@agent-native/core 0.101.10 → 0.101.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (79) hide show
  1. package/corpus/README.md +1 -1
  2. package/corpus/core/CHANGELOG.md +6 -0
  3. package/corpus/core/package.json +1 -1
  4. package/corpus/core/src/a2a/client.ts +23 -1
  5. package/corpus/core/src/a2a/handlers.ts +65 -1
  6. package/corpus/core/src/a2a/server.ts +124 -0
  7. package/corpus/core/src/a2a/task-store.ts +253 -0
  8. package/corpus/core/src/a2a/types.ts +26 -0
  9. package/corpus/core/src/agent/production-agent.ts +5 -2
  10. package/corpus/core/src/mcp/builtin-tools.ts +25 -1
  11. package/corpus/core/src/scripts/call-agent.ts +22 -3
  12. package/corpus/core/src/server/agent-chat-plugin.ts +86 -1
  13. package/corpus/core/src/templates/workspace-core/.agents/skills/a2a-protocol/SKILL.md +25 -0
  14. package/corpus/templates/content/.agents/skills/document-editing/SKILL.md +23 -0
  15. package/corpus/templates/content/app/components/editor/MathRenderer.tsx +43 -0
  16. package/corpus/templates/content/app/components/editor/SlashCommandMenu.tsx +260 -4
  17. package/corpus/templates/content/app/components/editor/extensions/NotionExtensions.tsx +78 -0
  18. package/corpus/templates/content/app/global.css +53 -0
  19. package/corpus/templates/content/app/i18n/zh-TW.ts +13 -0
  20. package/corpus/templates/content/app/i18n-data.ts +163 -0
  21. package/corpus/templates/content/app/root.tsx +2 -0
  22. package/corpus/templates/content/changelog/2026-07-14-latex-equations-render-in-documents-public-pages-and-exports.md +6 -0
  23. package/corpus/templates/content/package.json +1 -0
  24. package/corpus/templates/content/shared/document-export.ts +296 -25
  25. package/corpus/templates/content/shared/inline-math.ts +128 -0
  26. package/corpus/templates/content/shared/math-rendering.ts +50 -0
  27. package/corpus/templates/content/shared/nfm.ts +17 -14
  28. package/corpus/templates/content/vite.config.ts +0 -1
  29. package/corpus/templates/mail/.agents/skills/email-drafts/SKILL.md +17 -0
  30. package/corpus/templates/mail/AGENTS.md +21 -19
  31. package/corpus/templates/mail/actions/create-attachment-upload.ts +49 -0
  32. package/corpus/templates/mail/changelog/2026-07-14-connected-agents-can-now-securely-upload-local-files-for-mai.md +6 -0
  33. package/corpus/templates/mail/server/handlers/media.ts +84 -61
  34. package/corpus/templates/mail/server/lib/attachment-upload-ticket.ts +234 -0
  35. package/corpus/templates/mail/server/lib/mail-connector-catalog.ts +8 -4
  36. package/corpus/templates/mail/server/lib/media-upload.ts +114 -0
  37. package/corpus/templates/mail/server/plugins/auth.ts +9 -1
  38. package/corpus/templates/mail/server/routes/api/media/attachment-upload/[uploadId].put.ts +1 -0
  39. package/dist/a2a/client.d.ts +5 -1
  40. package/dist/a2a/client.d.ts.map +1 -1
  41. package/dist/a2a/client.js +18 -1
  42. package/dist/a2a/client.js.map +1 -1
  43. package/dist/a2a/handlers.d.ts.map +1 -1
  44. package/dist/a2a/handlers.js +57 -8
  45. package/dist/a2a/handlers.js.map +1 -1
  46. package/dist/a2a/server.d.ts.map +1 -1
  47. package/dist/a2a/server.js +87 -1
  48. package/dist/a2a/server.js.map +1 -1
  49. package/dist/a2a/task-store.d.ts +27 -0
  50. package/dist/a2a/task-store.d.ts.map +1 -1
  51. package/dist/a2a/task-store.js +216 -0
  52. package/dist/a2a/task-store.js.map +1 -1
  53. package/dist/a2a/types.d.ts +24 -0
  54. package/dist/a2a/types.d.ts.map +1 -1
  55. package/dist/a2a/types.js.map +1 -1
  56. package/dist/agent/production-agent.d.ts +1 -0
  57. package/dist/agent/production-agent.d.ts.map +1 -1
  58. package/dist/agent/production-agent.js +5 -2
  59. package/dist/agent/production-agent.js.map +1 -1
  60. package/dist/collab/struct-routes.d.ts +1 -1
  61. package/dist/file-upload/actions/upload-image.d.ts +1 -1
  62. package/dist/mcp/builtin-tools.d.ts.map +1 -1
  63. package/dist/mcp/builtin-tools.js +22 -3
  64. package/dist/mcp/builtin-tools.js.map +1 -1
  65. package/dist/notifications/routes.d.ts +3 -3
  66. package/dist/observability/routes.d.ts +5 -5
  67. package/dist/resources/handlers.d.ts +3 -3
  68. package/dist/scripts/call-agent.d.ts +1 -1
  69. package/dist/scripts/call-agent.d.ts.map +1 -1
  70. package/dist/scripts/call-agent.js +19 -1
  71. package/dist/scripts/call-agent.js.map +1 -1
  72. package/dist/secrets/routes.d.ts +9 -9
  73. package/dist/server/agent-chat-plugin.d.ts.map +1 -1
  74. package/dist/server/agent-chat-plugin.js +71 -2
  75. package/dist/server/agent-chat-plugin.js.map +1 -1
  76. package/dist/server/agent-engine-api-key-route.d.ts +1 -1
  77. package/dist/templates/workspace-core/.agents/skills/a2a-protocol/SKILL.md +25 -0
  78. package/package.json +1 -1
  79. package/src/templates/workspace-core/.agents/skills/a2a-protocol/SKILL.md +25 -0
package/dist/a2a/handlers.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/a2a/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAE1D,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,EAChC,4CAA4C,EAC5C,mCAAmC,EACnC,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EACV,yBAAyB,EACzB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAWzB,qEAAqE;AACrE,0EAA0E;AAC1E,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AACjE,MAAM,oCAAoC,GAAG,KAAK,CAAC;AACnD,MAAM,kCAAkC,GAAG,MAAM,CAAC;AAClD,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACpD,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAE3C;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,QAA6C;IAE7C,MAAM,GAAG,GAAG,QAAQ,EAAE,aAAa,CAAC;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAsB;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,yBAAyB,CAAC;YAC/B,aAAa,EAAE,SAAS,CAAC,KAAY,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,QAA6C,EAC7C,KAAsB;IAEtB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IACE,cAAc;QACd,CAAC,cAAc,KAAK,cAAc,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC,EAC5E,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CACzB,QAA6C,EAC7C,KAAsB;IAEtB,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAChC,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,aAAa;QAAE,OAAO,CAAC,aAAa,GAAG,aAAa,CAAC;;QACpD,OAAO,OAAO,CAAC,aAAa,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAChD,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAChD,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CACpC,KAAU,EACV,MAAc,EACd,MAAiB;IAEjB,MAAM,cAAc,GAAG,sCAAsC,EAAE,CAAC;IAChE,MAAM,mBAAmB,GACvB,mCAAmC,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,qBAAqB;KACvC,CAAC,IAAI,4CAA4C,CAAC,cAAc,CAAC,CAAC;IAErE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,oBAAoB,CAAC;YACzB,KAAK;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM;SACP,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,oBAAoB,CAAC;YACzB,KAAK;YACL,IAAI,EAAE,cAAc;YACpB,MAAM;YACN,IAAI,EAAE;gBACJ,CAAC,gCAAgC,CAAC,EAAE,8BAA8B;aACnE;YACD,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,eAAe,EAAE,CAAC;QACzB,kEAAkE;QAClE,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,OAAO,CAAC,KAAK,CACX,+EAA+E,EAC/E,eAAe,CAChB,CAAC;QACF,MAAM,oBAAoB,CAAC;YACzB,KAAK;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM;YACN,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,mDAAmD;YACnD,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,oCAAoC;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,MAAiB,EACjB,KAAW;IAEX,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0DAA0D;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,uBAAuB,CAAC,MAAM,EAAE;YACpC,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC;aACvE;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IACjE,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAA4B,CAAC;IAC9E,MAAM,aAAa,GAAG,aAAa,CAAC,aAAmC,CAAC;IACxE,MAAM,aAAa,GAAG,aAAa,CAAC,aAAmC,CAAC;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,aAAa,GACjB,yBAAyB,CAAC,aAAa,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,SAAS,GACZ,aAAa,CAAC,SAAuC,IAAI,SAAS,CAAC;IACtE,MAAM,cAAc,GACjB,aAAa,CAAC,cAGD,IAAI,SAAS,CAAC;IAE9B,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,aAAa,EACb,aAAa,CACd,CAAC;IAEF,MAAM,EAAE,qBAAqB,EAAE,GAC7B,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,sBAAsB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3C,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAC5D,CAAC;IACJ,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAE9B,SACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,qBAAqB,CACzB;YACE,SAAS,EAAE,aAAa;YACxB,KAAK,EAAE,aAAa;YACpB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,EACD,GAAG,EAAE,CACH,oBAAoB,CAClB,MAAM,EACN,OAAO,EACP,MAAM,EACN,SAAS,EACT,cAAc,EACd,KAAK,CACN,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,MAAM,EAAE;gBACpC,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,IAAI,iBAAiB,EAAE,CAAC;iBACnE;aACF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,cAAc,GAAe,KAAK,EACtC,OAAgB,EAChB,QAA2B,EACA,EAAE;IAC7B,kCAAkC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK;SACvB,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;aAC9D;SACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,wDAAwD;IACxD,4EAA4E;IAC5E,oEAAoE;IACpE,yEAAyE;IACzE,8BAA8B;IAC9B,qEAAqE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,+DAA+D,UAAU,sNAAsN,IAAI,EAAE;QACvS,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAEnD,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,6BAA6B;YAC1C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACvC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM;oBACzB,CAAC,CAAC;wBACE;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,kBAAkB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBACrD;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;SACF;QACD,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACxD,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,UAAU,CAAC,MAAiB;IACnC,OAAO,MAAM,CAAC,OAAO,IAAI,cAAc,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CACnB,EAA0B,EAC1B,IAAY,EACZ,OAAe;IAEf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,EAAmB,EAAE,MAAe;IACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAc,EACd,SAAkB,EAClB,QAAkC,EAClC,KAAW;IAKX,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAsB;QACjC,MAAM;QACN,SAAS;QACT,QAAQ;QACR,KAAK;QACL,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ;YACnC,MAAM,QAAQ,GAAa;gBACzB,IAAI;gBACJ,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC;wBACE;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE;gCACJ,IAAI;gCACJ,QAAQ;gCACR,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;6BAC/C;yBACF;qBACF;oBACH,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;aACtC,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAClC,QAA6C,EAC7C,KAAsB,EACtB,EAAoB;IAEpB,MAAM,EAAE,qBAAqB,EAAE,GAC7B,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAE/C,MAAM,aAAa,GAChB,KAAK,EAAE,OAAO,EAAE,kBAAyC,IAAI,SAAS,CAAC;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,qCAAqC;IACrC,MAAM,SAAS,GACZ,KAAK,EAAE,OAAO,EAAE,cAAqC,IAAI,SAAS,CAAC;IAEtE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE/D,OAAO,qBAAqB,CAC1B;QACE,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,aAAa;QACpB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,EACD,EAAE,CACW,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,aAAiC,EACjC,iBAAqC;IAErC,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YACxD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnE,OAAO,CAAC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC,IAAI,SAAS,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,OAAgB,EAChB,MAAiB,EACjB,SAA6B,EAC7B,QAA6C,EAC7C,KAAW;IAEX,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAC/C,MAAM,EACN,SAAS,EACT,QAAQ,EACR,KAAK,CACN,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEpD,IACE,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,aAAa,IAAI,MAAM,EAC9B,CAAC;YACD,IAAI,WAAgC,CAAC;YACrC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAiC,EAAE,CAAC;gBAC1D,WAAW,GAAG,GAAG,CAAC;YACpB,CAAC;YACD,MAAM,uBAAuB,CAAC,MAAM,EAAE;gBACpC,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,MAAO,MAAoC,CAAC;QAClE,MAAM,YAAY,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,uBAAuB,CAAC,MAAM,EAAE;YACpC,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,SAAS,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,uBAAuB,CAAC,MAAM,EAAE;YACpC,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,IAAI,gBAAgB,EAAE,CAAC;aAClE;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAA+B,EAC/B,MAAiB,EACjB,KAAW;IAEX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAkB,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO;YACL,GAAG,YAAY,CACb,CAAC,EACD,CAAC,KAAK,EACN,sDAAsD,CACvD;YACD,GAAG,EAAE,CAAC;SACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAA+B,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAA+C,CAAC;IAExE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,6BAA6B;IAC7B,MAAM,iBAAiB,GACpB,KAAK,EAAE,OAAO,EAAE,kBAAyC,IAAI,IAAI,CAAC;IAErE,sEAAsE;IACtE,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,kEAAkE;IAClE,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,SAAS,GACb,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC,CAAC;IAE9E,IAAI,SAAS,EAAE,CAAC;QACd,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,IAAI,sBAAsB,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5D,OAAO;gBACL,GAAG,YAAY,CACb,CAAC,EACD,CAAC,KAAK,EACN,+EAA+E,CAChF;gBACD,GAAG,EAAE,CAAC;aACP,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,aAAa,GAChB,KAAK,EAAE,OAAO,EAAE,kBAAyC,IAAI,SAAS,CAAC;QAC1E,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,aAAa,GAChB,KAAK,EAAE,OAAO,EAAE,cAAqC,IAAI,SAAS,CAAC;QACtE,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAEzD,MAAM,YAAY,GAA4B;YAC5C,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YACvB,eAAe,EAAE;gBACf,aAAa;gBACb,aAAa;gBACb,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,cAAc,EAAE,YAAY,IAAI,IAAI;aACrC;SACF,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,OAAO,EACP,SAAS,EACT,YAAY,EACZ,iBAAiB,CAClB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEhE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,2DAA2D;QAC3D,mEAAmE;QACnE,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,OAAO,EACP,SAAS,EACT,SAAS,EACT,iBAAiB,CAClB,CAAC;QACF,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,kBAAkB,CAC5B,IAAI,CAAC,EAAE,EACP,SAAS,EACT,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,EACnC,KAAK,CACN,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAExD,IACE,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,CAAC,aAAa,IAAI,MAAM,EAC9B,CAAC;gBACD,IAAI,WAAgC,CAAC;gBACrC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAiC,EAAE,CAAC;oBAC1D,WAAW,GAAG,GAAG,CAAC;gBACpB,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;oBACxC,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,WAAW;oBACpB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;iBAChE,CAAC,CAAC;gBACH,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YAClD,CAAC;YAED,MAAM,aAAa,GAAG,MAAO,MAAoC,CAAC;YAClE,MAAM,YAAY,GAAG;gBACnB,GAAG,GAAG,CAAC,SAAS;gBAChB,GAAG,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,CAAC;aACnC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBACxC,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,SAAS,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC9D,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBACxB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;iBACjE;aACF,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC;gBAC3D,GAAG,EAAE,CAAC;aACP,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAA+B,EAC/B,MAAiB,EACjB,GAAwD,EACxD,KAAW;IAEX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAkB,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CACP,SAAS,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,MAAM,CACzE,CAAC;QACF,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAA+B,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAA+C,CAAC;IACxE,MAAM,iBAAiB,GACpB,KAAK,EAAE,OAAO,EAAE,kBAAyC,IAAI,IAAI,CAAC;IAErE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,OAAO,EACP,SAAS,EACT,SAAS,EACT,iBAAiB,CAClB,CAAC;QAEF,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEhD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAC/C,IAAI,CAAC,EAAE,EACP,SAAS,EACT,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,EACnC,KAAK,CACN,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEpD,IACE,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,CAAC,aAAa,IAAI,MAAM,EAC9B,CAAC;gBACD,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAiC,EAAE,CAAC;oBAC1D,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;wBAC7C,KAAK,EAAE,SAAS;wBAChB,OAAO,EAAE,GAAG;qBACb,CAAC,CAAC;oBACH,GAAG,CAAC,KAAK,CACP,SAAS,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,MAAM,CAC9D,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,aAAa,GAAG,MAAO,MAAoC,CAAC;gBAClE,MAAM,YAAY,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;oBACxC,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,aAAa,CAAC,OAAO;oBAC9B,SAAS,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;iBAC9D,CAAC,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBACtC,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC9D,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/C,GAAG,CAAC,KAAK,CACP,SAAS,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,CACxF,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,aAAa;IACb,WAAW;IACX,WAAW;IACX,aAAa;IACb,cAAc;IACd,QAAQ;IACR,eAAe;IACf,eAAe;IACf,QAAQ;CACT,CAAC,CAAC;AAEH,SAAS,uBAAuB,CAAC,IAAS;IACxC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAmC,CAAC;IACtD,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,iBAAiB;YAAE,SAAS;QACtC,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7C,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAC1B,cAA6B,EAC7B,KAAU,EACV,MAAiB;IAEjB,MAAM,aAAa,GAChB,KAAK,EAAE,OAAO,EAAE,kBAAyC,IAAI,IAAI,CAAC;IACrE,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;IAE9C,IAAI,YAAY,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAChD,mEAAmE;QACnE,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,qDAAqD;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,MAA+B,EAC/B,KAAU,EACV,MAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAY,CAAC;IAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,4BAA4B,CACpD,EAAE,EACF,KAAK,EACL,MAAM,CACP,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACd,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,OAAO;YAAE,OAAO,aAAa,CAAC,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,aAAa,CAAC,CAAC,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAAc,EACd,KAAU,EACV,MAAiB;IAEjB,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe;QAAE,OAAO,KAAK,CAAC;IAEnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,oBAAoB,GAAG,GAAG,GAAG,sBAAsB,EAAE,CAAC;QAC5D,IAAI,KAAK,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;YAC5C,sEAAsE;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,OAAO,sBAAsB,CAC3B,MAAM,EACN,oBAAoB,EACpB,kGAAkG,CACnG,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG,kCAAkC,EAAE,CAAC;YAChE,IAAI,CAAC,CAAC,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,oDAAoD,EACpD,GAAG,CACJ,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,qBAAqB,GAAG,GAAG,GAAG,6BAA6B,CAAC;QAClE,MAAM,wBAAwB,GAAG,GAAG,GAAG,0BAA0B,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,qBAAqB,CAAC;QACzD,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,IAAI,wBAAwB,CAAC;QACnE,IAAI,OAAO,IAAI,cAAc,EAAE,CAAC;YAC9B,+DAA+D;YAC/D,yEAAyE;YACzE,wEAAwE;YACxE,OAAO,gBAAgB,CACrB,MAAM,EACN,qBAAqB,EACrB,OAAO;gBACL,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,kFAAkF,EACtF,wBAAwB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAA+B,EAC/B,KAAU,EACV,MAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAY,CAAC;IAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,aAAa,CAAC,CAAC,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAS,EACT,KAAU,EACV,MAAiB;IAEjB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAI,IAAI,CAAC,MAAkC,IAAI,EAAE,CAAC;IAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IAEnB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,cAAc,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACvD,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;YACpC,OAAO,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAqB,CAAC;QAChD,CAAC;QACD,KAAK,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,YAAY,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;YAC7D,CAAC;YACD,8CAA8C;YAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;YAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,YAAY,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;YAC7D,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAC;YAC9D,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YACtD,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YACrD,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,SAAgB,CAAC,CAAC,gCAAgC;QAC3D,CAAC;QACD,KAAK,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAqB,CAAC;QAC9C,CAAC;QACD,KAAK,cAAc,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACzD,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAqB,CAAC;QAC9C,CAAC;QACD;YACE,OAAO,YAAY,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC","sourcesContent":["import { setResponseHeader, setResponseStatus } from \"h3\";\n\nimport {\n AGENT_BACKGROUND_PROCESSOR_A2A,\n AGENT_BACKGROUND_PROCESSOR_FIELD,\n dispatchPathTargetsNetlifyBackgroundFunction,\n isAgentChatDurableBackgroundEnabled,\n resolveAgentChatProcessRunDispatchPath,\n} from \"../agent/durable-background.js\";\nimport { withConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { getOrigin, isConfiguredAppOrigin } from \"../server/google-oauth.js\";\nimport { fireInternalDispatch } from \"../server/self-dispatch.js\";\nimport { agentChat } from \"../shared/agent-chat.js\";\nimport {\n hasConfiguredA2ASecret,\n isA2AProductionRuntime,\n} from \"./auth-policy.js\";\nimport {\n createTask,\n getTask,\n getTaskOwner,\n updateTask,\n claimA2ATaskForProcessing,\n getA2ATaskDispatchState,\n failStuckA2ATask,\n failStuckQueuedA2ATask,\n settleProcessingA2ATask,\n touchQueuedA2ATaskDispatch,\n touchProcessingA2ATask,\n} from \"./task-store.js\";\nimport type {\n A2AConfig,\n A2AHandler,\n A2AHandlerContext,\n A2AHandlerResult,\n JsonRpcResponse,\n Message,\n Artifact,\n} from \"./types.js\";\n\n// Inlined to avoid pulling the entire core-routes-plugin (and its h3\n// transitive deps) into the a2a/handlers test boundary. Must stay in sync\n// with FRAMEWORK_ROUTE_PREFIX in `server/core-routes-plugin.ts`.