@kodax-ai/kodax 0.7.71 → 0.7.72

package/dist/sdk-a2a.d.ts

@@ -1,22 +1,23 @@
-import { ax as ExternalAgentRegistration, u as AgentEffectDeclaration, x as AgentExecutorFactory, g as AgentArtifactPolicy } from './types-chunks/types.d-CRCaLt_s.js';
+import { b5 as ExternalAgentRegistration, I as AgentEffectDeclaration, Q as AgentExecutorFactory, m as AgentArtifactPolicy } from './types-chunks/types.d-DH1mvdcl.js';
 import { RuntimeKodaXOptions, RuntimeWorkspaceBinding, RuntimeExecutionToolPolicy, RuntimeUserMarkdownAgentRef, KodaXRuntime, RuntimeExternalAgentsOptions } from './sdk-runtime.js';
 import { c as IntegrationConfigSnapshot, e as IntegrationConfigStatus } from './types-chunks/integration-config.d-ojG4swOP.js';
 import './types-chunks/types.d-Cqaw71Ax.js';
-import './types-chunks/bash-prefix-extractor.d-YoiZl5yt.js';
-import './types-chunks/types.d-vJExiRje.js';
+import './types-chunks/bash-prefix-extractor.d-CHJO5y94.js';
+import './types-chunks/types.d-DCQVBqVn.js';
 import 'vscode-languageserver-protocol';
 import './types-chunks/cost-tracker.d-BeaenODW.js';
 import './types-chunks/capability.d-K664nHOS.js';
 import './types-chunks/base.d-Cz_rwpOi.js';
 import './types-chunks/config.d-CJy1WENT.js';
 import './types-chunks/manager.d-B67TmPO1.js';
-import './types-chunks/run-manager.d-DxU3SSGR.js';
-import './types-chunks/types.d-CzsLFqmf.js';
-import './types-chunks/utils.d-Cb6vdvFM.js';
-import './types-chunks/guardrail.d-DdeDWnVu.js';
-import './types-chunks/guardrail.d-DilYC1dh.js';
+import './types-chunks/run-manager.d-Bh50OdVl.js';
+import './types-chunks/types.d-EqQmHztg.js';
+import './types-chunks/utils.d-gmn3c5U4.js';
+import './types-chunks/guardrail.d-auV61_h5.js';
+import './types-chunks/guardrail.d-DlpMnd-Y.js';
 import 'readline';
-import './types-chunks/public-api.d-BvCp5VkW.js';
+import './types-chunks/public-api.d--IDNJsu1.js';
+import './types-chunks/center-types.d-BBT122uJ.js';
 import 'child_process';
 
 declare const A2A_PROTOCOL_VERSION = "1.0";

package/dist/sdk-a2a.js

@@ -1,5 +1,5 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import"./chunks/chunk-Z535BARK.js";import"./chunks/chunk-F7KGYHJ3.js";import{f as Ye,l as et}from"./chunks/chunk-GVTM4Z6O.js";import"./chunks/chunk-SX2WFHIS.js";import"./chunks/chunk-A574DBTV.js";import"./chunks/chunk-A2TFSV5M.js";import"./chunks/chunk-PHH4TRGF.js";import"./chunks/chunk-T7LYK53M.js";import"./chunks/chunk-64NQBOSN.js";import"./chunks/chunk-44QXPEEE.js";import"./chunks/chunk-PVUXONQB.js";import"./chunks/chunk-ZJIMT5I3.js";import"./chunks/chunk-Y5XKAN7C.js";import{b as V}from"./chunks/chunk-52JSZ77P.js";import"./chunks/chunk-VRSVNU2Y.js";import"./chunks/chunk-23X6REO4.js";import{a as o}from"./chunks/chunk-ONUPGMER.js";var te="1.0",Ce="kodax-a2a-v1-jsonrpc";var u=class extends Error{constructor(n,r,i=200,s,a){super(r);this.code=n;this.httpStatus=i;this.data=s;this.headers=a;this.name="A2AError"}code;httpStatus;data;headers;static{o(this,"A2AError")}};function ge(t){return t instanceof Error?t.message:String(t)}o(ge,"errorMessage");var nn=["apiKeySecurityScheme","httpAuthSecurityScheme","oauth2SecurityScheme","openIdConnectSecurityScheme","mtlsSecurityScheme"],rn=["authorizationCode","clientCredentials","implicit","password","deviceCode"],sn=/^[\x21\x23-\x5B\x5D-\x7E]+$/u;function re(t,e){if(!sn.test(t))throw new Error(`${e} must be an RFC 6749 scope-token.