@kodax-ai/kodax 0.7.69 → 0.7.71

package/dist/sdk-a2a.js

@@ -1,9 +1,10 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import"./chunks/chunk-NGJURAY5.js";import"./chunks/chunk-VAZ25MDX.js";import{f as ge,k as me,l as ye}from"./chunks/chunk-M7TCFYTO.js";import"./chunks/chunk-WW2O2DEP.js";import"./chunks/chunk-ZG4DMYBS.js";import"./chunks/chunk-URC6ZI6P.js";import"./chunks/chunk-PA76WUBL.js";import"./chunks/chunk-4WIODYOH.js";import"./chunks/chunk-I4TPQEJN.js";import"./chunks/chunk-Y4WOTWUC.js";import"./chunks/chunk-PQ3XUSY2.js";import"./chunks/chunk-UJEMSPM5.js";import"./chunks/chunk-VYKFM3TB.js";import{b as M}from"./chunks/chunk-AWMTNUDS.js";import"./chunks/chunk-F7C7J6IM.js";import"./chunks/chunk-NGHQIGVW.js";import{a as i}from"./chunks/chunk-ONUPGMER.js";var C="1.0",L="kodax-a2a-v1-jsonrpc";var u=class extends Error{constructor(n,r,s=200,o){super(r);this.code=n;this.httpStatus=s;this.data=o;this.name="A2AError"}code;httpStatus;data;static{i(this,"A2AError")}};function q(t){return t instanceof Error?t.message:String(t)}i(q,"errorMessage");var ze=new Set(["TASK_STATE_UNSPECIFIED","TASK_STATE_SUBMITTED","TASK_STATE_WORKING","TASK_STATE_COMPLETED","TASK_STATE_FAILED","TASK_STATE_CANCELED","TASK_STATE_INPUT_REQUIRED","TASK_STATE_REJECTED","TASK_STATE_AUTH_REQUIRED"]);function A(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}i(A,"isRecord");function w(t,e,n){let r=t[e];if(typeof r!="string"||r.trim().length===0)throw new u(-32602,`${n}.${e} must be a non-empty string.`);return r}i(w,"requiredString");function m(t,e){let n=t[e];return typeof n=="string"&&n.length>0?n:void 0}i(m,"optionalString");function D(t,e){if(!Array.isArray(t)||!t.every(n=>typeof n=="string"))throw new u(-32602,`${e} must be a string array.`);return t}i(D,"stringArray");function We(t){if(!A(t))throw new u(-32602,"Agent Card interface is invalid.");return{url:w(t,"url","interface"),protocolBinding:w(t,"protocolBinding","interface"),protocolVersion:w(t,"protocolVersion","interface"),...m(t,"tenant")?{tenant:m(t,"tenant")}:{}}}i(We,"parseInterface");function Xe(t){if(!A(t))throw new u(-32602,"Agent Card skill is invalid.");return{id:w(t,"id","skill"),name:w(t,"name","skill"),description:w(t,"description","skill"),tags:D(t.tags,"skill.tags"),...Array.isArray(t.examples)?{examples:D(t.examples,"skill.examples")}:{},...Array.isArray(t.inputModes)?{inputModes:D(t.inputModes,"skill.inputModes")}:{},...Array.isArray(t.outputModes)?{outputModes:D(t.outputModes,"skill.outputModes")}:{}}}i(Xe,"parseSkill");function he(t){if(!A(t))throw new u(-32602,"Agent Card must be an object.");let e=t.supportedInterfaces,n=t.skills;if(!Array.isArray(e)||e.length===0)throw new u(-32602,"Agent Card must declare supportedInterfaces.");if(!Array.isArray(n))throw new u(-32602,"Agent Card must declare skills.");if(!A(t.capabilities))throw new u(-32602,"Agent Card capabilities are invalid.");return{name:w(t,"name","Agent Card"),description:w(t,"description","Agent Card"),supportedInterfaces:e.map(We),version:w(t,"version","Agent Card"),capabilities:{...typeof t.capabilities.streaming=="boolean"?{streaming:t.capabilities.streaming}:{},...typeof t.capabilities.pushNotifications=="boolean"?{pushNotifications:t.capabilities.pushNotifications}:{},...typeof t.capabilities.extendedAgentCard=="boolean"?{extendedAgentCard:t.capabilities.extendedAgentCard}:{},...Array.isArray(t.capabilities.extensions)?{extensions:t.capabilities.extensions.filter(A)}:{}},...A(t.securitySchemes)?{securitySchemes:t.securitySchemes}:{},...Array.isArray(t.securityRequirements)?{securityRequirements:t.securityRequirements.filter(A)}:{},defaultInputModes:D(t.defaultInputModes,"Agent Card defaultInputModes"),defaultOutputModes:D(t.defaultOutputModes,"Agent Card defaultOutputModes"),skills:n.map(Xe)}}i(he,"parseA2AAgentCard");function we(t){if(!A(t))throw new u(-32602,"Message Part must be an object.");if(["text","raw","url","data"].filter(n=>t[n]!==void 0).length!==1)throw new u(-32602,"Message Part must contain exactly one content field.");return{...typeof t.text=="string"?{text:t.text}:{},...typeof t.raw=="string"?{raw:t.raw}:{},...typeof t.url=="string"?{url:t.url}:{},...t.data!==void 0?{data:t.data}:{},...A(t.metadata)?{metadata:t.metadata}:{},...m(t,"filename")?{filename:m(t,"filename")}:{},...m(t,"mediaType")?{mediaType:m(t,"mediaType")}:{}}}i(we,"parseA2APart");function v(t){if(!A(t))throw new u(-32602,"Message must be an object.");if(t.role!=="ROLE_USER"&&t.role!=="ROLE_AGENT")throw new u(-32602,"Message role is invalid.");if(!Array.isArray(t.parts)||t.parts.length===0)throw new u(-32602,"Message parts must not be empty.");return{messageId:w(t,"messageId","Message"),role:t.role,parts:t.parts.map(we),...m(t,"contextId")?{contextId:m(t,"contextId")}:{},...m(t,"taskId")?{taskId:m(t,"taskId")}:{},...A(t.metadata)?{metadata:t.metadata}:{}}}i(v,"parseA2AMessage");function Ge(t){if(!A(t)||!Array.isArray(t.parts)||t.parts.length===0)throw new u(-32603,"A2A artifact is invalid.");return{artifactId:w(t,"artifactId","Artifact"),parts:t.parts.map(we),...m(t,"name")?{name:m(t,"name")}:{},...m(t,"description")?{description:m(t,"description")}:{},...A(t.metadata)?{metadata:t.metadata}:{}}}i(Ge,"parseArtifact");function I(t){if(!A(t)||!A(t.status))throw new u(-32603,"A2A task is invalid.");let e=t.status.state;if(typeof e!="string"||!ze.has(e))throw new u(-32603,"A2A task state is invalid.");return{id:w(t,"id","Task"),contextId:w(t,"contextId","Task"),status:{state:e,...t.status.message!==void 0?{message:v(t.status.message)}:{},...m(t.status,"timestamp")?{timestamp:m(t.status,"timestamp")}:{}},...Array.isArray(t.artifacts)?{artifacts:t.artifacts.map(Ge)}:{},...Array.isArray(t.history)?{history:t.history.map(v)}:{},...A(t.metadata)?{metadata:t.metadata}:{}}}i(I,"parseA2ATask");function ke(t){if(!A(t)||t.jsonrpc!=="2.0")throw new u(-32600,"Invalid JSON-RPC request.");if(typeof t.id!="string"&&typeof t.id!="number")throw new u(-32600,"JSON-RPC request id is required.");return{jsonrpc:"2.0",id:t.id,method:w(t,"method","JSON-RPC request"),...A(t.params)?{params:t.params}:{}}}i(ke,"parseJsonRpcRequest");import{lookup as Ve}from"node:dns/promises";import{request as Qe}from"node:http";import{request as Ze}from"node:https";import{isIP as Ye}from"node:net";import{Readable as et}from"node:stream";function tt(t){let e=t.split(".").map(Number),[n,r]=e;return e.length!==4||n===void 0||r===void 0?!0:n===0||n===10||n===127||n===169&&r===254||n===172&&r>=16&&r<=31||n===192&&r===168||n>=224}i(tt,"isPrivateIpv4");function nt(t){let e=t.toLowerCase();return e==="::"||e==="::1"||e.startsWith("fc")||e.startsWith("fd")||e.startsWith("fe8")||e.startsWith("fe9")||e.startsWith("fea")||e.startsWith("feb")||e.startsWith("ff")}i(nt,"isPrivateIpv6");function Te(t){let e=Ye(t);return e===4?tt(t):e===6?nt(t):!0}i(Te,"isPrivateAddress");async function Se(t,e){if(t.protocol!=="https:"&&t.protocol!=="http:")throw new u(-32602,"A2A URL must use HTTP or HTTPS.");if(!e.allowedOrigins.includes(t.origin))throw new u(-32602,`A2A origin is not allowed: ${t.origin}`);if(t.username||t.password)throw new u(-32602,"A2A URL must not include credentials.");let n=await Ve(t.hostname,{all:!0,verbatim:!0});if(n.length===0)throw new u(-32602,"A2A hostname did not resolve.");if(t.protocol==="http:"&&!n.every(s=>Te(s.address)))throw new u(-32602,"Public A2A targets must use HTTPS.");if(!e.allowPrivateAddresses&&n.some(s=>Te(s.address)))throw new u(-32602,"A2A private network targets are not allowed.");let r=n[0];if(r===void 0||r.family!==4&&r.family!==6)throw new u(-32602,"A2A hostname returned an unsupported address.");return{address:r.address,family:r.family}}i(Se,"validateA2AUrl");async function rt(t,e){await Se(t,e)}i(rt,"assertSafeA2AUrl");function st(t){if(t==null||typeof t=="string")return t??void 0;if(t instanceof URLSearchParams)return t.toString();if(t instanceof Uint8Array)return t;if(t instanceof ArrayBuffer)return new Uint8Array(t);if(ArrayBuffer.isView(t))return new Uint8Array(t.buffer,t.byteOffset,t.byteLength);throw new u(-32602,"A2A request body type is not supported by the safe transport.")}i(st,"encodeRequestBody");function ot(t){return((e,n,r)=>{if(typeof n=="object"&&n.all){r(null,[t]);return}r(null,t.address,t.family)})}i(ot,"pinnedLookup");function it(t,e,n){return new Promise((r,s)=>{let o=new Headers(e.headers);o.set("accept-encoding","identity");let a=(t.protocol==="https:"?Ze:Qe)(t,{method:e.method,headers:Object.fromEntries(o),lookup:ot(n),signal:e.signal??void 0},d=>{let c=new Headers;for(let f=0;f<d.rawHeaders.length;f+=2){let E=d.rawHeaders[f],b=d.rawHeaders[f+1];E!==void 0&&b!==void 0&&c.append(E,b)}let l=d.statusCode??500,g=e.method!=="HEAD"&&l!==204&&l!==205&&l!==304?et.toWeb(d):null;r(new Response(g,{status:l,statusText:d.statusMessage,headers:c}))});a.once("error",s),a.end(st(e.body))})}i(it,"requestValidatedAddress");async function oe(t,e,n,r){let s=await Se(t,n);return r!==void 0?r(t,e):it(t,e,s)}i(oe,"openSafeA2AResponse");async function at(t,e){let n=t.headers.get("content-length");if(n&&Number(n)>e)throw new u(-32603,"A2A response is too large.");if(!t.body)return new Uint8Array;let r=t.body.getReader(),s=[],o=0;for(;;){let c=await r.read();if(c.done)break;if(o+=c.value.byteLength,o>e)throw await r.cancel(),new u(-32603,"A2A response is too large.");s.push(c.value)}let a=new Uint8Array(o),d=0;for(let c of s)a.set(c,d),d+=c.byteLength;return a}i(at,"boundedBody");async function W(t,e,n,r){let s=t,o=new Headers(e.headers).get("authorization");for(let a=0;a<=n.maxRedirects;a+=1){let d=new AbortController,c=setTimeout(()=>d.abort(new Error("A2A request timed out.")),n.requestTimeoutMs),l=new Headers(e.headers);o===null?l.delete("authorization"):l.set("authorization",o);try{let p=await oe(s,{...e,headers:l,redirect:"manual",signal:d.signal},n,r);if(p.status<300||p.status>=400)return{response:p,body:await at(p,n.maxResponseBytes),url:s};let g=p.headers.get("location");if(!g||a===n.maxRedirects)throw new u(-32603,"A2A redirect limit exceeded.");let f=new URL(g,s);await p.body?.cancel(),f.origin!==s.origin&&(o=null),s=f}finally{clearTimeout(c)}}throw new u(-32603,"A2A redirect limit exceeded.")}i(W,"safeA2AFetch");function X(t){return new TextDecoder("utf-8",{fatal:!0}).decode(t)}i(X,"decodeUtf8");import{createHash as dt,randomUUID as ie}from"node:crypto";function V(t){return Array.isArray(t)?`[${t.map(V).join(",")}]`:A(t)?`{${Object.keys(t).sort().map(e=>`${JSON.stringify(e)}:${V(t[e])}`).join(",")}}`:JSON.stringify(t)??"null"}i(V,"stableJson");function Re(t){return`sha256:${dt("sha256").update(t).digest("hex")}`}i(Re,"sha256");function N(t){let e=t.executorConfig;if(!A(e))throw new Error("A2A registration executorConfig is missing.");if(typeof e.agentCardUrl!="string"||typeof e.interfaceUrl!="string")throw new Error("A2A registration endpoints are invalid.");return{agentCardUrl:e.agentCardUrl,interfaceUrl:e.interfaceUrl,...typeof e.tenant=="string"?{tenant:e.tenant}:{}}}i(N,"executorConfig");function ct(t){let e=t.supportedInterfaces.find(n=>n.protocolBinding.toUpperCase()==="JSONRPC"&&n.protocolVersion==="1.0");if(!e)throw new Error("Agent Card has no supported A2A 1.0 JSONRPC interface.");return e}i(ct,"chooseInterface");function de(t,e){try{return JSON.parse(t)}catch{throw new Error(`${e} returned invalid JSON.`)}}i(de,"parseJson");async function be(t,e){let n=await W(new URL(t.agentCardUrl),{headers:{accept:"application/json"}},e.networkPolicy,e.fetch);if(!n.response.ok)throw new Error(`Agent Card request failed with HTTP ${n.response.status}.`);if(!n.response.headers.get("content-type")?.toLowerCase().includes("json"))throw new Error("Agent Card response is not JSON.");let r=he(de(X(n.body),"Agent Card")),s=ct(r),o=V({agentCardUrl:n.url.href,interfaceUrl:s.url,protocolBinding:s.protocolBinding,protocolVersion:s.protocolVersion,tenant:s.tenant??""}),a=Re(V(r));return{agentCard:r,registration:{agentId:t.agentId,displayName:r.name,description:r.description,enabled:!0,executorId:L,protocol:"a2a",configurationRevision:a,endpointIdentityHash:Re(o),...t.credentialRef?{credentialRef:t.credentialRef}:{},executorConfig:{agentCardUrl:n.url.href,interfaceUrl:s.url,...s.tenant?{tenant:s.tenant}:{}},skills:r.skills.map(d=>d.id),inputModalities:r.defaultInputModes,outputModalities:r.defaultOutputModes,capabilities:{streaming:r.capabilities.streaming?"supported":"unsupported",durableTasks:"supported",inputRequired:"supported",cancellation:"supported",artifacts:"supported"},effects:{remote:t.effects.remote,workspace:"proposal"},health:{status:"healthy",checkedAt:new Date().toISOString()}}}}i(be,"discoverA2ARegistration");function ce(t){return t.metadata??{}}i(ce,"metadata");function Ee(t){let e=ce(t).directMessage;return e===void 0?void 0:v(e)}i(Ee,"directMessage");function ve(t){return{TASK_STATE_UNSPECIFIED:"unknown",TASK_STATE_SUBMITTED:"submitted",TASK_STATE_WORKING:"working",TASK_STATE_COMPLETED:"completed",TASK_STATE_FAILED:"failed",TASK_STATE_CANCELED:"canceled",TASK_STATE_INPUT_REQUIRED:"input-required",TASK_STATE_REJECTED:"rejected",TASK_STATE_AUTH_REQUIRED:"auth-required"}[t]}i(ve,"taskState");function Q(t){return t.flatMap(e=>e.text===void 0?[]:[e.text]).join(`
-`)}i(Q,"textFromParts");function ut(t){let e=t.parts.find(n=>n.url!==void 0);return{name:t.name??t.artifactId,...t.parts[0]?.mediaType?{mimeType:t.parts[0].mediaType}:{},...e?.url?{uri:e.url}:{},provenance:"a2a"}}i(ut,"artifactReference");function G(t){let e=(t.artifacts??[]).flatMap(s=>Q(s.parts)),n=t.status.message?Q(t.status.message.parts):"",r=[...e,n].filter(Boolean).join(`
-`);return{state:ve(t.status.state),...r?{output:r}:{},...t.status.state==="TASK_STATE_FAILED"?{error:n||"Remote A2A task failed."}:{},...t.artifacts?.length?{artifacts:t.artifacts.map(ut)}:{}}}i(G,"snapshotFromTask");function ae(t){return{state:"completed",output:Q(t.parts)}}i(ae,"snapshotFromMessage");function xe(t){return t==="completed"||t==="failed"||t==="canceled"||t==="rejected"}i(xe,"isTerminal");var ue=class{constructor(e,n,r){this.registration=e;this.context=n;this.options=r}registration;context;options;static{i(this,"A2AClientExecutor")}#e=!1;#t=new Set;async preflight(){try{return N(this.registration),{ok:!0}}catch(e){return{ok:!1,reasons:[e instanceof Error?e.message:String(e)]}}}async start(e){let n=e.idempotencyKey;if(!n)throw new Error("A2A executor requires an idempotency key.");let r=await this.sendMessage({message:{messageId:n,role:"ROLE_USER",parts:[{text:e.input??e.objective,mediaType:"text/plain"}]},configuration:{returnImmediately:!0}});if(A(r.task)){let s=I(r.task);return{idempotencyKey:n,remoteTaskId:s.id,metadata:{contextId:s.contextId}}}if(r.message!==void 0)return{idempotencyKey:n,metadata:{directMessage:v(r.message)}};throw new Error("A2A SendMessage returned neither task nor message.")}async*events(e){let n=Ee(e);if(n){yield ae(n);return}if(this.registration.capabilities.streaming==="supported"&&!this.registration.credentialRef)try{yield*this.streamEvents(e);return}catch(r){if(this.#e)return;M({source:"a2a.client",level:"warn",message:"A2A event stream failed; polling fallback started.",detail:r}),yield{progress:{message:"A2A stream unavailable; polling."}}}for(;!this.#e;){let r=await this.get(e);if(yield r,xe(r.state)||r.state==="input-required"||r.state==="auth-required")return;await new Promise(s=>setTimeout(s,this.options.pollIntervalMs))}}async get(e){let n=Ee(e);if(n)return ae(n);if(!e.remoteTaskId)throw new Error("A2A task reference has no remote task ID.");return G(I(await this.rpc("GetTask",this.taskParams(e))))}async sendInput(e,n){if(!e.remoteTaskId)throw new Error("Direct A2A responses cannot accept input.");await this.sendMessage({message:{messageId:ie(),taskId:e.remoteTaskId,...typeof ce(e).contextId=="string"?{contextId:ce(e).contextId}:{},role:"ROLE_USER",parts:[{text:n.content,mediaType:"text/plain"}]},configuration:{returnImmediately:!0}})}async cancel(e){return e.remoteTaskId?G(I(await this.rpc("CancelTask",this.taskParams(e)))):this.get(e)}async reconcile(e){return this.get(e)}async dispose(){this.#e=!0;for(let e of this.#t)e.abort(new Error("A2A executor disposed."))}async*streamEvents(e){if(!e.remoteTaskId)throw new Error("A2A stream requires a remote task ID.");let n=N(this.registration),r=new URL(n.interfaceUrl),s=new Headers({accept:"text/event-stream","a2a-version":"1.0","content-type":"application/json"});this.options.authorization&&s.set("authorization",this.options.authorization);let o=new AbortController;this.#t.add(o);let a,d=i(()=>{a!==void 0&&clearTimeout(a),a=void 0},"disarmTimeout"),c=i(l=>{d(),a=setTimeout(()=>o.abort(new Error(l)),this.options.networkPolicy.requestTimeoutMs),a.unref?.()},"armTimeout");try{c("A2A stream connection timed out.");let l=await oe(r,{method:"POST",headers:s,redirect:"manual",signal:o.signal,body:JSON.stringify({jsonrpc:"2.0",id:ie(),method:"SubscribeToTask",params:this.taskParams(e)})},this.options.networkPolicy,this.options.fetch);if(d(),!l.ok||!l.body)throw new Error(`A2A stream failed with HTTP ${l.status}.`);if(!l.headers.get("content-type")?.toLowerCase().startsWith("text/event-stream"))throw new Error("A2A stream returned an invalid content type.");let p=l.body.getReader(),g=new TextDecoder,f="",E=0;for(;!this.#e;){c("A2A stream was idle for too long.");let b=await p.read();if(d(),b.done)break;if(E+=b.value.byteLength,E>this.options.networkPolicy.maxResponseBytes)throw new Error("A2A stream exceeded the response size limit.");f+=g.decode(b.value,{stream:!0});let J=f.split(/\r?\n\r?\n/);f=J.pop()??"";for(let z of J){let re=z.split(/\r?\n/).filter(se=>se.startsWith("data:")).map(se=>se.slice(5).trimStart()).join(`
-`);if(!re)continue;let x=this.snapshotFromStreamPayload(de(re,"A2A stream"));if(x&&(yield x,x.state&&(xe(x.state)||x.state==="input-required"||x.state==="auth-required")))return}}}finally{d(),this.#t.delete(o)}}snapshotFromStreamPayload(e){if(!A(e))throw new Error("A2A stream frame is invalid.");if(e.error!==void 0){let n=A(e.error)?e.error:{};throw new u(typeof n.code=="number"?n.code:-32603,typeof n.message=="string"?n.message:"A2A stream error.")}if(A(e.result)){if(e.result.task!==void 0)return G(I(e.result.task));if(e.result.message!==void 0)return ae(v(e.result.message));if(A(e.result.statusUpdate)&&A(e.result.statusUpdate.status)){let n=e.result.statusUpdate.status.state;if(typeof n!="string")throw new Error("A2A status update has no state.");let r=e.result.statusUpdate.status.message,s=r===void 0?"":Q(v(r).parts);return{state:ve(n),...s?{output:s}:{}}}if(A(e.result.artifactUpdate)&&e.result.artifactUpdate.artifact!==void 0){let n=I({id:"stream-artifact",contextId:"stream-artifact",status:{state:"TASK_STATE_WORKING"},artifacts:[e.result.artifactUpdate.artifact]});return G(n)}}}taskParams(e){let n=N(this.registration);return{id:e.remoteTaskId,...n.tenant?{tenant:n.tenant}:{}}}async sendMessage(e){let n=await this.rpc("SendMessage",{...e,...N(this.registration).tenant?{tenant:N(this.registration).tenant}:{}});if(!A(n))throw new Error("A2A SendMessage result is invalid.");return n}async rpc(e,n){if(this.#e)throw new Error("A2A executor is disposed.");let r=i(s=>this.rpcWithAuthorization(e,n,s),"run");return this.registration.credentialRef?this.context.withCredential(this.registration.credentialRef,s=>r(`Bearer ${s}`)):r(this.options.authorization)}async rpcWithAuthorization(e,n,r){let s=N(this.registration),o=new Headers({accept:"application/json","a2a-version":"1.0","content-type":"application/json"});r&&o.set("authorization",r);let a=await W(new URL(s.interfaceUrl),{method:"POST",headers:o,body:JSON.stringify({jsonrpc:"2.0",id:ie(),method:e,params:n})},this.options.networkPolicy,this.options.fetch);if(!a.response.headers.get("content-type")?.toLowerCase().includes("json"))throw new Error("A2A JSON-RPC response has an invalid content type.");let d=de(X(a.body),"A2A endpoint");if(!A(d))throw new Error("A2A JSON-RPC response is invalid.");let c=d;if(c.error)throw new u(c.error.code,c.error.message,a.response.status);if(!a.response.ok)throw new Error(`A2A request failed with HTTP ${a.response.status}.`);return c.result}};function Ie(t){return{executorId:L,protocol:"a2a",async create(e,n){let r=typeof t=="function"?t(e):t;return new ue(e,n,r)}}}i(Ie,"createA2AAgentExecutorFactory");import{createHash as At,randomUUID as K}from"node:crypto";import j from"node:fs";import{createServer as pt}from"node:http";import U from"node:path";import{Readable as Pe}from"node:stream";import k from"node:fs";import le from"node:path";function _(t){return structuredClone(t)}i(_,"clone");function lt(t){if(!A(t))throw new Error("A2A task store record must be an object.");for(let e of["taskId","contextId","principalKey","runtimeIdentity","sessionId","createdAt","updatedAt"])if(typeof t[e]!="string")throw new Error(`A2A task store record has invalid ${e}.`);if(!A(t.messageDigests)||!Object.values(t.messageDigests).every(e=>typeof e=="string"))throw new Error("A2A task store message digests are invalid.");if(!Array.isArray(t.runIds)||!t.runIds.every(e=>typeof e=="string"))throw new Error("A2A task store run IDs are invalid.");if(!Array.isArray(t.history))throw new Error("A2A task store history is invalid.");if(!Number.isSafeInteger(t.eventSeq)||!Number.isSafeInteger(t.lastRuntimeEventSeq))throw new Error("A2A task store event cursors are invalid.");return{taskId:t.taskId,contextId:t.contextId,principalKey:t.principalKey,runtimeIdentity:t.runtimeIdentity,sessionId:t.sessionId,...typeof t.workspaceRoot=="string"?{workspaceRoot:t.workspaceRoot}:{},...typeof t.executionPolicyRevision=="string"?{executionPolicyRevision:t.executionPolicyRevision}:{},messageDigests:t.messageDigests,runIds:t.runIds,task:I(t.task),history:t.history,createdAt:t.createdAt,updatedAt:t.updatedAt,eventSeq:t.eventSeq,lastRuntimeEventSeq:t.lastRuntimeEventSeq,runtimeEventCount:Number.isSafeInteger(t.runtimeEventCount)?t.runtimeEventCount:0,runtimeEventBytes:Number.isSafeInteger(t.runtimeEventBytes)?t.runtimeEventBytes:0}}i(lt,"parseRecord");var Z=class{static{i(this,"A2AFileTaskStore")}#e=new Map;#t=new Map;#n;#r;#s;constructor(e){let n=le.resolve(e);k.mkdirSync(n,{recursive:!0,mode:448}),this.#n=le.join(n,"tasks.json"),this.#r=le.join(n,".server.lock"),this.#s=this.acquireLock();try{this.load()}catch(r){throw k.closeSync(this.#s),k.rmSync(this.#r,{force:!0}),r}}get(e){let n=this.#e.get(e);return n?_(n):void 0}findByMessage(e,n){for(let r of this.#e.values())if(r.principalKey===e&&r.messageDigests[n]!==void 0)return _(r)}list(e){return[...this.#e.values()].filter(n=>n.principalKey===e).sort((n,r)=>r.updatedAt.localeCompare(n.updatedAt)).map(_)}all(){return[...this.#e.values()].map(_)}save(e){let n=_(e);this.#e.set(e.taskId,n),this.persist();for(let r of this.#t.get(e.taskId)??[])r(_(n));return _(n)}subscribe(e,n){let r=this.#t.get(e)??new Set;return r.add(n),this.#t.set(e,r),()=>{r.delete(n),r.size===0&&this.#t.delete(e)}}close(){this.persist(),this.#t.clear(),k.closeSync(this.#s),k.rmSync(this.#r,{force:!0})}acquireLock(){let e=i(()=>{let n=k.openSync(this.#r,"wx",384);return k.writeFileSync(n,`${process.pid}
