npm - @agent-native/core - Versions diffs - 0.108.0 → 0.109.1 - Mend

@agent-native/core 0.108.0 → 0.109.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (368) hide show

package/dist/a2a/client.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAU5D,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,QAAQ,CAAO;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAE3B,YAAY,MAAc,EAAE,QAAc,EAAE,SAAiB;QAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,KAAK,CACH,YAAY,MAAM,4BAA4B,SAAS,mBAAmB,SAAS,GAAG,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,SAAkB,EAClB,SAAkB,EAClB,OAWC;IAED,MAAM,MAAM,GAAG,OAAO,EAAE,kBAAkB;QACxC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS;QACrC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,uBAAuB,CAAC;IAE1B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;QAC3B,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;QAC/B,yEAAyE;QACzE,uDAAuD;QACvD,GAAG,EAAE,KAAK;QACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,EAAE;SACb,iBAAiB,CAAC,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC;IAElD,IAAI,OAAO,EAAE,QAAQ;QAAE,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEzD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,SAAkB;IAC5D,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,MAAM,OAAO,SAAS;IACZ,OAAO,CAAS;IAChB,MAAM,CAAU;IAChB,cAAc,CAA4B;IAC1C,kBAAkB,GAAa,EAAE,CAAC;IAClC,gBAAgB,GAAG,KAAK,CAAC;IACzB,gBAAgB,CAAU;IAElC,YACE,OAAe,EACf,MAAe,EACf,OAAmE;QAEnE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,UAAU,CAAC;QACvD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC;YACrC,MAAM;YACN,GAAG,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO;QAEhD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,QAAQ,EACR,EAAE,MAAM,EAAE,SAAS,EAAE,EACrB,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;gBACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7C,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;QAClC,MAAM,CAAC,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,mBAAmB,CAAC,MAA0B;QACpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC;YACrC,MAAM;YACN,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,MAAc,EACd,MAA+B;QAE/B,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,MAAM;SACP,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAiB,IAAI,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,WAAW,MAAM,EAAE,CAAC,CAAC;gBACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,OAAO,CAAC,GAAG,CACT,0BAA0B,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,CACtE,CAAC;gBAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjD,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;gBAChD,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;gBACrE,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,MAAM,SAAS,CAAC;gBAClB,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,IAAI,CAAC,OAAO,8BAA8B,EAC7C,EAAE,EACF,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAwB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAgB,EAChB,IAaC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;YAC9C,OAAO;YACP,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,OAAgB,EAChB,IAUC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACzC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;YAC7B,WAAW;YACX,QAAQ;YACR,UAAU;YACV,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjE,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;gBAC7D,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CACX,OAAgB,EAChB,IAAiE;QAEjE,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,OAAO;gBACP,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;aACzB;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,GAAG,GAAoB,IAAI,CAAC;QAChC,IAAI,SAAS,GAAiB,IAAI,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,SAAS,CAAC,CAAC;oBACtC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjD,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;gBACpE,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,MAAM,SAAS,CAAC;gBACxD,MAAM;YACR,CAAC;YACD,IAAI,GAAG,EAAE,EAAE;gBAAE,MAAM;QACrB,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,MAAM,QAAQ,GAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,MAAc,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,4BAA4B,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,gBAAgB,EAAE,CAAC;oBACrB,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,IAAoB,EACpB,MAAM,GAAG,IAAI,CAAC,MAAM;QAEpB,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB;YACtC,CAAC,CAAC,IAAI,eAAe,EAAE;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GACT,UAAU,IAAI,IAAI,CAAC,gBAAgB;YACjC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CACxB,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,EAAE,MAAM;aAC3B,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAC/B,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACzE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YAC3D,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAoB,EAAE,OAAe;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CACnB,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiC;IAEjC,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc,EAAE,IAAY;IAC9D,OAAO,CACL,MAAM,KAAK,GAAG;QACd,sKAAsK,CAAC,IAAI,CACzK,IAAI,CACL,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAY,EACZ,IAoCC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,aAAa;QAAE,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAErE,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IACrC,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC;IAEF,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,aAAsB,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,cAAc;iBACnC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;iBACZ,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE;gBACnD,eAAe;aAChB,CAAC,CAAC;YACH,IAAI,IAAU,CAAC;YACf,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;oBACvC,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,QAAQ;oBACR,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;wBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,cAAc,EAAE,IAAI,EAAE,cAAc;oBACpC,QAAQ,EAAE,IAAI,EAAE,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;oBAChC,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,QAAQ;oBACR,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;wBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YAED,iCAAiC;YACjC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5C,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK;qBACpC,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;qBACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,IAAI,EAAE,mCAAmC,KAAK,KAAK;gBACnD,GAAG,YAAY,mBAAmB,EAClC,CAAC;gBACD,MAAM,eAAe,GAAG,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrE,IAAI,eAAe;oBAAE,OAAO,eAAe,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,aAAa,GAAG,GAAG,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,aAAa;QAAE,MAAM,aAAa,CAAC;IACvC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAKrC;IACC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,KAAyB,EAAE,EAAE;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QAC5D,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAElB,IAAI,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,GAAG,CACD,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACjE,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,GAAG,CACD,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACjE,kBAAkB,EAAE,KAAK;iBAC1B,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,iMAAiM,CAAC,IAAI,CAC3M,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,IAAU;IAChD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,KAAK;SACjB,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import * as jose from \"jose\";\n\nimport { ssrfSafeFetch } from \"../extensions/url-safety.js\";\nimport type {\n A2AApprovedAction,\n AgentCard,\n JsonRpcRequest,\n JsonRpcResponse,\n Message,\n Task,\n} from \"./types.js\";\n\nexport class A2ATaskTimeoutError extends Error {\n readonly taskId: string;\n readonly lastTask: Task;\n readonly lastState: string;\n readonly timeoutMs: number;\n\n constructor(taskId: string, lastTask: Task, timeoutMs: number) {\n const lastState = lastTask.status.state;\n super(\n `A2A task ${taskId} did not complete within ${timeoutMs}ms (last state: ${lastState})`,\n );\n this.name = \"A2ATaskTimeoutError\";\n this.taskId = taskId;\n this.lastTask = lastTask;\n this.lastState = lastState;\n this.timeoutMs = timeoutMs;\n }\n}\n\n/*\n Sign a JWT for A2A cross-app identity verification.\n \n Uses an org-level secret by default for direct org-secret workflows. Callers\n * that are doing ordinary hosted cross-app delegation can set\n * `preferGlobalSecret` so deployments with a shared A2A_SECRET don't depend on\n * every app database having an identical org row. The token contains the\n * caller's email as `sub`, so the receiving app can verify who's calling.\n /\nexport async function signA2AToken(\n email: string,\n orgDomain?: string,\n orgSecret?: string,\n options?: {\n expiresIn?: string \| number;\n preferGlobalSecret?: boolean;\n audience?: string \| string[];\n /\n Extra JWT claims to merge alongside `sub` / `org_domain`. Used by the\n * MCP connect flow to add a revocable `jti` and a `scope: \"mcp-connect\"`\n * marker. Reserved claims (`sub`, `org_domain`) cannot be overridden —\n * they are spread last so a caller can never spoof identity via this map.\n /\n extraClaims?: Record<string, unknown>;\n },\n): Promise<string> {\n const secret = options?.preferGlobalSecret\n ? process.env.A2A_SECRET \|\| orgSecret\n : orgSecret \|\| process.env.A2A_SECRET;\n if (!secret) {\n throw new Error(\n \"No A2A secret available. Set an org-level A2A secret in Team settings, \" +\n \"or set A2A_SECRET as an environment variable on all apps that need to verify identity.\",\n );\n }\n\n const appUrl =\n process.env.APP_URL \|\|\n process.env.BETTER_AUTH_URL \|\|\n \"http://localhost:3000\";\n\n const jwt = new jose.SignJWT({\n ...(options?.extraClaims ?? {}),\n // `sub` / `org_domain` are spread AFTER extraClaims so a caller-supplied\n // map can never override the verified identity claims.\n sub: email,\n ...