`)}o(re,"assertOAuthScopeToken");function tt(t,e){let n=t.split(" ");for(let r of n)re(r,e);return[...new Set(n)]}o(tt,"parseOAuthScopeValue");function ie(t,e){if(!Array.isArray(t))throw new Error(`${e} must be an array of strings.`);let n=t.map((r,i)=>{if(typeof r!="string")throw new Error(`${e}[${i}] must be a string.`);return re(r,`${e}[${i}]`),r});if(new Set(n).size!==n.length)throw new Error(`${e} must not contain duplicates.`);return n}o(ie,"parseOAuthScopeList");function B(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}o(B,"isRecord");function v(t,e){if(typeof t!="string"||t.trim().length===0)throw new Error(`${e} must be a non-empty string.`);return t}o(v,"requireNonEmptyString");function on(t,e){if(t!==void 0)return v(t,e)}o(on,"optionalString");function nt(t,e){return v(t,e).trim()}o(nt,"trimmedUri");function an(t){return/^[A-Za-z][A-Za-z0-9+.-]*:\/\/([^/?#]*)/u.exec(t)?.[1]?.includes("@")===!0}o(an,"hasAuthorityUserinfo");function me(t){let e=t.toLowerCase().replace(/^\[|\]$/gu,"");return e==="localhost"||e==="127.0.0.1"||e==="::1"}o(me,"isExactOAuthLoopbackHostname");function rt(t,e){let n=nt(t,e);if(!/^https?:\/\/([^/?#]*)/iu.exec(n)?.[1])throw new Error(`${e} must be an absolute HTTP(S) URL.`);let i;try{i=new URL(n)}catch{throw new Error(`${e} must be an absolute HTTP(S) URL.`)}if(an(n)||i.username||i.password||n.includes("#"))throw new Error(`${e} must not contain userinfo or a fragment.`);if(i.protocol==="http:"&&!me(i.hostname))throw new Error(`${e} must use HTTPS or exact loopback HTTP.`);return{raw:n,url:i}}o(rt,"secureOAuthHttpUrl");function H(t,e){let n=rt(t,e);if(n.raw.includes("?"))throw new Error(`${e} must not contain a query or fragment.`);return n.raw}o(H,"parseOAuthIssuerIdentifier");function $(t,e){return rt(t,e).url}o($,"parseOAuthEndpointUrl");function ne(t,e){let n=nt(t,e);if(!/^[A-Za-z][A-Za-z0-9+.-]*:/u.test(n))throw new Error(`${e} must be an absolute URI.`);try{new URL(n)}catch{throw new Error(`${e} must be an absolute URI.`)}if(n.includes("#"))throw new Error(`${e} must not contain a fragment.`);return n}o(ne,"parseOAuthResourceIdentifier");function it(t,e){return $(t,e).href}o(it,"absoluteHttpUrl");function cn(t,e){if(!B(t))throw new Error(`${e} must be a scope-description object.`);return Object.entries(t).map(([n,r])=>{if(n.trim().length===0||typeof r!="string")throw new Error(`${e} must map non-empty scope names to descriptions.`);return re(n,`${e}.${n}`),n})}o(cn,"parseScopes");function dn(t,e){if(!B(e))throw new Error(`securitySchemes.${t}.httpAuthSecurityScheme must be an object.`);let n=v(e.scheme,`securitySchemes.${t}.httpAuthSecurityScheme.scheme`),r=on(e.bearerFormat,`securitySchemes.${t}.httpAuthSecurityScheme.bearerFormat`);return n.toLowerCase()!=="bearer"?{name:t,kind:"unsupported",protocol:`http:${n.toLowerCase()}`}:{name:t,kind:"http-bearer",...r?{bearerFormat:r}:{}}}o(dn,"parseHttpScheme");function un(t,e){let n=e.flows;if(!B(n))throw new Error(`securitySchemes.${t}.oauth2SecurityScheme.flows must be an object.`);let r=rn.filter(c=>n[c]!==void 0);if(r.length!