-`,"utf8"),k.fsyncSync(n),n},"attempt");try{return e()}catch(n){let r=!1;try{let s=Number.parseInt(k.readFileSync(this.#r,"utf8").trim(),10);if(Number.isSafeInteger(s)&&s>0)try{process.kill(s,0)}catch{r=!0}}catch{r=!1}if(!r)throw new Error("A2A task store is already owned by another server.",{cause:n});return k.rmSync(this.#r,{force:!0}),e()}}load(){if(!k.existsSync(this.#n))return;let e;try{e=JSON.parse(k.readFileSync(this.#n,"utf8"))}catch(n){throw new Error(`Failed to read A2A task store: ${n instanceof Error?n.message:String(n)}`)}if(!Array.isArray(e))throw new Error("A2A task store root must be an array.");for(let n of e){let r=lt(n);this.#e.set(r.taskId,r)}}persist(){let e=`${this.#n}.${process.pid}.tmp`;k.writeFileSync(e,`${JSON.stringify([...this.#e.values()],null,2)}
-`,{encoding:"utf8",mode:384}),k.renameSync(e,this.#n)}};var R=new Set(["TASK_STATE_COMPLETED","TASK_STATE_FAILED","TASK_STATE_CANCELED","TASK_STATE_REJECTED"]),ft=new Set(["CreateTaskPushNotificationConfig","GetTaskPushNotificationConfig","ListTaskPushNotificationConfigs","DeleteTaskPushNotificationConfig"]);function y(t){return t().toISOString()}i(y,"nowIso");function P(t){return At("sha256").update(t).digest("hex")}i(P,"sha256");function O(t){return P(`${t.subject}\0${t.tenant??""}`)}i(O,"principalKey");function Oe(t){let e=t.toLowerCase().replace(/^\[|\]$/g,"");return e==="localhost"||e==="127.0.0.1"||e==="::1"}i(Oe,"isLoopbackHostname");function gt(t){let e=new URL(t);if(e.protocol!=="https:"&&!(e.protocol==="http:"&&Oe(e.hostname)))throw new Error("Published A2A base URL must use HTTPS, except on loopback.");if(e.username||e.password)throw new Error("Published A2A base URL must not contain credentials.");return e}i(gt,"validateBaseUrl");function mt(t){let n={SendMessage:"send-message",SendStreamingMessage:"send-streaming-message",GetTask:"get-task",ListTasks:"list-tasks",CancelTask:"cancel-task",SubscribeToTask:"subscribe-to-task",GetExtendedAgentCard:"get-extended-agent-card"}[t];if(!n)throw new u(-32601,"Method not found.");return n}i(mt,"operationForMethod");function yt(t){return{queued:"TASK_STATE_SUBMITTED",running:"TASK_STATE_WORKING",waiting_permission:"TASK_STATE_WORKING",waiting_user_input:"TASK_STATE_INPUT_REQUIRED",completed:"TASK_STATE_COMPLETED",failed:"TASK_STATE_FAILED",cancelled:"TASK_STATE_CANCELED",interrupted:"TASK_STATE_FAILED"}[t]}i(yt,"statusState");function Ce(t,e,n){return{messageId:K(),taskId:t,contextId:e,role:"ROLE_AGENT",parts:[{text:n,mediaType:"text/plain"}]}}i(Ce,"agentMessage");function Ae(t,e=t.agent.publicBaseUrl){let n=new URL("/",gt(e)).href;return{name:t.agent.name,description:t.agent.description,supportedInterfaces:[{url:n,protocolBinding:"JSONRPC",protocolVersion:"1.0"}],version:t.agent.version,capabilities:{streaming:!0,pushNotifications:!1,extendedAgentCard:t.extendedAgentCard!==void 0},securitySchemes:t.authentication.securitySchemes,securityRequirements:t.authentication.securityRequirements,defaultInputModes:t.agent.inputModes,defaultOutputModes:t.agent.outputModes,skills:t.agent.skills}}i(Ae,"buildCard");function $(t,e=200,n){return new Response(JSON.stringify(t),{status:e,headers:{"content-type":"application/json; charset=utf-8",...n}})}i($,"jsonResponse");async function ht(t,e){let n=Number(t.headers.get("content-length"));if(Number.isFinite(n)&&n>e)throw new u(-32600,"A2A request exceeds the configured limit.",413);if(!t.body)return new Uint8Array;let r=[],s=0,o=t.body.getReader();for(;;){let c=await o.read();if(c.done)break;if(s+=c.value.byteLength,s>e)throw await o.cancel("A2A request size limit exceeded."),new u(-32600,"A2A request exceeds the configured limit.",413);r.push(c.value)}let a=new Uint8Array(s),d=0;for(let c of r)a.set(c,d),d+=c.byteLength;return a}i(ht,"readBoundedBody");function B(t,e){return $({jsonrpc:"2.0",id:t,result:e})}i(B,"rpcResult");function wt(t,e){let r={[-32001]:"TASK_NOT_FOUND",[-32002]:"TASK_NOT_CANCELABLE",[-32003]:"PUSH_NOTIFICATION_NOT_SUPPORTED",[-32004]:"UNSUPPORTED_OPERATION",[-32005]:"CONTENT_TYPE_NOT_SUPPORTED",[-32006]:"INVALID_AGENT_RESPONSE",[-32007]:"EXTENDED_AGENT_CARD_NOT_CONFIGURED",[-32008]:"EXTENSION_SUPPORT_REQUIRED",[-32009]:"VERSION_NOT_SUPPORTED"}[e.code],s=e.data??(r?[{"@type":"type.googleapis.com/google.rpc.ErrorInfo",reason:r,domain:"kodax.ai"}]:void 0);return $({jsonrpc:"2.0",id:t,error:{code:e.code,message:e.message,...s!==void 0?{data:s}:{}}},e.httpStatus)}i(wt,"rpcError");function _e(t){return P(JSON.stringify(t))}i(_e,"messageDigest");function kt(t){return t.text!==void 0?Buffer.byteLength(t.text):t.raw!==void 0?Buffer.byteLength(t.raw,"base64"):t.url!==void 0?Buffer.byteLength(t.url):Buffer.byteLength(JSON.stringify(t.data))}i(kt,"partBytes");function Ue(t){if(!j.existsSync(t))return 0;let e=0;for(let n of j.readdirSync(t,{withFileTypes:!0})){let r=U.join(t,n.name);n.isSymbolicLink()||(n.isDirectory()?e+=Ue(r):n.isFile()&&(e+=j.statSync(r).size))}return e}i(Ue,"directoryBytes");function Tt(t,e,n){if(t.role!=="ROLE_USER")throw new u(-32602,"Inbound message role must be ROLE_USER.");for(let r of t.parts){if(kt(r)>e)throw new u(-32602,"Message Part exceeds the configured limit.");if(r.url!==void 0)throw new u(-32602,"Remote file URLs are not accepted by this server.");if(r.raw!==void 0&&!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(r.raw))throw new u(-32602,"Message Part raw content is not valid base64.");let s=r.mediaType??(r.text!==void 0?"text/plain":r.data!==void 0?"application/json":"application/octet-stream");if(!n.includes(s))throw new u(-32005,`Media type ${s} is not supported.`)}}i(Tt,"validateInput");function St(t,e,n){if(n===0){let{history:s,...o}=t;return o}let r=n===void 0?e:e.slice(-n);return{...t,history:r}}i(St,"withHistory");var Y=class{constructor(e){this.options=e;this.#t=e.now??(()=>new Date),this.#e=new Z(e.dataDir),this.#i=Ae(e),this.#d=this.recover()}options;static{i(this,"KodaXA2AServerRuntime")}#e;#t;#n=new Map;#r=new Set;#s=new Map;#d;#a;#o=!1;#i;#c;get agentCard(){return structuredClone(this.#i)}async whenReady(){await this.#d}updateHot(e){if(this.#o)throw new Error("A2A server is closed.");this.options={...this.options,...e},this.#i=Ae(this.options,e.agent.publicBaseUrl)}async handle(e){if(await this.#d,this.#o)return $({error:"A2A server is closed."},503);let n=new URL(e.url);if(e.method==="GET"&&n.pathname==="/.well-known/agent-card.json"){let r=JSON.stringify(this.#i);return $(this.#i,200,{etag:`"${P(r)}"`,"cache-control":"public, max-age=300"})}return e.method!=="POST"||n.pathname!=="/"&&n.pathname!=="/a2a"?$({error:"Not found."},404):this.handleRpc(e)}async listen(e){if(this.#a)throw new Error("A2A server is already listening.");if(!Oe(e.hostname))throw new Error("The built-in A2A HTTP listener is loopback-only; use handle() behind TLS for public service.");let n=pt((o,a)=>{this.handleNodeRequest(o).then(d=>{if(a.statusCode=d.status,d.headers.forEach((c,l)=>a.setHeader(l,c)),!d.body){a.end();return}Pe.fromWeb(d.body).pipe(a)}).catch(d=>{let c=P(q(d)).slice(0,16);this.emit({type:"server.request_failed",time:y(this.#t),outcome:"failed",diagnosticId:c}),a.statusCode=500,a.setHeader("content-type","application/json; charset=utf-8"),a.end(JSON.stringify({error:"Internal server error.",diagnosticId:c}))})});this.#a=n,await new Promise((o,a)=>{n.once("error",a),n.listen(e.port,e.hostname,o)});let r=n.address();if(!r||typeof r=="string")throw new Error("A2A server did not expose a TCP address.");let s=`http://${e.hostname}:${r.port}`;return this.#c=e.publicBaseUrl??s,this.#i=Ae(this.options,this.#c),s}async close(){if(this.#o)return;this.#o=!0;for(let n of this.#r)n();this.#r.clear();for(let n of this.#n.values())n.close();this.#n.clear(),this.#e.close();let e=this.#a;this.#a=void 0,e&&await new Promise((n,r)=>e.close(s=>s?r(s):n())),await this.options.preparedExecution?.close()}async handleNodeRequest(e){let r=`http://${e.headers.host??"127.0.0.1"}${e.url??"/"}`,s=new Headers;for(let[a,d]of Object.entries(e.headers))if(typeof d=="string")s.set(a,d);else for(let c of d??[])s.append(a,c);let o={method:e.method,headers:s,...e.method==="GET"||e.method==="HEAD"?{}:{body:Pe.toWeb(e)},duplex:"half"};return this.handle(new Request(r,o))}async handleRpc(e){let n=this.options,r=null;try{let s=e.headers.get("a2a-version");if(s&&s!=="1.0")throw new u(-32009,"A2A version is not supported.");if(!e.headers.get("content-type")?.toLowerCase().includes("application/json"))throw new u(-32600,"A2A JSON-RPC requests require application/json.",415);let o=await ht(e,n.limits.maxRequestBytes),a;try{a=JSON.parse(new TextDecoder().decode(o))}catch{throw new u(-32700,"Invalid JSON payload.")}let d=ke(a);r=d.id;let c=await n.authentication.authenticate(e);if(!c)throw new u(-32600,"Authentication required.",401);if(ft.has(d.method))throw new u(-32003,"Push notifications are not supported.");let l=mt(d.method),p=typeof d.params?.id=="string"?d.params.id:A(d.params?.message)&&typeof d.params.message.taskId=="string"?d.params.message.taskId:void 0;if(!await n.authorize({principal:c,operation:l,...p?{taskId:p}:{}}))throw new u(-32001,"Task not found.");return await this.dispatch(d,c,n)}catch(s){let o=P(q(s)).slice(0,16),a=s instanceof u?s:new u(-32603,"Internal error.",500,[{"@type":"type.googleapis.com/google.rpc.ErrorInfo",reason:"INTERNAL",domain:"kodax.ai",metadata:{diagnosticId:o}}]);return this.emit({type:"rpc.failed",time:y(this.#t),outcome:"failed",diagnosticId:o}),wt(r,a)}}async dispatch(e,n,r){switch(e.method){case"SendMessage":return B(e.id,{task:await this.sendMessage(e.params,n,!1,r)});case"SendStreamingMessage":{let s=await this.sendMessage(e.params,n,!0,r);return this.streamTask(e.id,s.id,O(n))}case"GetTask":return B(e.id,await this.getTask(e.params,n));case"ListTasks":return B(e.id,this.listTasks(e.params,n));case"CancelTask":return B(e.id,await this.cancelTask(e.params,n,r));case"SubscribeToTask":return this.subscribeTask(e.id,e.params,n);case"GetExtendedAgentCard":{if(!r.extendedAgentCard)throw new u(-32007,"Extended Agent Card is not configured.");return B(e.id,r.extendedAgentCard)}default:throw new u(-32601,"Method not found.")}}async sendMessage(e,n,r,s){let o=O(n),a=this.#s.get(o)??Promise.resolve(),d=i(()=>{},"release"),c=new Promise(l=>{d=l});this.#s.set(o,c),await a;try{return await this.sendMessageUnserialized(e,n,r,s)}finally{d(),this.#s.get(o)===c&&this.#s.delete(o)}}async sendMessageUnserialized(e,n,r,s){let o=v(e?.message);Tt(o,s.limits.maxPartBytes,s.agent.inputModes);let a=O(n),d=_e(o),c=this.#e.findByMessage(a,o.messageId);if(c){if(c.messageDigests[o.messageId]!==d)throw new u(-32602,"Message ID was reused with different content.");return this.emit({type:"task.deduplicated",time:y(this.#t),taskId:c.taskId,contextId:c.contextId}),c.task}let l=o.taskId?this.requireOwnedTask(o.taskId,a):void 0;if(l&&o.contextId!==void 0&&o.contextId!==l.contextId)throw new u(-32602,"Message contextId does not match the task.");if(l&&l.task.status.state!=="TASK_STATE_INPUT_REQUIRED"&&l.task.status.state!=="TASK_STATE_AUTH_REQUIRED")throw new u(-32004,"Task is not waiting for input.");let p=this.#e.list(a),g=s.limits.maxRetainedTasksPerPrincipal??s.limits.maxTasksPerPrincipal??100;if(!l&&p.length>=g)throw new u(-32004,"Principal task limit reached.");let f=p.filter(x=>!R.has(x.task.status.state)).length;if(!l&&f>=(s.limits.maxActiveTasksPerPrincipal??4))throw new u(-32004,"Principal active task limit reached.");let E=this.#e.all().filter(x=>!R.has(x.task.status.state)).length;if(!l&&E>=s.limits.maxConcurrentTasks)throw new u(-32004,"Server task concurrency limit reached.");let b=l??await this.createRecord(o,a,s),J=l?this.appendMessage(b,o,d):b,z=await this.startRun(J,o,s);return r||A(e?.configuration)&&e.configuration.returnImmediately===!0?z.task:(await this.waitForTask(z.taskId,s.limits.maxTaskWaitMs??3e4)).task}async createRecord(e,n,r){let s=e.contextId??K(),o=this.#e.list(n).find(g=>g.contextId===s),a=P(`${n}\0${s}`),d=o?.workspaceRoot??await r.preparedExecution?.prepareWorkspace(a),c=o?{id:o.sessionId}:await r.runtime.sessions.create({title:`A2A: ${r.agent.name}`,surface:"a2a",...r.execution?.profileId||r.agent.profileId?{profileId:r.execution?.profileId??r.agent.profileId}:{},...d?{projectPath:d,gitRoot:d}:r.agent.projectPath?{projectPath:r.agent.projectPath}:{}}),l=K(),p=y(this.#t);return this.#e.save({taskId:l,contextId:s,principalKey:n,runtimeIdentity:r.runtime.identity.runtimeId,sessionId:c.id,...d?{workspaceRoot:d}:{},...r.preparedExecution?{executionPolicyRevision:r.preparedExecution.binding.executionPolicyRevision}:{},messageDigests:{[e.messageId]:_e(e)},runIds:[],task:{id:l,contextId:s,status:{state:"TASK_STATE_SUBMITTED",timestamp:p},history:[{...e,taskId:l,contextId:s}]},history:[{...e,taskId:l,contextId:s}],createdAt:p,updatedAt:p,eventSeq:1,lastRuntimeEventSeq:0,runtimeEventCount:0,runtimeEventBytes:0})}appendMessage(e,n,r){let s={...n,taskId:e.taskId,contextId:e.contextId};return this.#e.save({...e,messageDigests:{...e.messageDigests,[n.messageId]:r},history:[...e.history,s],task:{...e.task,history:[...e.history,s]},updatedAt:y(this.#t),eventSeq:e.eventSeq+1})}async startRun(e,n,r){let s=await this.inputsForMessage(e.taskId,n,r),o=r.preparedExecution;if(o&&e.executionPolicyRevision!==o.binding.executionPolicyRevision)throw new u(-32004,"A2A task execution binding revision changed.");let a=o?await o.start({sessionId:e.sessionId,inputs:s,principalKey:e.principalKey}):await r.runtime.runs.start({sessionId:e.sessionId,input:s,mode:"managed_task",permissionBroker:"runtime",...r.agent.runOptions?{options:r.agent.runOptions}:{},agentContext:{actorId:`a2a:${e.principalKey.slice(0,16)}`}}),d=this.#e.save({...e,runIds:[...e.runIds,a.runId],task:{...e.task,status:{state:"TASK_STATE_WORKING",timestamp:y(this.#t)}},updatedAt:y(this.#t),eventSeq:e.eventSeq+1});return this.subscribeRuntime(d,a.runId,r),a.result.then(c=>this.finishRun(d.taskId,c)).catch(c=>{this.failTask(d.taskId,q(c))}),this.emit({type:"task.started",time:y(this.#t),taskId:d.taskId,contextId:d.contextId,runId:a.runId,outcome:"accepted"}),d}async inputsForMessage(e,n,r){let s=[];for(let o of n.parts){if(o.text!==void 0){s.push({type:"text",text:o.text});continue}s.push(await this.materializePart(e,o,r))}return s}async materializePart(e,n,r){let s=n.mediaType??(n.data!==void 0?"application/json":"application/octet-stream"),o=n.data!==void 0?".json":".bin",a=this.#e.get(e),d=a?.workspaceRoot?U.join(a.workspaceRoot,"inbox",P(e)):U.join(U.resolve(r.dataDir),"attachments",P(e));j.mkdirSync(d,{recursive:!0,mode:448});let c=n.data!==void 0?Buffer.from(JSON.stringify(n.data),"utf8"):Buffer.from(n.raw??"","base64"),l=r.limits.maxWorkspaceBytesPerContext??1073741824;if(a?.workspaceRoot&&Ue(a.workspaceRoot)+c.byteLength>l)throw new u(-32004,"A2A context workspace size limit reached.");let p=n.filename?U.basename(n.filename).replace(/[^A-Za-z0-9._-]/g,"_"):`${K()}${o}`,g=U.join(d,`${K()}-${p}`);j.writeFileSync(g,c,{mode:384});let f=s.startsWith("image/")?"image":s.startsWith("video/")?"video":"file";return{type:"artifact_ref",artifactId:(await r.runtime.artifacts.create({kind:f,path:g,mediaType:s,mimeType:s,...n.filename?{name:U.basename(n.filename)}:{},source:"user-inline",description:"Inbound A2A message part"})).id,description:"Inbound A2A attachment"}}subscribeRuntime(e,n,r){this.#n.get(e.taskId)?.close();let s=r.runtime.events.subscribe({runId:n},o=>this.onRuntimeEvent(e.taskId,o,r));this.#n.set(e.taskId,s)}onRuntimeEvent(e,n,r){let s=this.#e.get(e);if(!s||R.has(s.task.status.state))return;let o=Buffer.byteLength(JSON.stringify(n)),a=s.runtimeEventCount+1,d=s.runtimeEventBytes+o;if(a>(r.limits.maxEventsPerTask??1e3)||d>(r.limits.maxEventBytesPerTask??16777216)){let l=s.runIds.at(-1);l&&r.runtime.runs.abort(l),this.failTask(e,"A2A task event quota exceeded.");return}let c=n.type==="user_input.requested"?"TASK_STATE_INPUT_REQUIRED":s.task.status.state;this.#e.save({...s,task:{...s.task,status:{...s.task.status,state:c,timestamp:n.time}},updatedAt:n.time,eventSeq:s.eventSeq+1,lastRuntimeEventSeq:Math.max(s.lastRuntimeEventSeq,n.seq),runtimeEventCount:a,runtimeEventBytes:d})}finishRun(e,n){if(this.#o)return;let r=this.#e.get(e);if(!r||R.has(r.task.status.state))return;let s=yt(n.phase),o=n.result?.lastText??n.error?.message??"",a=o?Ce(e,r.contextId,o):void 0,d=a?[...r.history,a]:r.history,c=o?[{artifactId:`final-${e}`,name:"final-output",parts:[{text:o,mediaType:"text/plain"}]}]:void 0;this.#e.save({...r,history:d,task:{...r.task,status:{state:s,...a?{message:a}:{},timestamp:y(this.#t)},...c?{artifacts:c}:{},history:d},updatedAt:y(this.#t),eventSeq:r.eventSeq+1}),this.#n.get(e)?.close(),this.#n.delete(e),this.emit({type:"task.finished",time:y(this.#t),taskId:e,contextId:r.contextId,outcome:s==="TASK_STATE_COMPLETED"?"completed":"failed"})}failTask(e,n){if(this.#o)return;let r=this.#e.get(e);if(!r||R.has(r.task.status.state))return;let s=Ce(e,r.contextId,n);this.#e.save({...r,task:{...r.task,status:{state:"TASK_STATE_FAILED",message:s,timestamp:y(this.#t)}},updatedAt:y(this.#t),eventSeq:r.eventSeq+1})}async getTask(e,n){let r=typeof e?.id=="string"?e.id:"",s=this.requireOwnedTask(r,O(n)),o=typeof e?.historyLength=="number"?e.historyLength:void 0;return St(s.task,s.history,o)}listTasks(e,n){let r=this.#e.list(O(n)).filter(c=>!(typeof e?.contextId=="string"&&c.contextId!==e.contextId||typeof e?.status=="string"&&c.task.status.state!==e.status)),s=typeof e?.pageSize=="number"?Math.max(1,Math.min(100,Math.floor(e.pageSize))):50,o=typeof e?.pageToken=="string"&&e.pageToken?Number(Buffer.from(e.pageToken,"base64url").toString("utf8")):0;if(!Number.isSafeInteger(o)||o<0)throw new u(-32602,"Invalid page token.");let a=r.slice(o,o+s),d=o+a.length;return{tasks:a.map(c=>e?.includeArtifacts===!0?c.task:{...c.task,artifacts:void 0}),nextPageToken:d<r.length?Buffer.from(String(d)).toString("base64url"):"",pageSize:s,totalSize:r.length}}async cancelTask(e,n,r){let s=typeof e?.id=="string"?e.id:"",o=this.requireOwnedTask(s,O(n));if(R.has(o.task.status.state))throw new u(-32002,"Task is not cancelable.");let a=o.runIds.at(-1);return a&&await r.runtime.runs.abort(a),this.#e.save({...o,task:{...o.task,status:{state:"TASK_STATE_CANCELED",timestamp:y(this.#t)}},updatedAt:y(this.#t),eventSeq:o.eventSeq+1}).task}subscribeTask(e,n,r){let s=typeof n?.id=="string"?n.id:"",o=this.requireOwnedTask(s,O(r));if(R.has(o.task.status.state))throw new u(-32004,"Cannot subscribe to a terminal task.");return this.streamTask(e,s,o.principalKey)}streamTask(e,n,r){let s=this.requireOwnedTask(n,r),o=new TextEncoder,a,d=i(()=>{},"cleanup"),c=!1,l=new ReadableStream({start:i(p=>{let g=i(()=>{c||(c=!0,d(),p.close())},"close");if(d=i(()=>{a?.(),this.#r.delete(g)},"cleanup"),this.#r.add(g),p.enqueue(o.encode(this.sse(e,{task:s.task}))),R.has(s.task.status.state)){g();return}a=this.#e.subscribe(n,f=>{p.enqueue(o.encode(this.sse(e,{statusUpdate:{taskId:n,contextId:f.contextId,status:f.task.status}}))),(R.has(f.task.status.state)||f.task.status.state==="TASK_STATE_INPUT_REQUIRED"||f.task.status.state==="TASK_STATE_AUTH_REQUIRED")&&g()})},"start"),cancel:i(()=>{c||(c=!0,d())},"cancel")});return new Response(l,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-cache"}})}sse(e,n){return`data: ${JSON.stringify({jsonrpc:"2.0",id:e,result:n})}