\nconst A2A_PROCESS_TASK_PATH = \"/_agent-native/a2a/_process-task\";\nconst PORTABLE_FALLBACK_HANDOFF_TIMEOUT_MS = 1_000;\nconst A2A_QUEUED_DISPATCH_STUCK_AFTER_MS = 10_000;\nconst A2A_PROCESSING_STUCK_AFTER_MS = 5 * 60 * 1000;\nconst A2A_PROCESSING_HEARTBEAT_MS = 30_000;\n\n/**\n * Request origin is routing/link context, not an identity signal. Accept only\n * an absolute HTTP(S) origin from caller metadata so queued runs can preserve\n * custom-domain/workspace links without allowing arbitrary values to leak\n * into browser or artifact URLs.\n */\nfunction requestOriginFromMetadata(\n metadata: Record<string, unknown> | undefined,\n): string | undefined {\n const raw = metadata?.requestOrigin;\n if (typeof raw !== \"string\" || !raw.trim()) return undefined;\n try {\n const url = new URL(raw);\n if (url.protocol !== \"http:\" && url.protocol !== \"https:\") return undefined;\n return url.origin;\n } catch {\n return undefined;\n }\n}\n\nfunction requestOriginFromEvent(event: any | undefined): string | undefined {\n if (!event) return undefined;\n try {\n return requestOriginFromMetadata({\n requestOrigin: getOrigin(event as any),\n });\n } catch {\n return undefined;\n }\n}\n\n/**\n * Prefer the origin resolved from the receiving request. A distinct public\n * browser origin is allowed only when the receiver configured it explicitly;\n * arbitrary caller metadata must not steer links or service-token URLs.\n */\nfunction requestOriginForContext(\n metadata: Record<string, unknown> | undefined,\n event: any | undefined,\n): string | undefined {\n if (!event) return undefined;\n const receiverOrigin = requestOriginFromEvent(event);\n const metadataOrigin = requestOriginFromMetadata(metadata);\n if (\n metadataOrigin &&\n (metadataOrigin === receiverOrigin || isConfiguredAppOrigin(metadataOrigin))\n ) {\n return metadataOrigin;\n }\n return receiverOrigin;\n}\n\nfunction trustedA2AMetadata(\n metadata: Record<string, unknown> | undefined,\n event: any | undefined,\n): Record<string, unknown> | undefined {\n if (!metadata) return undefined;\n const trusted = { ...metadata };\n const requestOrigin = requestOriginForContext(metadata, event);\n if (requestOrigin) trusted.requestOrigin = requestOrigin;\n else delete trusted.requestOrigin;\n return trusted;\n}\n\n/**\n * Hard cap on how long a task may sit in submitted/working (never reaching\n * `processing`) before the dispatch-retry loop in\n * `refireStuckAsyncTaskIfNeeded` gives up and fails it. Without this, a\n * persistently failing dispatch (missing background function, bad A2A\n * secret, 404) throttles-and-retries forever — the queued bucket otherwise\n * has no terminal state. Override with A2A_QUEUED_LIFETIME_MAX_MS.\n */\nfunction a2aQueuedLifetimeMaxMs(): number {\n const raw = Number(process.env.A2A_QUEUED_LIFETIME_MAX_MS);\n if (Number.isFinite(raw) && raw > 0) return raw;\n return 3 * 60 * 1000;\n}\n\n/**\n * Hard cap on total time a task may spend in `processing`, independent of\n * the liveness heartbeat. `A2A_PROCESSING_STUCK_AFTER_MS` alone only catches\n * a dead process — a hung await inside a still-alive process keeps\n * `updated_at` fresh via the heartbeat forever. This bounds that case\n * without cutting off legitimately long runs under it. Override with\n * A2A_PROCESSING_LIFETIME_MAX_MS.\n */\nfunction a2aProcessingLifetimeMaxMs(): number {\n const raw = Number(process.env.A2A_PROCESSING_LIFETIME_MAX_MS);\n if (Number.isFinite(raw) && raw > 0) return raw;\n return 30 * 60 * 1000;\n}\n\n/**\n * Dispatch an async A2A task to a fresh function execution. Apps that opted\n * into durable background runs reuse the emitted Netlify 15-minute worker;\n * other hosts and apps retain the normal portable self-webhook route.\n */\nasync function fireProcessTaskDispatch(\n event: any,\n taskId: string,\n config: A2AConfig,\n): Promise<void> {\n const backgroundPath = resolveAgentChatProcessRunDispatchPath();\n const useBackgroundWorker =\n isAgentChatDurableBackgroundEnabled({\n appOptIn: config.durableBackgroundRuns,\n }) && dispatchPathTargetsNetlifyBackgroundFunction(backgroundPath);\n\n if (!useBackgroundWorker) {\n await fireInternalDispatch({\n event,\n path: A2A_PROCESS_TASK_PATH,\n taskId,\n });\n return;\n }\n\n try {\n // A real Netlify background function acknowledges the enqueue quickly.\n // Await that acknowledgement so a missing or rejected worker can fall\n // back before the task is left in `working` with no processor.\n await fireInternalDispatch({\n event,\n path: backgroundPath,\n taskId,\n body: {\n [AGENT_BACKGROUND_PROCESSOR_FIELD]: AGENT_BACKGROUND_PROCESSOR_A2A,\n },\n awaitResponse: true,\n });\n } catch (backgroundError) {\n // Deploys can retain a runtime env opt-in after the corresponding\n // background function was removed from the build. Keep async A2A useful\n // in that state by falling back to the portable processor route, which\n // runs in the regular framework function with the same task/auth checks.\n console.error(\n \"[a2a] Durable background dispatch failed; falling back to portable processor:\",\n backgroundError,\n );\n await fireInternalDispatch({\n event,\n path: A2A_PROCESS_TASK_PATH,\n taskId,\n // The caller is about to return after a failed background handoff.\n // Await the portable route briefly so the request definitely leaves this\n // invocation, but do not hold async message/send open for the full agent\n // run. The target processor continues independently after this bounded\n // client-side timeout if the handler takes longer.\n awaitResponse: true,\n responseTimeoutMs: PORTABLE_FALLBACK_HANDOFF_TIMEOUT_MS,\n });\n }\n}\n\n/**\n * Process a previously-enqueued A2A task. Called by the `_process-task`\n * route in `server.ts`, in a fresh function execution. Atomically claims the\n * task, reconstructs the caller's request context from the task's metadata,\n * runs the handler, and persists the outcome.\n *\n * Idempotent on duplicate dispatches: the atomic claim returns null if some\n * other invocation already picked the task up, in which case we no-op.\n */\nexport async function processA2ATaskFromQueue(\n taskId: string,\n config: A2AConfig,\n event?: any,\n): Promise<void> {\n const claimed = await claimA2ATaskForProcessing(taskId);\n if (!claimed) {\n // Already in flight, terminal, or missing. Nothing to do.\n return;\n }\n\n const message = claimed.history?.[0];\n if (!message) {\n await settleProcessingA2ATask(taskId, {\n state: \"failed\",\n message: {\n role: \"agent\",\n parts: [{ type: \"text\", text: \"Task is missing its inbound message\" }],\n },\n });\n return;\n }\n\n const meta = (claimed.metadata ?? {}) as Record<string, unknown>;\n const processorMeta = (meta.__a2a_processor ?? {}) as Record<string, unknown>;\n const verifiedEmail = processorMeta.verifiedEmail as string | undefined;\n const orgDomainHint = processorMeta.orgDomainHint as string | undefined;\n // The processor metadata was created by the authenticated inbound handler\n // from that request's resolved origin. Prefer it over the processor event,\n // whose host may be an internal worker/dispatch origin. Legacy tasks that\n // predate this metadata fall back to the processor event.\n const requestOrigin =\n requestOriginFromMetadata(processorMeta) ?? requestOriginFromEvent(event);\n const contextId =\n (processorMeta.contextId as string | null | undefined) ?? undefined;\n const callerMetadata =\n (processorMeta.callerMetadata as\n | Record<string, unknown>\n | null\n | undefined) ?? undefined;\n\n const resolvedOrgId = await resolveVerifiedA2AOrgId(\n verifiedEmail,\n orgDomainHint,\n );\n\n const { runWithRequestContext } =\n await import(\"../server/request-context.js\");\n const heartbeat = setInterval(() => {\n touchProcessingA2ATask(taskId).catch((err) =>\n console.error(\"[a2a] Failed to heartbeat async task:\", err),\n );\n }, A2A_PROCESSING_HEARTBEAT_MS);\n (\n heartbeat as ReturnType<typeof setInterval> & { unref?: () => void }\n ).unref?.();\n try {\n await runWithRequestContext(\n {\n userEmail: verifiedEmail,\n orgId: resolvedOrgId,\n ...(requestOrigin ? { requestOrigin } : {}),\n },\n () =>\n runHandlerAndPersist(\n taskId,\n message,\n config,\n contextId,\n callerMetadata,\n event,\n ),\n );\n } catch (err: any) {\n try {\n await settleProcessingA2ATask(taskId, {\n state: \"failed\",\n message: {\n role: \"agent\",\n parts: [{ type: \"text\", text: err?.message ?? \"Handler crashed\" }],\n },\n });\n } catch {}\n } finally {\n clearInterval(heartbeat);\n }\n}\n\n/**\n * Default A2A handler that delegates to agentChat.call().\n * Used when no custom handler is provided in A2AConfig.\n */\nconst defaultHandler: A2AHandler = async (\n message: Message,\n _context: A2AHandlerContext,\n): Promise<A2AHandlerResult> => {\n // Extract text from message parts\n const text = message.parts\n .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n .map((p) => p.text)\n .join(\"\\n\");\n\n if (!text) {\n return {\n message: {\n role: \"agent\",\n parts: [{ type: \"text\", text: \"No text content in message\" }],\n },\n };\n }\n\n // A2A note: this message arrived from a different app — the caller cannot\n // see this app's local state (open deck, selected slide, etc.). They only\n // see whatever this agent puts into the reply text. So:\n // 1) include any concrete result (deck/document/dashboard URL, ID, value)\n // explicitly in the reply — the caller can't navigate locally.\n // 2) URLs must be fully-qualified — relative paths resolve against the\n // caller's host and 404.\n // We prepend a one-line hint to the user message so the agent knows.\n const baseUrl = process.env.APP_URL || process.env.URL || \"\";\n const appBaseUrl = baseUrl ? withConfiguredAppBasePath(baseUrl) : \"\";\n const augmentedText = baseUrl\n ? `[Cross-app A2A request — the caller is on a different host (${appBaseUrl} is yours, theirs is different). Include the concrete result (URL, ID, value) explicitly in your reply text; the caller can't see your local UI state. Any URL MUST be fully-qualified, never a relative path.]\\n\\n${text}`\n : text;\n\n const result = await agentChat.call(augmentedText);\n\n const artifacts: Artifact[] = [];\n if (result.filesChanged.length > 0) {\n artifacts.push({\n name: \"files-changed\",\n description: \"Files modified by the agent\",\n parts: [{ type: \"data\", data: { files: result.filesChanged } }],\n });\n }\n\n return {\n message: {\n role: \"agent\",\n parts: [\n { type: \"text\", text: result.response },\n ...(result.warnings?.length\n ? [\n {\n type: \"text\" as const,\n text: `\\n\\nWarnings:\\n${result.warnings.join(\"\\n\")}`,\n },\n ]\n : []),\n ],\n },\n artifacts: artifacts.length > 0 ? artifacts : undefined,\n };\n};\n\nfunction getHandler(config: A2AConfig): A2AHandler {\n return config.handler ?? defaultHandler;\n}\n\nfunction jsonRpcError(\n id: string | number | null,\n code: number,\n message: string,\n): JsonRpcResponse {\n return { jsonrpc: \"2.0\", id, error: { code, message } };\n}\n\nfunction jsonRpcResult(id: string | number, result: unknown): JsonRpcResponse {\n return { jsonrpc: \"2.0\", id, result };\n}\n\nfunction makeHandlerContext(\n taskId: string,\n contextId?: string,\n metadata?: Record<string, unknown>,\n event?: any,\n): {\n context: A2AHandlerContext;\n artifacts: Artifact[];\n} {\n const artifacts: Artifact[] = [];\n const context: A2AHandlerContext = {\n taskId,\n contextId,\n metadata,\n event,\n writeArtifact(name, content, mimeType) {\n const artifact: Artifact = {\n name,\n parts: mimeType\n ? [\n {\n type: \"file\",\n file: {\n name,\n mimeType,\n bytes: Buffer.from(content).toString(\"base64\"),\n },\n },\n ]\n : [{ type: \"text\", text: content }],\n };\n artifacts.push(artifact);\n return name;\n },\n };\n return { context, artifacts };\n}\n\n/**\n * Resolve org context from A2A metadata / event context and wrap `fn`\n * inside `runWithRequestContext` so downstream actions see the org.\n */\nasync function withA2ARequestContext<T>(\n metadata: Record<string, unknown> | undefined,\n event: any | undefined,\n fn: () => Promise<T>,\n): Promise<T> {\n const { runWithRequestContext } =\n await import(\"../server/request-context.js\");\n\n const verifiedEmail =\n (event?.context?.__a2aVerifiedEmail as string | undefined) ?? undefined;\n // Only trust the org domain from the cryptographically verified JWT claim on\n // the event context. metadata.orgDomain is caller-supplied and must not be\n // used for org resolution — an unauthenticated caller could forge it and\n // gain access to another org's data.\n const orgDomain =\n (event?.context?.__a2aOrgDomain as string | undefined) ?? undefined;\n\n const resolvedOrgId = await resolveVerifiedA2AOrgId(verifiedEmail, orgDomain);\n const requestOrigin = requestOriginForContext(metadata, event);\n\n return runWithRequestContext(\n {\n userEmail: verifiedEmail,\n orgId: resolvedOrgId,\n ...(requestOrigin ? { requestOrigin } : {}),\n },\n fn,\n ) as Promise<T>;\n}\n\nasync function resolveVerifiedA2AOrgId(\n verifiedEmail: string | undefined,\n verifiedOrgDomain: string | undefined,\n): Promise<string | undefined> {\n if (verifiedOrgDomain) {\n try {\n const { resolveOrgByDomain } = await import(\"../org/context.js\");\n const org = await resolveOrgByDomain(verifiedOrgDomain);\n if (org) return org.orgId;\n } catch {\n // Org tables may not exist — continue without org context\n }\n }\n\n if (verifiedEmail) {\n try {\n const { resolveOrgIdForEmail } = await import(\"../org/context.js\");\n return (await resolveOrgIdForEmail(verifiedEmail)) ?? undefined;\n } catch {\n // Org tables may not exist — continue without org context\n }\n }\n\n return undefined;\n}\n\n/**\n * Run the handler against the message and persist the outcome to the task store.\n * Used in sync mode (awaited inline) and in async mode (called by the\n * `_process-task` processor route in a fresh function execution).\n */\nasync function runHandlerAndPersist(\n taskId: string,\n message: Message,\n config: A2AConfig,\n contextId: string | undefined,\n metadata: Record<string, unknown> | undefined,\n event?: any,\n): Promise<void> {\n const { context, artifacts } = makeHandlerContext(\n taskId,\n contextId,\n metadata,\n event,\n );\n try {\n const result = getHandler(config)(message, context);\n\n if (\n result &&\n typeof result === \"object\" &&\n Symbol.asyncIterator in result\n ) {\n let lastMessage: Message | undefined;\n for await (const msg of result as AsyncGenerator<Message>) {\n lastMessage = msg;\n }\n await settleProcessingA2ATask(taskId, {\n state: \"completed\",\n message: lastMessage,\n artifacts: artifacts.length > 0 ? artifacts : undefined,\n });\n return;\n }\n\n const handlerResult = await (result as Promise<A2AHandlerResult>);\n const allArtifacts = [...artifacts, ...(handlerResult.artifacts ?? [])];\n await settleProcessingA2ATask(taskId, {\n state: \"completed\",\n message: handlerResult.message,\n artifacts: allArtifacts.length > 0 ? allArtifacts : undefined,\n });\n } catch (err: any) {\n await settleProcessingA2ATask(taskId, {\n state: \"failed\",\n message: {\n role: \"agent\",\n parts: [{ type: \"text\", text: err?.message ?? \"Handler failed\" }],\n },\n });\n }\n}\n\nasync function handleSend(\n params: Record<string, unknown>,\n config: A2AConfig,\n event?: any,\n): Promise<JsonRpcResponse & { _id: string | number }> {\n const message = params.message as Message;\n if (!message || !message.role || !Array.isArray(message.parts)) {\n return {\n ...jsonRpcError(\n 0,\n -32602,\n \"Invalid params: message with role and parts required\",\n ),\n _id: 0,\n };\n }\n\n const contextId = params.contextId as string | undefined;\n const metadata = params.metadata as Record<string, unknown> | undefined;\n\n // The JWT-verified caller email (set by mountA2A in server.ts) is the\n // single source of truth for task ownership — bound at creation, checked\n // on every subsequent tasks/get and tasks/cancel call. Caller-supplied\n // metadata.userEmail is NEVER used for ownership; that would re-introduce\n // the IDOR class fixed here.\n const ownerEmailForTask =\n (event?.context?.__a2aVerifiedEmail as string | undefined) ?? null;\n\n // Async mode: return the task immediately in `working` state, run the\n // handler in the background, and let the caller poll `tasks/get`. This is\n // the workaround for synchronous serverless request timeouts when the handler\n // runs LLM + tool loops that can exceed a single HTTP invocation budget.\n // SECURITY: only honor the explicit top-level `params.async`. The\n // metadata.async fallback was caller-controlled and could force async\n // dispatch (which has weaker auth than the sync path) on otherwise sync\n // requests. Async is also refused entirely when no auth is configured in\n // production — see the additional gate below.\n const asyncMode =\n params.async === true || (event && event.context?.__a2aForceAsync === true);\n\n if (asyncMode) {\n // Refuse async mode entirely when no auth is configured in production.\n // The async dispatch path self-fires the `_process-task` route, which\n // accepts unsigned dispatches when A2A_SECRET is unset — that combined\n // with the lack of caller identity here would let any unauthenticated\n // attacker queue and trigger handler runs. In production, require some\n // form of auth so the verifiedEmail is bound to the task.\n const hasA2ASecret = hasConfiguredA2ASecret();\n const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);\n if (isA2AProductionRuntime() && !hasA2ASecret && !hasApiKey) {\n return {\n ...jsonRpcError(\n 0,\n -32001,\n \"A2A async mode is not available — A2A_SECRET or apiKeyEnv must be configured.\",\n ),\n _id: 0,\n };\n }\n // Resolve identity up front (cheap), bake it into the task's metadata,\n // and dispatch the actual handler run to a SEPARATE function execution.\n // On serverless hosts (Netlify, Vercel, Cloudflare) detached promises get\n // killed when the response is flushed, so we self-fire a webhook to a\n // dedicated processor route — same cross-platform pattern the integration\n // webhook queue uses. The processor reconstructs the request context from\n // the task metadata and runs the handler with its own full timeout.\n const verifiedEmail =\n (event?.context?.__a2aVerifiedEmail as string | undefined) ?? undefined;\n // Only trust the verified org domain from the JWT claim — do not fall back\n // to metadata.orgDomain which is caller-supplied and unverified.\n const orgDomainHint =\n (event?.context?.