(orgDomain ? { org_domain: orgDomain } : {}),\n })\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuer(appUrl)\n .setIssuedAt()\n .setExpirationTime(options?.expiresIn ?? \"15m\");\n\n if (options?.audience) jwt.setAudience(options.audience);\n\n return jwt.sign(new TextEncoder().encode(secret));\n}\n\nexport function shouldPreferGlobalA2ASecret(orgSecret?: string): boolean {\n return !!process.env.A2A_SECRET?.trim() \|\| !orgSecret;\n}\n\nexport class A2AClient {\n private baseUrl: string;\n private apiKey?: string;\n private apiKeyAttempts: Array<string \| undefined>;\n private endpointCandidates: string[] = [];\n private endpointResolved = false;\n private requestTimeoutMs?: number;\n\n constructor(\n baseUrl: string,\n apiKey?: string,\n options?: { requestTimeoutMs?: number; fallbackApiKeys?: string[] },\n ) {\n const normalized = baseUrl.replace(/\\/$/, \"\");\n const explicitEndpoint = splitExplicitA2AEndpoint(normalized);\n this.baseUrl = explicitEndpoint?.baseUrl ?? normalized;\n if (explicitEndpoint) {\n this.endpointCandidates = [explicitEndpoint.endpointUrl];\n this.endpointResolved = true;\n }\n this.apiKey = apiKey;\n this.apiKeyAttempts = uniqueAuthTokens([\n apiKey,\n ...(options?.fallbackApiKeys ?? []),\n ]);\n this.requestTimeoutMs = options?.requestTimeoutMs;\n }\n\n /\n Detect which A2A path the target agent uses.\n * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.\n /\n async resolveEndpoint(): Promise<void> {\n await this.ensureEndpointCandidates();\n if (this.endpointCandidates.length <= 1) return;\n\n for (const endpoint of this.endpointCandidates) {\n try {\n const res = await ssrfSafeFetch(\n endpoint,\n { method: \"OPTIONS\" },\n { maxRedirects: 3 },\n );\n if (res.status !== 404 && res.status !== 405) {\n this.endpointCandidates = [endpoint];\n return;\n }\n if (res.status === 405) {\n this.endpointCandidates = [endpoint];\n return;\n }\n } catch {\n // Try the next candidate.\n }\n }\n }\n\n private headers(apiKey = this.apiKey): Record<string, string> {\n const h: Record<string, string> = { \"Content-Type\": \"application/json\" };\n if (apiKey) {\n h[\"Authorization\"] = `Bearer ${apiKey}`;\n }\n return h;\n }\n\n private markApiKeySucceeded(apiKey: string \| undefined) {\n this.apiKey = apiKey;\n this.apiKeyAttempts = uniqueAuthTokens([\n apiKey,\n ...this.apiKeyAttempts.filter((token) => token !== apiKey),\n ]);\n }\n\n private async rpc(\n method: string,\n params: Record<string, unknown>,\n ): Promise<JsonRpcResponse> {\n const body: JsonRpcRequest = {\n jsonrpc: \"2.0\",\n id: Date.now(),\n method,\n params,\n };\n\n await this.ensureEndpointCandidates();\n let lastError: Error \| null = null;\n\n for (const url of this.endpointCandidates) {\n for (let i = 0; i < this.apiKeyAttempts.length; i++) {\n console.log(`[A2A Client] POST ${url} method=${method}`);\n const startTime = Date.now();\n const res = await this.postJson(url, body, this.apiKeyAttempts[i]);\n console.log(\n `[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`,\n );\n\n if (res.ok) {\n this.endpointCandidates = [url];\n this.markApiKeySucceeded(this.apiKeyAttempts[i]);\n return res.json() as Promise<JsonRpcResponse>;\n }\n\n const text = await res.text();\n lastError = new Error(`A2A request failed (${res.status}): ${text}`);\n if (\n i < this.apiKeyAttempts.length - 1 &&\n isA2AAuthRejectionResponse(res.status, text)\n ) {\n continue;\n }\n if (!shouldTryNextEndpoint(res.status)) {\n throw lastError;\n }\n break;\n }\n }\n\n throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n }\n\n async getAgentCard(): Promise<AgentCard> {\n const res = await ssrfSafeFetch(\n `${this.baseUrl}/.well-known/agent-card.json`,\n {},\n { maxRedirects: 3 },\n );\n if (!res.ok) {\n throw new Error(`Failed to fetch agent card (${res.status})`);\n }\n return res.json() as Promise<AgentCard>;\n }\n\n async send(\n message: Message,\n opts?: {\n contextId?: string;\n metadata?: Record<string, unknown>;\n approvedActions?: A2AApprovedAction[];\n /\n If true, ask the server to return the task immediately in `working`\n * state and process the handler in the background. The caller should\n * then poll `getTask(taskId)` until `completed` / `failed` / `canceled`.\n \n Use this when you expect the handler may exceed a synchronous\n * serverless request budget.\n /\n async?: boolean;\n },\n ): Promise<Task> {\n const response = await this.rpc(\"message/send\", {\n message,\n contextId: opts?.contextId,\n metadata: opts?.metadata,\n ...(opts?.approvedActions?.length\n ? { approvedActions: opts.approvedActions }\n : {}),\n ...(opts?.async ? { async: true } : {}),\n });\n\n if (response.error) {\n throw new Error(\n `A2A error (${response.error.code}): ${response.error.message}`,\n );\n }\n\n return response.result as Task;\n }\n\n /\n Poll for a task by id. Used in async mode after `send({ async: true })`.\n /\n async getTask(taskId: string): Promise<Task> {\n const response = await this.rpc(\"tasks/get\", { id: taskId });\n if (response.error) {\n throw new Error(\n `A2A error (${response.error.code}): ${response.error.message}`,\n );\n }\n return response.result as Task;\n }\n\n /\n Send a message in async mode and poll until the task reaches a terminal\n * state. This is the recommended path on serverless hosts with short\n * function timeouts (Netlify, Vercel) where a synchronous LLM-driven A2A\n * call can exceed the gateway limit.\n \n Each individual fetch returns quickly; long-running work happens on the\n * receiving side and is checked via `tasks/get`.\n /\n async sendAndWait(\n message: Message,\n opts?: {\n contextId?: string;\n metadata?: Record<string, unknown>;\n approvedActions?: A2AApprovedAction[];\n /* Total time to wait for completion. Default 5 min. /\n timeoutMs?: number;\n /* Poll interval. Default 2s. /\n pollIntervalMs?: number;\n /* Called with each polled task — useful for surfacing progress. /\n onUpdate?: (task: Task) => void;\n },\n ): Promise<Task> {\n const submitted = await this.send(message, {\n contextId: opts?.contextId,\n metadata: opts?.metadata,\n ...(opts?.approvedActions?.length\n ? { approvedActions: opts.approvedActions }\n : {}),\n async: true,\n });\n\n const terminalStates = new Set([\n \"completed\",\n \"failed\",\n \"canceled\",\n \"input-required\",\n ]);\n if (terminalStates.has(submitted.status.state)) return submitted;\n\n const timeoutMs = opts?.timeoutMs ?? 5 60_000;\n const pollMs = opts?.pollIntervalMs ?? 2_000;\n const deadline = Date.now() + timeoutMs;\n\n let current = submitted;\n while (Date.now() < deadline) {\n await new Promise((r) => setTimeout(r, pollMs));\n try {\n current = await this.getTask(submitted.id);\n opts?.onUpdate?.(current);\n } catch {\n // Transient fetch failure — keep polling until the deadline.\n continue;\n }\n if (terminalStates.has(current.status.state)) return current;\n }\n throw new A2ATaskTimeoutError(submitted.id, current, timeoutMs);\n }\n\n async stream(\n message: Message,\n opts?: { contextId?: string; metadata?: Record<string, unknown> },\n ): AsyncGenerator<Task> {\n const body: JsonRpcRequest = {\n jsonrpc: \"2.0\",\n id: Date.now(),\n method: \"message/stream\",\n params: {\n message,\n contextId: opts?.contextId,\n metadata: opts?.metadata,\n },\n };\n\n await this.ensureEndpointCandidates();\n let res: Response \| null = null;\n let lastError: Error \| null = null;\n for (const candidate of this.endpointCandidates) {\n for (let i = 0; i < this.apiKeyAttempts.length; i++) {\n res = await this.postJson(candidate, body, this.apiKeyAttempts[i]);\n if (res.ok) {\n this.endpointCandidates = [candidate];\n this.markApiKeySucceeded(this.apiKeyAttempts[i]);\n break;\n }\n const text = await res.text();\n lastError = new Error(`A2A stream failed (${res.status}): ${text}`);\n if (\n i < this.apiKeyAttempts.length - 1 &&\n isA2AAuthRejectionResponse(res.status, text)\n ) {\n continue;\n }\n if (!shouldTryNextEndpoint(res.status)) throw lastError;\n break;\n }\n if (res?.ok) break;\n }\n if (!res?.ok) {\n throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n }\n\n const reader = res.body?.getReader();\n if (!reader) throw new Error(\"No response body\");\n\n const decoder = new TextDecoder();\n let buffer = \"\";\n\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() ?? \"\";\n\n for (const line of lines) {\n if (!line.startsWith(\"data: \")) continue;\n const json = line.slice(6).trim();\n if (!json) continue;\n\n const response: JsonRpcResponse = JSON.parse(json);\n if (response.error) {\n throw new Error(\n `A2A error (${response.error.code}): ${response.error.message}`,\n );\n }\n if (response.result) {\n yield response.result as Task;\n }\n }\n }\n }\n\n private async ensureEndpointCandidates(): Promise<void> {\n if (this.endpointResolved) return;\n this.endpointResolved = true;\n\n const candidates: string[] = [];\n addDefaultEndpointCandidates(candidates, this.baseUrl);\n\n try {\n const card = await this.getAgentCard();\n const cardUrl = normalizeUrl(card.url, this.baseUrl);\n if (cardUrl) {\n const explicitEndpoint = splitExplicitA2AEndpoint(cardUrl);\n if (explicitEndpoint) {\n candidates.unshift(explicitEndpoint.endpointUrl);\n } else {\n addDefaultEndpointCandidates(candidates, cardUrl);\n }\n }\n } catch {\n // Agent cards are discovery hints. Fall back to conventional endpoints.\n }\n\n this.endpointCandidates = unique(candidates);\n }\n\n private async postJson(\n url: string,\n body: JsonRpcRequest,\n apiKey = this.apiKey,\n ): Promise<Response> {\n const controller = this.requestTimeoutMs\n ? new AbortController()\n : undefined;\n const timer =\n controller && this.requestTimeoutMs\n ? setTimeout(() => controller.abort(), this.requestTimeoutMs)\n : undefined;\n try {\n return await ssrfSafeFetch(\n url,\n {\n method: \"POST\",\n headers: this.headers(apiKey),\n body: JSON.stringify(body),\n signal: controller?.signal,\n },\n { maxRedirects: 3 },\n );\n } finally {\n if (timer) clearTimeout(timer);\n }\n }\n}\n\nfunction splitExplicitA2AEndpoint(\n url: string,\n): { baseUrl: string; endpointUrl: string } \| null {\n try {\n const parsed = new URL(url);\n const pathname = parsed.pathname.replace(/\\/$/, \"\");\n if (pathname.endsWith(\"/_agent-native/a2a\")) {\n parsed.pathname = pathname.slice(0, -\"/_agent-native/a2a\".length) \|\| \"/\";\n parsed.search = \"\";\n parsed.hash = \"\";\n return {\n baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n endpointUrl: url,\n };\n }\n if (pathname.endsWith(\"/a2a\")) {\n parsed.pathname = pathname.slice(0, -\"/a2a\".length) \|\| \"/\";\n parsed.search = \"\";\n parsed.hash = \"\";\n return {\n baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n endpointUrl: url,\n };\n }\n } catch {\n // Relative or invalid URLs are handled by the caller's normal fetch path.