+import"./chunks/chunk-Z535BARK.js";import"./chunks/chunk-F7KGYHJ3.js";import{f as Ye,l as et}from"./chunks/chunk-GVTM4Z6O.js";import"./chunks/chunk-SX2WFHIS.js";import"./chunks/chunk-A574DBTV.js";import"./chunks/chunk-A2TFSV5M.js";import"./chunks/chunk-PHH4TRGF.js";import"./chunks/chunk-T7LYK53M.js";import"./chunks/chunk-64NQBOSN.js";import"./chunks/chunk-44QXPEEE.js";import"./chunks/chunk-PVUXONQB.js";import"./chunks/chunk-ZJIMT5I3.js";import"./chunks/chunk-Y5XKAN7C.js";import{b as V}from"./chunks/chunk-52JSZ77P.js";import"./chunks/chunk-VRSVNU2Y.js";import"./chunks/chunk-23X6REO4.js";import{a as o}from"./chunks/chunk-ONUPGMER.js";var te="1.0",Ce="kodax-a2a-v1-jsonrpc";var u=class extends Error{constructor(n,r,i=200,s,a){super(r);this.code=n;this.httpStatus=i;this.data=s;this.headers=a;this.name="A2AError"}code;httpStatus;data;headers;static{o(this,"A2AError")}};function ge(t){return t instanceof Error?t.message:String(t)}o(ge,"errorMessage");var nn=["apiKeySecurityScheme","httpAuthSecurityScheme","oauth2SecurityScheme","openIdConnectSecurityScheme","mtlsSecurityScheme"],rn=["authorizationCode","clientCredentials","implicit","password","deviceCode"],sn=/^[\x21\x23-\x5B\x5D-\x7E]+$/u;function re(t,e){if(!sn.test(t))throw new Error(`${e} must be an RFC 6749 scope-token.`)}o(re,"assertOAuthScopeToken");function tt(t,e){let n=t.split(" ");for(let r of n)re(r,e);return[...new Set(n)]}o(tt,"parseOAuthScopeValue");function ie(t,e){if(!Array.isArray(t))throw new Error(`${e} must be an array of strings.`);let n=t.map((r,i)=>{if(typeof r!="string")throw new Error(`${e}[${i}] must be a string.`);return re(r,`${e}[${i}]`),r});if(new Set(n).size!==n.length)throw new Error(`${e} must not contain duplicates.`);return n}o(ie,"parseOAuthScopeList");function B(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}o(B,"isRecord");function v(t,e){if(typeof t!="string"||t.trim().length===0)throw new Error(`${e} must be a non-empty string.`);return t}o(v,"requireNonEmptyString");function on(t,e){if(t!==void 0)return v(t,e)}o(on,"optionalString");function nt(t,e){return v(t,e).trim()}o(nt,"trimmedUri");function an(t){return/^[A-Za-z][A-Za-z0-9+.-]*:\/\/([^/?#]*)/u.exec(t)?.[1]?.includes("@")===!0}o(an,"hasAuthorityUserinfo");function me(t){let e=t.toLowerCase().replace(/^\[|\]$/gu,"");return e==="localhost"||e==="127.0.0.1"||e==="::1"}o(me,"isExactOAuthLoopbackHostname");function rt(t,e){let n=nt(t,e);if(!/^https?:\/\/([^/?#]*)/iu.exec(n)?.[1])throw new Error(`${e} must be an absolute HTTP(S) URL.`);let i;try{i=new URL(n)}catch{throw new Error(`${e} must be an absolute HTTP(S) URL.`)}if(an(n)||i.username||i.password||n.includes("#"))throw new Error(`${e} must not contain userinfo or a fragment.`);if(i.protocol==="http:"&&!me(i.hostname))throw new Error(`${e} must use HTTPS or exact loopback HTTP.`);return{raw:n,url:i}}o(rt,"secureOAuthHttpUrl");function H(t,e){let n=rt(t,e);if(n.raw.includes("?"))throw new Error(`${e} must not contain a query or fragment.`);return n.raw}o(H,"parseOAuthIssuerIdentifier");function $(t,e){return rt(t,e).url}o($,"parseOAuthEndpointUrl");function ne(t,e){let n=nt(t,e);if(!/^[A-Za-z][A-Za-z0-9+.-]*:/u.test(n))throw new Error(`${e} must be an absolute URI.`);try{new URL(n)}catch{throw new Error(`${e} must be an absolute URI.`)}if(n.includes("#"))throw new Error(`${e} must not contain a fragment.`);return n}o(ne,"parseOAuthResourceIdentifier");function it(t,e){return $(t,e).href}o(it,"absoluteHttpUrl");function cn(t,e){if(!B(t))throw new Error(`${e} must be a scope-description object.`);return Object.entries(t).map(([n,r])=>{if(n.trim().length===0||typeof r!="string")throw new Error(`${e} must map non-empty scope names to descriptions.`);return re(n,`${e}.${n}`),n})}o(cn,"parseScopes");function dn(t,e){if(!B(e))throw new Error(`securitySchemes.${t}.httpAuthSecurityScheme must be an object.`);let n=v(e.scheme,`securitySchemes.${t}.httpAuthSecurityScheme.scheme`),r=on(e.bearerFormat,`securitySchemes.${t}.httpAuthSecurityScheme.bearerFormat`);return n.toLowerCase()!=="bearer"?{name:t,kind:"unsupported",protocol:`http:${n.toLowerCase()}`}:{name:t,kind:"http-bearer",...r?{bearerFormat:r}:{}}}o(dn,"parseHttpScheme");function un(t,e){let n=e.flows;if(!B(n))throw new Error(`securitySchemes.${t}.oauth2SecurityScheme.flows must be an object.`);let r=rn.filter(c=>n[c]!==void 0);if(r.length!==1)throw new Error(`securitySchemes.${t}.oauth2SecurityScheme.flows must contain exactly one OAuth flow.`);let i=r[0],s=n[i];if(!B(s))throw new Error(`securitySchemes.${t}.oauth2SecurityScheme.flows.${i} must be an object.`);let a=cn(s.scopes,`securitySchemes.${t}.oauth2SecurityScheme.flows.${i}.scopes`);if(i==="clientCredentials"){let c=it(s.tokenUrl,`securitySchemes.${t}.oauth2SecurityScheme.flows.clientCredentials.tokenUrl`);return{name:t,kind:"oauth2-client-credentials",tokenUrl:c,scopes:a}}return{name:t,kind:"unsupported",protocol:`oauth2:${i}`,oauthScopes:a}}o(un,"parseOAuthFlow");function ln(t,e,n){if(!B(n))throw new Error(`securitySchemes.${t}.${e} must be an object.`);if(e==="apiKeySecurityScheme"){let r=v(n.location,`securitySchemes.${t}.${e}.location`);if(!["query","header","cookie"].includes(r))throw new Error(`securitySchemes.${t}.${e}.location must be query, header, or cookie.`);return v(n.name,`securitySchemes.${t}.${e}.name`),{name:t,kind:"unsupported",protocol:"api-key"}}return e==="openIdConnectSecurityScheme"?(it(n.openIdConnectUrl,`securitySchemes.${t}.${e}.openIdConnectUrl`),{name:t,kind:"unsupported",protocol:"openid-connect",acceptsOAuthScopes:!0}):{name:t,kind:"unsupported",protocol:"mutual-tls"}}o(ln,"parseUnsupportedScheme");function An(t,e){if(!B(e))throw new Error(`securitySchemes.${t} must be an object.`);let n=nn.filter(i=>e[i]!==void 0);if(n.length!==1)throw new Error(`securitySchemes.${t} must contain exactly one security scheme.`);let r=n[0];if(r==="httpAuthSecurityScheme")return dn(t,e[r]);if(r==="oauth2SecurityScheme"){let i=e[r];if(!B(i))throw new Error(`securitySchemes.${t}.${r} must be an object.`);return un(t,i)}return ln(t,r,e[r])}o(An,"parseScheme");function pn(t){if(t===void 0)return{};if(!B(t))throw new Error("securitySchemes must be an object.");return Object.fromEntries(Object.entries(t).map(([e,n])=>{if(e.trim().length===0)throw new Error("securitySchemes names must not be empty.");return[e,An(e,n)]}))}o(pn,"parseSchemes");function fn(t,e){if(!B(t))throw new Error(`${e} must be a StringList object.`);if(t.list===void 0)return[];if(!Array.isArray(t.list)||!t.list.every(n=>typeof n=="string"&&n.trim().length>0))throw new Error(`${e}.list must be an array of non-empty strings.`);if(new Set(t.list).size!==t.list.length)throw new Error(`${e}.list must not contain duplicate scopes.`);for(let n of t.list)re(n,`${e}.list`);return t.list}o(fn,"parseScopeList");function hn(t,e){if(t.kind==="oauth2-client-credentials"||t.kind==="unsupported"&&t.oauthScopes!==void 0){let n=t.kind==="oauth2-client-credentials"?t.scopes:t.oauthScopes??[];for(let r of e)if(!n.includes(r))throw new Error(`scope "${r}" is not declared by security scheme "${t.name}".`);return}if(e.length>0&&!(t.kind==="unsupported"&&t.acceptsOAuthScopes))throw new Error(`security scheme "${t.name}" does not accept OAuth scopes.`)}o(hn,"validateRequiredScopes");function gn(t,e,n){if(!B(t))throw new Error(`securityRequirements[${e}] must be an object.`);let r=t.schemes;if(r!==void 0&&!B(r))throw new Error(`securityRequirements[${e}].schemes must be an object.`);return{schemes:Object.entries(r??{}).map(([a,c])=>{if(!Object.hasOwn(n,a))throw new Error(`securityRequirements[${e}] references unknown security scheme "${a}".`);let d=n[a],A=fn(c,`securityRequirements[${e}].schemes.${a}`);return hn(d,A),{scheme:d,scopes:A}})}}o(gn,"parseRequirement");function F(t,e){let n=pn(t);if(e===void 0)return{schemes:n,requirements:[]};if(!Array.isArray(e))throw new Error("securityRequirements must be an array.");return{schemes:n,requirements:e.map((r,i)=>gn(r,i,n))}}o(F,"parseA2ASecurity");function mn(t,e){let{scheme:n,scopes:r}=e;return n.kind!=="unsupported"&&t.schemeName===n.name&&t.kind===n.kind&&r.every(i=>t.scopes?.includes(i)===!0)}o(mn,"capabilityMatches");function xi(t,e){return ye(t,e)[0]??null}o(xi,"selectA2ASecurityRequirement");function ye(t,e){return(t.requirements.length===0?[{schemes:[]}]:t.requirements).filter(r=>r.schemes.every(i=>e.some(s=>mn(s,i))))}o(ye,"satisfiableA2ASecurityRequirements");var yn=new Set(["TASK_STATE_UNSPECIFIED","TASK_STATE_SUBMITTED","TASK_STATE_WORKING","TASK_STATE_COMPLETED","TASK_STATE_FAILED","TASK_STATE_CANCELED","TASK_STATE_INPUT_REQUIRED","TASK_STATE_REJECTED","TASK_STATE_AUTH_REQUIRED"]);function g(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}o(g,"isRecord");function st(t){if(t===null)return;let e=t.split(";",1)[0]?.trim().toLowerCase();return e&&!/\s/u.test(e)?e:void 0}o(st,"mediaTypeEssence");function de(t){let e=st(t);return e==="application/json"||/^application\/[!#$%&'*+\-.^_`|~0-9a-z]+\+json$/u.test(e??"")}o(de,"isJsonMediaType");function ot(t){return st(t)==="text/event-stream"}o(ot,"isEventStreamMediaType");function U(t,e,n){let r=t[e];if(typeof r!="string"||r.trim().length===0)throw new u(-32602,`${n}.${e} must be a non-empty string.`);return r}o(U,"requiredString");function b(t,e){let n=t[e];return typeof n=="string"&&n.length>0?n:void 0}o(b,"optionalString");function se(t,e){if(!Array.isArray(t)||!t.every(n=>typeof n=="string"))throw new u(-32602,`${e} must be a string array.`);return t}o(se,"stringArray");function wn(t){if(!g(t))throw new u(-32602,"Agent Card interface is invalid.");return{url:U(t,"url","interface"),protocolBinding:U(t,"protocolBinding","interface"),protocolVersion:U(t,"protocolVersion","interface"),...b(t,"tenant")?{tenant:b(t,"tenant")}:{}}}o(wn,"parseInterface");function at(t,e,n){try{F(t,e)}catch(r){let i=r instanceof Error?r.message:String(r);throw new u(-32602,`${n} is invalid: ${i}`)}}o(at,"validateSecurity");function kn(t,e){if(!g(t))throw new u(-32602,"Agent Card skill is invalid.");return t.securityRequirements!==void 0&&at(e,t.securityRequirements,"skill.securityRequirements"),{id:U(t,"id","skill"),name:U(t,"name","skill"),description:U(t,"description","skill"),tags:se(t.tags,"skill.tags"),...Array.isArray(t.examples)?{examples:se(t.examples,"skill.examples")}:{},...Array.isArray(t.inputModes)?{inputModes:se(t.inputModes,"skill.inputModes")}:{},...Array.isArray(t.outputModes)?{outputModes:se(t.outputModes,"skill.outputModes")}:{},...Array.isArray(t.securityRequirements)?{securityRequirements:t.securityRequirements.filter(g)}:{}}}o(kn,"parseSkill");function Sn(t){if(!g(t))throw new u(-32602,"Agent Card extension is invalid.");let e=U(t,"uri","extension");try{new URL(e)}catch{throw new u(-32602,"Agent Card extension.uri must be an absolute URI.")}if(t.description!==void 0&&typeof t.description!="string")throw new u(-32602,"Agent Card extension.description must be a string.");if(t.required!==void 0&&typeof t.required!="boolean")throw new u(-32602,"Agent Card extension.required must be a boolean.");if(t.params!==void 0&&!g(t.params))throw new u(-32602,"Agent Card extension.params must be an object.");return{uri:e,...typeof t.description=="string"?{description:t.description}:{},...typeof t.required=="boolean"?{required:t.required}:{},...g(t.params)?{params:t.params}:{}}}o(Sn,"parseExtension");function ct(t){if(!g(t))throw new u(-32602,"Agent Card must be an object.");let e=t.supportedInterfaces,n=t.skills;if(!Array.isArray(e)||e.length===0)throw new u(-32602,"Agent Card must declare supportedInterfaces.");if(!Array.isArray(n))throw new u(-32602,"Agent Card must declare skills.");if(!g(t.capabilities))throw new u(-32602,"Agent Card capabilities are invalid.");if(t.capabilities.extensions!==void 0&&!Array.isArray(t.capabilities.extensions))throw new u(-32602,"Agent Card capabilities.extensions must be an array.");return at(t.securitySchemes,t.securityRequirements,"Agent Card security declaration"),{name:U(t,"name","Agent Card"),description:U(t,"description","Agent Card"),supportedInterfaces:e.map(wn),version:U(t,"version","Agent Card"),capabilities:{...typeof t.capabilities.streaming=="boolean"?{streaming:t.capabilities.streaming}:{},...typeof t.capabilities.pushNotifications=="boolean"?{pushNotifications:t.capabilities.pushNotifications}:{},...typeof t.capabilities.extendedAgentCard=="boolean"?{extendedAgentCard:t.capabilities.extendedAgentCard}:{},...Array.isArray(t.capabilities.extensions)?{extensions:t.capabilities.extensions.map(Sn)}:{}},...g(t.securitySchemes)?{securitySchemes:t.securitySchemes}:{},...Array.isArray(t.securityRequirements)?{securityRequirements:t.securityRequirements.filter(g)}:{},defaultInputModes:se(t.defaultInputModes,"Agent Card defaultInputModes"),defaultOutputModes:se(t.defaultOutputModes,"Agent Card defaultOutputModes"),skills:n.map(r=>kn(r,t.securitySchemes))}}o(ct,"parseA2AAgentCard");function dt(t){if(!g(t))throw new u(-32602,"Message Part must be an object.");let e=["text","raw","url","data"].filter(r=>t[r]!==void 0);if(e.length!==1)throw new u(-32602,"Message Part must contain exactly one content field.");let n=e[0];if(n!=="data"&&typeof t[n]!="string")throw new u(-32602,`Message Part ${n} content must be a string.`);return{...typeof t.text=="string"?{text:t.text}:{},...typeof t.raw=="string"?{raw:t.raw}:{},...typeof t.url=="string"?{url:t.url}:{},...t.data!==void 0?{data:t.data}:{},...g(t.metadata)?{metadata:t.metadata}:{},...b(t,"filename")?{filename:b(t,"filename")}:{},...b(t,"mediaType")?{mediaType:b(t,"mediaType")}:{}}}o(dt,"parseA2APart");function N(t){if(!g(t))throw new u(-32602,"Message must be an object.");if(t.role!=="ROLE_USER"&&t.role!=="ROLE_AGENT")throw new u(-32602,"Message role is invalid.");if(!Array.isArray(t.parts)||t.parts.length===0)throw new u(-32602,"Message parts must not be empty.");return{messageId:U(t,"messageId","Message"),role:t.role,parts:t.parts.map(dt),...b(t,"contextId")?{contextId:b(t,"contextId")}:{},...b(t,"taskId")?{taskId:b(t,"taskId")}:{},...g(t.metadata)?{metadata:t.metadata}:{}}}o(N,"parseA2AMessage");function Rn(t){if(!g(t)||!Array.isArray(t.parts)||t.parts.length===0)throw new u(-32603,"A2A artifact is invalid.");return{artifactId:U(t,"artifactId","Artifact"),parts:t.parts.map(dt),...b(t,"name")?{name:b(t,"name")}:{},...b(t,"description")?{description:b(t,"description")}:{},...g(t.metadata)?{metadata:t.metadata}:{}}}o(Rn,"parseArtifact");function z(t){if(!g(t)||!g(t.status))throw new u(-32603,"A2A task is invalid.");let e=t.status.state;if(typeof e!="string")throw new u(-32603,"A2A task state is invalid.");let n=yn.has(e)?e:"TASK_STATE_UNSPECIFIED";return{id:U(t,"id","Task"),contextId:b(t,"contextId")??"",status:{state:n,...t.status.message!==void 0?{message:N(t.status.message)}:{},...b(t.status,"timestamp")?{timestamp:b(t.status,"timestamp")}:{}},...Array.isArray(t.artifacts)?{artifacts:t.artifacts.map(Rn)}:{},...Array.isArray(t.history)?{history:t.history.map(N)}:{},...g(t.metadata)?{metadata:t.metadata}:{}}}o(z,"parseA2ATask");function ut(t){if(!g(t)||t.jsonrpc!=="2.0")throw new u(-32600,"Invalid JSON-RPC request.");if(typeof t.id!="string"&&typeof t.id!="number")throw new u(-32600,"JSON-RPC request id is required.");return{jsonrpc:"2.0",id:t.id,method:U(t,"method","JSON-RPC request"),...g(t.params)?{params:t.params}:{}}}o(ut,"parseJsonRpcRequest");import{lookup as Tn}from"node:dns/promises";import{request as En}from"node:http";import{request as bn}from"node:https";import{BlockList as xn,isIP as At}from"node:net";import{Readable as In}from"node:stream";var we=new xn;we.addSubnet("127.0.0.0",8,"ipv4");we.addAddress("::1","ipv6");function pt(t){let e=At(t);return e===4?we.check(t,"ipv4"):e===6&&we.check(t,"ipv6")}o(pt,"isLoopbackAddress");function ve(t){let e=t.split(".").map(Number),[n,r,i,s]=e;return e.length!==4||n===void 0||r===void 0||i===void 0||s===void 0?!0:n===0||n===10||n===127||n===100&&r>=64&&r<=127||n===169&&r===254||n===172&&r>=16&&r<=31||n===192&&r===168||n===192&&r===0&&i===0&&s!==9&&s!==10||n===192&&r===0&&i===2||n===198&&(r===18||r===19)||n===198&&r===51&&i===100||n===203&&r===0&&i===113||n>=224}o(ve,"isPrivateIpv4");function Cn(t){if(pt(t))return!0;let e=t.toLowerCase(),n=/^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(e)?.[1];if(n)return ve(n);let r=/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(e);if(r?.[1]&&r[2]){let i=Number.parseInt(r[1],16),s=Number.parseInt(r[2],16);return ve(`${i>>8}.${i&255}.${s>>8}.${s&255}`)}return e==="::"||e==="::1"||e.startsWith("fc")||e.startsWith("fd")||e.startsWith("fe8")||e.startsWith("fe9")||e.startsWith("fea")||e.startsWith("feb")||e.startsWith("ff")}o(Cn,"isPrivateIpv6");function lt(t){let e=At(t);return e===4?ve(t):e===6?Cn(t):!0}o(lt,"isPrivateAddress");async function ft(t,e){if(t.protocol!=="https:"&&t.protocol!=="http:")throw new u(-32602,"A2A URL must use HTTP or HTTPS.");if(!e.allowedOrigins.includes(t.origin))throw new u(-32602,`A2A origin is not allowed: ${t.origin}`);if(t.username||t.password)throw new u(-32602,"A2A URL must not include credentials.");let n=t.hostname.startsWith("[")&&t.hostname.endsWith("]")?t.hostname.slice(1,-1):t.hostname,r=await Tn(n,{all:!0,verbatim:!0});if(r.length===0)throw new u(-32602,"A2A hostname did not resolve.");if(n.toLowerCase()==="localhost"&&!r.every(s=>pt(s.address)))throw new u(-32602,"A2A localhost target must resolve only to loopback addresses.");if(t.protocol==="http:"&&!r.every(s=>lt(s.address)))throw new u(-32602,"Public A2A targets must use HTTPS.");if(!e.allowPrivateAddresses&&r.some(s=>lt(s.address)))throw new u(-32602,"A2A private network targets are not allowed.");let i=r[0];if(i===void 0||i.family!==4&&i.family!==6)throw new u(-32602,"A2A hostname returned an unsupported address.");return{address:i.address,family:i.family}}o(ft,"validateA2AUrl");async function vn(t,e){await ft(t,e)}o(vn,"assertSafeA2AUrl");function Pn(t){if(t==null||typeof t=="string")return t??void 0;if(t instanceof URLSearchParams)return t.toString();if(t instanceof Uint8Array)return t;if(t instanceof ArrayBuffer)return new Uint8Array(t);if(ArrayBuffer.isView(t))return new Uint8Array(t.buffer,t.byteOffset,t.byteLength);throw new u(-32602,"A2A request body type is not supported by the safe transport.")}o(Pn,"encodeRequestBody");function On(t){return((e,n,r)=>{if(typeof n=="object"&&n.all){r(null,[t]);return}r(null,t.address,t.family)})}o(On,"pinnedLookup");function Un(t,e,n){return new Promise((r,i)=>{let s=new Headers(e.headers);s.set("accept-encoding","identity");let a=(t.protocol==="https:"?bn:En)(t,{method:e.method,headers:Object.fromEntries(s),lookup:On(n),signal:e.signal??void 0},c=>{let d=new Headers;for(let p=0;p<c.rawHeaders.length;p+=2){let h=c.rawHeaders[p],k=c.rawHeaders[p+1];h!==void 0&&k!==void 0&&d.append(h,k)}let A=c.statusCode??500,l=e.method!=="HEAD"&&A!==204&&A!==205&&A!==304?In.toWeb(c):null;r(new Response(l,{status:A,statusText:c.statusMessage,headers:d}))});a.once("error",i),a.end(Pn(e.body))})}o(Un,"requestValidatedAddress");async function Pe(t,e,n,r){let i=await ft(t,n);return r!==void 0?r(t,e):Un(t,e,i)}o(Pe,"openSafeA2AResponse");async function _n(t,e){let n=t.headers.get("content-length");if(n&&Number(n)>e)throw new u(-32603,"A2A response is too large.");if(!t.body)return new Uint8Array;let r=t.body.getReader(),i=[],s=0;for(;;){let d=await r.read();if(d.done)break;if(s+=d.value.byteLength,s>e)throw await r.cancel(),new u(-32603,"A2A response is too large.");i.push(d.value)}let a=new Uint8Array(s),c=0;for(let d of i)a.set(d,c),c+=d.byteLength;return a}o(_n,"boundedBody");async function G(t,e,n,r){let i=t,s=new Headers(e.headers).get("authorization");for(let a=0;a<=n.maxRedirects;a+=1){let c=new AbortController,d=setTimeout(()=>c.abort(new Error("A2A request timed out.")),n.requestTimeoutMs),A=new Headers(e.headers);s===null?A.delete("authorization"):A.set("authorization",s);try{let f=await Pe(i,{...e,headers:A,redirect:"manual",signal:c.signal},n,r);if(f.status<300||f.status>=400)return{response:f,body:await _n(f,n.maxResponseBytes),url:i};let l=f.headers.get("location");if(!l||a===n.maxRedirects)throw new u(-32603,"A2A redirect limit exceeded.");let p=new URL(l,i);await f.body?.cancel(),p.origin!==i.origin&&(s=null),i=p}finally{clearTimeout(d)}}throw new u(-32603,"A2A redirect limit exceeded.")}o(G,"safeA2AFetch");function X(t){return new TextDecoder("utf-8",{fatal:!0}).decode(t)}o(X,"decodeUtf8");import{createHash as Dn,randomUUID as Oe}from"node:crypto";import*as D from"oauth4webapi";var Mn=6e4,qn=1e3,Ln=.1;function $n(t,e){return new Response(e.byteLength===0?null:X(e),{status:t.status,statusText:t.statusText,headers:t.headers})}o($n,"oauthResponse");function Nn(t,e){if(e===void 0||e<=0)return t;let n=e*1e3,r=Math.min(Mn,Math.max(qn,n*Ln));return t+Math.max(0,n-r)}o(Nn,"cacheExpiry");function ht(t){let e=v(t.clientId,"OAuth 2.0 clientId");if(t.clientAuthenticationMethod!=="basic"&&t.clientAuthenticationMethod!=="post")throw new Error("OAuth 2.0 clientAuthenticationMethod must be basic or post.");let n=t.clientAuthenticationMethod,r=t.scopes===void 0?void 0:ie(t.scopes,"OAuth 2.0 scopes"),i=H(t.issuer,"OAuth 2.0 issuer"),s=$(t.tokenUrl,"OAuth 2.0 token endpoint"),a=t.resource===void 0?void 0:ne(t.resource,"OAuth 2.0 resource"),c={issuer:i,token_endpoint:s.href},d={client_id:e},A={...t.networkPolicy,maxRedirects:0},f=t.now??Date.now,l,p,h=0;async function k(w){let y=n==="post"?D.ClientSecretPost(w):D.ClientSecretBasic(w),T=new URLSearchParams;r&&r.length>0&&T.set("scope",r.join(" ")),a!==void 0&&T.set("resource",a);let m={[D.customFetch]:async(R,O)=>{if(new URL(R).href!==s.href)throw new Error("OAuth 2.0 token request targeted an unexpected endpoint.");let j=await G(s,{method:O.method,headers:O.headers,body:O.body,redirect:"manual",...O.signal!==void 0?{signal:O.signal}:{}},A,t.fetch);return $n(j.response,j.body)}};s.protocol==="http:"&&(m[D.allowInsecureRequests]=!0);let S;try{let R=await D.clientCredentialsGrantRequest(c,d,y,T,m);S=await D.processClientCredentialsResponse(c,d,R)}catch{throw new Error("OAuth 2.0 client credentials token request failed.")}if(S.token_type!=="bearer")throw new Error("OAuth 2.0 token endpoint did not return a Bearer access token.");let q=f();return{value:`Bearer ${S.access_token}`,expiresAt:Nn(q,S.expires_in)}}return o(k,"requestAuthorization"),{async getAuthorization(w){if(w.length===0)throw new Error("OAuth 2.0 client secret is required.");let y=f();if(l!==void 0&&l.expiresAt>y)return l.value;if(p!==void 0)return p;let T=h,m;return m=k(w).then(S=>(h===T&&S.expiresAt>f()&&(l=S),S.value)).finally(()=>{p===m&&(p=void 0)}),p=m,m},invalidate(w){if(w!==void 0){l?.value===w&&(l=void 0);return}h+=1,l=void 0,p=void 0}}}o(ht,"createOAuth2ClientCredentialsTokenManager");var gt=4,mt=/^[A-Za-z0-9\-._~+/=]$/u;function ke(t){return t!==void 0&&/^Bearer\s+\S+$/iu.test(t)}o(ke,"isBearerAuthorization");function Kn(t,e){let n="",r=0;for(;r<t.length;){let i=t.indexOf(e,r);if(i<0)return n+t.slice(r);let s=i===0?void 0:t[i-1],a=i+e.length,c=a===t.length?void 0:t[a],d=s===void 0||!mt.test(s),A=c===void 0||!mt.test(c);n+=t.slice(r,i),d&&A?(n+="[REDACTED]",r=a):(n+=e,r=a)}return n}o(Kn,"replaceBoundedToken");function Ae(t){return Array.isArray(t)?`[${t.map(Ae).join(",")}]`:g(t)?`{${Object.keys(t).sort().map(e=>`${JSON.stringify(e)}:${Ae(t[e])}`).join(",")}}`:JSON.stringify(t)??"null"}o(Ae,"stableJson");function yt(t){return`sha256:${Dn("sha256").update(t).digest("hex")}`}o(yt,"sha256");var _e=class{static{o(this,"AuthorizationRedactor")}#e=[];#n=new Map;remember(e){if(!e)return;let n=this.#e.indexOf(e);n>=0&&this.#e.splice(n,1),this.#e.unshift(e),this.#e.length>gt&&(this.#e.length=gt)}retain(e){if(!e)return()=>{};this.remember(e),this.#n.set(e,(this.#n.get(e)??0)+1);let n=!1;return()=>{if(n)return;n=!0;let r=(this.#n.get(e)??1)-1;r===0?this.#n.delete(e):this.#n.set(e,r)}}redactText(e){let n=[...new Set([...this.#n.keys(),...this.#e])],r=n.sort((s,a)=>a.length-s.length).reduce((s,a)=>s.split(a).join("[REDACTED]"),e),i=n.flatMap(s=>{let a=/^Bearer\s+(\S+)$/iu.exec(s)?.[1];return a?[a]:[]}).sort((s,a)=>a.length-s.length);return[...new Set(i)].reduce((s,a)=>Kn(s,a),r)}redactContent(e){return typeof e=="string"?this.redactText(e):Array.isArray(e)?e.map(n=>this.redactContent(n)):g(e)?Object.fromEntries(Object.entries(e).map(([n,r])=>[n,this.redactContent(r)])):e}redactPart(e){return{...e,...e.text===void 0?{}:{text:this.redactText(e.text)},...e.raw===void 0?{}:{raw:this.redactText(e.raw)},...e.url===void 0?{}:{url:this.redactText(e.url)},...e.data===void 0?{}:{data:this.redactContent(e.data)},...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)},...e.filename===void 0?{}:{filename:this.redactText(e.filename)}}}redactMessage(e){return{...e,parts:e.parts.map(n=>this.redactPart(n)),...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)}}}redactArtifact(e){return{...e,...e.name===void 0?{}:{name:this.redactText(e.name)},...e.description===void 0?{}:{description:this.redactText(e.description)},parts:e.parts.map(n=>this.redactPart(n)),...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)}}}redactTask(e){return{...e,status:{...e.status,...e.status.message===void 0?{}:{message:this.redactMessage(e.status.message)}},...e.artifacts===void 0?