__a2aOrgDomain as string | undefined) ?? undefined;\n const requestOrigin = requestOriginForContext(metadata, event);\n const safeMetadata = trustedA2AMetadata(metadata, event);\n\n const taskMetadata: Record<string, unknown> = {\n ...(safeMetadata ?? {}),\n __a2a_processor: {\n verifiedEmail,\n orgDomainHint,\n ...(requestOrigin ? { requestOrigin } : {}),\n contextId: contextId ?? null,\n callerMetadata: safeMetadata ?? null,\n },\n };\n const task = await createTask(\n message,\n contextId,\n taskMetadata,\n ownerEmailForTask,\n );\n const working = await updateTask(task.id, { state: \"working\" });\n\n // Awaited, not fire-and-forget: this handler is about to return, and a\n // detached dispatch fetch racing only a short settle timer can be killed\n // mid-flight when the serverless response is flushed WITHOUT rejecting —\n // see the `awaitResponse` doc on `fireInternalDispatch` in\n // server/self-dispatch.ts. The durable worker path gets a fast 202\n // acknowledgement; a stale-worker fallback uses a short bounded timeout\n // because the portable route responds after processing the task.\n try {\n await fireProcessTaskDispatch(event, task.id, config);\n } catch (err) {\n console.error(\"[a2a] Failed to dispatch process-task:\", err);\n }\n\n return { ...jsonRpcResult(0, working ?? task), _id: 0 };\n }\n\n return withA2ARequestContext(metadata, event, async () => {\n const task = await createTask(\n message,\n contextId,\n undefined,\n ownerEmailForTask,\n );\n await updateTask(task.id, { state: \"working\" });\n\n const ctx = makeHandlerContext(\n task.id,\n contextId,\n trustedA2AMetadata(metadata, event),\n event,\n );\n\n try {\n const result = getHandler(config)(message, ctx.context);\n\n if (\n result &&\n typeof result === \"object\" &&\n Symbol.asyncIterator in result\n ) {\n let lastMessage: Message | undefined;\n for await (const msg of result as AsyncGenerator<Message>) {\n lastMessage = msg;\n }\n const updated = await updateTask(task.id, {\n state: \"completed\",\n message: lastMessage,\n artifacts: ctx.artifacts.length > 0 ? ctx.artifacts : undefined,\n });\n return { ...jsonRpcResult(0, updated), _id: 0 };\n }\n\n const handlerResult = await (result as Promise<A2AHandlerResult>);\n const allArtifacts = [\n ...ctx.artifacts,\n ...(handlerResult.artifacts ?? []),\n ];\n const updated = await updateTask(task.id, {\n state: \"completed\",\n message: handlerResult.message,\n artifacts: allArtifacts.length > 0 ? allArtifacts : undefined,\n });\n return { ...jsonRpcResult(0, updated), _id: 0 };\n } catch (err: any) {\n await updateTask(task.id, {\n state: \"failed\",\n message: {\n role: \"agent\",\n parts: [{ type: \"text\", text: err.message ?? \"Handler failed\" }],\n },\n });\n return {\n ...jsonRpcError(0, -32000, err.message ?? \"Handler failed\"),\n _id: 0,\n };\n }\n });\n}\n\nasync function handleStream(\n params: Record<string, unknown>,\n config: A2AConfig,\n res: { write: (chunk: string) => void; end: () => void },\n event?: any,\n): Promise<void> {\n const message = params.message as Message;\n if (!message || !message.role || !Array.isArray(message.parts)) {\n res.write(\n `data: ${JSON.stringify(jsonRpcError(0, -32602, \"Invalid params\"))}\\n\\n`,\n );\n res.end();\n return;\n }\n\n const contextId = params.contextId as string | undefined;\n const metadata = params.metadata as Record<string, unknown> | undefined;\n const ownerEmailForTask =\n (event?.context?.__a2aVerifiedEmail as string | undefined) ?? null;\n\n await withA2ARequestContext(metadata, event, async () => {\n const task = await createTask(\n message,\n contextId,\n undefined,\n ownerEmailForTask,\n );\n\n await updateTask(task.id, { state: \"working\" });\n\n const { context, artifacts } = makeHandlerContext(\n task.id,\n contextId,\n trustedA2AMetadata(metadata, event),\n event,\n );\n\n try {\n const result = getHandler(config)(message, context);\n\n if (\n result &&\n typeof result === \"object\" &&\n Symbol.asyncIterator in result\n ) {\n for await (const msg of result as AsyncGenerator<Message>) {\n const intermediate = await updateTask(task.id, {\n state: \"working\",\n message: msg,\n });\n res.write(\n `data: ${JSON.stringify(jsonRpcResult(0, intermediate))}\\n\\n`,\n );\n }\n } else {\n const handlerResult = await (result as Promise<A2AHandlerResult>);\n const allArtifacts = [...artifacts, ...(handlerResult.artifacts ?? [])];\n const updated = await updateTask(task.id, {\n state: \"completed\",\n message: handlerResult.message,\n artifacts: allArtifacts.length > 0 ? allArtifacts : undefined,\n });\n res.write(`data: ${JSON.stringify(jsonRpcResult(0, updated))}\\n\\n`);\n res.end();\n return;\n }\n\n const allArtifacts = [...artifacts];\n const final = await updateTask(task.id, {\n state: \"completed\",\n artifacts: allArtifacts.length > 0 ? allArtifacts : undefined,\n });\n res.write(`data: ${JSON.stringify(jsonRpcResult(0, final))}\\n\\n`);\n } catch (err: any) {\n await updateTask(task.id, { state: \"failed\" });\n res.write(\n `data: ${JSON.stringify(jsonRpcError(0, -32000, err.message ?? \"Handler failed\"))}\\n\\n`,\n );\n }\n\n res.end();\n });\n}\n\n/**\n * Caller-supplied metadata keys that may contain sensitive bearer / OAuth\n * material. Always stripped from `tasks/get` responses so a leaked task id\n * never discloses an OAuth token even when the original sender carelessly\n * stuffed one into `metadata` (see `production-agent.ts:1144-1156` for the\n * historical googleToken propagation pattern).\n */\nconst SENSITIVE_METADATA_KEYS = new Set([\n \"googleToken\",\n \"userEmail\",\n \"orgDomain\",\n \"accessToken\",\n \"refreshToken\",\n \"apiKey\",\n \"Authorization\",\n \"authorization\",\n \"bearer\",\n]);\n\nfunction sanitizeTaskForResponse(task: any): any {\n if (!task || typeof task !== \"object\") return task;\n if (!task.metadata || typeof task.metadata !== \"object\") return task;\n\n const meta = task.metadata as Record<string, unknown>;\n const publicMeta: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(meta)) {\n if (k === \"__a2a_processor\") continue;\n if (SENSITIVE_METADATA_KEYS.has(k)) continue;\n publicMeta[k] = v;\n }\n return { ...task, metadata: publicMeta };\n}\n\n/**\n * Reject access when the task has a recorded owner that doesn't match the\n * verified caller. Returns a 404-shaped JSON-RPC error to avoid disclosing\n * task existence to the wrong caller (enumeration via UUID lookup).\n *\n * - When the task has no recorded owner (legacy row from before the\n * owner_email migration) we allow access if some verifiable bearer token\n * was presented; otherwise we still reject so an unsigned caller can never\n * read or cancel arbitrary task ids.\n * - When neither A2A_SECRET nor apiKeyEnv is configured AND we're in\n * production, we refuse `tasks/get` and `tasks/cancel` outright — there's\n * no way to authenticate the caller, so the only safe response is \"not\n * found\".\n */\nfunction authorizeTaskAccess(\n taskOwnerEmail: string | null,\n event: any,\n config: A2AConfig,\n): JsonRpcResponse | null {\n const verifiedEmail =\n (event?.context?.__a2aVerifiedEmail as string | undefined) ?? null;\n const hasA2ASecret = hasConfiguredA2ASecret();\n const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);\n const inProduction = isA2AProductionRuntime();\n\n if (inProduction && !hasA2ASecret && !hasApiKey) {\n // No way to authenticate the caller in production — refuse access.\n return jsonRpcError(0, -32001, \"Task not found\");\n }\n\n if (taskOwnerEmail) {\n if (!verifiedEmail) {\n return jsonRpcError(0, -32001, \"Task not found\");\n }\n if (verifiedEmail.toLowerCase() !== taskOwnerEmail.toLowerCase()) {\n return jsonRpcError(0, -32001, \"Task not found\");\n }\n }\n // Legacy row (no owner_email recorded). The route-level auth gate is the\n // only thing protecting it — fall through and serve.\n return null;\n}\n\nasync function handleGet(\n params: Record<string, unknown>,\n event: any,\n config: A2AConfig,\n): Promise<JsonRpcResponse> {\n const id = params.id as string;\n if (!id) {\n return jsonRpcError(0, -32602, \"Invalid params: id required\");\n }\n const ownerEmail = await getTaskOwner(id);\n const denied = authorizeTaskAccess(ownerEmail, event, config);\n if (denied) return denied;\n\n const task = await getTask(id);\n if (!task) {\n return jsonRpcError(0, -32001, \"Task not found\");\n }\n const taskChanged = await refireStuckAsyncTaskIfNeeded(\n id,\n event,\n config,\n ).catch((err) => {\n console.error(\"[a2a] Failed to refire stuck async task:\", err);\n return false;\n });\n if (taskChanged) {\n const updated = await getTask(id);\n if (updated) return jsonRpcResult(0, sanitizeTaskForResponse(updated));\n }\n return jsonRpcResult(0, sanitizeTaskForResponse(task));\n}\n\nasync function refireStuckAsyncTaskIfNeeded(\n taskId: string,\n event: any,\n config: A2AConfig,\n): Promise<boolean> {\n const state = await getA2ATaskDispatchState(taskId);\n if (!state) return false;\n if (!state.metadata?.__a2a_processor) return false;\n\n const now = Date.now();\n\n if (state.statusState === \"submitted\" || state.statusState === \"working\") {\n const queuedLifetimeCutoff = now - a2aQueuedLifetimeMaxMs();\n if (state.createdAt <= queuedLifetimeCutoff) {\n // Dispatch has kept failing (or was never delivered) long enough that\n // retrying further would just repeat the same failure forever — stop\n // refiring and surface a terminal error instead of throttling forever.\n return failStuckQueuedA2ATask(\n taskId,\n queuedLifetimeCutoff,\n \"The async A2A task could not be started because dispatch kept failing. Please retry the request.\",\n );\n }\n\n if (state.updatedAt <= now - A2A_QUEUED_DISPATCH_STUCK_AFTER_MS) {\n if (!(await touchQueuedA2ATaskDispatch(taskId))) return false;\n try {\n await fireProcessTaskDispatch(event, taskId, config);\n } catch (err) {\n console.error(\n \"[a2a] Failed to refire stuck queued task dispatch:\",\n err,\n );\n return false;\n }\n return true;\n }\n return false;\n }\n\n if (state.statusState === \"processing\") {\n const processingStuckCutoff = now - A2A_PROCESSING_STUCK_AFTER_MS;\n const processingLifetimeCutoff = now - a2aProcessingLifetimeMaxMs();\n const isStale = state.updatedAt <= processingStuckCutoff;\n const isOverLifetime = state.createdAt <= processingLifetimeCutoff;\n if (isStale || isOverLifetime) {\n // A processor that died mid-handler may have already performed\n // side-effectful work. Retrying from the top can duplicate artifacts, so\n // fail deterministically and let the caller issue an intentional retry.\n return failStuckA2ATask(\n taskId,\n processingStuckCutoff,\n isStale\n ? \"The async A2A processor timed out before completing. Please retry the request.\"\n : \"The async A2A processor exceeded its maximum run time. Please retry the request.\",\n processingLifetimeCutoff,\n );\n }\n }\n\n return false;\n}\n\nasync function handleCancel(\n params: Record<string, unknown>,\n event: any,\n config: A2AConfig,\n): Promise<JsonRpcResponse> {\n const id = params.id as string;\n if (!id) {\n return jsonRpcError(0, -32602, \"Invalid params: id required\");\n }\n const ownerEmail = await getTaskOwner(id);\n const denied = authorizeTaskAccess(ownerEmail, event, config);\n if (denied) return denied;\n\n const task = await updateTask(id, { state: \"canceled\" });\n if (!task) {\n return jsonRpcError(0, -32001, \"Task not found\");\n }\n return jsonRpcResult(0, sanitizeTaskForResponse(task));\n}\n\n/**\n * H3-compatible JSON-RPC handler. Returns JSON directly (H3 serializes it).\n * Streaming is handled via H3's node response when needed.\n */\nexport async function handleJsonRpcH3(\n body: any,\n event: any,\n config: A2AConfig,\n): Promise<JsonRpcResponse> {\n if (!body || body.jsonrpc !== \"2.0\" || !body.method) {\n setResponseStatus(event, 400);\n return jsonRpcError(body?.id ?? null, -32600, \"Invalid JSON-RPC request\");\n }\n\n const params = (body.params as Record<string, unknown>) ?? {};\n const id = body.id;\n\n switch (body.method) {\n case \"message/send\": {\n const result = await handleSend(params, config, event);\n const { _id, ...response } = result;\n return { ...response, id } as JsonRpcResponse;\n }\n case \"message/stream\": {\n if (!config.streaming) {\n return jsonRpcError(id, -32601, \"Streaming not supported\");\n }\n // Use the raw node response for SSE streaming\n const res = event.node?.res;\n if (!res) {\n return jsonRpcError(id, -32000, \"Streaming not available\");\n }\n setResponseHeader(event, \"Content-Type\", \"text/event-stream\");\n setResponseHeader(event, \"Cache-Control\", \"no-cache\");\n setResponseHeader(event, \"Connection\", \"keep-alive\");\n await handleStream(params, config, res, event);\n return undefined as any; // Response already sent via SSE\n }\n case \"tasks/get\": {\n const result = await handleGet(params, event, config);\n return { ...result, id } as JsonRpcResponse;\n }\n case \"tasks/cancel\": {\n const result = await handleCancel(params, event, config);\n return { ...result, id } as JsonRpcResponse;\n }\n default:\n return jsonRpcError(id, -32601, `Method not found: ${body.method}`);\n }\n}\n"]}
1
+ {"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/a2a/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAE1D,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,EAChC,4CAA4C,EAC5C,mCAAmC,EACnC,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EACV,yBAAyB,EACzB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAYzB,qEAAqE;AACrE,0EAA0E;AAC1E,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AACjE,MAAM,oCAAoC,GAAG,KAAK,CAAC;AACnD,MAAM,kCAAkC,GAAG,MAAM,CAAC;AAClD,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACpD,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC,SAAS,sBAAsB,CAC7B,KAAc,EACd,KAAsB;IAEtB,2EAA2E;IAC3E,yEAAyE;IACzE,8CAA8C;IAC9C,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,kBAAkB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK;SACnB,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC;SAClC,MAAM,CACL,CAAC,SAAS,EAAkC,EAAE,CAC5C,CAAC,CAAC,SAAS;QACX,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAQ,SAAqC,CAAC,IAAI,KAAK,QAAQ;QAC/D,CAAC,CAAE,SAAqC,CAAC,IAAI,CAChD;SACA,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,QAA6C;IAE7C,MAAM,GAAG,GAAG,QAAQ,EAAE,aAAa,CAAC;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAsB;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,yBAAyB,CAAC;YAC/B,aAAa,EAAE,SAAS,CAAC,KAAY,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,QAA6C,EAC7C,KAAsB;IAEtB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IACE,cAAc;QACd,CAAC,cAAc,KAAK,cAAc,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC,EAC5E,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CACzB,QAA6C,EAC7C,KAAsB;IAEtB,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAChC,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,aAAa;QAAE,OAAO,CAAC,aAAa,GAAG,aAAa,CAAC;;QACpD,OAAO,OAAO,CAAC,aAAa,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAChD,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAChD,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CACpC,KAAU,EACV,MAAc,EACd,MAAiB;IAEjB,MAAM,cAAc,GAAG,sCAAsC,EAAE,CAAC;IAChE,MAAM,mBAAmB,GACvB,mCAAmC,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,qBAAqB;KACvC,CAAC,IAAI,4CAA4C,CAAC,cAAc,CAAC,CAAC;IAErE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,oBAAoB,CAAC;YACzB,KAAK;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM;SACP,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,oBAAoB,CAAC;YACzB,KAAK;YACL,IAAI,EAAE,cAAc;YACpB,MAAM;YACN,IAAI,EAAE;gBACJ,CAAC,gCAAgC,CAAC,EAAE,8BAA8B;aACnE;YACD,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,eAAe,EAAE,CAAC;QACzB,kEAAkE;QAClE,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,OAAO,CAAC,KAAK,CACX,+EAA+E,EAC/E,eAAe,CAChB,CAAC;QACF,MAAM,oBAAoB,CAAC;YACzB,KAAK;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM;YACN,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,mDAAmD;YACnD,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,oCAAoC;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,MAAiB,EACjB,KAAW;IAEX,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0DAA0D;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,uBAAuB,CAAC,MAAM,EAAE;YACpC,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC;aACvE;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IACjE,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAA4B,CAAC;IAC9E,MAAM,aAAa,GAAG,aAAa,CAAC,aAAmC,CAAC;IACxE,MAAM,aAAa,GAAG,aAAa,CAAC,aAAmC,CAAC;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,aAAa,GACjB,yBAAyB,CAAC,aAAa,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,SAAS,GACZ,aAAa,CAAC,SAAuC,IAAI,SAAS,CAAC;IACtE,MAAM,cAAc,GACjB,aAAa,CAAC,cAGD,IAAI,SAAS,CAAC;IAC9B,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC;QAClE,CAAC,CAAE,aAAa,CAAC,eAAuC;QACxD,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,aAAa,EACb,aAAa,CACd,CAAC;IAEF,MAAM,EAAE,qBAAqB,EAAE,GAC7B,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,sBAAsB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3C,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAC5D,CAAC;IACJ,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAE9B,SACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,qBAAqB,CACzB;YACE,SAAS,EAAE,aAAa;YACxB,KAAK,EAAE,aAAa;YACpB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,EACD,GAAG,EAAE,CACH,oBAAoB,CAClB,MAAM,EACN,OAAO,EACP,MAAM,EACN,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,MAAM,EAAE;gBACpC,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,IAAI,iBAAiB,EAAE,CAAC;iBACnE;aACF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,cAAc,GAAe,KAAK,EACtC,OAAgB,EAChB,QAA2B,EACA,EAAE;IAC7B,kCAAkC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK;SACvB,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;aAC9D;SACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,wDAAwD;IACxD,4EAA4E;IAC5E,oEAAoE;IACpE,yEAAyE;IACzE,8BAA8B;IAC9B,qEAAqE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,+DAA+D,UAAU,sNAAsN,IAAI,EAAE;QACvS,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAEnD,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,6BAA6B;YAC1C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACvC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM;oBACzB,CAAC,CAAC;wBACE;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,kBAAkB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBACrD;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;SACF;QACD,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACxD,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,UAAU,CAAC,MAAiB;IACnC,OAAO,MAAM,CAAC,OAAO,IAAI,cAAc,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CACnB,EAA0B,EAC1B,IAAY,EACZ,OAAe;IAEf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,EAAmB,EAAE,MAAe;IACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAc,EACd,SAAkB,EAClB,QAAkC,EAClC,KAAW,EACX,eAAqC;IAKrC,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAsB;QACjC,MAAM;QACN,SAAS;QACT,QAAQ;QACR,KAAK;QACL,eAAe;QACf,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ;YACnC,MAAM,QAAQ,GAAa;gBACzB,IAAI;gBACJ,KAAK,EAAE,QAAQ;oBACb,CAAC,CAAC;wBACE;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE;gCACJ,IAAI;gCACJ,QAAQ;gCACR,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;6BAC/C;yBACF;qBACF;oBACH,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;aACtC,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAClC,QAA6C,EAC7C,KAAsB,EACtB,EAAoB;IAEpB,MAAM,EAAE,qBAAqB,EAAE,GAC7B,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAE/C,MAAM,aAAa,GAChB,KAAK,EAAE,OAAO,EAAE,kBAAyC,IAAI,SAAS,CAAC;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,qCAAqC;IACrC,MAAM,SAAS,GACZ,KAAK,EAAE,OAAO,EAAE,cAAqC,IAAI,SAAS,CAAC;IAEtE,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE/D,OAAO,qBAAqB,CAC1B;QACE,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,aAAa;QACpB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,EACD,EAAE,CACW,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,aAAiC,EACjC,iBAAqC;IAErC,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YACxD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnE,OAAO,CAAC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC,IAAI,SAAS,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,OAAgB,EAChB,MAAiB,EACjB,SAA6B,EAC7B,QAA6C,EAC7C,KAAW,EACX,eAAqC;IAErC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAC/C,MAAM,EACN,SAAS,EACT,QAAQ,EACR,KAAK,EACL,eAAe,CAChB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEpD,IACE,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,aAAa,IAAI,MAAM,EAC9B,CAAC;YACD,IAAI,WAAgC,CAAC;YACrC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAiC,EAAE,CAAC;gBAC1D,WAAW,GAAG,GAAG,CAAC;YACpB,CAAC;YACD,IAAI,WAAW,EAAE,QAAQ,EAAE,oBAAoB,KAAK,gBAAgB,EAAE,CAAC;gBACrE,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,uBAAuB,CAAC,MAAM,EAAE;gBACpC,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,MAAO,MAAoC,CAAC;QAClE,MAAM,YAAY,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,aAAa,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;YACjD,MAAM,sBAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,uBAAuB,CAAC,MAAM,EAAE;YACpC,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,SAAS,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,uBAAuB,CAAC,MAAM,EAAE;YACpC,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,IAAI,gBAAgB,EAAE,CAAC;aAClE;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAA+B,EAC/B,MAAiB,EACjB,KAAW;IAEX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAkB,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO;YACL,GAAG,YAAY,CACb,CAAC,EACD,CAAC,KAAK,EACN,sDAAsD,CACvD;YACD,GAAG,EAAE,CAAC;SACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAA+B,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAA+C,CAAC;IACxE,MAAM,eAAe,GAAG,sBAAsB,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAE9E,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,6BAA6B;IAC7B,MAAM,iBAAiB,GACpB,KAAK,EAAE,OAAO,EAAE,kBAAyC,IAAI,IAAI,CAAC;IAErE,sEAAsE;IACtE,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,kEAAkE;IAClE,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,SAAS,GACb,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC,CAAC;IAE9E,IAAI,SAAS,EAAE,CAAC;QACd,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,IAAI,sBAAsB,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5D,OAAO;gBACL,GAAG,YAAY,CACb,CAAC,EACD,CAAC,KAAK,EACN,+EAA+E,CAChF;gBACD,GAAG,EAAE,CAAC;aACP,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,aAAa,GAChB,KAAK,EAAE,OAAO,EAAE,kBAAyC,IAAI,SAAS,CAAC;QAC1E,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,aAAa,GAChB,KAAK,EAAE,OAAO,EAAE,cAAqC,IAAI,SAAS,CAAC;QACtE,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAEzD,MAAM,YAAY,GAA4B;YAC5C,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YACvB,eAAe,EAAE;gBACf,aAAa;gBACb,aAAa;gBACb,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,cAAc,EAAE,YAAY,IAAI,IAAI;gBACpC,eAAe,EAAE,eAAe,IAAI,IAAI;aACzC;SACF,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,OAAO,EACP,SAAS,EACT,YAAY,EACZ,iBAAiB,CAClB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEhE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,2DAA2D;QAC3D,mEAAmE;QACnE,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO;YACL,GAAG,aAAa,CAAC,CAAC,EAAE,uBAAuB,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;YAC7D,GAAG,EAAE,CAAC;SACP,CAAC;IACJ,CAAC;IAED,OAAO,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,OAAO,EACP,SAAS,EACT,SAAS,EACT,iBAAiB,CAClB,CAAC;QACF,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,kBAAkB,CAC5B,IAAI,CAAC,EAAE,EACP,SAAS,EACT,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,EACnC,KAAK,EACL,eAAe,CAChB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAExD,IACE,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,CAAC,aAAa,IAAI,MAAM,EAC9B,CAAC;gBACD,IAAI,WAAgC,CAAC;gBACrC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAiC,EAAE,CAAC;oBAC1D,WAAW,GAAG,GAAG,CAAC;gBACpB,CAAC;gBACD,IAAI,WAAW,EAAE,QAAQ,EAAE,oBAAoB,KAAK,gBAAgB,EAAE,CAAC;oBACrE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;wBACxC,KAAK,EAAE,gBAAgB;wBACvB,OAAO,EAAE,WAAW;qBACrB,CAAC,CAAC;oBACH,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;gBAClD,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;oBACxC,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,WAAW;oBACpB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;iBAChE,CAAC,CAAC;gBACH,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YAClD,CAAC;YAED,MAAM,aAAa,GAAG,MAAO,MAAoC,CAAC;YAClE,MAAM,YAAY,GAAG;gBACnB,GAAG,GAAG,CAAC,SAAS;gBAChB,GAAG,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,CAAC;aACnC,CAAC;YACF,IAAI,aAAa,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;gBACjD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;oBACxC,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,aAAa,CAAC,OAAO;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YAClD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBACxC,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,SAAS,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC9D,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBACxB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;iBACjE;aACF,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC;gBAC3D,GAAG,EAAE,CAAC;aACP,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAA+B,EAC/B,MAAiB,EACjB,GAAwD,EACxD,KAAW;IAEX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAkB,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CACP,SAAS,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,MAAM,CACzE,CAAC;QACF,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAA+B,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAA+C,CAAC;IACxE,MAAM,eAAe,GAAG,sBAAsB,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9E,MAAM,iBAAiB,GACpB,KAAK,EAAE,OAAO,EAAE,kBAAyC,IAAI,IAAI,CAAC;IAErE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,OAAO,EACP,SAAS,EACT,SAAS,EACT,iBAAiB,CAClB,CAAC;QAEF,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEhD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAC/C,IAAI,CAAC,EAAE,EACP,SAAS,EACT,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,EACnC,KAAK,EACL,eAAe,CAChB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEpD,IACE,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,CAAC,aAAa,IAAI,MAAM,EAC9B,CAAC;gBACD,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAiC,EAAE,CAAC;oBAC1D,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;wBAC7C,KAAK,EAAE,SAAS;wBAChB,OAAO,EAAE,GAAG;qBACb,CAAC,CAAC;oBACH,GAAG,CAAC,KAAK,CACP,SAAS,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,MAAM,CAC9D,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,aAAa,GAAG,MAAO,MAAoC,CAAC;gBAClE,MAAM,YAAY,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;oBACxC,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,aAAa,CAAC,OAAO;oBAC9B,SAAS,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;iBAC9D,CAAC,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBACtC,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC9D,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/C,GAAG,CAAC,KAAK,CACP,SAAS,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,CACxF,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,aAAa;IACb,WAAW;IACX,WAAW;IACX,aAAa;IACb,cAAc;IACd,QAAQ;IACR,eAAe;IACf,eAAe;IACf,QAAQ;CACT,CAAC,CAAC;AAEH,SAAS,uBAAuB,CAAC,IAAS;IACxC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAmC,CAAC;IACtD,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,iBAAiB;YAAE,SAAS;QACtC,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7C,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAC1B,cAA6B,EAC7B,KAAU,EACV,MAAiB;IAEjB,MAAM,aAAa,GAChB,KAAK,EAAE,OAAO,EAAE,kBAAyC,IAAI,IAAI,CAAC;IACrE,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;IAE9C,IAAI,YAAY,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAChD,mEAAmE;QACnE,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,qDAAqD;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,MAA+B,EAC/B,KAAU,EACV,MAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAY,CAAC;IAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,4BAA4B,CACpD,EAAE,EACF,KAAK,EACL,MAAM,CACP,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACd,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,OAAO;YAAE,OAAO,aAAa,CAAC,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,aAAa,CAAC,CAAC,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAAc,EACd,KAAU,EACV,MAAiB;IAEjB,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe;QAAE,OAAO,KAAK,CAAC;IAEnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,oBAAoB,GAAG,GAAG,GAAG,sBAAsB,EAAE,CAAC;QAC5D,IAAI,KAAK,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;YAC5C,sEAAsE;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,OAAO,sBAAsB,CAC3B,MAAM,EACN,oBAAoB,EACpB,kGAAkG,CACnG,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG,kCAAkC,EAAE,CAAC;YAChE,IAAI,CAAC,CAAC,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,oDAAoD,EACpD,GAAG,CACJ,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,qBAAqB,GAAG,GAAG,GAAG,6BAA6B,CAAC;QAClE,MAAM,wBAAwB,GAAG,GAAG,GAAG,0BAA0B,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,qBAAqB,CAAC;QACzD,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,IAAI,wBAAwB,CAAC;QACnE,IAAI,OAAO,IAAI,cAAc,EAAE,CAAC;YAC9B,+DAA+D;YAC/D,yEAAyE;YACzE,wEAAwE;YACxE,OAAO,gBAAgB,CACrB,MAAM,EACN,qBAAqB,EACrB,OAAO;gBACL,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,kFAAkF,EACtF,wBAAwB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAA+B,EAC/B,KAAU,EACV,MAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAY,CAAC;IAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,aAAa,CAAC,CAAC,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAS,EACT,KAAU,EACV,MAAiB;IAEjB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAI,IAAI,CAAC,MAAkC,IAAI,EAAE,CAAC;IAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IAEnB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,cAAc,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACvD,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;YACpC,OAAO,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAqB,CAAC;QAChD,CAAC;QACD,KAAK,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,YAAY,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;YAC7D,CAAC;YACD,8CAA8C;YAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;YAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,YAAY,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;YAC7D,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAC;YAC9D,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YACtD,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YACrD,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,SAAgB,CAAC,CAAC,gCAAgC;QAC3D,CAAC;QACD,KAAK,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAqB,CAAC;QAC9C,CAAC;QACD,KAAK,cAAc,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACzD,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAqB,CAAC;QAC9C,CAAC;QACD;YACE,OAAO,YAAY,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC","sourcesContent":["import { setResponseHeader, setResponseStatus } from \"h3\";\n\nimport {\n AGENT_BACKGROUND_PROCESSOR_A2A,\n AGENT_BACKGROUND_PROCESSOR_FIELD,\n dispatchPathTargetsNetlifyBackgroundFunction,\n isAgentChatDurableBackgroundEnabled,\n resolveAgentChatProcessRunDispatchPath,\n} from \"../agent/durable-background.js\";\nimport { withConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { getOrigin, isConfiguredAppOrigin } from \"../server/google-oauth.js\";\nimport { fireInternalDispatch } from \"../server/self-dispatch.js\";\nimport { agentChat } from \"../shared/agent-chat.js\";\nimport {\n hasConfiguredA2ASecret,\n isA2AProductionRuntime,\n} from \"./auth-policy.js\";\nimport {\n createTask,\n getTask,\n getTaskOwner,\n updateTask,\n claimA2ATaskForProcessing,\n getA2ATaskDispatchState,\n failStuckA2ATask,\n failStuckQueuedA2ATask,\n settleProcessingA2ATask,\n touchQueuedA2ATaskDispatch,\n touchProcessingA2ATask,\n pauseProcessingA2ATask,\n} from \"./task-store.js\";\nimport type {\n A2AApprovedAction,\n A2AConfig,\n A2AHandler,\n A2AHandlerContext,\n A2AHandlerResult,\n JsonRpcResponse,\n Message,\n Artifact,\n} from \"./types.js\";\n\n// Inlined to avoid pulling the entire core-routes-plugin (and its h3\n// transitive deps) into the a2a/handlers test boundary. Must stay in sync\n// with FRAMEWORK_ROUTE_PREFIX in `server/core-routes-plugin.ts`.\nconst A2A_PROCESS_TASK_PATH = \"/_agent-native/a2a/_process-task\";\nconst PORTABLE_FALLBACK_HANDOFF_TIMEOUT_MS = 1_000;\nconst A2A_QUEUED_DISPATCH_STUCK_AFTER_MS = 10_000;\nconst A2A_PROCESSING_STUCK_AFTER_MS = 5 * 60 * 1000;\nconst A2A_PROCESSING_HEARTBEAT_MS = 30_000;\nconst MAX_A2A_APPROVED_ACTIONS = 10;\n\nfunction trustedApprovedActions(\n value: unknown,\n event: any | undefined,\n): A2AApprovedAction[] | undefined {\n // Static API keys and unsigned requests do not prove which user authorized\n // a consequential action. Only a verified identity-bearing JWT may carry\n // chat authorization across the A2A boundary.\n if (!event?.context?.__a2aVerifiedEmail || !Array.isArray(value)) {\n return undefined;\n }\n const approved = value\n .slice(0, MAX_A2A_APPROVED_ACTIONS)\n .filter(\n (candidate): candidate is A2AApprovedAction =>\n !!candidate &&\n typeof candidate === \"object\" &&\n typeof (candidate as Record<string, unknown>).tool === \"string\" &&\n !!(candidate as Record<string, unknown>).tool,\n )\n .map((candidate) => ({ tool: candidate.tool, input: candidate.input }));\n return approved.length > 0 ? approved : undefined;\n}\n\n/**\n * Request origin is routing/link context, not an identity signal. Accept only\n * an absolute HTTP(S) origin from caller metadata so queued runs can preserve\n * custom-domain/workspace links without allowing arbitrary values to leak\n * into browser or artifact URLs.\n */\nfunction requestOriginFromMetadata(\n metadata: Record<string, unknown> | undefined,\n): string | undefined {\n const raw = metadata?.requestOrigin;\n if (typeof raw !== \"string\" || !raw.trim()) return undefined;\n try {\n const url = new URL(raw);\n if (url.protocol !== \"http:\" && url.protocol !== \"https:\") return undefined;\n return url.origin;\n } catch {\n return undefined;\n }\n}\n\nfunction requestOriginFromEvent(event: any | undefined): string | undefined {\n if (!event) return undefined;\n try {\n return requestOriginFromMetadata({\n requestOrigin: getOrigin(event as any),\n });\n } catch {\n return undefined;\n }\n}\n\n/**\n * Prefer the origin resolved from the receiving request. A distinct public\n * browser origin is allowed only when the receiver configured it explicitly;\n * arbitrary caller metadata must not steer links or service-token URLs.\n */\nfunction requestOriginForContext(\n metadata: Record<string, unknown> | undefined,\n event: any | undefined,\n): string | undefined {\n if (!event) return undefined;\n const receiverOrigin = requestOriginFromEvent(event);\n const metadataOrigin = requestOriginFromMetadata(metadata);\n if (\n metadataOrigin &&\n (metadataOrigin === receiverOrigin || isConfiguredAppOrigin(metadataOrigin))\n ) {\n return metadataOrigin;\n }\n return receiverOrigin;\n}\n\nfunction trustedA2AMetadata(\n metadata: Record<string, unknown> | undefined,\n event: any | undefined,\n): Record<string, unknown> | undefined {\n if (!metadata) return undefined;\n const trusted = { ...metadata };\n const requestOrigin = requestOriginForContext(metadata, event);\n if (requestOrigin) trusted.requestOrigin = requestOrigin;\n else delete trusted.requestOrigin;\n return trusted;\n}\n\n/**\n * Hard cap on how long a task may sit in submitted/working (never reaching\n * `processing`) before the dispatch-retry loop in\n * `refireStuckAsyncTaskIfNeeded` gives up and fails it. Without this, a\n * persistently failing dispatch (missing background function, bad A2A\n * secret, 404) throttles-and-retries forever — the queued bucket otherwise\n * has no terminal state. Override with A2A_QUEUED_LIFETIME_MAX_MS.\n */\nfunction a2aQueuedLifetimeMaxMs(): number {\n const raw = Number(process.env.A2A_QUEUED_LIFETIME_MAX_MS);\n if (Number.isFinite(raw) && raw > 0) return raw;\n return 3 * 60 * 1000;\n}\n\n/**\n * Hard cap on total time a task may spend in `processing`, independent of\n * the liveness heartbeat. `A2A_PROCESSING_STUCK_AFTER_MS` alone only catches\n * a dead process — a hung await inside a still-alive process keeps\n * `updated_at` fresh via the heartbeat forever. This bounds that case\n * without cutting off legitimately long runs under it. Override with\n * A2A_PROCESSING_LIFETIME_MAX_MS.\n */\nfunction a2aProcessingLifetimeMaxMs(): number {\n const raw = Number(process.env.A2A_PROCESSING_LIFETIME_MAX_MS);\n if (Number.isFinite(raw) && raw > 0) return raw;\n return 30 * 60 * 1000;\n}\n\n/**\n * Dispatch an async A2A task to a fresh function execution. Apps that opted\n * into durable background runs reuse the emitted Netlify 15-minute worker;\n * other hosts and apps retain the normal portable self-webhook route.\n */\nasync function fireProcessTaskDispatch(\n event: any,\n taskId: string,\n config: A2AConfig,\n): Promise<void> {\n const backgroundPath = resolveAgentChatProcessRunDispatchPath();\n const useBackgroundWorker =\n isAgentChatDurableBackgroundEnabled({\n appOptIn: config.durableBackgroundRuns,\n }) && dispatchPathTargetsNetlifyBackgroundFunction(backgroundPath);\n\n if (!useBackgroundWorker) {\n await fireInternalDispatch({\n event,\n path: A2A_PROCESS_TASK_PATH,\n taskId,\n });\n return;\n }\n\n try {\n // A real Netlify background function acknowledges the enqueue quickly.\n // Await that acknowledgement so a missing or rejected worker can fall\n // back before the task is left in `working` with no processor.\n await fireInternalDispatch({\n event,\n path: backgroundPath,\n taskId,\n body: {\n [AGENT_BACKGROUND_PROCESSOR_FIELD]: AGENT_BACKGROUND_PROCESSOR_A2A,\n },\n awaitResponse: true,\n });\n } catch (backgroundError) {\n // Deploys can retain a runtime env opt-in after the corresponding\n // background function was removed from the build. Keep async A2A useful\n // in that state by falling back to the portable processor route, which\n // runs in the regular framework function with the same task/auth checks.\n console.error(\n \"[a2a] Durable background dispatch failed; falling back to portable processor:\",\n backgroundError,\n );\n await fireInternalDispatch({\n event,\n path: A2A_PROCESS_TASK_PATH,\n taskId,\n // The caller is about to return after a failed background handoff.\n // Await the portable route briefly so the request definitely leaves this\n // invocation, but do not hold async message/send open for the full agent\n // run. The target processor continues independently after this bounded\n // client-side timeout if the handler takes longer.\n awaitResponse: true,\n responseTimeoutMs: PORTABLE_FALLBACK_HANDOFF_TIMEOUT_MS,\n });\n }\n}\n\n/**\n * Process a previously-enqueued A2A task. Called by the `_process-task`\n * route in `server.ts`, in a fresh function execution. Atomically claims the\n * task, reconstructs the caller's request context from the task's metadata,\n * runs the handler, and persists the outcome.\n *\n * Idempotent on duplicate dispatches: the atomic claim returns null if some\n * other invocation already picked the task up, in which case we no-op.\n */\nexport async function processA2ATaskFromQueue(\n taskId: string,\n config: A2AConfig,\n event?: any,\n): Promise<void> {\n const claimed = await claimA2ATaskForProcessing(taskId);\n if (!claimed) {\n // Already in flight, terminal, or missing. Nothing to do.\n return;\n }\n\n const message = claimed.history?.[0];\n if (!message) {\n await settleProcessingA2ATask(taskId, {\n state: \"failed\",\n message: {\n role: \"agent\",\n parts: [{ type: \"text\", text: \"Task is missing its inbound message\" }],\n },\n });\n return;\n }\n\n const meta = (claimed.metadata ?? {}) as Record<string, unknown>;\n const processorMeta = (meta.__a2a_processor ?? {}) as Record<string, unknown>;\n const verifiedEmail = processorMeta.verifiedEmail as string | undefined;\n const orgDomainHint = processorMeta.orgDomainHint as string | undefined;\n // The processor metadata was created by the authenticated inbound handler\n // from that request's resolved origin. Prefer it over the processor event,\n // whose host may be an internal worker/dispatch origin. Legacy tasks that\n // predate this metadata fall back to the processor event.