@arnilo/prism-supervisor 0.0.6 → 0.0.8

package/dist/a2a-server.js

@@ -1,29 +1,31 @@
 import { createA2AAgentCard } from "./a2a-card.js";
+import { bounded, optionalCursor, parseA2AMessage, record, requireId, resolveA2ALimits, validateA2ATask } from "./a2a-parts.js";
 import { A2AError } from "./errors.js";
-const JSON_HEADERS = { "content-type": "application/a2a+json; charset=utf-8" };
-const SSE_HEADERS = { "content-type": "text/event-stream; charset=utf-8", "cache-control": "no-cache, no-transform" };
-const DEFAULTS = { maxRequestBytes: 64 * 1024, maxResponseBytes: 1024 * 1024, maxEventBytes: 64 * 1024, maxStreamBytes: 10 * 1024 * 1024, maxStreamEvents: 10_000, maxConcurrentRequests: 16, timeoutMs: 120_000, maxCardBytes: 64 * 1024 };
-const HARD = { maxRequestBytes: 1024 * 1024, maxResponseBytes: 8 * 1024 * 1024, maxEventBytes: 1024 * 1024, maxStreamBytes: 64 * 1024 * 1024, maxStreamEvents: 100_000, maxConcurrentRequests: 256, timeoutMs: 30 * 60_000, maxCardBytes: 1024 * 1024 };
+const JSON_HEADERS = { "content-type": "application/a2a+json; charset=utf-8", "a2a-version": "1.0" };
+const SSE_HEADERS = { "content-type": "text/event-stream; charset=utf-8", "cache-control": "no-cache, no-transform", "a2a-version": "1.0" };
 export function createA2AHandler(options) {
     const limits = resolveA2ALimits(options.limits);
     const card = createA2AAgentCard(options.card);
+    if (Boolean(card.capabilities.pushNotifications) !== Boolean(options.push))
+        throw new A2AError("Agent card push capability must match push adapter", 400, "ERR_PRISM_A2A_CONFIG");
     const endpointPath = options.endpointPath ?? new URL(card.supportedInterfaces[0].url).pathname;
     if (!endpointPath.startsWith("/"))
         throw new A2AError("endpointPath must be absolute", 400, "ERR_PRISM_A2A_CONFIG");
     const cardJson = JSON.stringify(card);
-    if (new TextEncoder().encode(cardJson).byteLength > limits.maxCardBytes)
+    if (Buffer.byteLength(cardJson) > limits.maxCardBytes)
         throw new A2AError("Agent card exceeds max bytes", 400, "ERR_PRISM_A2A_CARD");
     let active = 0;
-    let sequence = 0;
     return async (request) => {
-        let acquired = false;
-        let transferred = false;
+        let acquired = false, transferred = false;
         try {
             const path = new URL(request.url).pathname;
             if (request.method === "GET" && path === "/.well-known/agent-card.json")
-                return new Response(cardJson, { status: 200, headers: JSON_HEADERS });
+                return new Response(cardJson, { headers: JSON_HEADERS });
             if (request.method !== "POST" || path !== endpointPath)
                 return errorResponse(404, "Not found", null);
+            const version = request.headers.get("a2a-version");
+            if (version && version !== "1.0")
+                return rpcError(null, -32009, "Unsupported A2A version");
             if (active >= limits.maxConcurrentRequests)
                 return errorResponse(429, "Too many requests", null);
             active += 1;
@@ -33,31 +35,67 @@ export function createA2AHandler(options) {
                 const contentType = request.headers.get("content-type")?.split(";", 1)[0]?.trim();
                 if (contentType !== "application/json" && contentType !== "application/a2a+json")
                     return errorResponse(415, "Unsupported media type", null);
-                const body = await readJson(request, limits.maxRequestBytes, owned.signal);
-                const rpc = parseRpc(body);
-                const authorized = await abortable(Promise.resolve(options.authorize({ request, method: rpc.method, signal: owned.signal })), owned.signal);
-                if (!authorized)
+                const rpc = parseRpc(await readJson(request, limits.maxRequestBytes, owned.signal));
+                const authorization = await abortable(Promise.resolve(options.authorize({ request, method: rpc.method, signal: owned.signal })), owned.signal);
+                if (!authorization)
                     return errorResponse(403, "Forbidden", rpc.id);
                 if (rpc.method === "GetExtendedAgentCard")
