@agent-native/core 0.128.3 → 0.129.0

package/corpus/templates/macros/.agents/skills/security/SKILL.md

@@ -163,7 +163,9 @@ private UI after the shell loads. See the `authentication` skill and
 proves *someone* is signed in. To restrict an operation to some teammates, set
 `authorize` on the `defineAction`. It wraps `run`, so it applies at every
 dispatch site (agent tool, HTTP, frontend, MCP, A2A, CLI) — unlike
-`needsApproval`, which is honoured only in the agent loop.
+`needsApproval`, which is honored by the agent loop and MCP 2026 hosts that
+support elicitation, but is not an authorization boundary for every dispatch
+site.
 
 ```ts
 import { coachAccess } from "../lib/access.js"; // defineAppRoles(...)
@@ -203,7 +205,16 @@ export default defineAction({
 });
 ```
 
-When the gate is truthy and the call is not yet approved, the loop emits an `approval_required` event and **stops the turn — `run()` never executes**. The human approves via the chat UI's Approve affordance, which re-issues the turn with the call's stable `approvalKey`; only then does the action run. A predicate gates conditionally (e.g. only external recipients) and **fails closed** — a throw is treated as "approval required".
+When the gate is truthy and the call is not yet approved, the agent loop emits
+an `approval_required` event and **stops the turn — `run()` never executes**.
+The human approves via the chat UI's Approve affordance, which re-issues the
+turn with the call's stable `approvalKey`; only then does the action run. MCP
+2026 hosts receive an `input_required` approval request bound to the exact
+caller, action, and arguments. The signed response state is backed by a durable,
+single-use grant, so denial, expiry, replay, missing host support, or invalid
+state fails closed before `run()`. A predicate gates conditionally (e.g. only
+external recipients) and **fails closed** — a throw is treated as "approval
+required".
 
 Rules:
 

package/corpus/templates/mail/.agents/skills/security/SKILL.md

@@ -163,7 +163,9 @@ private UI after the shell loads. See the `authentication` skill and
 proves *someone* is signed in. To restrict an operation to some teammates, set
 `authorize` on the `defineAction`. It wraps `run`, so it applies at every
 dispatch site (agent tool, HTTP, frontend, MCP, A2A, CLI) — unlike
-`needsApproval`, which is honoured only in the agent loop.
+`needsApproval`, which is honored by the agent loop and MCP 2026 hosts that
+support elicitation, but is not an authorization boundary for every dispatch
+site.
 
 ```ts
 import { coachAccess } from "../lib/access.js"; // defineAppRoles(...)
@@ -203,7 +205,16 @@ export default defineAction({
 });
 ```
 
-When the gate is truthy and the call is not yet approved, the loop emits an `approval_required` event and **stops the turn — `run()` never executes**. The human approves via the chat UI's Approve affordance, which re-issues the turn with the call's stable `approvalKey`; only then does the action run. A predicate gates conditionally (e.g. only external recipients) and **fails closed** — a throw is treated as "approval required".
+When the gate is truthy and the call is not yet approved, the agent loop emits
+an `approval_required` event and **stops the turn — `run()` never executes**.
+The human approves via the chat UI's Approve affordance, which re-issues the
+turn with the call's stable `approvalKey`; only then does the action run. MCP
+2026 hosts receive an `input_required` approval request bound to the exact
+caller, action, and arguments. The signed response state is backed by a durable,
+single-use grant, so denial, expiry, replay, missing host support, or invalid
+state fails closed before `run()`. A predicate gates conditionally (e.g. only
+external recipients) and **fails closed** — a throw is treated as "approval
+required".
 
 Rules:
 

package/corpus/templates/plan/.agents/skills/security/SKILL.md

@@ -163,7 +163,9 @@ private UI after the shell loads. See the `authentication` skill and
 proves *someone* is signed in. To restrict an operation to some teammates, set
 `authorize` on the `defineAction`. It wraps `run`, so it applies at every
 dispatch site (agent tool, HTTP, frontend, MCP, A2A, CLI) — unlike
-`needsApproval`, which is honoured only in the agent loop.
+`needsApproval`, which is honored by the agent loop and MCP 2026 hosts that
+support elicitation, but is not an authorization boundary for every dispatch
+site.
 
 ```ts
 import { coachAccess } from "../lib/access.js"; // defineAppRoles(...)
@@ -203,7 +205,16 @@ export default defineAction({
 });
 ```
 
-When the gate is truthy and the call is not yet approved, the loop emits an `approval_required` event and **stops the turn — `run()` never executes**. The human approves via the chat UI's Approve affordance, which re-issues the turn with the call's stable `approvalKey`; only then does the action run. A predicate gates conditionally (e.g. only external recipients) and **fails closed** — a throw is treated as "approval required".
+When the gate is truthy and the call is not yet approved, the agent loop emits
+an `approval_required` event and **stops the turn — `run()` never executes**.
+The human approves via the chat UI's Approve affordance, which re-issues the
+turn with the call's stable `approvalKey`; only then does the action run. MCP
+2026 hosts receive an `input_required` approval request bound to the exact
+caller, action, and arguments. The signed response state is backed by a durable,
+single-use grant, so denial, expiry, replay, missing host support, or invalid
+state fails closed before `run()`. A predicate gates conditionally (e.g. only
+external recipients) and **fails closed** — a throw is treated as "approval
+required".
 
 Rules:
 

package/corpus/templates/slides/.agents/skills/security/SKILL.md

@@ -163,7 +163,9 @@ private UI after the shell loads. See the `authentication` skill and
 proves *someone* is signed in. To restrict an operation to some teammates, set
 `authorize` on the `defineAction`. It wraps `run`, so it applies at every
 dispatch site (agent tool, HTTP, frontend, MCP, A2A, CLI) — unlike
-`needsApproval`, which is honoured only in the agent loop.
+`needsApproval`, which is honored by the agent loop and MCP 2026 hosts that
+support elicitation, but is not an authorization boundary for every dispatch
+site.
 
 ```ts
 import { coachAccess } from "../lib/access.js"; // defineAppRoles(...)
@@ -203,7 +205,16 @@ export default defineAction({
 });
 ```
 
-When the gate is truthy and the call is not yet approved, the loop emits an `approval_required` event and **stops the turn — `run()` never executes**. The human approves via the chat UI's Approve affordance, which re-issues the turn with the call's stable `approvalKey`; only then does the action run. A predicate gates conditionally (e.g. only external recipients) and **fails closed** — a throw is treated as "approval required".
+When the gate is truthy and the call is not yet approved, the agent loop emits
+an `approval_required` event and **stops the turn — `run()` never executes**.
+The human approves via the chat UI's Approve affordance, which re-issues the
+turn with the call's stable `approvalKey`; only then does the action run. MCP
+2026 hosts receive an `input_required` approval request bound to the exact
+caller, action, and arguments. The signed response state is backed by a durable,
+single-use grant, so denial, expiry, replay, missing host support, or invalid
+state fails closed before `run()`. A predicate gates conditionally (e.g. only
+external recipients) and **fails closed** — a throw is treated as "approval
+required".
 
 Rules:
 

package/corpus/templates/tasks/.agents/skills/security/SKILL.md

@@ -163,7 +163,9 @@ private UI after the shell loads. See the `authentication` skill and
 proves *someone* is signed in. To restrict an operation to some teammates, set
 `authorize` on the `defineAction`. It wraps `run`, so it applies at every
 dispatch site (agent tool, HTTP, frontend, MCP, A2A, CLI) — unlike
-`needsApproval`, which is honoured only in the agent loop.
+`needsApproval`, which is honored by the agent loop and MCP 2026 hosts that
+support elicitation, but is not an authorization boundary for every dispatch
+site.
 
 ```ts
 import { coachAccess } from "../lib/access.js"; // defineAppRoles(...)
@@ -203,7 +205,16 @@ export default defineAction({
 });
 ```
 
-When the gate is truthy and the call is not yet approved, the loop emits an `approval_required` event and **stops the turn — `run()` never executes**. The human approves via the chat UI's Approve affordance, which re-issues the turn with the call's stable `approvalKey`; only then does the action run. A predicate gates conditionally (e.g. only external recipients) and **fails closed** — a throw is treated as "approval required".
+When the gate is truthy and the call is not yet approved, the agent loop emits
+an `approval_required` event and **stops the turn — `run()` never executes**.
+The human approves via the chat UI's Approve affordance, which re-issues the
+turn with the call's stable `approvalKey`; only then does the action run. MCP
+2026 hosts receive an `input_required` approval request bound to the exact
+caller, action, and arguments. The signed response state is backed by a durable,
+single-use grant, so denial, expiry, replay, missing host support, or invalid
+state fails closed before `run()`. A predicate gates conditionally (e.g. only
+external recipients) and **fails closed** — a throw is treated as "approval
+required".
 
 Rules:
 

package/corpus/toolkit/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @agent-native/toolkit
 
+## 0.10.11
+
+### Patch Changes
+
+- 0aada94: Allow the new chat control to fill the available history rail space.
+- 0aada94: Show relative cost per model in the composer's model picker. Each row now
+  carries a quiet `$`/`$$`/`$$$` suffix so a user can tell an entry model from a
+  flagship one before selecting it, rather than discovering the difference in
+  their bill. The tier reuses the token list the picker already sorts by
+  (`MODEL_COST_ORDER`) and reflects each provider's own entry/mid/flagship ladder
+  — it is not a cross-provider price claim. Models outside that list render with
+  no label at all; a guessed tier would read as fact.
+
 ## 0.10.10
 
 ### Patch Changes

package/corpus/toolkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/toolkit",
-  "version": "0.10.10",
+  "version": "0.10.11",
   "description": "Reusable app-building UI and helpers for Agent-Native apps.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/toolkit/src/chat-history.css

@@ -168,8 +168,7 @@
 }
 
 .an-chat-history-rail__new-chat {
-  flex: 0 0 auto;
-  margin-inline-end: auto;
+  flex: 1 1 auto;
   gap: 8px;
   height: auto;
   min-width: 0;

package/corpus/toolkit/src/composer/TiptapComposer.tsx

@@ -948,6 +948,50 @@ function latestModelsOnly(models: string[]): string[] {
   });
 }
 
+/**
+ * Coarse relative cost per model, rendered as a quiet `$`…`$$$` suffix.
+ *
+ * Tokens and their order mirror `MODEL_COST_ORDER` in `@agent-native/core`'s
+ * chat-model-groups, which sorts these same rows — the toolkit cannot import
+ * from core, so a new model family has to be added in both places. Tiers are
+ * each provider's own entry/mid/flagship ladder, not a cross-provider price
+ * claim; anything unlisted has no tier rather than a guessed one.
+ */
+const MODEL_COST_TIERS: ReadonlyArray<readonly [string, 1 | 2 | 3]> = [
+  ["luna", 1],
+  ["terra", 2],
+  ["sol", 3],
+  ["haiku", 1],
+  ["sonnet", 2],
+  ["opus", 3],
+  ["fable", 3],
+  ["flash", 1],
+  ["pro", 3],
+];
+
+const COST_TIER_LABELS = { 1: "Lower", 2: "Medium", 3: "Higher" } as const;
+
+export function composerModelCostTier(model: string): 1 | 2 | 3 | undefined {
+  const normalized = model.toLowerCase();
+  return MODEL_COST_TIERS.find(([token]) => normalized.includes(token))?.[1];
+}
+
+function ModelCostTier({ model }: { model: string }) {
+  const tier = composerModelCostTier(model);
+  if (!tier) return null;
+  return (
+    <>
+      <span
+        aria-hidden="true"
+        className="shrink-0 text-[11px] tabular-nums text-muted-foreground/60"
+      >
+        {"$".repeat(tier)}
+      </span>
+      <span className="sr-only">{COST_TIER_LABELS[tier]} cost</span>
+    </>
+  );
+}
+
 /**
  * Optional secondary model menu for apps that drive a separate generation model
  * alongside the chat LLM (e.g. the Assets app's image-generation model). When
@@ -1357,6 +1401,7 @@ function ModelSelector({
                       <span className="flex-1 min-w-0 text-[13px] text-foreground truncate">
                         {friendlyModelName(m)}
                       </span>
+                      <ModelCostTier model={m} />
                       {m === model && group.configured && (
                         <IconCheck className="h-3.5 w-3.5 shrink-0 text-blue-500" />
                       )}

