diff --git a/frontend/src/a2a.js b/frontend/src/a2a.js
index 498212a..abe8851 100644
--- a/frontend/src/a2a.js
+++ b/frontend/src/a2a.js
@@ -1,12 +1,21 @@
 export const CONFIG_URL = import.meta.env.DEV ? "/config.json" : "./config.json";
+export const MAX_UPLOAD_BYTES = 64_000;
+export const ACCEPTED_TYPES = ["text/csv", "text/plain", "application/json"];
 
 export async function requestJson(url, init = {}) {
   const response = await fetch(url, { credentials: "same-origin", ...init });
   const text = await response.text();
-  const data = text ? JSON.parse(text) : null;
+  let data = null;
+  try {
+    data = text ? JSON.parse(text) : null;
+  } catch {
+    data = { message: text };
+  }
   if (!response.ok) {
-    const detail = data && (data.detail || data.message);
-    throw new Error(detail || `request failed: ${response.status}`);
+    const detail = data && (data.detail || data.message || data.error);
+    const error = new Error(detail || `request failed: ${response.status}`);
+    error.status = response.status;
+    throw error;
   }
   return data;
 }
@@ -20,66 +29,45 @@ export async function loadSession(config) {
 }
 
 export function signInUrl(config) {
-  // Always prefer authorizeUrl. The dashboard's login cookie is host-locked to
-  // the dashboard's own origin, so sending the browser straight to loginUrl
-  // signs the user in *there* and bounces back here still signed out.
-  // authorizeUrl hands this origin a code it trades for its own session.
   const target = config.auth?.authorizeUrl || config.auth?.loginUrl;
   if (!target) return null;
-  const next = encodeURIComponent(
-    window.location.pathname + window.location.search + window.location.hash,
-  );
+  const next = encodeURIComponent(window.location.pathname + window.location.search + window.location.hash);
   return `${target}${target.includes("?") ? "&" : "?"}next=${next}`;
 }
 
-export async function requireSession(config) {
-  const session = await loadSession(config);
-  if (!session?.authenticated) {
-    const target = signInUrl(config);
-    if (target) window.location.assign(target);
-    throw new Error("sign in required");
-  }
-  return session;
-}
-
 export async function callSkill(config, skillName, args) {
-  if (config.auth?.invokeRequiresSession) {
-    await requireSession(config);
-  }
-  return requestJson(
-    `${config.endpoints.invoke}/${encodeURIComponent(skillName)}`,
-    {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ arguments: args }),
-    },
-  );
+  return requestJson(`${config.endpoints.invoke}/${encodeURIComponent(skillName)}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ arguments: args }),
+  });
 }
 
-export function sampleValue(schema) {
-  if (!schema || typeof schema !== "object") return null;
-  if ("default" in schema) return schema.default;
-  if ("const" in schema) return schema.const;
-  if (Array.isArray(schema.enum) && schema.enum.length) return schema.enum[0];
-  const type = Array.isArray(schema.type)
-    ? schema.type.find((item) => item !== "null") || schema.type[0]
-    : schema.type;
-  if (type === "array") return [];
-  if (type === "boolean") return false;
-  if (type === "integer" || type === "number") return 0;
-  if (type === "string") return "";
-  const props = schema.properties || {};
-  if (type === "object" || Object.keys(props).length) {
-    const required = Array.isArray(schema.required) ? schema.required : Object.keys(props);
-    return Object.fromEntries(
-      required.map((key) => [key, sampleValue(props[key])]),
-    );
+export async function fileToBrowserDocument(file) {
+  if (!ACCEPTED_TYPES.includes(file.type || "text/plain")) {
+    throw new Error(`${file.name} must be CSV, JSON, or plain text.`);
   }
-  return null;
+  if (file.size > MAX_UPLOAD_BYTES) {
+    throw new Error(`${file.name} exceeds ${MAX_UPLOAD_BYTES} bytes.`);
+  }
+  const buffer = await file.arrayBuffer();
+  let binary = "";
+  const bytes = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.byteLength; i += 1) binary += String.fromCharCode(bytes[i]);
+  return {
+    filename: file.name,
+    media_type: file.type || "text/plain",
+    data_base64: window.btoa(binary),
+  };
 }
 
-export function sampleArgs(skill) {
-  const schema = skill?.input_schema || skill?.inputSchema || {};
-  const value = sampleValue(schema);
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+export function successFixture() {
+  return {
+    comparison_id: "studio-quote-v1",
+    quotes: [
+      { vendor: "Acme Bearings", unit_price: 10.75, quantity: 500, delivery_days: 12, warranty_months: 12 },
+      { vendor: "Beta Industrial", unit_price: 9.1, quantity: 500, delivery_days: 8, warranty_months: 18 },
+    ],
+    weights: { price: 50, delivery: 30, warranty: 20 },
+  };
 }