-                    return boundedJson({ jsonrpc: "2.0", id: rpc.id, result: card }, limits.maxResponseBytes, options);
-                if (rpc.method !== "SendMessage" && rpc.method !== "SendStreamingMessage")
-                    return boundedJson({ jsonrpc: "2.0", id: rpc.id, error: { code: -32601, message: "Method not found" } }, limits.maxResponseBytes, options);
-                const message = parseMessage(rpc.params?.message, limits.maxRequestBytes);
-                const input = message.parts.map((part) => part.text).join("\n");
-                sequence += 1;
-                const taskId = `task-${crypto.randomUUID()}`;
-                const contextId = message.contextId ?? `context-${sequence}-${crypto.randomUUID()}`;
-                const session = await abortable(Promise.resolve(options.exposure.sessionFactory(authorized)), owned.signal);
-                if (rpc.method === "SendMessage") {
-                    const result = await abortable(session.run(input, { ownership: authorized.ownership, metadata: authorized.metadata, signal: owned.signal, redactor: options.redactor }), owned.signal);
-                    return boundedJson({ jsonrpc: "2.0", id: rpc.id, result: { task: toTask(taskId, contextId, result, options) } }, limits.maxResponseBytes, options);
+                    return card.capabilities.extendedAgentCard ? json(rpc.id, card, limits, options) : rpcError(rpc.id, -32004, "Extended Agent Card unavailable");
+                if (rpc.method === "SendMessage" || rpc.method === "SendStreamingMessage") {
+                    const message = await parseA2AMessage(rpc.params?.message, limits, options.parts);
+                    if (options.tasks) {
+                        const task = await options.tasks.start({ message, authorization, signal: owned.signal, returnImmediately: record(rpc.params?.configuration) && rpc.params.configuration.returnImmediately === true });
+                        await validateA2ATask(task, limits, options.parts);
+                        if (rpc.method === "SendMessage")
+                            return json(rpc.id, { task }, limits, options);
+                        transferred = true;
+                        const events = terminal(task.status.state) ? oneEvent(task) : options.tasks.subscribe({ id: task.id, authorization, signal: owned.signal });
+                        return streamResponse(rpc.id, events, owned, limits, options, () => { active -= 1; });
+                    }
+                    if (message.parts.some((part) => !("text" in part)))
+                        return rpcError(rpc.id, -32004, "Durable task lifecycle required for rich parts");
+                    const input = message.parts.map((part) => part.text).join("\n");
+                    const session = await abortable(Promise.resolve(options.exposure.sessionFactory(authorization)), owned.signal);
+                    const taskId = `task-${crypto.randomUUID()}`, contextId = message.contextId ?? `context-${crypto.randomUUID()}`;
+                    if (rpc.method === "SendMessage")
+                        return json(rpc.id, { task: toTask(taskId, contextId, await abortable(session.run(input, { ownership: authorization.ownership, metadata: authorization.metadata, signal: owned.signal, redactor: options.redactor }), owned.signal), options) }, limits, options);
+                    transferred = true;
+                    const events = runEvents(taskId, contextId, () => session.run(input, { ownership: authorization.ownership, metadata: authorization.metadata, signal: owned.signal, redactor: options.redactor }), options);
+                    return streamResponse(rpc.id, events, owned, limits, options, () => { active -= 1; });
                 }
-                if (rpc.method === "SendStreamingMessage") {
+                if (["GetTask", "ListTasks", "CancelTask", "SubscribeToTask"].includes(rpc.method)) {
+                    if (!options.tasks)
+                        return rpcError(rpc.id, -32004, "Task lifecycle unavailable");
+                    if (rpc.method === "GetTask") {