\n }\n return null;\n}\n\nfunction addDefaultEndpointCandidates(candidates: string[], baseUrl: string) {\n const base = baseUrl.replace(/\\/$/, \"\");\n candidates.push(`${base}/_agent-native/a2a`, `${base}/a2a`);\n}\n\nfunction normalizeUrl(\n value: string \| undefined,\n baseUrl: string,\n): string \| null {\n if (!value) return null;\n try {\n return new URL(value, `${baseUrl.replace(/\\/$/, \"\")}/`)\n .toString()\n .replace(/\\/$/, \"\");\n } catch {\n return null;\n }\n}\n\nfunction shouldTryNextEndpoint(status: number): boolean {\n return status === 404 \|\| status === 405;\n}\n\nfunction unique(values: string[]): string[] {\n return Array.from(new Set(values));\n}\n\nfunction uniqueAuthTokens(\n values: Array<string \| undefined>,\n): Array<string \| undefined> {\n const result: Array<string \| undefined> = [];\n for (const value of values) {\n if (result.includes(value)) continue;\n result.push(value);\n }\n if (result.length === 0) result.push(undefined);\n return result;\n}\n\nfunction isA2AAuthRejectionResponse(status: number, text: string): boolean {\n return (\n status === 401 \|\|\n /A2A error \$-32001\$: (?:Invalid or expired A2A token\|Invalid API key\|Authentication required)\|Invalid or expired A2A token\|Invalid API key\|Authentication required/i.test(\n text,\n )\n );\n}\n\n/\n One-shot convenience function: send a text message and get a text response.\n \n When A2A_SECRET is set and userEmail is provided, outbound calls are signed\n * with a JWT so the receiving app can cryptographically verify the caller's\n * identity (instead of blindly trusting metadata).\n /\nexport async function callAgent(\n url: string,\n text: string,\n opts?: {\n apiKey?: string;\n contextId?: string;\n userEmail?: string;\n orgDomain?: string;\n orgSecret?: string;\n /* Origin used to build links back to the receiving app. /\n requestOrigin?: string;\n /* Exact downstream actions explicitly authorized in the caller's chat. /\n approvedActions?: A2AApprovedAction[];\n /\n Use async/poll instead of a single blocking POST. Recommended for\n * cross-app calls that may exceed a synchronous serverless request budget.\n * Defaults to true so callers get safe behavior out of the box.\n /\n async?: boolean;\n /* Total time to wait for the polled task (default 5 min). /\n timeoutMs?: number;\n /* Poll interval for async calls. Primarily useful for tests/retries. /\n pollIntervalMs?: number;\n /\n Return receiver-verified artifact text from the last polled task when\n * the call times out. Defaults to true for backwards compatibility.\n * Callers that can continue polling the remote task separately should set\n * this to false so the A2ATaskTimeoutError (and its taskId) is preserved.\n /\n returnRecoverableArtifactsOnTimeout?: boolean;\n /\n Called with each successfully polled task while an async call is still\n * in flight (see `A2AClient.sendAndWait`). Fires once per real poll\n * round-trip that returns a task — including the terminal poll — so\n * callers can surface genuine remote liveness/progress. Not called when a\n * poll fetch throws (remote unresponsive) or when the task completes\n * synchronously on submit. Only threaded through for async calls.\n */\n onUpdate?: (task: Task) => void;\n },\n): Promise<string> {\n const metadata: Record<string, unknown> = {};\n if (opts?.userEmail) metadata.userEmail = opts.userEmail;\n if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;\n if (opts?.requestOrigin) metadata.requestOrigin = opts.requestOrigin;\n\n // Default to async + poll. The receiving A2A server's `_process-task` route\n // runs the handler in a fresh function execution (cross-platform queue\n // pattern), so async mode now works on every host instead of relying on\n // detached promises that get killed on Netlify/Vercel. Callers that\n // explicitly want a single-shot blocking POST can pass `async: false`.\n const useAsync = opts?.async ?? true;\n const message: Message = {\n role: \"user\",\n parts: [{ type: \"text\", text }],\n };\n\n const apiKeyAttempts = await buildA2AApiKeyAttempts(opts);\n let lastAuthError: unknown;\n\n for (let i = 0; i < apiKeyAttempts.length; i++) {\n try {\n const fallbackApiKeys = apiKeyAttempts\n .slice(i + 1)\n .filter((token): token is string => token !== undefined);\n const client = new A2AClient(url, apiKeyAttempts[i], {\n fallbackApiKeys,\n });\n let task: Task;\n if (useAsync) {\n task = await client.sendAndWait(message, {\n contextId: opts?.contextId,\n metadata,\n ...(opts?.approvedActions?.length\n ? { approvedActions: opts.approvedActions }\n : {}),\n timeoutMs: opts?.timeoutMs,\n pollIntervalMs: opts?.pollIntervalMs,\n onUpdate: opts?.onUpdate,\n });\n } else {\n task = await client.send(message, {\n contextId: opts?.contextId,\n metadata,\n ...(opts?.approvedActions?.length\n ? { approvedActions: opts.approvedActions }\n : {}),\n });\n }\n\n // Extract text from the response\n const responseMessage = task.status.message;\n if (responseMessage) {\n const textParts = responseMessage.parts\n .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n .map((p) => p.text);\n return textParts.join(\"\\n\");\n }\n\n return \"\";\n } catch (err) {\n if (\n opts?.returnRecoverableArtifactsOnTimeout !== false &&\n err instanceof A2ATaskTimeoutError\n ) {\n const recoverableText = extractRecoverableArtifactText(err.lastTask);\n if (recoverableText) return recoverableText;\n }\n if (i < apiKeyAttempts.length - 1 && isA2AAuthRejection(err)) {\n lastAuthError = err;\n continue;\n }\n throw err;\n }\n }\n\n if (lastAuthError) throw lastAuthError;\n return \"\";\n}\n\nasync function buildA2AApiKeyAttempts(opts?: {\n apiKey?: string;\n userEmail?: string;\n orgDomain?: string;\n orgSecret?: string;\n}): Promise<Array<string \| undefined>> {\n const attempts: Array<string \| undefined> = [];\n const add = (token: string \| undefined) => {\n if (token === undefined \|\| attempts.includes(token)) return;\n attempts.push(token);\n };\n\n add(opts?.apiKey);\n\n if (opts?.userEmail && (opts.orgSecret \|\| process.env.A2A_SECRET)) {\n if (process.env.A2A_SECRET?.trim()) {\n try {\n add(\n await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {\n preferGlobalSecret: true,\n }),\n );\n } catch {\n // Keep any explicit token attempt, then fall back below.\n }\n }\n\n if (opts.orgSecret) {\n try {\n add(\n await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {\n preferGlobalSecret: false,\n }),\n );\n } catch {\n // Fall through to the attempts we already have.\n }\n }\n }\n\n if (attempts.length === 0) attempts.push(undefined);\n return attempts;\n}\n\nfunction isA2AAuthRejection(err: unknown): boolean {\n const message = err instanceof Error ? err.message : String(err ?? \"\");\n return /A2A request failed \$401\$\|A2A error \$-32001\$: (?:Invalid or expired A2A token\|Invalid API key\|Authentication required)\|Invalid or expired A2A token\|Invalid API key\|Authentication required/i.test(\n message,\n );\n}\n\nfunction extractRecoverableArtifactText(task: Task): string {\n if (!task.status.message?.metadata?.agentNativeRecoverableArtifacts) {\n return \"\";\n }\n return extractMessageText(task.status.message);\n}\n\nfunction extractMessageText(message: Message): string {\n return message.parts\n .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n .map((p) => p.text)\n .join(\"\\n\");\n}\n"]}
1	+ {"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAYlE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,QAAQ,CAAO;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAE3B,YAAY,MAAc,EAAE,QAAc,EAAE,SAAiB;QAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,KAAK,CACH,YAAY,MAAM,4BAA4B,SAAS,mBAAmB,SAAS,GAAG,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,SAAkB,EAClB,SAAkB,EAClB,OAWC;IAED,MAAM,MAAM,GAAG,OAAO,EAAE,kBAAkB;QACxC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS;QACrC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,uBAAuB,CAAC;IAE1B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;QAC3B,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;QAC/B,yEAAyE;QACzE,uDAAuD;QACvD,GAAG,EAAE,KAAK;QACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,EAAE;SACb,iBAAiB,CAAC,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC;IAElD,IAAI,OAAO,EAAE,QAAQ;QAAE,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEzD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,SAAkB;IAC5D,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,MAAM,OAAO,SAAS;IACZ,OAAO,CAAS;IAChB,MAAM,CAAU;IAChB,cAAc,CAA4B;IAC1C,kBAAkB,GAAa,EAAE,CAAC;IAClC,gBAAgB,GAAG,KAAK,CAAC;IACzB,gBAAgB,CAAU;IAElC,YACE,OAAe,EACf,MAAe,EACf,OAAmE;QAEnE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,UAAU,CAAC;QACvD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC;YACrC,MAAM;YACN,GAAG,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO;QAEhD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,QAAQ,EACR,EAAE,MAAM,EAAE,SAAS,EAAE,EACrB,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;gBACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7C,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;QAClC,MAAM,CAAC,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,mBAAmB,CAAC,MAA0B;QACpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC;YACrC,MAAM;YACN,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,MAAc,EACd,MAA+B;QAE/B,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,MAAM;SACP,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAiB,IAAI,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,WAAW,MAAM,EAAE,CAAC,CAAC;gBACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,OAAO,CAAC,GAAG,CACT,0BAA0B,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,CACtE,CAAC;gBAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC9B,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;wBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;wBACD,SAAS,GAAG,IAAI,KAAK,CACnB,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAC9C,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;gBAC7C,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;gBACrE,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,MAAM,SAAS,CAAC;gBAClB,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,IAAI,CAAC,OAAO,8BAA8B,EAC7C,EAAE,EACF,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAwB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAgB,EAChB,IAcC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;YAC9C,OAAO;YACP,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,KAAK,GAA4B,EAAE,EACnC,IAA4C;QAE5C,