@agenticprimitives/a2a 0.0.0-alpha.1 → 0.0.0-alpha.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (40) hide show
  1. package/CLAUDE.md +11 -0
  2. package/dist/agent.d.ts +46 -1
  3. package/dist/agent.d.ts.map +1 -1
  4. package/dist/agent.js +165 -51
  5. package/dist/agent.js.map +1 -1
  6. package/dist/auth.d.ts +51 -2
  7. package/dist/auth.d.ts.map +1 -1
  8. package/dist/auth.js +34 -2
  9. package/dist/auth.js.map +1 -1
  10. package/dist/client.d.ts +6 -3
  11. package/dist/client.d.ts.map +1 -1
  12. package/dist/client.js +8 -5
  13. package/dist/client.js.map +1 -1
  14. package/dist/cloudflare/index.d.ts.map +1 -1
  15. package/dist/cloudflare/index.js +10 -2
  16. package/dist/cloudflare/index.js.map +1 -1
  17. package/dist/index.d.ts +5 -3
  18. package/dist/index.d.ts.map +1 -1
  19. package/dist/index.js +2 -1
  20. package/dist/index.js.map +1 -1
  21. package/dist/jsonrpc.d.ts +3 -1
  22. package/dist/jsonrpc.d.ts.map +1 -1
  23. package/dist/jsonrpc.js +11 -4
  24. package/dist/jsonrpc.js.map +1 -1
  25. package/dist/payment-gate.d.ts +88 -0
  26. package/dist/payment-gate.d.ts.map +1 -0
  27. package/dist/payment-gate.js +47 -0
  28. package/dist/payment-gate.js.map +1 -0
  29. package/dist/runtime.d.ts +3 -0
  30. package/dist/runtime.d.ts.map +1 -1
  31. package/dist/runtime.js +34 -4
  32. package/dist/runtime.js.map +1 -1
  33. package/dist/skill-handler.d.ts +11 -1
  34. package/dist/skill-handler.d.ts.map +1 -1
  35. package/dist/skill-handler.js.map +1 -1
  36. package/dist/task-store.d.ts +5 -3
  37. package/dist/task-store.d.ts.map +1 -1
  38. package/dist/task-store.js +8 -6
  39. package/dist/task-store.js.map +1 -1
  40. package/package.json +16 -14
package/CLAUDE.md CHANGED
@@ -5,6 +5,17 @@ Async, delegation-authorized **Agent-to-Agent task transport** (spec 269). Any c
5
5
  other claimed agent an asynchronous task and collects the result by poll / push / stream. Built on the
6
6
  `@agenticprimitives/fulfillment` Task substrate; the delegation primitive is the auth.
7
7
 
8
+ ## Agentic role (ADR-0044)
9
+ A2A is the **agentic orchestration, intelligence, and discovery layer**: first-party web apps express
10
+ INTENTS to an a2a agent, which decides *which MCP tools to compose* as primitives. Web NEVER constructs
11
+ MCP tool calls directly. **Orchestration is a Ring-0 primitive** — the agentic loop, planner port, and tool
12
+ model live in a pure `packages/*` orchestration core; ONLY the concrete LLM-framework binding (LangChain/
13
+ OpenAI/Anthropic SDK) sits in a dedicated in-repo adapter behind the port (the `chain-state`+`chain-state-viem`
14
+ pattern). This `a2a` package itself stays pure transport + delegation-auth: it carries tasks, enforces
15
+ authority, and *runs* the orchestration core via the injected `SkillHandler` — it does not embed the LLM SDK.
16
+ See [ADR-0044](../../docs/architecture/decisions/0044-a2a-is-the-agentic-orchestration-layer.md)
17
+ + `docs/architecture/principles.md` §1.
18
+
8
19
  ## The boundary (ADR-0034 — READ FIRST)
9
20
  This package is the **transport-agnostic core**: the Task runtime over a `TaskStore` PORT, the
10
21
  `SkillHandler` contract + dispatcher, the JSON-RPC handlers, the `A2aWireAdapter` client, the
package/dist/agent.d.ts CHANGED
@@ -7,6 +7,26 @@ import { type SkillHandler, type VaultClient, type McpClient } from './skill-han
7
7
  import { type OnChainChecks } from './auth.js';
8
8
  import type { A2aEnforcers } from './grant.js';
9
9
  import { type TerminalSigner, type PushSender } from './push.js';
10
+ import { type PaymentGate, type SkillPayment } from './payment-gate.js';
11
+ /**
12
+ * Spec 290 §6 Stage-3 — an injected per-Smart-Agent HARD budget. STRUCTURAL (no `rate-control` import —
13
+ * ADR-0034 keeps this package transport/vendor-agnostic); the app wires a `rate-control` HardBudgetStore
14
+ * adapter. The runtime reserves AFTER authority (keyed by the verified principal), COMMITS only once the
15
+ * task is durably created, and RELEASES on any pre-creation failure (the spec §3 A2A pattern). Additive to
16
+ * the on-chain enforcers, never the authority for value movement (ADR-0041). Omit ⇒ no Stage-3 budget.