==1)throw new Error(`securitySchemes.${t}.oauth2SecurityScheme.flows must contain exactly one OAuth flow.`);let i=r[0],s=n[i];if(!B(s))throw new Error(`securitySchemes.${t}.oauth2SecurityScheme.flows.${i} must be an object.`);let a=cn(s.scopes,`securitySchemes.${t}.oauth2SecurityScheme.flows.${i}.scopes`);if(i==="clientCredentials"){let c=it(s.tokenUrl,`securitySchemes.${t}.oauth2SecurityScheme.flows.clientCredentials.tokenUrl`);return{name:t,kind:"oauth2-client-credentials",tokenUrl:c,scopes:a}}return{name:t,kind:"unsupported",protocol:`oauth2:${i}`,oauthScopes:a}}o(un,"parseOAuthFlow");function ln(t,e,n){if(!B(n))throw new Error(`securitySchemes.${t}.${e} must be an object.`);if(e==="apiKeySecurityScheme"){let r=v(n.location,`securitySchemes.${t}.${e}.location`);if(!["query","header","cookie"].includes(r))throw new Error(`securitySchemes.${t}.${e}.location must be query, header, or cookie.`);return v(n.name,`securitySchemes.${t}.${e}.name`),{name:t,kind:"unsupported",protocol:"api-key"}}return e==="openIdConnectSecurityScheme"?(it(n.openIdConnectUrl,`securitySchemes.${t}.${e}.openIdConnectUrl`),{name:t,kind:"unsupported",protocol:"openid-connect",acceptsOAuthScopes:!0}):{name:t,kind:"unsupported",protocol:"mutual-tls"}}o(ln,"parseUnsupportedScheme");function An(t,e){if(!B(e))throw new Error(`securitySchemes.${t} must be an object.`);let n=nn.filter(i=>e[i]!==void 0);if(n.length!==1)throw new Error(`securitySchemes.${t} must contain exactly one security scheme.`);let r=n[0];if(r==="httpAuthSecurityScheme")return dn(t,e[r]);if(r==="oauth2SecurityScheme"){let i=e[r];if(!B(i))throw new Error(`securitySchemes.${t}.${r} must be an object.`);return un(t,i)}return ln(t,r,e[r])}o(An,"parseScheme");function pn(t){if(t===void 0)return{};if(!B(t))throw new Error("securitySchemes must be an object.");return Object.fromEntries(Object.entries(t).map(([e,n])=>{if(e.trim().length===0)throw new Error("securitySchemes names must not be empty.");return[e,An(e,n)]}))}o(pn,"parseSchemes");function fn(t,e){if(!B(t))throw new Error(`${e} must be a StringList object.`);if(t.list===void 0)return[];if(!Array.isArray(t.list)||!t.list.every(n=>typeof n=="string"&&n.trim().length>0))throw new Error(`${e}.list must be an array of non-empty strings.`);if(new Set(t.list).size!==t.list.length)throw new Error(`${e}.list must not contain duplicate scopes.`);for(let n of t.list)re(n,`${e}.list`);return t.list}o(fn,"parseScopeList");function hn(t,e){if(t.kind==="oauth2-client-credentials"||t.kind==="unsupported"&&t.oauthScopes!==void 0){let n=t.kind==="oauth2-client-credentials"?t.scopes:t.oauthScopes??[];for(let r of e)if(!n.includes(r))throw new Error(`scope "${r}" is not declared by security scheme "${t.name}".`);return}if(e.length>0&&!(t.kind==="unsupported"&&t.acceptsOAuthScopes))throw new Error(`security scheme "${t.name}" does not accept OAuth scopes.`)}o(hn,"validateRequiredScopes");function gn(t,e,n){if(!B(t))throw new Error(`securityRequirements[${e}] must be an object.`);let r=t.schemes;if(r!==void 0&&!B(r))throw new Error(`securityRequirements[${e}].schemes must be an object.`);return{schemes:Object.entries(r??{}).map(([a,c])=>{if(!Object.hasOwn(n,a))throw new Error(`securityRequirements[${e}] references unknown security scheme "${a}".