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAChD,MAAM;YACN,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAiC,CAAC;IACpD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,OAAgB,EAChB,IAWC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACzC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,cAAc,EAAE,IAAI,EAAE,cAAc;YACpC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,IAOC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,SAAe,EACf,IAIC;QAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;YAC7B,WAAW;YACX,QAAQ;YACR,UAAU;YACV,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjE,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;gBAC7D,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CACX,OAAgB,EAChB,IAAiE;QAEjE,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,OAAO;gBACP,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;aACzB;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,GAAG,GAAoB,IAAI,CAAC;QAChC,IAAI,SAAS,GAAiB,IAAI,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,SAAS,CAAC,CAAC;oBACtC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjD,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;gBACpE,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,MAAM,SAAS,CAAC;gBACxD,MAAM;YACR,CAAC;YACD,IAAI,GAAG,EAAE,EAAE;gBAAE,MAAM;QACrB,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,MAAM,QAAQ,GAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,MAAc,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,4BAA4B,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,gBAAgB,EAAE,CAAC;oBACrB,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,IAAoB,EACpB,MAAM,GAAG,IAAI,CAAC,MAAM;QAEpB,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB;YACtC,CAAC,CAAC,IAAI,eAAe,EAAE;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GACT,UAAU,IAAI,IAAI,CAAC,gBAAgB;YACjC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CACxB,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,EAAE,MAAM;aAC3B,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAC/B,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACzE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YAC3D,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAoB,EAAE,OAAe;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CACnB,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiC;IAEjC,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc,EAAE,IAAY;IAC9D,OAAO,CACL,MAAM,KAAK,GAAG;QACd,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,sKAAsK,CAAC,IAAI,CACzK,IAAI,CACL,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAY,EACZ,IA6CC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,aAAa;QAAE,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACrE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAE3E,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IACrC,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC;IAEF,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,aAAsB,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,cAAc;iBACnC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;iBACZ,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE;gBACnD,eAAe;aAChB,CAAC,CAAC;YACH,IAAI,IAAU,CAAC;YACf,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,GAAG,IAAI,EAAE,MAAM;oBACjB,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE;wBACpC,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;wBACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC;oBACJ,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;wBAChC,SAAS,EAAE,IAAI,EAAE,SAAS;wBAC1B,QAAQ;wBACR,cAAc,EAAE,IAAI,EAAE,cAAc;wBACpC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;4BAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;4BAC3C,CAAC,CAAC,EAAE,CAAC;wBACP,SAAS,EAAE,IAAI,EAAE,SAAS;wBAC1B,cAAc,EAAE,IAAI,EAAE,cAAc;wBACpC,QAAQ,EAAE,IAAI,EAAE,QAAQ;qBACzB,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;oBAChC,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,QAAQ;oBACR,cAAc,EAAE,IAAI,EAAE,cAAc;oBACpC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;wBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YAED,iCAAiC;YACjC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5C,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK;qBACpC,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;qBACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,IAAI,EAAE,mCAAmC,KAAK,KAAK;gBACnD,GAAG,YAAY,mBAAmB,EAClC,CAAC;gBACD,MAAM,eAAe,GAAG,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrE,IAAI,eAAe;oBAAE,OAAO,eAAe,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,aAAa,GAAG,GAAG,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,aAAa;QAAE,MAAM,aAAa,CAAC;IACvC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,MAAc,EACd,KAAK,GAA4B,EAAE,EACnC,IAOC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,sBAAsB,CACjD,IAAI,EACJ,oBAAoB,CAAC,GAAG,CAAC,CAC1B,CAAC;IACF,MAAM,eAAe,GAAG,cAAc;SACnC,KAAK,CAAC,CAAC,CAAC;SACR,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE;QACnD,eAAe;QACf,gBAAgB,EAAE,IAAI,EAAE,gBAAgB;KACzC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,EAAE;QAC5C,QAAQ,EAAE,8BAA8B,CAAC,IAAI,EAAE,WAAW,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,IAKC,EACD,QAAiB;IAEjB,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,KAAyB,EAAE,EAAE;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QAC5D,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAElB,IAAI,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,GAAG,CACD,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACjE,kBAAkB,EAAE,IAAI;oBACxB,QAAQ;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,GAAG,CACD,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACjE,kBAAkB,EAAE,KAAK;oBACzB,QAAQ;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,iMAAiM,CAAC,IAAI,CAC3M,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,IAAU;IAChD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,KAAK;SACjB,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import * as jose from \"jose\";\n\nimport { ssrfSafeFetch } from \"../extensions/url-safety.js\";\nimport { sanitizeA2ACorrelationMetadata } from \"./correlation.js\";\nimport type {\n A2AApprovedAction,\n A2ACorrelationMetadata,\n A2AReadOnlyActionResult,\n AgentCard,\n JsonRpcRequest,\n JsonRpcResponse,\n Message,\n Task,\n} from \"./types.js\";\n\nexport class A2ATaskTimeoutError extends Error {\n readonly taskId: string;\n readonly lastTask: Task;\n readonly lastState: string;\n readonly timeoutMs: number;\n\n constructor(taskId: string, lastTask: Task, timeoutMs: number) {\n const lastState = lastTask.status.state;\n super(\n `A2A task ${taskId} did not complete within ${timeoutMs}ms (last state: ${lastState})`,\n );\n this.name = \"A2ATaskTimeoutError\";\n this.taskId = taskId;\n this.lastTask = lastTask;\n this.lastState = lastState;\n this.timeoutMs = timeoutMs;\n }\n}\n\n/*\n Sign a JWT for A2A cross-app identity verification.\n \n Uses an org-level secret by default for direct org-secret workflows. Callers\n * that are doing ordinary hosted cross-app delegation can set\n * `preferGlobalSecret` so deployments with a shared A2A_SECRET don't depend on\n * every app database having an identical org row. The token contains the\n * caller's email as `sub`, so the receiving app can verify who's calling.\n /\nexport async function signA2AToken(\n email: string,\n orgDomain?: string,\n orgSecret?: string,\n options?: {\n expiresIn?: string \| number;\n preferGlobalSecret?: boolean;\n audience?: string \| string[];\n /\n Extra JWT claims to merge alongside `sub` / `org_domain`. Used by the\n * MCP connect flow to add a revocable `jti` and a `scope: \"mcp-connect\"`\n * marker. Reserved claims (`sub`, `org_domain`) cannot be overridden —\n * they are spread last so a caller can never spoof identity via this map.\n /\n extraClaims?: Record<string, unknown>;\n },\n): Promise<string> {\n const secret = options?.preferGlobalSecret\n ? process.env.A2A_SECRET \|\| orgSecret\n : orgSecret \|\| process.env.A2A_SECRET;\n if (!secret) {\n throw new Error(\n \"No A2A secret available. Set an org-level A2A secret in Team settings, \" +\n \"or set A2A_SECRET as an environment variable on all apps that need to verify identity.\",\n );\n }\n\n const appUrl =\n process.env.APP_URL \|\|\n process.env.BETTER_AUTH_URL \|\|\n \"http://localhost:3000\";\n\n const jwt = new jose.SignJWT({\n ...(options?.extraClaims ?? {}),\n // `sub` / `org_domain` are spread AFTER extraClaims so a caller-supplied\n // map can never override the verified identity claims.\n sub: email,\n ...(orgDomain ? { org_domain: orgDomain } : {}),\n })\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuer(appUrl)\n .setIssuedAt()\n .setExpirationTime(options?.expiresIn ?? \"15m\");\n\n if (options?.audience) jwt.setAudience(options.audience);\n\n return jwt.sign(new TextEncoder().encode(secret));\n}\n\nexport function shouldPreferGlobalA2ASecret(orgSecret?: string): boolean {\n return !!process.env.A2A_SECRET?.trim() \|\| !orgSecret;\n}\n\nexport class A2AClient {\n private baseUrl: string;\n private apiKey?: string;\n private apiKeyAttempts: Array<string \| undefined>;\n private endpointCandidates: string[] = [];\n private endpointResolved = false;\n private requestTimeoutMs?: number;\n\n constructor(\n baseUrl: string,\n apiKey?: string,\n options?: { requestTimeoutMs?: number; fallbackApiKeys?: string[] },\n ) {\n const normalized = baseUrl.replace(/\\/$/, \"\");\n const explicitEndpoint = splitExplicitA2AEndpoint(normalized);\n this.baseUrl = explicitEndpoint?.baseUrl ?? normalized;\n if (explicitEndpoint) {\n this.endpointCandidates = [explicitEndpoint.endpointUrl];\n this.endpointResolved = true;\n }\n this.apiKey = apiKey;\n this.apiKeyAttempts = uniqueAuthTokens([\n apiKey,\n ...(options?.fallbackApiKeys ?? []),\n ]);\n this.requestTimeoutMs = options?.requestTimeoutMs;\n }\n\n /\n Detect which A2A path the target agent uses.\n * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.\n /\n async resolveEndpoint(): Promise<void> {\n await this.ensureEndpointCandidates();\n if (this.endpointCandidates.length <= 1) return;\n\n for (const endpoint of this.endpointCandidates) {\n try {\n const res = await ssrfSafeFetch(\n endpoint,\n { method: \"OPTIONS\" },\n { maxRedirects: 3 },\n );\n if (res.status !== 404 && res.status !== 405) {\n this.endpointCandidates = [endpoint];\n return;\n }\n if (res.status === 405) {\n this.endpointCandidates = [endpoint];\n return;\n }\n } catch {\n // Try the next candidate.