@harrylabsj/kiwi 0.6.0

package/dist/discovery/agent-card/secrets.js

@@ -0,0 +1,240 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Agent Card secret 扫描（基线 §26 MUST NOT 子句 + 安全不变量 24）。
+ *
+ * Agent Card / public metadata 不得包含：静态 bearer token、API key、password、
+ * 私钥、Merchant cost/floor 数据、Principal 私有状态。本扫描器对原始 JSON
+ * （含未知/扩展字段）做启发式拒绝，任何命中即视为不可用的 card。
+ *
+ * 设计取舍：安全扫描宁可误报（fail-closed）也不漏报。合法 card 的常见字符串
+ * （name/description 散文、URL、版本号、binding 名、skill id、credential 引用）
+ * 均不会命中以下规则。
+ */
+import { AgentCardError } from "./error.js";
+/** PEM 私钥块。 */
+const PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
+/** 已知厂商 token 前缀（整串或 word-boundary 片段）。 */
+const TOKEN_PREFIX_RE = /^(sk-|sk_live_|rk_live_|pk_live_|pk_test_|AKIA|ASIA|ghp_|gho_|ghu_|ghs_|ghr_|xox[baprs]-|ya29\.|eyJ[A-Za-z0-9_-]{6,}\.)/;
+/** 内嵌在散文中的 token 片段（整串扫描之外的二次兜底）。 */
+const EMBEDDED_TOKEN_RE = /\b(sk-[A-Za-z0-9_-]{8,}|sk_live_[A-Za-z0-9]{10,}|pk_live_[A-Za-z0-9]{10,}|ghp_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,})\b/;
+/** 显式 Bearer 头。 */
+const BEARER_RE = /^Bearer\s+\S/;
+/** 安全引用/占位符：env 引用、${VAR}、$VAR、<placeholder>。 */
+const PLACEHOLDER_RE = /^(env:[A-Za-z_][A-Za-z0-9_]*|\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$[A-Za-z_][A-Za-z0-9_]*|<[^>]*>)$/;
+/** 字段名直接命中即拒绝的敏感键（值非占位符时）。 */
+const SENSITIVE_FIELD_NAMES = new Set([
+    "password",
+    "passwd",
+    "client_secret",
+    "secret_key",
+    "private_key",
+    "access_token",
+    "refresh_token",
+    "bearer_token",
+    "api_key",
+    "apikey",
+    "api-key",
+    "x-api-key",
+    "x-auth-token",
+    "authorization",
+    "proxy-authorization",
+    "authorizationheader",
+]);
+/** Merchant cost/floor 与 Principal 私有阈值字段名（基线 §4.4 Private by default）。 */
+const PRIVATE_COMMERCE_KEYS = new Set([
+    "cost",
+    "costs",
+    "unit_cost",
+    "cost_price",
+    "total_cost",
+    "floor",
+    "floor_price",
+    "price_floor",
+    "min_price",
+    "minimum_price",
+    "min_unit_price",
+    "margin",
+    "markup",
+    "cogs",
+    "breakeven",
+    "reserve_price",
+    "max_budget",
+    "budget_limit",
+    "max_total_price",
+    "max_unit_price",
+    "private_threshold",
+]);
+/** Principal 私有状态键名。 */
+const PRINCIPAL_PRIVATE_KEYS = new Set([
+    "private_memory",
+    "principal_memory",
+    "principal_private",
+    "personal_details",
+]);
+const RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+function looksLikeUrl(value) {
+    try {
+        const url = new URL(value);
+        return ((url.protocol === "https:" || url.protocol === "http:") &&
+            url.username === "" &&
+            url.password === "");
+    }
+    catch {
+        return false;
+    }
+}
+function charClasses(value) {
+    let count = 0;
+    if (/[a-z]/.test(value))
+        count += 1;
+    if (/[A-Z]/.test(value))
+        count += 1;
+    if (/[0-9]/.test(value))
+        count += 1;
+    if (/[^A-Za-z0-9]/.test(value))
+        count += 1;
+    return count;
+}
+/** 高熵 token 启发式：长、无空白、非 URL/时间戳、至少 3 个字符类或大写字+数字。 */
+function looksLikeToken(value) {
+    if (value.length < 24)
+        return false;
+    if (/\s/.test(value))
+        return false;
+    if (looksLikeUrl(value))
+        return false;
+    if (RFC3339.test(value))
+        return false;
+    if (PLACEHOLDER_RE.test(value))
+        return false;
+    return charClasses(value) >= 3 || (/[A-Z]/.test(value) && /[0-9]/.test(value));
+}
+function detectKindForValue(value) {
+    if (PRIVATE_KEY_RE.test(value))
+        return "private_key";
+    if (BEARER_RE.test(value))
+        return "bearer_token";
+    return "api_key";
+}
+function kindForSensitiveField(key) {
+    const lower = key.toLowerCase();
+    if (lower === "authorization" ||
+        lower === "proxy-authorization" ||
+        lower === "authorizationheader") {
+        return "authorization_header";
+    }
+    if (lower === "password" || lower === "passwd" || lower === "client_secret") {