package/dist/a2a/client.d.ts

@@ -49,6 +49,13 @@ export declare class A2AClient {
     private rpc;
     getAgentCard(options?: {
         timeoutMs?: number;
+        /**
+         * Identity token for the card fetch. The anonymous card can only advertise
+         * publicly-safe actions, which is a disjoint set from what `actions/invoke`
+         * runs — so a sibling that discovers anonymously is told there is nothing
+         * callable. Pass a token to see the invocable set.
+         */
+        token?: string;
     }): Promise<AgentCard>;
     send(message: Message, opts?: {
         contextId?: string;

package/dist/a2a/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAIpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAU5D;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,wBAAgB,2BAA2B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EAepE;IAED;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBrC;IAED,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,mBAAmB;YAQb,GAAG;IA+DX,YAAY,CAAC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAYvE;IAEK,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACtC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAmBf;IAED;;OAEG;IACG,OAAO,CACX,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAYf;IAED;;;;OAIG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,sBAAsB,CAAA;KAAE,GAC3C,OAAO,CAAC,uBAAuB,CAAC,CAalC;IAED;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACtC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAYf;IAED;;;;OAIG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QACL,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,iDAAiD;QACjD,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAIf;YAEa,QAAQ;IA2Cf,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC,CAsEtB;YAEa,wBAAwB;YAyBxB,QAAQ;CA0BvB;AAiFD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACtC,6EAA6E;IAC7E,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C,qEAAqE;IACrE,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,mCAAmC,CAAC,EAAE,OAAO,CAAC;IAC9C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CACjC,GACA,OAAO,CAAC,MAAM,CAAC,CA2FjB;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,sBAAsB,CAAC;CACtC,GACA,OAAO,CAAC,uBAAuB,CAAC,CAqBlC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,SAAS,EAGT,OAAO,EACP,IAAI,EACL,MAAM,YAAY,CAAC;AAIpB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAU5D;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,wBAAgB,2BAA2B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EAepE;IAED;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBrC;IAED,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,mBAAmB;YAQb,GAAG;IA+DX,YAAY,CAAC,OAAO,CAAC,EAAE;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,SAAS,CAAC,CAiBrB;IAEK,IAAI,CACR,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACtC;;;;;;;WAOG;QACH,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAmBf;IAED;;OAEG;IACG,OAAO,CACX,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAYf;IAED;;;;OAIG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,sBAAsB,CAAA;KAAE,GAC3C,OAAO,CAAC,uBAAuB,CAAC,CAalC;IAED;;;;;;;;OAQG;IACG,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACtC,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAYf;IAED;;;;OAIG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QACL,wDAAwD;QACxD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iCAAiC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,iDAAiD;QACjD,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,IAAI,CAAC,CAIf;YAEa,QAAQ;IA2Cf,MAAM,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAChE,cAAc,CAAC,IAAI,CAAC,CAsEtB;YAEa,wBAAwB;YAyBxB,QAAQ;CA0BvB;AAiFD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACtC,6EAA6E;IAC7E,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C,qEAAqE;IACrE,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,mCAAmC,CAAC,EAAE,OAAO,CAAC;IAC9C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CACjC,GACA,OAAO,CAAC,MAAM,CAAC,CA2FjB;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACnC,IAAI,CAAC,EAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,sBAAsB,CAAC;CACtC,GACA,OAAO,CAAC,uBAAuB,CAAC,CAqBlC"}

package/dist/a2a/client.js

@@ -201,9 +201,14 @@ export class A2AClient {
         throw lastError ?? new Error("No A2A endpoint candidates available");
     }
     async getAgentCard(options) {
-        const res = await ssrfSafeFetch(`${this.baseUrl}/.well-known/agent-card.json`, options?.timeoutMs
-            ? { signal: AbortSignal.timeout(options.timeoutMs) }
-            : {}, { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() });
+        const res = await ssrfSafeFetch(`${this.baseUrl}/.well-known/agent-card.json`, {
+            ...(options?.timeoutMs
+                ? { signal: AbortSignal.timeout(options.timeoutMs) }
+                : {}),
+            ...(options?.token
+                ? { headers: { Authorization: `Bearer ${options.token}` } }
+                : {}),
+        }, { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() });
         if (!res.ok) {
             throw new Error(`Failed to fetch agent card (${res.status})`);
         }