\n }\n }\n }\n\n private headers(apiKey = this.apiKey): Record<string, string> {\n const h: Record<string, string> = { \"Content-Type\": \"application/json\" };\n if (apiKey) {\n h[\"Authorization\"] = `Bearer ${apiKey}`;\n }\n return h;\n }\n\n private markApiKeySucceeded(apiKey: string \| undefined) {\n this.apiKey = apiKey;\n this.apiKeyAttempts = uniqueAuthTokens([\n apiKey,\n ...this.apiKeyAttempts.filter((token) => token !== apiKey),\n ]);\n }\n\n private async rpc(\n method: string,\n params: Record<string, unknown>,\n ): Promise<JsonRpcResponse> {\n const body: JsonRpcRequest = {\n jsonrpc: \"2.0\",\n id: Date.now(),\n method,\n params,\n };\n\n await this.ensureEndpointCandidates();\n let lastError: Error \| null = null;\n\n for (const url of this.endpointCandidates) {\n for (let i = 0; i < this.apiKeyAttempts.length; i++) {\n console.log(`[A2A Client] POST ${url} method=${method}`);\n const startTime = Date.now();\n const res = await this.postJson(url, body, this.apiKeyAttempts[i]);\n console.log(\n `[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`,\n );\n\n if (res.ok) {\n const text = await res.text();\n if (\n i < this.apiKeyAttempts.length - 1 &&\n isA2AAuthRejectionResponse(res.status, text)\n ) {\n lastError = new Error(\n `A2A request failed (${res.status}): ${text}`,\n );\n continue;\n }\n this.endpointCandidates = [url];\n this.markApiKeySucceeded(this.apiKeyAttempts[i]);\n return JSON.parse(text) as JsonRpcResponse;\n }\n\n const text = await res.text();\n lastError = new Error(`A2A request failed (${res.status}): ${text}`);\n if (\n i < this.apiKeyAttempts.length - 1 &&\n isA2AAuthRejectionResponse(res.status, text)\n ) {\n continue;\n }\n if (!shouldTryNextEndpoint(res.status)) {\n throw lastError;\n }\n break;\n }\n }\n\n throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n }\n\n async getAgentCard(): Promise<AgentCard> {\n const res = await ssrfSafeFetch(\n `${this.baseUrl}/.well-known/agent-card.json`,\n {},\n { maxRedirects: 3 },\n );\n if (!res.ok) {\n throw new Error(`Failed to fetch agent card (${res.status})`);\n }\n return res.json() as Promise<AgentCard>;\n }\n\n async send(\n message: Message,\n opts?: {\n contextId?: string;\n metadata?: Record<string, unknown>;\n idempotencyKey?: string;\n approvedActions?: A2AApprovedAction[];\n /\n If true, ask the server to return the task immediately in `working`\n * state and process the handler in the background. The caller should\n * then poll `getTask(taskId)` until `completed` / `failed` / `canceled`.\n \n Use this when you expect the handler may exceed a synchronous\n * serverless request budget.\n /\n async?: boolean;\n },\n ): Promise<Task> {\n const response = await this.rpc(\"message/send\", {\n message,\n contextId: opts?.contextId,\n metadata: opts?.metadata,\n ...(opts?.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {}),\n ...(opts?.approvedActions?.length\n ? { approvedActions: opts.approvedActions }\n : {}),\n ...(opts?.async ? { async: true } : {}),\n });\n\n if (response.error) {\n throw new Error(\n `A2A error (${response.error.code}): ${response.error.message}`,\n );\n }\n\n return response.result as Task;\n }\n\n /\n Poll for a task by id. Used in async mode after `send({ async: true })`.\n /\n async getTask(taskId: string): Promise<Task> {\n const response = await this.rpc(\"tasks/get\", { id: taskId });\n if (response.error) {\n throw new Error(\n `A2A error (${response.error.code}): ${response.error.message}`,\n );\n }\n return response.result as Task;\n }\n\n /\n Execute one receiver-approved read-only action without starting the\n * receiver's agent loop. The receiver still owns validation, credentials,\n * request scoping, and the explicit action exposure decision.\n /\n async invokeAction(\n action: string,\n input: Record<string, unknown> = {},\n opts?: { metadata?: A2ACorrelationMetadata },\n ): Promise<A2AReadOnlyActionResult> {\n const metadata = sanitizeA2ACorrelationMetadata(opts?.metadata);\n const response = await this.rpc(\"actions/invoke\", {\n action,\n input,\n ...(Object.keys(metadata).length > 0 ? { metadata } : {}),\n });\n if (response.error) {\n throw new Error(\n `A2A error (${response.error.code}): ${response.error.message}`,\n );\n }\n return response.result as A2AReadOnlyActionResult;\n }\n\n /\n Send a message in async mode and poll until the task reaches a terminal\n * state. This is the recommended path on serverless hosts with short\n * function timeouts (Netlify, Vercel) where a synchronous LLM-driven A2A\n * call can exceed the gateway limit.\n \n Each individual fetch returns quickly; long-running work happens on the\n * receiving side and is checked via `tasks/get`.\n /\n async sendAndWait(\n message: Message,\n opts?: {\n contextId?: string;\n metadata?: Record<string, unknown>;\n idempotencyKey?: string;\n approvedActions?: A2AApprovedAction[];\n /* Total time to wait for completion. Default 5 min. /\n timeoutMs?: number;\n /* Poll interval. Default 2s. /\n pollIntervalMs?: number;\n /* Called with each polled task — useful for surfacing progress. /\n onUpdate?: (task: Task) => void;\n },\n ): Promise<Task> {\n const submitted = await this.send(message, {\n contextId: opts?.contextId,\n metadata: opts?.metadata,\n idempotencyKey: opts?.idempotencyKey,\n ...(opts?.approvedActions?.length\n ? { approvedActions: opts.approvedActions }\n : {}),\n async: true,\n });\n\n return this.pollTask(submitted, opts);\n }\n\n /\n Continue waiting for an existing async task without submitting a second\n * message. Use this after a bounded caller-side wait expires but the remote\n * task is still working.\n /\n async waitForTask(\n taskId: string,\n opts?: {\n /* Total time to wait for completion. Default 5 min. /\n timeoutMs?: number;\n /* Poll interval. Default 2s. /\n pollIntervalMs?: number;\n /* Called with each successfully polled task. /\n onUpdate?: (task: Task) => void;\n },\n ): Promise<Task> {\n const current = await this.getTask(taskId);\n opts?.onUpdate?.(current);\n return this.pollTask(current, opts);\n }\n\n private async pollTask(\n submitted: Task,\n opts?: {\n timeoutMs?: number;\n pollIntervalMs?: number;\n onUpdate?: (task: Task) => void;\n },\n ): Promise<Task> {\n const terminalStates = new Set([\n \"completed\",\n \"failed\",\n \"canceled\",\n \"input-required\",\n ]);\n if (terminalStates.has(submitted.status.state)) return submitted;\n\n const timeoutMs = opts?.timeoutMs ?? 5 60_000;\n const pollMs = opts?.pollIntervalMs ?? 2_000;\n const deadline = Date.now() + timeoutMs;\n\n let current = submitted;\n while (Date.now() < deadline) {\n await new Promise((r) => setTimeout(r, pollMs));\n try {\n current = await this.getTask(submitted.id);\n opts?.onUpdate?.(current);\n } catch {\n // Transient fetch failure — keep polling until the deadline.\n continue;\n }\n if (terminalStates.has(current.status.state)) return current;\n }\n throw new A2ATaskTimeoutError(submitted.id, current, timeoutMs);\n }\n\n async stream(\n message: Message,\n opts?: { contextId?: string; metadata?: Record<string, unknown> },\n ): AsyncGenerator<Task> {\n const body: JsonRpcRequest = {\n jsonrpc: \"2.0\",\n id: Date.now(),\n method: \"message/stream\",\n params: {\n message,\n contextId: opts?.contextId,\n metadata: opts?.metadata,\n },\n };\n\n await this.ensureEndpointCandidates();\n let res: Response \| null = null;\n let lastError: Error \| null = null;\n for (const candidate of this.endpointCandidates) {\n for (let i = 0; i < this.apiKeyAttempts.length; i++) {\n res = await this.postJson(candidate, body, this.apiKeyAttempts[i]);\n if (res.ok) {\n this.endpointCandidates = [candidate];\n this.markApiKeySucceeded(this.apiKeyAttempts[i]);\n break;\n }\n const text = await res.text();\n lastError = new Error(`A2A stream failed (${res.status}): ${text}`);\n if (\n i < this.apiKeyAttempts.length - 1 &&\n isA2AAuthRejectionResponse(res.status, text)\n ) {\n continue;\n }\n if (!shouldTryNextEndpoint(res.status)) throw lastError;\n break;\n }\n if (res?.ok) break;\n }\n if (!res?.ok) {\n throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n }\n\n const reader = res.body?.getReader();\n if (!reader) throw new Error(\"No response body\");\n\n const decoder = new TextDecoder();\n let buffer = \"\";\n\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() ?? \"\";\n\n for (const line of lines) {\n if (!line.startsWith(\"data: \")) continue;\n const json = line.slice(6).trim();\n if (!json) continue;\n\n const response: JsonRpcResponse = JSON.parse(json);\n if (response.error) {\n throw new Error(\n `A2A error (${response.error.code}): ${response.error.message}`,\n );\n }\n if (response.result) {\n yield response.result as Task;\n }\n }\n }\n }\n\n private async ensureEndpointCandidates(): Promise<void> {\n if (this.endpointResolved) return;\n this.endpointResolved = true;\n\n const candidates: string[] = [];\n addDefaultEndpointCandidates(candidates, this.baseUrl);\n\n try {\n const card = await this.getAgentCard();\n const cardUrl = normalizeUrl(card.url, this.baseUrl);\n if (cardUrl) {\n const explicitEndpoint = splitExplicitA2AEndpoint(cardUrl);\n if (explicitEndpoint) {\n candidates.unshift(explicitEndpoint.endpointUrl);\n } else {\n addDefaultEndpointCandidates(candidates, cardUrl);\n }\n }\n } catch {\n // Agent cards are discovery hints. Fall back to conventional endpoints.\n }\n\n this.endpointCandidates = unique(candidates);\n }\n\n private async postJson(\n url: string,\n body: JsonRpcRequest,\n apiKey = this.apiKey,\n ): Promise<Response> {\n const controller = this.requestTimeoutMs\n ? new AbortController()\n : undefined;\n const timer =\n controller && this.requestTimeoutMs\n ? setTimeout(() => controller.abort(), this.requestTimeoutMs)\n : undefined;\n try {\n return await ssrfSafeFetch(\n url,\n {\n method: \"POST\",\n headers: this.headers(apiKey),\n body: JSON.stringify(body),\n signal: controller?.signal,\n },\n { maxRedirects: 3 },\n );\n } finally {\n if (timer) clearTimeout(timer);\n }\n }\n}\n\nfunction splitExplicitA2AEndpoint(\n url: string,\n): { baseUrl: string; endpointUrl: string } \| null {\n try {\n const parsed = new URL(url);\n const pathname = parsed.pathname.replace(/\\/$/, \"\");\n if (pathname.endsWith(\"/_agent-native/a2a\")) {\n parsed.pathname = pathname.slice(0, -\"/_agent-native/a2a\".length) \|\| \"/\";\n parsed.search = \"\";\n parsed.hash = \"\";\n return {\n baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n endpointUrl: url,\n };\n }\n if (pathname.endsWith(\"/a2a\")) {\n parsed.pathname = pathname.slice(0, -\"/a2a\".length) \|\| \"/\";\n parsed.search = \"\";\n parsed.hash = \"\";\n return {\n baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n endpointUrl: url,\n };\n }\n } catch {\n // Relative or invalid URLs are handled by the caller's normal fetch path.