\n const requestOrigin =\n requestOriginFromMetadata(processorMeta) ?? requestOriginFromEvent(event);\n const contextId =\n (processorMeta.contextId as string | null | undefined) ?? undefined;\n const callerMetadata =\n (processorMeta.callerMetadata as\n | Record<string, unknown>\n | null\n | undefined) ?? undefined;\n const approvedActions = Array.isArray(processorMeta.approvedActions)\n ? (processorMeta.approvedActions as A2AApprovedAction[])\n : undefined;\n\n const resolvedOrgId = await resolveVerifiedA2AOrgId(\n verifiedEmail,\n orgDomainHint,\n );\n\n const { runWithRequestContext } =\n await import(\"../server/request-context.js\");\n const heartbeat = setInterval(() => {\n touchProcessingA2ATask(taskId).catch((err) =>\n console.error(\"[a2a] Failed to heartbeat async task:\", err),\n );\n }, A2A_PROCESSING_HEARTBEAT_MS);\n (\n heartbeat as ReturnType<typeof setInterval> & { unref?: () => void }\n ).unref?.();\n try {\n await runWithRequestContext(\n {\n userEmail: verifiedEmail,\n orgId: resolvedOrgId,\n ...(requestOrigin ? { requestOrigin } : {}),\n },\n () =>\n runHandlerAndPersist(\n taskId,\n message,\n config,\n contextId,\n callerMetadata,\n event,\n approvedActions,\n ),\n );\n } catch (err: any) {\n try {\n await settleProcessingA2ATask(taskId, {\n state: \"failed\",\n message: {\n role: \"agent\",\n parts: [{ type: \"text\", text: err?.message ?? \"Handler crashed\" }],\n },\n });\n } catch {}\n } finally {\n clearInterval(heartbeat);\n }\n}\n\n/**\n * Default A2A handler that delegates to agentChat.call().\n * Used when no custom handler is provided in A2AConfig.\n */\nconst defaultHandler: A2AHandler = async (\n message: Message,\n _context: A2AHandlerContext,\n): Promise<A2AHandlerResult> => {\n // Extract text from message parts\n const text = message.parts\n .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n .map((p) => p.text)\n .join(\"\\n\");\n\n if (!text) {\n return {\n message: {\n role: \"agent\",\n parts: [{ type: \"text\", text: \"No text content in message\" }],\n },\n };\n }\n\n // A2A note: this message arrived from a different app — the caller cannot\n // see this app's local state (open deck, selected slide, etc.). They only\n // see whatever this agent puts into the reply text. So:\n // 1) include any concrete result (deck/document/dashboard URL, ID, value)\n // explicitly in the reply — the caller can't navigate locally.\n // 2) URLs must be fully-qualified — relative paths resolve against the\n // caller's host and 404.\n // We prepend a one-line hint to the user message so the agent knows.\n const baseUrl = process.env.APP_URL || process.env.URL || \"\";\n const appBaseUrl = baseUrl ? withConfiguredAppBasePath(baseUrl) : \"\";\n const augmentedText = baseUrl\n ? `[Cross-app A2A request — the caller is on a different host (${appBaseUrl} is yours, theirs is different). Include the concrete result (URL, ID, value) explicitly in your reply text; the caller can't see your local UI state. Any URL MUST be fully-qualified, never a relative path.]\\n\\n${text}`\n : text;\n\n const result = await agentChat.call(augmentedText);\n\n const artifacts: Artifact[] = [];\n if (result.filesChanged.length > 0) {\n artifacts.push({\n name: \"files-changed\",\n description: \"Files modified by the agent\",\n parts: [{ type: \"data\", data: { files: result.filesChanged } }],\n });\n }\n\n return {\n message: {\n role: \"agent\",\n parts: [\n { type: \"text\", text: result.response },\n ...(result.warnings?.length\n ? [\n {\n type: \"text\" as const,\n text: `\\n\\nWarnings:\\n${result.warnings.join(\"\\n\")}`,\n },\n ]\n : []),\n ],\n },\n artifacts: artifacts.length > 0 ? artifacts : undefined,\n };\n};\n\nfunction getHandler(config: A2AConfig): A2AHandler {\n return config.handler ?? defaultHandler;\n}\n\nfunction jsonRpcError(\n id: string | number | null,\n code: number,\n message: string,\n): JsonRpcResponse {\n return { jsonrpc: \"2.0\", id, error: { code, message } };\n}\n\nfunction jsonRpcResult(id: string | number, result: unknown): JsonRpcResponse {\n return { jsonrpc: \"2.0\", id, result };\n}\n\nfunction makeHandlerContext(\n taskId: string,\n contextId?: string,\n metadata?: Record<string, unknown>,\n event?: any,\n approvedActions?: A2AApprovedAction[],\n): {\n context: A2AHandlerContext;\n artifacts: Artifact[];\n} {\n const artifacts: Artifact[] = [];\n const context: A2AHandlerContext = {\n taskId,\n contextId,\n metadata,\n event,\n approvedActions,\n writeArtifact(name, content, mimeType) {\n const artifact: Artifact = {\n name,\n parts: mimeType\n ? [\n {\n type: \"file\",\n file: {\n name,\n mimeType,\n bytes: Buffer.from(content).toString(\"base64\"),\n },\n },\n ]\n : [{ type: \"text\", text: content }],\n };\n artifacts.push(artifact);\n return name;\n },\n };\n return { context, artifacts };\n}\n\n/**\n * Resolve org context from A2A metadata / event context and wrap `fn`\n * inside `runWithRequestContext` so downstream actions see the org.\n */\nasync function withA2ARequestContext<T>(\n metadata: Record<string, unknown> | undefined,\n event: any | undefined,\n fn: () => Promise<T>,\n): Promise<T> {\n const { runWithRequestContext } =\n await import(\"../server/request-context.js\");\n\n const verifiedEmail =\n (event?.context?.__a2aVerifiedEmail as string | undefined) ?? undefined;\n // Only trust the org domain from the cryptographically verified JWT claim on\n // the event context. metadata.orgDomain is caller-supplied and must not be\n // used for org resolution — an unauthenticated caller could forge it and\n // gain access to another org's data.\n const orgDomain =\n (event?.context?.__a2aOrgDomain as string | undefined) ?? undefined;\n\n const resolvedOrgId = await resolveVerifiedA2AOrgId(verifiedEmail, orgDomain);\n const requestOrigin = requestOriginForContext(metadata, event);\n\n return runWithRequestContext(\n {\n userEmail: verifiedEmail,\n orgId: resolvedOrgId,\n ...(requestOrigin ? { requestOrigin } : {}),\n },\n fn,\n ) as Promise<T>;\n}\n\nasync function resolveVerifiedA2AOrgId(\n verifiedEmail: string | undefined,\n verifiedOrgDomain: string | undefined,\n): Promise<string | undefined> {\n if (verifiedOrgDomain) {\n try {\n const { resolveOrgByDomain } = await import(\"../org/context.js\");\n const org = await resolveOrgByDomain(verifiedOrgDomain);\n if (org) return org.orgId;\n } catch {\n // Org tables may not exist — continue without org context\n }\n }\n\n if (verifiedEmail) {\n try {\n const { resolveOrgIdForEmail } = await import(\"../org/context.js\");\n return (await resolveOrgIdForEmail(verifiedEmail)) ?? undefined;\n } catch {\n // Org tables may not exist — continue without org context\n }\n }\n\n return undefined;\n}\n\n/**\n * Run the handler against the message and persist the outcome to the task store.\n * Used in sync mode (awaited inline) and in async mode (called by the\n * `_process-task` processor route in a fresh function execution).\n */\nasync function runHandlerAndPersist(\n taskId: string,\n message: Message,\n config: A2AConfig,\n contextId: string | undefined,\n metadata: Record<string, unknown> | undefined,\n event?: any,\n approvedActions?: A2AApprovedAction[],\n): Promise<void> {\n const { context, artifacts } = makeHandlerContext(\n taskId,\n contextId,\n metadata,\n event,\n approvedActions,\n );\n try {\n const result = getHandler(config)(message, context);\n\n if (\n result &&\n typeof result === \"object\" &&\n Symbol.asyncIterator in result\n ) {\n let lastMessage: Message | undefined;\n for await (const msg of result as AsyncGenerator<Message>) {\n lastMessage = msg;\n }\n if (lastMessage?.metadata?.agentNativeTaskState === \"input-required\") {\n await pauseProcessingA2ATask(taskId, lastMessage);\n return;\n }\n await settleProcessingA2ATask(taskId, {\n state: \"completed\",\n message: lastMessage,\n artifacts: artifacts.length > 0 ? artifacts : undefined,\n });\n return;\n }\n\n const handlerResult = await (result as Promise<A2AHandlerResult>);\n const allArtifacts = [...artifacts, ...(handlerResult.artifacts ?? [])];\n if (handlerResult.taskState === \"input-required\") {\n await pauseProcessingA2ATask(taskId, handlerResult.message);\n return;\n }\n await settleProcessingA2ATask(taskId, {\n state: \"completed\",\n message: handlerResult.message,\n artifacts: allArtifacts.length > 0 ? allArtifacts : undefined,\n });\n } catch (err: any) {\n await settleProcessingA2ATask(taskId, {\n state: \"failed\",\n message: {\n role: \"agent\",\n parts: [{ type: \"text\", text: err?.message ?? \"Handler failed\" }],\n },\n });\n }\n}\n\nasync function handleSend(\n params: Record<string, unknown>,\n config: A2AConfig,\n event?: any,\n): Promise<JsonRpcResponse & { _id: string | number }> {\n const message = params.message as Message;\n if (!message || !message.role || !Array.isArray(message.parts)) {\n return {\n ...jsonRpcError(\n 0,\n -32602,\n \"Invalid params: message with role and parts required\",\n ),\n _id: 0,\n };\n }\n\n const contextId = params.contextId as string | undefined;\n const metadata = params.metadata as Record<string, unknown> | undefined;\n const approvedActions = trustedApprovedActions(params.approvedActions, event);\n\n // The JWT-verified caller email (set by mountA2A in server.ts) is the\n // single source of truth for task ownership — bound at creation, checked\n // on every subsequent tasks/get and tasks/cancel call. Caller-supplied\n // metadata.userEmail is NEVER used for ownership; that would re-introduce\n // the IDOR class fixed here.\n const ownerEmailForTask =\n (event?.context?.__a2aVerifiedEmail as string | undefined) ?? null;\n\n // Async mode: return the task immediately in `working` state, run the\n // handler in the background, and let the caller poll `tasks/get`. This is\n // the workaround for synchronous serverless request timeouts when the handler\n // runs LLM + tool loops that can exceed a single HTTP invocation budget.\n // SECURITY: only honor the explicit top-level `params.async`. The\n // metadata.async fallback was caller-controlled and could force async\n // dispatch (which has weaker auth than the sync path) on otherwise sync\n // requests. Async is also refused entirely when no auth is configured in\n // production — see the additional gate below.\n const asyncMode =\n params.async === true || (event && event.context?.__a2aForceAsync === true);\n\n if (asyncMode) {\n // Refuse async mode entirely when no auth is configured in production.\n // The async dispatch path self-fires the `_process-task` route, which\n // accepts unsigned dispatches when A2A_SECRET is unset — that combined\n // with the lack of caller identity here would let any unauthenticated\n // attacker queue and trigger handler runs. In production, require some\n // form of auth so the verifiedEmail is bound to the task.\n const hasA2ASecret = hasConfiguredA2ASecret();\n const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);\n if (isA2AProductionRuntime() && !hasA2ASecret && !hasApiKey) {\n return {\n ...jsonRpcError(\n 0,\n -32001,\n \"A2A async mode is not available — A2A_SECRET or apiKeyEnv must be configured.\",\n ),\n _id: 0,\n };\n }\n // Resolve identity up front (cheap), bake it into the task's metadata,\n // and dispatch the actual handler run to a SEPARATE function execution.\n // On serverless hosts (Netlify, Vercel, Cloudflare) detached promises get\n // killed when the response is flushed, so we self-fire a webhook to a\n // dedicated processor route — same cross-platform pattern the integration\n // webhook queue uses. The processor reconstructs the request context from\n // the task metadata and runs the handler with its own full timeout.\n const verifiedEmail =\n (event?.context?.__a2aVerifiedEmail as string | undefined) ?? undefined;\n // Only trust the verified org domain from the JWT claim — do not fall back\n // to metadata.orgDomain which is caller-supplied and unverified.\n const orgDomainHint =\n (event?.context?.__a2aOrgDomain as string | undefined) ?? undefined;\n const requestOrigin = requestOriginForContext(metadata, event);\n const safeMetadata = trustedA2AMetadata(metadata, event);\n\n const taskMetadata: Record<string, unknown> = {\n ...(safeMetadata ?? {}),\n __a2a_processor: {\n verifiedEmail,\n orgDomainHint,\n ...(requestOrigin ? { requestOrigin } : {}),\n contextId: contextId ?? null,\n callerMetadata: safeMetadata ?? null,\n approvedActions: approvedActions ?? null,\n },\n };\n const task = await createTask(\n message,\n contextId,\n taskMetadata,\n ownerEmailForTask,\n );\n const working = await updateTask(task.id, { state: \"working\" });\n\n // Awaited, not fire-and-forget: this handler is about to return, and a\n // detached dispatch fetch racing only a short settle timer can be killed\n // mid-flight when the serverless response is flushed WITHOUT rejecting —\n // see the `awaitResponse` doc on `fireInternalDispatch` in\n // server/self-dispatch.ts. The durable worker path gets a fast 202\n // acknowledgement; a stale-worker fallback uses a short bounded timeout\n // because the portable route responds after processing the task.\n try {\n await fireProcessTaskDispatch(event, task.id, config);\n } catch (err) {\n console.error(\"[a2a] Failed to dispatch process-task:\", err);\n }\n\n return {\n ...jsonRpcResult(0, sanitizeTaskForResponse(working ?? task)),\n _id: 0,\n };\n }\n\n return withA2ARequestContext(metadata, event, async () => {\n const task = await createTask(\n message,\n contextId,\n undefined,\n ownerEmailForTask,\n );\n await updateTask(task.id, { state: \"working\" });\n\n const ctx = makeHandlerContext(\n task.id,\n contextId,\n trustedA2AMetadata(metadata, event),\n event,\n approvedActions,\n );\n\n try {\n const result = getHandler(config)(message, ctx.context);\n\n if (\n result &&\n typeof result === \"object\" &&\n Symbol.asyncIterator in result\n ) {\n let lastMessage: Message | undefined;\n for await (const msg of result as AsyncGenerator<Message>) {\n lastMessage = msg;\n }\n if (lastMessage?.metadata?.agentNativeTaskState === \"input-required\") {\n const updated = await updateTask(task.id, {\n state: \"input-required\",\n message: lastMessage,\n });\n return { ...jsonRpcResult(0, updated), _id: 0 };\n }\n const updated = await updateTask(task.id, {\n state: \"completed\",\n message: lastMessage,\n artifacts: ctx.artifacts.length > 0 ? ctx.artifacts : undefined,\n });\n return { ...jsonRpcResult(0, updated), _id: 0 };\n }\n\n const handlerResult = await (result as Promise<A2AHandlerResult>);\n const allArtifacts = [\n ...ctx.artifacts,\n ...(handlerResult.artifacts ?? []),\n ];\n if (handlerResult.taskState === \"input-required\") {\n const updated = await updateTask(task.id, {\n state: \"input-required\",\n message: handlerResult.message,\n });\n return { ...jsonRpcResult(0, updated), _id: 0 };\n }\n const updated = await updateTask(task.id, {\n state: \"completed\",\n message: handlerResult.message,\n artifacts: allArtifacts.length > 0 ? allArtifacts : undefined,\n });\n return { ...jsonRpcResult(0, updated), _id: 0 };\n } catch (err: any) {\n await updateTask(task.id, {\n state: \"failed\",\n message: {\n role: \"agent\",\n parts: [{ type: \"text\", text: err.message ?? \"Handler failed\" }],\n },\n });\n return {\n ...jsonRpcError(0, -32000, err.message ?? \"Handler failed\"),\n _id: 0,\n };\n }\n });\n}\n\nasync function handleStream(\n params: Record<string, unknown>,\n config: A2AConfig,\n res: { write: (chunk: string) => void; end: () => void },\n event?: any,\n): Promise<void> {\n const message = params.message as Message;\n if (!message || !message.role || !Array.isArray(message.parts)) {\n res.write(\n `data: ${JSON.stringify(jsonRpcError(0, -32602, \"Invalid params\"))}\\n\\n`,\n );\n res.end();\n return;\n }\n\n const contextId = params.contextId as string | undefined;\n const metadata = params.metadata as Record<string, unknown> | undefined;\n const approvedActions = trustedApprovedActions(params.approvedActions, event);\n const ownerEmailForTask =\n (event?.context?.__a2aVerifiedEmail as string | undefined) ?? null;\n\n await withA2ARequestContext(metadata, event, async () => {\n const task = await createTask(\n message,\n contextId,\n undefined,\n ownerEmailForTask,\n );\n\n await updateTask(task.id, { state: \"working\" });\n\n const { context, artifacts } = makeHandlerContext(\n task.id,\n contextId,\n trustedA2AMetadata(metadata, event),\n event,\n approvedActions,\n );\n\n try {\n const result = getHandler(config)(message, context);\n\n if (\n result &&\n typeof result === \"object\" &&\n Symbol.asyncIterator in result\n ) {\n for await (const msg of result as AsyncGenerator<Message>) {\n const intermediate = await updateTask(task.id, {\n state: \"working\",\n message: msg,\n });\n res.write(\n `data: ${JSON.stringify(jsonRpcResult(0, intermediate))}\\n\\n`,\n );\n }\n } else {\n const handlerResult = await (result as Promise<A2AHandlerResult>);\n const allArtifacts = [...artifacts, ...(handlerResult.artifacts ?? [])];\n const updated = await updateTask(task.id, {\n state: \"completed\",\n message: handlerResult.message,\n artifacts: allArtifacts.length > 0 ? allArtifacts : undefined,\n });\n res.write(`data: ${JSON.stringify(jsonRpcResult(0, updated))}\\n\\n`);\n res.end();\n return;\n }\n\n const allArtifacts = [...artifacts];\n const final = await updateTask(task.id, {\n state: \"completed\",\n artifacts: allArtifacts.length > 0 ? allArtifacts : undefined,\n });\n res.write(`data: ${JSON.stringify(jsonRpcResult(0, final))}\\n\\n`);\n } catch (err: any) {\n await updateTask(task.id, { state: \"failed\" });\n res.write(\n `data: ${JSON.stringify(jsonRpcError(0, -32000, err.message ?? \"Handler failed\"))}\\n\\n`,\n );\n }\n\n res.end();\n });\n}\n\n/**\n * Caller-supplied metadata keys that may contain sensitive bearer / OAuth\n * material. Always stripped from `tasks/get` responses so a leaked task id\n * never discloses an OAuth token even when the original sender carelessly\n * stuffed one into `metadata` (see `production-agent.ts:1144-1156` for the\n * historical googleToken propagation pattern).\n */\nconst SENSITIVE_METADATA_KEYS = new Set([\n \"googleToken\",\n \"userEmail\",\n \"orgDomain\",\n \"accessToken\",\n \"refreshToken\",\n \"apiKey\",\n \"Authorization\",\n \"authorization\",\n \"bearer\",\n]);\n\nfunction sanitizeTaskForResponse(task: any): any {\n if (!task || typeof task !== \"object\") return task;\n if (!task.metadata || typeof task.metadata !== \"object\") return task;\n\n const meta = task.metadata as Record<string, unknown>;\n const publicMeta: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(meta)) {\n if (k === \"__a2a_processor\") continue;\n if (SENSITIVE_METADATA_KEYS.has(k)) continue;\n publicMeta[k] = v;\n }\n return { ...task, metadata: publicMeta };\n}\n\n/**\n * Reject access when the task has a recorded owner that doesn't match the\n * verified caller. Returns a 404-shaped JSON-RPC error to avoid disclosing\n * task existence to the wrong caller (enumeration via UUID lookup).\n *\n * - When the task has no recorded owner (legacy row from before the\n * owner_email migration) we allow access if some verifiable bearer token\n * was presented; otherwise we still reject so an unsigned caller can never\n * read or cancel arbitrary task ids.\n * - When neither A2A_SECRET nor apiKeyEnv is configured AND we're in\n * production, we refuse `tasks/get` and `tasks/cancel` outright — there's\n * no way to authenticate the caller, so the only safe response is \"not\n * found\".\n */\nfunction authorizeTaskAccess(\n taskOwnerEmail: string | null,\n event: any,\n config: A2AConfig,\n): JsonRpcResponse | null {\n const verifiedEmail =\n (event?.context?.__a2aVerifiedEmail as string | undefined) ?? null;\n const hasA2ASecret = hasConfiguredA2ASecret();\n const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);\n const inProduction = isA2AProductionRuntime();\n\n if (inProduction && !hasA2ASecret && !hasApiKey) {\n // No way to authenticate the caller in production — refuse access.\n return jsonRpcError(0, -32001, \"Task not found\");\n }\n\n if (taskOwnerEmail) {\n if (!verifiedEmail) {\n return jsonRpcError(0, -32001, \"Task not found\");\n }\n if (verifiedEmail.toLowerCase() !== taskOwnerEmail.toLowerCase()) {\n return jsonRpcError(0, -32001, \"Task not found\");\n }\n }\n // Legacy row (no owner_email recorded). The route-level auth gate is the\n // only thing protecting it — fall through and serve.