package/dist/a2a/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,uBAAuB;IAC9B,MAAM,OAAO,GAAG;QACd,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,yEAAyE;QACzE,yDAAyD;QACzD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KACnE;SACE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;SAC7B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE/C,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IACzD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;gBACtC,CAAC,CAAC,MAAM,CAAC,IAAI;gBACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBACrB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,EAAE,CAAC;YACT,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,CAAC;gBACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC;gBACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtD,OAAO,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAalE,MAAM,mCAAmC,GAAG,MAAM,CAAC;AAEnD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,QAAQ,CAAO;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAE3B,YAAY,MAAc,EAAE,QAAc,EAAE,SAAiB;QAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,KAAK,CACH,YAAY,MAAM,4BAA4B,SAAS,mBAAmB,SAAS,GAAG,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,SAAkB,EAClB,SAAkB,EAClB,OAWC;IAED,MAAM,MAAM,GAAG,OAAO,EAAE,kBAAkB;QACxC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS;QACrC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,uBAAuB,CAAC;IAE1B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;QAC3B,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;QAC/B,yEAAyE;QACzE,uDAAuD;QACvD,GAAG,EAAE,KAAK;QACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,EAAE;SACb,iBAAiB,CAAC,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC;IAElD,IAAI,OAAO,EAAE,QAAQ;QAAE,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEzD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,SAAkB;IAC5D,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,MAAM,OAAO,SAAS;IACZ,OAAO,CAAS;IAChB,MAAM,CAAU;IAChB,cAAc,CAA4B;IAC1C,kBAAkB,GAAa,EAAE,CAAC;IAClC,gBAAgB,GAAG,KAAK,CAAC;IACzB,gBAAgB,CAAU;IAElC,YACE,OAAe,EACf,MAAe,EACf,OAAmE;QAEnE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,UAAU,CAAC;QACvD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC;YACrC,MAAM;YACN,GAAG,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO;QAEhD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,QAAQ,EACR,EAAE,MAAM,EAAE,SAAS,EAAE,EACrB,EAAE,YAAY,EAAE,CAAC,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,EAAE,CACtE,CAAC;gBACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7C,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;QAClC,MAAM,CAAC,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,mBAAmB,CAAC,MAA0B;QACpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC;YACrC,MAAM;YACN,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,MAAc,EACd,MAA+B,EAC/B,OAAuC;QAEvC,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,MAAM;SACP,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAiB,IAAI,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,WAAW,MAAM,EAAE,CAAC,CAAC;gBACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,GAAG,EACH,IAAI,EACJ,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EACtB,OAAO,EAAE,gBAAgB,CAC1B,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,0BAA0B,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,CACtE,CAAC;gBAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC9B,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;wBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;wBACD,SAAS,GAAG,IAAI,KAAK,CACnB,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAC9C,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;gBAC7C,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;gBACrE,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,MAAM,SAAS,CAAC;gBAClB,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAgC;QACjD,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,IAAI,CAAC,OAAO,8BAA8B,EAC7C,OAAO,EAAE,SAAS;YAChB,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YACpD,CAAC,CAAC,EAAE,EACN,EAAE,YAAY,EAAE,CAAC,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,EAAE,CACtE,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAwB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAgB,EAChB,IAcC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;YAC9C,OAAO;YACP,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAoC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAC7B,WAAW,EACX,EAAE,EAAE,EAAE,MAAM,EAAE,EACd,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAC7C,CAAC;QACF,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,KAAK,GAA4B,EAAE,EACnC,IAA4C;QAE5C,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAChD,MAAM;YACN,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAiC,CAAC;IACpD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,OAAgB,EAChB,IAWC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACzC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,cAAc,EAAE,IAAI,EAAE,cAAc;YACpC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,IAOC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,SAAe,EACf,IAIC;QAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;YAC7B,WAAW;YACX,QAAQ;YACR,UAAU;YACV,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjE,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1C,IAAI,WAAW,IAAI,CAAC;gBAAE,MAAM;YAC5B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;oBACzC,gBAAgB,EAAE,IAAI,CAAC,GAAG,CACxB,IAAI,CAAC,gBAAgB,IAAI,mCAAmC,EAC5D,WAAW,CACZ;iBACF,CAAC,CAAC;gBACH,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;gBAC7D,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CACX,OAAgB,EAChB,IAAiE;QAEjE,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,OAAO;gBACP,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;aACzB;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,GAAG,GAAoB,IAAI,CAAC;QAChC,IAAI,SAAS,GAAiB,IAAI,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,SAAS,CAAC,CAAC;oBACtC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjD,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;gBACpE,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,MAAM,SAAS,CAAC;gBACxD,MAAM;YACR,CAAC;YACD,IAAI,GAAG,EAAE,EAAE;gBAAE,MAAM;QACrB,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,MAAM,QAAQ,GAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,MAAc,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,4BAA4B,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,gBAAgB,EAAE,CAAC;oBACrB,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,IAAoB,EACpB,MAAM,GAAG,IAAI,CAAC,MAAM,EACpB,gBAAgB,GAAG,IAAI,CAAC,gBAAgB;QAExC,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,KAAK,GACT,UAAU,IAAI,gBAAgB;YAC5B,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC;YACxD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CACxB,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,EAAE,MAAM;aAC3B,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,EAAE,CACtE,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAC/B,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACzE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YAC3D,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAoB,EAAE,OAAe;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CACnB,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiC;IAEjC,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc,EAAE,IAAY;IAC9D,OAAO,CACL,MAAM,KAAK,GAAG;QACd,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,sKAAsK,CAAC,IAAI,CACzK,IAAI,CACL,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAY,EACZ,IAmDC;IAED,MAAM,QAAQ,GAA4B,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChE,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,aAAa;QAAE,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACrE,IAAI,IAAI,EAAE,aAAa;QAAE,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACrE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAE3E,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IACrC,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC;IAEF,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,aAAsB,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,cAAc;iBACnC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;iBACZ,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE;gBACnD,eAAe;aAChB,CAAC,CAAC;YACH,IAAI,IAAU,CAAC;YACf,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,GAAG,IAAI,EAAE,MAAM;oBACjB,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE;wBACpC,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;wBACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC;oBACJ,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;wBAChC,SAAS,EAAE,IAAI,EAAE,SAAS;wBAC1B,QAAQ;wBACR,cAAc,EAAE,IAAI,EAAE,cAAc;wBACpC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;4BAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;4BAC3C,CAAC,CAAC,EAAE,CAAC;wBACP,SAAS,EAAE,IAAI,EAAE,SAAS;wBAC1B,cAAc,EAAE,IAAI,EAAE,cAAc;wBACpC,QAAQ,EAAE,IAAI,EAAE,QAAQ;qBACzB,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;oBAChC,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,QAAQ;oBACR,cAAc,EAAE,IAAI,EAAE,cAAc;oBACpC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;wBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YAED,iCAAiC;YACjC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5C,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK;qBACpC,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;qBACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,IAAI,EAAE,mCAAmC,KAAK,KAAK;gBACnD,GAAG,YAAY,mBAAmB,EAClC,CAAC;gBACD,MAAM,eAAe,GAAG,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrE,IAAI,eAAe;oBAAE,OAAO,eAAe,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,aAAa,GAAG,GAAG,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,aAAa;QAAE,MAAM,aAAa,CAAC;IACvC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,MAAc,EACd,KAAK,GAA4B,EAAE,EACnC,IAOC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,sBAAsB,CACjD,IAAI,EACJ,oBAAoB,CAAC,GAAG,CAAC,CAC1B,CAAC;IACF,MAAM,eAAe,GAAG,cAAc;SACnC,KAAK,CAAC,CAAC,CAAC;SACR,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE;QACnD,eAAe;QACf,gBAAgB,EAAE,IAAI,EAAE,gBAAgB;KACzC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,EAAE;QAC5C,QAAQ,EAAE,8BAA8B,CAAC,IAAI,EAAE,WAAW,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,IAMC,EACD,QAAiB;IAEjB,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,KAAyB,EAAE,EAAE;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QAC5D,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClB,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,eAAe,IAAI,EAAE;QAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAElE,IAAI,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,GAAG,CACD,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACjE,kBAAkB,EAAE,IAAI;oBACxB,QAAQ;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,GAAG,CACD,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACjE,kBAAkB,EAAE,KAAK;oBACzB,QAAQ;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,iMAAiM,CAAC,IAAI,CAC3M,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,IAAU;IAChD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,KAAK;SACjB,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import * as jose from \"jose\";\n\nimport { ssrfSafeFetch } from \"../extensions/url-safety.js\";\n\n/**\n * A workspace serves every app from one gateway on loopback, so sibling A2A\n * targets are private addresses by construction and the SSRF guard cannot tell\n * them apart from an attack. Trust only origins this deployment configured for\n * itself — never a value that arrived on a request.\n */\nfunction workspacePrivateOrigins(): string[] {\n  const origins = [\n    process.env.WORKSPACE_GATEWAY_URL,\n    process.env.APP_URL,\n    process.env.BETTER_AUTH_URL,\n    // Escape hatch for contexts that never receive the gateway manifest (the\n    // action CLI, one-off scripts). Comma-separated origins.\n    ...(process.env.AGENT_NATIVE_A2A_ALLOWED_ORIGINS ?? \"\").split(\",\"),\n  ]\n    .map((value) => value?.trim())\n    .filter((value): value is string => !!value);\n\n  // The gateway also hands each child the sibling manifest, and siblings are\n  // reached on their own loopback ports rather than through the gateway.\n  const raw = process.env.AGENT_NATIVE_WORKSPACE_APPS_JSON;\n  if (raw) {\n    try {\n      const parsed = JSON.parse(raw);\n      const apps = Array.isArray(parsed?.apps)\n        ? parsed.apps\n        : Array.isArray(parsed)\n          ? parsed\n          : [];\n      for (const app of apps) {\n        const url = app?.url ?? app?.origin ?? app?.baseUrl;\n        if (typeof url === \"string\" && url) origins.push(url);\n        const port = app?.port;\n        if (typeof port === \"number\" && Number.isFinite(port)) {\n          origins.push(`http://127.0.0.1:${port}`);\n        }\n      }\n    } catch {\n      // A malformed manifest must not disable the SSRF guard.\n    }\n  }\n  return origins;\n}\nimport { sanitizeA2ACorrelationMetadata } from \"./correlation.js\";\nimport type {\n  A2AApprovedAction,\n  A2ACorrelationMetadata,\n  A2ASourceContextReference,\n  A2AReadOnlyActionResult,\n  AgentCard,\n  JsonRpcRequest,\n  JsonRpcResponse,\n  Message,\n  Task,\n} from \"./types.js\";\n\nconst DEFAULT_A2A_POLL_REQUEST_TIMEOUT_MS = 15_000;\n\nexport class A2ATaskTimeoutError extends Error {\n  readonly taskId: string;\n  readonly lastTask: Task;\n  readonly lastState: string;\n  readonly timeoutMs: number;\n\n  constructor(taskId: string, lastTask: Task, timeoutMs: number) {\n    const lastState = lastTask.status.state;\n    super(\n      `A2A task ${taskId} did not complete within ${timeoutMs}ms (last state: ${lastState})`,\n    );\n    this.name = \"A2ATaskTimeoutError\";\n    this.taskId = taskId;\n    this.lastTask = lastTask;\n    this.lastState = lastState;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Sign a JWT for A2A cross-app identity verification.\n *\n * Uses an org-level secret by default for direct org-secret workflows. Callers\n * that are doing ordinary hosted cross-app delegation can set\n * `preferGlobalSecret` so deployments with a shared A2A_SECRET don't depend on\n * every app database having an identical org row. The token contains the\n * caller's email as `sub`, so the receiving app can verify who's calling.\n */\nexport async function signA2AToken(\n  email: string,\n  orgDomain?: string,\n  orgSecret?: string,\n  options?: {\n    expiresIn?: string | number;\n    preferGlobalSecret?: boolean;\n    audience?: string | string[];\n    /**\n     * Extra JWT claims to merge alongside `sub` / `org_domain`. Used by the\n     * MCP connect flow to add a revocable `jti` and a `scope: \"mcp-connect\"`\n     * marker. Reserved claims (`sub`, `org_domain`) cannot be overridden —\n     * they are spread last so a caller can never spoof identity via this map.\n     */\n    extraClaims?: Record<string, unknown>;\n  },\n): Promise<string> {\n  const secret = options?.preferGlobalSecret\n    ? process.env.A2A_SECRET || orgSecret\n    : orgSecret || process.env.A2A_SECRET;\n  if (!secret) {\n    throw new Error(\n      \"No A2A secret available. Set an org-level A2A secret in Team settings, \" +\n        \"or set A2A_SECRET as an environment variable on all apps that need to verify identity.\",\n    );\n  }\n\n  const appUrl =\n    process.env.APP_URL ||\n    process.env.BETTER_AUTH_URL ||\n    \"http://localhost:3000\";\n\n  const jwt = new jose.SignJWT({\n    ...(options?.extraClaims ?? {}),\n    // `sub` / `org_domain` are spread AFTER extraClaims so a caller-supplied\n    // map can never override the verified identity claims.\n    sub: email,\n    ...(orgDomain ? { org_domain: orgDomain } : {}),\n  })\n    .setProtectedHeader({ alg: \"HS256\" })\n    .setIssuer(appUrl)\n    .setIssuedAt()\n    .setExpirationTime(options?.expiresIn ?? \"15m\");\n\n  if (options?.audience) jwt.setAudience(options.audience);\n\n  return jwt.sign(new TextEncoder().encode(secret));\n}\n\nexport function shouldPreferGlobalA2ASecret(orgSecret?: string): boolean {\n  return !!process.env.A2A_SECRET?.trim() || !orgSecret;\n}\n\nexport class A2AClient {\n  private baseUrl: string;\n  private apiKey?: string;\n  private apiKeyAttempts: Array<string | undefined>;\n  private endpointCandidates: string[] = [];\n  private endpointResolved = false;\n  private requestTimeoutMs?: number;\n\n  constructor(\n    baseUrl: string,\n    apiKey?: string,\n    options?: { requestTimeoutMs?: number; fallbackApiKeys?: string[] },\n  ) {\n    const normalized = baseUrl.replace(/\\/$/, \"\");\n    const explicitEndpoint = splitExplicitA2AEndpoint(normalized);\n    this.baseUrl = explicitEndpoint?.baseUrl ?? normalized;\n    if (explicitEndpoint) {\n      this.endpointCandidates = [explicitEndpoint.endpointUrl];\n      this.endpointResolved = true;\n    }\n    this.apiKey = apiKey;\n    this.apiKeyAttempts = uniqueAuthTokens([\n      apiKey,\n      ...(options?.fallbackApiKeys ?? []),\n    ]);\n    this.requestTimeoutMs = options?.requestTimeoutMs;\n  }\n\n  /**\n   * Detect which A2A path the target agent uses.\n   * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.