{}:{artifacts:e.artifacts.map(n=>this.redactArtifact(n))},...e.history===void 0?{}:{history:e.history.map(n=>this.redactMessage(n))},...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)}}}redactError(e){let n=this.redactText(e instanceof Error?e.message:String(e));return e instanceof u?new u(e.code,n,e.httpStatus,this.redactContent(e.data),e.headers):new Error(n)}};function wt(t,e){let n=new URL(e).origin;if(!t.allowedOrigins.some(i=>new URL(i).origin===n))throw new Error(`A2A endpoint origin is not allowed by network policy: ${n}`);return{...t,allowedOrigins:[n]}}o(wt,"endpointNetworkPolicy");function jn(t){if(t!==void 0){if(!g(t)||typeof t.scheme!="string")throw new Error("A2A registration authentication is invalid.");if(t.type==="http-bearer")return{type:"http-bearer",scheme:t.scheme};if(t.type!=="oauth2-client-credentials"||typeof t.issuer!="string"||typeof t.tokenUrl!="string"||typeof t.clientId!="string"||!Array.isArray(t.scopes)||!t.scopes.every(e=>typeof e=="string")||!["client-secret-basic","client-secret-post"].includes(String(t.clientAuthentication)))throw new Error("A2A registration OAuth2 authentication is invalid.");return{type:"oauth2-client-credentials",scheme:t.scheme,issuer:t.issuer,tokenUrl:t.tokenUrl,clientId:t.clientId,scopes:t.scopes,...typeof t.resource=="string"?{resource:t.resource}:{},clientAuthentication:t.clientAuthentication}}}o(jn,"executorAuthentication");function Q(t){let e=t.executorConfig;if(!g(e))throw new Error("A2A registration executorConfig is missing.");if(typeof e.agentCardUrl!="string"||typeof e.interfaceUrl!="string")throw new Error("A2A registration endpoints are invalid.");let n=jn(e.authentication);return{agentCardUrl:e.agentCardUrl,interfaceUrl:e.interfaceUrl,...typeof e.tenant=="string"?{tenant:e.tenant}:{},...n?{authentication:n}:{}}}o(Q,"executorConfig");function Bn(t,e){let n=t.supportedInterfaces.find(i=>i.protocolBinding.toUpperCase()==="JSONRPC"&&i.protocolVersion==="1.0");if(!n)throw new Error("Agent Card has no supported A2A 1.0 JSONRPC interface.");let r=new URL(n.url);if(r.username||r.password||r.hash)throw new Error("A2A interface URL must not contain credentials or a fragment.");if(r.origin!==e.origin)throw new Error("A2A interface must use the same origin as the trusted Agent Card.");return n}o(Bn,"chooseInterface");function zn(t){if(t===void 0)return;if(!g(t))throw new Error("A2A authentication must be an object.");let e=v(t.scheme,"A2A authentication.scheme");if(t.type==="http-bearer")return{type:"http-bearer",scheme:e,credentialRef:v(t.credentialRef,"A2A authentication.credentialRef")};if(t.type!=="oauth2-client-credentials")throw new Error("A2A authentication.type must be http-bearer or oauth2-client-credentials.");if(t.clientAuthentication!=="client-secret-basic"&&t.clientAuthentication!=="client-secret-post")throw new Error("A2A authentication.clientAuthentication is invalid.");return{type:"oauth2-client-credentials",scheme:e,issuer:H(t.issuer,"Configured OAuth2 issuer"),tokenUrl:$(t.tokenUrl,"Configured OAuth2 token endpoint").href,clientId:v(t.clientId,"Configured OAuth2 clientId"),clientSecretRef:v(t.clientSecretRef,"Configured OAuth2 clientSecretRef"),scopes:ie(t.scopes,"Configured OAuth2 scopes"),...t.resource===void 0?{}:{resource:ne(t.resource,"Configured OAuth2 resource")},clientAuthentication:t.clientAuthentication}}o(zn,"validatedClientAuthentication");function Jn(t){let e=t.credentialRef===void 0?void 0:v(t.credentialRef,"A2A credentialRef"),n=zn(t.authentication);if(t.credentialRef!==void 0&&t.authentication!==void 0)throw new Error("A2A registration cannot combine credentialRef with structured authentication.");return{agentId:t.agentId,agentCardUrl:t.agentCardUrl,...e!==void 0?{credentialRef:e}:{},...n!==void 0?{authentication:n}:{},effects:t.effects}}o(Jn,"validatedRegistrationInput");function Hn(t,e,n){if(t.authentication)return[[{schemeName:t.authentication.scheme,kind:t.authentication.type,...t.authentication.type==="oauth2-client-credentials"?{scopes:t.authentication.scopes}:{}}]];let r=ke(n);if(!t.credentialRef&&!r)return[[]];let i=F(e.securitySchemes,e.securityRequirements);return Object.values(i.schemes).flatMap(s=>s.kind==="http-bearer"?[[{schemeName:s.name,kind:"http-bearer"}]]:[])}o(Hn,"configuredCapabilityCandidates");function kt(t,e){for(let n of t){if(n.schemes.length!==1)continue;let r=n.schemes[0].scheme;if(e.some(i=>i.schemeName===r.name&&i.kind===r.kind))return r}}o(kt,"matchingDeclaredScheme");function Fn(t,e){let n=F(t.securitySchemes,t.securityRequirements),r=ye(n,e).filter(a=>a.schemes.length<=1);if(r.length===0)return null;let i=kt(r,e),s=[];for(let a of t.skills){let c=F(t.securitySchemes,a.securityRequirements),d=ye(c,e).filter(A=>A.schemes.length<=1);d.length!==0&&(s.push(a.id),i??=kt(d,e))}return t.skills.length>0&&s.length===0?null:{skillIds:s,...i?{declaredScheme:i}:{}}}o(Fn,"evaluateSecurityCapabilities");function Wn(t,e,n){if(t.credentialRef!==void 0&&t.authentication!==void 0)throw new Error("A2A registration cannot combine credentialRef with structured authentication.");if(n!==void 0&&!ke(n))throw new Error("A2A options.authorization must be a valid Bearer authorization.");let r=ke(n),i=t.credentialRef!==void 0||t.authentication!==void 0||r,s;for(let h of Hn(t,e,n)){let k=Fn(e,h);if(k&&(!i||k.declaredScheme)){s=k;break}}if(!s)throw new Error(i?"Configured A2A authentication cannot fully satisfy the Agent Card and any advertised Skill security requirements.":"Agent Card or at least one advertised Skill requires authentication, but no compatible A2A authentication is configured.");if(!i)return{skillIds:s.skillIds};let a=s.declaredScheme,c=t.authentication;if(!c&&!t.credentialRef&&r)return{skillIds:s.skillIds};if(!c)return{credentialRef:t.credentialRef,authentication:{type:"http-bearer",scheme:a.name},skillIds:s.skillIds};if(c.type==="http-bearer")return{credentialRef:c.credentialRef,authentication:{type:"http-bearer",scheme:c.scheme},skillIds:s.skillIds};if(a.kind!=="oauth2-client-credentials")throw new Error("Configured OAuth2 authentication does not match the selected Agent Card scheme.");let d=a,A=H(c.issuer,"Configured OAuth2 issuer"),f=$(c.tokenUrl,"Configured OAuth2 token endpoint").href,l=c.resource===void 0?void 0:ne(c.resource,"Configured OAuth2 resource");if(new URL(d.tokenUrl).href!==f)throw new Error("Configured OAuth2 tokenUrl does not match the selected Agent Card security scheme.");let p=c.scopes.find(h=>!d.scopes.includes(h));if(p)throw new Error(`Configured OAuth2 scope is not declared by the Agent Card: ${p}`);return{credentialRef:c.clientSecretRef,authentication:{type:"oauth2-client-credentials",scheme:c.scheme,issuer:A,tokenUrl:f,clientId:c.clientId,scopes:c.scopes,...l?{resource:l}:{},clientAuthentication:c.clientAuthentication},skillIds:s.skillIds}}o(Wn,"planClientAuthentication");function Me(t,e){try{return JSON.parse(t)}catch{throw new Error(`${e} returned invalid JSON.`)}}o(Me,"parseJson");function Tt(t){let e=t.maxTaskResponseBytes??t.networkPolicy.maxResponseBytes;if(!Number.isSafeInteger(e)||e<=0)throw new Error("A2A maxTaskResponseBytes must be a positive safe integer.");return e}o(Tt,"taskResponseBytes");function Vn(t){return{...t.networkPolicy,maxResponseBytes:Tt(t)}}o(Vn,"taskNetworkPolicy");async function Et(t,e){let n=Jn(t),r=await G(new URL(n.agentCardUrl),{headers:{accept:"application/json"}},e.networkPolicy,e.fetch);if(!r.response.ok)throw new Error(`Agent Card request failed with HTTP ${r.response.status}.`);if(!de(r.response.headers.get("content-type")))throw new Error("Agent Card response is not JSON.");let i=ct(Me(X(r.body),"Agent Card")),s=i.capabilities.extensions?.filter(f=>f.required)??[];if(s.length>0)throw new Error(`Agent Card required A2A extension(s) are unsupported: ${s.map(f=>f.uri).join(", ")}`);let a=Bn(i,r.url),c=Wn(n,i,e.authorization),d=Ae({agentCardUrl:r.url.href,interfaceUrl:a.url,protocolBinding:a.protocolBinding,protocolVersion:a.protocolVersion,tenant:a.tenant??"",authentication:c.authentication??null}),A=yt(Ae({card:i,endpointIdentity:d,credentialRef:c.credentialRef??null,effects:n.effects}));return{agentCard:i,registration:{agentId:n.agentId,displayName:i.name,description:i.description,enabled:!0,executorId:Ce,protocol:"a2a",configurationRevision:A,endpointIdentityHash:yt(d),...c.credentialRef?{credentialRef:c.credentialRef}:{},executorConfig:{agentCardUrl:r.url.href,interfaceUrl:a.url,...a.tenant?{tenant:a.tenant}:{},...c.authentication?{authentication:c.authentication}:{}},skills:c.skillIds,inputModalities:i.defaultInputModes,outputModalities:i.defaultOutputModes,capabilities:{streaming:i.capabilities.streaming?"supported":"unsupported",durableTasks:"supported",inputRequired:"supported",cancellation:"supported",artifacts:"supported"},effects:{remote:n.effects.remote,workspace:"proposal"},health:{status:"healthy",checkedAt:new Date().toISOString()}}}}o(Et,"discoverA2ARegistration");function le(t){return t.metadata??{}}o(le,"metadata");function qe(t){if(t===null||typeof t=="string"||typeof t=="boolean"||typeof t=="number"&&Number.isFinite(t))return t;if(Array.isArray(t))return t.map(qe);if(g(t)){let e={};for(let[n,r]of Object.entries(t))e[n]=qe(r);return e}throw new Error("A2A response metadata must be JSON-safe.")}o(qe,"toAgentJsonValue");function St(t){let e=le(t).directMessage;return e===void 0?void 0:N(e)}o(St,"directMessage");function Gn(t){return{TASK_STATE_UNSPECIFIED:"unknown",TASK_STATE_SUBMITTED:"submitted",TASK_STATE_WORKING:"working",TASK_STATE_COMPLETED:"completed",TASK_STATE_FAILED:"failed",TASK_STATE_CANCELED:"canceled",TASK_STATE_INPUT_REQUIRED:"input-required",TASK_STATE_REJECTED:"rejected",TASK_STATE_AUTH_REQUIRED:"auth-required"}[t]??"unknown"}o(Gn,"taskState");function Le(t){return t.flatMap(e=>e.text===void 0?[]:[e.text]).join(`
+`)}o(Le,"textFromParts");function bt(t,e){let n=t.mediaType??(t.data!==void 0?"application/json":"application/octet-stream"),r=t.raw!==void 0?`data:${n};base64,${t.raw}`:t.data!==void 0?`data:${n};base64,${Buffer.from(JSON.stringify(t.data),"utf8").toString("base64")}`:void 0,i=t.url??r;if(i)return{name:e,...t.mediaType?{mimeType:t.mediaType}:{},...t.raw!==void 0?{size:Buffer.from(t.raw,"base64").byteLength}:{},uri:i,provenance:"a2a"}}o(bt,"partArtifactReference");function Xn(t){let e=t.parts.find(n=>n.url!==void 0||n.raw!==void 0||n.data!==void 0);return e?bt(e,t.name??t.artifactId):void 0}o(Xn,"artifactReference");function ue(t){let e=(t.artifacts??[]).flatMap(i=>Le(i.parts)),n=t.status.message?Le(t.status.message.parts):"",r=[...e,n].filter(Boolean).join(`
+`);return{state:Gn(t.status.state),...r?{output:r}:{},...t.status.state==="TASK_STATE_FAILED"?{error:n||"Remote A2A task failed."}:{},...t.artifacts?.length?{artifacts:t.artifacts.flatMap(i=>Xn(i)??[])}:{}}}o(ue,"snapshotFromTask");function Ue(t){let e=Le(t.parts),n=t.parts.flatMap((r,i)=>{if(r.text!==void 0)return[];let s=bt(r,r.filename??`message-part-${i+1}`);return s?[s]:[]});return{state:"completed",...e?{output:e}:{},...n.length>0?{artifacts:n}:{}}}o(Ue,"snapshotFromMessage");function Rt(t){return t==="completed"||t==="failed"||t==="canceled"||t==="rejected"}o(Rt,"isTerminal");function Qn(t,e,n){let r=t.get(e.artifactId);t.set(e.artifactId,n&&r?{...r,...e,parts:[...r.parts,...e.parts]}:e)}o(Qn,"mergeStreamArtifact");var Se=class{constructor(e,n,r,i,s){this.registration=e;this.context=n;this.options=r;this.oauthTokenManager=i;this.releaseOAuthTokenManager=s}registration;context;options;oauthTokenManager;releaseOAuthTokenManager;static{o(this,"A2AClientExecutor")}#e=!1;#n=new Set;#t=new _e;async preflight(){try{return Q(this.registration),{ok:!0}}catch(e){return{ok:!1,reasons:[e instanceof Error?e.message:String(e)]}}}async start(e){let n=e.idempotencyKey;if(!n)throw new Error("A2A executor requires an idempotency key.");let r=await this.sendMessage({message:{messageId:n,role:"ROLE_USER",parts:[{text:e.input??e.objective,mediaType:"text/plain"}]},configuration:{returnImmediately:!0}});if(g(r.task)){let i=z(r.task);return{idempotencyKey:n,remoteTaskId:i.id,...i.contextId?{metadata:{contextId:i.contextId}}:{}}}if(r.message!==void 0){let i=this.#t.redactMessage(N(r.message));return{idempotencyKey:n,metadata:{directMessage:qe(i)}}}throw new Error("A2A SendMessage returned neither task nor message.")}async*events(e){let n=St(e);if(n){yield await this.authorizeArtifacts(Ue(this.#t.redactMessage(n)));return}if(this.registration.capabilities.streaming==="supported")try{yield*this.streamEvents(e);return}catch(r){if(this.#e)return;V({source:"a2a.client",level:"warn",message:"A2A event stream failed; polling fallback started.",detail:r}),yield{progress:{message:"A2A stream unavailable; polling."}}}for(;!this.#e;){let r=await this.get(e);if(yield r,Rt(r.state)||r.state==="input-required"||r.state==="auth-required")return;await new Promise(i=>setTimeout(i,this.options.pollIntervalMs))}}async get(e){let n=St(e);if(n)return this.authorizeArtifacts(Ue(this.#t.redactMessage(n)));if(!e.remoteTaskId)throw new Error("A2A task reference has no remote task ID.");let r=z(await this.rpc("GetTask",this.taskParams(e)));return this.assertTaskReference(r,e),this.authorizeArtifacts(ue(this.#t.redactTask(r)))}async sendInput(e,n){if(!e.remoteTaskId)throw new Error("Direct A2A responses cannot accept input.");await this.sendMessage({message:{messageId:Oe(),taskId:e.remoteTaskId,...typeof le(e).contextId=="string"?{contextId:le(e).contextId}:{},role:"ROLE_USER",parts:[{text:n.content,mediaType:"text/plain"}]},configuration:{returnImmediately:!0}})}async cancel(e){if(!e.remoteTaskId)return this.get(e);let n=z(await this.rpc("CancelTask",this.taskParams(e)));return this.assertTaskReference(n,e),this.authorizeArtifacts(ue(this.#t.redactTask(n)))}async reconcile(e){return this.get(e)}async dispose(){if(!this.#e){this.#e=!0;try{for(let e of this.#n)e.abort(new Error("A2A executor disposed."))}finally{this.releaseOAuthTokenManager?.()}}}async*streamEvents(e){if(!e.remoteTaskId)throw new Error("A2A stream requires a remote task ID.");let n=Q(this.registration),r=new URL(n.interfaceUrl),i=new Headers({accept:"text/event-stream","a2a-version":"1.0","content-type":"application/json"}),s=new AbortController,a=Oe();this.#n.add(s);let c,d,A=o(()=>{d!==void 0&&clearTimeout(d),d=void 0},"disarmTimeout"),f=o(l=>{A(),d=setTimeout(()=>s.abort(new Error(l)),this.options.networkPolicy.requestTimeoutMs),d.unref?.()},"armTimeout");try{f("A2A stream connection timed out.");let l=await this.openStreamResponse(r,i,s.signal,{jsonrpc:"2.0",id:a,method:"SubscribeToTask",params:this.taskParams(e)}),p=l.response;if(c=l.releaseAuthorization,A(),!p.ok||!p.body)throw new Error(`A2A stream failed with HTTP ${p.status}.`);if(!ot(p.headers.get("content-type")))throw new Error("A2A stream returned an invalid content type.");let h=p.body.getReader(),k=new TextDecoder,w=new Map,y="",T=0;for(;!this.#e;){f("A2A stream was idle for too long.");let m=await h.read();if(A(),m.done)break;if(T+=m.value.byteLength,T>Tt(this.options))throw new Error("A2A stream exceeded the response size limit.");y+=k.decode(m.value,{stream:!0});let S=y.split(/\r?\n\r?\n/);y=S.pop()??"";for(let q of S){let R=q.split(/\r?\n/).filter(j=>j.startsWith("data:")).map(j=>j.slice(5).trimStart()).join(`
+`);if(!R)continue;let O=await this.snapshotFromStreamPayload(Me(R,"A2A stream"),a,e,w);if(O&&(yield O,O.state&&(Rt(O.state)||O.state==="input-required"||O.state==="auth-required")))return}}if(!this.#e)throw new Error("A2A event stream ended before the task reached a stable state.")}catch(l){throw this.#t.redactError(l)}finally{A(),c?.(),this.#n.delete(s)}}async snapshotFromStreamPayload(e,n,r,i){if(!g(e))throw new Error("A2A stream frame is invalid.");if(e.jsonrpc!=="2.0"||e.id!==n)throw new Error("A2A stream frame has an invalid JSON-RPC version or response id.");if(e.error!==void 0){let s=g(e.error)?e.error:{},a=typeof s.message=="string"?s.message:"A2A stream error.";throw new u(typeof s.code=="number"?s.code:-32603,this.#t.redactText(a))}if(g(e.result)){if(e.result.task!==void 0){let s=z(e.result.task);this.assertTaskReference(s,r),i.clear();for(let a of s.artifacts??[])i.set(a.artifactId,a);return this.authorizeArtifacts(ue(this.#t.redactTask(s)))}if(e.result.message!==void 0){let s=N(e.result.message);if(s.taskId!==void 0&&s.taskId!==r.remoteTaskId)throw new Error("A2A stream message belongs to a different task.");return this.authorizeArtifacts(Ue(this.#t.redactMessage(s)))}if(g(e.result.statusUpdate)&&g(e.result.statusUpdate.status)){this.assertStreamTaskScope(e.result.statusUpdate,r);let s=z({id:r.remoteTaskId,contextId:e.result.statusUpdate.contextId,status:e.result.statusUpdate.status,...i.size>0?{artifacts:[...i.values()]}:{}});return this.authorizeArtifacts(ue(this.#t.redactTask(s)))}if(g(e.result.artifactUpdate)&&e.result.artifactUpdate.artifact!==void 0){this.assertStreamTaskScope(e.result.artifactUpdate,r);let s=z({id:r.remoteTaskId,contextId:e.result.artifactUpdate.contextId,status:{state:"TASK_STATE_WORKING"},artifacts:[e.result.artifactUpdate.artifact]}),a=s.artifacts?.[0];if(!a)throw new Error("A2A artifact update has no artifact.");Qn(i,a,e.result.artifactUpdate.append===!0);let c={...s,artifacts:[...i.values()]};return this.authorizeArtifacts(ue(this.#t.redactTask(c)))}}}async authorizeArtifacts(e){for(let n of e.artifacts??[])await this.context.authorizeArtifact(n);return e}assertTaskReference(e,n){if(e.id!==n.remoteTaskId)throw new Error("A2A response belongs to a different task id.");let r=le(n).contextId;if(typeof r=="string"&&e.contextId&&e.contextId!==r)throw new Error("A2A response belongs to a different task context.")}assertStreamTaskScope(e,n){if(typeof e.taskId!="string"||e.taskId!==n.remoteTaskId)throw new Error("A2A stream event belongs to a different task.");let r=le(n).contextId;if(typeof e.contextId!="string"||typeof r=="string"&&e.contextId!==r)throw new Error("A2A stream event belongs to a different task context.")}async openStreamResponse(e,n,r,i){let s=o(a=>{let c=new Headers(n);return a&&c.set("authorization",a),Pe(e,{method:"POST",headers:c,redirect:"manual",signal:r,body:JSON.stringify(i)},this.options.networkPolicy,this.options.fetch)},"open");return this.withAuthorization(async a=>{let c=this.#t.retain(a);try{let d=await s(a);if(d.status===401)throw await d.body?.cancel(),new u(-32600,"A2A authentication was rejected.",401);return{response:d,releaseAuthorization:c}}catch(d){throw c(),d}})}taskParams(e){let n=Q(this.registration);return{id:e.remoteTaskId,...n.tenant?{tenant:n.tenant}:{}}}async sendMessage(e){let n=await this.rpc("SendMessage",{...e,...Q(this.registration).tenant?{tenant:Q(this.registration).tenant}:{}});if(!g(n))throw new Error("A2A SendMessage result is invalid.");return n}async rpc(e,n){if(this.#e)throw new Error("A2A executor is disposed.");return this.withAuthorization(r=>this.rpcWithAuthorization(e,n,r))}redactRpcResult(e,n){return e==="GetTask"||e==="CancelTask"?this.#t.redactTask(z(n)):e!=="SendMessage"||!g(n)?n:{...n,...n.task===void 0?{}:{task:this.#t.redactTask(z(n.task))},...n.message===void 0?{}:{message:this.#t.redactMessage(N(n.message))}}}async withAuthorization(e){let n=Q(this.registration).authentication;if(!n){if(this.options.authorization!==void 0&&!ke(this.options.authorization))throw new Error("A2A options.authorization must be a valid Bearer authorization.");let c=this.#t.retain(this.options.authorization);try{return await e(this.options.authorization)}catch(d){throw this.#t.redactError(d)}finally{c()}}let r=this.registration.credentialRef;if(!r)throw new Error("Authenticated A2A registration has no credential reference.");let i=o(c=>this.context.withCredential(r,async d=>{let A,f;try{return A=n.type==="http-bearer"?`Bearer ${d}`:await this.requireOAuthTokenManager().getAuthorization(d),f=this.#t.retain(A),{ok:!0,value:await e(A)}}catch(l){if(c&&n.type==="oauth2-client-credentials"&&l instanceof u&&l.httpStatus===401&&A!==void 0)return{ok:!1,rejectedAuthorization:A};throw this.#t.redactError(l)}finally{f?.()}}),"execute"),s=await i(n.type==="oauth2-client-credentials");if(s.ok)return s.value;this.requireOAuthTokenManager().invalidate(s.rejectedAuthorization);let a=await i(!1);if(!a.ok)throw new Error("A2A OAuth2 retry did not produce a result.");return a.value}requireOAuthTokenManager(){if(!this.oauthTokenManager)throw new Error("A2A OAuth2 token manager is unavailable.");return this.oauthTokenManager}async rpcWithAuthorization(e,n,r){let i=Q(this.registration),s=new Headers({accept:"application/json","a2a-version":"1.0","content-type":"application/json"});r&&s.set("authorization",r);let a=Oe(),c=await G(new URL(i.interfaceUrl),{method:"POST",headers:s,body:JSON.stringify({jsonrpc:"2.0",id:a,method:e,params:n})},Vn(this.options),this.options.fetch);if(c.response.status===401)throw new u(-32600,"A2A authentication was rejected.",401);if(!de(c.response.headers.get("content-type")))throw new Error("A2A JSON-RPC response has an invalid content type.");let d=Me(X(c.body),"A2A endpoint");if(!g(d))throw new Error("A2A JSON-RPC response is invalid.");if(d.jsonrpc!=="2.0"||d.id!==a)throw new Error("A2A JSON-RPC response has an invalid version or response id.");let A=Object.hasOwn(d,"result"),f=Object.hasOwn(d,"error");if(A===f)throw new Error("A2A JSON-RPC response must contain exactly one result or error.");if(f)throw!g(d.error)||typeof d.error.code!="number"||typeof d.error.message!="string"?new Error("A2A JSON-RPC error response is invalid."):new u(d.error.code,this.#t.redactText(d.error.message),c.response.status,this.#t.redactContent(d.error.data));if(!c.response.ok)throw new Error(`A2A request failed with HTTP ${c.response.status}.`);return this.redactRpcResult(e,d.result)}};function xt(t){let e=new Map;return{executorId:Ce,protocol:"a2a",async create(n,r){let i=typeof t=="function"?t(n):t,s=Q(n),a=s.authentication,c={...i,networkPolicy:wt(i.networkPolicy,s.interfaceUrl)},d;if(a?.type==="oauth2-client-credentials"){let p=wt(i.networkPolicy,a.tokenUrl),h=Ae({authentication:a,credentialRef:n.credentialRef??"",networkPolicy:p}),k=e.get(n.agentId);if(d=k?.key===h&&k.fetch===i.fetch?k:void 0,!d){let w=ht({issuer:a.issuer,tokenUrl:a.tokenUrl,clientId:a.clientId,scopes:a.scopes,...a.resource?{resource:a.resource}:{},clientAuthenticationMethod:a.clientAuthentication==="client-secret-post"?"post":"basic",networkPolicy:p,...i.fetch?