+                        const task = await options.tasks.get({ id: requireId(rpc.params?.id, limits), historyLength: integer(rpc.params?.historyLength, 0, limits.maxHistory), authorization, signal: owned.signal });
+                        return task ? json(rpc.id, await validateA2ATask(task, limits, options.parts), limits, options) : rpcError(rpc.id, -32001, "Task not found");
+                    }
+                    if (rpc.method === "ListTasks") {
+                        const pageSize = integer(rpc.params?.pageSize, 50, limits.maxPageSize), pageToken = optionalCursor(rpc.params?.pageToken, limits), contextId = rpc.params?.contextId === undefined ? undefined : requireId(rpc.params.contextId, limits, "context id");
+                        const page = await options.tasks.list({ pageSize, pageToken, contextId, authorization, signal: owned.signal });
+                        if (page.tasks.length > pageSize || page.tasks.length > limits.maxPageSize)
+                            throw new A2AError("Task page exceeds limit", 507, "ERR_PRISM_A2A_RESPONSE_LIMIT");
+                        for (const task of page.tasks)
+                            await validateA2ATask(task, limits, options.parts);
+                        optionalCursor(page.nextPageToken, limits);
+                        return json(rpc.id, page, limits, options);
+                    }
+                    if (rpc.method === "CancelTask") {
+                        const task = await options.tasks.cancel({ id: requireId(rpc.params?.id, limits), authorization, signal: owned.signal });
+                        return task ? json(rpc.id, await validateA2ATask(task, limits, options.parts), limits, options) : rpcError(rpc.id, -32001, "Task not found");
+                    }
+                    const taskId = requireId(rpc.params?.id, limits), afterEventId = optionalCursor(rpc.params?.afterEventId, limits);
+                    const current = await options.tasks.get({ id: taskId, historyLength: 0, authorization, signal: owned.signal });
+                    if (!current)
+                        return rpcError(rpc.id, -32001, "Task not found");
+                    if (finalTerminal(current.status.state))
+                        return rpcError(rpc.id, -32004, "Terminal task cannot be subscribed");
                     transferred = true;
-                    const stream = taskStream(rpc.id, taskId, contextId, () => session.run(input, { ownership: authorized.ownership, metadata: authorized.metadata, signal: owned.signal, redactor: options.redactor }), owned, limits, options, () => { active -= 1; });
-                    return new Response(stream, { status: 200, headers: SSE_HEADERS });
+                    return streamResponse(rpc.id, options.tasks.subscribe({ id: taskId, afterEventId, authorization, signal: owned.signal }), owned, limits, options, () => { active -= 1; });
                 }
-                throw new A2AError("Method not found", 400, "ERR_PRISM_A2A_METHOD");
+                if (rpc.method.includes("TaskPushNotificationConfig"))
+                    return await pushOperation(rpc, authorization, owned.signal, limits, options);
+                return rpcError(rpc.id, -32601, "Method not found");
             }
             finally {
                 if (!transferred)
@@ -74,157 +112,140 @@ export function createA2AHandler(options) {
         }
     };
 }
-function taskStream(id, taskId, contextId, run, owned, limits, options, release) {
-    const iterator = (async function* () {
-        yield { jsonrpc: "2.0", id, result: { task: { id: taskId, contextId, status: { state: "TASK_STATE_WORKING", timestamp: new Date().toISOString() } } } };
-        try {
-            const result = await run();
-            yield { jsonrpc: "2.0", id, result: { task: toTask(taskId, contextId, result, options) } };
-        }
-        catch (error) {
-            yield { jsonrpc: "2.0", id, error: { code: -32000, message: safeError(error, options) } };
-        }
-    })()[Symbol.asyncIterator]();
-    let events = 0;
-    let bytes = 0;
-    let released = false;
+async function pushOperation(rpc, authorization, signal, limits, options) {