\n   */\n  async resolveEndpoint(): Promise<void> {\n    await this.ensureEndpointCandidates();\n    if (this.endpointCandidates.length <= 1) return;\n\n    for (const endpoint of this.endpointCandidates) {\n      try {\n        const res = await ssrfSafeFetch(\n          endpoint,\n          { method: \"OPTIONS\" },\n          { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() },\n        );\n        if (res.status !== 404 && res.status !== 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n        if (res.status === 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n      } catch {\n        // Try the next candidate.\n      }\n    }\n  }\n\n  private headers(apiKey = this.apiKey): Record<string, string> {\n    const h: Record<string, string> = { \"Content-Type\": \"application/json\" };\n    if (apiKey) {\n      h[\"Authorization\"] = `Bearer ${apiKey}`;\n    }\n    return h;\n  }\n\n  private markApiKeySucceeded(apiKey: string | undefined) {\n    this.apiKey = apiKey;\n    this.apiKeyAttempts = uniqueAuthTokens([\n      apiKey,\n      ...this.apiKeyAttempts.filter((token) => token !== apiKey),\n    ]);\n  }\n\n  private async rpc(\n    method: string,\n    params: Record<string, unknown>,\n    options?: { requestTimeoutMs?: number },\n  ): Promise<JsonRpcResponse> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method,\n      params,\n    };\n\n    await this.ensureEndpointCandidates();\n    let lastError: Error | null = null;\n\n    for (const url of this.endpointCandidates) {\n      for (let i = 0; i < this.apiKeyAttempts.length; i++) {\n        console.log(`[A2A Client] POST ${url} method=${method}`);\n        const startTime = Date.now();\n        const res = await this.postJson(\n          url,\n          body,\n          this.apiKeyAttempts[i],\n          options?.requestTimeoutMs,\n        );\n        console.log(\n          `[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`,\n        );\n\n        if (res.ok) {\n          const text = await res.text();\n          if (\n            i < this.apiKeyAttempts.length - 1 &&\n            isA2AAuthRejectionResponse(res.status, text)\n          ) {\n            lastError = new Error(\n              `A2A request failed (${res.status}): ${text}`,\n            );\n            continue;\n          }\n          this.endpointCandidates = [url];\n          this.markApiKeySucceeded(this.apiKeyAttempts[i]);\n          return JSON.parse(text) as JsonRpcResponse;\n        }\n\n        const text = await res.text();\n        lastError = new Error(`A2A request failed (${res.status}): ${text}`);\n        if (\n          i < this.apiKeyAttempts.length - 1 &&\n          isA2AAuthRejectionResponse(res.status, text)\n        ) {\n          continue;\n        }\n        if (!shouldTryNextEndpoint(res.status)) {\n          throw lastError;\n        }\n        break;\n      }\n    }\n\n    throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n  }\n\n  async getAgentCard(options?: { timeoutMs?: number }): Promise<AgentCard> {\n    const res = await ssrfSafeFetch(\n      `${this.baseUrl}/.well-known/agent-card.json`,\n      options?.timeoutMs\n        ? { signal: AbortSignal.timeout(options.timeoutMs) }\n        : {},\n      { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() },\n    );\n    if (!res.ok) {\n      throw new Error(`Failed to fetch agent card (${res.status})`);\n    }\n    return res.json() as Promise<AgentCard>;\n  }\n\n  async send(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      idempotencyKey?: string;\n      approvedActions?: A2AApprovedAction[];\n      /**\n       * If true, ask the server to return the task immediately in `working`\n       * state and process the handler in the background. The caller should\n       * then poll `getTask(taskId)` until `completed` / `failed` / `canceled`.\n       *\n       * Use this when you expect the handler may exceed a synchronous\n       * serverless request budget.\n       */\n      async?: boolean;\n    },\n  ): Promise<Task> {\n    const response = await this.rpc(\"message/send\", {\n      message,\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      ...(opts?.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {}),\n      ...(opts?.approvedActions?.length\n        ? { approvedActions: opts.approvedActions }\n        : {}),\n      ...(opts?.async ? { async: true } : {}),\n    });\n\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n\n    return response.result as Task;\n  }\n\n  /**\n   * Poll for a task by id. Used in async mode after `send({ async: true })`.\n   */\n  async getTask(\n    taskId: string,\n    opts?: { requestTimeoutMs?: number },\n  ): Promise<Task> {\n    const response = await this.rpc(\n      \"tasks/get\",\n      { id: taskId },\n      { requestTimeoutMs: opts?.requestTimeoutMs },\n    );\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n    return response.result as Task;\n  }\n\n  /**\n   * Execute one receiver-approved read-only action without starting the\n   * receiver's agent loop. The receiver still owns validation, credentials,\n   * request scoping, and the explicit action exposure decision.\n   */\n  async invokeAction(\n    action: string,\n    input: Record<string, unknown> = {},\n    opts?: { metadata?: A2ACorrelationMetadata },\n  ): Promise<A2AReadOnlyActionResult> {\n    const metadata = sanitizeA2ACorrelationMetadata(opts?.metadata);\n    const response = await this.rpc(\"actions/invoke\", {\n      action,\n      input,\n      ...(Object.keys(metadata).length > 0 ? { metadata } : {}),\n    });\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n    return response.result as A2AReadOnlyActionResult;\n  }\n\n  /**\n   * Send a message in async mode and poll until the task reaches a terminal\n   * state. This is the recommended path on serverless hosts with short\n   * function timeouts (Netlify, Vercel) where a synchronous LLM-driven A2A\n   * call can exceed the gateway limit.\n   *\n   * Each individual fetch returns quickly; long-running work happens on the\n   * receiving side and is checked via `tasks/get`.\n   */\n  async sendAndWait(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      idempotencyKey?: string;\n      approvedActions?: A2AApprovedAction[];\n      /** Total time to wait for completion. Default 5 min. */\n      timeoutMs?: number;\n      /** Poll interval. Default 2s. */\n      pollIntervalMs?: number;\n      /** Called with each polled task — useful for surfacing progress. */\n      onUpdate?: (task: Task) => void;\n    },\n  ): Promise<Task> {\n    const submitted = await this.send(message, {\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      idempotencyKey: opts?.idempotencyKey,\n      ...(opts?.approvedActions?.length\n        ? { approvedActions: opts.approvedActions }\n        : {}),\n      async: true,\n    });\n\n    return this.pollTask(submitted, opts);\n  }\n\n  /**\n   * Continue waiting for an existing async task without submitting a second\n   * message. Use this after a bounded caller-side wait expires but the remote\n   * task is still working.\n   */\n  async waitForTask(\n    taskId: string,\n    opts?: {\n      /** Total time to wait for completion. Default 5 min. */\n      timeoutMs?: number;\n      /** Poll interval. Default 2s. */\n      pollIntervalMs?: number;\n      /** Called with each successfully polled task. */\n      onUpdate?: (task: Task) => void;\n    },\n  ): Promise<Task> {\n    const current = await this.getTask(taskId);\n    opts?.onUpdate?.(current);\n    return this.pollTask(current, opts);\n  }\n\n  private async pollTask(\n    submitted: Task,\n    opts?: {\n      timeoutMs?: number;\n      pollIntervalMs?: number;\n      onUpdate?: (task: Task) => void;\n    },\n  ): Promise<Task> {\n    const terminalStates = new Set([\n      \"completed\",\n      \"failed\",\n      \"canceled\",\n      \"input-required\",\n    ]);\n    if (terminalStates.has(submitted.status.state)) return submitted;\n\n    const timeoutMs = opts?.timeoutMs ?? 5 * 60_000;\n    const pollMs = opts?.pollIntervalMs ?? 2_000;\n    const deadline = Date.now() + timeoutMs;\n\n    let current = submitted;\n    while (Date.now() < deadline) {\n      const sleepMs = Math.min(pollMs, Math.max(0, deadline - Date.now()));\n      await new Promise((r) => setTimeout(r, sleepMs));\n      const remainingMs = deadline - Date.now();\n      if (remainingMs <= 0) break;\n      try {\n        current = await this.getTask(submitted.id, {\n          requestTimeoutMs: Math.min(\n            this.requestTimeoutMs ?? DEFAULT_A2A_POLL_REQUEST_TIMEOUT_MS,\n            remainingMs,\n          ),\n        });\n        opts?.onUpdate?.(current);\n      } catch {\n        // Transient fetch failure — keep polling until the deadline.\n        continue;\n      }\n      if (terminalStates.has(current.status.state)) return current;\n    }\n    throw new A2ATaskTimeoutError(submitted.id, current, timeoutMs);\n  }\n\n  async *stream(\n    message: Message,\n    opts?: { contextId?: string; metadata?: Record<string, unknown> },\n  ): AsyncGenerator<Task> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method: \"message/stream\",\n      params: {\n        message,\n        contextId: opts?.contextId,\n        metadata: opts?.metadata,\n      },\n    };\n\n    await this.ensureEndpointCandidates();\n    let res: Response | null = null;\n    let lastError: Error | null = null;\n    for (const candidate of this.endpointCandidates) {\n      for (let i = 0; i < this.apiKeyAttempts.length; i++) {\n        res = await this.postJson(candidate, body, this.apiKeyAttempts[i]);\n        if (res.ok) {\n          this.endpointCandidates = [candidate];\n          this.markApiKeySucceeded(this.apiKeyAttempts[i]);\n          break;\n        }\n        const text = await res.text();\n        lastError = new Error(`A2A stream failed (${res.status}): ${text}`);\n        if (\n          i < this.apiKeyAttempts.length - 1 &&\n          isA2AAuthRejectionResponse(res.status, text)\n        ) {\n          continue;\n        }\n        if (!shouldTryNextEndpoint(res.status)) throw lastError;\n        break;\n      }\n      if (res?.ok) break;\n    }\n    if (!res?.ok) {\n      throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n    }\n\n    const reader = res.body?.getReader();\n    if (!reader) throw new Error(\"No response body\");\n\n    const decoder = new TextDecoder();\n    let buffer = \"\";\n\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n\n      buffer += decoder.decode(value, { stream: true });\n      const lines = buffer.split(\"\\n\");\n      buffer = lines.pop() ?? \"\";\n\n      for (const line of lines) {\n        if (!line.startsWith(\"data: \")) continue;\n        const json = line.slice(6).trim();\n        if (!json) continue;\n\n        const response: JsonRpcResponse = JSON.parse(json);\n        if (response.error) {\n          throw new Error(\n            `A2A error (${response.error.code}): ${response.error.message}`,\n          );\n        }\n        if (response.result) {\n          yield response.result as Task;\n        }\n      }\n    }\n  }\n\n  private async ensureEndpointCandidates(): Promise<void> {\n    if (this.endpointResolved) return;\n    this.endpointResolved = true;\n\n    const candidates: string[] = [];\n    addDefaultEndpointCandidates(candidates, this.baseUrl);\n\n    try {\n      const card = await this.getAgentCard();\n      const cardUrl = normalizeUrl(card.url, this.baseUrl);\n      if (cardUrl) {\n        const explicitEndpoint = splitExplicitA2AEndpoint(cardUrl);\n        if (explicitEndpoint) {\n          candidates.unshift(explicitEndpoint.endpointUrl);\n        } else {\n          addDefaultEndpointCandidates(candidates, cardUrl);\n        }\n      }\n    } catch {\n      // Agent cards are discovery hints. Fall back to conventional endpoints.\n    }\n\n    this.endpointCandidates = unique(candidates);\n  }\n\n  private async postJson(\n    url: string,\n    body: JsonRpcRequest,\n    apiKey = this.apiKey,\n    requestTimeoutMs = this.requestTimeoutMs,\n  ): Promise<Response> {\n    const controller = requestTimeoutMs ? new AbortController() : undefined;\n    const timer =\n      controller && requestTimeoutMs\n        ? setTimeout(() => controller.abort(), requestTimeoutMs)\n        : undefined;\n    try {\n      return await ssrfSafeFetch(\n        url,\n        {\n          method: \"POST\",\n          headers: this.headers(apiKey),\n          body: JSON.stringify(body),\n          signal: controller?.signal,\n        },\n        { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() },\n      );\n    } finally {\n      if (timer) clearTimeout(timer);\n    }\n  }\n}\n\nfunction splitExplicitA2AEndpoint(\n  url: string,\n): { baseUrl: string; endpointUrl: string } | null {\n  try {\n    const parsed = new URL(url);\n    const pathname = parsed.pathname.replace(/\\/$/, \"\");\n    if (pathname.endsWith(\"/_agent-native/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/_agent-native/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n    if (pathname.endsWith(\"/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n  } catch {\n    // Relative or invalid URLs are handled by the caller's normal fetch path.\n  }\n  return null;\n}\n\nfunction addDefaultEndpointCandidates(candidates: string[], baseUrl: string) {\n  const base = baseUrl.replace(/\\/$/, \"\");\n  candidates.push(`${base}/_agent-native/a2a`, `${base}/a2a`);\n}\n\nfunction normalizeUrl(\n  value: string | undefined,\n  baseUrl: string,\n): string | null {\n  if (!value) return null;\n  try {\n    return new URL(value, `${baseUrl.replace(/\\/$/, \"\")}/`)\n      .toString()\n      .replace(/\\/$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction shouldTryNextEndpoint(status: number): boolean {\n  return status === 404 || status === 405;\n}\n\nfunction unique(values: string[]): string[] {\n  return Array.from(new Set(values));\n}\n\nfunction uniqueAuthTokens(\n  values: Array<string | undefined>,\n): Array<string | undefined> {\n  const result: Array<string | undefined> = [];\n  for (const value of values) {\n    if (result.includes(value)) continue;\n    result.push(value);\n  }\n  if (result.length === 0) result.push(undefined);\n  return result;\n}\n\nfunction isA2AAuthRejectionResponse(status: number, text: string): boolean {\n  return (\n    status === 401 ||\n    /verified, audience-bound user identity/i.test(text) ||\n    /A2A error \\(-32001\\): (?:Invalid or expired A2A token|Invalid API key|Authentication required)|Invalid or expired A2A token|Invalid API key|Authentication required/i.test(\n      text,\n    )\n  );\n}\n\n/**\n * One-shot convenience function: send a text message and get a text response.\n *\n * When A2A_SECRET is set and userEmail is provided, outbound calls are signed\n * with a JWT so the receiving app can cryptographically verify the caller's\n * identity (instead of blindly trusting metadata).\n */\nexport async function callAgent(\n  url: string,\n  text: string,\n  opts?: {\n    apiKey?: string;\n    /** Additional bearer tokens to try in order after apiKey during rotation. */\n    apiKeyFallbacks?: string[];\n    /** Additional transport metadata. Receivers must not use it as identity. */\n    metadata?: Record<string, unknown>;\n    contextId?: string;\n    userEmail?: string;\n    orgDomain?: string;\n    orgSecret?: string;\n    /** Origin used to build links back to the receiving app. */\n    requestOrigin?: string;\n    /** Exact downstream actions explicitly authorized in the caller's chat. */\n    approvedActions?: A2AApprovedAction[];\n    /** Opaque provenance reference resolved by the receiver through Dispatch. */\n    sourceContext?: A2ASourceContextReference;\n    /** Bounded telemetry-only lineage forwarded to the receiving app. */\n    correlation?: A2ACorrelationMetadata;\n    /** Stable caller-generated key for one message submission. */\n    idempotencyKey?: string;\n    /**\n     * Use async/poll instead of a single blocking POST. Recommended for\n     * cross-app calls that may exceed a synchronous serverless request budget.\n     * Defaults to true so callers get safe behavior out of the box.\n     */\n    async?: boolean;\n    /** Total time to wait for the polled task (default 5 min). */\n    timeoutMs?: number;\n    /**\n     * Existing async task to keep polling. When set, no new message is sent.\n     * This prevents a caller-side timeout from duplicating downstream work.\n     */\n    taskId?: string;\n    /** Poll interval for async calls. Primarily useful for tests/retries. */\n    pollIntervalMs?: number;\n    /**\n     * Return receiver-verified artifact text from the last polled task when\n     * the call times out. Defaults to true for backwards compatibility.\n     * Callers that can continue polling the remote task separately should set\n     * this to false so the A2ATaskTimeoutError (and its taskId) is preserved.