@adonis-agora/agent 0.60.1 → 0.62.0

package/dist/providers/mcp_provider.js

@@ -4,7 +4,8 @@ import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { DefaultToolAuthorizer } from '../src/authorizer.js';
 import { actorFromAuthInfo } from '../src/mcp/actor.js';
 import { McpAuthError, resolveMcpAuth } from '../src/mcp/auth.js';
-import { normalizeMcpPath, protectedResourceMetadata, protectedResourceMetadataUrl, publicOrigin, wwwAuthenticateChallenge, } from '../src/mcp/discovery.js';
+import { mcpResourceUrl, normalizeMcpPath, protectedResourceMetadata, protectedResourceMetadataUrl, publicOrigin, wwwAuthenticateChallenge, } from '../src/mcp/discovery.js';
+import { registerOAuthResource } from '../src/mcp/oauth-resource.js';
 import { createMcpServer } from '../src/mcp/server.js';
 import { ToolRegistry } from '../src/tool-registry.js';
 /**
@@ -15,6 +16,9 @@ import { ToolRegistry } from '../src/tool-registry.js';
  * - `GET /.well-known/oauth-protected-resource{path}` — RFC 9728 protected-resource metadata, mounted
  *   only when `auth.oauth` is set, so MCP clients can discover how to authenticate.
  *
+ * …once for the top-level config and once per entry of `endpoints`: each is a protected resource of
+ * its own, with its registry, auth, sessions and metadata.
+ *
  * A refused request answers `401` (or `403` for an {@link McpAuthError} with that status) with a
  * `WWW-Authenticate: Bearer …` challenge; with OAuth it carries `resource_metadata`, which is what makes
  * an MCP client discover the authorization server and open the login. URLs are built from
@@ -27,10 +31,8 @@ import { ToolRegistry } from '../src/tool-registry.js';
  */
 export default class McpProvider {
     app;
-    /** Live session transports, keyed by MCP session id (per-provider in-memory state). */
-    #transports = new Map();
-    /** The mounted route prefix, normalized (no leading/trailing slashes). */
-    #path = 'mcp';
+    /** Every mounted endpoint — the top-level one first. */
+    #endpoints = [];
     /** `config.publicUrl` reduced to its origin; `undefined` → derive it from each request. */
     #publicOrigin;
     constructor(app) {
@@ -38,37 +40,85 @@ export default class McpProvider {
     }
     async boot() {
         const config = this.app.config.get('mcp', {});
-        const registry = await this.app.container.make(ToolRegistry);
         const defaultRoles = config.defaultRoles ?? ['ADMIN'];
         const authorizer = config.authorizer ??
             new DefaultToolAuthorizer(defaultRoles, { emptyRoles: config.emptyRoles ?? 'allow' });
-        const auth = config.auth !== undefined ? await resolveMcpAuth(config.auth, { app: this.app }) : undefined;
+        const ctx = { app: this.app };
+        const auth = config.auth !== undefined ? await resolveMcpAuth(config.auth, ctx) : undefined;
         this.#publicOrigin =
             config.publicUrl !== undefined ? publicOrigin(config.publicUrl) : undefined;
-        // The actor fallback for open/dev mode (no `auth`): a fixed identity, or fail-closed (reject).
-        const openActor = config.actor;
-        const router = await this.app.container.make('router');
-        const path = normalizeMcpPath(config.path);
-        this.#path = path;
-        const route = `/${path}`;
-        router.post(route, (ctx) => this.#handlePost(ctx, config, registry, authorizer, auth, openActor));
-        router.get(route, (ctx) => this.#handleGet(ctx, auth, openActor));
-        router.delete(route, (ctx) => this.#handleDelete(ctx, auth, openActor));
-        if (auth?.oauth) {
-            const oauth = auth.oauth;
-            const metadataPath = `/.well-known/oauth-protected-resource/${path}`;
-            router.get(metadataPath, async (ctx) => {
-                // `oauth` may be lazy (authkit needs a fully booted app to resolve) — resolve it on request.
-                const meta = typeof oauth === 'function' ? await oauth() : oauth;
-                // Public and user-free; MCP clients running in a browser fetch it cross-origin.
-                ctx.response.header('access-control-allow-origin', '*');
-                return ctx.response.json(protectedResourceMetadata(meta, this.#origin(ctx), path));
+        const base = {
+            path: normalizeMcpPath(config.path),
+            name: config.name,
+            version: config.version,
+            ...(config.instructions !== undefined ? { instructions: config.instructions } : {}),
+            registry: await this.app.container.make(ToolRegistry),
+            authorizer,
+            auth,
+            // The actor fallback for open/dev mode (no `auth`): a fixed identity, or fail-closed (reject).