+    if (!options.push)
+        return rpcError(rpc.id, -32004, "Push notifications unavailable");
+    const taskId = requireId(rpc.params?.taskId, limits), id = rpc.params?.id === undefined ? undefined : requireId(rpc.params.id, limits, "push config id");
+    if (rpc.method === "CreateTaskPushNotificationConfig") {
+        const supplied = record(rpc.params?.config) ? rpc.params.config : rpc.params;
+        if (!record(supplied))
+            throw new A2AError("Invalid push config", 400, "ERR_PRISM_A2A_PUSH");
+        const config = await parsePush({ ...supplied, taskId }, limits, options);
+        return json(rpc.id, publicPush(await options.push.create({ config, authorization, signal })), limits, options);
+    }
+    if (rpc.method === "GetTaskPushNotificationConfig") {
+        const value = await options.push.get({ taskId, id: id, authorization, signal });
+        return value ? json(rpc.id, publicPush(value), limits, options) : rpcError(rpc.id, -32001, "Task or push config not found");
+    }
+    if (rpc.method === "ListTaskPushNotificationConfigs") {
+        const pageSize = integer(rpc.params?.pageSize, limits.maxPushConfigs, limits.maxPushConfigs), pageToken = optionalCursor(rpc.params?.pageToken, limits);
+        const page = await options.push.list({ taskId, pageSize, pageToken, authorization, signal });
+        if (page.configs.length > pageSize)
+            throw new A2AError("Push config page exceeds limit", 507, "ERR_PRISM_A2A_RESPONSE_LIMIT");
+        return json(rpc.id, { configs: page.configs.map(publicPush), nextPageToken: optionalCursor(page.nextPageToken, limits) }, limits, options);
+    }
+    if (rpc.method === "DeleteTaskPushNotificationConfig")
+        return await options.push.delete({ taskId, id: id, authorization, signal }) ? json(rpc.id, {}, limits, options) : rpcError(rpc.id, -32001, "Task or push config not found");
+    return rpcError(rpc.id, -32601, "Method not found");
+}
+async function parsePush(value, limits, options) {
+    const id = requireId(value.id, limits, "push config id"), taskId = requireId(value.taskId, limits);
+    if (typeof value.url !== "string" || !options.parts?.validateUrl)
+        throw new A2AError("Push URL policy required", 403, "ERR_PRISM_A2A_ORIGIN");
+    let url;
+    try {
+        url = new URL(value.url);
+    }
+    catch {
+        throw new A2AError("Invalid push URL", 400, "ERR_PRISM_A2A_PUSH");
+    }
+    if (url.protocol !== "https:" || url.username || url.password || url.hash)
+        throw new A2AError("Push URL requires credential-free HTTPS", 403, "ERR_PRISM_A2A_ORIGIN");
+    await options.parts.validateUrl(url);
+    const authentication = record(value.authentication) && typeof value.authentication.scheme === "string" ? { scheme: value.authentication.scheme.slice(0, 64), credentials: typeof value.authentication.credentials === "string" ? value.authentication.credentials.slice(0, limits.maxPartBytes) : undefined } : undefined;
+    return bounded({ id, taskId, url: url.href, token: typeof value.token === "string" ? value.token.slice(0, limits.maxPartBytes) : undefined, authentication }, limits.maxPartBytes, "Push config");
+}
+function publicPush(value) { return { id: value.id, taskId: value.taskId, url: value.url, authentication: value.authentication ? { scheme: value.authentication.scheme } : undefined }; }
+function streamResponse(id, source, owned, limits, options, release) {
+    const iterator = source[Symbol.asyncIterator]();
+    let events = 0, bytes = 0, released = false, previous = "";
     const finish = () => { if (!released) {
         released = true;
         owned.dispose();
         release();
+        void iterator.return?.();
     } };
-    return new ReadableStream({
-        async pull(controller) {
-            try {
-                const next = await iterator.next();
-                if (next.done) {
-                    finish();
-                    controller.close();
-                    return;
-                }
-                const payload = options.redactor?.redact(next.value) ?? next.value;