\n     */\n    returnRecoverableArtifactsOnTimeout?: boolean;\n    /**\n     * Called with each successfully polled task while an async call is still\n     * in flight (see `A2AClient.sendAndWait`). Fires once per real poll\n     * round-trip that returns a task — including the terminal poll — so\n     * callers can surface genuine remote liveness/progress. Not called when a\n     * poll fetch throws (remote unresponsive) or when the task completes\n     * synchronously on submit. Only threaded through for async calls.\n     */\n    onUpdate?: (task: Task) => void;\n  },\n): Promise<string> {\n  const metadata: Record<string, unknown> = { ...opts?.metadata };\n  if (opts?.userEmail) metadata.userEmail = opts.userEmail;\n  if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;\n  if (opts?.requestOrigin) metadata.requestOrigin = opts.requestOrigin;\n  if (opts?.sourceContext) metadata.sourceContext = opts.sourceContext;\n  Object.assign(metadata, sanitizeA2ACorrelationMetadata(opts?.correlation));\n\n  // Default to async + poll. The receiving A2A server's `_process-task` route\n  // runs the handler in a fresh function execution (cross-platform queue\n  // pattern), so async mode now works on every host instead of relying on\n  // detached promises that get killed on Netlify/Vercel. Callers that\n  // explicitly want a single-shot blocking POST can pass `async: false`.\n  const useAsync = opts?.async ?? true;\n  const message: Message = {\n    role: \"user\",\n    parts: [{ type: \"text\", text }],\n  };\n\n  const apiKeyAttempts = await buildA2AApiKeyAttempts(opts);\n  let lastAuthError: unknown;\n\n  for (let i = 0; i < apiKeyAttempts.length; i++) {\n    try {\n      const fallbackApiKeys = apiKeyAttempts\n        .slice(i + 1)\n        .filter((token): token is string => token !== undefined);\n      const client = new A2AClient(url, apiKeyAttempts[i], {\n        fallbackApiKeys,\n      });\n      let task: Task;\n      if (useAsync) {\n        task = opts?.taskId\n          ? await client.waitForTask(opts.taskId, {\n              timeoutMs: opts.timeoutMs,\n              pollIntervalMs: opts.pollIntervalMs,\n              onUpdate: opts.onUpdate,\n            })\n          : await client.sendAndWait(message, {\n              contextId: opts?.contextId,\n              metadata,\n              idempotencyKey: opts?.idempotencyKey,\n              ...(opts?.approvedActions?.length\n                ? { approvedActions: opts.approvedActions }\n                : {}),\n              timeoutMs: opts?.timeoutMs,\n              pollIntervalMs: opts?.pollIntervalMs,\n              onUpdate: opts?.onUpdate,\n            });\n      } else {\n        if (opts?.taskId) {\n          throw new Error(\"Polling an existing A2A task requires async mode\");\n        }\n        task = await client.send(message, {\n          contextId: opts?.contextId,\n          metadata,\n          idempotencyKey: opts?.idempotencyKey,\n          ...(opts?.approvedActions?.length\n            ? { approvedActions: opts.approvedActions }\n            : {}),\n        });\n      }\n\n      // Extract text from the response\n      const responseMessage = task.status.message;\n      if (responseMessage) {\n        const textParts = responseMessage.parts\n          .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n          .map((p) => p.text);\n        return textParts.join(\"\\n\");\n      }\n\n      return \"\";\n    } catch (err) {\n      if (\n        opts?.returnRecoverableArtifactsOnTimeout !== false &&\n        err instanceof A2ATaskTimeoutError\n      ) {\n        const recoverableText = extractRecoverableArtifactText(err.lastTask);\n        if (recoverableText) return recoverableText;\n      }\n      if (i < apiKeyAttempts.length - 1 && isA2AAuthRejection(err)) {\n        lastAuthError = err;\n        continue;\n      }\n      throw err;\n    }\n  }\n\n  if (lastAuthError) throw lastAuthError;\n  return \"\";\n}\n\n/**\n * Invoke one receiver-approved read-only action with an audience-bound user\n * token. Unlike conversational delegation, this never starts the receiver's\n * model loop.\n */\nexport async function callAction(\n  url: string,\n  action: string,\n  input: Record<string, unknown> = {},\n  opts?: {\n    apiKey?: string;\n    userEmail?: string;\n    orgDomain?: string;\n    orgSecret?: string;\n    requestTimeoutMs?: number;\n    correlation?: A2ACorrelationMetadata;\n  },\n): Promise<A2AReadOnlyActionResult> {\n  const actionName = action.trim();\n  if (!actionName) throw new Error(\"A2A action name is required\");\n  if (!input || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new Error(\"A2A action input must be an object\");\n  }\n\n  const apiKeyAttempts = await buildA2AApiKeyAttempts(\n    opts,\n    normalizeA2AAudience(url),\n  );\n  const fallbackApiKeys = apiKeyAttempts\n    .slice(1)\n    .filter((token): token is string => token !== undefined);\n  const client = new A2AClient(url, apiKeyAttempts[0], {\n    fallbackApiKeys,\n    requestTimeoutMs: opts?.requestTimeoutMs,\n  });\n  return client.invokeAction(actionName, input, {\n    metadata: sanitizeA2ACorrelationMetadata(opts?.correlation),\n  });\n}\n\nasync function buildA2AApiKeyAttempts(\n  opts?: {\n    apiKey?: string;\n    apiKeyFallbacks?: string[];\n    userEmail?: string;\n    orgDomain?: string;\n    orgSecret?: string;\n  },\n  audience?: string,\n): Promise<Array<string | undefined>> {\n  const attempts: Array<string | undefined> = [];\n  const add = (token: string | undefined) => {\n    if (token === undefined || attempts.includes(token)) return;\n    attempts.push(token);\n  };\n\n  add(opts?.apiKey);\n  for (const fallback of opts?.apiKeyFallbacks ?? []) add(fallback);\n\n  if (opts?.userEmail && (opts.orgSecret || process.env.A2A_SECRET)) {\n    if (process.env.A2A_SECRET?.trim()) {\n      try {\n        add(\n          await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {\n            preferGlobalSecret: true,\n            audience,\n          }),\n        );\n      } catch {\n        // Keep any explicit token attempt, then fall back below.\n      }\n    }\n\n    if (opts.orgSecret) {\n      try {\n        add(\n          await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {\n            preferGlobalSecret: false,\n            audience,\n          }),\n        );\n      } catch {\n        // Fall through to the attempts we already have.\n      }\n    }\n  }\n\n  if (attempts.length === 0) attempts.push(undefined);\n  return attempts;\n}\n\nfunction normalizeA2AAudience(url: string): string {\n  const explicit = splitExplicitA2AEndpoint(url.replace(/\\/$/, \"\"));\n  const base = (explicit?.baseUrl ?? url).replace(/\\/$/, \"\");\n  // Receivers derive their expected audience from APP_URL, which carries no\n  // app path. In a workspace every app is mounted under one gateway origin, so\n  // signing the path-qualified URL yields an audience the receiver can never\n  // match. The origin is the identifier both sides agree on.\n  try {\n    return new URL(base).origin;\n  } catch {\n    return base;\n  }\n}\n\nfunction isA2AAuthRejection(err: unknown): boolean {\n  const message = err instanceof Error ? err.message : String(err ?? \"\");\n  return /A2A request failed \\(401\\)|A2A error \\(-32001\\): (?:Invalid or expired A2A token|Invalid API key|Authentication required)|Invalid or expired A2A token|Invalid API key|Authentication required/i.test(\n    message,\n  );\n}\n\nfunction extractRecoverableArtifactText(task: Task): string {\n  if (!task.status.message?.metadata?.agentNativeRecoverableArtifacts) {\n    return \"\";\n  }\n  return extractMessageText(task.status.message);\n}\n\nfunction extractMessageText(message: Message): string {\n  return message.parts\n    .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n    .map((p) => p.text)\n    .join(\"\\n\");\n}\n"]}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/a2a/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,uBAAuB;IAC9B,MAAM,OAAO,GAAG;QACd,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,yEAAyE;QACzE,yDAAyD;QACzD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KACnE;SACE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;SAC7B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE/C,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IACzD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;gBACtC,CAAC,CAAC,MAAM,CAAC,IAAI;gBACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBACrB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,EAAE,CAAC;YACT,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,CAAC;gBACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC;gBACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtD,OAAO,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAalE,MAAM,mCAAmC,GAAG,MAAM,CAAC;AAEnD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,QAAQ,CAAO;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAE3B,YAAY,MAAc,EAAE,QAAc,EAAE,SAAiB;QAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,KAAK,CACH,YAAY,MAAM,4BAA4B,SAAS,mBAAmB,SAAS,GAAG,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,SAAkB,EAClB,SAAkB,EAClB,OAWC;IAED,MAAM,MAAM,GAAG,OAAO,EAAE,kBAAkB;QACxC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS;QACrC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,uBAAuB,CAAC;IAE1B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;QAC3B,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;QAC/B,yEAAyE;QACzE,uDAAuD;QACvD,GAAG,EAAE,KAAK;QACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,EAAE;SACb,iBAAiB,CAAC,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC;IAElD,IAAI,OAAO,EAAE,QAAQ;QAAE,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEzD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,SAAkB;IAC5D,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,MAAM,OAAO,SAAS;IACZ,OAAO,CAAS;IAChB,MAAM,CAAU;IAChB,cAAc,CAA4B;IAC1C,kBAAkB,GAAa,EAAE,CAAC;IAClC,gBAAgB,GAAG,KAAK,CAAC;IACzB,gBAAgB,CAAU;IAElC,YACE,OAAe,EACf,MAAe,EACf,OAAmE;QAEnE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,UAAU,CAAC;QACvD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC;YACrC,MAAM;YACN,GAAG,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO;QAEhD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,QAAQ,EACR,EAAE,MAAM,EAAE,SAAS,EAAE,EACrB,EAAE,YAAY,EAAE,CAAC,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,EAAE,CACtE,CAAC;gBACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7C,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACrC,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;QAClC,MAAM,CAAC,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,mBAAmB,CAAC,MAA0B;QACpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC;YACrC,MAAM;YACN,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,MAAc,EACd,MAA+B,EAC/B,OAAuC;QAEvC,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,MAAM;SACP,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAiB,IAAI,CAAC;QAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,WAAW,MAAM,EAAE,CAAC,CAAC;gBACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,GAAG,EACH,IAAI,EACJ,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EACtB,OAAO,EAAE,gBAAgB,CAC1B,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,0BAA0B,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,CACtE,CAAC;gBAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC9B,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;wBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;wBACD,SAAS,GAAG,IAAI,KAAK,CACnB,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAC9C,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;gBAC7C,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;gBACrE,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,MAAM,SAAS,CAAC;gBAClB,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OASlB;QACC,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,IAAI,CAAC,OAAO,8BAA8B,EAC7C;YACE,GAAG,CAAC,OAAO,EAAE,SAAS;gBACpB,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,EAAE,KAAK;gBAChB,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE;gBAC3D,CAAC,CAAC,EAAE,CAAC;SACR,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,EAAE,CACtE,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAwB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAgB,EAChB,IAcC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;YAC9C,OAAO;YACP,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAoC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAC7B,WAAW,EACX,EAAE,EAAE,EAAE,MAAM,EAAE,EACd,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAC7C,CAAC;QACF,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAc,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,KAAK,GAA4B,EAAE,EACnC,IAA4C;QAE5C,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAChD,MAAM;YACN,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,MAAiC,CAAC;IACpD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,OAAgB,EAChB,IAWC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACzC,SAAS,EAAE,IAAI,EAAE,SAAS;YAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,cAAc,EAAE,IAAI,EAAE,cAAc;YACpC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,IAOC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,SAAe,EACf,IAIC;QAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;YAC7B,WAAW;YACX,QAAQ;YACR,UAAU;YACV,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjE,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1C,IAAI,WAAW,IAAI,CAAC;gBAAE,MAAM;YAC5B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;oBACzC,gBAAgB,EAAE,IAAI,CAAC,GAAG,CACxB,IAAI,CAAC,gBAAgB,IAAI,mCAAmC,EAC5D,WAAW,CACZ;iBACF,CAAC,CAAC;gBACH,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;gBAC7D,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CACX,OAAgB,EAChB,IAAiE;QAEjE,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE;gBACN,OAAO;gBACP,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,QAAQ,EAAE,IAAI,EAAE,QAAQ;aACzB;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,GAAG,GAAoB,IAAI,CAAC;QAChC,IAAI,SAAS,GAAiB,IAAI,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpD,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,IAAI,CAAC,kBAAkB,GAAG,CAAC,SAAS,CAAC,CAAC;oBACtC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjD,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;gBACpE,IACE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAClC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAC5C,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,MAAM,SAAS,CAAC;gBACxD,MAAM;YACR,CAAC;YACD,IAAI,GAAG,EAAE,EAAE;gBAAE,MAAM;QACrB,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,MAAM,QAAQ,GAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,MAAc,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,4BAA4B,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,gBAAgB,EAAE,CAAC;oBACrB,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,IAAoB,EACpB,MAAM,GAAG,IAAI,CAAC,MAAM,EACpB,gBAAgB,GAAG,IAAI,CAAC,gBAAgB;QAExC,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,KAAK,GACT,UAAU,IAAI,gBAAgB;YAC5B,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC;YACxD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CACxB,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,EAAE,MAAM;aAC3B,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,EAAE,CACtE,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB,CAC/B,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACzE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YAC3D,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAoB,EAAE,OAAe;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CACnB,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC;aACpD,QAAQ,EAAE;aACV,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiC;IAEjC,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc,EAAE,IAAY;IAC9D,OAAO,CACL,MAAM,KAAK,GAAG;QACd,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,sKAAsK,CAAC,IAAI,CACzK,IAAI,CACL,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAY,EACZ,IAmDC;IAED,MAAM,QAAQ,GAA4B,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChE,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,aAAa;QAAE,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACrE,IAAI,IAAI,EAAE,aAAa;QAAE,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACrE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAE3E,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IACrC,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAChC,CAAC;IAEF,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,aAAsB,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,cAAc;iBACnC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;iBACZ,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE;gBACnD,eAAe;aAChB,CAAC,CAAC;YACH,IAAI,IAAU,CAAC;YACf,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,GAAG,IAAI,EAAE,MAAM;oBACjB,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE;wBACpC,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;wBACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC;oBACJ,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;wBAChC,SAAS,EAAE,IAAI,EAAE,SAAS;wBAC1B,QAAQ;wBACR,cAAc,EAAE,IAAI,EAAE,cAAc;wBACpC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;4BAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;4BAC3C,CAAC,CAAC,EAAE,CAAC;wBACP,SAAS,EAAE,IAAI,EAAE,SAAS;wBAC1B,cAAc,EAAE,IAAI,EAAE,cAAc;wBACpC,QAAQ,EAAE,IAAI,EAAE,QAAQ;qBACzB,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;oBAChC,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,QAAQ;oBACR,cAAc,EAAE,IAAI,EAAE,cAAc;oBACpC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM;wBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YAED,iCAAiC;YACjC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5C,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK;qBACpC,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;qBACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,IAAI,EAAE,mCAAmC,KAAK,KAAK;gBACnD,GAAG,YAAY,mBAAmB,EAClC,CAAC;gBACD,MAAM,eAAe,GAAG,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACrE,IAAI,eAAe;oBAAE,OAAO,eAAe,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,aAAa,GAAG,GAAG,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,aAAa;QAAE,MAAM,aAAa,CAAC;IACvC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,MAAc,EACd,KAAK,GAA4B,EAAE,EACnC,IAOC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,sBAAsB,CACjD,IAAI,EACJ,oBAAoB,CAAC,GAAG,CAAC,CAC1B,CAAC;IACF,MAAM,eAAe,GAAG,cAAc;SACnC,KAAK,CAAC,CAAC,CAAC;SACR,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE;QACnD,eAAe;QACf,gBAAgB,EAAE,IAAI,EAAE,gBAAgB;KACzC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,EAAE;QAC5C,QAAQ,EAAE,8BAA8B,CAAC,IAAI,EAAE,WAAW,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,IAMC,EACD,QAAiB;IAEjB,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,KAAyB,EAAE,EAAE;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QAC5D,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClB,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,eAAe,IAAI,EAAE;QAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAElE,IAAI,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,GAAG,CACD,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACjE,kBAAkB,EAAE,IAAI;oBACxB,QAAQ;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,GAAG,CACD,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACjE,kBAAkB,EAAE,KAAK;oBACzB,QAAQ;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,iMAAiM,CAAC,IAAI,CAC3M,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,IAAU;IAChD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,KAAK;SACjB,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import * as jose from \"jose\";\n\nimport { ssrfSafeFetch } from \"../extensions/url-safety.js\";\n\n/**\n * A workspace serves every app from one gateway on loopback, so sibling A2A\n * targets are private addresses by construction and the SSRF guard cannot tell\n * them apart from an attack. Trust only origins this deployment configured for\n * itself — never a value that arrived on a request.\n */\nfunction workspacePrivateOrigins(): string[] {\n  const origins = [\n    process.env.WORKSPACE_GATEWAY_URL,\n    process.env.APP_URL,\n    process.env.BETTER_AUTH_URL,\n    // Escape hatch for contexts that never receive the gateway manifest (the\n    // action CLI, one-off scripts). Comma-separated origins.\n    ...(process.env.AGENT_NATIVE_A2A_ALLOWED_ORIGINS ?? \"\").split(\",\"),\n  ]\n    .map((value) => value?.trim())\n    .filter((value): value is string => !!value);\n\n  // The gateway also hands each child the sibling manifest, and siblings are\n  // reached on their own loopback ports rather than through the gateway.\n  const raw = process.env.AGENT_NATIVE_WORKSPACE_APPS_JSON;\n  if (raw) {\n    try {\n      const parsed = JSON.parse(raw);\n      const apps = Array.isArray(parsed?.apps)\n        ? parsed.apps\n        : Array.isArray(parsed)\n          ? parsed\n          : [];\n      for (const app of apps) {\n        const url = app?.url ?? app?.origin ?? app?.baseUrl;\n        if (typeof url === \"string\" && url) origins.push(url);\n        const port = app?.port;\n        if (typeof port === \"number\" && Number.isFinite(port)) {\n          origins.push(`http://127.0.0.1:${port}`);\n        }\n      }\n    } catch {\n      // A malformed manifest must not disable the SSRF guard.\n    }\n  }\n  return origins;\n}\nimport { sanitizeA2ACorrelationMetadata } from \"./correlation.js\";\nimport type {\n  A2AApprovedAction,\n  A2ACorrelationMetadata,\n  A2ASourceContextReference,\n  A2AReadOnlyActionResult,\n  AgentCard,\n  JsonRpcRequest,\n  JsonRpcResponse,\n  Message,\n  Task,\n} from \"./types.js\";\n\nconst DEFAULT_A2A_POLL_REQUEST_TIMEOUT_MS = 15_000;\n\nexport class A2ATaskTimeoutError extends Error {\n  readonly taskId: string;\n  readonly lastTask: Task;\n  readonly lastState: string;\n  readonly timeoutMs: number;\n\n  constructor(taskId: string, lastTask: Task, timeoutMs: number) {\n    const lastState = lastTask.status.state;\n    super(\n      `A2A task ${taskId} did not complete within ${timeoutMs}ms (last state: ${lastState})`,\n    );\n    this.name = \"A2ATaskTimeoutError\";\n    this.taskId = taskId;\n    this.lastTask = lastTask;\n    this.lastState = lastState;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Sign a JWT for A2A cross-app identity verification.\n *\n * Uses an org-level secret by default for direct org-secret workflows. Callers\n * that are doing ordinary hosted cross-app delegation can set\n * `preferGlobalSecret` so deployments with a shared A2A_SECRET don't depend on\n * every app database having an identical org row. The token contains the\n * caller's email as `sub`, so the receiving app can verify who's calling.\n */\nexport async function signA2AToken(\n  email: string,\n  orgDomain?: string,\n  orgSecret?: string,\n  options?: {\n    expiresIn?: string | number;\n    preferGlobalSecret?: boolean;\n    audience?: string | string[];\n    /**\n     * Extra JWT claims to merge alongside `sub` / `org_domain`. Used by the\n     * MCP connect flow to add a revocable `jti` and a `scope: \"mcp-connect\"`\n     * marker. Reserved claims (`sub`, `org_domain`) cannot be overridden —\n     * they are spread last so a caller can never spoof identity via this map.\n     */\n    extraClaims?: Record<string, unknown>;\n  },\n): Promise<string> {\n  const secret = options?.preferGlobalSecret\n    ? process.env.A2A_SECRET || orgSecret\n    : orgSecret || process.env.A2A_SECRET;\n  if (!secret) {\n    throw new Error(\n      \"No A2A secret available. Set an org-level A2A secret in Team settings, \" +\n        \"or set A2A_SECRET as an environment variable on all apps that need to verify identity.\",\n    );\n  }\n\n  const appUrl =\n    process.env.APP_URL ||\n    process.env.BETTER_AUTH_URL ||\n    \"http://localhost:3000\";\n\n  const jwt = new jose.SignJWT({\n    ...(options?.extraClaims ?? {}),\n    // `sub` / `org_domain` are spread AFTER extraClaims so a caller-supplied\n    // map can never override the verified identity claims.\n    sub: email,\n    ...(orgDomain ? { org_domain: orgDomain } : {}),\n  })\n    .setProtectedHeader({ alg: \"HS256\" })\n    .setIssuer(appUrl)\n    .setIssuedAt()\n    .setExpirationTime(options?.expiresIn ?? \"15m\");\n\n  if (options?.audience) jwt.setAudience(options.audience);\n\n  return jwt.sign(new TextEncoder().encode(secret));\n}\n\nexport function shouldPreferGlobalA2ASecret(orgSecret?: string): boolean {\n  return !!process.env.A2A_SECRET?.trim() || !orgSecret;\n}\n\nexport class A2AClient {\n  private baseUrl: string;\n  private apiKey?: string;\n  private apiKeyAttempts: Array<string | undefined>;\n  private endpointCandidates: string[] = [];\n  private endpointResolved = false;\n  private requestTimeoutMs?: number;\n\n  constructor(\n    baseUrl: string,\n    apiKey?: string,\n    options?: { requestTimeoutMs?: number; fallbackApiKeys?: string[] },\n  ) {\n    const normalized = baseUrl.replace(/\\/$/, \"\");\n    const explicitEndpoint = splitExplicitA2AEndpoint(normalized);\n    this.baseUrl = explicitEndpoint?.baseUrl ?? normalized;\n    if (explicitEndpoint) {\n      this.endpointCandidates = [explicitEndpoint.endpointUrl];\n      this.endpointResolved = true;\n    }\n    this.apiKey = apiKey;\n    this.apiKeyAttempts = uniqueAuthTokens([\n      apiKey,\n      ...(options?.fallbackApiKeys ?? []),\n    ]);\n    this.requestTimeoutMs = options?.requestTimeoutMs;\n  }\n\n  /**\n   * Detect which A2A path the target agent uses.\n   * Agent-native apps use /_agent-native/a2a, external agents may use /a2a.\n   */\n  async resolveEndpoint(): Promise<void> {\n    await this.ensureEndpointCandidates();\n    if (this.endpointCandidates.length <= 1) return;\n\n    for (const endpoint of this.endpointCandidates) {\n      try {\n        const res = await ssrfSafeFetch(\n          endpoint,\n          { method: \"OPTIONS\" },\n          { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() },\n        );\n        if (res.status !== 404 && res.status !== 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n        if (res.status === 405) {\n          this.endpointCandidates = [endpoint];\n          return;\n        }\n      } catch {\n        // Try the next candidate.\n      }\n    }\n  }\n\n  private headers(apiKey = this.apiKey): Record<string, string> {\n    const h: Record<string, string> = { \"Content-Type\": \"application/json\" };\n    if (apiKey) {\n      h[\"Authorization\"] = `Bearer ${apiKey}`;\n    }\n    return h;\n  }\n\n  private markApiKeySucceeded(apiKey: string | undefined) {\n    this.apiKey = apiKey;\n    this.apiKeyAttempts = uniqueAuthTokens([\n      apiKey,\n      ...this.apiKeyAttempts.filter((token) => token !== apiKey),\n    ]);\n  }\n\n  private async rpc(\n    method: string,\n    params: Record<string, unknown>,\n    options?: { requestTimeoutMs?: number },\n  ): Promise<JsonRpcResponse> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method,\n      params,\n    };\n\n    await this.ensureEndpointCandidates();\n    let lastError: Error | null = null;\n\n    for (const url of this.endpointCandidates) {\n      for (let i = 0; i < this.apiKeyAttempts.length; i++) {\n        console.log(`[A2A Client] POST ${url} method=${method}`);\n        const startTime = Date.now();\n        const res = await this.postJson(\n          url,\n          body,\n          this.apiKeyAttempts[i],\n          options?.requestTimeoutMs,\n        );\n        console.log(\n          `[A2A Client] Response: ${res.status} in ${Date.now() - startTime}ms`,\n        );\n\n        if (res.ok) {\n          const text = await res.text();\n          if (\n            i < this.apiKeyAttempts.length - 1 &&\n            isA2AAuthRejectionResponse(res.status, text)\n          ) {\n            lastError = new Error(\n              `A2A request failed (${res.status}): ${text}`,\n            );\n            continue;\n          }\n          this.endpointCandidates = [url];\n          this.markApiKeySucceeded(this.apiKeyAttempts[i]);\n          return JSON.parse(text) as JsonRpcResponse;\n        }\n\n        const text = await res.text();\n        lastError = new Error(`A2A request failed (${res.status}): ${text}`);\n        if (\n          i < this.apiKeyAttempts.length - 1 &&\n          isA2AAuthRejectionResponse(res.status, text)\n        ) {\n          continue;\n        }\n        if (!shouldTryNextEndpoint(res.status)) {\n          throw lastError;\n        }\n        break;\n      }\n    }\n\n    throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n  }\n\n  async getAgentCard(options?: {\n    timeoutMs?: number;\n    /**\n     * Identity token for the card fetch. The anonymous card can only advertise\n     * publicly-safe actions, which is a disjoint set from what `actions/invoke`\n     * runs — so a sibling that discovers anonymously is told there is nothing\n     * callable. Pass a token to see the invocable set.\n     */\n    token?: string;\n  }): Promise<AgentCard> {\n    const res = await ssrfSafeFetch(\n      `${this.baseUrl}/.well-known/agent-card.json`,\n      {\n        ...(options?.timeoutMs\n          ? { signal: AbortSignal.timeout(options.timeoutMs) }\n          : {}),\n        ...(options?.token\n          ? { headers: { Authorization: `Bearer ${options.token}` } }\n          : {}),\n      },\n      { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() },\n    );\n    if (!res.ok) {\n      throw new Error(`Failed to fetch agent card (${res.status})`);\n    }\n    return res.json() as Promise<AgentCard>;\n  }\n\n  async send(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      idempotencyKey?: string;\n      approvedActions?: A2AApprovedAction[];\n      /**\n       * If true, ask the server to return the task immediately in `working`\n       * state and process the handler in the background. The caller should\n       * then poll `getTask(taskId)` until `completed` / `failed` / `canceled`.\n       *\n       * Use this when you expect the handler may exceed a synchronous\n       * serverless request budget.\n       */\n      async?: boolean;\n    },\n  ): Promise<Task> {\n    const response = await this.rpc(\"message/send\", {\n      message,\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      ...(opts?.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {}),\n      ...(opts?.approvedActions?.length\n        ? { approvedActions: opts.approvedActions }\n        : {}),\n      ...(opts?.async ? { async: true } : {}),\n    });\n\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n\n    return response.result as Task;\n  }\n\n  /**\n   * Poll for a task by id. Used in async mode after `send({ async: true })`.\n   */\n  async getTask(\n    taskId: string,\n    opts?: { requestTimeoutMs?: number },\n  ): Promise<Task> {\n    const response = await this.rpc(\n      \"tasks/get\",\n      { id: taskId },\n      { requestTimeoutMs: opts?.requestTimeoutMs },\n    );\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n    return response.result as Task;\n  }\n\n  /**\n   * Execute one receiver-approved read-only action without starting the\n   * receiver's agent loop. The receiver still owns validation, credentials,\n   * request scoping, and the explicit action exposure decision.\n   */\n  async invokeAction(\n    action: string,\n    input: Record<string, unknown> = {},\n    opts?: { metadata?: A2ACorrelationMetadata },\n  ): Promise<A2AReadOnlyActionResult> {\n    const metadata = sanitizeA2ACorrelationMetadata(opts?.metadata);\n    const response = await this.rpc(\"actions/invoke\", {\n      action,\n      input,\n      ...(Object.keys(metadata).length > 0 ? { metadata } : {}),\n    });\n    if (response.error) {\n      throw new Error(\n        `A2A error (${response.error.code}): ${response.error.message}`,\n      );\n    }\n    return response.result as A2AReadOnlyActionResult;\n  }\n\n  /**\n   * Send a message in async mode and poll until the task reaches a terminal\n   * state. This is the recommended path on serverless hosts with short\n   * function timeouts (Netlify, Vercel) where a synchronous LLM-driven A2A\n   * call can exceed the gateway limit.\n   *\n   * Each individual fetch returns quickly; long-running work happens on the\n   * receiving side and is checked via `tasks/get`.\n   */\n  async sendAndWait(\n    message: Message,\n    opts?: {\n      contextId?: string;\n      metadata?: Record<string, unknown>;\n      idempotencyKey?: string;\n      approvedActions?: A2AApprovedAction[];\n      /** Total time to wait for completion. Default 5 min. */\n      timeoutMs?: number;\n      /** Poll interval. Default 2s. */\n      pollIntervalMs?: number;\n      /** Called with each polled task — useful for surfacing progress. */\n      onUpdate?: (task: Task) => void;\n    },\n  ): Promise<Task> {\n    const submitted = await this.send(message, {\n      contextId: opts?.contextId,\n      metadata: opts?.metadata,\n      idempotencyKey: opts?.idempotencyKey,\n      ...(opts?.approvedActions?.length\n        ? { approvedActions: opts.approvedActions }\n        : {}),\n      async: true,\n    });\n\n    return this.pollTask(submitted, opts);\n  }\n\n  /**\n   * Continue waiting for an existing async task without submitting a second\n   * message. Use this after a bounded caller-side wait expires but the remote\n   * task is still working.\n   */\n  async waitForTask(\n    taskId: string,\n    opts?: {\n      /** Total time to wait for completion. Default 5 min. */\n      timeoutMs?: number;\n      /** Poll interval. Default 2s. */\n      pollIntervalMs?: number;\n      /** Called with each successfully polled task. */\n      onUpdate?: (task: Task) => void;\n    },\n  ): Promise<Task> {\n    const current = await this.getTask(taskId);\n    opts?.onUpdate?.(current);\n    return this.pollTask(current, opts);\n  }\n\n  private async pollTask(\n    submitted: Task,\n    opts?: {\n      timeoutMs?: number;\n      pollIntervalMs?: number;\n      onUpdate?: (task: Task) => void;\n    },\n  ): Promise<Task> {\n    const terminalStates = new Set([\n      \"completed\",\n      \"failed\",\n      \"canceled\",\n      \"input-required\",\n    ]);\n    if (terminalStates.has(submitted.status.state)) return submitted;\n\n    const timeoutMs = opts?.timeoutMs ?? 