+            openActor: config.actor,
+            ...(config.allowedTools !== undefined ? { allowedTools: config.allowedTools } : {}),
+            ...(config.actions !== undefined ? { actions: config.actions } : {}),
+            ...(config.describeTool !== undefined ? { describeTool: config.describeTool } : {}),
+            stateless: config.stateless === true,
+            metadataRouteName: 'mcp.oauth_protected_resource',
+            transports: new Map(),
+        };
+        this.#endpoints.push(base);
+        for (const extra of config.endpoints ?? []) {
+            const path = normalizeMcpPath(extra.path);
+            this.#endpoints.push({
+                ...base,
+                path,
+                name: extra.name ?? base.name,
+                ...(extra.instructions !== undefined ? { instructions: extra.instructions } : {}),
+                registry: extra.registry ? await extra.registry(ctx) : base.registry,
+                auth: extra.auth !== undefined ? await resolveMcpAuth(extra.auth, ctx) : base.auth,
+                ...(extra.allowedTools !== undefined ? { allowedTools: extra.allowedTools } : {}),
+                ...(extra.actions !== undefined ? { actions: extra.actions } : {}),
+                ...(extra.describeTool !== undefined ? { describeTool: extra.describeTool } : {}),
+                metadataRouteName: extra.metadataRouteName ?? `mcp.${path.split('/').join('.')}.oauth_protected_resource`,
+                transports: new Map(),
             });
         }
+        const router = await this.app.container.make('router');
+        const middleware = config.middleware ?? [];
+        for (const endpoint of this.#endpoints) {
+            const route = `/${endpoint.path}`;
+            const routes = [
+                router.post(route, (c) => this.#handlePost(c, endpoint)),
+                router.get(route, (c) => endpoint.stateless ? this.#methodNotAllowed(c, endpoint) : this.#handleGet(c, endpoint)),
+                router.delete(route, (c) => endpoint.stateless
+                    ? this.#methodNotAllowed(c, endpoint)
+                    : this.#handleDelete(c, endpoint)),
+            ];
+            if (middleware.length > 0)
+                for (const r of routes)
+                    r.use(middleware);
+            const oauth = endpoint.auth?.oauth;
+            if (oauth) {
+                // Announce this server to the authorization server in the same process (authkit's `mcp`):
+                // tokens it issues for this URL are then bound to it, with no URL repeated in its config.
+                registerOAuthResource(this.#publicOrigin !== undefined
+                    ? { url: mcpResourceUrl(this.#publicOrigin, endpoint.path) }
+                    : { path: `/${endpoint.path}` });
+                router
+                    .get(`/.well-known/oauth-protected-resource/${endpoint.path}`, async (c) => {
+                    // `oauth` may be lazy (authkit needs a fully booted app to resolve) — resolve it on request.
+                    const meta = typeof oauth === 'function' ? await oauth() : oauth;
+                    // Public and user-free; MCP clients running in a browser fetch it cross-origin.
+                    c.response.header('access-control-allow-origin', '*');
+                    return c.response.json(protectedResourceMetadata(meta, this.#origin(c), endpoint.path));
+                })
+                    .as(endpoint.metadataRouteName);
+            }
+        }
     }
     async shutdown() {
-        await Promise.all([...this.#transports.values()].map((transport) => transport.close()));
-        this.#transports.clear();
+        const transports = this.#endpoints.flatMap((endpoint) => [...endpoint.transports.values()]);
+        await Promise.all(transports.map((transport) => transport.close()));
+        for (const endpoint of this.#endpoints)
+            endpoint.transports.clear();
     }
     // ── auth helpers ──────────────────────────────────────────────────────────
     /** The public origin: `config.publicUrl` when set, else the request's own protocol and `Host`. */
@@ -79,17 +129,17 @@ export default class McpProvider {
     /**
      * Refuse the request with `status` and the RFC 6750 / RFC 9728 challenge. `hadToken` picks the error
      * code (no token → none, per RFC 6750 §3.1); `resource_metadata` is added when the auth exposes OAuth.
-     * `auth` is `undefined` on the fail-closed open-mode path, which still gets a bare `Bearer` challenge.
+     * With no auth (the fail-closed open-mode path) it is still a bare `Bearer` challenge.
      */
-    #refuse(ctx, auth, status, message, hadToken) {
+    #refuse(ctx, endpoint, status, message, hadToken) {
         const challenge = wwwAuthenticateChallenge({
             ...(status === 403
                 ? { error: 'insufficient_scope' }
                 : hadToken
                     ? { error: 'invalid_token' }
                     : {}),
-            ...(auth?.oauth !== undefined
-                ? { resourceMetadataUrl: protectedResourceMetadataUrl(this.#origin(ctx), this.#path) }
+            ...(endpoint.auth?.oauth !== undefined
+                ? { resourceMetadataUrl: protectedResourceMetadataUrl(this.#origin(ctx), endpoint.path) }
                 : {}),
         });
         ctx.response.header('WWW-Authenticate', challenge);
@@ -97,46 +147,74 @@ export default class McpProvider {
         return null;
     }
     /**
-     * Verify the request's `Authorization: Bearer` token against the configured auth, or fall back to the
-     * open-mode `actor`. Returns the `AuthInfo` to attach to the transport, or `null` once it has replied
-     * 401/403.