+        return "password";
+    }
+    if (lower === "private_key" || lower === "secret_key") {
+        return "private_key";
+    }
+    return "api_key";
+}
+function scanString(value, path, findings) {
+    if (PRIVATE_KEY_RE.test(value) || BEARER_RE.test(value) || TOKEN_PREFIX_RE.test(value)) {
+        findings.push({
+            path,
+            kind: detectKindForValue(value),
+            detail: "string matches a known secret shape",
+        });
+        return;
+    }
+    if (EMBEDDED_TOKEN_RE.test(value)) {
+        findings.push({
+            path,
+            kind: "api_key",
+            detail: "prose contains an embedded token-shaped substring",
+        });
+        return;
+    }
+    if (looksLikeToken(value)) {
+        findings.push({
+            path,
+            kind: "high_entropy_token",
+            detail: "string is a long high-entropy token-shaped value",
+        });
+    }
+}
+/** 拼接 JSON Pointer 风格路径：根路径 "/" 不产生双斜杠。 */
+function joinPath(path, segment) {
+    return path === "/" ? `/${segment}` : `${path}/${segment}`;
+}
+function scanValue(value, path, findings) {
+    if (value === null || value === undefined)
+        return;
+    if (typeof value === "string") {
+        scanString(value, path, findings);
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => scanValue(item, joinPath(path, String(index)), findings));
+        return;
+    }
+    if (typeof value === "object") {
+        const record = value;
+        for (const [key, child] of Object.entries(record)) {
+            const childPath = joinPath(path, key);
+            const lower = key.toLowerCase();
+            if (PRIVATE_COMMERCE_KEYS.has(lower) &&
+                child !== undefined &&
+                child !== null &&
+                child !== "") {
+                findings.push({
+                    path: childPath,
+                    kind: "merchant_private_data",
+                    detail: `key "${key}" may carry private cost/floor data (baseline §4.4)`,
+                });
+            }
+            if (PRINCIPAL_PRIVATE_KEYS.has(lower) &&
+                child !== undefined &&
+                child !== null &&
+                child !== "") {
+                findings.push({
+                    path: childPath,
+                    kind: "principal_private_state",
+                    detail: `key "${key}" may carry principal private state`,
+                });
+            }
+            if (SENSITIVE_FIELD_NAMES.has(lower) && typeof child === "string") {
+                if (child.length > 0 && !PLACEHOLDER_RE.test(child)) {
+                    findings.push({
+                        path: childPath,
+                        kind: kindForSensitiveField(key),
+                        detail: `key "${key}" holds a static secret-shaped value`,
+                    });
+                }
+            }
+            scanValue(child, childPath, findings);
+        }
+    }
+}
+/** 扫描任意 JSON 值（原始 card 含未知/扩展字段）。纯函数，不抛错。 */
+export function scanAgentCardSecrets(value) {
+    const findings = [];
+    scanValue(value, "/", findings);
+    return { ok: findings.length === 0, findings };
+}
+/** 若命中任一 secret 类发现则抛 AgentCardError("secret_found")。 */
+export function assertNoAgentCardSecrets(value) {
+    const result = scanAgentCardSecrets(value);
+    if (!result.ok) {
+        const first = result.findings[0];
+        throw new AgentCardError("secret_found", `Agent Card rejected: ${first?.detail ?? "static secret detected"} at ${first?.path ?? "/"}`, first?.path ?? "/");
+    }
+}
+//# sourceMappingURL=secrets.js.map

