@agent-native/core 0.100.2 → 0.101.2

package/corpus/templates/forms/server/routes/api/forms/og/[...slug]/og.png.get.ts

@@ -0,0 +1,184 @@
+import { agentNativeOgImageResponseHeaders } from "@agent-native/core/server";
+import { getSetting } from "@agent-native/core/settings";
+import {
+  defineEventHandler,
+  getMethod,
+  getRequestURL,
+  getRouterParam,
+  setResponseStatus,
+  type H3Event,
+} from "h3";
+
+import {
+  renderFormOgImagePng,
+  renderFormOgImageSvg,
+} from "../../../../../lib/form-og-image.js";
+import { getPublicFormBySlugOrId } from "../../../../../lib/public-form-ssr.js";
+
+function pngBody(bytes: Uint8Array): ArrayBuffer {
+  const body = new ArrayBuffer(bytes.byteLength);
+  new Uint8Array(body).set(bytes);
+  return body;
+}
+
+function textByteLength(value: string): number {
+  return new TextEncoder().encode(value).byteLength;
+}
+
+function isResvgRuntimeUnavailableError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error ?? "");
+  return (
+    /@resvg\/resvg-js|resvgjs\.[\w-]+\.node|native binding/i.test(message) &&
+    /cannot find|no such module|err_module_not_found|dlopen|invalid elf|wrong architecture|not a valid win32|native binding/i.test(
+      message,
+    )
+  );
+}
+
+const AVATAR_DATA_URL_RE =
+  /^data:image\/(?:png|jpe?g|gif|webp);base64,[A-Za-z0-9+/]+={0,2}$/i;
+
+function validAvatarDataUrl(value: string): string | undefined {
+  const image = value.trim();
+  return image.length <= 2_000_000 && AVATAR_DATA_URL_RE.test(image)
+    ? image
+    : undefined;
+}
+
+function normalizeGoogleProfilePhotoUrl(value: string): string | undefined {
+  try {
+    const url = new URL(value);
+    if (
+      url.protocol !== "https:" ||
+      !/(^|\.)googleusercontent\.com$/i.test(url.hostname)
+    ) {
+      return undefined;
+    }
+    return url.toString().replace(/=s\d+(-c)?$/i, "=s256-c");
+  } catch {
+    return undefined;
+  }
+}
+
+async function fetchGoogleProfilePhotoDataUrl(
+  photoUrl: string,
+): Promise<string | undefined> {
+  const url = normalizeGoogleProfilePhotoUrl(photoUrl);
+  if (!url) return undefined;
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 2_500);
+  try {
+    const response = await fetch(url, {
+      headers: { "User-Agent": "Agent-Native Forms OG Image" },
+      signal: controller.signal,
+    });
+    if (!response.ok) return undefined;
+
+    const contentType =
+      response.headers.get("content-type")?.split(";")[0]?.trim() || "";
+    if (!/^image\/(?:png|jpe?g|gif|webp)$/i.test(contentType)) {
+      return undefined;
+    }
+
+    const contentLength = Number(response.headers.get("content-length"));
+    if (Number.isFinite(contentLength) && contentLength > 2_000_000) {
+      return undefined;
+    }
+
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > 2_000_000) return undefined;
+    return `data:${contentType};base64,${Buffer.from(bytes).toString("base64")}`;
+  } catch {
+    return undefined;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function loadProfileImageDataUrl(
+  ownerEmail: string | null | undefined,
+): Promise<string | undefined> {
+  if (!ownerEmail) return undefined;
+  try {
+    const avatar = await getSetting(`avatar:${ownerEmail}`);
+    if (typeof avatar?.image !== "string") return undefined;
+    return (
+      validAvatarDataUrl(avatar.image) ??
+      (await fetchGoogleProfilePhotoDataUrl(avatar.image))
+    );
+  } catch {
+    return undefined;
+  }
+}
+
+export function formSlugFromOgPath(pathname: string): string {
+  const marker = "/api/forms/og/";
+  const markerIndex = pathname.indexOf(marker);
+  if (markerIndex < 0) return "";
+
+  const tail = pathname.slice(markerIndex + marker.length);
+  const suffix = "/og.png";
+  if (!tail.endsWith(suffix)) return "";
+
+  try {
+    return decodeURIComponent(tail.slice(0, -suffix.length));
+  } catch {
+    return "";
+  }
+}
+
+export default defineEventHandler(async (event: H3Event) => {
+  const slug =
+    formSlugFromOgPath(getRequestURL(event).pathname) ||
+    (() => {
+      const param = getRouterParam(event, "slug");
+      if (!param) return "";
+      try {
+        return decodeURIComponent(param);
+      } catch {
+        return "";
+      }
+    })();
+  if (!slug) {
+    setResponseStatus(event, 400);
+    return { error: "slug is required" };
+  }
+
+  const form = await getPublicFormBySlugOrId(slug);
+  if (!form) {
+    setResponseStatus(event, 404);
+    return { error: "Form not found" };
+  }
+
+  if (getMethod(event) === "HEAD") {
+    return new Response(null, {
+      headers: agentNativeOgImageResponseHeaders(0),
+    });
+  }
+
+  const profileImageDataUrl = await loadProfileImageDataUrl(form.ownerEmail);
+  const imageInput = {
+    title: form.title,
+    description: form.description,
+    profileImageDataUrl,
+  };
+
+  let png: Uint8Array;
+  try {
+    png = await renderFormOgImagePng(imageInput);
+  } catch (error) {
+    if (!isResvgRuntimeUnavailableError(error)) throw error;
+    const svg = renderFormOgImageSvg(imageInput);
+    return new Response(svg, {
+      headers: agentNativeOgImageResponseHeaders(
+        textByteLength(svg),
+        "image/svg+xml; charset=utf-8",
+      ),
+    });
+  }
+
+  return new Response(pngBody(png), {
+    headers: agentNativeOgImageResponseHeaders(png.byteLength),
+  });
+});

package/corpus/templates/forms/shared/types.ts

@@ -72,6 +72,8 @@ export interface FormSettings {
   successMessage?: string;
   redirectUrl?: string;
   showProgressBar?: boolean;
+  /** Send new response summaries to the form owner's account email. */
+  emailOnNewResponses?: boolean;
   /**
    * Strict response privacy mode. When enabled, submissions do not retain the
    * request IP, submitter identity, chat/run ids, page URL, or client surface.

package/corpus/templates/plan/.agents/skills/visual-plan/SKILL.md

@@ -201,10 +201,12 @@ forward only the code-research and plan-composition guidance here.
 
 ## Self-Review Before Handoff
 
-For high-stakes plans — architecture, backend, data-model, migration, multi-file,
-or otherwise risky work — run one adversarial self-review pass before treating the
-plan as final. Skip it for small, UI-only, or single-decision plans where the cost
-outweighs the value. Keep the pass cheap and non-blocking:
+This adversarial self-review pass is opt-in, not default: run it only for
+high-stakes plans — irreversible migrations, security-sensitive work, or when
+the user explicitly asks for extra rigor — and skip it otherwise. It roughly
+doubles the cost of plan generation, so the default for small, UI-only,
+single-decision, or ordinary plans is to skip it, not to run it. Keep the pass
+cheap and non-blocking when it does run:
 
 - **Surface the plan first, review concurrently.** Post the link and let the user
   start reading, then run the review in parallel — never make the user wait on it.

package/corpus/templates/plan/.agents/skills/visual-recap/SKILL.md

@@ -133,6 +133,10 @@ Budgets that keep the recap reviewable:
   tab; summarize or link the rest of a long file instead of dumping it.
 - Title at most ~70 characters; brief 1-3 sentences.
 
+These budgets are also the cost ceiling: do not exceed them in the name of
+thoroughness, and do not re-read the full diff after the initial sequential
+pass — work from the notes taken during that pass.
+
 **GOOD.** A 25-file auth change: Before/After wireframes of the login surface,
 a two-paragraph narrative, a diff-aware `data-model` of the sessions table, an
 `api-endpoint` for the new refresh route, a `file-tree` with change flags, and
@@ -213,7 +217,9 @@ sketchy rough overlay.
 When a browser tool is available, render a UI-impact recap in the Plan viewer
 and visually inspect it at the current theme before sharing. If any label,
 annotation, toolbar, or wireframe content overlaps another element, fix the MDX
-and re-import before reporting the link. A text-match screenshot is not enough;
+and re-import before reporting the link. Limit this to one render-and-inspect
+pass plus at most one fix-and-re-render; do not keep iterating beyond that
+unless the user explicitly asks. A text-match screenshot is not enough;
 visually inspect the captured image. When no browser is available (for example
 a headless CI agent), state that in the recap handoff instead.
 