-                const chunk = new TextEncoder().encode(`data: ${JSON.stringify(payload)}\n\n`);
-                events += 1;
-                bytes += chunk.byteLength;
-                if (chunk.byteLength > limits.maxEventBytes || events > limits.maxStreamEvents || bytes > limits.maxStreamBytes)
-                    throw new A2AError("A2A stream limit exceeded", 507, "ERR_PRISM_A2A_STREAM_LIMIT");
-                controller.enqueue(chunk);
-            }
-            catch (error) {
+    return new Response(new ReadableStream({
+        async pull(controller) { try {
+            const next = await iterator.next();
+            if (next.done) {
                 finish();
-                controller.error(error);
+                controller.close();
+                return;
             }
-        },
-        cancel(reason) { owned.abort(reason); finish(); void iterator.return?.(); },
-    });
-}
-function toTask(taskId, contextId, result, options) {
-    const state = result.status === "succeeded" ? "TASK_STATE_COMPLETED" : result.status === "aborted" ? "TASK_STATE_CANCELED" : "TASK_STATE_FAILED";
-    const text = options.redactor?.redact(result.text) ?? result.text;
-    return Object.freeze({
-        id: taskId,
-        contextId,
-        status: { state, timestamp: new Date().toISOString() },
-        artifacts: text ? [{ artifactId: `${taskId}-result`, parts: [{ text }] }] : undefined,
-    });
-}
-function parseRpc(value) {
-    if (!isRecord(value) || value.jsonrpc !== "2.0" || !(typeof value.id === "string" || typeof value.id === "number" || value.id === null) || typeof value.method !== "string")
-        throw new A2AError("Invalid JSON-RPC request", 400, "ERR_PRISM_A2A_REQUEST");
-    if (value.params !== undefined && !isRecord(value.params))
-        throw new A2AError("Invalid JSON-RPC params", 400, "ERR_PRISM_A2A_REQUEST");
-    return { jsonrpc: "2.0", id: value.id, method: value.method, params: value.params };
-}
-function parseMessage(value, maxBytes) {
-    if (!isRecord(value) || (value.role !== "user" && value.role !== "ROLE_USER") || typeof value.messageId !== "string" || !value.messageId || !Array.isArray(value.parts) || value.parts.length < 1 || value.parts.length > 32)
-        throw new A2AError("Invalid A2A message", 400, "ERR_PRISM_A2A_MESSAGE");
-    const parts = value.parts.map((part) => {
-        if (!isRecord(part) || typeof part.text !== "string" || Object.keys(part).some((key) => key !== "text" && key !== "metadata"))
-            throw new A2AError("Only text A2A parts are supported", 400, "ERR_PRISM_A2A_MESSAGE");
-        return { text: part.text, metadata: isRecord(part.metadata) ? part.metadata : undefined };
-    });
-    const message = { role: value.role, messageId: value.messageId, parts, contextId: typeof value.contextId === "string" ? value.contextId : undefined };
-    if (encode(message).byteLength > maxBytes)
-        throw new A2AError("A2A message exceeds max bytes", 413, "ERR_PRISM_A2A_MESSAGE_LIMIT");
-    return message;
-}
-function resolveA2ALimits(input = {}) {
-    const output = {};
-    for (const key of Object.keys(DEFAULTS)) {
-        const value = input[key] ?? DEFAULTS[key];
-        if (!Number.isSafeInteger(value) || value < 1 || value > HARD[key])
-            throw new A2AError(`${key} is invalid`, 400, "ERR_PRISM_A2A_CONFIG");
-        output[key] = value;
-    }
-    return output;
-}
-async function readJson(request, maxBytes, signal) {
-    if (!request.body)
-        throw new A2AError("Request body is required", 400, "ERR_PRISM_A2A_REQUEST");
-    const reader = request.body.getReader();
-    const chunks = [];
-    let size = 0;
-    try {
-        while (true) {
-            signal.throwIfAborted();
-            const next = await reader.read();
-            if (next.done)
-                break;
-            size += next.value.byteLength;
-            if (size > maxBytes)
-                throw new A2AError("Request exceeds max bytes", 413, "ERR_PRISM_A2A_REQUEST_LIMIT");
-            chunks.push(next.value);
+            if (!optionalCursor(next.value.eventId, limits) || next.value.eventId === previous)