17
+ */
18
+ export interface A2aBudgetPort {
19
+ reserve(input: {
20
+ sponsorAgent: Address;
21
+ capabilityId: string;
22
+ idempotencyKey: string;
23
+ }): Promise<{
24
+ allowed: boolean;
25
+ reservationId?: string;
26
+ }>;
27
+ commit(reservationId: string): Promise<void>;
28
+ release(reservationId: string): Promise<void>;
29
+ }
10
30
  export interface A2aAgentConfig {
11
31
  /** This agent's Smart Account — the assignee + the allowedTargets the gate requires. */
12
32
  agentSA: Address;
@@ -32,6 +52,17 @@ export interface A2aAgentConfig {
32
52
  /** FR-3.6 — the policy gating skill-handler hand-offs (`requestHandoff`). Omit ⇒ hand-offs are
33
53
  * rejected (fail-closed). */
34
54
  handoffPolicy?: HandoffPolicy;
55
+ /** Spec 272 PAY-A2A — the injected x402 payment gate. When a priced skill (handler.payment) is
56
+ * invoked, the gate decides paid/unpaid (the app wires the payments x402 rail). Omit ⇒ priced skills
57
+ * behave as free (dev / unpriced deployment). */
58
+ paymentGate?: PaymentGate;
59
+ /** Spec 290 §6 Stage-3 — the per-Smart-Agent hard-budget port (post-authority, keyed by the verified
60
+ * principal). Omit ⇒ no Stage-3 budget (authority + single-use message-id still apply). */
61
+ budget?: A2aBudgetPort;
62
+ /** N-2 (seam audit): when set, read/control caller signatures (tasks/get, tasks/cancel,
63
+ * pushNotificationConfig/set) MUST carry a recent `issuedAt` (within this many seconds) — bounding
64
+ * replay of a captured signature to the window. Omit ⇒ no freshness requirement (legacy behavior). */
65
+ callerSigMaxAgeSec?: number;
35
66
  }
36
67
  export type RpcOk<T> = {
37
68
  ok: true;
@@ -72,6 +103,8 @@ export interface A2aAgent {
72
103
  tasksGet(params: {
73
104
  taskId: Hex;
74
105
  caller: Address;
106
+ signature: Hex;
107
+ issuedAt?: number;
75
108
  }): Promise<RpcResult<Task & {
76
109
  error?: string;
77
110
  artifactRefs: VaultRef[];
@@ -79,16 +112,20 @@ export interface A2aAgent {
79
112
  tasksCancel(params: {
80
113
  taskId: Hex;
81
114
  caller: Address;
115
+ signature: Hex;
116
+ issuedAt?: number;
82
117
  }): Promise<RpcResult<{
83
118
  taskId: Hex;
84
119
  state: Task['state'];
85
120
  }>>;
86
- /** Register the push webhook for a task (FR-5.2). Party-authed. */
121
+ /** Register the push webhook for a task (FR-5.2). Signed-caller + party-authed (NEW-A2A-2). */
87
122
  pushConfigSet(params: {
88
123
  taskId: Hex;
89
124
  caller: Address;
125
+ signature: Hex;
90
126
  url: string;
91
127
  token?: string;
128
+ issuedAt?: number;
92
129
  }): Promise<RpcResult<{
93
130
  taskId: Hex;
94
131
  registered: true;
@@ -105,9 +142,17 @@ export interface AgentCard {
105
142
  streaming: boolean;
106
143
  pushNotifications: boolean;
107
144
  stateTransitionHistory: boolean;
145
+ /** PAY-A2A-4 — declared extensions (e.g. x402 pay-per-use); clients activate via X-A2A-Extensions. */
146
+ extensions?: {
147
+ uri: string;
148
+ required: boolean;
149
+ description: string;
150
+ }[];
108
151
  };
152
+ /** Priced skills annotate their `payment` so clients learn the price BEFORE calling. */
109
153
  skills: {
110
154
  id: string;
155
+ payment?: SkillPayment;
111
156
  }[];
112
157
  }
113
158
  export declare function createA2aAgent(config: A2aAgentConfig): A2aAgent;
package/dist/agent.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAc,SAAS,EAAE,UAAU,EAAe,QAAQ,EAAc,MAAM,YAAY,CAAC;AAE7G,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAe,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAE9E,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAC;IACjB,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,YAAY,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;IACf,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC;IAC1B,iGAAiG;IACjG,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC;IACjC;8DAC0D;IAC1D,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;kCAC8B;IAC9B,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,MAAM,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAClE,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,UAAU,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C;AAED;wGACwG;AACxG,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,EAAE,GAAG,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IAClG,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IAC5F,QAAQ,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,QAAQ,EAAE,CAAA;KAAE,CAAC,CAAC,CAAC;IAC5H,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IACjH,mEAAmE;IACnE,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAC5I,8GAA8G;IAC9G,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnC,SAAS,IAAI,SAAS,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAC;QAAC,sBAAsB,EAAE,OAAO,CAAA;KAAE,CAAC;IAClG,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1B;AAOD,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CAiL/D"}
1
+ {"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAc,SAAS,EAAE,UAAU,EAAe,QAAQ,EAAc,MAAM,YAAY,CAAC;AAE7G,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EAAiE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAC9G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAe,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAA0B,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEhG;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,KAAK,EAAE;QAAE,YAAY,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/I,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAC;IACjB,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,YAAY,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;IACf,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC;IAC1B,iGAAiG;IACjG,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC;IACjC;8DAC0D;IAC1D,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;kCAC8B;IAC9B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;sDAEkD;IAClD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;gGAC4F;IAC5F,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;2GAEuG;IACvG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,MAAM,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAClE,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,UAAU,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C;AAED;wGACwG;AACxG,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,EAAE,GAAG,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IAClG,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IAI5F,QAAQ,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,QAAQ,EAAE,CAAA;KAAE,CAAC,CAAC,CAAC;IAC/J,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IACpJ,+FAA+F;IAC/F,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAC/K,8GAA8G;IAC9G,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnC,SAAS,IAAI,SAAS,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE;QACZ,SAAS,EAAE,OAAO,CAAC;QACnB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,sBAAsB,EAAE,OAAO,CAAC;QAChC,sGAAsG;QACtG,UAAU,CAAC,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACxE,CAAC;IACF,wFAAwF;IACxF,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,YAAY,CAAA;KAAE,EAAE,CAAC;CAClD;AAQD,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CAqR/D"}
package/dist/agent.js CHANGED
@@ -7,17 +7,65 @@ import { hashDelegation } from '@agenticprimitives/delegation';
7
7
  import { isTerminal } from './types.js';
8
8
  import { newTaskRecord, applyTransition, dispatchTask } from './runtime.js';
9
9
  import { buildSkillRegistry } from './skill-handler.js';
10
- import { authorizeA2aMessage } from './auth.js';
10
+ import { authorizeA2aMessage, hashA2aTaskRequest, hashPushConfigParams } from './auth.js';
11
11
  import { deliverPush } from './push.js';
12
+ import { x402AgentCardExtension } from './payment-gate.js';
12
13
  const RPC_INVALID_REQUEST = -32600;
13
14
  const RPC_UNAUTHORIZED = -32001;
14
15
  const RPC_NOT_FOUND = -32004;
16
+ const RPC_BUDGET_EXHAUSTED = -32005;
15
17
  const eq = (a, b) => a.toLowerCase() === b.toLowerCase();
16
18
  export function createA2aAgent(config) {
19
+ // A2A-5 (seam audit): fail closed at construction — a PRICED handler (declares `payment`) with no
20
+ // `paymentGate` wired would otherwise run for free (the gate is a no-op without a rail). Force the
21
+ // operator to wire the gate rather than silently serve priced skills unpaid.