`);let d=n[a],A=fn(c,`securityRequirements[${e}].schemes.${a}`);return hn(d,A),{scheme:d,scopes:A}})}}o(gn,"parseRequirement");function F(t,e){let n=pn(t);if(e===void 0)return{schemes:n,requirements:[]};if(!Array.isArray(e))throw new Error("securityRequirements must be an array.");return{schemes:n,requirements:e.map((r,i)=>gn(r,i,n))}}o(F,"parseA2ASecurity");function mn(t,e){let{scheme:n,scopes:r}=e;return n.kind!=="unsupported"&&t.schemeName===n.name&&t.kind===n.kind&&r.every(i=>t.scopes?.includes(i)===!0)}o(mn,"capabilityMatches");function xi(t,e){return ye(t,e)[0]??null}o(xi,"selectA2ASecurityRequirement");function ye(t,e){return(t.requirements.length===0?[{schemes:[]}]:t.requirements).filter(r=>r.schemes.every(i=>e.some(s=>mn(s,i))))}o(ye,"satisfiableA2ASecurityRequirements");var yn=new Set(["TASK_STATE_UNSPECIFIED","TASK_STATE_SUBMITTED","TASK_STATE_WORKING","TASK_STATE_COMPLETED","TASK_STATE_FAILED","TASK_STATE_CANCELED","TASK_STATE_INPUT_REQUIRED","TASK_STATE_REJECTED","TASK_STATE_AUTH_REQUIRED"]);function g(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}o(g,"isRecord");function st(t){if(t===null)return;let e=t.split(";",1)[0]?.trim().toLowerCase();return e&&!/\s/u.test(e)?e:void 0}o(st,"mediaTypeEssence");function de(t){let e=st(t);return e==="application/json"||/^application\/[!#$%&'*+\-.^_`|~0-9a-z]+\+json$/u.test(e??"")}o(de,"isJsonMediaType");function ot(t){return st(t)==="text/event-stream"}o(ot,"isEventStreamMediaType");function U(t,e,n){let r=t[e];if(typeof r!="string"||r.trim().length===0)throw new u(-32602,`${n}.${e} must be a non-empty string.`);return r}o(U,"requiredString");function b(t,e){let n=t[e];return typeof n=="string"&&n.length>0?n:void 0}o(b,"optionalString");function se(t,e){if(!Array.isArray(t)||!t.every(n=>typeof n=="string"))throw new u(-32602,`${e} must be a string array.`);return t}o(se,"stringArray");function wn(t){if(!g(t))throw new u(-32602,"Agent Card interface is invalid.");return{url:U(t,"url","interface"),protocolBinding:U(t,"protocolBinding","interface"),protocolVersion:U(t,"protocolVersion","interface"),...b(t,"tenant")?{tenant:b(t,"tenant")}:{}}}o(wn,"parseInterface");function at(t,e,n){try{F(t,e)}catch(r){let i=r instanceof Error?r.message:String(r);throw new u(-32602,`${n} is invalid: ${i}`)}}o(at,"validateSecurity");function kn(t,e){if(!g(t))throw new u(-32602,"Agent Card skill is invalid.");return t.securityRequirements!==void 0&&at(e,t.securityRequirements,"skill.securityRequirements"),{id:U(t,"id","skill"),name:U(t,"name","skill"),description:U(t,"description","skill"),tags:se(t.tags,"skill.tags"),...Array.isArray(t.examples)?{examples:se(t.examples,"skill.examples")}:{},...Array.isArray(t.inputModes)?{inputModes:se(t.inputModes,"skill.inputModes")}:{},...Array.isArray(t.outputModes)?{outputModes:se(t.outputModes,"skill.outputModes")}:{},...Array.isArray(t.securityRequirements)?{securityRequirements:t.securityRequirements.filter(g)}:{}}}o(kn,"parseSkill");function Sn(t){if(!g(t))throw new u(-32602,"Agent Card extension is invalid.");let e=U(t,"uri","extension");try{new URL(e)}catch{throw new u(-32602,"Agent Card extension.uri must be an absolute URI.")}if(t.description!