|-------------|--------|
+| **streaming_agent** | Live agent with SSE `TaskStream` chunks over HTTP | `uv run python -m asap.examples.streaming_agent` |
 | **streaming_response** | Stream TaskUpdate progress chunks (simulated streaming) | `uv run python -m asap.examples.streaming_response [--chunks N]` |
 | **multi_step_workflow** | Multi-step pipeline: fetch → transform → summarize (WorkflowState, run_workflow) | `uv run python -m asap.examples.multi_step_workflow` |

{asap_protocol-2.5.2 → asap_protocol-2.5.3}/src/asap/transport/_request_handler.py RENAMED Viewed

@@ -79,7 +79,38 @@ T = TypeVar("T")
 HandlerResult = tuple[T | None, JSONResponse | None]
 EnvelopeOrError = Union[JSONResponse, tuple[Envelope, str]]
-__all__ = ["ASAPRequestHandler", "_audit_log_operation", "_fallback_context"]
+__all__ = [
+    "ASAPRequestHandler",
+    "_audit_log_operation",
+    "_fallback_context",
+    "json_safe_validation_errors",
+]
+def json_safe_validation_errors(exc: ValidationError) -> list[dict[str, Any]]:
+    """Return Pydantic validation errors that are JSON-serializable.
+    ``ValidationError.errors()`` may embed non-JSON types in ``ctx`` (e.g. a
+    raw ``ValueError`` from a field validator). Putting that into
+    ``JSONResponse`` raises during Starlette encoding and the client sees
+    JSON-RPC ``-32603`` instead of ``-32602``.
+    Uses ``exc.json()`` so ``ctx`` values are stringified while locations and
+    messages stay intact.
+    Example:
+        >>> from pydantic import BaseModel, ValidationError
+        >>> class M(BaseModel):
+        ...     x: int
+        >>> try:
+        ...     M(x="bad")
+        ... except ValidationError as err:
+        ...     errs = json_safe_validation_errors(err)
+        >>> isinstance(errs[0]["loc"], list)
+        True
+    """
+    loaded: list[dict[str, Any]] = json.loads(exc.json())
+    return loaded
 def _fallback_context(start_time: float) -> RequestContext:
@@ -309,9 +340,10 @@ class ASAPRequestHandler:
             payload_type = envelope.payload_type
             return envelope, payload_type
         except ValidationError as e:
+            validation_errors = json_safe_validation_errors(e)
             log_data: dict[str, Any] = {
                 "error": "Invalid envelope structure",
-                "validation_errors": e.errors(),
+                "validation_errors": validation_errors,
             }
             if not is_debug_mode():
                 log_data = sanitize_for_logging(log_data)
@@ -322,7 +354,7 @@ class ASAPRequestHandler:
                 INVALID_PARAMS,
                 data={
                     "error": "Invalid envelope structure",
-                    "validation_errors": e.errors(),
+                    "validation_errors": validation_errors,
                 },
                 request_id=ctx.request_id,
             )
@@ -820,22 +852,22 @@ class ASAPRequestHandler:
             error_code = INVALID_REQUEST
             error_message = "Invalid JSON-RPC structure"
             if isinstance(e, ValidationError):
-                errors = e.errors()
+                validation_errors = json_safe_validation_errors(e)
                 # If params validation failed with dict_type error, use INVALID_PARAMS
-                for error in errors:
-                    if error.get("loc") == ("params",) and error.get("type") == "dict_type":
+                for error in validation_errors:
+                    if error.get("loc") == ["params"] and error.get("type") == "dict_type":
                         error_code = INVALID_PARAMS
                         error_message = "JSON-RPC 'params' must be an object"
                         break
+            else:
+                validation_errors = [
+                    {"type": "type_error", "loc": [], "msg": str(e), "input": None}
+                ]
             log_struct: dict[str, Any] = {
                 "error": error_message,
                 "error_type": type(e).__name__,
-                "validation_errors": (
-                    e.errors()
-                    if isinstance(e, ValidationError)
-                    else [{"type": "type_error", "loc": (), "msg": str(e), "input": None}]
-                ),
+                "validation_errors": validation_errors,
             }
             if not is_debug_mode():
                 log_struct = sanitize_for_logging(log_struct)
@@ -844,11 +876,7 @@ class ASAPRequestHandler:
                 error_code,
                 data={
                     "error": error_message,
-                    "validation_errors": (
-                        e.errors()
-                        if isinstance(e, ValidationError)
-                        else [{"type": "type_error", "loc": (), "msg": str(e), "input": None}]
-                    ),
+                    "validation_errors": validation_errors,
                 },
                 request_id=body.get("id") if isinstance(body, dict) else None,
             )

{asap_protocol-2.5.2 → asap_protocol-2.5.3}/src/asap/transport/client/_discovery.py RENAMED Viewed

@@ -418,7 +418,7 @@ class _DiscoveryMixin:
                     url=sanitize_url(url),
                 ) from e
-    async def health_check(self, base_url: str) -> HealthStatus:
+    async def health_check(self, base_url: str | None = None) -> HealthStatus:
         """Check agent health/liveness at the given base URL.
         Fetches GET {base_url}/.well-known/asap/health and parses the
@@ -426,6 +426,7 @@ class _DiscoveryMixin:
         Args:
             base_url: Agent base URL (e.g. "https://agent.example.com").
+                Defaults to this client's HTTP base URL when omitted.
         Returns:
             HealthStatus with status, agent_id, version, uptime_seconds, etc.
@@ -437,10 +438,11 @@ class _DiscoveryMixin:
         Example:
             >>> async with ASAPClient("http://localhost:8000") as client:
-            ...     health = await client.health_check("https://other-agent.example.com")
+            ...     health = await client.health_check()
             ...     print(health.status, health.uptime_seconds)
         """
-        health_url = base_url.rstrip("/") + WELLKNOWN_HEALTH_PATH
+        resolved = self._http_base_url if base_url is None else base_url
+        health_url = resolved.rstrip("/") + WELLKNOWN_HEALTH_PATH
         if not self._client:
             raise ASAPConnectionError(
                 "Client not connected. Use 'async with' context.",