+     * Verify the request's `Authorization: Bearer` token against the endpoint's auth, or fall back to
+     * the open-mode `actor`. Returns the `AuthInfo` to attach to the transport, or `null` once it has
+     * replied 401/403.
      */
-    async #authenticate(ctx, auth, openActor) {
+    async #authenticate(ctx, endpoint) {
         const header = ctx.request.header('authorization');
         const token = /^Bearer\s/i.test(header ?? '') ? header?.slice(7).trim() : undefined;
+        const auth = endpoint.auth;
         if (auth !== undefined) {
             if (!token) {
-                return this.#refuse(ctx, auth, 401, 'missing bearer token', false);
+                return this.#refuse(ctx, endpoint, 401, 'missing bearer token', false);
             }
             try {
-                return await auth.verify(token);
+                return await auth.verify(token, {
+                    resource: mcpResourceUrl(this.#origin(ctx), endpoint.path),
+                });
             }
             catch (error) {
                 const status = error instanceof McpAuthError ? error.status : 401;
                 const message = error instanceof Error ? error.message : 'unauthorized';
-                return this.#refuse(ctx, auth, status, message, true);
+                return this.#refuse(ctx, endpoint, status, message, true);
             }
         }
-        if (openActor !== undefined) {
-            return { token: '', clientId: '', scopes: [], extra: { actor: openActor } };
+        if (endpoint.openActor !== undefined) {
+            return { token: '', clientId: '', scopes: [], extra: { actor: endpoint.openActor } };
         }
-        return this.#refuse(ctx, undefined, 401, 'unauthorized: no auth configured and no fallback actor', false);
+        return this.#refuse(ctx, endpoint, 401, 'unauthorized: no auth configured and no fallback actor', false);
     }
     // ── route handlers ────────────────────────────────────────────────────────
-    async #handlePost(ctx, config, registry, authorizer, auth, openActor) {
+    #newServer(endpoint) {
+        return createMcpServer({
+            name: endpoint.name,
+            version: endpoint.version,
+            ...(endpoint.instructions !== undefined ? { instructions: endpoint.instructions } : {}),
+            registry: endpoint.registry,
+            policy: endpoint.authorizer,
+            ...(endpoint.allowedTools !== undefined ? { allowedTools: endpoint.allowedTools } : {}),
+            ...(endpoint.actions !== undefined ? { actions: endpoint.actions } : {}),
+            ...(endpoint.describeTool !== undefined ? { describeTool: endpoint.describeTool } : {}),
+            actorFromAuth: actorFromAuthInfo,
+        });
+    }
+    async #handlePost(ctx, endpoint) {
         const req = ctx.request.request;
         const res = ctx.response.response;
         const body = ctx.request.all();
         const sessionId = ctx.request.header('mcp-session-id');
-        const authInfo = await this.#authenticate(ctx, auth, openActor);
+        const authInfo = await this.#authenticate(ctx, endpoint);
         if (authInfo === null)
             return;
         req.auth = authInfo;
         try {
             let transport;
-            if (sessionId && this.#transports.has(sessionId)) {
+            if (endpoint.stateless) {
+                // No session: this request gets its own transport and server, closed once answered — and a
+                // plain JSON answer, since there is no stream to keep open.
+                const stateless = new StreamableHTTPServerTransport({ enableJsonResponse: true });
+                const server = this.#newServer(endpoint);
+                res.on('close', () => {
+                    void stateless.close();
+                    void server.close();
+                });
+                await server.connect(stateless);
+                await stateless.handleRequest(req, res, body);
+            }
+            else if (sessionId && endpoint.transports.has(sessionId)) {
                 // Session resume — reuse the existing transport (already connected to its own server).