==void 0&&typeof t.description!="string")throw new u(-32602,"Agent Card extension.description must be a string.");if(t.required!==void 0&&typeof t.required!="boolean")throw new u(-32602,"Agent Card extension.required must be a boolean.");if(t.params!==void 0&&!g(t.params))throw new u(-32602,"Agent Card extension.params must be an object.");return{uri:e,...typeof t.description=="string"?{description:t.description}:{},...typeof t.required=="boolean"?{required:t.required}:{},...g(t.params)?{params:t.params}:{}}}o(Sn,"parseExtension");function ct(t){if(!g(t))throw new u(-32602,"Agent Card must be an object.");let e=t.supportedInterfaces,n=t.skills;if(!Array.isArray(e)||e.length===0)throw new u(-32602,"Agent Card must declare supportedInterfaces.");if(!Array.isArray(n))throw new u(-32602,"Agent Card must declare skills.");if(!g(t.capabilities))throw new u(-32602,"Agent Card capabilities are invalid.");if(t.capabilities.extensions!==void 0&&!Array.isArray(t.capabilities.extensions))throw new u(-32602,"Agent Card capabilities.extensions must be an array.");return at(t.securitySchemes,t.securityRequirements,"Agent Card security declaration"),{name:U(t,"name","Agent Card"),description:U(t,"description","Agent Card"),supportedInterfaces:e.map(wn),version:U(t,"version","Agent Card"),capabilities:{...typeof t.capabilities.streaming=="boolean"?{streaming:t.capabilities.streaming}:{},...typeof t.capabilities.pushNotifications=="boolean"?{pushNotifications:t.capabilities.pushNotifications}:{},...typeof t.capabilities.extendedAgentCard=="boolean"?{extendedAgentCard:t.capabilities.extendedAgentCard}:{},...Array.isArray(t.capabilities.extensions)?{extensions:t.capabilities.extensions.map(Sn)}:{}},...g(t.securitySchemes)?{securitySchemes:t.securitySchemes}:{},...Array.isArray(t.securityRequirements)?{securityRequirements:t.securityRequirements.filter(g)}:{},defaultInputModes:se(t.defaultInputModes,"Agent Card defaultInputModes"),defaultOutputModes:se(t.defaultOutputModes,"Agent Card defaultOutputModes"),skills:n.map(r=>kn(r,t.securitySchemes))}}o(ct,"parseA2AAgentCard");function dt(t){if(!g(t))throw new u(-32602,"Message Part must be an object.");let e=["text","raw","url","data"].filter(r=>t[r]!==void 0);if(e.length!==1)throw new u(-32602,"Message Part must contain exactly one content field.");let n=e[0];if(n!=="data"&&typeof t[n]!="string")throw new u(-32602,`Message Part ${n} content must be a string.`);return{...typeof t.text=="string"?{text:t.text}:{},...typeof t.raw=="string"?{raw:t.raw}:{},...typeof t.url=="string"?{url:t.url}:{},...t.data!==void 0?{data:t.data}:{},...g(t.metadata)?{metadata:t.metadata}:{},...b(t,"filename")?{filename:b(t,"filename")}:{},...b(t,"mediaType")?{mediaType:b(t,"mediaType")}:{}}}o(dt,"parseA2APart");function N(t){if(!g(t))throw new u(-32602,"Message must be an object.");if(t.role!=="ROLE_USER"&&t.role!=="ROLE_AGENT")throw new u(-32602,"Message role is invalid.");if(!Array.isArray(t.parts)||t.parts.length===0)throw new u(-32602,"Message parts must not be empty.");return{messageId:U(t,"messageId","Message"),role:t.role,parts:t.parts.map(dt),...b(t,"contextId")?{contextId:b(t,"contextId")}:{},...b(t,"taskId")?{taskId:b(t,"taskId")}:{},...g(t.metadata)?