{fetch:i.fetch}:{}});d={key:h,fetch:i.fetch,manager:w,references:0},e.set(n.agentId,d)}}if(!d)return new Se(n,r,c);let A=d;A.references+=1;let f=!1,l=o(()=>{f||(f=!0,A.references-=1,A.references===0&&(A.manager.invalidate(),e.get(n.agentId)===A&&e.delete(n.agentId)))},"releaseOAuthTokenManager");return new Se(n,r,c,A.manager,l)}}}o(xt,"createA2AAgentExecutorFactory");import{createHash as er,randomUUID as fe}from"node:crypto";import W from"node:fs";import{createServer as tr}from"node:http";import E from"node:path";import{Readable as vt}from"node:stream";import{createHash as Zn}from"node:crypto";var Z="realm-subject-tenant-v1";function It(t){return Zn("sha256").update(t).digest("hex")}o(It,"sha256");function Ct(t){return It(`${t.subject}\0${t.tenant??""}`)}o(Ct,"legacyA2APrincipalKey");function Re(t){return It(JSON.stringify([t.securityRealm,t.subject,t.tenant??null]))}o(Re,"realmA2APrincipalKey");import _ from"node:fs";import $e from"node:path";function Y(t){return structuredClone(t)}o(Y,"clone");function Yn(t){if(!g(t))throw new Error("A2A task store record must be an object.");for(let n of["taskId","contextId","principalKey","runtimeIdentity","sessionId","createdAt","updatedAt"])if(typeof t[n]!="string")throw new Error(`A2A task store record has invalid ${n}.`);if(!g(t.messageDigests)||!Object.values(t.messageDigests).every(n=>typeof n=="string"))throw new Error("A2A task store message digests are invalid.");if(!Array.isArray(t.runIds)||!t.runIds.every(n=>typeof n=="string"))throw new Error("A2A task store run IDs are invalid.");if(!Array.isArray(t.history))throw new Error("A2A task store history is invalid.");if(t.principalKeyScheme!==void 0&&t.principalKeyScheme!==Z)throw new Error("A2A task store principal key scheme is unsupported.");if(!Number.isSafeInteger(t.eventSeq)||!Number.isSafeInteger(t.lastRuntimeEventSeq))throw new Error("A2A task store event cursors are invalid.");let e=t.pendingUserInput;if(e!==void 0&&(!g(e)||typeof e.requestId!="string"||!Number.isSafeInteger(e.revision)||typeof e.runId!="string"||typeof e.kind!="string"))throw new Error("A2A task store pending user input is invalid.");if(t.acceptedOutputModes!==void 0&&(!Array.isArray(t.acceptedOutputModes)||!t.acceptedOutputModes.every(n=>typeof n=="string")))throw new Error("A2A task store accepted output modes are invalid.");return{taskId:t.taskId,contextId:t.contextId,principalKey:t.principalKey,...t.principalKeyScheme===Z?{principalKeyScheme:Z}:{},runtimeIdentity:t.runtimeIdentity,sessionId:t.sessionId,...typeof t.workspaceRoot=="string"?{workspaceRoot:t.workspaceRoot}:{},...typeof t.executionPolicyRevision=="string"?{executionPolicyRevision:t.executionPolicyRevision}:{},messageDigests:t.messageDigests,runIds:t.runIds,task:z(t.task),history:t.history.map(N),createdAt:t.createdAt,updatedAt:t.updatedAt,eventSeq:t.eventSeq,lastRuntimeEventSeq:t.lastRuntimeEventSeq,runtimeEventCount:Number.isSafeInteger(t.runtimeEventCount)?t.runtimeEventCount:0,runtimeEventBytes:Number.isSafeInteger(t.runtimeEventBytes)?t.runtimeEventBytes:0,...t.acceptedOutputModes!==void 0?{acceptedOutputModes:t.acceptedOutputModes}:{},...e!==void 0?{pendingUserInput:{requestId:e.requestId,revision:e.revision,runId:e.runId,kind:e.kind}}:{}}}o(Yn,"parseRecord");var oe=class{static{o(this,"A2AFileTaskStore")}#e=new Map;#n=new Map;#t;#r;#i;constructor(e){let n=$e.resolve(e);_.mkdirSync(n,{recursive:!0,mode:448}),this.#t=$e.join(n,"tasks.json"),this.#r=$e.join(n,".server.lock"),this.#i=this.acquireLock();try{this.load()}catch(r){throw _.closeSync(this.#i),_.rmSync(this.#r,{force:!0}),r}}get(e){let n=this.#e.get(e);return n?Y(n):void 0}findByMessage(e,n){for(let r of this.#e.values())if(r.principalKey===e&&r.messageDigests[n]!==void 0)return Y(r)}list(e){return[...this.#e.values()].filter(n=>n.principalKey===e).sort((n,r)=>r.updatedAt.localeCompare(n.updatedAt)||r.taskId.localeCompare(n.taskId)).map(Y)}all(){return[...this.#e.values()].map(Y)}save(e){let n=Y(e),r=this.#e.get(e.taskId);this.#e.set(e.taskId,n);try{this.persist()}catch(i){throw r?this.#e.set(e.taskId,r):this.#e.delete(e.taskId),i}for(let i of this.#n.get(e.taskId)??[])i(Y(n));return Y(n)}pruneTerminal(e,n){let r=[...this.#e.values()].filter(s=>s.principalKey===e).sort((s,a)=>s.updatedAt.localeCompare(a.updatedAt)),i=[];for(;r.length>n;){let s=r.findIndex(c=>c.task.status.state==="TASK_STATE_COMPLETED"||c.task.status.state==="TASK_STATE_FAILED"||c.task.status.state==="TASK_STATE_CANCELED"||c.task.status.state==="TASK_STATE_REJECTED");if(s<0)break;let[a]=r.splice(s,1);if(!a)break;this.#e.delete(a.taskId),this.#n.delete(a.taskId),i.push(Y(a))}return i.length>0&&this.persist(),i}migrateUnversionedPrincipalKeys(e){let n=0,r=0,i=0,s=[];for(let[a,c]of this.#e){if(c.principalKeyScheme!==void 0)continue;let d=e.legacyToCurrent.get(c.principalKey);d!==void 0?(n+=1,s.push([a,{...c,principalKey:d,principalKeyScheme:Z}])):e.currentKeys.has(c.principalKey)?(r+=1,s.push([a,{...c,principalKeyScheme:Z}])):i+=1}if(e.apply&&s.length>0){for(let[a,c]of s)this.#e.set(a,c);this.persist()}return{matchedLegacyTaskCount:n,matchedCurrentTaskCount:r,unmatchedUnversionedTaskCount:i}}subscribe(e,n){let r=this.#n.get(e)??new Set;return r.add(n),this.#n.set(e,r),()=>{r.delete(n),r.size===0&&this.#n.delete(e)}}close(){this.#n.clear(),_.closeSync(this.#i),_.rmSync(this.#r,{force:!0})}acquireLock(){let e=o(()=>{let n=_.openSync(this.#r,"wx",384);return _.writeFileSync(n,`${process.pid}
+`,"utf8"),_.fsyncSync(n),n},"attempt");try{return e()}catch(n){let r=!1;try{let i=Number.parseInt(_.readFileSync(this.#r,"utf8").trim(),10);if(Number.isSafeInteger(i)&&i>0)try{process.kill(i,0)}catch(s){r=s.code==="ESRCH"}}catch{r=!1}if(!r)throw new Error("A2A task store is already owned by another server.",{cause:n});return _.rmSync(this.#r,{force:!0}),e()}}load(){if(!_.existsSync(this.#t))return;let e;try{e=JSON.parse(_.readFileSync(this.#t,"utf8"))}catch(n){throw new Error(`Failed to read A2A task store: ${n instanceof Error?n.message:String(n)}`)}if(!Array.isArray(e))throw new Error("A2A task store root must be an array.");for(let n of e){let r=Yn(n);this.#e.set(r.taskId,r)}}persist(){let e=`${this.#t}.${process.pid}.tmp`;_.writeFileSync(e,`${JSON.stringify([...this.#e.values()],null,2)}
+`,{encoding:"utf8",mode:384}),_.renameSync(e,this.#t)}};var M=new Set(["TASK_STATE_COMPLETED","TASK_STATE_FAILED","TASK_STATE_CANCELED","TASK_STATE_REJECTED"]),nr=new Set(["TASK_STATE_UNSPECIFIED","TASK_STATE_SUBMITTED","TASK_STATE_WORKING","TASK_STATE_COMPLETED","TASK_STATE_FAILED","TASK_STATE_CANCELED","TASK_STATE_INPUT_REQUIRED","TASK_STATE_REJECTED","TASK_STATE_AUTH_REQUIRED"]),rr=new Set(["CreateTaskPushNotificationConfig","GetTaskPushNotificationConfig","ListTaskPushNotificationConfigs","DeleteTaskPushNotificationConfig"]),ir=4,sr=8,or=24*1024*1024;function x(t){return t().toISOString()}o(x,"nowIso");function J(t){return er("sha256").update(t).digest("hex")}o(J,"sha256");function Ne(t){let e=t.securityRealm;if(typeof e!="string"||e.trim().length===0)throw new Error("A2A authentication.securityRealm must be a non-empty stable string.");return e}o(Ne,"securityRealm");function _t(t){let e=t.toLowerCase().replace(/^\[|\]$/g,"");return e==="localhost"||e==="127.0.0.1"||e==="::1"}o(_t,"isLoopbackHostname");function ar(t){let e=new URL(t);if(e.protocol!=="https:"&&!(e.protocol==="http:"&&_t(e.hostname)))throw new Error("Published A2A base URL must use HTTPS, except on loopback.");if(e.username||e.password)throw new Error("Published A2A base URL must not contain credentials.");return e}o(ar,"validateBaseUrl");function cr(t){let n={SendMessage:"send-message",SendStreamingMessage:"send-streaming-message",GetTask:"get-task",ListTasks:"list-tasks",CancelTask:"cancel-task",SubscribeToTask:"subscribe-to-task",GetExtendedAgentCard:"get-extended-agent-card"}[t];if(!n)throw new u(-32601,"Method not found.");return n}o(cr,"operationForMethod");function dr(t){return{queued:"TASK_STATE_SUBMITTED",running:"TASK_STATE_WORKING",waiting_permission:"TASK_STATE_WORKING",waiting_user_input:"TASK_STATE_INPUT_REQUIRED",completed:"TASK_STATE_COMPLETED",failed:"TASK_STATE_FAILED",cancelled:"TASK_STATE_CANCELED",interrupted:"TASK_STATE_FAILED"}[t]}o(dr,"statusState");function ze(t,e,n){return{messageId:fe(),taskId:t,contextId:e,role:"ROLE_AGENT",parts:[{text:n,mediaType:"text/plain"}]}}o(ze,"agentMessage");function ur(t){let e=ar(t);return e.pathname=`${e.pathname.replace(/\/$/,"")}/a2a`,e.search="",e.hash="",e.href}o(ur,"interfaceUrl");function De(t,e){if(t!==void 0){if(!Number.isSafeInteger(t)||t<0)throw new u(-32602,`${e} must be a non-negative integer.`);return t}}o(De,"parseHistoryLength");function Ke(t){if(typeof t?.id!="string"||t.id.length===0)throw new u(-32602,"Task id is required.");return t.id}o(Ke,"requiredTaskId");function lr(t){if(!(!g(t)||typeof t.label!="string"||typeof t.value!="string"))return{label:t.label,value:t.value,...typeof t.description=="string"?{description:t.description}:{}}}o(lr,"publicInputOption");function Pt(t){if(!g(t)||typeof t.question!="string")return;let e=Array.isArray(t.options)?t.options.flatMap(n=>{let r=lr(n);return r?[r]:[]}):void 0;return{question:t.question,...typeof t.header=="string"?{header:t.header}:{},...typeof t.kind=="string"?{kind:t.kind}:{},...e?{options:e}:{},...typeof t.multiSelect=="boolean"?{multiSelect:t.multiSelect}:{},...Number.isSafeInteger(t.minSelections)?{minSelections:t.minSelections}:{},...Number.isSafeInteger(t.maxSelections)?{maxSelections:t.maxSelections}:{},...typeof t.allowCustomInput=="boolean"?{allowCustomInput:t.allowCustomInput}:{},...typeof t.customInputLabel=="string"?{customInputLabel:t.customInputLabel}:{},...typeof t.customInputPrompt=="string"?{customInputPrompt:t.customInputPrompt}:{}}}o(Pt,"publicInputQuestion");function Ar(t){return g(t)?Array.isArray(t.questions)?{questions:t.questions.flatMap(n=>{let r=Pt(n);return r?[r]:[]})}:Pt(t)??{}:{}}o(Ar,"publicInputOptions");function pr(t,e,n){if(!g(n.payload)||typeof n.payload.kind!="string")return;let r=Ar(n.payload.options),i="";try{i=JSON.stringify(r)}catch{i="{}"}let s=i.length>4096?`${i.slice(0,4093)}...`:i;return{...ze(t,e,`Input required (${n.payload.kind}): ${s}`),metadata:{"kodax.ai/user-input":{kind:n.payload.kind,options:r}}}}o(pr,"pendingInputMessage");function fr(t,e){let n=t.parts.find(i=>i.data!==void 0)?.data;if(n!==void 0)return n;let r=t.parts.flatMap(i=>i.text===void 0?[]:[i.text]).join(`
+`);if(e==="askUserMulti"||r.startsWith("[")||r.startsWith("{"))try{return JSON.parse(r)}catch{}return r}o(fr,"continuationAnswer");function Ot(t,e){let n=E.relative(t,e);return n===""||!n.startsWith(`..${E.sep}`)&&n!==".."&&!E.isAbsolute(n)}o(Ot,"isInside");function hr(t){return{".csv":"text/csv",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".json":"application/json",".pdf":"application/pdf",".pptx":"application/vnd.openxmlformats-officedocument.presentationml.presentation",".txt":"text/plain",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"}[E.extname(t).toLowerCase()]??"application/octet-stream"}o(hr,"artifactMediaType");function gr(t,e,n){let r=t.workspaceRoot??n.agent.projectPath;if(!r||!e.result?.artifactLedger)return[];let i;try{i=W.realpathSync(r)}catch{return[]}let s=new Set,a=[];for(let c of e.result.artifactLedger){if(c.kind!=="file_created"&&c.kind!=="file_modified"||typeof c.target!="string")continue;let d=E.isAbsolute(c.target)?c.target:E.resolve(r,c.target),A=E.relative(r,d),f=A.split(E.sep).includes(".kodax-a2a-staging"),l=c.sourceTool==="run_skill_script"&&c.action==="promote_output";if(!Ot(r,d)||!f&&!l)continue;let p,h,k;try{if(p=W.lstatSync(d),h=W.realpathSync(d),!p.isFile()||p.isSymbolicLink()||!Ot(i,h)||s.has(h)||p.size>n.limits.maxPartBytes)continue;k=W.readFileSync(h)}catch{continue}if(k.byteLength>n.limits.maxPartBytes)continue;let w=hr(d);(t.acceptedOutputModes??n.agent.outputModes).includes(w)&&(s.add(h),a.push({artifactId:`file-${J(`${t.taskId}\0${A}\0${k.byteLength}\0${p.mtimeMs}`).slice(0,24)}`,name:E.basename(d),description:l?"KodaX Skill task output":"KodaX staged task output",parts:[{raw:k.toString("base64"),filename:E.basename(d),mediaType:w}]}))}return a}o(gr,"stagedArtifacts");function mr(t,e,n){let r=t;for(let i of[e.workspaceRoot,n.agent.projectPath,E.resolve(n.dataDir)])i&&(r=r.split(i).join("[redacted-path]"),r=r.split(i.replaceAll("\\","/")).join("[redacted-path]"));return r}o(mr,"safeTaskText");function je(t,e=t.agent.publicBaseUrl){let n=ur(e),r={name:t.agent.name,description:t.agent.description,supportedInterfaces:[{url:n,protocolBinding:"JSONRPC",protocolVersion:"1.0"}],version:t.agent.version,capabilities:{streaming:!0,pushNotifications:!1,extendedAgentCard:t.extendedAgentCard!==void 0},securitySchemes:t.authentication.securitySchemes,securityRequirements:t.authentication.securityRequirements,defaultInputModes:t.agent.inputModes,defaultOutputModes:t.agent.outputModes,skills:t.agent.skills};F(r.securitySchemes,r.securityRequirements);for(let i of r.skills)F(r.securitySchemes,i.securityRequirements);return r}o(je,"buildCard");function yr(t,e){if(t===null)return!1;let n=e.replace(/^W\//iu,"");return t.split(",").some(r=>{let i=r.trim();return i==="*"||i.replace(/^W\//iu,"")===n})}o(yr,"matchesIfNoneMatch");function he(t,e=200,n){return new Response(JSON.stringify(t),{status:e,headers:{"content-type":"application/json; charset=utf-8",...n}})}o(he,"jsonResponse");async function wr(t,e){let n=Number(t.headers.get("content-length"));if(Number.isFinite(n)&&n>e)throw new u(-32600,"A2A request exceeds the configured limit.",413);if(!t.body)return new Uint8Array;let r=[],i=0,s=t.body.getReader();for(;;){let d=await s.read();if(d.done)break;if(i+=d.value.byteLength,i>e)throw await s.cancel("A2A request size limit exceeded."),new u(-32600,"A2A request exceeds the configured limit.",413);r.push(d.value)}let a=new Uint8Array(i),c=0;for(let d of r)a.set(d,c),c+=d.byteLength;return a}o(wr,"readBoundedBody");function pe(t,e){return he({jsonrpc:"2.0",id:t,result:e})}o(pe,"rpcResult");function kr(t,e){let r={[-32001]:"TASK_NOT_FOUND",[-32002]:"TASK_NOT_CANCELABLE",[-32003]:"PUSH_NOTIFICATION_NOT_SUPPORTED",[-32004]:"UNSUPPORTED_OPERATION",[-32005]:"CONTENT_TYPE_NOT_SUPPORTED",[-32006]:"INVALID_AGENT_RESPONSE",[-32007]:"EXTENDED_AGENT_CARD_NOT_CONFIGURED",[-32008]:"EXTENSION_SUPPORT_REQUIRED",[-32009]:"VERSION_NOT_SUPPORTED"}[e.code],i=e.data??(r?[{"@type":"type.googleapis.com/google.rpc.ErrorInfo",reason:r,domain:"a2a-protocol.org"}]:void 0);return he({jsonrpc:"2.0",id:t,error:{code:e.code,message:e.message,...i!==void 0?{data:i}:{}}},e.httpStatus,e.headers)}o(kr,"rpcError");function Ut(t){return J(JSON.stringify(t))}o(Ut,"messageDigest");function Sr(t){return t.text!==void 0?Buffer.byteLength(t.text):t.raw!==void 0?Buffer.byteLength(t.raw,"base64"):t.url!==void 0?Buffer.byteLength(t.url):Buffer.byteLength(JSON.stringify(t.data))}o(Sr,"partBytes");function Mt(t){return t.mediaType??(t.text!==void 0?"text/plain":t.data!==void 0?"application/json":"application/octet-stream")}o(Mt,"partMediaType");function qt(t){if(!W.existsSync(t))return 0;let e=0;for(let n of W.readdirSync(t,{withFileTypes:!0})){let r=E.join(t,n.name);n.isSymbolicLink()||(n.isDirectory()?e+=qt(r):n.isFile()&&(e+=W.statSync(r).size))}return e}o(qt,"directoryBytes");function Rr(t,e,n){if(t.role!=="ROLE_USER")throw new u(-32602,"Inbound message role must be ROLE_USER.");for(let r of t.parts){if(Sr(r)>e)throw new u(-32602,"Message Part exceeds the configured limit.");if(r.url!==void 0)throw new u(-32602,"Remote file URLs are not accepted by this server.");if(r.raw!==void 0&&!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(r.raw))throw new u(-32602,"Message Part raw content is not valid base64.");let i=Mt(r);if(!n.includes(i))throw new u(-32005,`Media type ${i} is not supported.`)}}o(Rr,"validateInput");function Be(t,e,n){if(n===0){let{history:i,...s}=t;return s}let r=n===void 0?e:e.slice(-n);return{...t,history:r}}o(Be,"withHistory");function Tr(t){if(!t)return;let e;try{e=JSON.parse(Buffer.from(t,"base64url").toString("utf8"))}catch{throw new u(-32602,"Invalid page token.")}if(!g(e)||typeof e.updatedAt!="string"||!Number.isFinite(Date.parse(e.updatedAt))||typeof e.taskId!="string"||e.taskId.length===0)throw new u(-32602,"Invalid page token.");return{updatedAt:e.updatedAt,taskId:e.taskId}}o(Tr,"parseTaskListCursor");function Er(t){return Buffer.from(JSON.stringify({updatedAt:t.updatedAt,taskId:t.taskId})).toString("base64url")}o(Er,"encodeTaskListCursor");function br(t,e){let n=t.updatedAt.localeCompare(e.updatedAt);return n<0||n===0&&t.taskId.localeCompare(e.taskId)<0}o(br,"followsTaskListCursor");var Te=class{constructor(e){this.options=e;Ne(e.authentication),this.#n=e.now??(()=>new Date),this.#e=new oe(e.dataDir),this.#o=je(e),this.#c=this.recover()}options;static{o(this,"KodaXA2AServerRuntime")}#e;#n;#t=new Map;#r=new Set;#i=new Map;#a=new Map;#p=new Set;#c;#d=0;#u;#f=0;#l=!1;#s=!1;#A;#o;#h;get agentCard(){return structuredClone(this.#o)}async whenReady(){await this.#c}updateHot(e){if(this.#l||this.#s)throw new Error("A2A server is closed.");Ne(e.authentication);let n={...this.options,...e},r=je(n,e.agent.publicBaseUrl);this.options=n,this.#o=r}handle(e){if(this.#l||this.#s)return Promise.resolve(he({error:"A2A server is closed."},503));let n=o(()=>{},"release"),r=new Promise(i=>{n=i});return this.#p.add(r),this.handleAdmitted(e).finally(()=>{this.#p.delete(r),n()})}async handleAdmitted(e){await this.#c;let n=new URL(e.url);if(e.method==="GET"&&n.pathname==="/.well-known/agent-card.json"){let r=JSON.stringify(this.#o),i=`"${J(r)}"`,s={etag:i,"cache-control":"no-cache"};return yr(e.headers.get("if-none-match"),i)?new Response(null,{status:304,headers:s}):he(this.#o,200,s)}return e.method!=="POST"||n.pathname!=="/"&&n.pathname!=="/a2a"?he({error:"Not found."},404):this.handleRpc(e)}async listen(e){if(this.#l||this.#s)throw new Error("A2A server is closed.");if(this.#u)throw new Error("A2A server is already listening.");if(!_t(e.hostname))throw new Error("The built-in A2A HTTP listener is loopback-only; use handle() behind TLS for public service.");let n=tr((s,a)=>{this.handleNodeRequest(s).then(c=>{if(a.statusCode=c.status,c.headers.forEach((f,l)=>a.setHeader(l,f)),!c.body){a.end();return}let d=vt.fromWeb(c.body),A=o(()=>{d.destroy()},"closeBody");a.once("close",A),d.once("close",()=>a.off("close",A)),d.once("error",()=>{a.destroyed||a.destroy()}),d.pipe(a)}).catch(c=>{let d=J(ge(c)).slice(0,16);this.emit({type:"server.request_failed",time:x(this.#n),outcome:"failed",diagnosticId:d}),a.statusCode=500,a.setHeader("content-type","application/json; charset=utf-8"),a.end(JSON.stringify({error:"Internal server error.",diagnosticId:d}))})});this.#u=n,await new Promise((s,a)=>{n.once("error",a),n.listen(e.port,e.hostname,s)});let r=n.address();if(!r||typeof r=="string")throw new Error("A2A server did not expose a TCP address.");let i=`http://${e.hostname}:${r.port}`;return this.#h=e.publicBaseUrl??i,this.#o=je(this.options,this.#h),i}close(){if(this.#A)return this.#A;this.#l=!0;let e=this.#u;this.#u=void 0;let n=e?new Promise((r,i)=>e.close(s=>s?i(s):r())):Promise.resolve();return this.#A=this.closeAdmittedWork(n),this.#A}async closeAdmittedWork(e){let n=[];try{await this.#c}catch(r){n.push(r)}await Promise.all([...this.#p]),this.#s=!0;for(let r of[...this.#r])try{r()}catch(i){n.push(i)}this.#r.clear();for(let r of this.#t.values())try{r.close()}catch(i){n.push(i)}this.#t.clear();try{await e}catch(r){n.push(r)}try{this.#e.close()}catch(r){n.push(r)}try{await this.options.preparedExecution?.close()}catch(r){n.push(r)}if(n.length===1)throw n[0];if(n.length>1)throw new AggregateError(n,"A2A server close failed.")}async handleNodeRequest(e){let r=`http://${e.headers.host??"127.0.0.1"}${e.url??"/"}`,i=new Headers;for(let[a,c]of Object.entries(e.headers))if(typeof c=="string")i.set(a,c);else for(let d of c??[])i.append(a,d);let s={method:e.method,headers:i,...e.method==="GET"||e.method==="HEAD"?{}:{body:vt.toWeb(e)},duplex:"half"};return this.handle(new Request(r,s))}async handleRpc(e){let n=this.options,r=null;try{if((e.headers.get("a2a-version")??new URL(e.url).searchParams.get("A2A-Version"))!=="1.0")throw new u(-32009,"A2A version is not supported.");if(!de(e.headers.get("content-type")))throw new u(-32600,"A2A JSON-RPC requests require application/json.",415);let s=await n.authentication.authenticate(e);if(!s)throw new u(-32600,"Authentication required.",401,void 0,{"www-authenticate":"Bearer"});let a=await wr(e,n.limits.maxRequestBytes),c;try{c=JSON.parse(new TextDecoder().decode(a))}catch{throw new u(-32700,"Invalid JSON payload.")}let d=ut(c);if(r=d.id,rr.has(d.method))throw new u(-32003,"Push notifications are not supported.");let A=cr(d.method),f=d.method==="SendMessage"||d.method==="SendStreamingMessage"?N(d.params?.message):void 0,l=typeof d.params?.id=="string"?d.params.id:f?.taskId,p=f?.contextId,h=f?[...new Set(f.parts.map(Mt))]:void 0;if(!await n.authorize({principal:s,operation:A,...l?{taskId:l}:{},...p?{contextId:p}:{},...h?{inputModes:h}:{}}))throw new u(-32001,"Task not found.");return await this.dispatch(d,s,n)}catch(i){let s=J(ge(i)).slice(0,16),a=i instanceof u?i:new u(-32603,"Internal error.",500,[{"@type":"type.googleapis.com/google.rpc.ErrorInfo",reason:"INTERNAL",domain:"kodax.ai",metadata:{diagnosticId:s}}]);return this.emit({type:"rpc.failed",time:x(this.#n),outcome:"failed",diagnosticId:s}),kr(r,a)}}async dispatch(e,n,r){let i=Re({securityRealm:Ne(r.authentication),subject:n.subject,...n.tenant!==void 0?{tenant:n.tenant}:{}});switch(e.method){case"SendMessage":return pe(e.id,{task:await this.sendMessage(e.params,i,!1,r)});case"SendStreamingMessage":{let s=await this.sendMessage(e.params,i,!0,r);return this.streamTask(e.id,s.id,i)}case"GetTask":return pe(e.id,await this.getTask(e.params,i));case"ListTasks":return pe(e.id,this.listTasks(e.params,i));case"CancelTask":return pe(e.id,await this.cancelTask(e.params,i,r));case"SubscribeToTask":return this.subscribeTask(e.id,e.params,i);case"GetExtendedAgentCard":{if(!r.extendedAgentCard)throw new u(-32004,"Extended Agent Card is not supported.");return pe(e.id,r.extendedAgentCard)}default:throw new u(-32601,"Method not found.")}}async sendMessage(e,n,r,i){let s=this.#a.get(n)??Promise.resolve(),a=o(()=>{},"release"),c=new Promise(d=>{a=d});this.#a.set(n,c),await s;try{return await this.sendMessageUnserialized(e,n,r,i)}finally{a(),this.#a.get(n)===c&&this.#a.delete(n)}}async sendMessageUnserialized(e,n,r,i){let s=N(e?.message);if(Rr(s,i.limits.maxPartBytes,i.agent.inputModes),e?.configuration!