\n return null;\n}\n\nasync function handleGet(\n params: Record<string, unknown>,\n event: any,\n config: A2AConfig,\n): Promise<JsonRpcResponse> {\n const id = params.id as string;\n if (!id) {\n return jsonRpcError(0, -32602, \"Invalid params: id required\");\n }\n const ownerEmail = await getTaskOwner(id);\n const denied = authorizeTaskAccess(ownerEmail, event, config);\n if (denied) return denied;\n\n const task = await getTask(id);\n if (!task) {\n return jsonRpcError(0, -32001, \"Task not found\");\n }\n const taskChanged = await refireStuckAsyncTaskIfNeeded(\n id,\n event,\n config,\n ).catch((err) => {\n console.error(\"[a2a] Failed to refire stuck async task:\", err);\n return false;\n });\n if (taskChanged) {\n const updated = await getTask(id);\n if (updated) return jsonRpcResult(0, sanitizeTaskForResponse(updated));\n }\n return jsonRpcResult(0, sanitizeTaskForResponse(task));\n}\n\nasync function refireStuckAsyncTaskIfNeeded(\n taskId: string,\n event: any,\n config: A2AConfig,\n): Promise<boolean> {\n const state = await getA2ATaskDispatchState(taskId);\n if (!state) return false;\n if (!state.metadata?.__a2a_processor) return false;\n\n const now = Date.now();\n\n if (state.statusState === \"submitted\" || state.statusState === \"working\") {\n const queuedLifetimeCutoff = now - a2aQueuedLifetimeMaxMs();\n if (state.createdAt <= queuedLifetimeCutoff) {\n // Dispatch has kept failing (or was never delivered) long enough that\n // retrying further would just repeat the same failure forever — stop\n // refiring and surface a terminal error instead of throttling forever.\n return failStuckQueuedA2ATask(\n taskId,\n queuedLifetimeCutoff,\n \"The async A2A task could not be started because dispatch kept failing. Please retry the request.\",\n );\n }\n\n if (state.updatedAt <= now - A2A_QUEUED_DISPATCH_STUCK_AFTER_MS) {\n if (!(await touchQueuedA2ATaskDispatch(taskId))) return false;\n try {\n await fireProcessTaskDispatch(event, taskId, config);\n } catch (err) {\n console.error(\n \"[a2a] Failed to refire stuck queued task dispatch:\",\n err,\n );\n return false;\n }\n return true;\n }\n return false;\n }\n\n if (state.statusState === \"processing\") {\n const processingStuckCutoff = now - A2A_PROCESSING_STUCK_AFTER_MS;\n const processingLifetimeCutoff = now - a2aProcessingLifetimeMaxMs();\n const isStale = state.updatedAt <= processingStuckCutoff;\n const isOverLifetime = state.createdAt <= processingLifetimeCutoff;\n if (isStale || isOverLifetime) {\n // A processor that died mid-handler may have already performed\n // side-effectful work. Retrying from the top can duplicate artifacts, so\n // fail deterministically and let the caller issue an intentional retry.\n return failStuckA2ATask(\n taskId,\n processingStuckCutoff,\n isStale\n ? \"The async A2A processor timed out before completing. Please retry the request.\"\n : \"The async A2A processor exceeded its maximum run time. Please retry the request.\",\n processingLifetimeCutoff,\n );\n }\n }\n\n return false;\n}\n\nasync function handleCancel(\n params: Record<string, unknown>,\n event: any,\n config: A2AConfig,\n): Promise<JsonRpcResponse> {\n const id = params.id as string;\n if (!id) {\n return jsonRpcError(0, -32602, \"Invalid params: id required\");\n }\n const ownerEmail = await getTaskOwner(id);\n const denied = authorizeTaskAccess(ownerEmail, event, config);\n if (denied) return denied;\n\n const task = await updateTask(id, { state: \"canceled\" });\n if (!task) {\n return jsonRpcError(0, -32001, \"Task not found\");\n }\n return jsonRpcResult(0, sanitizeTaskForResponse(task));\n}\n\n/**\n * H3-compatible JSON-RPC handler. Returns JSON directly (H3 serializes it).\n * Streaming is handled via H3's node response when needed.\n */\nexport async function handleJsonRpcH3(\n body: any,\n event: any,\n config: A2AConfig,\n): Promise<JsonRpcResponse> {\n if (!body || body.jsonrpc !== \"2.0\" || !body.method) {\n setResponseStatus(event, 400);\n return jsonRpcError(body?.id ?? null, -32600, \"Invalid JSON-RPC request\");\n }\n\n const params = (body.params as Record<string, unknown>) ?? {};\n const id = body.id;\n\n switch (body.method) {\n case \"message/send\": {\n const result = await handleSend(params, config, event);\n const { _id, ...response } = result;\n return { ...response, id } as JsonRpcResponse;\n }\n case \"message/stream\": {\n if (!config.streaming) {\n return jsonRpcError(id, -32601, \"Streaming not supported\");\n }\n // Use the raw node response for SSE streaming\n const res = event.node?.res;\n if (!res) {\n return jsonRpcError(id, -32000, \"Streaming not available\");\n }\n setResponseHeader(event, \"Content-Type\", \"text/event-stream\");\n setResponseHeader(event, \"Cache-Control\", \"no-cache\");\n setResponseHeader(event, \"Connection\", \"keep-alive\");\n await handleStream(params, config, res, event);\n return undefined as any; // Response already sent via SSE\n }\n case \"tasks/get\": {\n const result = await handleGet(params, event, config);\n return { ...result, id } as JsonRpcResponse;\n }\n case \"tasks/cancel\": {\n const result = await handleCancel(params, event, config);\n return { ...result, id } as JsonRpcResponse;\n }\n default:\n return jsonRpcError(id, -32601, `Method not found: ${body.method}`);\n }\n}\n"]}
package/dist/a2a/server.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmB5C;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAsCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,eAAe,CAAC,CAqF1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,SAAS,EACjB,WAAW,SAAmB,GAC7B,IAAI,CAsNN;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,qCA6B5D"}
1
+ {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmB5C;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAsCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,eAAe,CAAC,CAqF1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,SAAS,EACjB,WAAW,SAAmB,GAC7B,IAAI,CA0UN;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,qCA6B5D"}
package/dist/a2a/server.js CHANGED
@@ -1,11 +1,14 @@
1
- import { defineEventHandler, setResponseStatus, getMethod, getRequestHeader, } from "h3";
1
+ import { defineEventHandler, setResponseHeader, setResponseStatus, getMethod, getRequestHeader, } from "h3";
2
2
  import * as jose from "jose";
3
+ import { redactArgsToJson } from "../audit/redact.js";
3
4
  import { extractBearerToken, verifyInternalToken, } from "../integrations/internal-token.js";
4
5
  import { getH3App } from "../server/framework-request-handler.js";
5
6
  import { readBody } from "../server/h3-helpers.js";
7
+ import { isSameOriginRequest } from "../server/request-origin.js";
6
8
  import { generateAgentCard } from "./agent-card.js";
7
9
  import { hasConfiguredA2ASecret, isA2AProductionRuntime, } from "./auth-policy.js";
8
10
  import { handleJsonRpcH3, processA2ATaskFromQueue } from "./handlers.js";
11
+ import { claimA2AApproval, getA2AApprovalForOwner, settleA2AApproval, } from "./task-store.js";
9
12
  /**
10
13
  * One-time warning when A2A is running unauthenticated in development. We
11
14
  * don't refuse the request (local templates need to work out of the box),
@@ -186,6 +189,89 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
186
189
  const filteredSkills = filterPublicAgentCardSkills(config);
187
190
  return generateAgentCard({ ...config, skills: filteredSkills }, baseUrl, `${routePrefix}/a2a`);
188
191
  }));
192
+ // Human-only continuation for consequential A2A tool calls. The opaque id
193
+ // is a lookup handle, not authorization: every read and mutation also
194
+ // requires the task owner's live browser session. Ordinary A2A bearer
195
+ // tokens never reach this control plane and cannot approve themselves.
196
+ getH3App(nitroApp).use(`${routePrefix}/a2a/approvals`, defineEventHandler(async (event) => {
197
+ const approvalId = (event.path || "")
198
+ .split("?")[0]
199
+ .replace(/^\//, "")
200
+ .split("/")[0];
201
+ if (!approvalId) {
202
+ setResponseStatus(event, 404);
203
+ return { error: "Approval not found" };
204
+ }
205
+ const { getSession } = await import("../server/auth.js");
206
+ const session = await getSession(event);
207
+ if (!session?.email) {
208
+ setResponseStatus(event, 401);
209
+ return { error: "Sign in to review this approval" };
210
+ }
211
+ if (getMethod(event) === "GET") {
212
+ const approval = await getA2AApprovalForOwner(approvalId, session.email, session.orgId ?? null);
213
+ if (!approval) {
214
+ setResponseStatus(event, 404);
215
+ return { error: "Approval not found" };
216
+ }
217
+ const safeInput = redactArgsToJson(approval.input) ?? "{}";
218
+ const esc = (value) => value.replace(/[&<>"']/g, (char) => ({
219
+ "&": "&amp;",
220
+ "<": "&lt;",
221
+ ">": "&gt;",
222
+ '"': "&quot;",
223
+ "'": "&#39;",
224
+ })[char] ?? char);
225
+ setResponseHeader(event, "content-type", "text/html; charset=utf-8");
226
+ setResponseHeader(event, "cache-control", "no-store");
227
+ setResponseHeader(event, "x-frame-options", "DENY");
228
+ setResponseHeader(event, "content-security-policy", "frame-ancestors 'none'");
229
+ setResponseHeader(event, "referrer-policy", "no-referrer");
230
+ const expired = approval.expiresAt <= Date.now();
231
+ const active = approval.status === "pending" && !expired;
232
+ const displayStatus = expired ? "expired" : approval.status;
233
+ return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Review agent action</title><style>body{font:15px/1.5 ui-sans-serif,system-ui;background:#f7f7f5;color:#171717;margin:0}.card{max-width:680px;margin:8vh auto;background:white;border:1px solid #ddd;border-radius:14px;padding:28px;box-shadow:0 12px 36px #0001}h1{font-size:22px;margin:0 0 8px}p{color:#555}pre{white-space:pre-wrap;word-break:break-word;background:#f4f4f2;padding:16px;border-radius:9px;max-height:45vh;overflow:auto}button{background:#171717;color:white;border:0;border-radius:8px;padding:11px 16px;font-weight:650;cursor:pointer}button[disabled]{opacity:.5;cursor:default}#status{margin-left:10px;color:#555}</style></head><body><main class="card"><h1>Review agent action</h1><p>This action is paused until you approve it. Approval can be used once.</p><h2>${esc(approval.tool)}</h2><pre>${esc(safeInput)}</pre><button id="approve" ${active ? "" : "disabled"}>${active ? "Approve and run" : esc(displayStatus)}</button><span id="status">${active ? "" : esc(approval.result ?? displayStatus)}</span><script>document.getElementById('approve').onclick=async function(){this.disabled=true;document.getElementById('status').textContent='Running…';try{const r=await fetch(location.href,{method:'POST',credentials:'include',headers:{'content-type':'application/json'}});const j=await r.json();document.getElementById('status').textContent=j.output||j.error||'Done';}catch(e){document.getElementById('status').textContent='Could not run the action.'}}</script></main></body></html>`;
234
+ }
235
+ if (getMethod(event) !== "POST") {
236
+ setResponseStatus(event, 405);
237
+ return { error: "Method not allowed" };
238
+ }
239
+ if (!isSameOriginRequest(event)) {
240
+ setResponseStatus(event, 403);
241
+ return { error: "Cross-origin approval denied" };
242
+ }
243
+ if (!config.executeApproval) {
244
+ setResponseStatus(event, 501);
245
+ return { error: "Approval execution is not configured" };
246
+ }
247
+ const approval = await claimA2AApproval(approvalId, session.email, session.orgId ?? null);
248
+ if (!approval) {
249
+ const current = await getA2AApprovalForOwner(approvalId, session.email, session.orgId ?? null);
250
+ setResponseStatus(event, current ? 409 : 404);
251
+ return {
252
+ error: current
253
+ ? `Approval is ${current.status} and cannot be run again`
254
+ : "Approval not found",
255
+ };
256
+ }
257
+ const { runWithRequestContext } = await import("../server/request-context.js");
258
+ let execution;
259
+ try {
260
+ execution = await runWithRequestContext({ userEmail: session.email, orgId: session.orgId ?? undefined }, () => config.executeApproval(approval));
261
+ }
262
+ catch (error) {
263
+ execution = {
264
+ status: "failed",
265
+ output: error instanceof Error
266
+ ? error.message
267
+ : "Approval execution failed",
268
+ };
269
+ }
270
+ await settleA2AApproval(approval.id, execution.status, execution.output);
271
+ if (execution.status === "failed")
272
+ setResponseStatus(event, 500);
273
+ return execution;
274
+ }));
189
275
  // Async-mode processor route. MUST be mounted BEFORE the `/a2a` catch-all
190
276
  // below, since h3's `.use()` matches by prefix and `/a2a` would otherwise
191
277
  // swallow `/a2a/_process-task` and return a JSON-RPC "Invalid token" error
package/dist/a2a/server.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AACZ,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAGzE;;;;;GAKG;AACH,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAC7B,SAAS,iBAAiB;IACxB,IAAI,gBAAgB;QAAE,OAAO;IAC7B,gBAAgB,GAAG,IAAI,CAAC;IACxB,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,mFAAmF;QACjF,4FAA4F,CAC/F,CAAC;AACJ,CAAC;AAYD,SAAS,kBAAkB,CACzB,UAAoB,EACpB,MAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO;IACrD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,KAAsB;IACjD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC;QACtE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,KAAW;IAEX,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,aAAiC,CAAC;IACtC,IAAI,iBAA8C,CAAC;IACnD,IAAI,CAAC;QACH,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,aAAa,GAAG,iBAAiB,CAAC,UAAgC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC5D,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,IAAI,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAE3E,iDAAiD;IACjD,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,wBAAwB;IACxB,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,qCAAqC;IACrC,IAAI,CAAC;QACH,MAAM,aAAa,GAA0B,EAAE,CAAC;QAChD,IAAI,iBAAiB,IAAI,OAAO,iBAAiB,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YACtE,sEAAsE;YACtE,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAClD,aAAa,CAAC,QAAQ,GAAG,GAAG,CAAC;QAC/B,CAAC;QACD,IACE,iBAAiB;YACjB,OAAO,iBAAiB,CAAC,GAAG,KAAK,QAAQ;YACzC,iBAAiB,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAChC,CAAC;YACD,aAAa,CAAC,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,aAAa,CACd,CAAC;gBACF,OAAO;oBACL,KAAK,EAAG,OAAO,CAAC,GAAc,IAAI,IAAI;oBACtC,SAAS,EAAG,OAAO,CAAC,UAAqB,IAAI,IAAI;iBAClD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,iDAAiD;IACjD,EAAE;IACF,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,wDAAwD;IACxD,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,8BAA8B,EAC9B,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,QAAQ,GACZ,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC;YAC5C,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;QAExC,MAAM,cAAc,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAE3D,OAAO,iBAAiB,CACtB,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EACrC,OAAO,EACP,GAAG,WAAW,MAAM,CACrB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,oBAAoB,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAgC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,8DAA8D;QAC9D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,sBAAsB,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;YACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,uFAAuF;aAC1F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iBAAiB,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO;QAE5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAC9C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QAErC,oEAAoE;QACpE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExE,6EAA6E;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9D,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC;YACzC,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC;YAC3C,wBAAwB,GAAG,CAAC,mBAAmB,CAAC;QAClD,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE;qBAC5D,CAAC;gBACJ,CAAC;gBACD,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;oBAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBACpD,CAAC;gBACJ,CAAC;gBACD,yBAAyB,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACvD,oEAAoE;YACpE,gEAAgE;YAChE,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,8BAA8B;qBACxC;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,IAAI,sBAAsB,EAAE,EAAE,CAAC;oBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,qHAAqH;yBACxH;qBACF,CAAC;gBACJ,CAAC;gBACD,iBAAiB,EAAE,CAAC;YACtB,CAAC;iBAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;gBACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB;qBACnC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,mBAAmB,EAAE,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;QACzD,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,iBAAiB,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,MAAM,EAAE,GACL,KAAwC,CAAC,EAAE;YAC3C,KAA2B,CAAC,IAAI;YACjC,EAAE,CAAC;QACL,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,CACL,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,IAAI;gBACjC,KAAK,CAAC,WAAW,CAAC,QAAQ,KAAK,IAAI;gBACnC,KAAK,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI;gBACvC,KAAK,CAAC,WAAW,CAAC,eAAe,KAAK,IAAI,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n defineEventHandler,\n setResponseStatus,\n getMethod,\n getRequestHeader,\n} from \"h3\";\nimport * as jose from \"jose\";\n\nimport {\n extractBearerToken,\n verifyInternalToken,\n} from \"../integrations/internal-token.js\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { generateAgentCard } from \"./agent-card.js\";\nimport {\n hasConfiguredA2ASecret,\n isA2AProductionRuntime,\n} from \"./auth-policy.js\";\nimport { handleJsonRpcH3, processA2ATaskFromQueue } from \"./handlers.js\";\nimport type { A2AConfig } from \"./types.js\";\n\n/**\n * One-time warning when A2A is running unauthenticated in development. We\n * don't refuse the request (local templates need to work out of the box),\n * but we log a single noisy line so operators notice if they accidentally\n * deploy with no auth configured.\n */\nlet _warnedUnauthA2A = false;\nfunction warnA2AUnauthOnce(): void {\n if (_warnedUnauthA2A) return;\n _warnedUnauthA2A = true;\n // eslint-disable-next-line no-console\n console.warn(\n \"[a2a] No A2A_SECRET or apiKeyEnv configured — A2A endpoint runs unauthenticated. \" +\n \"This is allowed in development but blocked in production. Set A2A_SECRET before deploying.\",\n );\n}\n\n/**\n * Result of verifying an inbound A2A JWT. `email` is the caller identity from\n * the token's `sub` claim (null when verification fails), `orgDomain` mirrors\n * the verified `org_domain` claim when present.\n */\nexport interface A2ATokenPayload {\n email: string | null;\n orgDomain: string | null;\n}\n\nfunction addSecretCandidate(\n candidates: string[],\n secret: string | undefined,\n): void {\n const trimmed = secret?.trim();\n if (!trimmed || candidates.includes(trimmed)) return;\n candidates.push(trimmed);\n}\n\n/**\n * Resolve the audience (`aud`) value to expect in an inbound JWT. We use the\n * receiver's app URL — it's the natural identifier of \"who this token was\n * minted for\". Returns undefined when no app URL is configured and no request\n * host is derivable; `verifyA2AToken` then rejects any token that carries an\n * `aud` claim (fail closed — a correctly signed token minted for another\n * service must not verify here). Only tokens without an `aud` claim (minted\n * before the audience claim shipped) skip the audience check.\n */\nfunction expectedJwtAudience(event: any | undefined): string | undefined {\n const fromEnv =\n process.env.APP_URL ||\n process.env.URL ||\n process.env.DEPLOY_URL ||\n process.env.BETTER_AUTH_URL;\n if (fromEnv) return String(fromEnv);\n // Best-effort: derive from the inbound request host. This is forgeable\n // (Host-header attack), but only useful as a hint when env-derived URL\n // is unset; the rest of the JWT verification still uses the secret.\n try {\n const proto = getRequestHeader(event, \"x-forwarded-proto\") || \"https\";\n const host = getRequestHeader(event, \"host\");\n if (host) return `${proto}://${host}`;\n } catch {}\n return undefined;\n}\n\n/**\n * Verify an inbound A2A bearer token (HS256) exactly as the\n * `/_agent-native/a2a` endpoint does: it peeks at the unverified `org_domain`\n * claim to build an ordered candidate-secret set (`process.env.A2A_SECRET`\n * plus any org-level secret for that domain), then verifies the JWT — checking\n * `aud`/`iss` when the token carries them and `exp` always. Returns the\n * caller's email (`sub`) and org domain on success, or `{ email: null,\n * orgDomain: null }` on any failure (malformed, bad signature, expired, or no\n * secret configured), never throwing.