package/dist/a2a/index.d.ts

@@ -1,4 +1,5 @@
-export { mountA2A } from "./server.js";
+export { mountA2A, verifyA2AToken } from "./server.js";
+export type { A2ATokenPayload } from "./server.js";
 export { generateAgentCard } from "./agent-card.js";
 export { A2AClient, callAgent, signA2AToken } from "./client.js";
 export { AgentInvocationError, buildAgentInvocationPrompt, invokeAgent, looksLikeAgentUrl, resolveAgentInvocationTarget, } from "./invoke.js";

package/dist/a2a/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,WAAW,EACX,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,IAAI,EACJ,SAAS,EACT,UAAU,EACV,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,WAAW,EACX,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,IAAI,EACJ,SAAS,EACT,UAAU,EACV,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,aAAa,CAAC"}

package/dist/a2a/index.js

@@ -1,5 +1,5 @@
 // Server (H3/Nitro)
-export { mountA2A } from "./server.js";
+export { mountA2A, verifyA2AToken } from "./server.js";
 export { generateAgentCard } from "./agent-card.js";
 // Client
 export { A2AClient, callAgent, signA2AToken } from "./client.js";

package/dist/a2a/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,SAAS;AACT,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,WAAW,EACX,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC","sourcesContent":["// Server (H3/Nitro)\nexport { mountA2A } from \"./server.js\";\nexport { generateAgentCard } from \"./agent-card.js\";\n\n// Client\nexport { A2AClient, callAgent, signA2AToken } from \"./client.js\";\nexport {\n  AgentInvocationError,\n  buildAgentInvocationPrompt,\n  invokeAgent,\n  looksLikeAgentUrl,\n  resolveAgentInvocationTarget,\n} from \"./invoke.js\";\n\n// Types\nexport type {\n  A2AConfig,\n  A2AHandler,\n  A2AHandlerContext,\n  A2AHandlerResult,\n  AgentCard,\n  AgentSkill,\n  AgentCapabilities,\n  Task,\n  TaskState,\n  TaskStatus,\n  Message,\n  Part,\n  TextPart,\n  FilePart,\n  DataPart,\n  Artifact,\n  JsonRpcRequest,\n  JsonRpcResponse,\n} from \"./types.js\";\nexport type {\n  AgentInvocationErrorCode,\n  AgentInvocationResult,\n  AgentInvocationRuntime,\n  InvokeAgentOptions,\n  ResolveAgentInvocationTargetOptions,\n  ResolvedAgentInvocationTarget,\n} from \"./invoke.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/a2a/index.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,SAAS;AACT,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,WAAW,EACX,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC","sourcesContent":["// Server (H3/Nitro)\nexport { mountA2A, verifyA2AToken } from \"./server.js\";\nexport type { A2ATokenPayload } from \"./server.js\";\nexport { generateAgentCard } from \"./agent-card.js\";\n\n// Client\nexport { A2AClient, callAgent, signA2AToken } from \"./client.js\";\nexport {\n  AgentInvocationError,\n  buildAgentInvocationPrompt,\n  invokeAgent,\n  looksLikeAgentUrl,\n  resolveAgentInvocationTarget,\n} from \"./invoke.js\";\n\n// Types\nexport type {\n  A2AConfig,\n  A2AHandler,\n  A2AHandlerContext,\n  A2AHandlerResult,\n  AgentCard,\n  AgentSkill,\n  AgentCapabilities,\n  Task,\n  TaskState,\n  TaskStatus,\n  Message,\n  Part,\n  TextPart,\n  FilePart,\n  DataPart,\n  Artifact,\n  JsonRpcRequest,\n  JsonRpcResponse,\n} from \"./types.js\";\nexport type {\n  AgentInvocationErrorCode,\n  AgentInvocationResult,\n  AgentInvocationRuntime,\n  InvokeAgentOptions,\n  ResolveAgentInvocationTargetOptions,\n  ResolvedAgentInvocationTarget,\n} from \"./invoke.js\";\n"]}

package/dist/a2a/server.d.ts

@@ -1,4 +1,29 @@
 import type { A2AConfig } from "./types.js";
+/**
+ * Result of verifying an inbound A2A JWT. `email` is the caller identity from
+ * the token's `sub` claim (null when verification fails), `orgDomain` mirrors
+ * the verified `org_domain` claim when present.
+ */
+export interface A2ATokenPayload {
+    email: string | null;
+    orgDomain: string | null;
+}
+/**
+ * Verify an inbound A2A bearer token (HS256) exactly as the
+ * `/_agent-native/a2a` endpoint does: it peeks at the unverified `org_domain`
+ * claim to build an ordered candidate-secret set (`process.env.A2A_SECRET`
+ * plus any org-level secret for that domain), then verifies the JWT — checking
+ * `aud`/`iss` when the token carries them and `exp` always. Returns the
+ * caller's email (`sub`) and org domain on success, or `{ email: null,
+ * orgDomain: null }` on any failure (malformed, bad signature, expired, or no
+ * secret configured), never throwing.
+ *
+ * Exported so workspaces can accept A2A callers on the HTTP action route with
+ * the same routine — including org-level fallback secrets — instead of
+ * reimplementing a partial verifier. Pass the H3 `event` to enable org-domain →
+ * org-secret lookup and audience derivation; it is optional.
+ */
+export declare function verifyA2AToken(token: string, event?: any): Promise<A2ATokenPayload>;
 /**
  * Mount A2A protocol endpoints on an H3/Nitro app.
  *

package/dist/a2a/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAiJ5C;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,SAAS,EACjB,WAAW,SAAmB,GAC7B,IAAI,CAsNN;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,qCA6B5D"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmB5C;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAsCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,eAAe,CAAC,CAqF1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,SAAS,EACjB,WAAW,SAAmB,GAC7B,IAAI,CAsNN;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,qCA6B5D"}

package/dist/a2a/server.js

@@ -30,9 +30,11 @@ function addSecretCandidate(candidates, secret) {
 /**
  * Resolve the audience (`aud`) value to expect in an inbound JWT. We use the
  * receiver's app URL — it's the natural identifier of "who this token was
- * minted for". Falls back to undefined when no app URL is configured, in
- * which case the audience check is skipped (backward-compat with tokens
- * minted before the audience claim shipped).
+ * minted for". Returns undefined when no app URL is configured and no request
+ * host is derivable; `verifyA2AToken` then rejects any token that carries an
+ * `aud` claim (fail closed — a correctly signed token minted for another
+ * service must not verify here). Only tokens without an `aud` claim (minted
+ * before the audience claim shipped) skip the audience check.
  */
 function expectedJwtAudience(event) {
     const fromEnv = process.env.APP_URL ||
@@ -53,7 +55,22 @@ function expectedJwtAudience(event) {
     catch { }
     return undefined;
 }
-async function verifyA2AToken(token, event) {
+/**
+ * Verify an inbound A2A bearer token (HS256) exactly as the
+ * `/_agent-native/a2a` endpoint does: it peeks at the unverified `org_domain`
+ * claim to build an ordered candidate-secret set (`process.env.A2A_SECRET`
+ * plus any org-level secret for that domain), then verifies the JWT — checking
+ * `aud`/`iss` when the token carries them and `exp` always. Returns the
+ * caller's email (`sub`) and org domain on success, or `{ email: null,
+ * orgDomain: null }` on any failure (malformed, bad signature, expired, or no
+ * secret configured), never throwing.
+ *
+ * Exported so workspaces can accept A2A callers on the HTTP action route with
+ * the same routine — including org-level fallback secrets — instead of
+ * reimplementing a partial verifier. Pass the H3 `event` to enable org-domain →
+ * org-secret lookup and audience derivation; it is optional.
+ */
+export async function verifyA2AToken(token, event) {
     // Step 1: Peek at JWT claims WITHOUT verification to get org_domain.
     // This is safe because we only use org_domain to look up the secret,
     // then verify the full JWT with that secret. If someone forges a JWT
@@ -103,9 +120,16 @@ async function verifyA2AToken(token, event) {
     try {
         const verifyOptions = {};
         if (unverifiedPayload && typeof unverifiedPayload.aud !== "undefined") {
+            // Fail closed: the token was minted for a specific audience, but this
+            // receiver can't derive its own expected audience (no APP_URL/URL and no
+            // usable request host). Accepting here would let a correctly-signed token
+            // whose `aud` targets ANOTHER service verify against a shared secret. A
+            // token that self-declares an audience must be checked against ours, so
+            // when we have nothing to check it against we reject rather than skip.
             const aud = expectedJwtAudience(event);
-            if (aud)
-                verifyOptions.audience = aud;
+            if (!aud)
+                return { email: null, orgDomain: null };
+            verifyOptions.audience = aud;
         }
         if (unverifiedPayload &&
             typeof unverifiedPayload.iss === "string" &&