+                throw new A2AError("Duplicate/invalid A2A event id", 500, "ERR_PRISM_A2A_STREAM_LIMIT");
+            await validateTaskEvent(next.value, limits, options);
+            previous = next.value.eventId;
+            const payload = options.redactor?.redact({ jsonrpc: "2.0", id, result: next.value }) ?? { jsonrpc: "2.0", id, result: next.value };
+            const chunk = new TextEncoder().encode(`id: ${next.value.eventId}\ndata: ${JSON.stringify(payload)}\n\n`);
+            events++;
+            bytes += chunk.byteLength;
+            if (events > Math.min(limits.maxStreamEvents, limits.maxReplayEvents) || chunk.byteLength > limits.maxEventBytes || bytes > limits.maxStreamBytes)
+                throw new A2AError("A2A stream limit exceeded", 507, "ERR_PRISM_A2A_STREAM_LIMIT");
+            controller.enqueue(chunk);
         }
+        catch (error) {
+            finish();
+            controller.error(error);
+        } },
+        cancel(reason) { owned.abort(reason); finish(); },
+    }), { headers: SSE_HEADERS });
+}
+async function validateTaskEvent(event, limits, options) {
+    if ("task" in event) {
+        await validateA2ATask(event.task, limits, options.parts);
+        return;
     }
-    finally {
-        reader.releaseLock();
-    }
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    try {
-        return JSON.parse(new TextDecoder().decode(bytes));
-    }
-    catch {
-        throw new A2AError("Invalid JSON", 400, "ERR_PRISM_A2A_REQUEST");
+    if ("statusUpdate" in event) {
+        await validateA2ATask({ id: event.statusUpdate.taskId, contextId: event.statusUpdate.contextId, status: event.statusUpdate.status }, limits, options.parts);
+        return;
     }
+    await validateA2ATask({ id: event.artifactUpdate.taskId, contextId: event.artifactUpdate.contextId, status: { state: "TASK_STATE_WORKING", timestamp: new Date().toISOString() }, artifacts: [event.artifactUpdate.artifact] }, limits, options.parts);
 }
-function boundedJson(value, maxBytes, options) {
-    const body = JSON.stringify(options.redactor?.redact(value) ?? value);
-    if (new TextEncoder().encode(body).byteLength > maxBytes)
-        throw new A2AError("Response exceeds max bytes", 507, "ERR_PRISM_A2A_RESPONSE_LIMIT");
-    return new Response(body, { status: 200, headers: JSON_HEADERS });
-}
-function errorResponse(status, message, id) {
-    const body = { jsonrpc: "2.0", id, error: { code: status === 404 ? -32601 : -32000, message } };
-    return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
-}
-function ownedSignal(parent, timeoutMs) {
-    const controller = new AbortController();
-    const abort = () => controller.abort(parent.reason);
-    if (parent.aborted)
-        abort();
-    else
-        parent.addEventListener("abort", abort, { once: true });
-    const timer = setTimeout(() => controller.abort(new DOMException("A2A request timed out", "AbortError")), timeoutMs);
-    return { signal: controller.signal, abort: (reason) => controller.abort(reason), dispose: () => { clearTimeout(timer); parent.removeEventListener("abort", abort); } };
-}
-function abortable(promise, signal) {
-    if (signal.aborted)
-        return Promise.reject(signal.reason);
-    return new Promise((resolve, reject) => {
-        const abort = () => reject(signal.reason);
-        signal.addEventListener("abort", abort, { once: true });
-        promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
-    });
+async function* oneEvent(task) { yield { eventId: `terminal-${task.id}`, task }; }
+async function* runEvents(taskId, contextId, run, options) { yield { eventId: "1", task: { id: taskId, contextId, status: { state: "TASK_STATE_WORKING", timestamp: new Date().toISOString() } } }; yield { eventId: "2", task: toTask(taskId, contextId, await run(), options) }; }
+function toTask(taskId, contextId, result, options) { const state = result.status === "succeeded" ? "TASK_STATE_COMPLETED" : result.status === "aborted" ? "TASK_STATE_CANCELED" : "TASK_STATE_FAILED"; const text = options.redactor?.redact(result.text) ?? result.text; return { id: taskId, contextId, status: { state, timestamp: new Date().toISOString() }, artifacts: text ? [{ artifactId: `${taskId}-result`, parts: [{ text }] }] : undefined }; }