\n *\n * Exported so workspaces can accept A2A callers on the HTTP action route with\n * the same routine — including org-level fallback secrets — instead of\n * reimplementing a partial verifier. Pass the H3 `event` to enable org-domain →\n * org-secret lookup and audience derivation; it is optional.\n */\nexport async function verifyA2AToken(\n token: string,\n event?: any,\n): Promise<A2ATokenPayload> {\n // Step 1: Peek at JWT claims WITHOUT verification to get org_domain.\n // This is safe because we only use org_domain to look up the secret,\n // then verify the full JWT with that secret. If someone forges a JWT\n // with a fake org_domain, verification will fail because they don't\n // have the real secret.\n let orgDomainHint: string | undefined;\n let unverifiedPayload: jose.JWTPayload | undefined;\n try {\n unverifiedPayload = jose.decodeJwt(token);\n orgDomainHint = unverifiedPayload.org_domain as string | undefined;\n } catch {\n // Malformed token — fall through to global secret attempt\n }\n\n // Step 2: Build a small, ordered set of candidate secrets. Tokens minted by\n // current callers prefer the shared A2A_SECRET; older callers may still use\n // an org-level secret. Try both without logging or reflecting secret details.\n const candidateSecrets: string[] = [];\n addSecretCandidate(candidateSecrets, process.env.A2A_SECRET);\n if (orgDomainHint) {\n try {\n const { getA2ASecretByDomain } = await import(\"../org/context.js\");\n const orgSecret = await getA2ASecretByDomain(orgDomainHint);\n addSecretCandidate(candidateSecrets, orgSecret ?? undefined);\n } catch {\n // DB not ready or column doesn't exist yet — fall through\n }\n }\n if (candidateSecrets.length === 0) return { email: null, orgDomain: null };\n\n // Step 3: Verify JWT with the candidate secrets.\n //\n // - `audience`: passed only when the token carries an `aud` claim\n // (backward-compat: tokens minted by older `signA2AToken` versions\n // don't include one).\n // - `issuer`: enforced when the token carries an `iss` claim. The\n // sender's `signA2AToken` (`a2a/client.ts:42`) sets the issuer to its\n // own app URL, so a verified token must self-identify a non-empty\n // string issuer. We accept any string the token claims (we don't pin\n // a specific expected issuer because dispatchers may legitimately\n // mint tokens from many sender URLs — dev tunnels, multi-deploy\n // setups). The pin is \"issuer must match the value the token says\n // it was minted from\", which `jose.jwtVerify` validates exactly when\n // `issuer` is supplied as a string. Backward-compat: when the token\n // has no `iss`, we skip the check.\n try {\n const verifyOptions: jose.JWTVerifyOptions = {};\n if (unverifiedPayload && typeof unverifiedPayload.aud !== \"undefined\") {\n // Fail closed: the token was minted for a specific audience, but this\n // receiver can't derive its own expected audience (no APP_URL/URL and no\n // usable request host). Accepting here would let a correctly-signed token\n // whose `aud` targets ANOTHER service verify against a shared secret. A\n // token that self-declares an audience must be checked against ours, so\n // when we have nothing to check it against we reject rather than skip.\n const aud = expectedJwtAudience(event);\n if (!aud) return { email: null, orgDomain: null };\n verifyOptions.audience = aud;\n }\n if (\n unverifiedPayload &&\n typeof unverifiedPayload.iss === \"string\" &&\n unverifiedPayload.iss.length > 0\n ) {\n verifyOptions.issuer = unverifiedPayload.iss;\n }\n for (const secret of candidateSecrets) {\n try {\n const { payload } = await jose.jwtVerify(\n token,\n new TextEncoder().encode(secret),\n verifyOptions,\n );\n return {\n email: (payload.sub as string) ?? null,\n orgDomain: (payload.org_domain as string) ?? null,\n };\n } catch {\n // Try the next candidate without leaking which secret failed.\n }\n }\n } catch {\n // Keep malformed option construction indistinguishable from auth failure.\n }\n return { email: null, orgDomain: null };\n}\n\n/**\n * Mount A2A protocol endpoints on an H3/Nitro app.\n *\n * - GET /.well-known/agent-card.json — public agent card (no auth)\n * - POST /_agent-native/a2a — JSON-RPC endpoint (with optional auth)\n *\n * When A2A_SECRET is set, inbound Bearer tokens are verified as JWTs\n * and the caller's email is extracted from the `sub` claim. This provides\n * cryptographic identity verification for cross-app A2A calls.\n */\nexport function mountA2A(\n nitroApp: any,\n config: A2AConfig,\n routePrefix = \"/_agent-native\",\n): void {\n // Public agent card endpoint (no auth required).\n //\n // SECURITY: per-user / per-org MCP tools are filtered out of the public\n // skills list. Their merged-key prefix (`mcp__user_<emailhash>_…` or\n // `mcp__org_<orgid>_…`) discloses (a) which users have integrations\n // attached, and (b) what those integrations are — fingerprinting the\n // tenant. Template- and framework-defined skills stay; only the dynamic\n // per-tenant MCP entries are dropped. See finding #7 in\n // /tmp/security-audit/12-mcp-a2a-agent.md.\n getH3App(nitroApp).use(\n \"/.well-known/agent-card.json\",\n defineEventHandler((event) => {\n if (getMethod(event) !== \"GET\") {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n }\n const protocol =\n getRequestHeader(event, \"x-forwarded-proto\") ||\n (event.url?.protocol?.replace(\":\", \"\") ?? \"http\");\n const host = getRequestHeader(event, \"host\") ?? \"localhost\";\n const baseUrl = `${protocol}://${host}`;\n\n const filteredSkills = filterPublicAgentCardSkills(config);\n\n return generateAgentCard(\n { ...config, skills: filteredSkills },\n baseUrl,\n `${routePrefix}/a2a`,\n );\n }),\n );\n\n // Async-mode processor route. MUST be mounted BEFORE the `/a2a` catch-all\n // below, since h3's `.use()` matches by prefix and `/a2a` would otherwise\n // swallow `/a2a/_process-task` and return a JSON-RPC \"Invalid token\" error\n // (the JSON-RPC handler doesn't know about taskId-only bodies).\n //\n // When `message/send` is called with `async: true`, the JSON-RPC handler\n // enqueues the task and self-fires a POST to this route on the same\n // deployment so the actual handler runs in a fresh function execution (its\n // own full timeout). Authenticated with an HMAC token bound to the task id\n // (5-minute lifetime, signed with A2A_SECRET — same scheme as the\n // integration webhook queue).\n getH3App(nitroApp).use(\n `${routePrefix}/a2a/_process-task`,\n defineEventHandler(async (event) => {\n if (getMethod(event) !== \"POST\") {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n }\n\n const body = (await readBody(event)) as { taskId?: unknown } | null;\n const taskId = body && typeof body.taskId === \"string\" ? body.taskId : \"\";\n if (!taskId) {\n setResponseStatus(event, 400);\n return { error: \"taskId required\" };\n }\n\n // When A2A_SECRET is set, require a valid HMAC token bound to this\n // taskId. In production, we REQUIRE A2A_SECRET to be set so unsigned\n // dispatches are never accepted (an attacker who fishes a taskId out\n // of logs / a share link could otherwise force-replay it). In\n // development, a missing secret is permitted so local templates work\n // out of the box, but we log a one-time warning so operators notice.\n if (hasConfiguredA2ASecret()) {\n const auth = getRequestHeader(event, \"authorization\");\n const tok = extractBearerToken(auth);\n if (!verifyInternalToken(taskId, tok ?? \"\")) {\n setResponseStatus(event, 401);\n return { error: \"Invalid or expired processor token\" };\n }\n } else if (isA2AProductionRuntime()) {\n setResponseStatus(event, 503);\n return {\n error:\n \"A2A processor not configured — set A2A_SECRET on this deployment to enable async A2A.\",\n };\n } else {\n warnA2AUnauthOnce();\n }\n\n try {\n await processA2ATaskFromQueue(taskId, config, event);\n return { ok: true };\n } catch (err: any) {\n console.error(\"[a2a] process-task failed:\", err);\n setResponseStatus(event, 500);\n return { error: err?.message ?? \"process-task failed\" };\n }\n }),\n );\n\n // JSON-RPC A2A endpoint (with optional auth)\n getH3App(nitroApp).use(\n `${routePrefix}/a2a`,\n defineEventHandler(async (event) => {\n if (getMethod(event) !== \"POST\") {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n }\n\n // h3 prefix-matches mounts, so a request to `/a2a/_process-task`\n // reaches this handler too. The dedicated mount above runs first and\n // takes the request, but if that returns `undefined` (or h3 ever\n // changes ordering semantics) defensively bail here. event.path is\n // stripped to the remainder after the mount prefix.\n const sub = (event.path || \"/\").split(\"?\")[0].replace(/^\\//, \"\");\n if (sub.startsWith(\"_process-task\")) return;\n\n const authHeader = getRequestHeader(event, \"authorization\");\n const bearerToken = extractBearerToken(authHeader);\n let verifiedCallerEmail: string | null = null;\n let verifiedOrgDomain: string | null = null;\n let legacyApiKeyAuthenticated = false;\n let bearerTokenRejectedByJwt = false;\n\n // SECURITY: when neither A2A_SECRET nor an apiKeyEnv is configured,\n // there's no way to authenticate the caller. Default to \"auth required\"\n // in production — return 503 with a clear message instead of running\n // the agent loop unauthenticated. In development, log a one-time\n // warning but allow so local templates work out of the box.\n const hasA2ASecret = hasConfiguredA2ASecret();\n const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);\n\n // Try JWT verification first (org-level or global A2A_SECRET-based identity)\n if (bearerToken) {\n const tokenPayload = await verifyA2AToken(bearerToken, event);\n verifiedCallerEmail = tokenPayload.email;\n verifiedOrgDomain = tokenPayload.orgDomain;\n bearerTokenRejectedByJwt = !verifiedCallerEmail;\n }\n\n // Fall back to legacy API key check (exact string match)\n if (!verifiedCallerEmail && config.apiKeyEnv) {\n const expectedKey = process.env[config.apiKeyEnv];\n if (expectedKey) {\n if (!bearerToken) {\n setResponseStatus(event, 401);\n return {\n jsonrpc: \"2.0\",\n id: null,\n error: { code: -32001, message: \"Authentication required\" },\n };\n }\n if (bearerToken !== expectedKey) {\n setResponseStatus(event, 401);\n return {\n jsonrpc: \"2.0\",\n id: null,\n error: { code: -32001, message: \"Invalid API key\" },\n };\n }\n legacyApiKeyAuthenticated = true;\n }\n }\n\n if (!verifiedCallerEmail && !legacyApiKeyAuthenticated) {\n // Any supplied bearer token that failed JWT verification is an auth\n // failure after the legacy exact-match apiKeyEnv path has had a\n // chance to succeed. Do not let bad tokens fall through to tasks/get\n // and get reported as lookup misses.\n if (bearerTokenRejectedByJwt) {\n setResponseStatus(event, 401);\n return {\n jsonrpc: \"2.0\",\n id: null,\n error: {\n code: -32001,\n message: \"Invalid or expired A2A token\",\n },\n };\n }\n\n if (!hasA2ASecret && !hasApiKey) {\n if (isA2AProductionRuntime()) {\n setResponseStatus(event, 503);\n return {\n jsonrpc: \"2.0\",\n id: null,\n error: {\n code: -32001,\n message:\n \"A2A authentication not configured. Set A2A_SECRET (preferred) or configure apiKeyEnv to accept inbound A2A traffic.\",\n },\n };\n }\n warnA2AUnauthOnce();\n } else if (isA2AProductionRuntime()) {\n setResponseStatus(event, 401);\n return {\n jsonrpc: \"2.0\",\n id: null,\n error: {\n code: -32001,\n message: \"Authentication required\",\n },\n };\n }\n }\n\n // Store verified caller identity on the event context so the handler\n // can set request context from a trusted source instead of metadata\n if (verifiedCallerEmail) {\n event.context.__a2aVerifiedEmail = verifiedCallerEmail;\n }\n if (verifiedOrgDomain) {\n event.context.__a2aOrgDomain = verifiedOrgDomain;\n }\n\n const body = await readBody(event);\n return handleJsonRpcH3(body, event, config);\n }),\n );\n}\n\nexport function filterPublicAgentCardSkills(config: A2AConfig) {\n return (config.skills ?? []).filter((skill) => {\n const id =\n (skill as { id?: string; name?: string }).id ??\n (skill as { name?: string }).name ??\n \"\";\n if (typeof id === \"string\") {\n if (id.startsWith(\"mcp__user_\") || id.startsWith(\"mcp__org_\")) {\n return false;\n }\n }\n\n if (skill.public === false || skill.requiresAuth || skill.isConsequential) {\n return false;\n }\n\n if (!config.publicSkillsOnly) return true;\n\n if (skill.publicAgent) {\n return (\n skill.publicAgent.expose === true &&\n skill.publicAgent.readOnly === true &&\n skill.publicAgent.requiresAuth !== true &&\n skill.publicAgent.isConsequential !== true\n );\n }\n\n return skill.public === true && skill.readOnly !== false;\n });\n}\n"]}
1
+ {"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AACZ,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAGzB;;;;;GAKG;AACH,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAC7B,SAAS,iBAAiB;IACxB,IAAI,gBAAgB;QAAE,OAAO;IAC7B,gBAAgB,GAAG,IAAI,CAAC;IACxB,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,mFAAmF;QACjF,4FAA4F,CAC/F,CAAC;AACJ,CAAC;AAYD,SAAS,kBAAkB,CACzB,UAAoB,EACpB,MAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO;IACrD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,KAAsB;IACjD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC;QACtE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,KAAW;IAEX,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,aAAiC,CAAC;IACtC,IAAI,iBAA8C,CAAC;IACnD,IAAI,CAAC;QACH,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,aAAa,GAAG,iBAAiB,CAAC,UAAgC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC5D,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,IAAI,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAE3E,iDAAiD;IACjD,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,wBAAwB;IACxB,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,qCAAqC;IACrC,IAAI,CAAC;QACH,MAAM,aAAa,GAA0B,EAAE,CAAC;QAChD,IAAI,iBAAiB,IAAI,OAAO,iBAAiB,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YACtE,sEAAsE;YACtE,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAClD,aAAa,CAAC,QAAQ,GAAG,GAAG,CAAC;QAC/B,CAAC;QACD,IACE,iBAAiB;YACjB,OAAO,iBAAiB,CAAC,GAAG,KAAK,QAAQ;YACzC,iBAAiB,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAChC,CAAC;YACD,aAAa,CAAC,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,aAAa,CACd,CAAC;gBACF,OAAO;oBACL,KAAK,EAAG,OAAO,CAAC,GAAc,IAAI,IAAI;oBACtC,SAAS,EAAG,OAAO,CAAC,UAAqB,IAAI,IAAI;iBAClD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,iDAAiD;IACjD,EAAE;IACF,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,wDAAwD;IACxD,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,8BAA8B,EAC9B,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,QAAQ,GACZ,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC;YAC5C,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;QAExC,MAAM,cAAc,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAE3D,OAAO,iBAAiB,CACtB,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EACrC,OAAO,EACP,GAAG,WAAW,MAAM,CACrB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,gBAAgB,EAC9B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;aAClC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACb,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACtD,CAAC;QAED,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,UAAU,EACV,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,KAAK,IAAI,IAAI,CACtB,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YAC3D,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAC5B,KAAK,CAAC,OAAO,CACX,UAAU,EACV,CAAC,IAAI,EAAE,EAAE,CACP,CAAC;gBACC,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,MAAM;gBACX,GAAG,EAAE,MAAM;gBACX,GAAG,EAAE,QAAQ;gBACb,GAAG,EAAE,OAAO;aACb,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CACnB,CAAC;YACJ,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;YACrE,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YACtD,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;YACpD,iBAAiB,CACf,KAAK,EACL,yBAAyB,EACzB,wBAAwB,CACzB,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC;YACzD,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5D,OAAO,k4BAAk4B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,SAAS,CAAC,8BAA8B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,8BAA8B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,aAAa,CAAC,oeAAoe,CAAC;QACvlD,CAAC;QAED,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,UAAU,EACV,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,KAAK,IAAI,IAAI,CACtB,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,UAAU,EACV,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,KAAK,IAAI,IAAI,CACtB,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO;gBACL,KAAK,EAAE,OAAO;oBACZ,CAAC,CAAC,eAAe,OAAO,CAAC,MAAM,0BAA0B;oBACzD,CAAC,CAAC,oBAAoB;aACzB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,qBAAqB,EAAE,GAC7B,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC/C,IAAI,SAA6D,CAAC;QAClE,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,qBAAqB,CACrC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS,EAAE,EAC/D,GAAG,EAAE,CAAC,MAAM,CAAC,eAAgB,CAAC,QAAQ,CAAC,CACxC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG;gBACV,MAAM,EAAE,QAAQ;gBAChB,MAAM,EACJ,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,2BAA2B;aAClC,CAAC;QACJ,CAAC;QACD,MAAM,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ;YAAE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CACH,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,oBAAoB,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAgC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,8DAA8D;QAC9D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,sBAAsB,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;YACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,uFAAuF;aAC1F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iBAAiB,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO;QAE5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAC9C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QAErC,oEAAoE;QACpE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExE,6EAA6E;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9D,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC;YACzC,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC;YAC3C,wBAAwB,GAAG,CAAC,mBAAmB,CAAC;QAClD,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE;qBAC5D,CAAC;gBACJ,CAAC;gBACD,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;oBAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBACpD,CAAC;gBACJ,CAAC;gBACD,yBAAyB,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACvD,oEAAoE;YACpE,gEAAgE;YAChE,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,8BAA8B;qBACxC;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,IAAI,sBAAsB,EAAE,EAAE,CAAC;oBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,qHAAqH;yBACxH;qBACF,CAAC;gBACJ,CAAC;gBACD,iBAAiB,EAAE,CAAC;YACtB,CAAC;iBAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;gBACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB;qBACnC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,mBAAmB,EAAE,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;QACzD,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,iBAAiB,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,MAAM,EAAE,GACL,KAAwC,CAAC,EAAE;YAC3C,KAA2B,CAAC,IAAI;YACjC,EAAE,CAAC;QACL,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,CACL,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,IAAI;gBACjC,KAAK,CAAC,WAAW,CAAC,QAAQ,KAAK,IAAI;gBACnC,KAAK,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI;gBACvC,KAAK,CAAC,WAAW,CAAC,eAAe,KAAK,IAAI,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n defineEventHandler,\n setResponseHeader,\n setResponseStatus,\n getMethod,\n getRequestHeader,\n} from \"h3\";\nimport * as jose from \"jose\";\n\nimport { redactArgsToJson } from \"../audit/redact.js\";\nimport {\n extractBearerToken,\n verifyInternalToken,\n} from \"../integrations/internal-token.js\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { isSameOriginRequest } from \"../server/request-origin.js\";\nimport { generateAgentCard } from \"./agent-card.js\";\nimport {\n hasConfiguredA2ASecret,\n isA2AProductionRuntime,\n} from \"./auth-policy.js\";\nimport { handleJsonRpcH3, processA2ATaskFromQueue } from \"./handlers.js\";\nimport {\n claimA2AApproval,\n getA2AApprovalForOwner,\n settleA2AApproval,\n} from \"./task-store.js\";\nimport type { A2AConfig } from \"./types.js\";\n\n/**\n * One-time warning when A2A is running unauthenticated in development. We\n * don't refuse the request (local templates need to work out of the box),\n * but we log a single noisy line so operators notice if they accidentally\n * deploy with no auth configured.