22
+ const pricedWithoutGate = config.handlers.filter((h) => h.payment).map((h) => h.skill);
23
+ if (pricedWithoutGate.length > 0 && !config.paymentGate) {
24
+ throw new Error(`[a2a] priced skill(s) [${pricedWithoutGate.join(', ')}] registered without a paymentGate — wire ` +
25
+ `config.paymentGate (they would otherwise execute for free), or remove the skill's payment (A2A-5)`);
26
+ }
17
27
  const registry = buildSkillRegistry(config.handlers);
18
28
  const now = () => (config.now ? config.now() : Date.now());
29
+ // NEW-A2A-3: a cryptographically-random 32-byte task id when the integrator doesn't inject one. The
30
+ // previous fallback was a CONSTANT (0x00..01), so every task collided / could be poisoned.
31
+ const defaultTaskId = () => {
32
+ const b = new Uint8Array(32);
33
+ globalThis.crypto.getRandomValues(b);
34
+ return `0x${Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('')}`;
35
+ };
19
36
  let artCounter = 0;
20
37
  const newArtifactId = () => config.newArtifactId ? config.newArtifactId() : (`0x${(++artCounter).toString(16).padStart(64, '0')}`);
38
+ // AUDIT NEW-A2A-2 — the caller of a read/control op MUST prove control of `caller` by signing the
39
+ // request digest. Fail-closed: missing or invalid signature → UNAUTHORIZED, before any party check.
40
+ async function verifyCaller(method, taskId, caller, signature, paramsHash, issuedAt) {
41
+ if (!signature || signature === '0x')
42
+ return { ok: false, code: RPC_UNAUTHORIZED, message: 'caller signature required' };
43
+ // N-2: when the operator configures a freshness window, the caller MUST stamp `issuedAt` and it must be
44
+ // recent — bounding replay of a captured read/control signature to that window instead of the life of
45
+ // the task. Fail-closed: window configured but no/stale/future issuedAt → reject.
46
+ if (config.callerSigMaxAgeSec !== undefined) {
47
+ const nowSec = Math.floor(now() / 1000);
48
+ if (typeof issuedAt !== 'number' || issuedAt <= 0)
49
+ return { ok: false, code: RPC_UNAUTHORIZED, message: 'issuedAt required (freshness)' };
50
+ if (issuedAt > nowSec + 30)
51
+ return { ok: false, code: RPC_UNAUTHORIZED, message: 'issuedAt in the future' };
52
+ if (nowSec - issuedAt > config.callerSigMaxAgeSec)
53
+ return { ok: false, code: RPC_UNAUTHORIZED, message: 'caller signature expired' };
54
+ }
55
+ // N-1: `paramsHash` binds method-specific params (e.g. the push url/token) into the signed digest so a
56
+ // captured signature can't be replayed with swapped parameters. The agent re-derives it server-side.
57
+ const digest = hashA2aTaskRequest({ method, taskId, agentSA: config.agentSA, chainId: config.chainId, paramsHash, issuedAt });
58
+ let valid = false;
59
+ try {
60
+ valid = await config.checks.verifyCallerSignature(caller, digest, signature);
61
+ }
62
+ catch {
63
+ valid = false;
64
+ }
65
+ if (!valid)
66
+ return { ok: false, code: RPC_UNAUTHORIZED, message: 'caller signature invalid' };
67
+ return { ok: true, result: true };
68
+ }
21
69
  return {
22
70
  async messageSend(params) {
23
71
  const auth = await authorizeA2aMessage({
@@ -31,35 +79,72 @@ export function createA2aAgent(config) {
31
79
  store: config.taskStore,
32
80
  now: now(),
33
81
  });
82
+ // NEW-A2A-1: do NOT surface the raw authorization reason — it's an oracle (reveals delegation
83
+ // revocation / party / method-scope state to an unauthorized caller). Return a generic denial.
34
84
  if (!auth.ok)
35
- return { ok: false, code: RPC_UNAUTHORIZED, message: auth.reason };
36
- // FR-2.2 — body integrity + vault residency: the signed bodyHash must match the input; persist the
37
- // input to THIS agent's vault namespace; the message keeps only the ref + hash.
38
- if (!eq(config.hashBody(params.input), params.message.bodyHash)) {
39
- return { ok: false, code: RPC_INVALID_REQUEST, message: 'input does not match signed bodyHash' };
85
+ return { ok: false, code: RPC_UNAUTHORIZED, message: 'unauthorized' };
86
+ // Spec 290 §6 Stage-3 — reserve the per-SA hard budget AFTER authority (victim-bucket rule §9:
87
+ // verified-identity buckets only post-verify), keyed by the verified principal (= sponsorAgent).
88
+ // Idempotency = the single-use messageId. COMMIT only after the task is durably created; RELEASE on
89
+ // any pre-creation failure so a denied/failed submit never burns budget (the §3 A2A pattern).
90
+ let reservation;
91
+ if (config.budget) {
92
+ reservation = await config.budget.reserve({
93
+ sponsorAgent: auth.principal,
94
+ capabilityId: `a2a.${params.message.skill}`,
95
+ idempotencyKey: params.message.messageId,
96
+ });
97
+ if (!reservation.allowed) {
98
+ await auth.messageIdReservation.release(); // spec 290 §3 — don't burn the nonce on a budget reject
99
+ return { ok: false, code: RPC_BUDGET_EXHAUSTED, message: 'budget exhausted' };
100
+ }
101
+ }
102
+ // Spec 290 §3 — release BOTH the in-flight message-id reservation AND the budget on any pre-acceptance
103
+ // failure: a rejected/failed submit must consume neither the single-use nonce nor the budget.
104
+ const release = async () => {
105
+ await auth.messageIdReservation.release();
106
+ if (config.budget && reservation?.reservationId)
107
+ await config.budget.release(reservation.reservationId);
108
+ };
109
+ try {
110
+ // FR-2.2 — body integrity + vault residency: the signed bodyHash must match the input; persist the
111
+ // input to THIS agent's vault namespace; the message keeps only the ref + hash.
112
+ if (!eq(config.hashBody(params.input), params.message.bodyHash)) {
113
+ await release();
114
+ return { ok: false, code: RPC_INVALID_REQUEST, message: 'input does not match signed bodyHash' };
115
+ }
116
+ const bodyRef = await config.vault.write({
117
+ owner: config.agentSA,
118
+ recordType: `a2a:msg:${params.message.messageId}`,
119
+ data: params.input,
120
+ });
121
+ const message = { ...params.message, bodyRef };
122
+ const taskId = config.newTaskId ? config.newTaskId() : defaultTaskId();
123
+ const record = newTaskRecord({
124
+ taskId,
125
+ principal: auth.principal,
126
+ assignee: config.agentSA,
127
+ sender: params.requester,
128
+ skill: message.skill,
129
+ delegation: params.delegation,
130
+ inbound: message,
131
+ permissionGrantRef: hashDelegation(params.delegation, config.chainId, config.delegationManager),
132
+ inputHash: message.bodyHash,
133
+ now: now(),
134
+ });
135
+ const withPush = params.pushConfig ? { ...record, pushConfig: params.pushConfig } : record;
136
+ await config.taskStore.put(withPush); // FR-2.4 — schedule processing (listDue → alarm)
137
+ // Durably created → COMMIT the single-use message-id (permanently consumed) + charge the budget
138
+ // (the over-estimate, if any, is freed). Only now is the authorization truly spent (spec 290 §3).