5 * 60_000;\n    const pollMs = opts?.pollIntervalMs ?? 2_000;\n    const deadline = Date.now() + timeoutMs;\n\n    let current = submitted;\n    while (Date.now() < deadline) {\n      const sleepMs = Math.min(pollMs, Math.max(0, deadline - Date.now()));\n      await new Promise((r) => setTimeout(r, sleepMs));\n      const remainingMs = deadline - Date.now();\n      if (remainingMs <= 0) break;\n      try {\n        current = await this.getTask(submitted.id, {\n          requestTimeoutMs: Math.min(\n            this.requestTimeoutMs ?? DEFAULT_A2A_POLL_REQUEST_TIMEOUT_MS,\n            remainingMs,\n          ),\n        });\n        opts?.onUpdate?.(current);\n      } catch {\n        // Transient fetch failure — keep polling until the deadline.\n        continue;\n      }\n      if (terminalStates.has(current.status.state)) return current;\n    }\n    throw new A2ATaskTimeoutError(submitted.id, current, timeoutMs);\n  }\n\n  async *stream(\n    message: Message,\n    opts?: { contextId?: string; metadata?: Record<string, unknown> },\n  ): AsyncGenerator<Task> {\n    const body: JsonRpcRequest = {\n      jsonrpc: \"2.0\",\n      id: Date.now(),\n      method: \"message/stream\",\n      params: {\n        message,\n        contextId: opts?.contextId,\n        metadata: opts?.metadata,\n      },\n    };\n\n    await this.ensureEndpointCandidates();\n    let res: Response | null = null;\n    let lastError: Error | null = null;\n    for (const candidate of this.endpointCandidates) {\n      for (let i = 0; i < this.apiKeyAttempts.length; i++) {\n        res = await this.postJson(candidate, body, this.apiKeyAttempts[i]);\n        if (res.ok) {\n          this.endpointCandidates = [candidate];\n          this.markApiKeySucceeded(this.apiKeyAttempts[i]);\n          break;\n        }\n        const text = await res.text();\n        lastError = new Error(`A2A stream failed (${res.status}): ${text}`);\n        if (\n          i < this.apiKeyAttempts.length - 1 &&\n          isA2AAuthRejectionResponse(res.status, text)\n        ) {\n          continue;\n        }\n        if (!shouldTryNextEndpoint(res.status)) throw lastError;\n        break;\n      }\n      if (res?.ok) break;\n    }\n    if (!res?.ok) {\n      throw lastError ?? new Error(\"No A2A endpoint candidates available\");\n    }\n\n    const reader = res.body?.getReader();\n    if (!reader) throw new Error(\"No response body\");\n\n    const decoder = new TextDecoder();\n    let buffer = \"\";\n\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n\n      buffer += decoder.decode(value, { stream: true });\n      const lines = buffer.split(\"\\n\");\n      buffer = lines.pop() ?? \"\";\n\n      for (const line of lines) {\n        if (!line.startsWith(\"data: \")) continue;\n        const json = line.slice(6).trim();\n        if (!json) continue;\n\n        const response: JsonRpcResponse = JSON.parse(json);\n        if (response.error) {\n          throw new Error(\n            `A2A error (${response.error.code}): ${response.error.message}`,\n          );\n        }\n        if (response.result) {\n          yield response.result as Task;\n        }\n      }\n    }\n  }\n\n  private async ensureEndpointCandidates(): Promise<void> {\n    if (this.endpointResolved) return;\n    this.endpointResolved = true;\n\n    const candidates: string[] = [];\n    addDefaultEndpointCandidates(candidates, this.baseUrl);\n\n    try {\n      const card = await this.getAgentCard();\n      const cardUrl = normalizeUrl(card.url, this.baseUrl);\n      if (cardUrl) {\n        const explicitEndpoint = splitExplicitA2AEndpoint(cardUrl);\n        if (explicitEndpoint) {\n          candidates.unshift(explicitEndpoint.endpointUrl);\n        } else {\n          addDefaultEndpointCandidates(candidates, cardUrl);\n        }\n      }\n    } catch {\n      // Agent cards are discovery hints. Fall back to conventional endpoints.\n    }\n\n    this.endpointCandidates = unique(candidates);\n  }\n\n  private async postJson(\n    url: string,\n    body: JsonRpcRequest,\n    apiKey = this.apiKey,\n    requestTimeoutMs = this.requestTimeoutMs,\n  ): Promise<Response> {\n    const controller = requestTimeoutMs ? new AbortController() : undefined;\n    const timer =\n      controller && requestTimeoutMs\n        ? setTimeout(() => controller.abort(), requestTimeoutMs)\n        : undefined;\n    try {\n      return await ssrfSafeFetch(\n        url,\n        {\n          method: \"POST\",\n          headers: this.headers(apiKey),\n          body: JSON.stringify(body),\n          signal: controller?.signal,\n        },\n        { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() },\n      );\n    } finally {\n      if (timer) clearTimeout(timer);\n    }\n  }\n}\n\nfunction splitExplicitA2AEndpoint(\n  url: string,\n): { baseUrl: string; endpointUrl: string } | null {\n  try {\n    const parsed = new URL(url);\n    const pathname = parsed.pathname.replace(/\\/$/, \"\");\n    if (pathname.endsWith(\"/_agent-native/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/_agent-native/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n    if (pathname.endsWith(\"/a2a\")) {\n      parsed.pathname = pathname.slice(0, -\"/a2a\".length) || \"/\";\n      parsed.search = \"\";\n      parsed.hash = \"\";\n      return {\n        baseUrl: parsed.toString().replace(/\\/$/, \"\"),\n        endpointUrl: url,\n      };\n    }\n  } catch {\n    // Relative or invalid URLs are handled by the caller's normal fetch path.\n  }\n  return null;\n}\n\nfunction addDefaultEndpointCandidates(candidates: string[], baseUrl: string) {\n  const base = baseUrl.replace(/\\/$/, \"\");\n  candidates.push(`${base}/_agent-native/a2a`, `${base}/a2a`);\n}\n\nfunction normalizeUrl(\n  value: string | undefined,\n  baseUrl: string,\n): string | null {\n  if (!value) return null;\n  try {\n    return new URL(value, `${baseUrl.replace(/\\/$/, \"\")}/`)\n      .toString()\n      .replace(/\\/$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction shouldTryNextEndpoint(status: number): boolean {\n  return status === 404 || status === 405;\n}\n\nfunction unique(values: string[]): string[] {\n  return Array.from(new Set(values));\n}\n\nfunction uniqueAuthTokens(\n  values: Array<string | undefined>,\n): Array<string | undefined> {\n  const result: Array<string | undefined> = [];\n  for (const value of values) {\n    if (result.includes(value)) continue;\n    result.push(value);\n  }\n  if (result.length === 0) result.push(undefined);\n  return result;\n}\n\nfunction isA2AAuthRejectionResponse(status: number, text: string): boolean {\n  return (\n    status === 401 ||\n    /verified, audience-bound user identity/i.test(text) ||\n    /A2A error \\(-32001\\): (?:Invalid or expired A2A token|Invalid API key|Authentication required)|Invalid or expired A2A token|Invalid API key|Authentication required/i.test(\n      text,\n    )\n  );\n}\n\n/**\n * One-shot convenience function: send a text message and get a text response.\n *\n * When A2A_SECRET is set and userEmail is provided, outbound calls are signed\n * with a JWT so the receiving app can cryptographically verify the caller's\n * identity (instead of blindly trusting metadata).\n */\nexport async function callAgent(\n  url: string,\n  text: string,\n  opts?: {\n    apiKey?: string;\n    /** Additional bearer tokens to try in order after apiKey during rotation. */\n    apiKeyFallbacks?: string[];\n    /** Additional transport metadata. Receivers must not use it as identity. */\n    metadata?: Record<string, unknown>;\n    contextId?: string;\n    userEmail?: string;\n    orgDomain?: string;\n    orgSecret?: string;\n    /** Origin used to build links back to the receiving app. */\n    requestOrigin?: string;\n    /** Exact downstream actions explicitly authorized in the caller's chat. */\n    approvedActions?: A2AApprovedAction[];\n    /** Opaque provenance reference resolved by the receiver through Dispatch. */\n    sourceContext?: A2ASourceContextReference;\n    /** Bounded telemetry-only lineage forwarded to the receiving app. */\n    correlation?: A2ACorrelationMetadata;\n    /** Stable caller-generated key for one message submission. */\n    idempotencyKey?: string;\n    /**\n     * Use async/poll instead of a single blocking POST. Recommended for\n     * cross-app calls that may exceed a synchronous serverless request budget.\n     * Defaults to true so callers get safe behavior out of the box.\n     */\n    async?: boolean;\n    /** Total time to wait for the polled task (default 5 min). */\n    timeoutMs?: number;\n    /**\n     * Existing async task to keep polling. When set, no new message is sent.\n     * This prevents a caller-side timeout from duplicating downstream work.\n     */\n    taskId?: string;\n    /** Poll interval for async calls. Primarily useful for tests/retries. */\n    pollIntervalMs?: number;\n    /**\n     * Return receiver-verified artifact text from the last polled task when\n     * the call times out. Defaults to true for backwards compatibility.\n     * Callers that can continue polling the remote task separately should set\n     * this to false so the A2ATaskTimeoutError (and its taskId) is preserved.\n     */\n    returnRecoverableArtifactsOnTimeout?: boolean;\n    /**\n     * Called with each successfully polled task while an async call is still\n     * in flight (see `A2AClient.sendAndWait`). Fires once per real poll\n     * round-trip that returns a task — including the terminal poll — so\n     * callers can surface genuine remote liveness/progress. Not called when a\n     * poll fetch throws (remote unresponsive) or when the task completes\n     * synchronously on submit. Only threaded through for async calls.\n     */\n    onUpdate?: (task: Task) => void;\n  },\n): Promise<string> {\n  const metadata: Record<string, unknown> = { ...opts?.metadata };\n  if (opts?.userEmail) metadata.userEmail = opts.userEmail;\n  if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;\n  if (opts?.requestOrigin) metadata.requestOrigin = opts.requestOrigin;\n  if (opts?.sourceContext) metadata.sourceContext = opts.sourceContext;\n  Object.assign(metadata, sanitizeA2ACorrelationMetadata(opts?.correlation));\n\n  // Default to async + poll. The receiving A2A server's `_process-task` route\n  // runs the handler in a fresh function execution (cross-platform queue\n  // pattern), so async mode now works on every host instead of relying on\n  // detached promises that get killed on Netlify/Vercel. Callers that\n  // explicitly want a single-shot blocking POST can pass `async: false`.\n  const useAsync = opts?.async ?? true;\n  const message: Message = {\n    role: \"user\",\n    parts: [{ type: \"text\", text }],\n  };\n\n  const apiKeyAttempts = await buildA2AApiKeyAttempts(opts);\n  let lastAuthError: unknown;\n\n  for (let i = 0; i < apiKeyAttempts.length; i++) {\n    try {\n      const fallbackApiKeys = apiKeyAttempts\n        .slice(i + 1)\n        .filter((token): token is string => token !== undefined);\n      const client = new A2AClient(url, apiKeyAttempts[i], {\n        fallbackApiKeys,\n      });\n      let task: Task;\n      if (useAsync) {\n        task = opts?.taskId\n          ? await client.waitForTask(opts.taskId, {\n              timeoutMs: opts.timeoutMs,\n              pollIntervalMs: opts.pollIntervalMs,\n              onUpdate: opts.onUpdate,\n            })\n          : await client.sendAndWait(message, {\n              contextId: opts?.contextId,\n              metadata,\n              idempotencyKey: opts?.idempotencyKey,\n              ...(opts?.approvedActions?.length\n                ? { approvedActions: opts.approvedActions }\n                : {}),\n              timeoutMs: opts?.timeoutMs,\n              pollIntervalMs: opts?.pollIntervalMs,\n              onUpdate: opts?.onUpdate,\n            });\n      } else {\n        if (opts?.taskId) {\n          throw new Error(\"Polling an existing A2A task requires async mode\");\n        }\n        task = await client.send(message, {\n          contextId: opts?.contextId,\n          metadata,\n          idempotencyKey: opts?.idempotencyKey,\n          ...(opts?.approvedActions?.length\n            ? { approvedActions: opts.approvedActions }\n            : {}),\n        });\n      }\n\n      // Extract text from the response\n      const responseMessage = task.status.message;\n      if (responseMessage) {\n        const textParts = responseMessage.parts\n          .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n          .map((p) => p.text);\n        return textParts.join(\"\\n\");\n      }\n\n      return \"\";\n    } catch (err) {\n      if (\n        opts?.returnRecoverableArtifactsOnTimeout !== false &&\n        err instanceof A2ATaskTimeoutError\n      ) {\n        const recoverableText = extractRecoverableArtifactText(err.lastTask);\n        if (recoverableText) return recoverableText;\n      }\n      if (i < apiKeyAttempts.length - 1 && isA2AAuthRejection(err)) {\n        lastAuthError = err;\n        continue;\n      }\n      throw err;\n    }\n  }\n\n  if (lastAuthError) throw lastAuthError;\n  return \"\";\n}\n\n/**\n * Invoke one receiver-approved read-only action with an audience-bound user\n * token. Unlike conversational delegation, this never starts the receiver's\n * model loop.\n */\nexport async function callAction(\n  url: string,\n  action: string,\n  input: Record<string, unknown> = {},\n  opts?: {\n    apiKey?: string;\n    userEmail?: string;\n    orgDomain?: string;\n    orgSecret?: string;\n    requestTimeoutMs?: number;\n    correlation?: A2ACorrelationMetadata;\n  },\n): Promise<A2AReadOnlyActionResult> {\n  const actionName = action.trim();\n  if (!actionName) throw new Error(\"A2A action name is required\");\n  if (!input || typeof input !== \"object\" || Array.isArray(input)) {\n    throw new Error(\"A2A action input must be an object\");\n  }\n\n  const apiKeyAttempts = await buildA2AApiKeyAttempts(\n    opts,\n    normalizeA2AAudience(url),\n  );\n  const fallbackApiKeys = apiKeyAttempts\n    .slice(1)\n    .filter((token): token is string => token !== undefined);\n  const client = new A2AClient(url, apiKeyAttempts[0], {\n    fallbackApiKeys,\n    requestTimeoutMs: opts?.requestTimeoutMs,\n  });\n  return client.invokeAction(actionName, input, {\n    metadata: sanitizeA2ACorrelationMetadata(opts?.correlation),\n  });\n}\n\nasync function buildA2AApiKeyAttempts(\n  opts?: {\n    apiKey?: string;\n    apiKeyFallbacks?: string[];\n    userEmail?: string;\n    orgDomain?: string;\n    orgSecret?: string;\n  },\n  audience?: string,\n): Promise<Array<string | undefined>> {\n  const attempts: Array<string | undefined> = [];\n  const add = (token: string | undefined) => {\n    if (token === undefined || attempts.includes(token)) return;\n    attempts.push(token);\n  };\n\n  add(opts?.apiKey);\n  for (const fallback of opts?.apiKeyFallbacks ?? []) add(fallback);\n\n  if (opts?.userEmail && (opts.orgSecret || process.env.A2A_SECRET)) {\n    if (process.env.A2A_SECRET?.trim()) {\n      try {\n        add(\n          await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {\n            preferGlobalSecret: true,\n            audience,\n          }),\n        );\n      } catch {\n        // Keep any explicit token attempt, then fall back below.\n      }\n    }\n\n    if (opts.orgSecret) {\n      try {\n        add(\n          await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {\n            preferGlobalSecret: false,\n            audience,\n          }),\n        );\n      } catch {\n        // Fall through to the attempts we already have.\n      }\n    }\n  }\n\n  if (attempts.length === 0) attempts.push(undefined);\n  return attempts;\n}\n\nfunction normalizeA2AAudience(url: string): string {\n  const explicit = splitExplicitA2AEndpoint(url.replace(/\\/$/, \"\"));\n  const base = (explicit?.baseUrl ?? url).replace(/\\/$/, \"\");\n  // Receivers derive their expected audience from APP_URL, which carries no\n  // app path. In a workspace every app is mounted under one gateway origin, so\n  // signing the path-qualified URL yields an audience the receiver can never\n  // match. The origin is the identifier both sides agree on.\n  try {\n    return new URL(base).origin;\n  } catch {\n    return base;\n  }\n}\n\nfunction isA2AAuthRejection(err: unknown): boolean {\n  const message = err instanceof Error ? err.message : String(err ?? \"\");\n  return /A2A request failed \\(401\\)|A2A error \\(-32001\\): (?:Invalid or expired A2A token|Invalid API key|Authentication required)|Invalid or expired A2A token|Invalid API key|Authentication required/i.test(\n    message,\n  );\n}\n\nfunction extractRecoverableArtifactText(task: Task): string {\n  if (!task.status.message?.metadata?.agentNativeRecoverableArtifacts) {\n    return \"\";\n  }\n  return extractMessageText(task.status.message);\n}\n\nfunction extractMessageText(message: Message): string {\n  return message.parts\n    .filter((p): p is { type: \"text\"; text: string } => p.type === \"text\")\n    .map((p) => p.text)\n    .join(\"\\n\");\n}\n"]}