\n */\nlet _warnedUnauthA2A = false;\nfunction warnA2AUnauthOnce(): void {\n if (_warnedUnauthA2A) return;\n _warnedUnauthA2A = true;\n // eslint-disable-next-line no-console\n console.warn(\n \"[a2a] No A2A_SECRET or apiKeyEnv configured — A2A endpoint runs unauthenticated. \" +\n \"This is allowed in development but blocked in production. Set A2A_SECRET before deploying.\",\n );\n}\n\n/**\n * Result of verifying an inbound A2A JWT. `email` is the caller identity from\n * the token's `sub` claim (null when verification fails), `orgDomain` mirrors\n * the verified `org_domain` claim when present.\n */\nexport interface A2ATokenPayload {\n email: string | null;\n orgDomain: string | null;\n}\n\nfunction addSecretCandidate(\n candidates: string[],\n secret: string | undefined,\n): void {\n const trimmed = secret?.trim();\n if (!trimmed || candidates.includes(trimmed)) return;\n candidates.push(trimmed);\n}\n\n/**\n * Resolve the audience (`aud`) value to expect in an inbound JWT. We use the\n * receiver's app URL — it's the natural identifier of \"who this token was\n * minted for\". Returns undefined when no app URL is configured and no request\n * host is derivable; `verifyA2AToken` then rejects any token that carries an\n * `aud` claim (fail closed — a correctly signed token minted for another\n * service must not verify here). Only tokens without an `aud` claim (minted\n * before the audience claim shipped) skip the audience check.\n */\nfunction expectedJwtAudience(event: any | undefined): string | undefined {\n const fromEnv =\n process.env.APP_URL ||\n process.env.URL ||\n process.env.DEPLOY_URL ||\n process.env.BETTER_AUTH_URL;\n if (fromEnv) return String(fromEnv);\n // Best-effort: derive from the inbound request host. This is forgeable\n // (Host-header attack), but only useful as a hint when env-derived URL\n // is unset; the rest of the JWT verification still uses the secret.\n try {\n const proto = getRequestHeader(event, \"x-forwarded-proto\") || \"https\";\n const host = getRequestHeader(event, \"host\");\n if (host) return `${proto}://${host}`;\n } catch {}\n return undefined;\n}\n\n/**\n * Verify an inbound A2A bearer token (HS256) exactly as the\n * `/_agent-native/a2a` endpoint does: it peeks at the unverified `org_domain`\n * claim to build an ordered candidate-secret set (`process.env.A2A_SECRET`\n * plus any org-level secret for that domain), then verifies the JWT — checking\n * `aud`/`iss` when the token carries them and `exp` always. Returns the\n * caller's email (`sub`) and org domain on success, or `{ email: null,\n * orgDomain: null }` on any failure (malformed, bad signature, expired, or no\n * secret configured), never throwing.\n *\n * Exported so workspaces can accept A2A callers on the HTTP action route with\n * the same routine — including org-level fallback secrets — instead of\n * reimplementing a partial verifier. Pass the H3 `event` to enable org-domain →\n * org-secret lookup and audience derivation; it is optional.\n */\nexport async function verifyA2AToken(\n token: string,\n event?: any,\n): Promise<A2ATokenPayload> {\n // Step 1: Peek at JWT claims WITHOUT verification to get org_domain.\n // This is safe because we only use org_domain to look up the secret,\n // then verify the full JWT with that secret. If someone forges a JWT\n // with a fake org_domain, verification will fail because they don't\n // have the real secret.\n let orgDomainHint: string | undefined;\n let unverifiedPayload: jose.JWTPayload | undefined;\n try {\n unverifiedPayload = jose.decodeJwt(token);\n orgDomainHint = unverifiedPayload.org_domain as string | undefined;\n } catch {\n // Malformed token — fall through to global secret attempt\n }\n\n // Step 2: Build a small, ordered set of candidate secrets. Tokens minted by\n // current callers prefer the shared A2A_SECRET; older callers may still use\n // an org-level secret. Try both without logging or reflecting secret details.\n const candidateSecrets: string[] = [];\n addSecretCandidate(candidateSecrets, process.env.A2A_SECRET);\n if (orgDomainHint) {\n try {\n const { getA2ASecretByDomain } = await import(\"../org/context.js\");\n const orgSecret = await getA2ASecretByDomain(orgDomainHint);\n addSecretCandidate(candidateSecrets, orgSecret ?? undefined);\n } catch {\n // DB not ready or column doesn't exist yet — fall through\n }\n }\n if (candidateSecrets.length === 0) return { email: null, orgDomain: null };\n\n // Step 3: Verify JWT with the candidate secrets.\n //\n // - `audience`: passed only when the token carries an `aud` claim\n // (backward-compat: tokens minted by older `signA2AToken` versions\n // don't include one).\n // - `issuer`: enforced when the token carries an `iss` claim. The\n // sender's `signA2AToken` (`a2a/client.ts:42`) sets the issuer to its\n // own app URL, so a verified token must self-identify a non-empty\n // string issuer. We accept any string the token claims (we don't pin\n // a specific expected issuer because dispatchers may legitimately\n // mint tokens from many sender URLs — dev tunnels, multi-deploy\n // setups). The pin is \"issuer must match the value the token says\n // it was minted from\", which `jose.jwtVerify` validates exactly when\n // `issuer` is supplied as a string. Backward-compat: when the token\n // has no `iss`, we skip the check.\n try {\n const verifyOptions: jose.JWTVerifyOptions = {};\n if (unverifiedPayload && typeof unverifiedPayload.aud !== \"undefined\") {\n // Fail closed: the token was minted for a specific audience, but this\n // receiver can't derive its own expected audience (no APP_URL/URL and no\n // usable request host). Accepting here would let a correctly-signed token\n // whose `aud` targets ANOTHER service verify against a shared secret. A\n // token that self-declares an audience must be checked against ours, so\n // when we have nothing to check it against we reject rather than skip.\n const aud = expectedJwtAudience(event);\n if (!aud) return { email: null, orgDomain: null };\n verifyOptions.audience = aud;\n }\n if (\n unverifiedPayload &&\n typeof unverifiedPayload.iss === \"string\" &&\n unverifiedPayload.iss.length > 0\n ) {\n verifyOptions.issuer = unverifiedPayload.iss;\n }\n for (const secret of candidateSecrets) {\n try {\n const { payload } = await jose.jwtVerify(\n token,\n new TextEncoder().encode(secret),\n verifyOptions,\n );\n return {\n email: (payload.sub as string) ?? null,\n orgDomain: (payload.org_domain as string) ?? null,\n };\n } catch {\n // Try the next candidate without leaking which secret failed.\n }\n }\n } catch {\n // Keep malformed option construction indistinguishable from auth failure.\n }\n return { email: null, orgDomain: null };\n}\n\n/**\n * Mount A2A protocol endpoints on an H3/Nitro app.\n *\n * - GET /.well-known/agent-card.json — public agent card (no auth)\n * - POST /_agent-native/a2a — JSON-RPC endpoint (with optional auth)\n *\n * When A2A_SECRET is set, inbound Bearer tokens are verified as JWTs\n * and the caller's email is extracted from the `sub` claim. This provides\n * cryptographic identity verification for cross-app A2A calls.\n */\nexport function mountA2A(\n nitroApp: any,\n config: A2AConfig,\n routePrefix = \"/_agent-native\",\n): void {\n // Public agent card endpoint (no auth required).\n //\n // SECURITY: per-user / per-org MCP tools are filtered out of the public\n // skills list. Their merged-key prefix (`mcp__user_<emailhash>_…` or\n // `mcp__org_<orgid>_…`) discloses (a) which users have integrations\n // attached, and (b) what those integrations are — fingerprinting the\n // tenant. Template- and framework-defined skills stay; only the dynamic\n // per-tenant MCP entries are dropped. See finding #7 in\n // /tmp/security-audit/12-mcp-a2a-agent.md.\n getH3App(nitroApp).use(\n \"/.well-known/agent-card.json\",\n defineEventHandler((event) => {\n if (getMethod(event) !== \"GET\") {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n }\n const protocol =\n getRequestHeader(event, \"x-forwarded-proto\") ||\n (event.url?.protocol?.replace(\":\", \"\") ?? \"http\");\n const host = getRequestHeader(event, \"host\") ?? \"localhost\";\n const baseUrl = `${protocol}://${host}`;\n\n const filteredSkills = filterPublicAgentCardSkills(config);\n\n return generateAgentCard(\n { ...config, skills: filteredSkills },\n baseUrl,\n `${routePrefix}/a2a`,\n );\n }),\n );\n\n // Human-only continuation for consequential A2A tool calls. The opaque id\n // is a lookup handle, not authorization: every read and mutation also\n // requires the task owner's live browser session. Ordinary A2A bearer\n // tokens never reach this control plane and cannot approve themselves.\n getH3App(nitroApp).use(\n `${routePrefix}/a2a/approvals`,\n defineEventHandler(async (event) => {\n const approvalId = (event.path || \"\")\n .split(\"?\")[0]\n .replace(/^\\//, \"\")\n .split(\"/\")[0];\n if (!approvalId) {\n setResponseStatus(event, 404);\n return { error: \"Approval not found\" };\n }\n\n const { getSession } = await import(\"../server/auth.js\");\n const session = await getSession(event);\n if (!session?.email) {\n setResponseStatus(event, 401);\n return { error: \"Sign in to review this approval\" };\n }\n\n if (getMethod(event) === \"GET\") {\n const approval = await getA2AApprovalForOwner(\n approvalId,\n session.email,\n session.orgId ?? null,\n );\n if (!approval) {\n setResponseStatus(event, 404);\n return { error: \"Approval not found\" };\n }\n const safeInput = redactArgsToJson(approval.input) ?? \"{}\";\n const esc = (value: string) =>\n value.replace(\n /[&<>\"']/g,\n (char) =>\n ({\n \"&\": \"&amp;\",\n \"<\": \"&lt;\",\n \">\": \"&gt;\",\n '\"': \"&quot;\",\n \"'\": \"&#39;\",\n })[char] ?? char,\n );\n setResponseHeader(event, \"content-type\", \"text/html; charset=utf-8\");\n setResponseHeader(event, \"cache-control\", \"no-store\");\n setResponseHeader(event, \"x-frame-options\", \"DENY\");\n setResponseHeader(\n event,\n \"content-security-policy\",\n \"frame-ancestors 'none'\",\n );\n setResponseHeader(event, \"referrer-policy\", \"no-referrer\");\n const expired = approval.expiresAt <= Date.now();\n const active = approval.status === \"pending\" && !expired;\n const displayStatus = expired ? \"expired\" : approval.status;\n return `<!doctype html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Review agent action</title><style>body{font:15px/1.5 ui-sans-serif,system-ui;background:#f7f7f5;color:#171717;margin:0}.card{max-width:680px;margin:8vh auto;background:white;border:1px solid #ddd;border-radius:14px;padding:28px;box-shadow:0 12px 36px #0001}h1{font-size:22px;margin:0 0 8px}p{color:#555}pre{white-space:pre-wrap;word-break:break-word;background:#f4f4f2;padding:16px;border-radius:9px;max-height:45vh;overflow:auto}button{background:#171717;color:white;border:0;border-radius:8px;padding:11px 16px;font-weight:650;cursor:pointer}button[disabled]{opacity:.5;cursor:default}#status{margin-left:10px;color:#555}</style></head><body><main class=\"card\"><h1>Review agent action</h1><p>This action is paused until you approve it. Approval can be used once.</p><h2>${esc(approval.tool)}</h2><pre>${esc(safeInput)}</pre><button id=\"approve\" ${active ? \"\" : \"disabled\"}>${active ? \"Approve and run\" : esc(displayStatus)}</button><span id=\"status\">${active ? \"\" : esc(approval.result ?? displayStatus)}</span><script>document.getElementById('approve').onclick=async function(){this.disabled=true;document.getElementById('status').textContent='Running…';try{const r=await fetch(location.href,{method:'POST',credentials:'include',headers:{'content-type':'application/json'}});const j=await r.json();document.getElementById('status').textContent=j.output||j.error||'Done';}catch(e){document.getElementById('status').textContent='Could not run the action.'}}</script></main></body></html>`;\n }\n\n if (getMethod(event) !== \"POST\") {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n }\n if (!isSameOriginRequest(event)) {\n setResponseStatus(event, 403);\n return { error: \"Cross-origin approval denied\" };\n }\n if (!config.executeApproval) {\n setResponseStatus(event, 501);\n return { error: \"Approval execution is not configured\" };\n }\n\n const approval = await claimA2AApproval(\n approvalId,\n session.email,\n session.orgId ?? null,\n );\n if (!approval) {\n const current = await getA2AApprovalForOwner(\n approvalId,\n session.email,\n session.orgId ?? null,\n );\n setResponseStatus(event, current ? 409 : 404);\n return {\n error: current\n ? `Approval is ${current.status} and cannot be run again`\n : \"Approval not found\",\n };\n }\n\n const { runWithRequestContext } =\n await import(\"../server/request-context.js\");\n let execution: { status: \"completed\" | \"failed\"; output: string };\n try {\n execution = await runWithRequestContext(\n { userEmail: session.email, orgId: session.orgId ?? undefined },\n () => config.executeApproval!(approval),\n );\n } catch (error) {\n execution = {\n status: \"failed\",\n output:\n error instanceof Error\n ? error.message\n : \"Approval execution failed\",\n };\n }\n await settleA2AApproval(approval.id, execution.status, execution.output);\n if (execution.status === \"failed\") setResponseStatus(event, 500);\n return execution;\n }),\n );\n\n // Async-mode processor route. MUST be mounted BEFORE the `/a2a` catch-all\n // below, since h3's `.use()` matches by prefix and `/a2a` would otherwise\n // swallow `/a2a/_process-task` and return a JSON-RPC \"Invalid token\" error\n // (the JSON-RPC handler doesn't know about taskId-only bodies).\n //\n // When `message/send` is called with `async: true`, the JSON-RPC handler\n // enqueues the task and self-fires a POST to this route on the same\n // deployment so the actual handler runs in a fresh function execution (its\n // own full timeout). Authenticated with an HMAC token bound to the task id\n // (5-minute lifetime, signed with A2A_SECRET — same scheme as the\n // integration webhook queue).\n getH3App(nitroApp).use(\n `${routePrefix}/a2a/_process-task`,\n defineEventHandler(async (event) => {\n if (getMethod(event) !== \"POST\") {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n }\n\n const body = (await readBody(event)) as { taskId?: unknown } | null;\n const taskId = body && typeof body.taskId === \"string\" ? body.taskId : \"\";\n if (!taskId) {\n setResponseStatus(event, 400);\n return { error: \"taskId required\" };\n }\n\n // When A2A_SECRET is set, require a valid HMAC token bound to this\n // taskId. In production, we REQUIRE A2A_SECRET to be set so unsigned\n // dispatches are never accepted (an attacker who fishes a taskId out\n // of logs / a share link could otherwise force-replay it). In\n // development, a missing secret is permitted so local templates work\n // out of the box, but we log a one-time warning so operators notice.\n if (hasConfiguredA2ASecret()) {\n const auth = getRequestHeader(event, \"authorization\");\n const tok = extractBearerToken(auth);\n if (!verifyInternalToken(taskId, tok ?? \"\")) {\n setResponseStatus(event, 401);\n return { error: \"Invalid or expired processor token\" };\n }\n } else if (isA2AProductionRuntime()) {\n setResponseStatus(event, 503);\n return {\n error:\n \"A2A processor not configured — set A2A_SECRET on this deployment to enable async A2A.\",\n };\n } else {\n warnA2AUnauthOnce();\n }\n\n try {\n await processA2ATaskFromQueue(taskId, config, event);\n return { ok: true };\n } catch (err: any) {\n console.error(\"[a2a] process-task failed:\", err);\n setResponseStatus(event, 500);\n return { error: err?.message ?? \"process-task failed\" };\n }\n }),\n );\n\n // JSON-RPC A2A endpoint (with optional auth)\n getH3App(nitroApp).use(\n `${routePrefix}/a2a`,\n defineEventHandler(async (event) => {\n if (getMethod(event) !== \"POST\") {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n }\n\n // h3 prefix-matches mounts, so a request to `/a2a/_process-task`\n // reaches this handler too. The dedicated mount above runs first and\n // takes the request, but if that returns `undefined` (or h3 ever\n // changes ordering semantics) defensively bail here. event.path is\n // stripped to the remainder after the mount prefix.\n const sub = (event.path || \"/\").split(\"?\")[0].replace(/^\\//, \"\");\n if (sub.startsWith(\"_process-task\")) return;\n\n const authHeader = getRequestHeader(event, \"authorization\");\n const bearerToken = extractBearerToken(authHeader);\n let verifiedCallerEmail: string | null = null;\n let verifiedOrgDomain: string | null = null;\n let legacyApiKeyAuthenticated = false;\n let bearerTokenRejectedByJwt = false;\n\n // SECURITY: when neither A2A_SECRET nor an apiKeyEnv is configured,\n // there's no way to authenticate the caller. Default to \"auth required\"\n // in production — return 503 with a clear message instead of running\n // the agent loop unauthenticated. In development, log a one-time\n // warning but allow so local templates work out of the box.\n const hasA2ASecret = hasConfiguredA2ASecret();\n const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);\n\n // Try JWT verification first (org-level or global A2A_SECRET-based identity)\n if (bearerToken) {\n const tokenPayload = await verifyA2AToken(bearerToken, event);\n verifiedCallerEmail = tokenPayload.email;\n verifiedOrgDomain = tokenPayload.orgDomain;\n bearerTokenRejectedByJwt = !verifiedCallerEmail;\n }\n\n // Fall back to legacy API key check (exact string match)\n if (!verifiedCallerEmail && config.apiKeyEnv) {\n const expectedKey = process.env[config.apiKeyEnv];\n if (expectedKey) {\n if (!bearerToken) {\n setResponseStatus(event, 401);\n return {\n jsonrpc: \"2.0\",\n id: null,\n error: { code: -32001, message: \"Authentication required\" },\n };\n }\n if (bearerToken !== expectedKey) {\n setResponseStatus(event, 401);\n return {\n jsonrpc: \"2.0\",\n id: null,\n error: { code: -32001, message: \"Invalid API key\" },\n };\n }\n legacyApiKeyAuthenticated = true;\n }\n }\n\n if (!verifiedCallerEmail && !legacyApiKeyAuthenticated) {\n // Any supplied bearer token that failed JWT verification is an auth\n // failure after the legacy exact-match apiKeyEnv path has had a\n // chance to succeed. Do not let bad tokens fall through to tasks/get\n // and get reported as lookup misses.\n if (bearerTokenRejectedByJwt) {\n setResponseStatus(event, 401);\n return {\n jsonrpc: \"2.0\",\n id: null,\n error: {\n code: -32001,\n message: \"Invalid or expired A2A token\",\n },\n };\n }\n\n if (!hasA2ASecret && !hasApiKey) {\n if (isA2AProductionRuntime()) {\n setResponseStatus(event, 503);\n return {\n jsonrpc: \"2.0\",\n id: null,\n error: {\n code: -32001,\n message:\n \"A2A authentication not configured. Set A2A_SECRET (preferred) or configure apiKeyEnv to accept inbound A2A traffic.\",\n },\n };\n }\n warnA2AUnauthOnce();\n } else if (isA2AProductionRuntime()) {\n setResponseStatus(event, 401);\n return {\n jsonrpc: \"2.0\",\n id: null,\n error: {\n code: -32001,\n message: \"Authentication required\",\n },\n };\n }\n }\n\n // Store verified caller identity on the event context so the handler\n // can set request context from a trusted source instead of metadata\n if (verifiedCallerEmail) {\n event.context.__a2aVerifiedEmail = verifiedCallerEmail;\n }\n if (verifiedOrgDomain) {\n event.context.__a2aOrgDomain = verifiedOrgDomain;\n }\n\n const body = await readBody(event);\n return handleJsonRpcH3(body, event, config);\n }),\n );\n}\n\nexport function filterPublicAgentCardSkills(config: A2AConfig) {\n return (config.skills ?? []).filter((skill) => {\n const id =\n (skill as { id?: string; name?: string }).id ??\n (skill as { name?: string }).name ??\n \"\";\n if (typeof id === \"string\") {\n if (id.startsWith(\"mcp__user_\") || id.startsWith(\"mcp__org_\")) {\n return false;\n }\n }\n\n if (skill.public === false || skill.requiresAuth || skill.isConsequential) {\n return false;\n }\n\n if (!config.publicSkillsOnly) return true;\n\n if (skill.publicAgent) {\n return (\n skill.publicAgent.expose === true &&\n skill.publicAgent.readOnly === true &&\n skill.publicAgent.requiresAuth !== true &&\n skill.publicAgent.isConsequential !== true\n );\n }\n\n return skill.public === true && skill.readOnly !== false;\n });\n}\n"]}