package/dist/discovery/agent-card/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/discovery/agent-card/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAwB5C,eAAe;AACf,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAE/D,2CAA2C;AAC3C,MAAM,eAAe,GACnB,yHAAyH,CAAC;AAE5H,qCAAqC;AACrC,MAAM,iBAAiB,GACrB,4JAA4J,CAAC;AAE/J,mBAAmB;AACnB,MAAM,SAAS,GAAG,cAAc,CAAC;AAEjC,iDAAiD;AACjD,MAAM,cAAc,GAClB,8FAA8F,CAAC;AAEjG,8BAA8B;AAC9B,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,UAAU;IACV,QAAQ;IACR,eAAe;IACf,YAAY;IACZ,aAAa;IACb,cAAc;IACd,eAAe;IACf,cAAc;IACd,SAAS;IACT,QAAQ;IACR,SAAS;IACT,WAAW;IACX,cAAc;IACd,eAAe;IACf,qBAAqB;IACrB,qBAAqB;CACtB,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,MAAM;IACN,OAAO;IACP,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,OAAO;IACP,aAAa;IACb,aAAa;IACb,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,WAAW;IACX,eAAe;IACf,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;CACpB,CAAC,CAAC;AAEH,wBAAwB;AACxB,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,kEAAkE,CAAC;AAEnF,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;YACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE,CACpB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IACpC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qDAAqD;AACrD,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IACrD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IACE,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,qBAAqB;QAC/B,KAAK,KAAK,qBAAqB,EAC/B,CAAC;QACD,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC5E,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,QAAyB;IACxE,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC;YAC/B,MAAM,EAAE,qCAAqC;SAC9C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,kDAAkD;SAC3D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe;IAC7C,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,IAAY,EAAE,QAAyB;IACxE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAChC,IACE,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAChC,KAAK,KAAK,SAAS;gBACnB,KAAK,KAAK,IAAI;gBACd,KAAK,KAAK,EAAE,EACZ,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,uBAAuB;oBAC7B,MAAM,EAAE,QAAQ,GAAG,qDAAqD;iBACzE,CAAC,CAAC;YACL,CAAC;YACD,IACE,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC;gBACjC,KAAK,KAAK,SAAS;gBACnB,KAAK,KAAK,IAAI;gBACd,KAAK,KAAK,EAAE,EACZ,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,yBAAyB;oBAC/B,MAAM,EAAE,QAAQ,GAAG,qCAAqC;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAClE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpD,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,qBAAqB,CAAC,GAAG,CAAC;wBAChC,MAAM,EAAE,QAAQ,GAAG,sCAAsC;qBAC1D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,IAAI,cAAc,CACtB,cAAc,EACd,wBAAwB,KAAK,EAAE,MAAM,IAAI,wBAAwB,OAAO,KAAK,EAAE,IAAI,IAAI,GAAG,EAAE,EAC5F,KAAK,EAAE,IAAI,IAAI,GAAG,CACnB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/discovery/agent-card/types.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A2A Agent Card 领域类型（基线 §26，外部标准 pin §43：A2A v1.0.x）。
+ *
+ * 形状以架构基线 §26 的完整示例为准：`supportedInterfaces` 是数组，每一项至少
+ * 含 `url` + `protocolBinding` + `protocolVersion`。`protocolBinding` 的 core 值
+ * 对齐 A2A 1.0 核心 binding：JSONRPC / GRPC / HTTP+JSON；未来 compliant binding
+ * 使用正式 URI namespace（§26）。本模块不拒绝未知 binding 值，但 capability
+ * intersection 不选择它们（§3.1）。
+ *
+ * 安全不变量 24：Agent Card / public metadata 不得包含静态 secret。结构校验只
+ * 负责字段形状；secret 扫描由 secrets.ts 单独负责（含 merchant cost/floor 等
+ * 私有数据，基线 §4.4）。
+ */
+/** A2A 1.0 核心 protocol binding 集合（基线 §3.1 / §26 / §43）。 */
+export declare const CORE_PROTOCOL_BINDINGS: readonly ["JSONRPC", "GRPC", "HTTP+JSON"];
+export type CoreProtocolBinding = (typeof CORE_PROTOCOL_BINDINGS)[number];
+/** Kiwi Negotiation A2A Extension URI 路径（基线 §8.2）。 */
+export declare const KIWI_NEGOTIATION_EXTENSION_PATH = "/a2a/extensions/negotiation/1.0";
+/** 判断一个 binding 值是否是 A2A 1.0 核心 binding。未知 binding 不拒绝但不选择。 */
+export declare function isCoreProtocolBinding(value: string): value is CoreProtocolBinding;
+/**
+ * 单个 binding 的端点声明。§26 示例：
+ * `{ "url": "https://merchant.example/a2a", "protocolBinding": "JSONRPC", "protocolVersion": "1.0" }`
+ */
+export interface AgentInterface {
+    /** 该 binding 的端点 URL。连接时由 a2a client 做 SSRF/URL 安全校验。 */