139
+ await auth.messageIdReservation.commit();
140
+ if (config.budget && reservation?.reservationId)
141
+ await config.budget.commit(reservation.reservationId);
142
+ return { ok: true, result: { taskId, state: 'submitted' } }; // FR-2.3 — return immediately
143
+ }
144
+ catch (e) {
145
+ await release();
146
+ throw e;
40
147
  }
41
- const bodyRef = await config.vault.write({
42
- owner: config.agentSA,
43
- recordType: `a2a:msg:${params.message.messageId}`,
44
- data: params.input,
45
- });
46
- const message = { ...params.message, bodyRef };
47
- const taskId = config.newTaskId ? config.newTaskId() : (`0x${'00'.repeat(31)}01`);
48
- const record = newTaskRecord({
49
- taskId,
50
- principal: auth.principal,
51
- assignee: config.agentSA,
52
- sender: params.requester,
53
- skill: message.skill,
54
- delegation: params.delegation,
55
- inbound: message,
56
- permissionGrantRef: hashDelegation(params.delegation, config.chainId, config.delegationManager),
57
- inputHash: message.bodyHash,
58
- now: now(),
59
- });
60
- const withPush = params.pushConfig ? { ...record, pushConfig: params.pushConfig } : record;
61
- await config.taskStore.put(withPush); // FR-2.4 — schedule processing (listDue → alarm)
62
- return { ok: true, result: { taskId, state: 'submitted' } }; // FR-2.3 — return immediately
63
148
  },
64
149
  async resubmit(params) {
65
150
  const rec = await config.taskStore.get(params.taskId);
@@ -79,39 +164,57 @@ export function createA2aAgent(config) {
79
164
  checks: config.checks, store: config.taskStore, now: now(),
80
165
  });
81
166
  if (!auth.ok)
82
- return { ok: false, code: RPC_UNAUTHORIZED, message: auth.reason };
83
- if (!eq(config.hashBody(params.input), params.message.bodyHash)) {
84
- return { ok: false, code: RPC_INVALID_REQUEST, message: 'input does not match signed bodyHash' };
167
+ return { ok: false, code: RPC_UNAUTHORIZED, message: 'unauthorized' }; // NEW-A2A-1: generic denial
168
+ // Spec 290 §3 — the resubmit's message-id is now reserved IN-FLIGHT; commit only after the durable
169
+ // put, release on any pre-acceptance rejection so a failed resubmit never burns the fresh nonce.
170
+ try {
171
+ if (!eq(config.hashBody(params.input), params.message.bodyHash)) {
172
+ await auth.messageIdReservation.release();
173
+ return { ok: false, code: RPC_INVALID_REQUEST, message: 'input does not match signed bodyHash' };
174
+ }
175
+ const bodyRef = await config.vault.write({
176
+ owner: config.agentSA, recordType: `a2a:msg:${params.message.messageId}`, data: params.input,
177
+ });
178
+ const t = applyTransition(rec, 'submitted', { now: now() });
179
+ if (!t.ok) {
180
+ await auth.messageIdReservation.release();
181
+ return { ok: false, code: RPC_INVALID_REQUEST, message: t.reason };
182
+ }
183
+ // Replace the grant + append the fresh message (processDue reads the LATEST inbound body).
184
+ const updated = {
185
+ ...t.record, delegation: params.delegation,
186
+ task: { ...t.record.task, inputHash: params.message.bodyHash },
187
+ inbound: [...t.record.inbound, { ...params.message, bodyRef }],
188
+ };
189
+ await config.taskStore.put(updated);
190
+ await auth.messageIdReservation.commit(); // durably accepted → the resubmit nonce is consumed
191
+ return { ok: true, result: { taskId: params.taskId, state: 'submitted' } };
192
+ }
193
+ catch (e) {
194
+ await auth.messageIdReservation.release();
195
+ throw e;
85
196
  }
86
- const bodyRef = await config.vault.write({
87
- owner: config.agentSA, recordType: `a2a:msg:${params.message.messageId}`, data: params.input,
88
- });
89
- const t = applyTransition(rec, 'submitted', { now: now() });
90
- if (!t.ok)
91
- return { ok: false, code: RPC_INVALID_REQUEST, message: t.reason };
92
- // Replace the grant + append the fresh message (processDue reads the LATEST inbound body).
93
- const updated = {
94
- ...t.record, delegation: params.delegation,
95
- task: { ...t.record.task, inputHash: params.message.bodyHash },
96
- inbound: [...t.record.inbound, { ...params.message, bodyRef }],
97
- };
98
- await config.taskStore.put(updated);
99
- return { ok: true, result: { taskId: params.taskId, state: 'submitted' } };
100
197
  },
101
- async tasksGet({ taskId, caller }) {
198
+ async tasksGet({ taskId, caller, signature, issuedAt }) {
102
199
  const rec = await config.taskStore.get(taskId);
103
200
  if (!rec)
104
201
  return { ok: false, code: RPC_NOT_FOUND, message: 'unknown task' };
202
+ const authd = await verifyCaller('tasks/get', taskId, caller, signature, undefined, issuedAt);
203
+ if (!authd.ok)
204
+ return authd;
105
205
  // Caller must be the sender or the assignee (FR-2 tasks/get auth).