package/dist/a2a/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AACZ,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAGzE;;;;;GAKG;AACH,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAC7B,SAAS,iBAAiB;IACxB,IAAI,gBAAgB;QAAE,OAAO;IAC7B,gBAAgB,GAAG,IAAI,CAAC;IACxB,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,mFAAmF;QACjF,4FAA4F,CAC/F,CAAC;AACJ,CAAC;AAWD,SAAS,kBAAkB,CACzB,UAAoB,EACpB,MAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO;IACrD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAsB;IACjD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC;QACtE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAa,EACb,KAAsB;IAEtB,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,aAAiC,CAAC;IACtC,IAAI,iBAA8C,CAAC;IACnD,IAAI,CAAC;QACH,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,aAAa,GAAG,iBAAiB,CAAC,UAAgC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC5D,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,IAAI,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAE3E,iDAAiD;IACjD,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,wBAAwB;IACxB,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,qCAAqC;IACrC,IAAI,CAAC;QACH,MAAM,aAAa,GAA0B,EAAE,CAAC;QAChD,IAAI,iBAAiB,IAAI,OAAO,iBAAiB,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,GAAG;gBAAE,aAAa,CAAC,QAAQ,GAAG,GAAG,CAAC;QACxC,CAAC;QACD,IACE,iBAAiB;YACjB,OAAO,iBAAiB,CAAC,GAAG,KAAK,QAAQ;YACzC,iBAAiB,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAChC,CAAC;YACD,aAAa,CAAC,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,aAAa,CACd,CAAC;gBACF,OAAO;oBACL,KAAK,EAAG,OAAO,CAAC,GAAc,IAAI,IAAI;oBACtC,SAAS,EAAG,OAAO,CAAC,UAAqB,IAAI,IAAI;iBAClD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,iDAAiD;IACjD,EAAE;IACF,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,wDAAwD;IACxD,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,8BAA8B,EAC9B,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,QAAQ,GACZ,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC;YAC5C,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;QAExC,MAAM,cAAc,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAE3D,OAAO,iBAAiB,CACtB,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EACrC,OAAO,EACP,GAAG,WAAW,MAAM,CACrB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,oBAAoB,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAgC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,8DAA8D;QAC9D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,sBAAsB,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;YACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,uFAAuF;aAC1F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iBAAiB,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO;QAE5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAC9C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QAErC,oEAAoE;QACpE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExE,6EAA6E;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9D,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC;YACzC,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC;YAC3C,wBAAwB,GAAG,CAAC,mBAAmB,CAAC;QAClD,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE;qBAC5D,CAAC;gBACJ,CAAC;gBACD,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;oBAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBACpD,CAAC;gBACJ,CAAC;gBACD,yBAAyB,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACvD,oEAAoE;YACpE,gEAAgE;YAChE,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,8BAA8B;qBACxC;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,IAAI,sBAAsB,EAAE,EAAE,CAAC;oBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,qHAAqH;yBACxH;qBACF,CAAC;gBACJ,CAAC;gBACD,iBAAiB,EAAE,CAAC;YACtB,CAAC;iBAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;gBACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB;qBACnC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,mBAAmB,EAAE,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;QACzD,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,iBAAiB,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,MAAM,EAAE,GACL,KAAwC,CAAC,EAAE;YAC3C,KAA2B,CAAC,IAAI;YACjC,EAAE,CAAC;QACL,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,CACL,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,IAAI;gBACjC,KAAK,CAAC,WAAW,CAAC,QAAQ,KAAK,IAAI;gBACnC,KAAK,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI;gBACvC,KAAK,CAAC,WAAW,CAAC,eAAe,KAAK,IAAI,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  defineEventHandler,\n  setResponseStatus,\n  getMethod,\n  getRequestHeader,\n} from \"h3\";\nimport * as jose from \"jose\";\n\nimport {\n  extractBearerToken,\n  verifyInternalToken,\n} from \"../integrations/internal-token.js\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { generateAgentCard } from \"./agent-card.js\";\nimport {\n  hasConfiguredA2ASecret,\n  isA2AProductionRuntime,\n} from \"./auth-policy.js\";\nimport { handleJsonRpcH3, processA2ATaskFromQueue } from \"./handlers.js\";\nimport type { A2AConfig } from \"./types.js\";\n\n/**\n * One-time warning when A2A is running unauthenticated in development. We\n * don't refuse the request (local templates need to work out of the box),\n * but we log a single noisy line so operators notice if they accidentally\n * deploy with no auth configured.\n */\nlet _warnedUnauthA2A = false;\nfunction warnA2AUnauthOnce(): void {\n  if (_warnedUnauthA2A) return;\n  _warnedUnauthA2A = true;\n  // eslint-disable-next-line no-console\n  console.warn(\n    \"[a2a] No A2A_SECRET or apiKeyEnv configured — A2A endpoint runs unauthenticated. \" +\n      \"This is allowed in development but blocked in production. Set A2A_SECRET before deploying.\",\n  );\n}\n\n/**\n * Verify an inbound A2A JWT signed with the shared A2A_SECRET.\n * Returns the caller's email (from `sub` claim) if valid, null otherwise.\n */\ninterface A2ATokenPayload {\n  email: string | null;\n  orgDomain: string | null;\n}\n\nfunction addSecretCandidate(\n  candidates: string[],\n  secret: string | undefined,\n): void {\n  const trimmed = secret?.trim();\n  if (!trimmed || candidates.includes(trimmed)) return;\n  candidates.push(trimmed);\n}\n\n/**\n * Resolve the audience (`aud`) value to expect in an inbound JWT. We use the\n * receiver's app URL — it's the natural identifier of \"who this token was\n * minted for\". Falls back to undefined when no app URL is configured, in\n * which case the audience check is skipped (backward-compat with tokens\n * minted before the audience claim shipped).\n */\nfunction expectedJwtAudience(event: any | undefined): string | undefined {\n  const fromEnv =\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    process.env.BETTER_AUTH_URL;\n  if (fromEnv) return String(fromEnv);\n  // Best-effort: derive from the inbound request host. This is forgeable\n  // (Host-header attack), but only useful as a hint when env-derived URL\n  // is unset; the rest of the JWT verification still uses the secret.\n  try {\n    const proto = getRequestHeader(event, \"x-forwarded-proto\") || \"https\";\n    const host = getRequestHeader(event, \"host\");\n    if (host) return `${proto}://${host}`;\n  } catch {}\n  return undefined;\n}\n\nasync function verifyA2AToken(\n  token: string,\n  event: any | undefined,\n): Promise<A2ATokenPayload> {\n  // Step 1: Peek at JWT claims WITHOUT verification to get org_domain.\n  // This is safe because we only use org_domain to look up the secret,\n  // then verify the full JWT with that secret. If someone forges a JWT\n  // with a fake org_domain, verification will fail because they don't\n  // have the real secret.\n  let orgDomainHint: string | undefined;\n  let unverifiedPayload: jose.JWTPayload | undefined;\n  try {\n    unverifiedPayload = jose.decodeJwt(token);\n    orgDomainHint = unverifiedPayload.org_domain as string | undefined;\n  } catch {\n    // Malformed token — fall through to global secret attempt\n  }\n\n  // Step 2: Build a small, ordered set of candidate secrets. Tokens minted by\n  // current callers prefer the shared A2A_SECRET; older callers may still use\n  // an org-level secret. Try both without logging or reflecting secret details.\n  const candidateSecrets: string[] = [];\n  addSecretCandidate(candidateSecrets, process.env.A2A_SECRET);\n  if (orgDomainHint) {\n    try {\n      const { getA2ASecretByDomain } = await import(\"../org/context.js\");\n      const orgSecret = await getA2ASecretByDomain(orgDomainHint);\n      addSecretCandidate(candidateSecrets, orgSecret ?? undefined);\n    } catch {\n      // DB not ready or column doesn't exist yet — fall through\n    }\n  }\n  if (candidateSecrets.length === 0) return { email: null, orgDomain: null };\n\n  // Step 3: Verify JWT with the candidate secrets.\n  //\n  // - `audience`: passed only when the token carries an `aud` claim\n  //   (backward-compat: tokens minted by older `signA2AToken` versions\n  //   don't include one).\n  // - `issuer`: enforced when the token carries an `iss` claim. The\n  //   sender's `signA2AToken` (`a2a/client.ts:42`) sets the issuer to its\n  //   own app URL, so a verified token must self-identify a non-empty\n  //   string issuer. We accept any string the token claims (we don't pin\n  //   a specific expected issuer because dispatchers may legitimately\n  //   mint tokens from many sender URLs — dev tunnels, multi-deploy\n  //   setups). The pin is \"issuer must match the value the token says\n  //   it was minted from\", which `jose.jwtVerify` validates exactly when\n  //   `issuer` is supplied as a string. Backward-compat: when the token\n  //   has no `iss`, we skip the check.\n  try {\n    const verifyOptions: jose.JWTVerifyOptions = {};\n    if (unverifiedPayload && typeof unverifiedPayload.aud !== \"undefined\") {\n      const aud = expectedJwtAudience(event);\n      if (aud) verifyOptions.audience = aud;\n    }\n    if (\n      unverifiedPayload &&\n      typeof unverifiedPayload.iss === \"string\" &&\n      unverifiedPayload.iss.length > 0\n    ) {\n      verifyOptions.issuer = unverifiedPayload.iss;\n    }\n    for (const secret of candidateSecrets) {\n      try {\n        const { payload } = await jose.jwtVerify(\n          token,\n          new TextEncoder().encode(secret),\n          verifyOptions,\n        );\n        return {\n          email: (payload.sub as string) ?? null,\n          orgDomain: (payload.org_domain as string) ?? null,\n        };\n      } catch {\n        // Try the next candidate without leaking which secret failed.\n      }\n    }\n  } catch {\n    // Keep malformed option construction indistinguishable from auth failure.\n  }\n  return { email: null, orgDomain: null };\n}\n\n/**\n * Mount A2A protocol endpoints on an H3/Nitro app.\n *\n * - GET /.well-known/agent-card.json — public agent card (no auth)\n * - POST /_agent-native/a2a — JSON-RPC endpoint (with optional auth)\n *\n * When A2A_SECRET is set, inbound Bearer tokens are verified as JWTs\n * and the caller's email is extracted from the `sub` claim. This provides\n * cryptographic identity verification for cross-app A2A calls.\n */\nexport function mountA2A(\n  nitroApp: any,\n  config: A2AConfig,\n  routePrefix = \"/_agent-native\",\n): void {\n  // Public agent card endpoint (no auth required).\n  //\n  // SECURITY: per-user / per-org MCP tools are filtered out of the public\n  // skills list. Their merged-key prefix (`mcp__user_<emailhash>_…` or\n  // `mcp__org_<orgid>_…`) discloses (a) which users have integrations\n  // attached, and (b) what those integrations are — fingerprinting the\n  // tenant. Template- and framework-defined skills stay; only the dynamic\n  // per-tenant MCP entries are dropped. See finding #7 in\n  // /tmp/security-audit/12-mcp-a2a-agent.md.\n  getH3App(nitroApp).use(\n    \"/.well-known/agent-card.json\",\n    defineEventHandler((event) => {\n      if (getMethod(event) !== \"GET\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n      const protocol =\n        getRequestHeader(event, \"x-forwarded-proto\") ||\n        (event.url?.protocol?.replace(\":\", \"\") ?? \"http\");\n      const host = getRequestHeader(event, \"host\") ?? \"localhost\";\n      const baseUrl = `${protocol}://${host}`;\n\n      const filteredSkills = filterPublicAgentCardSkills(config);\n\n      return generateAgentCard(\n        { ...config, skills: filteredSkills },\n        baseUrl,\n        `${routePrefix}/a2a`,\n      );\n    }),\n  );\n\n  // Async-mode processor route. MUST be mounted BEFORE the `/a2a` catch-all\n  // below, since h3's `.use()` matches by prefix and `/a2a` would otherwise\n  // swallow `/a2a/_process-task` and return a JSON-RPC \"Invalid token\" error\n  // (the JSON-RPC handler doesn't know about taskId-only bodies).\n  //\n  // When `message/send` is called with `async: true`, the JSON-RPC handler\n  // enqueues the task and self-fires a POST to this route on the same\n  // deployment so the actual handler runs in a fresh function execution (its\n  // own full timeout). Authenticated with an HMAC token bound to the task id\n  // (5-minute lifetime, signed with A2A_SECRET — same scheme as the\n  // integration webhook queue).\n  getH3App(nitroApp).use(\n    `${routePrefix}/a2a/_process-task`,\n    defineEventHandler(async (event) => {\n      if (getMethod(event) !== \"POST\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n\n      const body = (await readBody(event)) as { taskId?: unknown } | null;\n      const taskId = body && typeof body.taskId === \"string\" ? body.taskId : \"\";\n      if (!taskId) {\n        setResponseStatus(event, 400);\n        return { error: \"taskId required\" };\n      }\n\n      // When A2A_SECRET is set, require a valid HMAC token bound to this\n      // taskId. In production, we REQUIRE A2A_SECRET to be set so unsigned\n      // dispatches are never accepted (an attacker who fishes a taskId out\n      // of logs / a share link could otherwise force-replay it). In\n      // development, a missing secret is permitted so local templates work\n      // out of the box, but we log a one-time warning so operators notice.\n      if (hasConfiguredA2ASecret()) {\n        const auth = getRequestHeader(event, \"authorization\");\n        const tok = extractBearerToken(auth);\n        if (!verifyInternalToken(taskId, tok ?? \"\")) {\n          setResponseStatus(event, 401);\n          return { error: \"Invalid or expired processor token\" };\n        }\n      } else if (isA2AProductionRuntime()) {\n        setResponseStatus(event, 503);\n        return {\n          error:\n            \"A2A processor not configured — set A2A_SECRET on this deployment to enable async A2A.\",\n        };\n      } else {\n        warnA2AUnauthOnce();\n      }\n\n      try {\n        await processA2ATaskFromQueue(taskId, config, event);\n        return { ok: true };\n      } catch (err: any) {\n        console.error(\"[a2a] process-task failed:\", err);\n        setResponseStatus(event, 500);\n        return { error: err?.message ?? \"process-task failed\" };\n      }\n    }),\n  );\n\n  // JSON-RPC A2A endpoint (with optional auth)\n  getH3App(nitroApp).use(\n    `${routePrefix}/a2a`,\n    defineEventHandler(async (event) => {\n      if (getMethod(event) !== \"POST\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n\n      // h3 prefix-matches mounts, so a request to `/a2a/_process-task`\n      // reaches this handler too. The dedicated mount above runs first and\n      // takes the request, but if that returns `undefined` (or h3 ever\n      // changes ordering semantics) defensively bail here. event.path is\n      // stripped to the remainder after the mount prefix.\n      const sub = (event.path || \"/\").split(\"?\")[0].replace(/^\\//, \"\");\n      if (sub.startsWith(\"_process-task\")) return;\n\n      const authHeader = getRequestHeader(event, \"authorization\");\n      const bearerToken = extractBearerToken(authHeader);\n      let verifiedCallerEmail: string | null = null;\n      let verifiedOrgDomain: string | null = null;\n      let legacyApiKeyAuthenticated = false;\n      let bearerTokenRejectedByJwt = false;\n\n      // SECURITY: when neither A2A_SECRET nor an apiKeyEnv is configured,\n      // there's no way to authenticate the caller. Default to \"auth required\"\n      // in production — return 503 with a clear message instead of running\n      // the agent loop unauthenticated. In development, log a one-time\n      // warning but allow so local templates work out of the box.\n      const hasA2ASecret = hasConfiguredA2ASecret();\n      const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);\n\n      // Try JWT verification first (org-level or global A2A_SECRET-based identity)\n      if (bearerToken) {\n        const tokenPayload = await verifyA2AToken(bearerToken, event);\n        verifiedCallerEmail = tokenPayload.email;\n        verifiedOrgDomain = tokenPayload.orgDomain;\n        bearerTokenRejectedByJwt = !verifiedCallerEmail;\n      }\n\n      // Fall back to legacy API key check (exact string match)\n      if (!verifiedCallerEmail && config.apiKeyEnv) {\n        const expectedKey = process.env[config.apiKeyEnv];\n        if (expectedKey) {\n          if (!bearerToken) {\n            setResponseStatus(event, 401);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: { code: -32001, message: \"Authentication required\" },\n            };\n          }\n          if (bearerToken !== expectedKey) {\n            setResponseStatus(event, 401);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: { code: -32001, message: \"Invalid API key\" },\n            };\n          }\n          legacyApiKeyAuthenticated = true;\n        }\n      }\n\n      if (!verifiedCallerEmail && !legacyApiKeyAuthenticated) {\n        // Any supplied bearer token that failed JWT verification is an auth\n        // failure after the legacy exact-match apiKeyEnv path has had a\n        // chance to succeed. Do not let bad tokens fall through to tasks/get\n        // and get reported as lookup misses.\n        if (bearerTokenRejectedByJwt) {\n          setResponseStatus(event, 401);\n          return {\n            jsonrpc: \"2.0\",\n            id: null,\n            error: {\n              code: -32001,\n              message: \"Invalid or expired A2A token\",\n            },\n          };\n        }\n\n        if (!hasA2ASecret && !hasApiKey) {\n          if (isA2AProductionRuntime()) {\n            setResponseStatus(event, 503);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: {\n                code: -32001,\n                message:\n                  \"A2A authentication not configured. Set A2A_SECRET (preferred) or configure apiKeyEnv to accept inbound A2A traffic.\",\n              },\n            };\n          }\n          warnA2AUnauthOnce();\n        } else if (isA2AProductionRuntime()) {\n          setResponseStatus(event, 401);\n          return {\n            jsonrpc: \"2.0\",\n            id: null,\n            error: {\n              code: -32001,\n              message: \"Authentication required\",\n            },\n          };\n        }\n      }\n\n      // Store verified caller identity on the event context so the handler\n      // can set request context from a trusted source instead of metadata\n      if (verifiedCallerEmail) {\n        event.context.__a2aVerifiedEmail = verifiedCallerEmail;\n      }\n      if (verifiedOrgDomain) {\n        event.context.__a2aOrgDomain = verifiedOrgDomain;\n      }\n\n      const body = await readBody(event);\n      return handleJsonRpcH3(body, event, config);\n    }),\n  );\n}\n\nexport function filterPublicAgentCardSkills(config: A2AConfig) {\n  return (config.skills ?? []).filter((skill) => {\n    const id =\n      (skill as { id?: string; name?: string }).id ??\n      (skill as { name?: string }).name ??\n      \"\";\n    if (typeof id === \"string\") {\n      if (id.startsWith(\"mcp__user_\") || id.startsWith(\"mcp__org_\")) {\n        return false;\n      }\n    }\n\n    if (skill.public === false || skill.requiresAuth || skill.isConsequential) {\n      return false;\n    }\n\n    if (!config.publicSkillsOnly) return true;\n\n    if (skill.publicAgent) {\n      return (\n        skill.publicAgent.expose === true &&\n        skill.publicAgent.readOnly === true &&\n        skill.publicAgent.requiresAuth !== true &&\n        skill.publicAgent.isConsequential !== true\n      );\n    }\n\n    return skill.public === true && skill.readOnly !