+    url: string;
+    /** JSONRPC | GRPC | HTTP+JSON，或未来 compliant binding 的正式 URI。 */
+    protocolBinding: string;
+    /** binding 协议版本，例如 "1.0"。未知版本 fail-closed（§4.6）。 */
+    protocolVersion: string;
+}
+export interface AgentProvider {
+    organization: string;
+    /** 组织主页（可选）。 */
+    url?: string;
+}
+/** capabilities.extensions 或顶层 extensions 中的扩展引用。 */
+export interface AgentExtension {
+    uri: string;
+    required: boolean;
+}
+export interface AgentCapabilities {
+    streaming?: boolean;
+    pushNotifications?: boolean;
+    stateTransitionHistory?: boolean;
+    /** true 表示允许 card 含未冻结的扩展字段（A2A extendedAgentCard）。 */
+    extendedAgentCard?: boolean;
+    /** 扩展引用；Kiwi 通过 isNegotiationExtensionUri 识别 negotiation extension（§8.2）。 */
+    extensions?: AgentExtension[];
+}
+export interface AgentSkill {
+    id: string;
+    name: string;
+    description?: string;
+    tags?: string[];
+}
+/**
+ * securitySchemes 的单个值（A2A v1.0）。`type` 为 scheme 类型；其余字段按类型
+ * 各异。本模块宽松建模（未知 scheme type 允许），静态 secret 由 secrets.ts 拒绝。
+ */
+export interface AgentSecurityScheme {
+    type: string;
+    [key: string]: unknown;
+}
+/**
+ * security 项：`scheme` 引用 securitySchemes 中的名字；`credential` /
+ * `credentials` 是凭据标识的引用（不是 secret 本身）。A2A 规范禁止在 card 中
+ * 携带真实凭据（不变量 24）。两种拼写都接受以兼容不同 A2A 实现。
+ */
+export interface AgentSecurityRequirement {
+    scheme: string;
+    credential?: string;
+    credentials?: string;
+}
+/**
+ * A2A Agent Card（基线 §26 字段清单）。字段集合允许未来扩展（extendedAgentCard），
+ * 因此结构校验只约束已知字段，未知顶层字段按 forward-compat 保留。
+ */
+export interface AgentCard {
+    name: string;
+    description: string;
+    provider: AgentProvider;
+    version: string;
+    /** 标准 Agent Card 的 canonical URL（可选；连接走 supportedInterfaces）。 */
+    url?: string;
+    documentationUrl?: string;
+    supportedInterfaces: AgentInterface[];
+    securitySchemes?: Record<string, AgentSecurityScheme>;
+    security?: AgentSecurityRequirement[];
+    capabilities?: AgentCapabilities;
+    skills?: AgentSkill[];
+    /** §26 字段清单中的顶层 extensions；capabilities.extensions 是规范位置。 */
+    extensions?: AgentExtension[];
+}

package/dist/discovery/agent-card/types.js

@@ -0,0 +1,37 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A2A Agent Card 领域类型（基线 §26，外部标准 pin §43：A2A v1.0.x）。
+ *
+ * 形状以架构基线 §26 的完整示例为准：`supportedInterfaces` 是数组，每一项至少
+ * 含 `url` + `protocolBinding` + `protocolVersion`。`protocolBinding` 的 core 值
+ * 对齐 A2A 1.0 核心 binding：JSONRPC / GRPC / HTTP+JSON；未来 compliant binding
+ * 使用正式 URI namespace（§26）。本模块不拒绝未知 binding 值，但 capability
+ * intersection 不选择它们（§3.1）。
+ *
+ * 安全不变量 24：Agent Card / public metadata 不得包含静态 secret。结构校验只
+ * 负责字段形状；secret 扫描由 secrets.ts 单独负责（含 merchant cost/floor 等
+ * 私有数据，基线 §4.4）。
+ */
+/** A2A 1.0 核心 protocol binding 集合（基线 §3.1 / §26 / §43）。 */
+export const CORE_PROTOCOL_BINDINGS = ["JSONRPC", "GRPC", "HTTP+JSON"];
+/** Kiwi Negotiation A2A Extension URI 路径（基线 §8.2）。 */
+export const KIWI_NEGOTIATION_EXTENSION_PATH = "/a2a/extensions/negotiation/1.0";
+/** 判断一个 binding 值是否是 A2A 1.0 核心 binding。未知 binding 不拒绝但不选择。 */
+export function isCoreProtocolBinding(value) {
+    return CORE_PROTOCOL_BINDINGS.includes(value);
+}
+//# sourceMappingURL=types.js.map

package/dist/discovery/agent-card/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/discovery/agent-card/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;GAYG;AAEH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAU,CAAC;AAGhF,sDAAsD;AACtD,MAAM,CAAC,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AAEjF,+DAA+D;AAC/D,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAQ,sBAA4C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC"}

package/dist/discovery/agent-card/validate.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A2A Agent Card 运行时校验（基线 §26 / §43）。
+ *
+ * 校验采用 fail-closed（§4.6）：无法证明合法即为非法。已知字段严格校验类型，
+ * 未知顶层字段保留（extendedAgentCard / forward-compat），但未知不自动通过——