package/dist/a2a/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmB5C;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAsCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,eAAe,CAAC,CAqF1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,SAAS,EACjB,WAAW,SAAmB,GAC7B,IAAI,CAsVN;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,qCA6B5D"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmB5C;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAsCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,eAAe,CAAC,CAqF1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,SAAS,EACjB,WAAW,SAAmB,GAC7B,IAAI,CAsWN;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,qCA6B5D"}

package/dist/a2a/server.js

@@ -177,7 +177,7 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
     // tenant. Template- and framework-defined skills stay; only the dynamic
     // per-tenant MCP entries are dropped. See finding #7 in
     // /tmp/security-audit/12-mcp-a2a-agent.md.
-    getH3App(nitroApp).use("/.well-known/agent-card.json", defineEventHandler((event) => {
+    getH3App(nitroApp).use("/.well-known/agent-card.json", defineEventHandler(async (event) => {
         if (getMethod(event) !== "GET") {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
@@ -186,8 +186,23 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
             (event.url?.protocol?.replace(":", "") ?? "http");
         const host = getRequestHeader(event, "host") ?? "localhost";
         const baseUrl = `${protocol}://${host}`;
-        const filteredSkills = filterPublicAgentCardSkills(config);
-        return generateAgentCard({ ...config, skills: filteredSkills }, baseUrl, `${routePrefix}/a2a`);
+        // The anonymous card may only advertise actions safe to disclose
+        // publicly (`requiresAuth !== true`), but `actions/invoke` only ever
+        // runs the opposite set (`requiresAuth === true`). Those are disjoint,
+        // so an unauthenticated card said "no directly callable actions" about
+        // an app whose actions a verified sibling can call — and callers fell
+        // back to open-ended delegation. Show a verified caller what it can
+        // actually invoke; anonymous fetches keep the public list unchanged.
+        let skills = filterPublicAgentCardSkills(config);
+        if (config.authenticatedSkills?.length) {
+            const bearer = extractBearerToken(getRequestHeader(event, "authorization"));
+            if (bearer) {
+                const payload = await verifyA2AToken(bearer, event);
+                if (payload.email)
+                    skills = config.authenticatedSkills;
+            }
+        }
+        return generateAgentCard({ ...config, skills }, baseUrl, `${routePrefix}/a2a`);
     }));
     // Human-only continuation for consequential A2A tool calls. The opaque id
     // is a lookup handle, not authorization: every read and mutation also