==void 0&&!g(e.configuration))throw new u(-32602,"SendMessage configuration must be an object.");let a=g(e?.configuration)?e.configuration:{},c=De(a.historyLength,"SendMessage historyLength");if(a.returnImmediately!==void 0&&typeof a.returnImmediately!="boolean")throw new u(-32602,"SendMessage returnImmediately must be a boolean.");if(a.taskPushNotificationConfig!==void 0)throw new u(-32003,"Push notifications are not supported.");if(a.acceptedOutputModes!==void 0){if(!Array.isArray(a.acceptedOutputModes)||!a.acceptedOutputModes.every(p=>typeof p=="string"))throw new u(-32602,"SendMessage acceptedOutputModes must be a string array.");if(!a.acceptedOutputModes.some(p=>i.agent.outputModes.includes(p)))throw new u(-32005,"No requested output media type is supported.")}let d=await this.admitMessage(s,n,i,a.acceptedOutputModes);if(d.runtimeEventsAttached)try{await d.runtimeEventsAttached}catch(p){throw this.failTask(d.record.taskId,"Task could not be started.",i),p}let A=this.#e.get(d.record.taskId)??d.record,l=d.duplicate||r||a.returnImmediately===!0?A:await this.waitForTask(A.taskId,i.limits.maxTaskWaitMs??3e4);return Be(l.task,l.history,c)}async admitMessage(e,n,r,i){let s=Ut(e),a=this.#e.findByMessage(n,e.messageId);if(a){if(a.messageDigests[e.messageId]!==s)throw new u(-32602,"Message ID was reused with different content.");return this.emit({type:"task.deduplicated",time:x(this.#n),taskId:a.taskId,contextId:a.contextId}),{record:a,duplicate:!0}}let c=e.taskId?this.requireOwnedTask(e.taskId,n):void 0;if(c&&e.contextId!==void 0&&e.contextId!==c.contextId)throw new u(-32602,"Message contextId does not match the task.");if(c&&c.task.status.state!=="TASK_STATE_INPUT_REQUIRED"&&c.task.status.state!=="TASK_STATE_AUTH_REQUIRED")throw new u(-32004,"Task is not waiting for input.");let d=r.limits.maxRetainedTasksPerPrincipal??r.limits.maxTasksPerPrincipal??100;c||this.#e.pruneTerminal(n,Math.max(0,d-1));let A=this.#e.list(n);if(!c&&A.length>=d)throw new u(-32004,"Principal task limit reached.");let f=A.filter(p=>!M.has(p.task.status.state)).length;if(!c&&f>=(r.limits.maxActiveTasksPerPrincipal??4))throw new u(-32004,"Principal active task limit reached.");let l=!1;if(!c){if(this.#e.all().filter(h=>!M.has(h.task.status.state)).length+this.#d>=r.limits.maxConcurrentTasks)throw new u(-32004,"Server task concurrency limit reached.");this.#d+=1,l=!0}try{let p,h;if(c?.task.status.state==="TASK_STATE_INPUT_REQUIRED")p=await this.resumeUserInput(c,e,s,r);else{let k=c??await this.createRecord(e,n,r,i);c||(this.#d-=1,l=!1);let w=c?this.appendMessage(k,e,s):k;try{let y=await this.startRun(w,e,r);p=y.record,h=y.runtimeEventsAttached}catch(y){throw this.failTask(w.taskId,"Task could not be started.",r),y}}return{record:p,duplicate:!1,...h?{runtimeEventsAttached:h}:{}}}finally{l&&(this.#d-=1)}}async resumeUserInput(e,n,r,i){let s=e.pendingUserInput;if(!s)throw new u(-32004,"Task has no pending Runtime input request.");if(!(await i.runtime.userInputs.respond(s.requestId,fr(n,s.kind),{expectedRevision:s.revision,runId:s.runId})).accepted)throw new u(-32004,"Pending Runtime input request is no longer active.");let c=this.#e.get(e.taskId)??e,d=this.appendMessage(c,n,r),{pendingUserInput:A,...f}=d;return M.has(d.task.status.state)?this.#e.save(f):this.#e.save({...f,task:{...d.task,status:{state:"TASK_STATE_WORKING",timestamp:x(this.#n)}},updatedAt:x(this.#n),eventSeq:d.eventSeq+1})}async createRecord(e,n,r,i){let s=e.contextId??fe(),a=this.#e.list(n).find(p=>p.contextId===s),c=J(`${n}\0${s}`),d=a?.workspaceRoot??await r.preparedExecution?.prepareWorkspace(c),A=a?{id:a.sessionId}:await r.runtime.sessions.create({title:`A2A: ${r.agent.name}`,surface:"a2a",...r.execution?.profileId||r.agent.profileId?{profileId:r.execution?.profileId??r.agent.profileId}:{},...d?{projectPath:d,gitRoot:d}:r.agent.projectPath?{projectPath:r.agent.projectPath}:{}}),f=fe(),l=x(this.#n);return this.#e.save({taskId:f,contextId:s,principalKey:n,principalKeyScheme:Z,runtimeIdentity:r.runtime.identity.runtimeId,sessionId:A.id,...d?{workspaceRoot:d}:{},...r.preparedExecution?{executionPolicyRevision:r.preparedExecution.binding.executionPolicyRevision}:{},messageDigests:{[e.messageId]:Ut(e)},runIds:[],task:{id:f,contextId:s,status:{state:"TASK_STATE_SUBMITTED",timestamp:l},history:[{...e,taskId:f,contextId:s}]},history:[{...e,taskId:f,contextId:s}],createdAt:l,updatedAt:l,eventSeq:1,lastRuntimeEventSeq:0,runtimeEventCount:0,runtimeEventBytes:0,...i?{acceptedOutputModes:i}:{}})}appendMessage(e,n,r){let i={...n,taskId:e.taskId,contextId:e.contextId};return this.#e.save({...e,messageDigests:{...e.messageDigests,[n.messageId]:r},history:[...e.history,i],task:{...e.task,history:[...e.history,i]},updatedAt:x(this.#n),eventSeq:e.eventSeq+1})}async startRun(e,n,r){let i=await this.inputsForMessage(e.taskId,n,r),s=r.preparedExecution;if(s&&e.executionPolicyRevision!==s.binding.executionPolicyRevision)throw new u(-32004,"A2A task execution binding revision changed.");let a=s?await s.start({sessionId:e.sessionId,inputs:i,principalKey:e.principalKey}):await r.runtime.runs.start({sessionId:e.sessionId,input:i,mode:"managed_task",permissionBroker:"runtime",...r.agent.runOptions?{options:r.agent.runOptions}:{},agentContext:{actorId:`a2a:${e.principalKey.slice(0,16)}`}}),c=this.#e.save({...e,runIds:[...e.runIds,a.runId],task:{...e.task,status:{state:"TASK_STATE_WORKING",timestamp:x(this.#n)}},updatedAt:x(this.#n),eventSeq:e.eventSeq+1});a.result.then(A=>this.finishRun(c.taskId,A,r)).catch(()=>{this.failTask(c.taskId,"Task execution failed.",r)});let d=this.attachRuntimeEvents(c,a.runId,r);return this.emit({type:"task.started",time:x(this.#n),taskId:c.taskId,contextId:c.contextId,runId:a.runId,outcome:"accepted"}),{record:c,runtimeEventsAttached:d}}async inputsForMessage(e,n,r){let i=[];for(let s of n.parts){if(s.text!==void 0){i.push({type:"text",text:s.text});continue}i.push(await this.materializePart(e,s,r))}return i}async materializePart(e,n,r){let i=n.mediaType??(n.data!==void 0?"application/json":"application/octet-stream"),s=n.data!==void 0?".json":".bin",a=this.#e.get(e),c=a?.workspaceRoot?E.join(a.workspaceRoot,"inbox",J(e)):E.join(E.resolve(r.dataDir),"attachments",J(e));W.mkdirSync(c,{recursive:!0,mode:448});let d=n.data!==void 0?Buffer.from(JSON.stringify(n.data),"utf8"):Buffer.from(n.raw??"","base64"),A=r.limits.maxWorkspaceBytesPerContext??1073741824;if(a?.workspaceRoot&&qt(a.workspaceRoot)+d.byteLength>A)throw new u(-32004,"A2A context workspace size limit reached.");let f=n.filename?E.basename(n.filename).replace(/[^A-Za-z0-9._-]/g,"_"):`${fe()}${s}`,l=E.join(c,`${fe()}-${f}`);W.writeFileSync(l,d,{mode:384});let p=i.startsWith("image/")?"image":i.startsWith("video/")?"video":"file";return{type:"artifact_ref",artifactId:(await r.runtime.artifacts.create({kind:p,path:l,mediaType:i,mimeType:i,...n.filename?{name:E.basename(n.filename)}:{},source:"user-inline",description:"Inbound A2A message part"})).id,description:"Inbound A2A attachment"}}async attachRuntimeEvents(e,n,r){this.#t.get(e.taskId)?.close(),this.#t.delete(e.taskId);let i=[],s=!0,a=r.runtime.events.subscribe({runId:n},c=>{s?i.push(c):this.onRuntimeEvent(e.taskId,c,r)});this.#t.set(e.taskId,a);try{let d=[...await r.runtime.events.replay({runId:n,sinceSeq:e.lastRuntimeEventSeq}),...i].sort((A,f)=>A.seq-f.seq||A.time.localeCompare(f.time)||A.id.localeCompare(f.id));for(let A of d)this.onRuntimeEvent(e.taskId,A,r);s=!1}catch(c){throw s=!1,this.#t.get(e.taskId)===a&&(a.close(),this.#t.delete(e.taskId)),c}}onRuntimeEvent(e,n,r){if(this.#s)return;let i=this.#e.get(e);if(!i||M.has(i.task.status.state)||n.seq<=i.lastRuntimeEventSeq)return;let s=Buffer.byteLength(JSON.stringify(n)),a=i.runtimeEventCount+1,c=i.runtimeEventBytes+s;if(a>(r.limits.maxEventsPerTask??1e3)||c>(r.limits.maxEventBytesPerTask??16777216)){let l=i.runIds.at(-1);l&&r.runtime.runs.abort(l),this.failTask(e,"A2A task event quota exceeded.",r);return}let d=n.type==="user_input.requested"?"TASK_STATE_INPUT_REQUIRED":i.task.status.state,A=n.type==="user_input.requested"?pr(e,i.contextId,n):void 0,f=n.type==="user_input.requested"&&g(n.payload)&&typeof n.payload.id=="string"&&Number.isSafeInteger(n.payload.revision)&&typeof n.payload.runId=="string"&&typeof n.payload.kind=="string"?{requestId:n.payload.id,revision:n.payload.revision,runId:n.payload.runId,kind:n.payload.kind}:void 0;this.#e.save({...i,task:{...i.task,status:{...i.task.status,state:d,...A?{message:A}:{},timestamp:n.time}},...f?{pendingUserInput:f}:{},updatedAt:n.time,eventSeq:i.eventSeq+1,lastRuntimeEventSeq:Math.max(i.lastRuntimeEventSeq,n.seq),runtimeEventCount:a,runtimeEventBytes:c})}finishRun(e,n,r=this.options){if(this.#s)return;let i=this.#e.get(e);if(!i||M.has(i.task.status.state))return;let s=dr(n.phase),a=n.error?J(ge(n.error)).slice(0,16):void 0,c=n.error?`Task failed. Diagnostic ID: ${a}`:mr(n.result?.lastText??"",i,r),d=c?ze(e,i.contextId,c):void 0,A=d?[...i.history,d]:i.history,l=[...c&&(i.acceptedOutputModes??r.agent.outputModes).includes("text/plain")?[{artifactId:`final-${e}`,name:"final-output",parts:[{text:c,mediaType:"text/plain"}]}]:[],...gr(i,n,r)],{pendingUserInput:p,...h}=i;this.#e.save({...h,history:A,task:{...i.task,status:{state:s,...d?{message:d}:{},timestamp:x(this.#n)},...l.length>0?{artifacts:l}:{},history:A},updatedAt:x(this.#n),eventSeq:i.eventSeq+1}),this.#t.get(e)?.close(),this.#t.delete(e),this.pruneRetained(i.principalKey,r),this.emit({type:"task.finished",time:x(this.#n),taskId:e,contextId:i.contextId,outcome:s==="TASK_STATE_COMPLETED"?"completed":"failed"})}failTask(e,n,r=this.options){if(this.#s)return;let i=this.#e.get(e);if(!i||M.has(i.task.status.state))return;let s=ze(e,i.contextId,n),{pendingUserInput:a,...c}=i;this.#e.save({...c,task:{...i.task,status:{state:"TASK_STATE_FAILED",message:s,timestamp:x(this.#n)}},updatedAt:x(this.#n),eventSeq:i.eventSeq+1}),this.#t.get(e)?.close(),this.#t.delete(e),this.pruneRetained(i.principalKey,r)}pruneRetained(e,n){let r=n.limits.maxRetainedTasksPerPrincipal??n.limits.maxTasksPerPrincipal??100;this.#e.pruneTerminal(e,r)}async getTask(e,n){let r=Ke(e),i=this.requireOwnedTask(r,n),s=De(e?.historyLength,"GetTask historyLength");return Be(i.task,i.history,s)}listTasks(e,n){let r=De(e?.historyLength,"ListTasks historyLength");if(e?.includeArtifacts!==void 0&&typeof e.includeArtifacts!="boolean")throw new u(-32602,"ListTasks includeArtifacts must be a boolean.");if(e?.contextId!==void 0&&typeof e.contextId!="string")throw new u(-32602,"ListTasks contextId must be a string.");if(e?.pageToken!==void 0&&typeof e.pageToken!="string")throw new u(-32602,"ListTasks pageToken must be a string.");if(e?.status!==void 0&&(typeof e.status!="string"||!nr.has(e.status)))throw new u(-32602,"ListTasks status is invalid.");let i=typeof e?.statusTimestampAfter=="string"?Date.parse(e.statusTimestampAfter):void 0;if(e?.statusTimestampAfter!==void 0&&!Number.isFinite(i))throw new u(-32602,"ListTasks statusTimestampAfter is invalid.");let s=this.#e.list(n).filter(l=>!(typeof e?.contextId=="string"&&l.contextId!==e.contextId||typeof e?.status=="string"&&l.task.status.state!==e.status||i!==void 0&&Date.parse(l.task.status.timestamp??l.updatedAt)<i));if(e?.pageSize!==void 0&&(!Number.isSafeInteger(e.pageSize)||e.pageSize<1||e.pageSize>100))throw new u(-32602,"ListTasks pageSize must be an integer from 1 to 100.");let a=typeof e?.pageSize=="number"?e.pageSize:50,c=Tr(typeof e?.pageToken=="string"?e.pageToken:void 0),d=c?s.filter(l=>br(l,c)):s,A=d.slice(0,a),f=A.at(-1);return{tasks:A.map(l=>{let p=Be(l.task,l.history,r);return e?.includeArtifacts===!0?p:{...p,artifacts:void 0}}),nextPageToken:f&&A.length<d.length?Er(f):"",pageSize:a,totalSize:s.length}}async cancelTask(e,n,r){let i=Ke(e),s=this.requireOwnedTask(i,n);if(M.has(s.task.status.state))throw new u(-32002,"Task is not cancelable.");let a=s.runIds.at(-1);a&&await r.runtime.runs.abort(a);let c=this.#e.save({...s,task:{...s.task,status:{state:"TASK_STATE_CANCELED",timestamp:x(this.#n)}},updatedAt:x(this.#n),eventSeq:s.eventSeq+1});return this.#t.get(i)?.close(),this.#t.delete(i),this.pruneRetained(s.principalKey,r),c.task}subscribeTask(e,n,r){let i=Ke(n),s=this.requireOwnedTask(i,r);if(M.has(s.task.status.state))throw new u(-32004,"Cannot subscribe to a terminal task.");return this.streamTask(e,i,s.principalKey)}streamTask(e,n,r){let i=this.requireOwnedTask(n,r),s=new Map((i.task.artifacts??[]).map(l=>[l.artifactId,J(JSON.stringify(l))])),a=this.reserveStream(n),c=new TextEncoder,d,A=a,f=!1;try{let l=new ReadableStream({start:o(p=>{let h=o(w=>{f||(f=!0,A(),w?p.error(w):p.close())},"close");A=o(()=>{d?.(),d=void 0,this.#r.delete(h),a()},"cleanup");let k=o(w=>{let y=c.encode(this.sse(e,w));return p.desiredSize===null||p.desiredSize<y.byteLength?(h(new Error("A2A SSE subscriber exceeded its buffer budget.")),!1):(p.enqueue(y),!0)},"enqueue");if(this.#r.add(h),!!k({task:i.task})){if(M.has(i.task.status.state)){h();return}d=this.#e.subscribe(n,w=>{!this.enqueueArtifactUpdates(k,w.task,s)||!k({statusUpdate:{taskId:n,contextId:w.contextId,status:w.task.status}})||(M.has(w.task.status.state)||w.task.status.state==="TASK_STATE_INPUT_REQUIRED"||w.task.status.state==="TASK_STATE_AUTH_REQUIRED")&&h()})}},"start"),cancel:o(()=>{f||(f=!0,A())},"cancel")},{highWaterMark:or,size:o(p=>p.byteLength,"size")});return new Response(l,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-cache"}})}catch(l){throw A(),l}}enqueueArtifactUpdates(e,n,r){for(let i of n.artifacts??[]){let s=J(JSON.stringify(i));if(r.get(i.artifactId)!==s){if(!e({artifactUpdate:{taskId:n.id,contextId:n.contextId,artifact:i,append:!1,lastChunk:!0}}))return!1;r.set(i.artifactId,s)}}return!0}reserveStream(e){let n=this.#i.get(e)??0;if(n>=ir)throw new u(-32e3,"Task stream capacity reached.",429);if(this.#f>=sr)throw new u(-32e3,"Server stream capacity reached.",429);this.#f+=1,this.#i.set(e,n+1);let r=!1;return()=>{if(r)return;r=!0,this.#f-=1;let i=(this.#i.get(e)??1)-1;i===0?this.#i.delete(e):this.#i.set(e,i)}}sse(e,n){return`data: ${JSON.stringify({jsonrpc:"2.0",id:e,result:n})}
 
-`}waitForTask(e,n){let r=this.#e.get(e);return r?R.has(r.task.status.state)||r.task.status.state==="TASK_STATE_INPUT_REQUIRED"||r.task.status.state==="TASK_STATE_AUTH_REQUIRED"?Promise.resolve(r):new Promise(s=>{let o=!1,a=i(()=>{},"unsubscribe"),d=i(p=>{o||(o=!0,clearTimeout(c),a(),s(p))},"finish"),c=setTimeout(()=>d(this.#e.get(e)??r),n);a=this.#e.subscribe(e,p=>{(R.has(p.task.status.state)||p.task.status.state==="TASK_STATE_INPUT_REQUIRED"||p.task.status.state==="TASK_STATE_AUTH_REQUIRED")&&d(p)});let l=this.#e.get(e);l&&(R.has(l.task.status.state)||l.task.status.state==="TASK_STATE_INPUT_REQUIRED"||l.task.status.state==="TASK_STATE_AUTH_REQUIRED")&&d(l)}):Promise.reject(new u(-32001,"Task not found."))}requireOwnedTask(e,n){let r=this.#e.get(e);if(!r||r.principalKey!==n)throw new u(-32001,"Task not found.");return r}async recover(){let e=this.options;for(let n of this.#e.all()){if(R.has(n.task.status.state))continue;let r=n.runIds.at(-1);if(!r||n.runtimeIdentity!==e.runtime.identity.runtimeId){this.failTask(n.taskId,"Runtime execution was interrupted before A2A recovery.");continue}try{let s=await e.runtime.runs.get(r);if(s.phase==="running"||s.phase==="queued"||s.phase==="waiting_permission"||s.phase==="waiting_user_input"){for(let o of await e.runtime.events.replay({runId:r,sinceSeq:n.lastRuntimeEventSeq}))this.onRuntimeEvent(n.taskId,o,e);this.subscribeRuntime(n,r,e),e.runtime.runs.await(r).then(o=>this.finishRun(n.taskId,o)).catch(o=>{this.failTask(n.taskId,q(o))})}else this.finishRun(n.taskId,{runId:r,sessionId:n.sessionId,phase:s.phase})}catch(s){M({source:"a2a.server",level:"warn",message:"A2A task recovery could not reattach to its Runtime run.",detail:{taskId:n.taskId,error:s}}),this.failTask(n.taskId,"Runtime execution was unavailable during A2A recovery.")}}}emit(e){this.options.onEvent?.(e)}};function Mn(t){return new Y(t)}i(Mn,"createKodaXA2AServer");async function Rt(t){let e=t.execution;if(!e)throw new Error("A2A execution declaration is required for prepared serving.");let n=t.runtime.agents.execution;if(!n)throw new Error("local-agent-capability-unavailable: Runtime does not own an embedded execution binding service.");if(t.signal?.aborted)throw t.signal.reason??new Error("A2A preparation aborted.");let r=await n.openOwnerSession();try{let s=e.kind==="local-agent"?await n.bindLocal({ownerSessionId:r.ownerSessionId,ref:e.agentRef,profileId:e.profileId,workspace:e.workspace,toolPolicy:e.toolPolicy,workspaceByteLimit:t.limits.maxWorkspaceBytesPerContext}):await n.bindDefault({ownerSessionId:r.ownerSessionId,profileId:e.profileId,workspace:e.workspace,toolPolicy:e.toolPolicy,workspaceByteLimit:t.limits.maxWorkspaceBytesPerContext}),o=!1;return{service:n,ownerSessionId:r.ownerSessionId,binding:s,declaration:e,prepareWorkspace(a){return n.prepareWorkspace({ownerSessionId:r.ownerSessionId,bindingId:s.bindingId,contextKey:a})},start(a){let d={ownerSessionId:r.ownerSessionId,bindingId:s.bindingId,expectedExecutionPolicyRevision:s.executionPolicyRevision,sessionId:a.sessionId,input:a.inputs,permissionBroker:"runtime",agentContext:{actorId:`a2a:${a.principalKey.slice(0,16)}`}};if(e.kind==="local-agent"){let c="configurationRevision"in s&&typeof s.configurationRevision=="string"?s.configurationRevision:void 0;if(!c)throw new Error("Prepared local-Agent binding is missing its revision.");return n.startLocal({...d,expectedConfigurationRevision:c})}return n.startDefault(d)},async close(){o||(o=!0,await n.closeOwnerSession(r.ownerSessionId))}}}catch(s){throw await n.closeOwnerSession(r.ownerSessionId),s}}i(Rt,"prepareExecution");async function Dn(t){let e=await Rt(t);try{let n=new Y({...t,preparedExecution:e});return await n.whenReady(),n}catch(n){throw await e.close(),n}}i(Dn,"prepareKodaXA2AServer");import{createHash as Et}from"node:crypto";import{existsSync as xt,readFileSync as bt}from"node:fs";import ee from"node:path";import{isDeepStrictEqual as pe}from"node:util";var De={maxRequestBytes:33554432,maxPartBytes:16777216,maxConcurrentTasks:4,maxTaskWaitMs:3e4,maxActiveTasksPerPrincipal:4,maxRetainedTasksPerPrincipal:100,maxEventsPerTask:1e3,maxEventBytesPerTask:16777216,maxWorkspaceBytesPerContext:1073741824},Me=Object.keys(De),te=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/,vt=/^[A-Za-z_][A-Za-z0-9_]*$/;function S(t,e){if(t===null||typeof t!="object"||Array.isArray(t))throw new Error(`${e} must be an object.`);return t}i(S,"record");function h(t,e,n){let r=new Set(e),s=Object.keys(t).find(o=>!r.has(o));if(s!==void 0)throw new Error(`${n} has unknown field "${s}".`)}i(h,"noUnknown");function T(t,e){if(typeof t!="string"||t.trim().length===0)throw new Error(`${e} must be a non-empty string.`);return t.trim()}i(T,"text");function H(t,e,n=!1){if(!Array.isArray(t)||!n&&t.length===0)throw new Error(`${e} must be ${n?"an":"a non-empty"} array of strings.`);let r=t.map((s,o)=>T(s,`${e}[${o}]`));if(new Set(r).size!==r.length)throw new Error(`${e} contains duplicates.`);return r}i(H,"stringList");function Ne(t,e,n=!0){let r=H(t,e,n);if(r.some(s=>s.includes("*")))throw new Error(`${e} does not accept wildcard authority.`);return r}i(Ne,"exactNames");function Le(t,e){let n=S(t,e),r={};for(let[s,o]of Object.entries(n)){if(!te.test(s)||s.includes("*"))throw new Error(`${e} keys must be exact names without wildcards.`);r[s]=Ne(o,`${e}.${s}`,!1)}return r}i(Le,"namedExactLists");function It(t,e){let n=S(t,e);h(n,["cardUrl","credentialEnv","effect"],e);let r=qe(n.cardUrl,`${e}.cardUrl`,!0),s=n.effect;if(!["none","read","write","unknown"].includes(String(s)))throw new Error(`${e}.effect is invalid.`);let o=n.credentialEnv===void 0?void 0:Be(n.credentialEnv,`${e}.credentialEnv`);return{cardUrl:r,...o?{credentialEnv:o}:{},effect:s}}i(It,"parseOutboundAgent");function qe(t,e,n){let r=T(t,e),s;try{s=new URL(r)}catch(a){throw new Error(`${e} must be an absolute HTTP URL.`,{cause:a})}if(s.username||s.password)throw new Error(`${e} must not contain embedded credentials.`);let o=["localhost","127.0.0.1","::1"].includes(s.hostname);if(s.protocol!=="https:"&&!(s.protocol==="http:"&&o&&n))throw new Error(`${e} must use HTTPS or explicit loopback HTTP.`);return s.toString()}i(qe,"parseHttpUrl");function Be(t,e){let n=T(t,e);if(!vt.test(n))throw new Error(`${e} must be an environment variable name.`);return n}i(Be,"parseEnvironmentName");function Pt(t){if(t===void 0)return{mode:"managed"};let e=S(t,"A2A server execution.workspace");if(e.mode==="managed")return h(e,["mode"],"A2A server execution.workspace"),{mode:"managed"};if(e.mode!=="fixed")throw new Error("A2A server execution.workspace.mode is invalid.");h(e,["mode","root"],"A2A server execution.workspace");let n=T(e.root,"A2A server execution.workspace.root");if(!ee.isAbsolute(n))throw new Error("Fixed A2A workspace root must be absolute.");return{mode:"fixed",root:ee.resolve(n)}}i(Pt,"parseWorkspace");function Ct(t){return{workspace:t.mode==="managed"?"write":"read",process:"deny",network:{mode:"deny"},tools:[],mcp:{},skillScripts:{},subagents:"deny"}}i(Ct,"defaultToolPolicy");function _t(t){let e=S(t,"A2A toolPolicy.network");if(e.mode==="deny")return h(e,["mode"],"A2A toolPolicy.network"),{mode:"deny"};if(e.mode!=="allowlist")throw new Error("A2A toolPolicy.network.mode is invalid.");h(e,["mode","origins"],"A2A toolPolicy.network");let n=H(e.origins,"A2A toolPolicy.network.origins").map(r=>{let s;try{s=new URL(r)}catch(o){throw new Error("A2A toolPolicy network origins must be absolute HTTP origins.",{cause:o})}if(!["http:","https:"].includes(s.protocol)||s.origin==="null")throw new Error("A2A toolPolicy network origins must be absolute HTTP origins.");return s.origin});if(new Set(n).size!==n.length)throw new Error("A2A toolPolicy.network.origins contains duplicates after normalization.");return{mode:"allowlist",origins:n}}i(_t,"parseNetworkPolicy");function Ot(t){let e=Le(t,"A2A toolPolicy.skillScripts");for(let[n,r]of Object.entries(e))e[n]=r.map(s=>{if(s.includes("\\")||ee.posix.isAbsolute(s))throw new Error("A2A skillScripts paths must use relative POSIX scripts/... paths.");let o=ee.posix.normalize(s);if(!o.startsWith("scripts/")||o.includes("../"))throw new Error("A2A skillScripts paths must remain below the Skill scripts directory.");return o});return e}i(Ot,"parseSkillScripts");function Ut(t,e){if(t===void 0)return Ct(e);let n=S(t,"A2A server execution.toolPolicy"),r=["workspace","process","network","tools","mcp","skillScripts","subagents"];if(h(n,r,"A2A server execution.toolPolicy"),r.some(a=>n[a]===void 0))throw new Error("A2A server execution.toolPolicy must be a complete object when present.");if(!