+ * 结构校验之外还要过 secret 扫描（secrets.ts）才能被接受为可用 card。
+ */
+import { AgentCardError } from "./error.js";
+import type { AgentCard } from "./types.js";
+/**
+ * 结构校验。校验通过返回规范化后的 AgentCard；失败抛 AgentCardError。
+ * 注意：此函数只做结构校验，secret 扫描由 parseAgentCard 组合执行。
+ */
+export declare function validateAgentCard(value: unknown): AgentCard;
+/** 结构校验错误的便捷断言（供调用方诊断）。 */
+export declare function isAgentCardError(err: unknown): err is AgentCardError;

package/dist/discovery/agent-card/validate.js

@@ -0,0 +1,210 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A2A Agent Card 运行时校验（基线 §26 / §43）。
+ *
+ * 校验采用 fail-closed（§4.6）：无法证明合法即为非法。已知字段严格校验类型，
+ * 未知顶层字段保留（extendedAgentCard / forward-compat），但未知不自动通过——
+ * 结构校验之外还要过 secret 扫描（secrets.ts）才能被接受为可用 card。
+ */
+import { AgentCardError, schemaError } from "./error.js";
+function requireObject(value, path) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw schemaError(path, `${path} must be an object`);
+    }
+    return value;
+}
+function requireArray(value, path) {
+    if (!Array.isArray(value)) {
+        throw schemaError(path, `${path} must be an array`);
+    }
+    return value;
+}
+function requireString(value, path) {
+    if (typeof value !== "string") {
+        throw schemaError(path, `${path} must be a string`);
+    }
+    return value;
+}
+function requireNonEmptyString(value, path) {
+    const s = requireString(value, path);
+    if (s.length === 0) {
+        throw schemaError(path, `${path} must be a non-empty string`);
+    }
+    return s;
+}
+function optionalString(value, path) {
+    return value === undefined ? undefined : requireString(value, path);
+}
+function optionalBoolean(value, path) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "boolean") {
+        throw schemaError(path, `${path} must be a boolean`);
+    }
+    return value;
+}
+/** 端点 URL 的结构校验：可解析且仅 http(s)。SSRF 由 a2a client 连接时执行。 */
+function validateEndpointUrl(value, path) {
+    const url = requireNonEmptyString(value, path);
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw schemaError(path, `${path} must be a valid URL`);
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw schemaError(path, `${path} must use http or https (got ${parsed.protocol})`);
+    }
+    if (parsed.username !== "" || parsed.password !== "") {
+        throw schemaError(path, `${path} must not embed credentials (userinfo)`);
+    }
+    return url;
+}
+function validateInterface(value, path) {
+    const obj = requireObject(value, path);
+    return {
+        url: validateEndpointUrl(obj.url, `${path}/url`),
+        protocolBinding: requireNonEmptyString(obj.protocolBinding, `${path}/protocolBinding`),
+        protocolVersion: requireNonEmptyString(obj.protocolVersion, `${path}/protocolVersion`),
+    };
+}
+function validateProvider(value, path) {
+    const obj = requireObject(value, path);
+    const provider = {
+        organization: requireNonEmptyString(obj.organization, `${path}/organization`),
+    };
+    const url = optionalString(obj.url, `${path}/url`);
+    if (url !== undefined) {
+        provider.url = validateEndpointUrl(url, `${path}/url`);
+    }
+    return provider;
+}
+function validateExtension(value, path) {
+    const obj = requireObject(value, path);
+    return {
+        uri: requireNonEmptyString(obj.uri, `${path}/uri`),
+        required: (() => {
+            if (typeof obj.required !== "boolean") {
+                throw schemaError(`${path}/required`, `${path}/required must be a boolean`);
+            }
+            return obj.required;
+        })(),
+    };
+}
+function validateExtensions(value, path) {
+    return requireArray(value, path).map((item, i) => validateExtension(item, `${path}/${i}`));
+}
+function validateCapabilities(value, path) {
+    const obj = requireObject(value, path);
+    const capabilities = {};
+    for (const key of [
+        "streaming",
+        "pushNotifications",
+        "stateTransitionHistory",