{metadata:t.metadata}:{}}}o(N,"parseA2AMessage");function Rn(t){if(!g(t)||!Array.isArray(t.parts)||t.parts.length===0)throw new u(-32603,"A2A artifact is invalid.");return{artifactId:U(t,"artifactId","Artifact"),parts:t.parts.map(dt),...b(t,"name")?{name:b(t,"name")}:{},...b(t,"description")?{description:b(t,"description")}:{},...g(t.metadata)?{metadata:t.metadata}:{}}}o(Rn,"parseArtifact");function z(t){if(!g(t)||!g(t.status))throw new u(-32603,"A2A task is invalid.");let e=t.status.state;if(typeof e!="string")throw new u(-32603,"A2A task state is invalid.");let n=yn.has(e)?e:"TASK_STATE_UNSPECIFIED";return{id:U(t,"id","Task"),contextId:b(t,"contextId")??"",status:{state:n,...t.status.message!==void 0?{message:N(t.status.message)}:{},...b(t.status,"timestamp")?{timestamp:b(t.status,"timestamp")}:{}},...Array.isArray(t.artifacts)?{artifacts:t.artifacts.map(Rn)}:{},...Array.isArray(t.history)?{history:t.history.map(N)}:{},...g(t.metadata)?{metadata:t.metadata}:{}}}o(z,"parseA2ATask");function ut(t){if(!g(t)||t.jsonrpc!=="2.0")throw new u(-32600,"Invalid JSON-RPC request.");if(typeof t.id!="string"&&typeof t.id!="number")throw new u(-32600,"JSON-RPC request id is required.");return{jsonrpc:"2.0",id:t.id,method:U(t,"method","JSON-RPC request"),...g(t.params)?{params:t.params}:{}}}o(ut,"parseJsonRpcRequest");import{lookup as Tn}from"node:dns/promises";import{request as En}from"node:http";import{request as bn}from"node:https";import{BlockList as xn,isIP as At}from"node:net";import{Readable as In}from"node:stream";var we=new xn;we.addSubnet("127.0.0.0",8,"ipv4");we.addAddress("::1","ipv6");function pt(t){let e=At(t);return e===4?we.check(t,"ipv4"):e===6&&we.check(t,"ipv6")}o(pt,"isLoopbackAddress");function ve(t){let e=t.split(".").map(Number),[n,r,i,s]=e;return e.length!==4||n===void 0||r===void 0||i===void 0||s===void 0?!0:n===0||n===10||n===127||n===100&&r>=64&&r<=127||n===169&&r===254||n===172&&r>=16&&r<=31||n===192&&r===168||n===192&&r===0&&i===0&&s!==9&&s!==10||n===192&&r===0&&i===2||n===198&&(r===18||r===19)||n===198&&r===51&&i===100||n===203&&r===0&&i===113||n>=224}o(ve,"isPrivateIpv4");function Cn(t){if(pt(t))return!0;let e=t.toLowerCase(),n=/^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(e)?.[1];if(n)return ve(n);let r=/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(e);if(r?.[1]&&r[2]){let i=Number.parseInt(r[1],16),s=Number.parseInt(r[2],16);return ve(`${i>>8}.${i&255}.${s>>8}.${s&255}`)}return e==="::"||e==="::1"||e.startsWith("fc")||e.startsWith("fd")||e.startsWith("fe8")||e.startsWith("fe9")||e.startsWith("fea")||e.startsWith("feb")||e.startsWith("ff")}o(Cn,"isPrivateIpv6");function lt(t){let e=At(t);return e===4?ve(t):e===6?Cn(t):!0}o(lt,"isPrivateAddress");async function ft(t,e){if(t.protocol!=="https:"&&t.protocol!=="http:")throw new u(-32602,"A2A URL must use HTTP or HTTPS.");if(!e.allowedOrigins.includes(t.origin))throw new u(-32602,`A2A origin is not allowed: ${t.origin}`);if(t.username||t.password)throw new u(-32602,"A2A URL must not include credentials.");let n=t.hostname.startsWith("[")&&t.hostname.endsWith("]")?t.hostname.slice(1,-1):t.hostname,r=await Tn(n,{all:!0,verbatim:!0});if(r.length===0)throw new u(-32602,"A2A hostname did not resolve.");if(n.toLowerCase()==="localhost"&&!r.every(s=>pt(s.address)))throw new u(-32602,"A2A localhost target must resolve only to loopback addresses.");if(t.protocol==="http:"&&!r.every(s=>lt(s.address)))throw new u(-32602,"Public A2A targets must use HTTPS.");if(!e.allowPrivateAddresses&&r.some(s=>lt(s.address)))throw new u(-32602,"A2A private network targets are not allowed.");let i=r[0];if(i===void 0||i.family!