-                transport = this.#transports.get(sessionId);
+                transport = endpoint.transports.get(sessionId);
                 await transport.handleRequest(req, res, body);
             }
             else if (!sessionId && isInitializeRequest(body)) {
@@ -145,23 +223,16 @@ export default class McpProvider {
                     sessionIdGenerator: () => randomUUID(),
                     onsessioninitialized: (sid) => {
                         if (transport)
-                            this.#transports.set(sid, transport);
+                            endpoint.transports.set(sid, transport);
                     },
                 });
                 transport.onclose = () => {
                     const sid = transport?.sessionId;
-                    if (sid && this.#transports.get(sid) === transport) {
-                        this.#transports.delete(sid);
+                    if (sid && endpoint.transports.get(sid) === transport) {
+                        endpoint.transports.delete(sid);
                     }
                 };
-                const server = createMcpServer({
-                    name: config.name,
-                    version: config.version,
-                    registry,
-                    policy: authorizer,
-                    ...(config.allowedTools !== undefined ? { allowedTools: config.allowedTools } : {}),
-                    actorFromAuth: actorFromAuthInfo,
-                });
+                const server = this.#newServer(endpoint);
                 await server.connect(transport);
                 await transport.handleRequest(req, res, body);
             }
@@ -191,15 +262,15 @@ export default class McpProvider {
         }
         await this.#awaitFinish(res);
     }
-    async #handleGet(ctx, auth, openActor) {
+    async #handleGet(ctx, endpoint) {
         const req = ctx.request.request;
         const res = ctx.response.response;
         const sessionId = ctx.request.header('mcp-session-id');
-        const authInfo = await this.#authenticate(ctx, auth, openActor);
+        const authInfo = await this.#authenticate(ctx, endpoint);
         if (authInfo === null)
             return;
         req.auth = authInfo;
-        const transport = sessionId ? this.#transports.get(sessionId) : undefined;
+        const transport = sessionId ? endpoint.transports.get(sessionId) : undefined;
         if (transport === undefined) {
             res.statusCode = 400;
             res.end('Invalid or missing session ID');
@@ -209,15 +280,15 @@ export default class McpProvider {
         await transport.handleRequest(req, res);
         await this.#awaitFinish(res);
     }
-    async #handleDelete(ctx, auth, openActor) {
+    async #handleDelete(ctx, endpoint) {
         const req = ctx.request.request;
         const res = ctx.response.response;
         const sessionId = ctx.request.header('mcp-session-id');
-        const authInfo = await this.#authenticate(ctx, auth, openActor);
+        const authInfo = await this.#authenticate(ctx, endpoint);
         if (authInfo === null)
             return;
         req.auth = authInfo;
-        const transport = sessionId ? this.#transports.get(sessionId) : undefined;
+        const transport = sessionId ? endpoint.transports.get(sessionId) : undefined;
         if (transport === undefined) {
             res.statusCode = 400;
             res.end('Invalid or missing session ID');
@@ -227,6 +298,20 @@ export default class McpProvider {
         await transport.handleRequest(req, res);
         await this.#awaitFinish(res);
     }
+    /**
+     * Stateless mode has no SSE stream to open and no session to close (MCP Streamable HTTP §2.2).
+     * Authenticated first: an unauthenticated caller gets the 401 that starts its login, not a 405.
+     */
+    async #methodNotAllowed(ctx, endpoint) {
+        if ((await this.#authenticate(ctx, endpoint)) === null)
+            return;
+        ctx.response.header('allow', 'POST');
+        return ctx.response.status(405).json({
+            jsonrpc: '2.0',
+            error: { code: -32000, message: 'Method not allowed: this MCP server is stateless.' },
+            id: null,
+        });
+    }
     /** Resolve only when the raw response is finished so Adonis doesn't try to handle the response again. */
     #awaitFinish(res) {
         return new Promise((resolve) => {

package/dist/providers/mcp_provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp_provider.js","sourceRoot":"","sources":["../../providers/mcp_provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,OAAO,OAAO,WAAW;IAQR,GAAG;IAPzB,uFAAuF;IAC9E,WAAW,GAAG,IAAI,GAAG,EAAyC,CAAC;IACxE,0EAA0E;IAC1E,KAAK,GAAG,KAAK,CAAC;IACd,2FAA2F;IAC3F,aAAa,CAAqB;IAElC,YAAsB,GAAuB;mBAAvB,GAAG;IAAuB,CAAC;IAEjD,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAY,KAAK,EAAE,EAAe,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GACd,MAAM,CAAC,UAAU;YACjB,IAAI,qBAAqB,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,CAAC,aAAa;YAChB,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9E,+FAA+F;QAC/F,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAElB,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAgB,EAAE,EAAE,CACtC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CACrE,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAErF,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,MAAM,YAAY,GAAG,yCAAyC,IAAI,EAAE,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;gBAClD,6FAA6F;gBAC7F,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACjE,gFAAgF;gBAChF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;gBACxD,