106
206
  if (!eq(caller, rec.sender) && !eq(caller, rec.task.assignee)) {
107
207
  return { ok: false, code: RPC_UNAUTHORIZED, message: 'not a party to this task' };
108
208
  }
109
209
  return { ok: true, result: { ...rec.task, error: rec.error, artifactRefs: rec.artifacts.map((a) => a.bodyRef) } };
110
210
  },
111
- async tasksCancel({ taskId, caller }) {
211
+ async tasksCancel({ taskId, caller, signature, issuedAt }) {
112
212
  const rec = await config.taskStore.get(taskId);
113
213
  if (!rec)
114
214
  return { ok: false, code: RPC_NOT_FOUND, message: 'unknown task' };
215
+ const authd = await verifyCaller('tasks/cancel', taskId, caller, signature, undefined, issuedAt);
216
+ if (!authd.ok)
217
+ return authd;
115
218
  if (!eq(caller, rec.sender) && !eq(caller, rec.task.assignee)) {
116
219
  return { ok: false, code: RPC_UNAUTHORIZED, message: 'not a party to this task' };
117
220
  }
@@ -121,10 +224,15 @@ export function createA2aAgent(config) {
121
224
  await config.taskStore.put(t.record);
122
225
  return { ok: true, result: { taskId, state: 'canceled' } };
123
226
  },
124
- async pushConfigSet({ taskId, caller, url, token }) {
227
+ async pushConfigSet({ taskId, caller, signature, url, token, issuedAt }) {
125
228
  const rec = await config.taskStore.get(taskId);
126
229
  if (!rec)
127
230
  return { ok: false, code: RPC_NOT_FOUND, message: 'unknown task' };
231
+ // N-1: bind the presented url + token into the signed digest so the signature authorizes THIS target
232
+ // only — a captured set-signature can't be replayed with an attacker url to hijack the push envelope.
233
+ const authd = await verifyCaller('tasks/pushNotificationConfig/set', taskId, caller, signature, hashPushConfigParams(url, token), issuedAt);
234
+ if (!authd.ok)
235
+ return authd;
128
236
  if (!eq(caller, rec.sender) && !eq(caller, rec.task.assignee)) {
129
237
  return { ok: false, code: RPC_UNAUTHORIZED, message: 'not a party to this task' };
130
238
  }
@@ -166,7 +274,7 @@ export function createA2aAgent(config) {
166
274
  });
167
275
  const input = await config.vault.read(rec.inbound[rec.inbound.length - 1].bodyRef);
168
276
  const ctxBase = makeContext(rec);
169
- const { record: processed, events: evs } = await dispatchTask(rec, registry, () => ({ ...ctxBase, input }), now(), config.handoffPolicy ? { handoffPolicy: config.handoffPolicy } : undefined);
277
+ const { record: processed, events: evs } = await dispatchTask(rec, registry, () => ({ ...ctxBase, input }), now(), { ...(config.handoffPolicy ? { handoffPolicy: config.handoffPolicy } : {}), paymentGate: config.paymentGate });
170
278
  const merged = { ...processed, artifacts: [...processed.artifacts, ...captured] };
171
279
  await config.taskStore.put(merged);
172
280
  events.push(...evs);
@@ -178,12 +286,18 @@ export function createA2aAgent(config) {
178
286
  return events;
179
287
  },
180
288
  agentCard() {
289
+ const priced = config.handlers.some((h) => h.payment);
181
290
  return {
182
291
  name: config.agentSA,
183
292
  url: `/api/a2a`,
184
293
  version: '0.1.0',
185
- capabilities: { streaming: true, pushNotifications: true, stateTransitionHistory: true },
186
- skills: config.handlers.map((h) => ({ id: h.skill })),
294
+ capabilities: {
295
+ streaming: true,
296
+ pushNotifications: true,
297
+ stateTransitionHistory: true,
298
+ ...(priced ? { extensions: [x402AgentCardExtension()] } : {}),
299
+ },
300
+ skills: config.handlers.map((h) => (h.payment ? { id: h.skill, payment: h.payment } : { id: h.skill })),
187
301
  };
188
302
  },
189
303
  };
package/dist/agent.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,yGAAyG;AACzG,2GAA2G;AAC3G,2GAA2G;AAC3G,4BAA4B;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAK/D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAuD,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAsB,MAAM,WAAW,CAAC;AAEpE,OAAO,EAAE,WAAW,EAAwC,MAAM,WAAW,CAAC;AAqE9E,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AACnC,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAChC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC;AAC7B,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAEzE,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAQ,CAAC;IAEhH,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;gBACrC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,WAAW,EAAE,MAAM,CAAC,OAAO;gBAC3B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,SAAS;gBACvB,GAAG,EAAE,GAAG,EAAE;aACX,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAEjF,mGAAmG;YACnG,gFAAgF;YAChF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;YACnG,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;gBACvC,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,UAAU,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;gBACjD,IAAI,EAAE,MAAM,CAAC,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,OAAO,GAAe,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;YAE3D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAQ,CAAC;YACzF,MAAM,MAAM,GAAG,aAAa,CAAC;gBAC3B,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,MAAM,CAAC,OAAO;gBACxB,MAAM,EAAE,MAAM,CAAC,SAAS;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,OAAO;gBAChB,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,CAAC;gBAC/F,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,GAAG,EAAE,GAAG,EAAE;aACX,CAAC,CAAC;YACH,MAAM,QAAQ,GAAe,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACvG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,iDAAiD;YACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,8BAA8B;QAC7F,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAM;YACnB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC7E,+FAA+F;YAC/F,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,eAAe;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;YAC9H,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;YACtI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;YACjI,iGAAiG;YACjG,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;gBACrC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;gBACnF,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE;aAC3D,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACjF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;YACnG,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;gBACvC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK;aAC7F,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9E,2FAA2F;YAC3F,MAAM,OAAO,GAAe;gBAC1B,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC1C,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAC9D,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;aAC/D,CAAC;YACF,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;YAC/B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC7E,mEAAmE;YACnE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;YACpF,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACpH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;YAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC7E,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9E,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;QAC7D,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC7E,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;YACpF,CAAC;YACD,MAAM,UAAU,GAAe,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;YAChE,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,UAAU;YACd,MAAM,MAAM,GAAgB,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAClD,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW;oBAAE,SAAS;gBAErD,0FAA0F;gBAC1F,mDAAmD;gBACnD,MAAM,QAAQ,GAAkB,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,CAAC;oBACtC,KAAK,EAAE,SAAoB,EAAE,4CAA4C;oBACzE,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,YAAY,EAAE,KAAK,EAAE,CAA6G,EAAgB,EAAE;wBAClJ,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;wBACnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC5H,QAAQ,CAAC,IAAI,CAAC;4BACZ,UAAU;4BACV,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAQ;4BACnD,QAAQ,EAAE,MAAM,CAAC,OAAO;4BACxB,YAAY,EAAE,CAAC,CAAC,YAAY;4BAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;4BACjC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,kBAAkB;4BACxD,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;4BACjD,OAAO;4BACP,SAAS,EAAE,GAAG,EAAE;yBACjB,CAAC,CAAC;wBACH,OAAO,UAAU,CAAC;oBACpB,CAAC;iBACF,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC;gBACpF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,YAAY,CAC3D,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EACnD,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;gBACF,MAAM,MAAM,GAAe,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;gBAC9F,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;gBAEpB,+FAA+F;gBAC/F,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBACnG,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,SAAS;YACP,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,OAAO;gBACpB,GAAG,EAAE,UAAU;gBACf,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE;gBACxF,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;aACtD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,yGAAyG;AACzG,2GAA2G;AAC3G,2GAA2G;AAC3G,4BAA4B;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAK/D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAuD,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAsB,MAAM,WAAW,CAAC;AAE9G,OAAO,EAAE,WAAW,EAAwC,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAuC,MAAM,mBAAmB,CAAC;AAuGhG,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AACnC,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAChC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC;AAC7B,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC;AACpC,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAEzE,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,kGAAkG;IAClG,mGAAmG;IACnG,6EAA6E;IAC7E,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,0BAA0B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C;YAChG,mGAAmG,CACtG,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,oGAAoG;IACpG,2FAA2F;IAC3F,MAAM,aAAa,GAAG,GAAQ,EAAE;QAC9B,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAS,CAAC;IACtF,CAAC,CAAC;IACF,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAQ,CAAC;IAEhH,kGAAkG;IAClG,oGAAoG;IACpG,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,MAAW,EAAE,MAAe,EAAE,SAAc,EAAE,UAAgB,EAAE,QAAiB;QAC3H,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;QACzH,wGAAwG;QACxG,sGAAsG;QACtG,kFAAkF;QAClF,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACxC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,IAAI,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;YAC1I,IAAI,QAAQ,GAAG,MAAM,GAAG,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;YAC5G,IAAI,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC,kBAAkB;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;QACvI,CAAC;QACD,uGAAuG;QACvG,qGAAqG;QACrG,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9H,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YAAC,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,GAAG,KAAK,CAAC;QAAC,CAAC;QAC9G,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;gBACrC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,WAAW,EAAE,MAAM,CAAC,OAAO;gBAC3B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,SAAS;gBACvB,GAAG,EAAE,GAAG,EAAE;aACX,CAAC,CAAC;YACH,8FAA8F;YAC9F,+FAA+F;YAC/F,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAEpF,+FAA+F;YAC/F,iGAAiG;YACjG,oGAAoG;YACpG,8FAA8F;YAC9F,IAAI,WAAqE,CAAC;YAC1E,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;oBACxC,YAAY,EAAE,IAAI,CAAC,SAAS;oBAC5B,YAAY,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE;oBAC3C,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;iBACzC,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;oBACzB,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC,CAAC,wDAAwD;oBACnG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;gBAChF,CAAC;YACH,CAAC;YACD,uGAAuG;YACvG,8FAA8F;YAC9F,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;gBACzB,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;gBAC1C,IAAI,MAAM,CAAC,MAAM,IAAI,WAAW,EAAE,aAAa;oBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YAC1G,CAAC,CAAC;YAEF,IAAI,CAAC;gBACH,mGAAmG;gBACnG,gFAAgF;gBAChF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChE,MAAM,OAAO,EAAE,CAAC;oBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;gBACnG,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;oBACvC,KAAK,EAAE,MAAM,CAAC,OAAO;oBACrB,UAAU,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;oBACjD,IAAI,EAAE,MAAM,CAAC,KAAK;iBACnB,CAAC,CAAC;gBACH,MAAM,OAAO,GAAe,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;gBAE3D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;gBACvE,MAAM,MAAM,GAAG,aAAa,CAAC;oBAC3B,MAAM;oBACN,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,QAAQ,EAAE,MAAM,CAAC,OAAO;oBACxB,MAAM,EAAE,MAAM,CAAC,SAAS;oBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,OAAO,EAAE,OAAO;oBAChB,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,CAAC;oBAC/F,SAAS,EAAE,OAAO,CAAC,QAAQ;oBAC3B,GAAG,EAAE,GAAG,EAAE;iBACX,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAe,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,iDAAiD;gBACvF,gGAAgG;gBAChG,kGAAkG;gBAClG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,MAAM,IAAI,WAAW,EAAE,aAAa;oBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;gBACvG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,8BAA8B;YAC7F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,OAAO,EAAE,CAAC;gBAChB,MAAM,CAAC,CAAC;YACV,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAM;YACnB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC7E,+FAA+F;YAC/F,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,eAAe;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;YAC9H,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;YACtI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;YACjI,iGAAiG;YACjG,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;gBACrC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;gBACnF,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE;aAC3D,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,4BAA4B;YACjH,mGAAmG;YACnG,iGAAiG;YACjG,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChE,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;oBAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;gBACnG,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;oBACvC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK;iBAC7F,CAAC,CAAC;gBACH,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACV,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;oBAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;gBACrE,CAAC;gBACD,2FAA2F;gBAC3F,MAAM,OAAO,GAAe;oBAC1B,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC1C,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE;oBAC9D,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;iBAC/D,CAAC;gBACF,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,oDAAoD;gBAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;YAC7E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;gBAC1C,MAAM,CAAC,CAAC;YACV,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC9F,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC5B,mEAAmE;YACnE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