==4&&i.family!==6)throw new u(-32602,"A2A hostname returned an unsupported address.");return{address:i.address,family:i.family}}o(ft,"validateA2AUrl");async function vn(t,e){await ft(t,e)}o(vn,"assertSafeA2AUrl");function Pn(t){if(t==null||typeof t=="string")return t??void 0;if(t instanceof URLSearchParams)return t.toString();if(t instanceof Uint8Array)return t;if(t instanceof ArrayBuffer)return new Uint8Array(t);if(ArrayBuffer.isView(t))return new Uint8Array(t.buffer,t.byteOffset,t.byteLength);throw new u(-32602,"A2A request body type is not supported by the safe transport.")}o(Pn,"encodeRequestBody");function On(t){return((e,n,r)=>{if(typeof n=="object"&&n.all){r(null,[t]);return}r(null,t.address,t.family)})}o(On,"pinnedLookup");function Un(t,e,n){return new Promise((r,i)=>{let s=new Headers(e.headers);s.set("accept-encoding","identity");let a=(t.protocol==="https:"?bn:En)(t,{method:e.method,headers:Object.fromEntries(s),lookup:On(n),signal:e.signal??void 0},c=>{let d=new Headers;for(let p=0;p<c.rawHeaders.length;p+=2){let h=c.rawHeaders[p],k=c.rawHeaders[p+1];h!==void 0&&k!==void 0&&d.append(h,k)}let A=c.statusCode??500,l=e.method!=="HEAD"&&A!==204&&A!==205&&A!==304?In.toWeb(c):null;r(new Response(l,{status:A,statusText:c.statusMessage,headers:d}))});a.once("error",i),a.end(Pn(e.body))})}o(Un,"requestValidatedAddress");async function Pe(t,e,n,r){let i=await ft(t,n);return r!==void 0?r(t,e):Un(t,e,i)}o(Pe,"openSafeA2AResponse");async function _n(t,e){let n=t.headers.get("content-length");if(n&&Number(n)>e)throw new u(-32603,"A2A response is too large.");if(!t.body)return new Uint8Array;let r=t.body.getReader(),i=[],s=0;for(;;){let d=await r.read();if(d.done)break;if(s+=d.value.byteLength,s>e)throw await r.cancel(),new u(-32603,"A2A response is too large.");i.push(d.value)}let a=new Uint8Array(s),c=0;for(let d of i)a.set(d,c),c+=d.byteLength;return a}o(_n,"boundedBody");async function G(t,e,n,r){let i=t,s=new Headers(e.headers).get("authorization");for(let a=0;a<=n.maxRedirects;a+=1){let c=new AbortController,d=setTimeout(()=>c.abort(new Error("A2A request timed out.")),n.requestTimeoutMs),A=new Headers(e.headers);s===null?A.delete("authorization"):A.set("authorization",s);try{let f=await Pe(i,{...e,headers:A,redirect:"manual",signal:c.signal},n,r);if(f.status<300||f.status>=400)return{response:f,body:await _n(f,n.maxResponseBytes),url:i};let l=f.headers.get("location");if(!l||a===n.maxRedirects)throw new u(-32603,"A2A redirect limit exceeded.");let p=new URL(l,i);await f.body?.cancel(),p.origin!==i.origin&&(s=null),i=p}finally{clearTimeout(d)}}throw new u(-32603,"A2A redirect limit exceeded.")