["none","read","write"].includes(String(n.workspace)))throw new Error("A2A toolPolicy.workspace is invalid.");if(!["deny","isolated"].includes(String(n.process)))throw new Error("A2A toolPolicy.process is invalid.");if(!["deny","inherit"].includes(String(n.subagents)))throw new Error("A2A toolPolicy.subagents is invalid.");let s=Ot(n.skillScripts),o=Object.values(s).reduce((a,d)=>a+d.length,0);if(n.process==="deny"&&o>0)throw new Error("A2A toolPolicy process deny requires empty skillScripts.");if(n.process==="isolated"&&o===0)throw new Error("A2A toolPolicy process isolated requires non-empty skillScripts.");return{workspace:n.workspace,process:n.process,network:_t(n.network),tools:Ne(n.tools,"A2A toolPolicy.tools"),mcp:Le(n.mcp,"A2A toolPolicy.mcp"),skillScripts:s,subagents:n.subagents}}i(Ut,"parseToolPolicy");function Mt(t){let e=S(t,"A2A server execution"),n=Pt(e.workspace),r=Ut(e.toolPolicy,n),s=e.profileId===void 0?void 0:T(e.profileId,"A2A server execution.profileId");if(e.kind==="runtime-default")return h(e,["kind","workspace","toolPolicy","profileId"],"A2A server execution"),{kind:"runtime-default",workspace:n,toolPolicy:r,...s?{profileId:s}:{}};if(e.kind!=="local-agent")throw new Error("A2A server execution.kind is invalid.");h(e,["kind","agentRef","workspace","toolPolicy","profileId"],"A2A server execution");let o=S(e.agentRef,"A2A server execution.agentRef");if(h(o,["source","name"],"A2A server execution.agentRef"),o.source!=="markdown:user")throw new Error("A2A local Agent source must be markdown:user.");let a=T(o.name,"A2A server execution.agentRef.name");if(!te.test(a))throw new Error("A2A local Agent name is invalid.");return{kind:"local-agent",agentRef:{source:"markdown:user",name:a},workspace:n,toolPolicy:r,...s?{profileId:s}:{}}}i(Mt,"parseExecution");function Dt(t,e){let n=`A2A server published.skills[${e}]`,r=S(t,n);return h(r,["id","name","description","tags"],n),{id:T(r.id,`${n}.id`),name:T(r.name,`${n}.name`),description:T(r.description,`${n}.description`),tags:H(r.tags,`${n}.tags`,!0)}}i(Dt,"parsePublishedSkill");function Nt(t){let e=S(t,"A2A server published");if(h(e,["name","description","version","skills","inputModes","outputModes"],"A2A server published"),!Array.isArray(e.skills))throw new Error("A2A server published.skills must be an array.");let n=e.skills.map(Dt),r=n.map(s=>s.id);if(new Set(r).size!==r.length)throw new Error("A2A published Skill ids must be unique.");return{name:T(e.name,"A2A server published.name"),description:T(e.description,"A2A server published.description"),version:T(e.version,"A2A server published.version"),skills:n,inputModes:H(e.inputModes,"A2A server published.inputModes"),outputModes:H(e.outputModes,"A2A server published.outputModes")}}i(Nt,"parsePublished");function Lt(t){let e=S(t,"A2A server authentication");if(h(e,["type","tokenEnv","principalId"],"A2A server authentication"),e.type!=="bearer-env")throw new Error("A2A authentication type must be bearer-env.");return{type:"bearer-env",tokenEnv:Be(e.tokenEnv,"A2A server authentication.tokenEnv"),principalId:T(e.principalId,"A2A server authentication.principalId")}}i(Lt,"parseAuthentication");function qt(t,e){if(!Number.isSafeInteger(t)||Number(t)<=0)throw new Error(`${e} must be a positive safe integer.`);return Number(t)}i(qt,"positiveInteger");function Bt(t,e){let n=t===void 0?{}:S(t,"A2A server limits");h(n,Me,"A2A server limits");let r=Object.fromEntries(Me.map(o=>[o,n[o]===void 0?De[o]:qt(n[o],`A2A server limits.${o}`)]));if(r.maxPartBytes>r.maxRequestBytes)throw new Error("A2A server limits.maxPartBytes must not exceed maxRequestBytes.");let s=e.workspace.mode==="fixed"&&e.toolPolicy.workspace==="write";if(s&&n.maxConcurrentTasks===void 0)return{...r,maxConcurrentTasks:1};if(s&&r.maxConcurrentTasks!==1)throw new Error("A2A fixed writable workspace requires maxConcurrentTasks 1.");return r}i(Bt,"parseLimits");function Kt(t){let e=S(t,"A2A server");h(e,["execution","published","publicBaseUrl","authentication","limits","dataDir"],"A2A server");let n=Mt(e.execution),r=e.publicBaseUrl===void 0?void 0:qe(e.publicBaseUrl,"A2A server.publicBaseUrl",!0);return{execution:n,published:Nt(e.published),...r?{publicBaseUrl:r}:{},authentication:Lt(e.authentication),limits:Bt(e.limits,n),dataDir:T(e.dataDir,"A2A server.dataDir")}}i(Kt,"parseServer");function ne(t){let e=S(t,"A2A integration config");if(h(e,["version","agents","server"],"A2A integration config"),e.version!==1)throw new Error("A2A integration config version must be 1.");let n=S(e.agents,"A2A integration config agents"),r={};for(let[s,o]of Object.entries(n)){if(!te.test(s))throw new Error(`A2A outbound Agent name "${s}" is invalid.`);r[s]=It(o,`A2A outbound Agent "${s}"`)}return{version:1,agents:r,...e.server===void 0?{}:{server:Kt(e.server)}}}i(ne,"parseA2AIntegrationDocument");function jt(t){return Et("sha256").update(t).digest("hex")}i(jt,"hash");function F(t){let e=ge("a2a",t),n=xt(e),r=n?bt(e,"utf8"):JSON.stringify({version:1,agents:{}}),s;try{s=JSON.parse(r)}catch(o){throw new Error("Invalid A2A integration JSON.",{cause:o})}return{domain:"a2a",source:n?"user":"default",path:e,revision:jt(r),document:ne(s),loadedAt:new Date().toISOString()}}i(F,"readA2AIntegration");function fe(t,e,n){return me({domain:"a2a",configHome:t,document:e,validate:ne,...n?{expectedRevision:n}:{}})}i(fe,"writeA2AIntegration");function Hn(t,e,n,r){if(!te.test(e))throw new Error("A2A outbound Agent name is invalid.");let s=F(t);return fe(t,{...s.document,agents:{...s.document.agents,[e]:n}},r??(s.source==="user"?s.revision:void 0))}i(Hn,"upsertA2AOutboundAgent");function Fn(t,e,n){let r=F(t);if(r.document.agents[e]===void 0)return!1;let s={...r.document.agents};return delete s[e],fe(t,{...r.document,agents:s},n??(r.source==="user"?r.revision:void 0)),!0}i(Fn,"removeA2AOutboundAgent");function Jn(t,e,n){let r=F(t),s=e===void 0?{version:1,agents:r.document.agents}:{...r.document,server:e};return fe(t,s,n??(r.source==="user"?r.revision:void 0))}i(Jn,"setA2AServerConfig");function zn(t,e){if(pe(t,e))return{kind:"none",fields:[]};if(t===void 0||e===void 0)return{kind:"restart-required",fields:["server"]};let n=["execution","dataDir"].filter(s=>!pe(t[s],e[s])),r=["published","publicBaseUrl","authentication","limits"].filter(s=>!pe(t[s],e[s]));return n.length>0?{kind:"restart-required",fields:[...n,...r]}:{kind:"hot",fields:r}}i(zn,"classifyA2AServerChange");import{timingSafeEqual as $t}from"node:crypto";import Ke from"node:os";import je from"node:path";function Ht(t){return t==="~"?Ke.homedir():t.startsWith("~/")||t.startsWith("~\\")?je.join(Ke.homedir(),t.slice(2)):je.resolve(t)}i(Ht,"expandHome");function Ft(t){let e=t.headers.get("authorization");return(e?/^Bearer ([^\s]+)$/i.exec(e):null)?.[1]}i(Ft,"bearerToken");function Jt(t,e){let n=Buffer.from(t),r=Buffer.from(e);return n.byteLength===r.byteLength&&$t(n,r)}i(Jt,"equalSecret");function $e(t,e=process.env){let n=e[t.tokenEnv];if(!n)throw new Error(`A2A bearer token environment variable is unset: ${t.tokenEnv}.`);return{securitySchemes:{bearer:{type:"http",scheme:"bearer",bearerFormat:"opaque"}},securityRequirements:[{bearer:[]}],async authenticate(r){let s=Ft(r);return s&&Jt(n,s)?{subject:t.principalId,scopes:["a2a:invoke"]}:null}}}i($e,"createBearerEnvA2AAuthentication");function He(t,e){return{name:t.published.name,description:t.published.description,version:t.published.version,publicBaseUrl:t.publicBaseUrl??e,skills:t.published.skills,inputModes:t.published.inputModes,outputModes:t.published.outputModes,...t.execution.profileId?{profileId:t.execution.profileId}:{}}}i(He,"publishedAgent");function Fe(){return Promise.resolve(!0)}i(Fe,"authorization");function Zn(t){return{runtime:t.runtime,agent:He(t.config,t.listenBaseUrl),execution:t.config.execution,dataDir:Ht(t.config.dataDir),limits:t.config.limits,authentication:$e(t.config.authentication,t.env),authorize:Fe}}i(Zn,"createA2AServerOptionsFromConfig");function Yn(t){return{agent:He(t.config,t.listenBaseUrl),limits:t.config.limits,authentication:$e(t.config.authentication,t.env),authorize:Fe}}i(Yn,"createA2AServerHotOptions");function zt(t){let e=t.toLowerCase().replace(/^\[|\]$/g,"");return e==="localhost"||e==="127.0.0.1"||e==="::1"}i(zt,"isExactLoopback");function Je(t){return{allowedOrigins:[t.origin],allowPrivateAddresses:zt(t.hostname),requestTimeoutMs:1e4,maxResponseBytes:1e6,maxRedirects:3}}i(Je,"networkPolicy");function Wt(t){let e=t.executorConfig?.interfaceUrl;if(typeof e!="string")throw new Error("Configured A2A registration has no interface URL.");return new URL(e)}i(Wt,"registrationUrl");function Xt(){let t=i(e=>{if(!e.startsWith("env:")||e.length===4)throw new Error("Configured A2A credentials must use an environment reference.");return e.slice(4)},"environmentName");return{isAvailable(e){let n=process.env[t(e)];return typeof n=="string"&&n.length>0},async withCredential(e,n){let r=process.env[t(e)];if(!r)throw new Error("Configured A2A credential is unavailable.");return n(r)}}}i(Xt,"environmentCredentialBroker");function Gt(t,e){return{agentId:`external:${t}`,agentCardUrl:e.cardUrl,...e.credentialEnv?{credentialRef:`env:${e.credentialEnv}`}:{},effects:{remote:e.effect}}}i(Gt,"registrationInput");function ar(t){return{runtimeOptions:{factories:[Ie(n=>({networkPolicy:Je(Wt(n)),pollIntervalMs:500,...t.fetch?{fetch:t.fetch}:{}}))],policy:i(()=>({allowed:!0}),"policy"),credentialBroker:Xt()},async start(n){let r=new ye({domain:"a2a",configHome:t.configHome,validate:ne,read:i(()=>F(t.configHome),"read")}),s=i(async a=>{let d=await n.admin.agentRegistrations.list(),c=new Set(d.filter(l=>l.executorId===L).map(l=>l.agentId));for(let[l,p]of Object.entries(a.agents)){let g=`external:${l}`;try{let f=new URL(p.cardUrl),E=await be(Gt(l,p),{networkPolicy:Je(f),pollIntervalMs:500,...t.fetch?{fetch:t.fetch}:{}});await n.admin.agentRegistrations.upsert(E.registration),c.delete(g)}catch(f){M({source:"a2a.runtime-config",level:"warn",message:`A2A Agent "${l}" refresh failed; last-known-good registration retained.`,detail:f}),t.onEvent?.(`A2A Agent "${l}" could not be refreshed; its last-known-good registration was retained.`),c.delete(g)}}for(let l of c)await n.admin.agentRegistrations.remove(l)},"reconcile"),o=await r.initialize();return await s(o.document),r.subscribe(async(a,d)=>{a.revision!==d?.revision&&(await s(a.document),t.onEvent?.(`A2A configuration hot-reloaded (${Object.keys(a.document.agents).length} outbound Agents).`))}),r.startWatching(),{status:i(()=>r.status(),"status"),async reload(){await r.reload()},close(){r.close()}}}}}i(ar,"createConfiguredA2ARuntimeIntegration");export{u as A2AError,L as A2A_EXECUTOR_ID,C as A2A_PROTOCOL_VERSION,rt as assertSafeA2AUrl,zn as classifyA2AServerChange,Ie as createA2AAgentExecutorFactory,Yn as createA2AServerHotOptions,Zn as createA2AServerOptionsFromConfig,$e as createBearerEnvA2AAuthentication,ar as createConfiguredA2ARuntimeIntegration,Mn as createKodaXA2AServer,X as decodeUtf8,be as discoverA2ARegistration,q as errorMessage,A as isRecord,he as parseA2AAgentCard,ne as parseA2AIntegrationDocument,v as parseA2AMessage,we as parseA2APart,I as parseA2ATask,ke as parseJsonRpcRequest,Dn as prepareKodaXA2AServer,F as readA2AIntegration,Fn as removeA2AOutboundAgent,W as safeA2AFetch,Jn as setA2AServerConfig,Hn as upsertA2AOutboundAgent};
+`}waitForTask(e,n){let r=this.#e.get(e);return r?M.has(r.task.status.state)||r.task.status.state==="TASK_STATE_INPUT_REQUIRED"||r.task.status.state==="TASK_STATE_AUTH_REQUIRED"?Promise.resolve(r):new Promise(i=>{let s=!1,a=o(()=>{},"unsubscribe"),c=o(f=>{s||(s=!0,clearTimeout(d),a(),i(f))},"finish"),d=setTimeout(()=>c(this.#e.get(e)??r),n);a=this.#e.subscribe(e,f=>{(M.has(f.task.status.state)||f.task.status.state==="TASK_STATE_INPUT_REQUIRED"||f.task.status.state==="TASK_STATE_AUTH_REQUIRED")&&c(f)});let A=this.#e.get(e);A&&(M.has(A.task.status.state)||A.task.status.state==="TASK_STATE_INPUT_REQUIRED"||A.task.status.state==="TASK_STATE_AUTH_REQUIRED")&&c(A)}):Promise.reject(new u(-32001,"Task not found."))}requireOwnedTask(e,n){let r=this.#e.get(e);if(!r||r.principalKey!==n)throw new u(-32001,"Task not found.");return r}async recover(){let e=this.options;for(let n of this.#e.all()){if(M.has(n.task.status.state))continue;let r=n.runIds.at(-1);if(!r||n.runtimeIdentity!==e.runtime.identity.runtimeId){this.failTask(n.taskId,"Runtime execution was interrupted before A2A recovery.",e);continue}try{let i=await e.runtime.runs.get(r);i.phase==="running"||i.phase==="queued"||i.phase==="waiting_permission"||i.phase==="waiting_user_input"?(await this.attachRuntimeEvents(n,r,e),e.runtime.runs.await(r).then(s=>this.finishRun(n.taskId,s,e)).catch(()=>{this.failTask(n.taskId,"Runtime execution failed during A2A recovery.",e)})):this.finishRun(n.taskId,{runId:r,sessionId:n.sessionId,phase:i.phase},e)}catch(i){V({source:"a2a.server",level:"warn",message:"A2A task recovery could not reattach to its Runtime run.",detail:{taskId:n.taskId,error:i}}),this.failTask(n.taskId,"Runtime execution was unavailable during A2A recovery.",e)}}}emit(e){this.options.onEvent?.(e)}};function Rs(t){return new Te(t)}o(Rs,"createKodaXA2AServer");async function xr(t){let e=t.execution;if(!e)throw new Error("A2A execution declaration is required for prepared serving.");let n=t.runtime.agents.execution;if(!n)throw new Error("local-agent-capability-unavailable: Runtime does not own an embedded execution binding service.");if(t.signal?.aborted)throw t.signal.reason??new Error("A2A preparation aborted.");let r=await n.openOwnerSession();try{let i=e.kind==="local-agent"?await n.bindLocal({ownerSessionId:r.ownerSessionId,ref:e.agentRef,profileId:e.profileId,workspace:e.workspace,toolPolicy:e.toolPolicy,workspaceByteLimit:t.limits.maxWorkspaceBytesPerContext}):await n.bindDefault({ownerSessionId:r.ownerSessionId,profileId:e.profileId,workspace:e.workspace,toolPolicy:e.toolPolicy,workspaceByteLimit:t.limits.maxWorkspaceBytesPerContext}),s=!1;return{service:n,ownerSessionId:r.ownerSessionId,binding:i,declaration:e,prepareWorkspace(a){return n.prepareWorkspace({ownerSessionId:r.ownerSessionId,bindingId:i.bindingId,contextKey:a})},start(a){let c={ownerSessionId:r.ownerSessionId,bindingId:i.bindingId,expectedExecutionPolicyRevision:i.executionPolicyRevision,sessionId:a.sessionId,input:a.inputs,permissionBroker:"runtime",agentContext:{actorId:`a2a:${a.principalKey.slice(0,16)}`}};if(e.kind==="local-agent"){let d="configurationRevision"in i&&typeof i.configurationRevision=="string"?i.configurationRevision:void 0;if(!d)throw new Error("Prepared local-Agent binding is missing its revision.");return n.startLocal({...c,expectedConfigurationRevision:d})}return n.startDefault(c)},async close(){s||(s=!0,await n.closeOwnerSession(r.ownerSessionId))}}}catch(i){throw await n.closeOwnerSession(r.ownerSessionId),i}}o(xr,"prepareExecution");async function Ts(t){let e=await xr(t);try{let n=new Te({...t,preparedExecution:e});return await n.whenReady(),n}catch(n){throw await e.close(),n}}o(Ts,"prepareKodaXA2AServer");import{createPublicKey as Ir}from"node:crypto";import*as ee from"oauth4webapi";var Cr=["RS256","RS384","RS512","PS256","PS384","PS512","ES256","ES384","ES512","EdDSA"],L=class extends Error{constructor(n,r){super(n);this.cause=r;this.name="OAuthJwksUnavailableError"}cause;static{o(this,"OAuthJwksUnavailableError")}};function Lt(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}o(Lt,"isRecord");function vr(t){for(let e of["kid","alg","use"])if(t[e]!==void 0&&typeof t[e]!="string")throw new L(`OAuth JWKS key field ${e} must be a string.`);if(t.key_ops!==void 0&&(!Array.isArray(t.key_ops)||!t.key_ops.every(e=>typeof e=="string")))throw new L("OAuth JWKS key_ops must be an array of strings.");if(typeof t.kty!="string"||t.kty.length===0)throw new L("OAuth JWKS key kty must be a non-empty string.");if(["RSA","EC","OKP"].includes(t.kty))try{Ir({key:t,format:"jwk"})}catch(e){throw new L("OAuth JWKS endpoint returned an invalid public key.",e)}}o(vr,"assertPublicJwk");function Pr(t,e){if(t.status!==200)throw new L("OAuth JWKS endpoint returned an unexpected status.");let n=t.headers.get("content-type")?.split(";",1)[0]?.trim().toLowerCase();if(n!=="application/json"&&n!=="application/jwk-set+json")throw new L("OAuth JWKS endpoint returned an unsupported media type.");let r;try{r=JSON.parse(X(e))}catch(i){throw new L("OAuth JWKS endpoint returned malformed JSON.",i)}if(!Lt(r)||!Array.isArray(r.keys)||!r.keys.every(Lt))throw new L("OAuth JWKS endpoint returned an invalid key set.");for(let i of r.keys)vr(i)}o(Pr,"assertJwksResponse");function Or(t){let e=new Set,n=t;for(;n!=null&&!e.has(n);){if(n instanceof L)return!0;if(e.add(n),typeof n!="object"||!("cause"in n))return!1;n=n.cause}return!1}o(Or,"isJwksUnavailable");function Ur(t){return{allowedOrigins:[t.origin],allowPrivateAddresses:me(t.hostname),requestTimeoutMs:1e4,maxResponseBytes:1048576,maxRedirects:0}}o(Ur,"jwksNetworkPolicy");function _r(t,e){return async(n,r)=>{try{let i=await G(new URL(n),{...r,redirect:"manual"},t,e);return Pr(i.response,i.body),new Response(i.body,{status:i.response.status,statusText:i.response.statusText,headers:i.response.headers})}catch(i){throw i instanceof L?i:new L("OAuth JWKS endpoint is unavailable.",i)}}}o(_r,"boundedOAuthFetch");function Mr(t){if(t===void 0)return[];if(typeof t!="string")throw new Error("OAuth access-token scope claim must be a string.");return tt(t,"OAuth access-token scope claim")}o(Mr,"scopesFromClaim");function $t(t,e){if(t.type!=="oauth2-jwt")throw new Error("A2A authentication.type must be oauth2-jwt.");let n=v(t.scheme,"A2A authentication.scheme"),r=v(t.audience,"A2A authentication.audience"),i=ie(t.requiredScopes,"A2A authentication.requiredScopes"),s=H(t.issuer,"OAuth issuer"),a=$(t.jwksUrl,"OAuth JWKS endpoint"),c=$(t.tokenUrl,"OAuth token endpoint"),d=t.metadataUrl===void 0?void 0:$(t.metadataUrl,"OAuth metadata endpoint"),A={issuer:s,jwks_uri:a.href},f={},l=_r(Ur(a),e),p=Object.fromEntries(i.map(h=>[h,"Required to invoke this Agent."]));return{securityRealm:`oauth2-jwt:${s}`,securitySchemes:{[n]:{oauth2SecurityScheme:{flows:{clientCredentials:{tokenUrl:c.href,scopes:p}},...d?{oauth2MetadataUrl:d.href}:{}}}},securityRequirements:[{schemes:{[n]:{list:i}}}],async authenticate(h){if(!h.headers.get("authorization"))return null;let w,y;try{w=await ee.validateJwtAccessToken(A,h,r,{signingAlgorithms:Cr,[ee.jwksCache]:f,[ee.customFetch]:l,...a.protocol==="http:"&&me(a.hostname)?{[ee.allowInsecureRequests]:!0}:{}});let m=w.scope;y=Mr(m)}catch(m){throw Or(m)?new u(-32603,"OAuth token verification is temporarily unavailable.",503):new u(-32600,"Invalid OAuth access token.",401,void 0,{"www-authenticate":'Bearer error="invalid_token"'})}if(i.filter(m=>!y.includes(m)).length>0)throw new u(-32600,"Insufficient OAuth scope.",403,void 0,{"www-authenticate":`Bearer error="insufficient_scope", scope="${i.join(" ")}"`});return{subject:w.sub,scopes:y}}}}o($t,"createOAuth2JwtA2AAuthentication");import Nt from"node:os";import Dt from"node:path";function qr(t){return t==="~"?Nt.homedir():t.startsWith("~/")||t.startsWith("~\\")?Dt.join(Nt.homedir(),t.slice(2)):Dt.resolve(t)}o(qr,"resolveDataDir");function Lr(t,e){if(typeof t.subject!="string")throw new Error(`A2A legacy task owner mapping ${e} subject must be a string.`);if(t.tenant!==void 0&&typeof t.tenant!="string")throw new Error(`A2A legacy task owner mapping ${e} tenant must be a string.`);if(typeof t.securityRealm!="string"||t.securityRealm.trim().length===0)throw new Error(`A2A legacy task owner mapping ${e} securityRealm must be a non-empty stable string.`)}o(Lr,"validateMapping");function Ls(t){if(typeof t.dataDir!="string"||t.dataDir.trim().length===0)throw new Error("A2A legacy task owner migration dataDir must be a non-empty path.");if(!Array.isArray(t.mappings)||t.mappings.length===0)throw new Error("A2A legacy task owner migration requires at least one explicit mapping.");if(typeof t.apply!="boolean")throw new Error("A2A legacy task owner migration apply must be a boolean.");let e=new Map,n=new Set;t.mappings.forEach((s,a)=>{Lr(s,a);let c=Ct(s),d=Re(s),A=e.get(c);if(A!==void 0&&A!==d)throw new Error("A2A legacy task owner mappings are ambiguous across security realms.");e.set(c,d),n.add(d)});let r=qr(t.dataDir),i=new oe(r);try{let s=i.migrateUnversionedPrincipalKeys({legacyToCurrent:e,currentKeys:n,apply:t.apply});return{dataDir:r,applied:t.apply,...s}}finally{i.close()}}o(Ls,"migrateA2ALegacyTaskOwners");import{createHash as $r}from"node:crypto";import{existsSync as Nr,readFileSync as Dr}from"node:fs";import be from"node:path";import{isDeepStrictEqual as Je}from"node:util";var jt={maxRequestBytes:33554432,maxPartBytes:16777216,maxConcurrentTasks:4,maxTaskWaitMs:3e4,maxActiveTasksPerPrincipal:4,maxRetainedTasksPerPrincipal:100,maxEventsPerTask:1e3,maxEventBytesPerTask:16777216,maxWorkspaceBytesPerContext:1073741824},Kt=Object.keys(jt),xe=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/,Kr=/^[A-Za-z_][A-Za-z0-9_]*$/;function jr(t){let e=t.toLowerCase().replace(/^\[|\]$/g,"");return e==="localhost"||e==="127.0.0.1"||e==="::1"}o(jr,"isExactLoopback");function P(t,e){if(t===null||typeof t!="object"||Array.isArray(t))throw new Error(`${e} must be an object.`);return t}o(P,"record");function I(t,e,n){let r=new Set(e),i=Object.keys(t).find(s=>!r.has(s));if(i!==void 0)throw new Error(`${n} has unknown field "${i}".`)}o(I,"noUnknown");function C(t,e){if(typeof t!="string"||t.trim().length===0)throw new Error(`${e} must be a non-empty string.`);return t.trim()}o(C,"text");function ae(t,e,n=!1){if(!Array.isArray(t)||!n&&t.length===0)throw new Error(`${e} must be ${n?"an":"a non-empty"} array of strings.`);let r=t.map((i,s)=>C(i,`${e}[${s}]`));if(new Set(r).size!==r.length)throw new Error(`${e} contains duplicates.`);return r}o(ae,"stringList");function Bt(t,e,n=!0){let r=ae(t,e,n);if(r.some(i=>i.includes("*")))throw new Error(`${e} does not accept wildcard authority.`);return r}o(Bt,"exactNames");function zt(t,e){let n=P(t,e),r={};for(let[i,s]of Object.entries(n)){if(!xe.test(i)||i.includes("*"))throw new Error(`${e} keys must be exact names without wildcards.`);r[i]=Bt(s,`${e}.${i}`,!1)}return r}o(zt,"namedExactLists");function Jt(t,e){let n=C(t,e);if(!xe.test(n))throw new Error(`${e} is invalid.