;YACpF,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACpH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjG,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9E,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;QAC7D,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE;YACrE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC7E,qGAAqG;YACrG,sGAAsG;YACtG,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,kCAAkC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC5I,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;YACpF,CAAC;YACD,MAAM,UAAU,GAAe,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;YAChE,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,UAAU;YACd,MAAM,MAAM,GAAgB,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAClD,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW;oBAAE,SAAS;gBAErD,0FAA0F;gBAC1F,mDAAmD;gBACnD,MAAM,QAAQ,GAAkB,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,CAAC;oBACtC,KAAK,EAAE,SAAoB,EAAE,4CAA4C;oBACzE,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,YAAY,EAAE,KAAK,EAAE,CAA6G,EAAgB,EAAE;wBAClJ,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;wBACnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC5H,QAAQ,CAAC,IAAI,CAAC;4BACZ,UAAU;4BACV,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAQ;4BACnD,QAAQ,EAAE,MAAM,CAAC,OAAO;4BACxB,YAAY,EAAE,CAAC,CAAC,YAAY;4BAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;4BACjC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,kBAAkB;4BACxD,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;4BACjD,OAAO;4BACP,SAAS,EAAE,GAAG,EAAE;yBACjB,CAAC,CAAC;wBACH,OAAO,UAAU,CAAC;oBACpB,CAAC;iBACF,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC;gBACpF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,YAAY,CAC3D,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EACnD,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAC9G,CAAC;gBACF,MAAM,MAAM,GAAe,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;gBAC9F,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;gBAEpB,+FAA+F;gBAC/F,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBACnG,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,SAAS;YACP,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACtD,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,OAAO;gBACpB,GAAG,EAAE,UAAU;gBACf,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE;oBACZ,SAAS,EAAE,IAAI;oBACf,iBAAiB,EAAE,IAAI;oBACvB,sBAAsB,EAAE,IAAI;oBAC5B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D;gBACD,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;aACxG,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
package/dist/auth.d.ts CHANGED
@@ -11,6 +11,32 @@ export declare function decodeAllowedTargetsTerms(terms: Hex): readonly Address[
11
11
  export declare function decodeAllowedMethodsTerms(terms: Hex): readonly Hex[];
12
12
  /** Canonical hash the SENDER signs for an inbound message (A2A-INV-01). Binds id + sender + skill + body. */
13
13
  export declare function hashA2aMessage(m: Pick<A2aMessage, 'messageId' | 'sender' | 'skill' | 'bodyHash' | 'createdAt'>): Hex;
14
+ /** AUDIT NEW-A2A-2: canonical digest the CALLER signs for a read/control request (tasks/get | cancel |
15
+ * pushNotificationConfig/set). Authorization for these ops previously trusted a `caller` param the client
16
+ * supplied — any attacker who knew a taskId could impersonate a party. The caller now PROVES control of
17
+ * `caller` by signing this digest (verified via `OnChainChecks.verifyCallerSignature`). Bound to the
18
+ * method (can't replay a `get` signature as a `cancel`), the taskId, the verifying agent, and the chain
19
+ * (no cross-deployment replay). The agent re-derives it server-side — a client-supplied digest is never
20
+ * trusted. */
21
+ export declare function hashA2aTaskRequest(r: {
22
+ method: string;
23
+ taskId: Hex;
24
+ agentSA: Address;
25
+ chainId: number;
26
+ /** N-1 (seam audit): hash of the method-specific parameters that MUST be bound into the signature so
27
+ * they can't be swapped on replay. For `pushNotificationConfig/set` this is
28
+ * `hashPushConfigParams(url, token)` — without it a captured `set` signature could be replayed with an
29
+ * ATTACKER url, redirecting the task's terminal push envelope (leaking taskId/state/artifacts + the push
30
+ * token). Absent (zero) for parameter-less ops (tasks/get, tasks/cancel). */
31
+ paramsHash?: Hex;
32
+ /** N-2 (seam audit): the caller's signing time (unix seconds), folded into the digest so a captured
33
+ * read/control signature is bounded to a freshness window (the agent rejects a stale one) instead of
34
+ * being replayable for the life of the task. Absent (0) preserves the legacy unbounded digest. */
35
+ issuedAt?: number;
36
+ }): Hex;
37
+ /** N-1: bind the push-notification target (url + optional token) into the `set` request signature so it
38
+ * cannot be replayed with a different url. The server re-derives this from the presented url/token. */
39
+ export declare function hashPushConfigParams(url: string, token?: string): Hex;
14
40
  /** On-chain + crypto verdicts injected by the consumer (viem-backed). All fail-closed. */
15
41
  export interface OnChainChecks {
16
42
  /** DelegationManager.isRevoked(hashDelegation(d)) — MUST throw or return true to deny. */
@@ -19,14 +45,37 @@ export interface OnChainChecks {
19
45
  verifyDelegationSignature(delegation: Delegation): Promise<boolean>;
20
46
  /** ERC-1271: the sender SA signed `hashA2aMessage(message)`. */
21
47
  verifyMessageSignature(message: A2aMessage, digest: Hex): Promise<boolean>;
48
+ /** AUDIT NEW-A2A-2 — ERC-1271: `caller` SA signed `hashA2aTaskRequest(...)`. Proves the read/control
49
+ * caller controls the address it claims, so `caller` can no longer be spoofed. Fail-closed (throw/false). */
50
+ verifyCallerSignature(caller: Address, digest: Hex, signature: Hex): Promise<boolean>;
22
51
  }
23
- /** Single-use reservation seam (the TaskStore provides this; FR-4.3). */
52
+ /** A reserved single-use message-id (spec 290 §3). Mirrors delegation's `JtiReservation`: a reservation is
53
+ * IN-FLIGHT (it still serves as the replay guard) until the caller either commits it (the task was durably
54
+ * created) or releases it (a pre-acceptance rejection). */
55
+ export interface MessageIdReservation {
56
+ /** Finalize — the id is permanently consumed; a later replay is rejected. */
57
+ commit(): Promise<void>;
58
+ /** Free the IN-FLIGHT reservation WITHOUT consuming the id, so a legitimate retry of the SAME message
59
+ * may re-reserve. Called on any pre-durable-acceptance rejection so a failed submit never burns the
60
+ * nonce (spec 290 §3 — a post-verify reject must not consume the authorization). */
61
+ release(): Promise<void>;
62
+ }
63
+ /** Single-use reservation seam (the TaskStore provides this; FR-4.3). Two-phase per spec 290 §3. */
24
64
  export interface MessageIdReserver {
25
- reserveMessageId(messageId: Hex, ttlSec: number): Promise<boolean>;
65
+ /** Reserve the id IN-FLIGHT (replay guard). Returns a reservation to `commit` (durable accept) or
66
+ * `release` (pre-acceptance reject); `null` if the id is already in-flight or consumed (replay → deny). */
67
+ reserveMessageId(messageId: Hex, ttlSec: number): Promise<MessageIdReservation | null>;
68
+ /** A2A-4 (seam audit): OPTIONAL cheap read-only "is this id already consumed/in-flight?" peek. When
69
+ * provided, authorizeA2aMessage checks it FIRST and rejects a definite replay BEFORE the 3 on-chain
70
+ * reads (isRevoked + two ERC-1271 verifies) — so replaying a consumed messageId can't amplify RPC load.