+        "extendedAgentCard",
+    ]) {
+        const v = optionalBoolean(obj[key], `${path}/${key}`);
+        if (v !== undefined)
+            capabilities[key] = v;
+    }
+    if (obj.extensions !== undefined) {
+        capabilities.extensions = validateExtensions(obj.extensions, `${path}/extensions`);
+    }
+    return capabilities;
+}
+function validateSkill(value, path) {
+    const obj = requireObject(value, path);
+    const skill = {
+        id: requireNonEmptyString(obj.id, `${path}/id`),
+        name: requireNonEmptyString(obj.name, `${path}/name`),
+    };
+    const description = optionalString(obj.description, `${path}/description`);
+    if (description !== undefined)
+        skill.description = description;
+    if (obj.tags !== undefined) {
+        skill.tags = requireArray(obj.tags, `${path}/tags`).map((t, i) => requireNonEmptyString(t, `${path}/tags/${i}`));
+    }
+    return skill;
+}
+function validateSecurityScheme(value, path) {
+    const obj = requireObject(value, path);
+    return { ...obj, type: requireNonEmptyString(obj.type, `${path}/type`) };
+}
+function validateSecurityRequirement(value, path) {
+    const obj = requireObject(value, path);
+    const requirement = {
+        scheme: requireNonEmptyString(obj.scheme, `${path}/scheme`),
+    };
+    const credential = optionalString(obj.credential, `${path}/credential`);
+    if (credential !== undefined)
+        requirement.credential = credential;
+    const credentials = optionalString(obj.credentials, `${path}/credentials`);
+    if (credentials !== undefined)
+        requirement.credentials = credentials;
+    return requirement;
+}
+/**
+ * 结构校验。校验通过返回规范化后的 AgentCard；失败抛 AgentCardError。
+ * 注意：此函数只做结构校验，secret 扫描由 parseAgentCard 组合执行。
+ */
+export function validateAgentCard(value) {
+    const obj = requireObject(value, "/");
+    const card = {
+        name: requireNonEmptyString(obj.name, "/name"),
+        description: requireNonEmptyString(obj.description, "/description"),
+        provider: validateProvider(obj.provider, "/provider"),
+        version: requireNonEmptyString(obj.version, "/version"),
+        supportedInterfaces: requireArray(obj.supportedInterfaces, "/supportedInterfaces").map((item, i) => validateInterface(item, `/supportedInterfaces/${i}`)),
+    };
+    if (card.supportedInterfaces.length === 0) {
+        throw schemaError("/supportedInterfaces", "supportedInterfaces must not be empty");
+    }
+    const url = optionalString(obj.url, "/url");
+    if (url !== undefined)
+        card.url = validateEndpointUrl(url, "/url");
+    const documentationUrl = optionalString(obj.documentationUrl, "/documentationUrl");
+    if (documentationUrl !== undefined) {
+        card.documentationUrl = validateEndpointUrl(documentationUrl, "/documentationUrl");
+    }
+    if (obj.securitySchemes !== undefined) {
+        const schemes = requireObject(obj.securitySchemes, "/securitySchemes");
+        const out = {};
+        for (const key of Object.keys(schemes)) {
+            out[key] = validateSecurityScheme(schemes[key], `/securitySchemes/${key}`);
+        }
+        card.securitySchemes = out;
+    }
+    if (obj.security !== undefined) {
+        card.security = requireArray(obj.security, "/security").map((item, i) => validateSecurityRequirement(item, `/security/${i}`));
+    }
+    if (obj.capabilities !== undefined) {
+        card.capabilities = validateCapabilities(obj.capabilities, "/capabilities");
+    }
+    if (obj.skills !== undefined) {
+        card.skills = requireArray(obj.skills, "/skills").map((item, i) => validateSkill(item, `/skills/${i}`));
+    }
+    if (obj.extensions !== undefined) {
+        card.extensions = validateExtensions(obj.extensions, "/extensions");
+    }
+    return card;
+}
+/** 结构校验错误的便捷断言（供调用方诊断）。 */
+export function isAgentCardError(err) {
+    return err instanceof AgentCardError;
+}
+//# sourceMappingURL=validate.js.map