`);return n}o(Jt,"parseSchemeName");function Ht(t,e){return H(t,e)}o(Ht,"parseIssuer");function Ft(t,e){let n=ae(t,e,!0);for(let r of n)re(r,e);return n}o(Ft,"oauthScopeList");function Br(t,e){return ne(t,e)}o(Br,"parseResource");function Ee(t,e){return $(t,e).href}o(Ee,"parseOAuthEndpoint");function zr(t,e){let n=P(t,e);if(I(n,["type","scheme","issuer","tokenUrl","clientId","clientSecretEnv","scopes","resource","clientAuthentication"],e),n.type!=="oauth2-client-credentials")throw new Error(`${e}.type must be oauth2-client-credentials.`);let r=n.clientAuthentication??"client-secret-basic";if(!["client-secret-basic","client-secret-post"].includes(String(r)))throw new Error(`${e}.clientAuthentication is invalid.`);return{type:"oauth2-client-credentials",scheme:Jt(n.scheme,`${e}.scheme`),issuer:Ht(n.issuer,`${e}.issuer`),tokenUrl:Ee(n.tokenUrl,`${e}.tokenUrl`),clientId:C(n.clientId,`${e}.clientId`),clientSecretEnv:He(n.clientSecretEnv,`${e}.clientSecretEnv`),scopes:Ft(n.scopes,`${e}.scopes`),...n.resource===void 0?{}:{resource:Br(n.resource,`${e}.resource`)},clientAuthentication:r}}o(zr,"parseOutboundAuthentication");function Jr(t,e,n){let r=P(t,e);I(r,n===1?["cardUrl","credentialEnv","effect"]:["cardUrl","enabled","credentialEnv","authentication","effect"],e);let i=Wt(r.cardUrl,`${e}.cardUrl`,!0),s=r.effect;if(!["none","read","write","unknown"].includes(String(s)))throw new Error(`${e}.effect is invalid.`);let a=r.credentialEnv===void 0?void 0:He(r.credentialEnv,`${e}.credentialEnv`);if(a&&r.authentication!==void 0)throw new Error(`${e}.credentialEnv and ${e}.authentication are mutually exclusive.`);if(r.enabled!==void 0&&typeof r.enabled!="boolean")throw new Error(`${e}.enabled must be a boolean.`);return{cardUrl:i,enabled:r.enabled??!0,...a?{credentialEnv:a}:{},...r.authentication===void 0?{}:{authentication:zr(r.authentication,`${e}.authentication`)},effect:s}}o(Jr,"parseOutboundAgent");function Wt(t,e,n){let r=C(t,e),i;try{i=new URL(r)}catch(a){throw new Error(`${e} must be an absolute HTTP URL.`,{cause:a})}if(i.username||i.password)throw new Error(`${e} must not contain embedded credentials.`);if(i.hash)throw new Error(`${e} must not contain a fragment.`);let s=jr(i.hostname);if(i.protocol!=="https:"&&!(i.protocol==="http:"&&s&&n))throw new Error(`${e} must use HTTPS or explicit loopback HTTP.`);return i.toString()}o(Wt,"parseHttpUrl");function He(t,e){let n=C(t,e);if(!Kr.test(n))throw new Error(`${e} must be an environment variable name.`);return n}o(He,"parseEnvironmentName");function Hr(t){if(t===void 0)return{mode:"managed"};let e=P(t,"A2A server execution.workspace");if(e.mode==="managed")return I(e,["mode"],"A2A server execution.workspace"),{mode:"managed"};if(e.mode!=="fixed")throw new Error("A2A server execution.workspace.mode is invalid.");I(e,["mode","root"],"A2A server execution.workspace");let n=C(e.root,"A2A server execution.workspace.root");if(!be.isAbsolute(n))throw new Error("Fixed A2A workspace root must be absolute.");return{mode:"fixed",root:be.resolve(n)}}o(Hr,"parseWorkspace");function Fr(t){return{workspace:t.mode==="managed"?"write":"read",process:"deny",network:{mode:"deny"},tools:[],mcp:{},skillScripts:{},subagents:"deny"}}o(Fr,"defaultToolPolicy");function Wr(t){let e=P(t,"A2A toolPolicy.network");if(e.mode==="deny")return I(e,["mode"],"A2A toolPolicy.network"),{mode:"deny"};if(e.mode!=="allowlist")throw new Error("A2A toolPolicy.network.mode is invalid.");I(e,["mode","origins"],"A2A toolPolicy.network");let n=ae(e.origins,"A2A toolPolicy.network.origins").map(r=>{let i;try{i=new URL(r)}catch(s){throw new Error("A2A toolPolicy network origins must be absolute HTTP origins.",{cause:s})}if(!["http:","https:"].includes(i.protocol)||i.origin==="null")throw new Error("A2A toolPolicy network origins must be absolute HTTP origins.");return i.origin});if(new Set(n).size!==n.length)throw new Error("A2A toolPolicy.network.origins contains duplicates after normalization.");return{mode:"allowlist",origins:n}}o(Wr,"parseNetworkPolicy");function Vr(t){let e=zt(t,"A2A toolPolicy.skillScripts");for(let[n,r]of Object.entries(e))e[n]=r.map(i=>{if(i.includes("\\")||be.posix.isAbsolute(i))throw new Error("A2A skillScripts paths must use relative POSIX scripts/... paths.");let s=be.posix.normalize(i);if(!s.startsWith("scripts/")||s.includes("../"))throw new Error("A2A skillScripts paths must remain below the Skill scripts directory.");return s});return e}o(Vr,"parseSkillScripts");function Gr(t,e){if(t===void 0)return Fr(e);let n=P(t,"A2A server execution.toolPolicy"),r=["workspace","process","network","tools","mcp","skillScripts","subagents"];if(I(n,r,"A2A server execution.toolPolicy"),r.some(a=>n[a]===void 0))throw new Error("A2A server execution.toolPolicy must be a complete object when present.");if(!["none","read","write"].includes(String(n.workspace)))throw new Error("A2A toolPolicy.workspace is invalid.");if(!["deny","isolated"].includes(String(n.process)))throw new Error("A2A toolPolicy.process is invalid.");if(!["deny","inherit"].includes(String(n.subagents)))throw new Error("A2A toolPolicy.subagents is invalid.");let i=Vr(n.skillScripts),s=Object.values(i).reduce((a,c)=>a+c.length,0);if(n.process==="deny"&&s>0)throw new Error("A2A toolPolicy process deny requires empty skillScripts.");if(n.process==="isolated"&&s===0)throw new Error("A2A toolPolicy process isolated requires non-empty skillScripts.");return{workspace:n.workspace,process:n.process,network:Wr(n.network),tools:Bt(n.tools,"A2A toolPolicy.tools"),mcp:zt(n.mcp,"A2A toolPolicy.mcp"),skillScripts:i,subagents:n.subagents}}o(Gr,"parseToolPolicy");function Xr(t){let e=P(t,"A2A server execution"),n=Hr(e.workspace),r=Gr(e.toolPolicy,n),i=e.profileId===void 0?void 0:C(e.profileId,"A2A server execution.profileId");if(e.kind==="runtime-default")return I(e,["kind","workspace","toolPolicy","profileId"],"A2A server execution"),{kind:"runtime-default",workspace:n,toolPolicy:r,...i?{profileId:i}:{}};if(e.kind!=="local-agent")throw new Error("A2A server execution.kind is invalid.");I(e,["kind","agentRef","workspace","toolPolicy","profileId"],"A2A server execution");let s=P(e.agentRef,"A2A server execution.agentRef");if(I(s,["source","name"],"A2A server execution.agentRef"),s.source!=="markdown:user")throw new Error("A2A local Agent source must be markdown:user.");let a=C(s.name,"A2A server execution.agentRef.name");if(!xe.test(a))throw new Error("A2A local Agent name is invalid.");return{kind:"local-agent",agentRef:{source:"markdown:user",name:a},workspace:n,toolPolicy:r,...i?{profileId:i}:{}}}o(Xr,"parseExecution");function Qr(t,e){let n=`A2A server published.skills[${e}]`,r=P(t,n);return I(r,["id","name","description","tags"],n),{id:C(r.id,`${n}.id`),name:C(r.name,`${n}.name`),description:C(r.description,`${n}.description`),tags:ae(r.tags,`${n}.tags`,!0)}}o(Qr,"parsePublishedSkill");function Zr(t){let e=P(t,"A2A server published");if(I(e,["name","description","version","skills","inputModes","outputModes"],"A2A server published"),!Array.isArray(e.skills))throw new Error("A2A server published.skills must be an array.");let n=e.skills.map(Qr),r=n.map(i=>i.id);if(new Set(r).size!==r.length)throw new Error("A2A published Skill ids must be unique.");return{name:C(e.name,"A2A server published.name"),description:C(e.description,"A2A server published.description"),version:C(e.version,"A2A server published.version"),skills:n,inputModes:ae(e.inputModes,"A2A server published.inputModes"),outputModes:ae(e.outputModes,"A2A server published.outputModes")}}o(Zr,"parsePublished");function Yr(t,e){let n=P(t,"A2A server authentication");if(n.type==="bearer-env")return I(n,["type","tokenEnv","principalId"],"A2A server authentication"),{type:"bearer-env",tokenEnv:He(n.tokenEnv,"A2A server authentication.tokenEnv"),principalId:C(n.principalId,"A2A server authentication.principalId")};if(e===1)throw new Error("A2A oauth2-jwt authentication requires integration config version 2.");if(n.type!=="oauth2-jwt")throw new Error("A2A authentication type must be bearer-env or oauth2-jwt.");return I(n,["type","scheme","issuer","audience","jwksUrl","tokenUrl","metadataUrl","requiredScopes"],"A2A server authentication"),{type:"oauth2-jwt",scheme:Jt(n.scheme,"A2A server authentication.scheme"),issuer:Ht(n.issuer,"A2A server authentication.issuer"),audience:C(n.audience,"A2A server authentication.audience"),jwksUrl:Ee(n.jwksUrl,"A2A server authentication.jwksUrl"),tokenUrl:Ee(n.tokenUrl,"A2A server authentication.tokenUrl"),...n.metadataUrl===void 0?{}:{metadataUrl:Ee(n.metadataUrl,"A2A server authentication.metadataUrl")},requiredScopes:Ft(n.requiredScopes,"A2A server authentication.requiredScopes")}}o(Yr,"parseAuthentication");function ei(t,e){if(!Number.isSafeInteger(t)||Number(t)<=0)throw new Error(`${e} must be a positive safe integer.`);return Number(t)}o(ei,"positiveInteger");function ti(t,e){let n=t===void 0?{}:P(t,"A2A server limits");I(n,Kt,"A2A server limits");let r=Object.fromEntries(Kt.map(s=>[s,n[s]===void 0?jt[s]:ei(n[s],`A2A server limits.${s}`)]));if(r.maxPartBytes>r.maxRequestBytes)throw new Error("A2A server limits.maxPartBytes must not exceed maxRequestBytes.");let i=e.workspace.mode==="fixed"&&e.toolPolicy.workspace==="write";if(i&&n.maxConcurrentTasks===void 0)return{...r,maxConcurrentTasks:1};if(i&&r.maxConcurrentTasks!==1)throw new Error("A2A fixed writable workspace requires maxConcurrentTasks 1.");return r}o(ti,"parseLimits");function ni(t,e){let n=P(t,"A2A server");I(n,["execution","published","publicBaseUrl","authentication","limits","dataDir"],"A2A server");let r=Xr(n.execution),i=n.publicBaseUrl===void 0?void 0:Wt(n.publicBaseUrl,"A2A server.publicBaseUrl",!0);return{execution:r,published:Zr(n.published),...i?{publicBaseUrl:i}:{},authentication:Yr(n.authentication,e),limits:ti(n.limits,r),dataDir:C(n.dataDir,"A2A server.dataDir")}}o(ni,"parseServer");function Ie(t){let e=P(t,"A2A integration config");if(I(e,["version","agents","server"],"A2A integration config"),e.version!==1&&e.version!==2)throw new Error("A2A integration config version must be 1 or 2.");let n=e.version,r=P(e.agents,"A2A integration config agents"),i={};for(let[s,a]of Object.entries(r)){if(!xe.test(s))throw new Error(`A2A outbound Agent name "${s}" is invalid.`);i[s]=Jr(a,`A2A outbound Agent "${s}"`,n)}return{version:2,agents:i,...e.server===void 0?{}:{server:ni(e.server,n)}}}o(Ie,"parseA2AIntegrationDocument");function ri(t){return $r("sha256").update(t).digest("hex")}o(ri,"hash");function Vt(t){let e=Ye("a2a",t),n=Nr(e),r=n?Dr(e,"utf8"):JSON.stringify({version:2,agents:{}}),i;try{i=JSON.parse(r)}catch(A){throw new Error("Invalid A2A integration JSON.",{cause:A})}let s=Ie(i),a=P(i,"A2A integration config");if(a.version!==1&&a.version!==2)throw new Error("A2A integration config version must be 1 or 2.");let c=a.version;return{snapshot:{domain:"a2a",source:n?"user":"default",path:e,revision:ri(r),document:s,loadedAt:new Date().toISOString()},sourceVersion:c,nonEmptyLegacy:c===1&&(Object.keys(s.agents).length>0||s.server!==void 0)}}o(Vt,"loadA2AIntegration");function Fe(t){return Vt(t).snapshot}o(Fe,"readA2AIntegration");function ii(t){let e=Vt(t);return{sourceVersion:e.sourceVersion,snapshot:e.snapshot}}o(ii,"inspectA2AIntegration");function si(t,e){if(Je(t,e))return{kind:"none",fields:[]};if(t===void 0||e===void 0)return{kind:"restart-required",fields:["server"]};let n=["execution","dataDir"].filter(i=>!Je(t[i],e[i])),r=["published","publicBaseUrl","authentication","limits"].filter(i=>!Je(t[i],e[i]));return n.length>0?{kind:"restart-required",fields:[...n,...r]}:{kind:"hot",fields:r}}o(si,"classifyA2AServerChange");import{timingSafeEqual as oi}from"node:crypto";import Gt from"node:os";import Xt from"node:path";function ai(t){return t==="~"?Gt.homedir():t.startsWith("~/")||t.startsWith("~\\")?Xt.join(Gt.homedir(),t.slice(2)):Xt.resolve(t)}o(ai,"expandHome");function ci(t){let e=t.headers.get("authorization");return(e?/^Bearer ([^\s]+)$/i.exec(e):null)?.[1]}o(ci,"bearerToken");function di(t,e){let n=Buffer.from(t),r=Buffer.from(e);return n.byteLength===r.byteLength&&oi(n,r)}o(di,"equalSecret");function ui(t,e=process.env){let n=e[t.tokenEnv];if(!n)throw new Error(`A2A bearer token environment variable is unset: ${t.tokenEnv}.`);return{securityRealm:`bearer-env:${t.tokenEnv}`,securitySchemes:{bearer:{httpAuthSecurityScheme:{scheme:"Bearer",bearerFormat:"opaque"}}},securityRequirements:[{schemes:{bearer:{list:[]}}}],async authenticate(r){let i=ci(r);return i&&di(n,i)?{subject:t.principalId,scopes:["a2a:invoke"]}:null}}}o(ui,"createBearerEnvA2AAuthentication");function Qt(t,e){return t.type==="bearer-env"?ui(t,e):$t(t)}o(Qt,"createConfiguredAuthentication");function Zt(t,e){return{name:t.published.name,description:t.published.description,version:t.published.version,publicBaseUrl:t.publicBaseUrl??e,skills:t.published.skills,inputModes:t.published.inputModes,outputModes:t.published.outputModes,...t.execution.profileId?{profileId:t.execution.profileId}:{}}}o(Zt,"publishedAgent");function Yt(){return Promise.resolve(!0)}o(Yt,"authorization");function Zs(t){return{runtime:t.runtime,agent:Zt(t.config,t.listenBaseUrl),execution:t.config.execution,dataDir:ai(t.config.dataDir),limits:t.config.limits,authentication:Qt(t.config.authentication,t.env),authorize:Yt}}o(Zs,"createA2AServerOptionsFromConfig");function Ys(t){return{agent:Zt(t.config,t.listenBaseUrl),limits:t.config.limits,authentication:Qt(t.config.authentication,t.env),authorize:Yt}}o(Ys,"createA2AServerHotOptions");import{createHash as li}from"node:crypto";import{isDeepStrictEqual as Ai}from"node:util";var K="kodax-a2a-runtime-config-v1",Ve="kodax-a2a-config-v1:";function pi(t){let e=t.toLowerCase().replace(/^\[|\]$/g,"");return e==="localhost"||e==="127.0.0.1"||e==="::1"}o(pi,"isExactLoopback");function We(t){let e=t.map(n=>pi(n.hostname));if(e.some(Boolean)&&!e.every(Boolean))throw new Error("Configured A2A Agent and OAuth endpoints must not mix loopback and public origins.");return{allowedOrigins:[...new Set(t.map(n=>n.origin))],allowPrivateAddresses:e.every(Boolean),requestTimeoutMs:1e4,maxResponseBytes:1e6,maxRedirects:3}}o(We,"networkPolicy");var fi=32*1024*1024;function hi(t){let e=t.executorConfig?.interfaceUrl;if(typeof e!="string")throw new Error("Configured A2A registration has no interface URL.");return new URL(e)}o(hi,"registrationUrl");function gi(t){let e=[hi(t)],n=t.executorConfig?.authentication;if(n!==null&&typeof n=="object"&&!Array.isArray(n)){let r=n.tokenUrl;typeof r=="string"&&e.push(new URL(r))}return e}o(gi,"registrationNetworkUrls");function mi(){let t=o(e=>{if(!e.startsWith("env:")||e.length===4)throw new Error("Configured A2A credentials must use an environment reference.");return e.slice(4)},"environmentName");return{isAvailable(e){let n=process.env[t(e)];return typeof n=="string"&&n.length>0},async withCredential(e,n){let r=process.env[t(e)];if(!r)throw new Error("Configured A2A credential is unavailable.");return n(r)}}}o(mi,"environmentCredentialBroker");var yi=o(({artifact:t})=>{if(t.provenance!=="a2a"||!t.uri)return{allowed:!1,reason:"Configured A2A artifacts require an A2A provenance URI."};let e;try{e=new URL(t.uri).protocol}catch{return{allowed:!1,reason:"Configured A2A artifact URI is invalid."}}return e!=="data:"&&e!=="http:"&&e!=="https:"?{allowed:!1,reason:`Configured A2A artifact URI scheme is not allowed: ${e}`}:{allowed:!0}},"configuredA2AArtifactPolicy");function wi(t,e){return{agentId:`external:${t}`,agentCardUrl:e.cardUrl,...e.credentialEnv?{credentialRef:`env:${e.credentialEnv}`}:{},...e.authentication?{authentication:{type:"oauth2-client-credentials",scheme:e.authentication.scheme,issuer:e.authentication.issuer,tokenUrl:e.authentication.tokenUrl,clientId:e.authentication.clientId,clientSecretRef:`env:${e.authentication.clientSecretEnv}`,scopes:e.authentication.scopes,...e.authentication.resource?{resource:e.authentication.resource}:{},clientAuthentication:e.authentication.clientAuthentication}}:{},effects:{remote:e.effect}}}o(wi,"registrationInput");function ki(t){let e=t.authentication?[t.authentication.type,t.authentication.scheme,t.authentication.issuer,t.authentication.tokenUrl,t.authentication.clientId,t.authentication.clientSecretEnv,t.authentication.scopes,t.authentication.resource??null,t.authentication.clientAuthentication]:null;return li("sha256").update(JSON.stringify([t.cardUrl,t.credentialEnv??null,e,t.effect])).digest("hex")}o(ki,"configFingerprint");function en(t){if(!t.startsWith(Ve))return;let e=Ve.length,n=t.indexOf(":",e);if(n<0)return;let r=t.slice(e,n),i=t.slice(n+1);if(!(!/^[a-f0-9]{64}$/.test(r)||i.length===0))return{fingerprint:r,registrationRevision:i}}o(en,"parseConfiguredRegistrationRevision");function Si(t,e){let n=en(e)?.registrationRevision??e;return`${Ve}${t}:${n}`}o(Si,"configuredRegistrationRevision");function Ri(t,e){return{...t,managementOwner:K,configurationRevision:Si(e,t.configurationRevision)}}o(Ri,"markConfiguredRegistration");function co(t){return{runtimeOptions:{factories:[xt(n=>({networkPolicy:We(gi(n)),maxTaskResponseBytes:fi,pollIntervalMs:500,...t.fetch?{fetch:t.fetch}:{}}))],policy:o(()=>({allowed:!0}),"policy"),credentialBroker:mi(),artifactPolicy:yi},async start(n){let r=new Map,i=new Map,s=o(l=>{try{t.onEvent?.(l)}catch(p){V({source:"a2a.runtime-config",level:"warn",message:"A2A Runtime event observer failed.",detail:p})}},"notify"),a=o((l,p,h)=>{V({source:"a2a.runtime-config",level:"warn",message:`A2A Agent "${l}" reconciliation failed; ${p}.`,detail:h}),s(`A2A Agent "${l}" could not be reconciled; ${p}.`)},"reportEntryFailure"),c=new et({domain:"a2a",configHome:t.configHome,validate:Ie,read:o(()=>Fe(t.configHome),"read")}),d=o(async(l,p)=>{if(p.managementOwner!==void 0&&p.managementOwner!==K)throw new Error(`A2A registration "${l}" is owned by ${p.managementOwner}.`);let h=r.get(l),k=await n.admin.agentRegistrations.setEnabled(l,!1,{expectedConfigurationRevision:p.configurationRevision,expectedManagementOwner:p.managementOwner??null,...p.managementOwner===void 0?{claimOwner:K}:{}});if(!k){r.delete(l),s(`A2A registration "${l}" changed concurrently; disable was deferred.`);return}return h?.configurationRevision===p.configurationRevision&&h.endpointIdentityHash===p.endpointIdentityHash?r.set(l,{...h,managementOwner:K,enabled:!1}):r.delete(l),k},"persistDisabledFence"),A=o(async(l,p,h,k,w,y)=>{let T=`external:${l}`;try{let m=new URL(p.cardUrl),S=[m,...p.authentication?[new URL(p.authentication.tokenUrl)]:[]];We(S);let q=await Et(wi(l,p),{networkPolicy:We([m]),pollIntervalMs:500,...t.fetch?{fetch:t.fetch}:{}}),R=Ri(q.registration,h);await n.admin.agentRegistrations.upsert(R,{expectedConfigurationRevision:w,expectedManagementOwner:y}),r.set(T,R),i.set(T,p)}catch(m){let S=k?"the live registration was left unchanged":"the activation was not applied";V({source:"a2a.runtime-config",level:"warn",message:`A2A Agent "${l}" refresh failed; ${S}.`,detail:m}),s(`A2A Agent "${l}" could not be refreshed; ${S}.`)}},"refreshConfiguredAgent"),f=o(async l=>{let p=await n.admin.agentRegistrations.list(),h=new Map(p.map(y=>[y.agentId,y])),k=new Set(Object.keys(l.agents).map(y=>`external:${y}`));for(let[y,T]of h){if(k.has(y)||T.managementOwner!==K)continue;let m;try{m=await n.admin.agentRegistrations.remove(y,{expectedConfigurationRevision:T.configurationRevision,expectedManagementOwner:K})}catch(S){a(y,"removal was not applied",S);continue}if(!m){r.delete(y),s(`A2A registration "${y}" changed concurrently; removal was deferred.`);continue}r.delete(y),i.delete(y),h.delete(y)}for(let[y,T]of Object.entries(l.agents)){if(T.enabled)continue;let m=`external:${y}`,S=h.get(m);if(S?.managementOwner!==void 0&&S.managementOwner!==K){a(m,"the registration belongs to another manager",new Error(`A2A registration "${m}" is owned by ${S.managementOwner}.`));continue}if(S&&(S.enabled||S.managementOwner!==K))try{let q=await d(m,S);q?h.set(m,q):h.delete(m)}catch(q){a(m,"the disabled fence was not applied",q);continue}i.set(m,T)}let w=[];for(let[y,T]of Object.entries(l.agents)){if(!T.enabled)continue;let m=`external:${y}`,S=ki(T),q=i.get(m),R=h.get(m);if(R?.managementOwner!==void 0&&R.managementOwner!==K){a(m,"the registration belongs to another manager",new Error(`A2A registration "${m}" is owned by ${R.managementOwner}.`));continue}let O=R?en(R.configurationRevision):void 0,j=r.get(m),Ge=j!==void 0&&R!==void 0&&j.configurationRevision===R.configurationRevision&&j.endpointIdentityHash===R.endpointIdentityHash;if(R?.enabled&&R.managementOwner===K&&O?.fingerprint===S&&q&&Ai(q,T)&&Ge)continue;let Xe=R?.enabled===!0&&R.managementOwner===K&&O?.fingerprint===S&&(j===void 0||Ge),Qe=R?.configurationRevision??null,Ze=R?.managementOwner??null;if(R&&!Xe&&(R.enabled||R.managementOwner!==K)){let ce;try{ce=await d(m,R)}catch(tn){a(m,"the authority fence was not applied",tn);continue}if(!ce){h.delete(m);continue}h.set(m,ce),Qe=ce.configurationRevision,Ze=ce.managementOwner??null}w.push(A(y,T,S,Xe,Qe,Ze))}await Promise.all(w)},"reconcile");try{let l=await c.initialize();return await f(l.document),c.subscribe(async p=>{await f(p.document);let h=Object.values(p.document.agents).filter(k=>k.enabled).length;s(`A2A configuration hot-reloaded (${h} enabled outbound Agents).`)}),c.startWatching(),{status:o(()=>c.status(),"status"),async reload(){await c.reload()},close(){c.close()}}}catch(l){throw c.close(),l}}}}o(co,"createConfiguredA2ARuntimeIntegration");export{u as A2AError,Ce as A2A_EXECUTOR_ID,te as A2A_PROTOCOL_VERSION,fi as CONFIGURED_A2A_TASK_RESPONSE_BYTES,re as assertOAuthScopeToken,vn as assertSafeA2AUrl,si as classifyA2AServerChange,yi as configuredA2AArtifactPolicy,xt as createA2AAgentExecutorFactory,Ys as createA2AServerHotOptions,Zs as createA2AServerOptionsFromConfig,ui as createBearerEnvA2AAuthentication,co as createConfiguredA2ARuntimeIntegration,Rs as createKodaXA2AServer,ht as createOAuth2ClientCredentialsTokenManager,$t as createOAuth2JwtA2AAuthentication,X as decodeUtf8,Et as discoverA2ARegistration,ge as errorMessage,ii as inspectA2AIntegration,ot as isEventStreamMediaType,me as isExactOAuthLoopbackHostname,de as isJsonMediaType,g as isRecord,Ls as migrateA2ALegacyTaskOwners,ct as parseA2AAgentCard,Ie as parseA2AIntegrationDocument,N as parseA2AMessage,dt as parseA2APart,F as parseA2ASecurity,z as parseA2ATask,ut as parseJsonRpcRequest,$ as parseOAuthEndpointUrl,H as parseOAuthIssuerIdentifier,ne as parseOAuthResourceIdentifier,ie as parseOAuthScopeList,tt as parseOAuthScopeValue,Ts as prepareKodaXA2AServer,Fe as readA2AIntegration,v as requireNonEmptyString,G as safeA2AFetch,ye as satisfiableA2ASecurityRequirements,xi as selectA2ASecurityRequirement};