== false;\n  });\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AACZ,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAGzE;;;;;GAKG;AACH,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAC7B,SAAS,iBAAiB;IACxB,IAAI,gBAAgB;QAAE,OAAO;IAC7B,gBAAgB,GAAG,IAAI,CAAC;IACxB,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,mFAAmF;QACjF,4FAA4F,CAC/F,CAAC;AACJ,CAAC;AAYD,SAAS,kBAAkB,CACzB,UAAoB,EACpB,MAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO;IACrD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,KAAsB;IACjD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC;QACtE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,KAAW;IAEX,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,aAAiC,CAAC;IACtC,IAAI,iBAA8C,CAAC;IACnD,IAAI,CAAC;QACH,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,aAAa,GAAG,iBAAiB,CAAC,UAAgC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC5D,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,IAAI,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAE3E,iDAAiD;IACjD,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,wBAAwB;IACxB,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,qCAAqC;IACrC,IAAI,CAAC;QACH,MAAM,aAAa,GAA0B,EAAE,CAAC;QAChD,IAAI,iBAAiB,IAAI,OAAO,iBAAiB,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YACtE,sEAAsE;YACtE,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAClD,aAAa,CAAC,QAAQ,GAAG,GAAG,CAAC;QAC/B,CAAC;QACD,IACE,iBAAiB;YACjB,OAAO,iBAAiB,CAAC,GAAG,KAAK,QAAQ;YACzC,iBAAiB,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAChC,CAAC;YACD,aAAa,CAAC,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,aAAa,CACd,CAAC;gBACF,OAAO;oBACL,KAAK,EAAG,OAAO,CAAC,GAAc,IAAI,IAAI;oBACtC,SAAS,EAAG,OAAO,CAAC,UAAqB,IAAI,IAAI;iBAClD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,iDAAiD;IACjD,EAAE;IACF,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,wDAAwD;IACxD,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,8BAA8B,EAC9B,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,QAAQ,GACZ,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC;YAC5C,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;QAExC,MAAM,cAAc,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAE3D,OAAO,iBAAiB,CACtB,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EACrC,OAAO,EACP,GAAG,WAAW,MAAM,CACrB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,oBAAoB,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAgC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,8DAA8D;QAC9D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,sBAAsB,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;YACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,uFAAuF;aAC1F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iBAAiB,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO;QAE5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAC9C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QAErC,oEAAoE;QACpE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExE,6EAA6E;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9D,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC;YACzC,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC;YAC3C,wBAAwB,GAAG,CAAC,mBAAmB,CAAC;QAClD,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE;qBAC5D,CAAC;gBACJ,CAAC;gBACD,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;oBAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBACpD,CAAC;gBACJ,CAAC;gBACD,yBAAyB,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACvD,oEAAoE;YACpE,gEAAgE;YAChE,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,8BAA8B;qBACxC;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,IAAI,sBAAsB,EAAE,EAAE,CAAC;oBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,qHAAqH;yBACxH;qBACF,CAAC;gBACJ,CAAC;gBACD,iBAAiB,EAAE,CAAC;YACtB,CAAC;iBAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;gBACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB;qBACnC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,mBAAmB,EAAE,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;QACzD,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,iBAAiB,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,MAAM,EAAE,GACL,KAAwC,CAAC,EAAE;YAC3C,KAA2B,CAAC,IAAI;YACjC,EAAE,CAAC;QACL,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,CACL,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,IAAI;gBACjC,KAAK,CAAC,WAAW,CAAC,QAAQ,KAAK,IAAI;gBACnC,KAAK,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI;gBACvC,KAAK,CAAC,WAAW,CAAC,eAAe,KAAK,IAAI,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  defineEventHandler,\n  setResponseStatus,\n  getMethod,\n  getRequestHeader,\n} from \"h3\";\nimport * as jose from \"jose\";\n\nimport {\n  extractBearerToken,\n  verifyInternalToken,\n} from \"../integrations/internal-token.js\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { generateAgentCard } from \"./agent-card.js\";\nimport {\n  hasConfiguredA2ASecret,\n  isA2AProductionRuntime,\n} from \"./auth-policy.js\";\nimport { handleJsonRpcH3, processA2ATaskFromQueue } from \"./handlers.js\";\nimport type { A2AConfig } from \"./types.js\";\n\n/**\n * One-time warning when A2A is running unauthenticated in development. We\n * don't refuse the request (local templates need to work out of the box),\n * but we log a single noisy line so operators notice if they accidentally\n * deploy with no auth configured.\n */\nlet _warnedUnauthA2A = false;\nfunction warnA2AUnauthOnce(): void {\n  if (_warnedUnauthA2A) return;\n  _warnedUnauthA2A = true;\n  // eslint-disable-next-line no-console\n  console.warn(\n    \"[a2a] No A2A_SECRET or apiKeyEnv configured — A2A endpoint runs unauthenticated. \" +\n      \"This is allowed in development but blocked in production. Set A2A_SECRET before deploying.\",\n  );\n}\n\n/**\n * Result of verifying an inbound A2A JWT. `email` is the caller identity from\n * the token's `sub` claim (null when verification fails), `orgDomain` mirrors\n * the verified `org_domain` claim when present.\n */\nexport interface A2ATokenPayload {\n  email: string | null;\n  orgDomain: string | null;\n}\n\nfunction addSecretCandidate(\n  candidates: string[],\n  secret: string | undefined,\n): void {\n  const trimmed = secret?.trim();\n  if (!trimmed || candidates.includes(trimmed)) return;\n  candidates.push(trimmed);\n}\n\n/**\n * Resolve the audience (`aud`) value to expect in an inbound JWT. We use the\n * receiver's app URL — it's the natural identifier of \"who this token was\n * minted for\". Returns undefined when no app URL is configured and no request\n * host is derivable; `verifyA2AToken` then rejects any token that carries an\n * `aud` claim (fail closed — a correctly signed token minted for another\n * service must not verify here). Only tokens without an `aud` claim (minted\n * before the audience claim shipped) skip the audience check.\n */\nfunction expectedJwtAudience(event: any | undefined): string | undefined {\n  const fromEnv =\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    process.env.BETTER_AUTH_URL;\n  if (fromEnv) return String(fromEnv);\n  // Best-effort: derive from the inbound request host. This is forgeable\n  // (Host-header attack), but only useful as a hint when env-derived URL\n  // is unset; the rest of the JWT verification still uses the secret.\n  try {\n    const proto = getRequestHeader(event, \"x-forwarded-proto\") || \"https\";\n    const host = getRequestHeader(event, \"host\");\n    if (host) return `${proto}://${host}`;\n  } catch {}\n  return undefined;\n}\n\n/**\n * Verify an inbound A2A bearer token (HS256) exactly as the\n * `/_agent-native/a2a` endpoint does: it peeks at the unverified `org_domain`\n * claim to build an ordered candidate-secret set (`process.env.A2A_SECRET`\n * plus any org-level secret for that domain), then verifies the JWT — checking\n * `aud`/`iss` when the token carries them and `exp` always. Returns the\n * caller's email (`sub`) and org domain on success, or `{ email: null,\n * orgDomain: null }` on any failure (malformed, bad signature, expired, or no\n * secret configured), never throwing.\n *\n * Exported so workspaces can accept A2A callers on the HTTP action route with\n * the same routine — including org-level fallback secrets — instead of\n * reimplementing a partial verifier. Pass the H3 `event` to enable org-domain →\n * org-secret lookup and audience derivation; it is optional.\n */\nexport async function verifyA2AToken(\n  token: string,\n  event?: any,\n): Promise<A2ATokenPayload> {\n  // Step 1: Peek at JWT claims WITHOUT verification to get org_domain.\n  // This is safe because we only use org_domain to look up the secret,\n  // then verify the full JWT with that secret. If someone forges a JWT\n  // with a fake org_domain, verification will fail because they don't\n  // have the real secret.\n  let orgDomainHint: string | undefined;\n  let unverifiedPayload: jose.JWTPayload | undefined;\n  try {\n    unverifiedPayload = jose.decodeJwt(token);\n    orgDomainHint = unverifiedPayload.org_domain as string | undefined;\n  } catch {\n    // Malformed token — fall through to global secret attempt\n  }\n\n  // Step 2: Build a small, ordered set of candidate secrets. Tokens minted by\n  // current callers prefer the shared A2A_SECRET; older callers may still use\n  // an org-level secret. Try both without logging or reflecting secret details.\n  const candidateSecrets: string[] = [];\n  addSecretCandidate(candidateSecrets, process.env.A2A_SECRET);\n  if (orgDomainHint) {\n    try {\n      const { getA2ASecretByDomain } = await import(\"../org/context.js\");\n      const orgSecret = await getA2ASecretByDomain(orgDomainHint);\n      addSecretCandidate(candidateSecrets, orgSecret ?? undefined);\n    } catch {\n      // DB not ready or column doesn't exist yet — fall through\n    }\n  }\n  if (candidateSecrets.length === 0) return { email: null, orgDomain: null };\n\n  // Step 3: Verify JWT with the candidate secrets.\n  //\n  // - `audience`: passed only when the token carries an `aud` claim\n  //   (backward-compat: tokens minted by older `signA2AToken` versions\n  //   don't include one).\n  // - `issuer`: enforced when the token carries an `iss` claim. The\n  //   sender's `signA2AToken` (`a2a/client.ts:42`) sets the issuer to its\n  //   own app URL, so a verified token must self-identify a non-empty\n  //   string issuer. We accept any string the token claims (we don't pin\n  //   a specific expected issuer because dispatchers may legitimately\n  //   mint tokens from many sender URLs — dev tunnels, multi-deploy\n  //   setups). The pin is \"issuer must match the value the token says\n  //   it was minted from\", which `jose.jwtVerify` validates exactly when\n  //   `issuer` is supplied as a string. Backward-compat: when the token\n  //   has no `iss`, we skip the check.\n  try {\n    const verifyOptions: jose.JWTVerifyOptions = {};\n    if (unverifiedPayload && typeof unverifiedPayload.aud !== \"undefined\") {\n      // Fail closed: the token was minted for a specific audience, but this\n      // receiver can't derive its own expected audience (no APP_URL/URL and no\n      // usable request host). Accepting here would let a correctly-signed token\n      // whose `aud` targets ANOTHER service verify against a shared secret. A\n      // token that self-declares an audience must be checked against ours, so\n      // when we have nothing to check it against we reject rather than skip.