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACrF,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E,kGAAkG;IAClG,OAAO,CAAC,GAAgB;QACtB,OAAO,CACL,IAAI,CAAC,aAAa;YAClB,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,WAAW,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CACL,GAAgB,EAChB,IAAyB,EACzB,MAAiB,EACjB,OAAe,EACf,QAAiB;QAEjB,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,EAAE,KAAK,EAAE,oBAA6B,EAAE;gBAC1C,CAAC,CAAC,QAAQ;oBACR,CAAC,CAAC,EAAE,KAAK,EAAE,eAAwB,EAAE;oBACrC,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS;gBAC3B,CAAC,CAAC,EAAE,mBAAmB,EAAE,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;gBACtF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,GAAgB,EAChB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;gBAClE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;gBACxE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CACjB,GAAG,EACH,SAAS,EACT,GAAG,EACH,wDAAwD,EACxD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,WAAW,CACf,GAAgB,EAChB,MAAiB,EACjB,QAAsB,EACtB,UAAuB,EACvB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,IAAI,CAAC;YACH,IAAI,SAAoD,CAAC;YACzD,IAAI,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,uFAAuF;gBACvF,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;gBAC7C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,8FAA8F;gBAC9F,SAAS,GAAG,IAAI,6BAA6B,CAAC;oBAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;oBACtC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;wBAC5B,IAAI,SAAS;4BAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACtD,CAAC;iBACF,CAAC,CAAC;gBACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;oBACvB,MAAM,GAAG,GAAG,SAAS,EAAE,SAAS,CAAC;oBACjC,IAAI,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;wBACnD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC,CAAC;gBACF,MAAM,MAAM,GAAG,eAAe,CAAC;oBAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ;oBACR,MAAM,EAAE,UAAU;oBAClB,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnF,aAAa,EAAE,iBAAiB;iBACjC,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAsB,CAAC,CAAC;gBAC7C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE;oBACpE,EAAE,EAAE,IAAI;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;qBACnE;oBACD,EAAE,EAAE,IAAI;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAgB,EAChB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,GAAgB,EAChB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,yGAAyG;IACzG,YAAY,CAAC,GAAmB;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"mcp_provider.js","sourceRoot":"","sources":["../../providers/mcp_provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,OAAO,OAAO,WAAW;IAMR,GAAG;IALzB,wDAAwD;IAC/C,UAAU,GAAe,EAAE,CAAC;IACrC,2FAA2F;IAC3F,aAAa,CAAqB;IAElC,YAAsB,GAAuB;mBAAvB,GAAG;IAAuB,CAAC;IAEjD,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAY,KAAK,EAAE,EAAe,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GACd,MAAM,CAAC,UAAU;YACjB,IAAI,qBAAqB,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,IAAI,CAAC,aAAa;YAChB,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9E,MAAM,IAAI,GAAa;YACrB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC;YACrD,UAAU;YACV,IAAI;YACJ,+FAA+F;YAC/F,SAAS,EAAE,MAAM,CAAC,KAAK;YACvB,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI;YACpC,iBAAiB,EAAE,8BAA8B;YACjD,UAAU,EAAE,IAAI,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBACnB,GAAG,IAAI;gBACP,IAAI;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;gBAC7B,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;gBACpE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;gBAClF,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,iBAAiB,EACf,KAAK,CAAC,iBAAiB,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B;gBACxF,UAAU,EAAE,IAAI,GAAG,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG;gBACb,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAc,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACrE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAc,EAAE,EAAE,CACnC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CACxF;gBACD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAc,EAAE,EAAE,CACtC,QAAQ,CAAC,SAAS;oBAChB,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC;oBACrC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CACpC;aACF,CAAC;YACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,MAAM,CAAC,IAAI,MAAM;oBAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAErE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;YACnC,IAAI,KAAK,EAAE,CAAC;gBACV,0FAA0F;gBAC1F,0FAA0F;gBAC1F,qBAAqB,CACnB,IAAI,CAAC,aAAa,KAAK,SAAS;oBAC9B,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;oBAC5D,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAClC,CAAC;gBACF,MAAM;qBACH,GAAG,CAAC,yCAAyC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAc,EAAE,EAAE;oBACtF,6FAA6F;oBAC7F,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;oBACjE,gFAAgF;oBAChF,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;oBACtD,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1F,CAAC,CAAC;qBACD,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5F,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU;YAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACtE,CAAC;IAED,6EAA6E;IAE7E,kGAAkG;IAClG,OAAO,CAAC,GAAgB;QACtB,OAAO,CACL,IAAI,CAAC,aAAa;YAClB,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,WAAW,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CACL,GAAgB,EAChB,QAAkB,EAClB,MAAiB,EACjB,OAAe,EACf,QAAiB;QAEjB,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,EAAE,KAAK,EAAE,oBAA6B,EAAE;gBAC1C,CAAC,CAAC,QAAQ;oBACR,CAAC,CAAC,EAAE,KAAK,EAAE,eAAwB,EAAE;oBACrC,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,mBAAmB,EAAE,