71
+ * It is only an optimization: the atomic reserve-LAST remains the source of truth for the genuine race
72
+ * (a false `false` here just falls through to the normal path). Omit ⇒ unchanged behavior. */
73
+ peekConsumed?(messageId: Hex): Promise<boolean>;
26
74
  }
27
75
  export type AuthorizeResult = {
28
76
  ok: true;
29
77
  principal: Address;
78
+ messageIdReservation: MessageIdReservation;
30
79
  } | {
31
80
  ok: false;
32
81
  reason: string;
package/dist/auth.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAQA,OAAO,EAAgE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAC5G,OAAO,KAAK,EAAE,UAAU,EAAU,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAgC,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAE7E,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAG3F;AACD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,GAAG,GAAG,SAAS,OAAO,EAAE,CAGxE;AACD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,GAAG,GAAG,SAAS,GAAG,EAAE,CAGpE;AAED,6GAA6G;AAC7G,wBAAgB,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG,GAAG,CAOpH;AAED,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,SAAS,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,yDAAyD;IACzD,yBAAyB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,gEAAgE;IAChE,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5E;AAED,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAMlC;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,UAAU,CAAC;IACpB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;IACrB,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,YAAY,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,iBAAiB,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6D3B"}
1
+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAQA,OAAO,EAAgE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAC5G,OAAO,KAAK,EAAE,UAAU,EAAU,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAgC,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAE7E,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAG3F;AACD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,GAAG,GAAG,SAAS,OAAO,EAAE,CAGxE;AACD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,GAAG,GAAG,SAAS,GAAG,EAAE,CAGpE;AAED,6GAA6G;AAC7G,wBAAgB,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG,GAAG,CAOpH;AAED;;;;;;eAMe;AACf,wBAAgB,kBAAkB,CAAC,CAAC,EAAE;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,GAAG,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;kFAI8E;IAC9E,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB;;uGAEmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,GAAG,CAcN;AAED;wGACwG;AACxG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,GAAG,CAErE;AAED,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,SAAS,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,yDAAyD;IACzD,yBAAyB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,gEAAgE;IAChE,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;kHAC8G;IAC9G,qBAAqB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AAED;;4DAE4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;yFAEqF;IACrF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC;gHAC4G;IAC5G,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACvF;;;;mGAI+F;IAC/F,YAAY,CAAC,CAAC,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,oBAAoB,EAAE,oBAAoB,CAAA;CAAE,GAC5E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAMlC;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,UAAU,CAAC;IACpB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;IACrB,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,YAAY,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,iBAAiB,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwE3B"}
package/dist/auth.js CHANGED
@@ -25,6 +25,28 @@ export function decodeAllowedMethodsTerms(terms) {
25
25
  export function hashA2aMessage(m) {
26
26
  return keccak256(encodeAbiParameters([{ type: 'bytes32' }, { type: 'address' }, { type: 'bytes32' }, { type: 'bytes32' }, { type: 'uint256' }], [m.messageId, m.sender, keccak256(toBytes(m.skill)), m.bodyHash, BigInt(m.createdAt)]));
27
27
  }
28
+ /** AUDIT NEW-A2A-2: canonical digest the CALLER signs for a read/control request (tasks/get | cancel |
29
+ * pushNotificationConfig/set). Authorization for these ops previously trusted a `caller` param the client
30
+ * supplied — any attacker who knew a taskId could impersonate a party. The caller now PROVES control of
31
+ * `caller` by signing this digest (verified via `OnChainChecks.verifyCallerSignature`). Bound to the
32
+ * method (can't replay a `get` signature as a `cancel`), the taskId, the verifying agent, and the chain
33
+ * (no cross-deployment replay). The agent re-derives it server-side — a client-supplied digest is never
34
+ * trusted. */
35
+ export function hashA2aTaskRequest(r) {
36
+ return keccak256(encodeAbiParameters([{ type: 'bytes32' }, { type: 'bytes32' }, { type: 'address' }, { type: 'uint256' }, { type: 'bytes32' }, { type: 'uint256' }], [
37
+ keccak256(toBytes(`a2a:request:${r.method}`)),
38
+ r.taskId,
39
+ r.agentSA,
40
+ BigInt(r.chainId),
41
+ r.paramsHash ?? `0x${'00'.repeat(32)}`,
42
+ BigInt(r.issuedAt ?? 0),
43
+ ]));
44
+ }
45
+ /** N-1: bind the push-notification target (url + optional token) into the `set` request signature so it
46
+ * cannot be replayed with a different url. The server re-derives this from the presented url/token. */
47
+ export function hashPushConfigParams(url, token) {
48
+ return keccak256(encodeAbiParameters([{ type: 'string' }, { type: 'string' }], [url, token ?? '']));
49
+ }
28
50
  const eq = (a, b) => a.toLowerCase() === b.toLowerCase();
29
51
  const findCaveat = (caveats, enforcer) => caveats.find((c) => eq(c.enforcer, enforcer));
30
52
  /**
@@ -40,6 +62,12 @@ export async function authorizeA2aMessage(args) {
40
62
  return { ok: false, reason: 'delegate != requester' };
41
63
  if (!eq(message.sender, args.requester))
42
64
  return { ok: false, reason: 'message sender != requester' };
65
+ // A2A-4 — cheap replay peek BEFORE the on-chain reads: a replayed (already-consumed) messageId is
66
+ // rejected here rather than after isRevoked + two ERC-1271 verifies, bounding RPC amplification. The
67
+ // atomic reserve-last below still handles the genuine race; this only short-circuits definite replays.
68
+ if (args.store.peekConsumed && (await args.store.peekConsumed(message.messageId))) {
69
+ return { ok: false, reason: 'message replay (already consumed)' };
70
+ }
43
71
  // FR-4.1 — timestamp window (off-chain decode; the enforcer would check the same on-chain).
44
72
  const tsCav = findCaveat(d.caveats, enforcers.timestamp);
45
73
  if (!tsCav)
@@ -108,9 +136,13 @@ export async function authorizeA2aMessage(args) {
108
136
  return { ok: false, reason: `message signature check failed: ${e instanceof Error ? e.message : e}` };
109
137
  }
110
138
  // FR-4.3 — single-use message id (reserve last; a replay of a valid message hits the reserved id).
111
- if (!(await args.store.reserveMessageId(message.messageId, args.replayTtlSec ?? 600))) {
139
+ // Two-phase (spec 290 §3): the reservation marks the id IN-FLIGHT; the caller commits it ONLY after the
140
+ // task is durably created, and releases it on any pre-acceptance rejection — so a post-verify failure
141
+ // (bad bodyHash, budget exhausted, a throwing store) never burns the nonce.
142
+ const messageIdReservation = await args.store.reserveMessageId(message.messageId, args.replayTtlSec ?? 600);
143
+ if (!messageIdReservation) {
112
144
  return { ok: false, reason: 'message id already used (replay)' };
113
145
  }
114
- return { ok: true, principal: d.delegator };
146
+ return { ok: true, principal: d.delegator, messageIdReservation };
115
147
  }
116
148
  //# sourceMappingURL=auth.js.map