\n      const aud = expectedJwtAudience(event);\n      if (!aud) return { email: null, orgDomain: null };\n      verifyOptions.audience = aud;\n    }\n    if (\n      unverifiedPayload &&\n      typeof unverifiedPayload.iss === \"string\" &&\n      unverifiedPayload.iss.length > 0\n    ) {\n      verifyOptions.issuer = unverifiedPayload.iss;\n    }\n    for (const secret of candidateSecrets) {\n      try {\n        const { payload } = await jose.jwtVerify(\n          token,\n          new TextEncoder().encode(secret),\n          verifyOptions,\n        );\n        return {\n          email: (payload.sub as string) ?? null,\n          orgDomain: (payload.org_domain as string) ?? null,\n        };\n      } catch {\n        // Try the next candidate without leaking which secret failed.\n      }\n    }\n  } catch {\n    // Keep malformed option construction indistinguishable from auth failure.\n  }\n  return { email: null, orgDomain: null };\n}\n\n/**\n * Mount A2A protocol endpoints on an H3/Nitro app.\n *\n * - GET /.well-known/agent-card.json — public agent card (no auth)\n * - POST /_agent-native/a2a — JSON-RPC endpoint (with optional auth)\n *\n * When A2A_SECRET is set, inbound Bearer tokens are verified as JWTs\n * and the caller's email is extracted from the `sub` claim. This provides\n * cryptographic identity verification for cross-app A2A calls.\n */\nexport function mountA2A(\n  nitroApp: any,\n  config: A2AConfig,\n  routePrefix = \"/_agent-native\",\n): void {\n  // Public agent card endpoint (no auth required).\n  //\n  // SECURITY: per-user / per-org MCP tools are filtered out of the public\n  // skills list. Their merged-key prefix (`mcp__user_<emailhash>_…` or\n  // `mcp__org_<orgid>_…`) discloses (a) which users have integrations\n  // attached, and (b) what those integrations are — fingerprinting the\n  // tenant. Template- and framework-defined skills stay; only the dynamic\n  // per-tenant MCP entries are dropped. See finding #7 in\n  // /tmp/security-audit/12-mcp-a2a-agent.md.\n  getH3App(nitroApp).use(\n    \"/.well-known/agent-card.json\",\n    defineEventHandler((event) => {\n      if (getMethod(event) !== \"GET\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n      const protocol =\n        getRequestHeader(event, \"x-forwarded-proto\") ||\n        (event.url?.protocol?.replace(\":\", \"\") ?? \"http\");\n      const host = getRequestHeader(event, \"host\") ?? \"localhost\";\n      const baseUrl = `${protocol}://${host}`;\n\n      const filteredSkills = filterPublicAgentCardSkills(config);\n\n      return generateAgentCard(\n        { ...config, skills: filteredSkills },\n        baseUrl,\n        `${routePrefix}/a2a`,\n      );\n    }),\n  );\n\n  // Async-mode processor route. MUST be mounted BEFORE the `/a2a` catch-all\n  // below, since h3's `.use()` matches by prefix and `/a2a` would otherwise\n  // swallow `/a2a/_process-task` and return a JSON-RPC \"Invalid token\" error\n  // (the JSON-RPC handler doesn't know about taskId-only bodies).\n  //\n  // When `message/send` is called with `async: true`, the JSON-RPC handler\n  // enqueues the task and self-fires a POST to this route on the same\n  // deployment so the actual handler runs in a fresh function execution (its\n  // own full timeout). Authenticated with an HMAC token bound to the task id\n  // (5-minute lifetime, signed with A2A_SECRET — same scheme as the\n  // integration webhook queue).\n  getH3App(nitroApp).use(\n    `${routePrefix}/a2a/_process-task`,\n    defineEventHandler(async (event) => {\n      if (getMethod(event) !== \"POST\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n\n      const body = (await readBody(event)) as { taskId?: unknown } | null;\n      const taskId = body && typeof body.taskId === \"string\" ? body.taskId : \"\";\n      if (!taskId) {\n        setResponseStatus(event, 400);\n        return { error: \"taskId required\" };\n      }\n\n      // When A2A_SECRET is set, require a valid HMAC token bound to this\n      // taskId. In production, we REQUIRE A2A_SECRET to be set so unsigned\n      // dispatches are never accepted (an attacker who fishes a taskId out\n      // of logs / a share link could otherwise force-replay it). In\n      // development, a missing secret is permitted so local templates work\n      // out of the box, but we log a one-time warning so operators notice.\n      if (hasConfiguredA2ASecret()) {\n        const auth = getRequestHeader(event, \"authorization\");\n        const tok = extractBearerToken(auth);\n        if (!verifyInternalToken(taskId, tok ?? \"\")) {\n          setResponseStatus(event, 401);\n          return { error: \"Invalid or expired processor token\" };\n        }\n      } else if (isA2AProductionRuntime()) {\n        setResponseStatus(event, 503);\n        return {\n          error:\n            \"A2A processor not configured — set A2A_SECRET on this deployment to enable async A2A.\",\n        };\n      } else {\n        warnA2AUnauthOnce();\n      }\n\n      try {\n        await processA2ATaskFromQueue(taskId, config, event);\n        return { ok: true };\n      } catch (err: any) {\n        console.error(\"[a2a] process-task failed:\", err);\n        setResponseStatus(event, 500);\n        return { error: err?.message ?? \"process-task failed\" };\n      }\n    }),\n  );\n\n  // JSON-RPC A2A endpoint (with optional auth)\n  getH3App(nitroApp).use(\n    `${routePrefix}/a2a`,\n    defineEventHandler(async (event) => {\n      if (getMethod(event) !== \"POST\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n\n      // h3 prefix-matches mounts, so a request to `/a2a/_process-task`\n      // reaches this handler too. The dedicated mount above runs first and\n      // takes the request, but if that returns `undefined` (or h3 ever\n      // changes ordering semantics) defensively bail here. event.path is\n      // stripped to the remainder after the mount prefix.\n      const sub = (event.path || \"/\").split(\"?\")[0].replace(/^\\//, \"\");\n      if (sub.startsWith(\"_process-task\")) return;\n\n      const authHeader = getRequestHeader(event, \"authorization\");\n      const bearerToken = extractBearerToken(authHeader);\n      let verifiedCallerEmail: string | null = null;\n      let verifiedOrgDomain: string | null = null;\n      let legacyApiKeyAuthenticated = false;\n      let bearerTokenRejectedByJwt = false;\n\n      // SECURITY: when neither A2A_SECRET nor an apiKeyEnv is configured,\n      // there's no way to authenticate the caller. Default to \"auth required\"\n      // in production — return 503 with a clear message instead of running\n      // the agent loop unauthenticated. In development, log a one-time\n      // warning but allow so local templates work out of the box.\n      const hasA2ASecret = hasConfiguredA2ASecret();\n      const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);\n\n      // Try JWT verification first (org-level or global A2A_SECRET-based identity)\n      if (bearerToken) {\n        const tokenPayload = await verifyA2AToken(bearerToken, event);\n        verifiedCallerEmail = tokenPayload.email;\n        verifiedOrgDomain = tokenPayload.orgDomain;\n        bearerTokenRejectedByJwt = !verifiedCallerEmail;\n      }\n\n      // Fall back to legacy API key check (exact string match)\n      if (!verifiedCallerEmail && config.apiKeyEnv) {\n        const expectedKey = process.env[config.apiKeyEnv];\n        if (expectedKey) {\n          if (!bearerToken) {\n            setResponseStatus(event, 401);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: { code: -32001, message: \"Authentication required\" },\n            };\n          }\n          if (bearerToken !== expectedKey) {\n            setResponseStatus(event, 401);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: { code: -32001, message: \"Invalid API key\" },\n            };\n          }\n          legacyApiKeyAuthenticated = true;\n        }\n      }\n\n      if (!verifiedCallerEmail && !legacyApiKeyAuthenticated) {\n        // Any supplied bearer token that failed JWT verification is an auth\n        // failure after the legacy exact-match apiKeyEnv path has had a\n        // chance to succeed. Do not let bad tokens fall through to tasks/get\n        // and get reported as lookup misses.\n        if (bearerTokenRejectedByJwt) {\n          setResponseStatus(event, 401);\n          return {\n            jsonrpc: \"2.0\",\n            id: null,\n            error: {\n              code: -32001,\n              message: \"Invalid or expired A2A token\",\n            },\n          };\n        }\n\n        if (!hasA2ASecret && !hasApiKey) {\n          if (isA2AProductionRuntime()) {\n            setResponseStatus(event, 503);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: {\n                code: -32001,\n                message:\n                  \"A2A authentication not configured. Set A2A_SECRET (preferred) or configure apiKeyEnv to accept inbound A2A traffic.\",\n              },\n            };\n          }\n          warnA2AUnauthOnce();\n        } else if (isA2AProductionRuntime()) {\n          setResponseStatus(event, 401);\n          return {\n            jsonrpc: \"2.0\",\n            id: null,\n            error: {\n              code: -32001,\n              message: \"Authentication required\",\n            },\n          };\n        }\n      }\n\n      // Store verified caller identity on the event context so the handler\n      // can set request context from a trusted source instead of metadata\n      if (verifiedCallerEmail) {\n        event.context.__a2aVerifiedEmail = verifiedCallerEmail;\n      }\n      if (verifiedOrgDomain) {\n        event.context.__a2aOrgDomain = verifiedOrgDomain;\n      }\n\n      const body = await readBody(event);\n      return handleJsonRpcH3(body, event, config);\n    }),\n  );\n}\n\nexport function filterPublicAgentCardSkills(config: A2AConfig) {\n  return (config.skills ?? []).filter((skill) => {\n    const id =\n      (skill as { id?: string; name?: string }).id ??\n      (skill as { name?: string }).name ??\n      \"\";\n    if (typeof id === \"string\") {\n      if (id.startsWith(\"mcp__user_\") || id.startsWith(\"mcp__org_\")) {\n        return false;\n      }\n    }\n\n    if (skill.public === false || skill.requiresAuth || skill.isConsequential) {\n      return false;\n    }\n\n    if (!config.publicSkillsOnly) return true;\n\n    if (skill.publicAgent) {\n      return (\n        skill.publicAgent.expose === true &&\n        skill.publicAgent.readOnly === true &&\n        skill.publicAgent.requiresAuth !== true &&\n        skill.publicAgent.isConsequential !== true\n      );\n    }\n\n    return skill.public === true && skill.readOnly !== false;\n  });\n}\n"]}