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;gBACzF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,GAAgB,EAAE,QAAkB;QACtD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC9B,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC;iBAC3D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;gBAClE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;gBACxE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CACjB,GAAG,EACH,QAAQ,EACR,GAAG,EACH,wDAAwD,EACxD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,UAAU,CAAC,QAAkB;QAC3B,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,UAAU;YAC3B,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAgB,EAAE,QAAkB;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,IAAI,CAAC;YACH,IAAI,SAAoD,CAAC;YACzD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACvB,2FAA2F;gBAC3F,4DAA4D;gBAC5D,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClF,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;oBACvB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,CAAC,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAsB,CAAC,CAAC;gBAC7C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,uFAAuF;gBACvF,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;gBAChD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,8FAA8F;gBAC9F,SAAS,GAAG,IAAI,6BAA6B,CAAC;oBAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;oBACtC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;wBAC5B,IAAI,SAAS;4BAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACzD,CAAC;iBACF,CAAC,CAAC;gBACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;oBACvB,MAAM,GAAG,GAAG,SAAS,EAAE,SAAS,CAAC;oBACjC,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;wBACtD,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAClC,CAAC;gBACH,CAAC,CAAC;gBACF,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAsB,CAAC,CAAC;gBAC7C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE;oBACpE,EAAE,EAAE,IAAI;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;qBACnE;oBACD,EAAE,EAAE,IAAI;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAgB,EAAE,QAAkB;QACnD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAgB,EAAE,QAAkB;QACtD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAgB,EAAE,QAAkB;QAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO;QAC/D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,mDAAmD,EAAE;YACrF,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;IACL,CAAC;IAED,yGAAyG;IACzG,YAAY,CAAC,GAAmB;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/src/a2a/auth.d.ts

@@ -0,0 +1,67 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { ApplicationService } from '@adonisjs/core/types';
+/**
+ * Who is calling an A2A endpoint: a personal agent (identified by its `issuer`) speaking for one of
+ * ITS users (`sub`, opaque) — and, when the user delegated, the account here it may act on.
+ */
+export interface A2aCaller {
+    /** The personal agent's issuer — stable, and its OAuth `client_id`. */
+    issuer: string;
+    /** The personal agent's user. NOT an account here. */
+    sub: string;
+    /** Display name of the personal agent. */
+    name: string;
+    /** Present when the request carried a valid delegation token. */
+    delegation: {
+        accountId: string;
+        scopes: string[];
+        grantId: string;
+    } | null;
+}
+/** What a receipt records about a turn served under delegation. */
+export interface A2aReceiptInput {
+    scopesUsed: string[];
+    actions: {
+        tool: string;
+        argsHash?: string;
+    }[];
+}
+/**
+ * How the A2A surface authenticates callers and speaks the delegation half of the protocol. The
+ * built-in driver is {@link authKitPersonalAgents} (`@adonis-agora/authkit-server`); anything
+ * implementing this works.
+ */
+export interface A2aAuth {
+    /**
+     * Verify the request. On failure, write the response (a bare `401` with the challenge) and return
+     * `null`. Called BEFORE the body is read.
+     */
+    authenticate(ctx: HttpContext): Promise<A2aCaller | null>;
+    /** The `securitySchemes` + `securityRequirements` of the Agent Card served at `interfaceUrl`. */
+    cardSecurity(ctx: HttpContext, interfaceUrl: string): Promise<Record<string, unknown>>;
+    /**
+     * The metadata of a step-up task asking the user for `missingScopes` (PACT §5.5), or `null` when
+     * this deployment has no delegation to step up into.
+     */
+    stepUp(ctx: HttpContext, missingScopes: string[]): Promise<Record<string, unknown> | null>;
+    /** The metadata carrying a signed receipt for a reply served under delegation (PACT §5.6). */
+    receipt(ctx: HttpContext, input: A2aReceiptInput): Promise<Record<string, unknown>>;
+    /** Scopes a user can delegate, `id → description` — what the agent may ask for. Empty = none. */
+    delegableScopes(): Promise<Record<string, string>>;
+}
+/** Runtime context an {@link A2aAuthFactory} gets at boot. */
+export interface A2aAuthContext {
+    app: ApplicationService;
+}
+export type A2aAuthFactory = (ctx: A2aAuthContext) => A2aAuth | Promise<A2aAuth>;
+export declare function resolveA2aAuth(auth: A2aAuth | A2aAuthFactory, ctx: A2aAuthContext): Promise<A2aAuth>;
+/**
+ * Requires `@adonis-agora/authkit-server` 0.76 or later (its personal agents). Loaded lazily, like
+ * the MCP `authKitAuth` driver, so it is not a declared peer.
+ *
+ * Authenticate A2A callers with AuthKit's personal agents (`personalAgents` in `config/authkit.ts`):
+ * the agent's signed JWT, the delegation token beside it, the Agent Card security block, step-up
+ * links and signed receipts — all from `@adonis-agora/authkit-server`, loaded lazily.