\n }\n return null;\n}\n\nfunction addDefaultEndpointCandidates(candidates: string[], baseUrl: string) {\n const base = baseUrl.replace(/\\/$/, \"\");\n candidates.push(`${base}/_agent-native/a2a`, `${base}/a2a`);\n}\n\nfunction normalizeUrl(\n value: string \| undefined,\n baseUrl: string,\n): string \| null {\n if (!value) return null;\n try {\n return new URL(value, `${baseUrl.replace(/\\/$/, \"\")}/`)\n .toString()\n .replace(/\\/$/, \"\");\n } catch {\n return null;\n }\n}\n\nfunction shouldTryNextEndpoint(status: number): boolean {\n return status === 404 \|\| status === 405;\n}\n\nfunction unique(values: string[]): string[] {\n return Array.from(new Set(values));\n}\n\nfunction uniqueAuthTokens(\n values: Array<string \| undefined>,\n): Array<string \| undefined> {\n const result: Array<string \| undefined> = [];\n for (const value of values) {\n if (result.includes(value)) continue;\n result.push(value);\n }\n if (result.length === 0) result.push(undefined);\n return result;\n}\n\nfunction isA2AAuthRejectionResponse(status: number, text: string): boolean {\n return (\n status === 401 \|\|\n /verified, audience-bound user identity/i.test(text) \|\|\n /A2A error \$-32001\$: (?:Invalid or expired A2A token\|Invalid API key\|Authentication required)\|Invalid or expired A2A token\|Invalid API key\|Authentication required/i.test(\n text,\n )\n );\n}\n\n/\n One-shot convenience function: send a text message and get a text response.\n \n When A2A_SECRET is set and userEmail is provided, outbound calls are signed\n * with a JWT so the receiving app can cryptographically verify the caller's\n * identity (instead of blindly trusting metadata).\n /\nexport async function callAgent(\n url: string,\n text: string,\n opts?: {\n apiKey?: string;\n contextId?: string;\n userEmail?: string;\n orgDomain?: string;\n orgSecret?: string;\n /* Origin used to build links back to the receiving app. /\n requestOrigin?: string;\n /* Exact downstream actions explicitly authorized in the caller's chat. /\n approvedActions?: A2AApprovedAction[];\n /* Bounded telemetry-only lineage forwarded to the receiving app. /\n correlation?: A2ACorrelationMetadata;\n /* Stable caller-generated key for one message submission. /\n idempotencyKey?: string;\n /\n Use async/poll instead of a single blocking POST. Recommended for\n * cross-app calls that may exceed a synchronous serverless request budget.\n * Defaults to true so callers get safe behavior out of the box.\n /\n async?: boolean;\n /* Total time to wait for the polled task (default 5 min). /\n timeoutMs?: number;\n /\n Existing async task to keep polling. When set, no new message is sent.\n * This prevents a caller-side timeout from duplicating downstream work.\n /\n taskId?: string;\n /* Poll interval for async calls. Primarily useful for tests/retries. /\n pollIntervalMs?: number;\n /\n Return receiver-verified artifact text from the last polled task when\n * the call times out. Defaults to true for backwards compatibility.\n * Callers that can continue polling the remote task separately should set\n * this to false so the A2ATaskTimeoutError (and its taskId) is preserved.\n /\n returnRecoverableArtifactsOnTimeout?: boolean;\n /\n Called with each successfully polled task while an async call is still\n * in flight (see `A2AClient.sendAndWait`). Fires once per real poll\n * round-trip that returns a task — including the terminal poll — so\n * callers can surface genuine remote liveness/progress. Not called when a\n * poll fetch throws (remote unresponsive) or when the task completes\n * synchronously on submit. Only threaded through for async calls.\n /\n onUpdate?: (task: Task) => void;\n },\n): Promise<string> {\n const metadata: Record<string, unknown> = {};\n if (opts?.userEmail) metadata.userEmail = opts.userEmail;\n if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;\n if (opts?.requestOrigin) metadata.requestOrigin = opts.requestOrigin;\n Object.assign(metadata, sanitizeA2ACorrelationMetadata(opts?.correlation));\n\n // Default to async + poll. The receiving A2A server's `_process-task` route\n // runs the handler in a fresh function execution (cross-platform queue\n // pattern), so async mode now works on every host instead of relying on\n // detached promises that get killed on Netlify/Vercel. Callers that\n // explicitly want a single-shot blocking POST can pass `async: false`.\n const useAsync = opts?.async ?? true;\n const message: Message = {\n role: \"user\",\n parts: [{ type: \"text\", text }],\n };\n\n const apiKeyAttempts = await buildA2AApiKeyAttempts(opts);\n let lastAuthError: unknown;\n\n for (let i = 0; i < apiKeyAttempts.length; i++) {\n try {\n const fallbackApiKeys = apiKeyAttempts\n .slice(i + 1)\n .filter((token): token is string => token !== undefined);\n const client = new A2AClient(url, apiKeyAttempts[i], {\n fallbackApiKeys,\n });\n let task: Task;\n if (useAsync) {\n task = opts?.taskId\n ? await client.waitForTask(opts.taskId, {\n timeoutMs: opts.timeoutMs,\n pollIntervalMs: opts.pollIntervalMs,\n onUpdate: opts.onUpdate,\n })\n : await client.sendAndWait(message, {\n contextId: opts?.contextId,\n metadata,\n idempotencyKey: opts?.idempotencyKey,\n ...(opts?.approvedActions?.length\n ? { approvedActions: opts.approvedActions }\n : {}),\n timeoutMs: opts?.timeoutMs,\n pollIntervalMs: opts?.pollIntervalMs,\n onUpdate: opts?.onUpdate,\n });\n } else {\n if (opts?.taskId) {\n throw new Error(\"Polling an existing A2A task requires async mode\");\n }\n task = await client.send(message, {\n contextId: opts?.contextId,\n metadata,\n idempotencyKey: opts?.idempotencyKey,\n ...(opts?.approvedActions?.length\n ? { approvedActions: opts.approvedActions }\n : {}),\n });\n }\n\n // Extract text from the response\n const responseMessage = task.status.message;\n if (responseMessage) {\n const textParts = responseMessage.parts\n .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n .map((p) => p.text);\n return textParts.join(\"\\n\");\n }\n\n return \"\";\n } catch (err) {\n if (\n opts?.returnRecoverableArtifactsOnTimeout !== false &&\n err instanceof A2ATaskTimeoutError\n ) {\n const recoverableText = extractRecoverableArtifactText(err.lastTask);\n if (recoverableText) return recoverableText;\n }\n if (i < apiKeyAttempts.length - 1 && isA2AAuthRejection(err)) {\n lastAuthError = err;\n continue;\n }\n throw err;\n }\n }\n\n if (lastAuthError) throw lastAuthError;\n return \"\";\n}\n\n/\n Invoke one receiver-approved read-only action with an audience-bound user\n * token. Unlike conversational delegation, this never starts the receiver's\n * model loop.\n */\nexport async function callAction(\n url: string,\n action: string,\n input: Record<string, unknown> = {},\n opts?: {\n apiKey?: string;\n userEmail?: string;\n orgDomain?: string;\n orgSecret?: string;\n requestTimeoutMs?: number;\n correlation?: A2ACorrelationMetadata;\n },\n): Promise<A2AReadOnlyActionResult> {\n const actionName = action.trim();\n if (!actionName) throw new Error(\"A2A action name is required\");\n if (!input \|\| typeof input !== \"object\" \|\| Array.isArray(input)) {\n throw new Error(\"A2A action input must be an object\");\n }\n\n const apiKeyAttempts = await buildA2AApiKeyAttempts(\n opts,\n normalizeA2AAudience(url),\n );\n const fallbackApiKeys = apiKeyAttempts\n .slice(1)\n .filter((token): token is string => token !== undefined);\n const client = new A2AClient(url, apiKeyAttempts[0], {\n fallbackApiKeys,\n requestTimeoutMs: opts?.requestTimeoutMs,\n });\n return client.invokeAction(actionName, input, {\n metadata: sanitizeA2ACorrelationMetadata(opts?.correlation),\n });\n}\n\nasync function buildA2AApiKeyAttempts(\n opts?: {\n apiKey?: string;\n userEmail?: string;\n orgDomain?: string;\n orgSecret?: string;\n },\n audience?: string,\n): Promise<Array<string \| undefined>> {\n const attempts: Array<string \| undefined> = [];\n const add = (token: string \| undefined) => {\n if (token === undefined \|\| attempts.includes(token)) return;\n attempts.push(token);\n };\n\n add(opts?.apiKey);\n\n if (opts?.userEmail && (opts.orgSecret \|\| process.env.A2A_SECRET)) {\n if (process.env.A2A_SECRET?.trim()) {\n try {\n add(\n await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {\n preferGlobalSecret: true,\n audience,\n }),\n );\n } catch {\n // Keep any explicit token attempt, then fall back below.\n }\n }\n\n if (opts.orgSecret) {\n try {\n add(\n await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {\n preferGlobalSecret: false,\n audience,\n }),\n );\n } catch {\n // Fall through to the attempts we already have.\n }\n }\n }\n\n if (attempts.length === 0) attempts.push(undefined);\n return attempts;\n}\n\nfunction normalizeA2AAudience(url: string): string {\n const explicit = splitExplicitA2AEndpoint(url.replace(/\\/$/, \"\"));\n return (explicit?.baseUrl ?? url).replace(/\\/$/, \"\");\n}\n\nfunction isA2AAuthRejection(err: unknown): boolean {\n const message = err instanceof Error ? err.message : String(err ?? \"\");\n return /A2A request failed \$401\$\|A2A error \$-32001\$: (?:Invalid or expired A2A token\|Invalid API key\|Authentication required)\|Invalid or expired A2A token\|Invalid API key\|Authentication required/i.test(\n message,\n );\n}\n\nfunction extractRecoverableArtifactText(task: Task): string {\n if (!task.status.message?.metadata?.agentNativeRecoverableArtifacts) {\n return \"\";\n }\n return extractMessageText(task.status.message);\n}\n\nfunction extractMessageText(message: Message): string {\n return message.parts\n .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n .map((p) => p.text)\n .join(\"\\n\");\n}\n"]}

package/dist/a2a/correlation.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+import type { A2ACorrelationMetadata } from "./types.js";
+export declare const MAX_A2A_CORRELATION_VALUE_CHARS = 200;
+export declare function sanitizeA2ACorrelationId(value: unknown): string | undefined;
+/**
+ * Keep only bounded, opaque ASCII correlation identifiers. These values
+ * remain telemetry hints; authentication continues to come exclusively from
+ * the verified A2A token/request context.