package/dist/agent/production-agent.d.ts

@@ -461,11 +461,13 @@ export declare function repeatedSourceSweepGuardMessage(opts: {
     toolName: string;
     priorCalls: number;
     threshold?: number;
+    scope?: "tool" | "aggregate";
 }): string;
 export declare function shouldGuardRepeatedSourceSweep(opts: {
     toolName: string;
     entry: ActionEntry | undefined;
     priorToolCalls: readonly AgentLoopToolCallSummary[];
+    actions?: Record<string, ActionEntry>;
     threshold?: number;
 }): {
     toolName: string;

package/dist/agent/production-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"production-agent.d.ts","sourceRoot":"","sources":["../../src/agent/production-agent.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,IAAI,cAAc,EAAE,MAAM,IAAI,CAAC;AAkCzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,+BAA+B,CAAC;AAoCvC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAOhE,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,iBAAiB,EAGlB,MAAM,mBAAmB,CAAC;AAgB3B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,MAAM,EACN,QAAQ,EACR,eAAe,EAIhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAIL,SAAS,EACT,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AAgBxB,OAAO,KAAK,EACV,UAAU,EAEV,mBAAmB,EAEnB,cAAc,EACd,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,OAAQ,CAAC;AACxD,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,MAAM,MAAM,yBAAyB,GACjC;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IACE,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,iBAAiB,GAAG,sBAAsB,GAAG,QAAQ,CAAC;CAC/D,CAAC;AAmBN;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,UAAU,EAAE,OAAO,CAAC;IACpB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QACpC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,wEAAwE;QACxE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,GAAG,IAAI,CAAC,CAAC;IACV,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA6FrC;AA4CD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoE7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwB7B;AAED,sEAAsE;AACtE,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED;;;;GAIG;AACH,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEnE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,CACH,IAAI,EAAE,GAAG,EACT,OAAO,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,KAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACxB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qFAAqF;IACrF,IAAI,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,GAAG,KAAK,CAAC;IACvD;;0EAEsE;IACtE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;qDACiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;sDAGkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;qFACiF;IACjF,WAAW,CAAC,EAAE,OAAO,cAAc,EAAE,uBAAuB,CAAC;IAC7D;4EACwE;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;0BAEsB;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;oDAEgD;IAChD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;gDAK4C;IAC5C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;2EAEuE;IACvE,IAAI,CAAC,EAAE,OAAO,cAAc,EAAE,iBAAiB,CAAC;IAChD;;qCAEiC;IACjC,MAAM,CAAC,EAAE,OAAO,cAAc,EAAE,kBAAkB,CAAC;IACnD,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,iBAAiB,EAAE,kBAAkB,CAAC;IACtD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,aAAa,CAAC,EACV,OAAO,GACP,CAAC,CACC,IAAI,EAAE,GAAG,EACT,GAAG,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,KAC1C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;CACtC;AAED,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC;AAEtC,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,eAAO,MAAM,uBAAuB,ivBAQ2H,CAAC;AAwFhK,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,WAAW,GACjB,OAAO,CAkBT;AA2FD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAsD7B;AAED,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,0FAA0F;IAC1F,YAAY,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,CAAC,EACH,WAAW,GACX,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,aAAa,SAAS,KAAK,GAAG,KAAK,GAAG,GAAG,CAAC;IAC5D,uEAAuE;IACvE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IACvE,mEAAmE;IACnE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,kBAAkB,CAAC;KAC1B,KACG,IAAI,GACJ;QACE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,GACD,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,CAAC,CAAC;IACP;;;mDAG+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,4FAA4F;IAC5F,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,EACrC,QAAQ,EAAE,MAAM,KACb,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAChE,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,2BAA2B,CAAC;IACjD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,EAC1D,KAAK,EAAE,GAAG,GACT,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUxB;AA0HD,iBAAS,aAAa,IAAI,MAAM,CAE/B;AAMD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAoB3D;AAED,6CAA6C;AAC7C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAkEtD;AAeD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,EAAE,EACzB,QAAQ,SAAyB,GAChC,aAAa,EAAE,GAAG,IAAI,CA0BxB;AA4GD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC,GAAG,iBAAiB,EAAE,CA8FtB;AAyBD,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,0BAA0B,EAAE,GAAG,SAAS,GAChD,aAAa,EAAE,GAAG,IAAI,CA2GxB;AAoBD,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8CxB;AAqED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,wBAAwB,EAAE,CAAC;IACtC,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,kBAAkB,CAAC;CACnC;AAED,MAAM,MAAM,iCAAiC,GACzC,MAAM,GACN;IACE,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEN,MAAM,MAAM,2BAA2B,GAAG,CACxC,OAAO,EAAE,kCAAkC,KAEzC,iCAAiC,GACjC,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,iCAAiC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAYlE,eAAO,MAAM,8BAA8B,mOACuL,CAAC;AAEnO,MAAM,MAAM,2BAA2B,GACnC,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,iBAAiB,GACjB,qBAAqB,GACrB,aAAa,CAAC;AAElB,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,aAAa,EAAE,EACzB,MAAM,EAAE,2BAA2B,EACnC,OAAO,GAAE;IAAE,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAO,QA4BjD;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAsC5D;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,CACjD,GAAG,EAAE,OAAO,GACX,iBAAiB,GAAG,qBAAqB,CAa3C;AAqED,+EAA+E;AAC/E,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,aAAa,EAAE,GACxB,MAAM,GAAG,SAAS,CAMpB;AAmMD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,UAAU,EAAE,CAkBd;AAED,MAAM,MAAM,4BAA4B,GACpC;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,GACD;IACE,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,4BAA4B,CAAC,CA+HvC;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,EAAE,EACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAC1B,UAAU,EAAE,CAUd;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,GAAG,MAAM,CAST;AAsSD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAsBT;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC;IAC/B,cAAc,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAgBnE;AA6FD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC;IAC9B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,2BAA2B,EAAE,4BAA4B,EAAE,CAAC;IACpF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,2BAA2B,CAAC;IACjD;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC1B,GAAG,OAAO,CAAC,cAAc,CAAC,CAutD1B;AAuDD,wBAAgB,2CAA2C,CACzD,MAAM,EAAE,SAAS,cAAc,EAAE,GAChC,MAAM,GAAG,SAAS,CAgHpB;AAgCD,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,SAAS,GACb,2BAA2B,CAkB7B;AAED,wBAAsB,6CAA6C,CACjE,IAAI,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG;IACzC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GACA,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAqGnD;AASD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACtD,kBAAkB,EAAE,OAAO,CAAC;IAC5B,GAAG,EAAE,SAAS,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC,GAAG,OAAO,CAWV;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAE3D,sDAAsD;AACtD,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAChD,0BAA0B,EAAE,MAAM,EAClC,cAAc,EAAE,MAAM,EACtB,uBAAuB,GAAE,MAA8C,GACtE,2BAA2B,CAM7B;AAED,wBAAsB,uCAAuC,CAAC,IAAI,EAAE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,2BAA2B,CAAC;IAChD,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,IAAI,CAAC,EAAE;QACL,wBAAwB,CAAC,EAAE,OAAO,wBAAwB,CAAC;QAC3D,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;QACjC,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;KACpD,CAAC;CACH,GAAG,OAAO,CAAC,OAAO,CAAC,CAqCnB;AAED,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,OAAO,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,IAAI,CAAC,EAAE;QACL,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;QACjD,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;QAC7B,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;QAC/C,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;KAChD,CAAC;CACH,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA2CnE;AAED,gFAAgF;AAChF,MAAM,WAAW,iCAAiC;IAChD,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAC3C,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IAC7B,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACnD,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACvD,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,wBAAwB,CAAC,EAAE,OAAO,wBAAwB,CAAC;IAC3D,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACnD,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,uCAAuC,CAAC,EAAE,OAAO,uCAAuC,CAAC;IACzF,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IACrC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B;IACzC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAClC;;;;sEAIkE;IAClE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACtD,yBAAyB,EAAE,OAAO,CAAC;IACnC,gCAAgC,EAAE,OAAO,CAAC;CAC3C,GAAG,0BAA0B,CAoB7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,SAAS,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB;4EACwE;IACxE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,2BAA2B,EAAE,MAAM,CAAC;IACpC,yBAAyB,EAAE,OAAO,CAAC;IACnC;;;;;gFAK4E;IAC5E,gCAAgC,CAAC,EAAE,OAAO,CAAC;IAC3C,IAAI,CAAC,EAAE,iCAAiC,CAAC;CAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CAgThB;AA+BD,wBAAgB,kCAAkC,CAAC,EACjD,KAAK,EACL,aAAa,EACb,gBAAgB,GACjB,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,GAAG,eAAe,GAAG,SAAS,CAK9B;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,sBAAsB,GAC9B,cAAc,CAk+DhB;AAED,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,MAAM,EACN,QAAQ,EACR,eAAe,EACf,cAAc,GACf,CAAC"}