+function parseRpc(value) { if (!record(value) || value.jsonrpc !== "2.0" || !(typeof value.id === "string" || typeof value.id === "number" || value.id === null) || typeof value.method !== "string" || (value.params !== undefined && !record(value.params)))
+    throw new A2AError("Invalid JSON-RPC request", 400, "ERR_PRISM_A2A_REQUEST"); return { jsonrpc: "2.0", id: value.id, method: value.method, params: value.params }; }
+async function readJson(request, maxBytes, signal) { if (!request.body)
+    throw new A2AError("Request body is required", 400, "ERR_PRISM_A2A_REQUEST"); const reader = request.body.getReader(), chunks = []; let size = 0; try {
+    while (true) {
+        signal.throwIfAborted();
+        const n = await reader.read();
+        if (n.done)
+            break;
+        size += n.value.byteLength;
+        if (size > maxBytes)
+            throw new A2AError("Request exceeds max bytes", 413, "ERR_PRISM_A2A_REQUEST_LIMIT");
+        chunks.push(n.value);
+    }
 }
-function encode(value) { return new TextEncoder().encode(JSON.stringify(value)); }
-function isRecord(value) { return !!value && typeof value === "object" && !Array.isArray(value); }
-function safeError(error, options) {
-    const message = (error instanceof Error ? error.message : "A2A request failed").slice(0, 1024);
-    return options.redactor?.redact(message) ?? message;
+finally {
+    reader.releaseLock();
+} const bytes = new Uint8Array(size); let offset = 0; for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+} try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
 }
+catch {
+    throw new A2AError("Invalid JSON", 400, "ERR_PRISM_A2A_REQUEST");
+} }
+function json(id, result, limits, options) { const body = JSON.stringify(options.redactor?.redact({ jsonrpc: "2.0", id, result }) ?? { jsonrpc: "2.0", id, result }); if (Buffer.byteLength(body) > limits.maxResponseBytes)
+    throw new A2AError("Response exceeds max bytes", 507, "ERR_PRISM_A2A_RESPONSE_LIMIT"); return new Response(body, { headers: JSON_HEADERS }); }
+function rpcError(id, code, message) { return new Response(JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } }), { headers: JSON_HEADERS }); }
+function errorResponse(status, message, id) { const body = { jsonrpc: "2.0", id, error: { code: status === 404 ? -32001 : -32000, message } }; return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS }); }
+function integer(value, fallback, max) { if (value === undefined)
+    return fallback; if (!Number.isSafeInteger(value) || Number(value) < 0 || Number(value) > max)
+    throw new A2AError("Invalid A2A integer limit", 400, "ERR_PRISM_A2A_REQUEST"); return Number(value); }
+function terminal(state) { return finalTerminal(state) || state === "TASK_STATE_INPUT_REQUIRED" || state === "TASK_STATE_AUTH_REQUIRED"; }
+function finalTerminal(state) { return ["TASK_STATE_COMPLETED", "TASK_STATE_FAILED", "TASK_STATE_CANCELED", "TASK_STATE_REJECTED"].includes(state); }
+function ownedSignal(parent, timeoutMs) { const controller = new AbortController(); const abort = () => controller.abort(parent.reason); if (parent.aborted)
+    abort();
+else
+    parent.addEventListener("abort", abort, { once: true }); const timer = setTimeout(() => controller.abort(new DOMException("A2A request timed out", "AbortError")), timeoutMs); return { signal: controller.signal, abort: (reason) => controller.abort(reason), dispose: () => { clearTimeout(timer); parent.removeEventListener("abort", abort); } }; }
+function abortable(promise, signal) { if (signal.aborted)
+    return Promise.reject(signal.reason); return new Promise((resolve, reject) => { const abort = () => reject(signal.reason); signal.addEventListener("abort", abort, { once: true }); promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort)); }); }
+function safeError(error, options) { const message = (error instanceof Error ? error.message : "A2A request failed").slice(0, 1024); return options.redactor?.redact(message) ?? message; }
 //# sourceMappingURL=a2a-server.js.map