Struct A2aServerConfig 

pub struct A2aServerConfig {

    pub enabled: bool,
    pub host: String,
    pub port: u16,
    pub public_url: String,
    pub auth_token: Option<String>,
    pub rate_limit: u32,
    pub max_body_size: usize,
    pub drain_timeout_ms: u64,
    pub require_auth: bool,
    pub ibct_keys: Vec<IbctKeyConfig>,
    pub ibct_signing_key_vault_ref: Option<String>,
    pub ibct_ttl_secs: u64,
    pub advertise_files: bool,
    pub request_timeout_ms: u64,
    pub task_ttl_secs: u64,
}

A2A server configuration, nested under [a2a] in TOML.

Controls the Agent-to-Agent HTTP server that exposes the agent via the A2A protocol. The AgentCard served at /.well-known/agent.json is built from these settings combined with runtime-detected capabilities (images, audio) and the opt-in advertise_files flag.

Fields

enabled: bool

host: String

port: u16

public_url: String

auth_token: Option<String>

Bearer token required on inbound A2A requests. None disables auth.

Security

Intentionally not redacted in Serialize: unlike the channel tokens above, the --init wizard writes the raw value straight into config.toml (there is no vault indirection for this field yet), so a redacting Serialize would corrupt the persisted config on the next --init/save round-trip. The redacting Debug impl on this struct is the approved representation for any log/dump/status output — never emit this field’s value via Serialize or any other non-Debug representation.

rate_limit: u32

max_body_size: usize

drain_timeout_ms: u64

require_auth: bool

When true, all requests are rejected with 401 if no auth_token is configured. Default false for backward compatibility — existing deployments without a token continue to operate. Set to true in production when authentication is mandatory.

ibct_keys: Vec<IbctKeyConfig>

IBCT signing keys for per-task delegation scoping.

When non-empty, all requests to /a2a and /a2a/stream must include a valid X-Zeph-IBCT header signed with one of these keys, scoped to this server’s own advertised endpoint (AgentCard::url, i.e. public_url above) and to the request’s task_id (params.id for tasks/get/tasks/cancel, params.message.taskId for message/send/message/stream — the empty-string sentinel for a brand-new task with no server-assigned ID yet). A missing/undecodable header is rejected with 401; a present-but-invalid one (bad signature, expired, unknown key, or scope mismatch) with 403. Multiple keys allow key rotation without downtime — see IbctKeyConfig. Enforced by zeph_a2a::server::router::ibct_middleware, wired via A2aServer::with_ibct_keys.

Before enabling in production: as of #6260, no caller in this repository attaches X-Zeph-IBCT yet (the --connect remote-TUI client does not opt in, and no A2A delegation client exists). Setting this to a non-empty list will 401 --connect and any standard A2A peer, without protecting a delegated-subagent flow that doesn’t yet exist — see specs/010-security/spec.md’s IBCT “Deployment status” note.

ibct_signing_key_vault_ref: Option<String>

Vault key name to resolve the primary IBCT signing key at startup (MF-3 fix).

When set, the vault key is resolved at startup and used to construct an IbctKey with key_id = "primary". Takes precedence over ibct_keys[0] if both are set. Example: "ZEPH_A2A_IBCT_KEY".

ibct_ttl_secs: u64

TTL (seconds) for issued IBCT tokens. Default: 300 (5 minutes).

advertise_files: bool

Advertise non-media file attachment capability on the AgentCard.

When true, the served /.well-known/agent.json sets capabilities.files = true, signalling to peer agents that this agent can receive Part::File entries that are not image or audio (e.g., documents, archives).

Default false because generic file attachments have no built-in ingestion path in the current agent loop. Set to true only when the deployed agent has skills or MCP tools that can consume file parts; otherwise the card would advertise a capability the agent silently drops.

Note: images and audio capability flags are auto-detected from the active LLM provider and STT configuration — no manual override is needed for those.

request_timeout_ms: u64

Request processing timeout in milliseconds.

Applies to both message/send and tasks/stream handlers. On timeout the task is set to Failed and the HTTP connection is closed. Defaults to 300 000 ms (5 minutes).

task_ttl_secs: u64

TTL (seconds) for completed, failed, canceled, or rejected tasks in the in-memory store.

Tasks that have reached a terminal state and whose age exceeds this value are evicted from memory by a background loop running every 60 seconds. Non-terminal tasks (submitted, working) are never evicted. Default: 3600 (1 hour).

Set to 0 to disable eviction entirely. In that case the task store grows without bound and the operator is responsible for managing memory (e.g., via process restart).

Trait Implementations

impl Debug for A2aServerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for A2aServerConfig

fn default() -> A2aServerConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for A2aServerConfig

fn deserialize<__D>( __deserializer: __D, ) -> Result<A2aServerConfig, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for A2aServerConfig

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.