+{"version":3,"file":"production-agent.d.ts","sourceRoot":"","sources":["../../src/agent/production-agent.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,IAAI,cAAc,EAAE,MAAM,IAAI,CAAC;AAkCzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,+BAA+B,CAAC;AAoCvC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAOhE,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,iBAAiB,EAGlB,MAAM,mBAAmB,CAAC;AAgB3B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,MAAM,EACN,QAAQ,EACR,eAAe,EAIhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAIL,SAAS,EACT,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AAgBxB,OAAO,KAAK,EACV,UAAU,EAEV,mBAAmB,EAEnB,cAAc,EACd,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,OAAQ,CAAC;AACxD,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,MAAM,MAAM,yBAAyB,GACjC;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IACE,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,iBAAiB,GAAG,sBAAsB,GAAG,QAAQ,CAAC;CAC/D,CAAC;AAmBN;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,UAAU,EAAE,OAAO,CAAC;IACpB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QACpC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,wEAAwE;QACxE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,GAAG,IAAI,CAAC,CAAC;IACV,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA6FrC;AA4CD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoE7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwB7B;AAED,sEAAsE;AACtE,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED;;;;GAIG;AACH,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEnE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,CACH,IAAI,EAAE,GAAG,EACT,OAAO,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,KAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACxB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qFAAqF;IACrF,IAAI,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,GAAG,KAAK,CAAC;IACvD;;0EAEsE;IACtE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;qDACiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;sDAGkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;qFACiF;IACjF,WAAW,CAAC,EAAE,OAAO,cAAc,EAAE,uBAAuB,CAAC;IAC7D;4EACwE;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;0BAEsB;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;oDAEgD;IAChD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;gDAK4C;IAC5C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;2EAEuE;IACvE,IAAI,CAAC,EAAE,OAAO,cAAc,EAAE,iBAAiB,CAAC;IAChD;;qCAEiC;IACjC,MAAM,CAAC,EAAE,OAAO,cAAc,EAAE,kBAAkB,CAAC;IACnD,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,iBAAiB,EAAE,kBAAkB,CAAC;IACtD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,aAAa,CAAC,EACV,OAAO,GACP,CAAC,CACC,IAAI,EAAE,GAAG,EACT,GAAG,CAAC,EAAE,OAAO,cAAc,EAAE,gBAAgB,KAC1C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;CACtC;AAED,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC;AAEtC,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,eAAO,MAAM,uBAAuB,ivBAQ2H,CAAC;AAwFhK,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,WAAW,GACjB,OAAO,CAkBT;AA2FD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAsD7B;AAED,MAAM,WAAW,sBAAsB;IACrC,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,0FAA0F;IAC1F,YAAY,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,CAAC,EACH,WAAW,GACX,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,aAAa,SAAS,KAAK,GAAG,KAAK,GAAG,GAAG,CAAC;IAC5D,uEAAuE;IACvE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IACvE,mEAAmE;IACnE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,kBAAkB,CAAC;KAC1B,KACG,IAAI,GACJ;QACE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,GACD,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,CAAC,CAAC;IACP;;;mDAG+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,4FAA4F;IAC5F,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,EACrC,QAAQ,EAAE,MAAM,KACb,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAChE,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,2BAA2B,CAAC;IACjD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,EAC1D,KAAK,EAAE,GAAG,GACT,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUxB;AA0HD,iBAAS,aAAa,IAAI,MAAM,CAE/B;AAMD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAoB3D;AAED,6CAA6C;AAC7C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAkEtD;AAeD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,EAAE,EACzB,QAAQ,SAAyB,GAChC,aAAa,EAAE,GAAG,IAAI,CA0BxB;AA4GD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC,GAAG,iBAAiB,EAAE,CA8FtB;AAyBD,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,0BAA0B,EAAE,GAAG,SAAS,GAChD,aAAa,EAAE,GAAG,IAAI,CA2GxB;AAoBD,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8CxB;AAqED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,wBAAwB,EAAE,CAAC;IACtC,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,kBAAkB,CAAC;CACnC;AAED,MAAM,MAAM,iCAAiC,GACzC,MAAM,GACN;IACE,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEN,MAAM,MAAM,2BAA2B,GAAG,CACxC,OAAO,EAAE,kCAAkC,KAEzC,iCAAiC,GACjC,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,iCAAiC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAYlE,eAAO,MAAM,8BAA8B,mOACuL,CAAC;AAEnO,MAAM,MAAM,2BAA2B,GACnC,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,iBAAiB,GACjB,qBAAqB,GACrB,aAAa,CAAC;AAElB,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,aAAa,EAAE,EACzB,MAAM,EAAE,2BAA2B,EACnC,OAAO,GAAE;IAAE,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAO,QA4BjD;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAsC5D;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,CACjD,GAAG,EAAE,OAAO,GACX,iBAAiB,GAAG,qBAAqB,CAa3C;AAqED,+EAA+E;AAC/E,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,aAAa,EAAE,GACxB,MAAM,GAAG,SAAS,CAMpB;AAmMD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,UAAU,EAAE,CAkBd;AAED,MAAM,MAAM,4BAA4B,GACpC;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,GACD;IACE,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,4BAA4B,CAAC,CA+HvC;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,EAAE,EACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAC1B,UAAU,EAAE,CAUd;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,GAAG,MAAM,CAST;AAyTD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;CAC9B,GAAG,MAAM,CA0BT;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC;IAC/B,cAAc,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAoCnE;AA6FD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC;IAC9B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,2BAA2B,EAAE,4BAA4B,EAAE,CAAC;IACpF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,2BAA2B,CAAC;IACjD;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC1B,GAAG,OAAO,CAAC,cAAc,CAAC,CAwtD1B;AAuDD,wBAAgB,2CAA2C,CACzD,MAAM,EAAE,SAAS,cAAc,EAAE,GAChC,MAAM,GAAG,SAAS,CAgHpB;AAgCD,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,SAAS,GACb,2BAA2B,CAkB7B;AAED,wBAAsB,6CAA6C,CACjE,IAAI,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG;IACzC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GACA,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAqGnD;AASD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACtD,kBAAkB,EAAE,OAAO,CAAC;IAC5B,GAAG,EAAE,SAAS,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC,GAAG,OAAO,CAWV;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAE3D,sDAAsD;AACtD,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAChD,0BAA0B,EAAE,MAAM,EAClC,cAAc,EAAE,MAAM,EACtB,uBAAuB,GAAE,MAA8C,GACtE,2BAA2B,CAM7B;AAED,wBAAsB,uCAAuC,CAAC,IAAI,EAAE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,2BAA2B,CAAC;IAChD,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,IAAI,CAAC,EAAE;QACL,wBAAwB,CAAC,EAAE,OAAO,wBAAwB,CAAC;QAC3D,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;QACjC,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;KACpD,CAAC;CACH,GAAG,OAAO,CAAC,OAAO,CAAC,CAqCnB;AAED,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,OAAO,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,IAAI,CAAC,EAAE;QACL,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;QACjD,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;QAC7B,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;QAC/C,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;KAChD,CAAC;CACH,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA2CnE;AAED,gFAAgF;AAChF,MAAM,WAAW,iCAAiC;IAChD,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAC3C,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IAC7B,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACnD,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACvD,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,wBAAwB,CAAC,EAAE,OAAO,wBAAwB,CAAC;IAC3D,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACnD,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,uCAAuC,CAAC,EAAE,OAAO,uCAAuC,CAAC;IACzF,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IACrC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B;IACzC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAClC;;;;sEAIkE;IAClE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACtD,yBAAyB,EAAE,OAAO,CAAC;IACnC,gCAAgC,EAAE,OAAO,CAAC;CAC3C,GAAG,0BAA0B,CAoB7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,SAAS,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB;4EACwE;IACxE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,2BAA2B,EAAE,MAAM,CAAC;IACpC,yBAAyB,EAAE,OAAO,CAAC;IACnC;;;;;gFAK4E;IAC5E,gCAAgC,CAAC,EAAE,OAAO,CAAC;IAC3C,IAAI,CAAC,EAAE,iCAAiC,CAAC;CAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CAgThB;AA+BD,wBAAgB,kCAAkC,CAAC,EACjD,KAAK,EACL,aAAa,EACb,gBAAgB,GACjB,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,GAAG,eAAe,GAAG,SAAS,CAK9B;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,sBAAsB,GAC9B,cAAc,CAk+DhB;AAED,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,MAAM,EACN,QAAQ,EACR,eAAe,EACf,cAAc,GACf,CAAC"}