package/dist/discovery/agent-card/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/discovery/agent-card/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAYzD,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACvD,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,gCAAgC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,wCAAwC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAY;IACrD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,GAAG,EAAE,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC;QAChD,eAAe,EAAE,qBAAqB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,IAAI,kBAAkB,CAAC;QACtF,eAAe,EAAE,qBAAqB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,IAAI,kBAAkB,CAAC;KACvF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAkB;QAC9B,YAAY,EAAE,qBAAqB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,CAAC;KAC9E,CAAC;IACF,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;IACnD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,QAAQ,CAAC,GAAG,GAAG,mBAAmB,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAY;IACrD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,GAAG,EAAE,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC;QAClD,QAAQ,EAAE,CAAC,GAAG,EAAE;YACd,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,WAAW,CAAC,GAAG,IAAI,WAAW,EAAE,GAAG,IAAI,6BAA6B,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC,CAAC,EAAE;KACL,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,IAAY;IACtD,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,IAAY;IACxD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,GAAsB,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI;QAChB,WAAW;QACX,mBAAmB;QACnB,wBAAwB;QACxB,mBAAmB;KACX,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,SAAS;YAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjC,YAAY,CAAC,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,KAAK,GAAe;QACxB,EAAE,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC;QAC/C,IAAI,EAAE,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC;KACtD,CAAC;IACF,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IAC3E,IAAI,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,WAAW,GAAG,WAAW,CAAC;IAC/D,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC/D,qBAAqB,CAAC,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,IAAY;IAC1D,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAc,EAAE,IAAY;IAC/D,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,WAAW,GAA6B;QAC5C,MAAM,EAAE,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC;KAC5D,CAAC;IACF,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;IACxE,IAAI,UAAU,KAAK,SAAS;QAAE,WAAW,CAAC,UAAU,GAAG,UAAU,CAAC;IAClE,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IAC3E,IAAI,WAAW,KAAK,SAAS;QAAE,WAAW,CAAC,WAAW,GAAG,WAAW,CAAC;IACrE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAc;QACtB,IAAI,EAAE,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;QAC9C,WAAW,EAAE,qBAAqB,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC;QACnE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC;QACrD,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC;QACvD,mBAAmB,EAAE,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC,GAAG,CACpF,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC,CAClE;KACF,CAAC;IACF,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,WAAW,CAAC,sBAAsB,EAAE,uCAAuC,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IACnF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,mBAAmB,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,GAAG,GAAwC,EAAE,CAAC;QACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,GAAG,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,oBAAoB,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CACtE,2BAA2B,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAChE,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CACpC,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,GAAG,YAAY,cAAc,CAAC;AACvC,CAAC"}