+ */
+export declare function authKitPersonalAgents(): A2aAuthFactory;
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/a2a/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/a2a/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,UAAU,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC7E;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB;;;OAGG;IACH,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1D,iGAAiG;IACjG,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvF;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3F,8FAA8F;IAC9F,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpF,iGAAiG;IACjG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,kBAAkB,CAAC;CACzB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjF,wBAAsB,cAAc,CAClC,IAAI,EAAE,OAAO,GAAG,cAAc,EAC9B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB;AAyBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CAoCtD"}

package/dist/src/a2a/auth.js

@@ -0,0 +1,47 @@
+export async function resolveA2aAuth(auth, ctx) {
+    return typeof auth === 'function' ? auth(ctx) : auth;
+}
+/**
+ * Requires `@adonis-agora/authkit-server` 0.76 or later (its personal agents). Loaded lazily, like
+ * the MCP `authKitAuth` driver, so it is not a declared peer.
+ *
+ * Authenticate A2A callers with AuthKit's personal agents (`personalAgents` in `config/authkit.ts`):
+ * the agent's signed JWT, the delegation token beside it, the Agent Card security block, step-up
+ * links and signed receipts — all from `@adonis-agora/authkit-server`, loaded lazily.
+ */
+export function authKitPersonalAgents() {
+    return async ({ app }) => {
+        const authkit = (await import('@adonis-agora/authkit-server'));
+        const middleware = authkit.personalAgentAuth();
+        const delegableScopes = async () => {
+            const service = (await app.container.make('authkit.server'));
+            return { ...(service.config.personalAgents?.delegation?.scopes ?? {}) };
+        };
+        return {
+            async authenticate(ctx) {
+                let passed = false;
+                await middleware(ctx, async () => {
+                    passed = true;
+                });
+                const caller = passed ? authkit.personalAgentOf(ctx) : null;
+                return caller
+                    ? {
+                        issuer: caller.issuer,
+                        sub: caller.sub,
+                        name: caller.name,
+                        delegation: caller.delegation,
+                    }
+                    : null;
+            },
+            cardSecurity: (ctx, interfaceUrl) => authkit.personalAgentSecurity(ctx, { interfaceUrl }),
+            async stepUp(ctx, missingScopes) {
+                if (Object.keys(await delegableScopes()).length === 0)
+                    return null;
+                return authkit.personalAgentStepUp(ctx, missingScopes);
+            },
+            receipt: (ctx, input) => authkit.personalAgentReceipt(ctx, input),
+            delegableScopes,
+        };
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/a2a/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/a2a/auth.ts"],"names":[],"mappings":"AAuDA,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA8B,EAC9B,GAAmB;IAEnB,OAAO,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAyBD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAC3B,8BAAwC,CACzC,CAAgC,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC/C,MAAM,eAAe,GAAG,KAAK,IAAqC,EAAE;YAClE,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAyB,CAAC,CAAuB,CAAC;YAC5F,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,CAAC,CAAC;QAEF,OAAO;YACL,KAAK,CAAC,YAAY,CAAC,GAAG;gBACpB,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;oBAC/B,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5D,OAAO,MAAM;oBACX,CAAC,CAAC;wBACE,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC9B;oBACH,CAAC,CAAC,IAAI,CAAC;YACX,CAAC;YACD,YAAY,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC;YACzF,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa;gBAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACnE,OAAO,OAAO,CAAC,mBAAmB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC;YACjE,eAAe;SAChB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/a2a/define_config.d.ts

@@ -0,0 +1,74 @@
+import type { ApplicationService } from '@adonisjs/core/types';
+import type { Actor } from '../types.js';
+import type { A2aAuth, A2aAuthFactory, A2aCaller } from './auth.js';
+import type { A2aCardInput } from './handler.js';
+import type { A2aStore } from './store.js';
+import type { A2aActionPolicy, A2aTurnService } from './turn.js';
+/** One agent exposed over A2A, keyed by its public id (the `{brand}` in `/a2a/{brand}`). */
+export interface A2aAgentConfig {
+    /** The registered agent that answers. Default: the key. */
+    agent?: string;
+    /** What the Agent Card says about it. */
+    card: A2aCardInput;
+}
+/**
+ * Shape of `config/a2a.ts`. Exposes registered agents to personal agents over A2A 1.0 (HTTP+JSON),
+ * the transport of PACT (https://openpactprotocol.org):
+ *
+ * ```ts
+ * import { defineA2aConfig, authKitPersonalAgents } from '@adonis-agora/agent/a2a'
+ *
+ * export default defineA2aConfig({
+ *   baseUrl: 'https://acme.com',
+ *   auth: authKitPersonalAgents(),
+ *   agents: {
+ *     support: { card: { name: 'Acme Support', description: 'Orders and returns.' } },
+ *   },
+ * })
+ * ```
+ */
+export interface A2aConfig {
+    /** Mount prefix. Default `'a2a'` → `/a2a/{agent}/…`. */
+    path?: string;
+    /**
+     * Public origin of this app, for the interface URL on each Agent Card. Set it in production — the
+     * fallback (the request's own Host) is whatever the caller sent.