+ */
+export declare function sanitizeA2ACorrelationMetadata(value: unknown): A2ACorrelationMetadata;
+//# sourceMappingURL=correlation.d.ts.map

package/dist/a2a/correlation.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"correlation.d.ts","sourceRoot":"","sources":["../../src/a2a/correlation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAqBnD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,GACb,sBAAsB,CAexB"}

package/dist/a2a/correlation.js ADDED Viewed

@@ -0,0 +1,40 @@
+export const MAX_A2A_CORRELATION_VALUE_CHARS = 200;
+const APP_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const CORRELATION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+function boundedIdentifier(value, pattern) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    if (!trimmed ||
+        trimmed.length > MAX_A2A_CORRELATION_VALUE_CHARS ||
+        !pattern.test(trimmed)) {
+        return undefined;
+    }
+    return trimmed;
+}
+export function sanitizeA2ACorrelationId(value) {
+    return boundedIdentifier(value, CORRELATION_ID_PATTERN);
+}
+/**
+ * Keep only bounded, opaque ASCII correlation identifiers. These values
+ * remain telemetry hints; authentication continues to come exclusively from
+ * the verified A2A token/request context.
+ */
+export function sanitizeA2ACorrelationMetadata(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return {};
+    const metadata = value;
+    const callerApp = boundedIdentifier(metadata.callerApp, APP_ID_PATTERN);
+    const callerThreadId = sanitizeA2ACorrelationId(metadata.callerThreadId);
+    const parentRunId = sanitizeA2ACorrelationId(metadata.parentRunId);
+    const parentTurnId = sanitizeA2ACorrelationId(metadata.parentTurnId);
+    const invocationId = sanitizeA2ACorrelationId(metadata.invocationId);
+    return {
+        ...(callerApp ? { callerApp } : {}),
+        ...(callerThreadId ? { callerThreadId } : {}),
+        ...(parentRunId ? { parentRunId } : {}),
+        ...(parentTurnId ? { parentTurnId } : {}),
+        ...(invocationId ? { invocationId } : {}),
+    };
+}
+//# sourceMappingURL=correlation.js.map

package/dist/a2a/correlation.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"correlation.js","sourceRoot":"","sources":["../../src/a2a/correlation.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD,MAAM,cAAc,GAAG,8BAA8B,CAAC;AACtD,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAE/D,SAAS,iBAAiB,CACxB,KAAc,EACd,OAAe;IAEf,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IACE,CAAC,OAAO;QACR,OAAO,CAAC,MAAM,GAAG,+BAA+B;QAChD,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,wBAAwB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrE,OAAO;QACL,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC","sourcesContent":["import type { A2ACorrelationMetadata } from \"./types.js\";\n\nexport const MAX_A2A_CORRELATION_VALUE_CHARS = 200;\n\nconst APP_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\nconst CORRELATION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;\n\nfunction boundedIdentifier(\n value: unknown,\n pattern: RegExp,\n): string | undefined {\n if (typeof value !== \"string\") return undefined;\n const trimmed = value.trim();\n if (\n !trimmed ||\n trimmed.length > MAX_A2A_CORRELATION_VALUE_CHARS ||\n !pattern.test(trimmed)\n ) {\n return undefined;\n }\n return trimmed;\n}\n\nexport function sanitizeA2ACorrelationId(value: unknown): string | undefined {\n return boundedIdentifier(value, CORRELATION_ID_PATTERN);\n}\n\n/**\n * Keep only bounded, opaque ASCII correlation identifiers. These values\n * remain telemetry hints; authentication continues to come exclusively from\n * the verified A2A token/request context.\n */\nexport function sanitizeA2ACorrelationMetadata(\n value: unknown,\n): A2ACorrelationMetadata {\n if (!value || typeof value !== \"object\" || Array.isArray(value)) return {};\n const metadata = value as Record<string, unknown>;\n const callerApp = boundedIdentifier(metadata.callerApp, APP_ID_PATTERN);\n const callerThreadId = sanitizeA2ACorrelationId(metadata.callerThreadId);\n const parentRunId = sanitizeA2ACorrelationId(metadata.parentRunId);\n const parentTurnId = sanitizeA2ACorrelationId(metadata.parentTurnId);\n const invocationId = sanitizeA2ACorrelationId(metadata.invocationId);\n return {\n ...(callerApp ? { callerApp } : {}),\n ...(callerThreadId ? { callerThreadId } : {}),\n ...(parentRunId ? { parentRunId } : {}),\n ...(parentTurnId ? { parentTurnId } : {}),\n ...(invocationId ? { invocationId } : {}),\n };\n}\n"]}

package/dist/a2a/handlers.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/a2a/handlers.ts"],"names":[],"mappings":"~~AA+BA~~,OAAO,KAAK,EAEV,SAAS,EAIT,eAAe,EAGhB,MAAM,YAAY,CAAC;~~AA6LpB~~;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,EACjB,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,IAAI,CAAC,CAsFf;~~AAitBD~~;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,GAAG,EACT,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,eAAe,CAAC,~~CAyC1B~~"}
1	+ {"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/a2a/handlers.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAEV,SAAS,EAIT,eAAe,EAGhB,MAAM,YAAY,CAAC;AAgMpB;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,EACjB,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,IAAI,CAAC,CAsFf;AA43BD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,GAAG,EACT,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,eAAe,CAAC,CA6C1B"}

package/dist/a2a/handlers.js CHANGED Viewed

@@ -1,11 +1,15 @@
+import crypto from "node:crypto";
 import { setResponseHeader, setResponseStatus } from "h3";
 import { AGENT_BACKGROUND_PROCESSOR_A2A, AGENT_BACKGROUND_PROCESSOR_FIELD, dispatchPathTargetsNetlifyBackgroundFunction, isAgentChatDurableBackgroundEnabled, resolveAgentChatProcessRunDispatchPath, } from "../agent/durable-background.js";
+import { trackingIdentityProperties } from "../observability/tracking-identity.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { getOrigin, isConfiguredAppOrigin } from "../server/google-oauth.js";
 import { fireInternalDispatch } from "../server/self-dispatch.js";
 import { agentChat } from "../shared/agent-chat.js";
+import { track } from "../tracking/registry.js";
 import { hasConfiguredA2ASecret, isA2AProductionRuntime, } from "./auth-policy.js";
-import { createTask, getTask, getTaskOwner, updateTask, claimA2ATaskForProcessing, getA2ATaskDispatchState, failStuckA2ATask, failStuckQueuedA2ATask, settleProcessingA2ATask, touchQueuedA2ATaskDispatch, touchProcessingA2ATask, pauseProcessingA2ATask, } from "./task-store.js";
+import { sanitizeA2ACorrelationMetadata } from "./correlation.js";
+import { createTask, createOrReuseTask, getTask, getTaskOwnership, updateTask, claimA2ATaskForProcessing, getA2ATaskDispatchState, failStuckA2ATask, failStuckQueuedA2ATask, settleProcessingA2ATask, touchQueuedA2ATaskDispatch, touchProcessingA2ATask, pauseProcessingA2ATask, MAX_A2A_IDEMPOTENCY_KEY_CHARS, A2A_PERSONAL_OWNER_SCOPE, } from "./task-store.js";
 // Inlined to avoid pulling the entire core-routes-plugin (and its h3
 // transitive deps) into the a2a/handlers test boundary. Must stay in sync
 // with FRAMEWORK_ROUTE_PREFIX in `server/core-routes-plugin.ts`.
@@ -15,6 +19,9 @@ const A2A_QUEUED_DISPATCH_STUCK_AFTER_MS = 10_000;
 const A2A_PROCESSING_STUCK_AFTER_MS = 5 * 60 * 1000;
 const A2A_PROCESSING_HEARTBEAT_MS = 30_000;
 const MAX_A2A_APPROVED_ACTIONS = 10;
+const MAX_A2A_DIRECT_ACTION_NAME_CHARS = 200;
+const MAX_A2A_DIRECT_ACTION_INPUT_BYTES = 64 * 1024;
+const A2A_READ_INVOKE_EVENT = "$a2a_read_invoke";
 function trustedApprovedActions(value, event) {
     // Static API keys and unsigned requests do not prove which user authorized
     // a consequential action. Only a verified identity-bearing JWT may carry
@@ -428,6 +435,17 @@ async function runHandlerAndPersist(taskId, message, config, contextId, metadata
         });
     }
 }
+function verifiedTaskOwner(event) {
+    const ownerEmail = event?.context?.__a2aVerifiedEmail ?? null;
+    return {
+        ownerEmail,
+        ownerScope: ownerEmail
+            ? (event?.context?.__a2aOrgDomain
+                ?.trim()
+                .toLowerCase() ?? A2A_PERSONAL_OWNER_SCOPE)
+            : null,
+    };
+}
 async function handleSend(params, config, event) {
     const message = params.message;
     if (!message || !message.role || !Array.isArray(message.parts)) {
@@ -444,7 +462,24 @@ async function handleSend(params, config, event) {
     // on every subsequent tasks/get and tasks/cancel call. Caller-supplied
     // metadata.userEmail is NEVER used for ownership; that would re-introduce
     // the IDOR class fixed here.