+     */
+    baseUrl?: string;
+    agents: Record<string, A2aAgentConfig>;
+    /** Also serve this agent's card at `/.well-known/agent-card.json` (PACT §2.1). */
+    rootCard?: string;
+    /** How callers authenticate — `authKitPersonalAgents()`, or your own {@link A2aAuth}. */
+    auth: A2aAuth | A2aAuthFactory;
+    /**
+     * Where conversation ownership and `messageId` replies live. Default `'lucid'` (tables created on
+     * first use, `CREATE TABLE IF NOT EXISTS`); `'memory'` for a single process; or your own store.
+     */
+    store?: 'lucid' | 'memory' | A2aStore;
+    /** Lucid connection for the `'lucid'` store. Default: the primary. */
+    connection?: string;
+    /** What happens to `action` calls that park for approval. Default `'approve-delegated'`. */
+    actions?: A2aActionPolicy;
+    /** Give up on a turn after this many ms (`INTERNAL`). Default 120 000. */
+    timeoutMs?: number;
+    /** Largest accepted request body, in bytes. Default 1 MiB. */
+    maxBodyBytes?: number;
+    /**
+     * What runs a turn. Default: the agent provider's `AgentService`. An app with its own runtime
+     * (a `runAgentLoop` built per request) passes an adapter — or a factory resolved on first use.
+     */
+    service?: A2aTurnService | ((ctx: {
+        app: ApplicationService;
+    }) => A2aTurnService | Promise<A2aTurnService>);
+    /** Roles of the actor a turn runs as. Default: `personal_agent` plus the delegated scopes. */
+    roles?: (caller: A2aCaller) => string[];
+    /**
+     * Map the caller to the actor your tools expect — e.g. an app whose actor is a PROFILE, not the
+     * account. Gets the default actor (account id under delegation, `pa:<hash>` without; the roles
+     * above). `personal_agent` is added back whatever this returns.
+     */
+    actor?: (caller: A2aCaller, defaults: Actor) => Actor | Promise<Actor>;
+}
+/** Identity helper giving `config/a2a.ts` full type-checking. */
+export declare function defineA2aConfig(config: A2aConfig): A2aConfig;
+//# sourceMappingURL=define_config.d.ts.map

package/dist/src/a2a/define_config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/a2a/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,IAAI,EAAE,YAAY,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,SAAS;IACxB,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACvC,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,IAAI,EAAE,OAAO,GAAG,cAAc,CAAC;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EACJ,cAAc,GACd,CAAC,CAAC,GAAG,EAAE;QAAE,GAAG,EAAE,kBAAkB,CAAA;KAAE,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACrF,8FAA8F;IAC9F,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,MAAM,EAAE,CAAC;IACxC;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CACxE;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAE5D"}

package/dist/src/a2a/define_config.js

@@ -0,0 +1,5 @@
+/** Identity helper giving `config/a2a.ts` full type-checking. */
+export function defineA2aConfig(config) {
+    return config;
+}
+//# sourceMappingURL=define_config.js.map

package/dist/src/a2a/define_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/a2a/define_config.ts"],"names":[],"mappings":"AA0EA,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/a2a/gate.d.ts

@@ -0,0 +1,23 @@
+import { type ScopeResolver } from '../skills.js';
+import type { RolesPolicy } from '../spi/roles-policy.js';
+/** The role a delegated scope becomes. Namespaced, so a scope can never pose as an app role. */
+export declare const SCOPE_ROLE_PREFIX = "scope:";
+export declare function scopeRole(scope: string): string;
+/**
+ * Wrap a {@link RolesPolicy} so personal agents reach only what was written for them.
+ *
+ * An A2A actor carries {@link PERSONAL_AGENT_ROLE}, plus one {@link scopeRole} per delegated scope.
+ * For it, a tool must DECLARE one of those roles, and the wrapped policy must agree too. A tool with
+ * no `roles` is unreachable: under the default policy "no roles" means "anyone", and an app's
+ * existing tools were never written with an outside caller in mind. Every other actor is decided by
+ * the wrapped policy alone, unchanged.
+ */
+export declare function personalAgentGate(inner: RolesPolicy): RolesPolicy;
+/**
+ * Wrap the {@link ScopeResolver} of memory or skills so a personal agent resolves NO scope. Under
+ * delegation its actor id is the account's — without this it would read the account's memories
+ * (and its tenant's) and could write new ones, a standing instruction to the user's own assistant.
+ * Built-ins like `remember` come from config, not the registry, so the tool gate never sees them.
+ */
+export declare function personalAgentScopes(inner: ScopeResolver | undefined): ScopeResolver;
+//# sourceMappingURL=gate.d.ts.map

package/dist/src/a2a/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../../src/a2a/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAI1D,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,CAwBjE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,GAAG,aAAa,CAKnF"}