-    const ownerEmailForTask = event?.context?.__a2aVerifiedEmail ?? null;
+    const { ownerEmail: ownerEmailForTask, ownerScope: ownerScopeForTask } = verifiedTaskOwner(event);
+    let idempotencyKey;
+    if (ownerEmailForTask && params.idempotencyKey !== undefined) {
+        if (typeof params.idempotencyKey !== "string") {
+            return {
+                ...jsonRpcError(0, -32602, "Invalid params: idempotencyKey must be a string"),
+                _id: 0,
+            };
+        }
+        idempotencyKey = params.idempotencyKey.trim();
+        if (!idempotencyKey ||
+            idempotencyKey.length > MAX_A2A_IDEMPOTENCY_KEY_CHARS) {
+            return {
+                ...jsonRpcError(0, -32602, "Invalid params: idempotencyKey is invalid"),
+                _id: 0,
+            };
+        }
+    }
     // Async mode: return the task immediately in `working` state, run the
     // handler in the background, and let the caller poll `tasks/get`. This is
     // the workaround for synchronous serverless request timeouts when the handler
@@ -455,6 +490,8 @@ async function handleSend(params, config, event) {
     // requests. Async is also refused entirely when no auth is configured in
     // production — see the additional gate below.
     const asyncMode = params.async === true || (event && event.context?.__a2aForceAsync === true);
+    if (!asyncMode)
+        idempotencyKey = undefined;
     if (asyncMode) {
         // Refuse async mode entirely when no auth is configured in production.
         // The async dispatch path self-fires the `_process-task` route, which
@@ -494,7 +531,13 @@ async function handleSend(params, config, event) {
                 approvedActions: approvedActions ?? null,
             },
         };
-        const task = await createTask(message, contextId, taskMetadata, ownerEmailForTask);
+        const { task, reused } = await createOrReuseTask(message, contextId, taskMetadata, ownerEmailForTask, ownerScopeForTask, idempotencyKey);
+        if (reused) {
+            return {
+                ...jsonRpcResult(0, sanitizeTaskForResponse(task)),
+                _id: 0,
+            };
+        }
         const working = await updateTask(task.id, { state: "working" });
         // Awaited, not fire-and-forget: this handler is about to return, and a
         // detached dispatch fetch racing only a short settle timer can be killed
@@ -515,7 +558,13 @@ async function handleSend(params, config, event) {
         };
     }
     return withA2ARequestContext(metadata, event, async () => {
-        const task = await createTask(message, contextId, undefined, ownerEmailForTask);
+        const { task, reused } = await createOrReuseTask(message, contextId, undefined, ownerEmailForTask, ownerScopeForTask, idempotencyKey);
+        if (reused) {
+            return {
+                ...jsonRpcResult(0, sanitizeTaskForResponse(task)),
+                _id: 0,
+            };
+        }
         await updateTask(task.id, { state: "working" });
         const ctx = makeHandlerContext(task.id, contextId, trustedA2AMetadata(metadata, event), event, approvedActions);
         try {
@@ -585,9 +634,9 @@ async function handleStream(params, config, res, event) {
     const contextId = params.contextId;
     const metadata = params.metadata;
     const approvedActions = trustedApprovedActions(params.approvedActions, event);
-    const ownerEmailForTask = event?.context?.__a2aVerifiedEmail ?? null;
+    const { ownerEmail: ownerEmailForTask, ownerScope: ownerScopeForTask } = verifiedTaskOwner(event);
     await withA2ARequestContext(metadata, event, async () => {
-        const task = await createTask(message, contextId, undefined, ownerEmailForTask);
+        const task = await createTask(message, contextId, undefined, ownerEmailForTask, ownerScopeForTask);
         await updateTask(task.id, { state: "working" });
         const { context, artifacts } = makeHandlerContext(task.id, contextId, trustedA2AMetadata(metadata, event), event, approvedActions);
         try {
@@ -650,9 +699,11 @@ const SENSITIVE_METADATA_KEYS = new Set([
 function sanitizeTaskForResponse(task) {
     if (!task || typeof task !== "object")
         return task;
-    if (!task.metadata || typeof task.metadata !== "object")
-        return task;
-    const meta = task.metadata;
+    const { ownerEmail: _ownerEmail, ownerScope: _ownerScope, ...publicTask } = task;
+    if (!publicTask.metadata || typeof publicTask.metadata !== "object") {
+        return publicTask;
+    }
+    const meta = publicTask.metadata;
     const publicMeta = {};
     for (const [k, v] of Object.entries(meta)) {
         if (k === "__a2a_processor")
@@ -661,7 +712,7 @@ function sanitizeTaskForResponse(task) {
             continue;
         publicMeta[k] = v;
     }
-    return { ...task, metadata: publicMeta };
+    return { ...publicTask, metadata: publicMeta };
 }
 /**
  * Reject access when the task has a recorded owner that doesn't match the
@@ -677,7 +728,7 @@ function sanitizeTaskForResponse(task) {
  *   no way to authenticate the caller, so the only safe response is "not
  *   found".
  */
-function authorizeTaskAccess(taskOwnerEmail, event, config) {
+function authorizeTaskAccess(taskOwnerEmail, taskOwnerScope, event, config) {
     const verifiedEmail = event?.context?.__a2aVerifiedEmail ?? null;
     const hasA2ASecret = hasConfiguredA2ASecret();
     const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);
@@ -693,6 +744,14 @@ function authorizeTaskAccess(taskOwnerEmail, event, config) {
         if (verifiedEmail.toLowerCase() !== taskOwnerEmail.toLowerCase()) {
             return jsonRpcError(0, -32001, "Task not found");
         }
+        if (taskOwnerScope) {
+            const verifiedScope = event?.context?.__a2aOrgDomain
+                ?.trim()
+                .toLowerCase() ?? A2A_PERSONAL_OWNER_SCOPE;
+            if (verifiedScope !== taskOwnerScope.toLowerCase()) {
+                return jsonRpcError(0, -32001, "Task not found");
+            }
+        }
     }
     // Legacy row (no owner_email recorded). The route-level auth gate is the
     // only thing protecting it — fall through and serve.
@@ -703,8 +762,8 @@ async function handleGet(params, event, config) {
     if (!id) {
         return jsonRpcError(0, -32602, "Invalid params: id required");
     }
-    const ownerEmail = await getTaskOwner(id);
-    const denied = authorizeTaskAccess(ownerEmail, event, config);
+    const ownership = await getTaskOwnership(id);
+    const denied = authorizeTaskAccess(ownership.ownerEmail, ownership.ownerScope, event, config);
     if (denied)
         return denied;
     const task = await getTask(id);
@@ -772,8 +831,8 @@ async function handleCancel(params, event, config) {
     if (!id) {
         return jsonRpcError(0, -32602, "Invalid params: id required");
     }
-    const ownerEmail = await getTaskOwner(id);
-    const denied = authorizeTaskAccess(ownerEmail, event, config);
+    const ownership = await getTaskOwnership(id);
+    const denied = authorizeTaskAccess(ownership.ownerEmail, ownership.ownerScope, event, config);
     if (denied)
         return denied;
     const task = await updateTask(id, { state: "canceled" });
@@ -782,6 +841,75 @@ async function handleCancel(params, event, config) {
     }
     return jsonRpcResult(0, sanitizeTaskForResponse(task));
 }
+async function handleInvokeReadOnlyAction(params, event, config) {
+    const action = typeof params.action === "string" ? params.action.trim() : "";
+    const input = params.input ?? {};
+    if (!action) {
+        return jsonRpcError(0, -32602, "Invalid params: action required");
+    }
+    if (action.length > MAX_A2A_DIRECT_ACTION_NAME_CHARS) {
+        return jsonRpcError(0, -32602, "Invalid params: action is too long");
+    }
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+        return jsonRpcError(0, -32602, "Invalid params: input must be an object");
+    }
+    let inputBytes;
+    try {
+        inputBytes = Buffer.byteLength(JSON.stringify(input), "utf8");
+    }
+    catch {
+        return jsonRpcError(0, -32602, "Invalid params: input must be JSON-safe");
+    }
+    if (inputBytes > MAX_A2A_DIRECT_ACTION_INPUT_BYTES) {
+        return jsonRpcError(0, -32602, "Invalid params: input is too large");
+    }
+    if (!event?.context?.__a2aVerifiedEmail ||
+        event?.context?.__a2aAudienceVerified !== true) {
+        return jsonRpcError(0, -32001, "A verified, audience-bound user identity is required for direct action invocation");
+    }
+    if (!config.executeReadOnlyAction) {
+        return jsonRpcError(0, -32601, "Direct action invocation not supported");
+    }
+    const startedAt = Date.now();
+    const correlation = sanitizeA2ACorrelationMetadata(params.metadata);
+    const invocationId = crypto.randomUUID();
+    const verifiedEmail = event.context.__a2aVerifiedEmail;
+    const emitTracking = (status) => {
+        const identity = trackingIdentityProperties();
+        track(A2A_READ_INVOKE_EVENT, {
+            ...identity,
+            action,
+            receiver_app: config.appId ?? identity.app ?? config.name,
+            caller_app: correlation.callerApp ?? "unknown",
+            duration_ms: Math.max(0, Date.now() - startedAt),
+            status,
+            invocation_id: invocationId,
+            ...(correlation.parentRunId
+                ? { parent_run_id: correlation.parentRunId }
+                : {}),
+            ...(correlation.parentTurnId
+                ? { parent_turn_id: correlation.parentTurnId }
+                : {}),
+            ...(correlation.invocationId
+                ? { caller_invocation_id: correlation.invocationId }
+                : {}),
+        }, { userId: verifiedEmail });
+    };
+    try {
+        const result = await withA2ARequestContext(undefined, event, () => config.executeReadOnlyAction({
+            action,
+            input: input,
+            invocationId,
+        }));
+        emitTracking(result.status);
+        return jsonRpcResult(0, { action, ...result });
+    }
+    catch (error) {
+        emitTracking("failed");
+        console.error(`[a2a] Direct action ${action} failed:`, error);
+        return jsonRpcError(0, -32000, "Direct action invocation failed");
+    }
+}
 /**
  * H3-compatible JSON-RPC handler. Returns JSON directly (H3 serializes it).
  * Streaming is handled via H3's node response when needed.
@@ -822,6 +950,10 @@ export async function handleJsonRpcH3(body, event, config) {
             const result = await handleCancel(params, event, config);
             return { ...result, id };
         }
+        case "actions/invoke": {
+            const result = await handleInvokeReadOnlyAction(params, event, config);
+            return { ...result, id };
+        }
         default:
             return jsonRpcError(id, -32601, `Method not found: ${body.method}`);
     }