}o(G,"safeA2AFetch");function X(t){return new TextDecoder("utf-8",{fatal:!0}).decode(t)}o(X,"decodeUtf8");import{createHash as Dn,randomUUID as Oe}from"node:crypto";import*as D from"oauth4webapi";var Mn=6e4,qn=1e3,Ln=.1;function $n(t,e){return new Response(e.byteLength===0?null:X(e),{status:t.status,statusText:t.statusText,headers:t.headers})}o($n,"oauthResponse");function Nn(t,e){if(e===void 0||e<=0)return t;let n=e*1e3,r=Math.min(Mn,Math.max(qn,n*Ln));return t+Math.max(0,n-r)}o(Nn,"cacheExpiry");function ht(t){let e=v(t.clientId,"OAuth 2.0 clientId");if(t.clientAuthenticationMethod!=="basic"&&t.clientAuthenticationMethod!=="post")throw new Error("OAuth 2.0 clientAuthenticationMethod must be basic or post.");let n=t.clientAuthenticationMethod,r=t.scopes===void 0?void 0:ie(t.scopes,"OAuth 2.0 scopes"),i=H(t.issuer,"OAuth 2.0 issuer"),s=$(t.tokenUrl,"OAuth 2.0 token endpoint"),a=t.resource===void 0?void 0:ne(t.resource,"OAuth 2.0 resource"),c={issuer:i,token_endpoint:s.href},d={client_id:e},A={...t.networkPolicy,maxRedirects:0},f=t.now??Date.now,l,p,h=0;async function k(w){let y=n==="post"?D.ClientSecretPost(w):D.ClientSecretBasic(w),T=new URLSearchParams;r&&r.length>0&&T.set("scope",r.join(" ")),a!==void 0&&T.set("resource",a);let m={[D.customFetch]:async(R,O)=>{if(new URL(R).href!==s.href)throw new Error("OAuth 2.0 token request targeted an unexpected endpoint.");let j=await G(s,{method:O.method,headers:O.headers,body:O.body,redirect:"manual",...O.signal!==void 0?{signal:O.signal}:{}},A,t.fetch);return $n(j.response,j.body)}};s.protocol==="http:"&&(m[D.allowInsecureRequests]=!0);let S;try{let R=await D.clientCredentialsGrantRequest(c,d,y,T,m);S=await D.processClientCredentialsResponse(c,d,R)}catch{throw new Error("OAuth 2.0 client credentials token request failed.")}if(S.token_type!=="bearer")throw new Error("OAuth 2.0 token endpoint did not return a Bearer access token.");let q=f();return{value:`Bearer ${S.access_token}`,expiresAt:Nn(q,S.expires_in)}}return o(k,"requestAuthorization"),{async getAuthorization(w){if(w.length===0)throw new Error("OAuth 2.0 client secret is required.");let y=f();if(l!==void 0&&l.expiresAt>y)return l.value;if(p!==void 0)return p;let T=h,m;return m=k(w).then(S=>(h===T&&S.expiresAt>f()&&(l=S),S.value)).finally(()=>{p===m&&(p=void 0)}),p=m,m},invalidate(w){if(w!==void 0){l?.value===w&&(l=void 0);return}h+=1,l=void 0,p=void 0}}}o(ht,"createOAuth2ClientCredentialsTokenManager");var gt=4,mt=/^[A-Za-z0-9\-._~+/=]$/u;function ke(t){return t!==void 0&&/^Bearer\s+\S+$/iu.test(t)}o(ke,"isBearerAuthorization");function Kn(t,e){let n="",r=0;for(;r<t.length;){let i=t.indexOf(e,r);if(i<0)return n+t.slice(r);let s=i===0?void 0:t[i-1],a=i+e.length,c=a===t.length?void 0:t[a],d=s===void 0||!mt.test(s),A=c===void 0||!mt.test(c);n+=t.slice(r,i),d&&A?(n+="[REDACTED]",r=a):(n+=e,r=a)}return n}o(Kn,"replaceBoundedToken");function Ae(t){return Array.isArray(t)?`[${t.map(Ae).join(",")}]`:g(t)?`{${Object.keys(t).sort().map(e=>`${JSON.stringify(e)}:${Ae(t[e])}`).join(",")}}`:JSON.stringify(t)??"null"}o(Ae,"stableJson");function yt(t){return`sha256:${Dn("sha256").update(t).digest("hex")}`}o(yt,"sha256");var _e=class{static{o(this,"AuthorizationRedactor")}#e=[];#n=new Map;remember(e){if(!e)return;let n=this.#e.indexOf(e);n>=0&&this.#e.splice(n,1),this.#e.unshift(e),this.#e.length>gt&&(this.#e.length=gt)}retain(e){if(!e)return()=>{};this.remember(e),this.#n.set(e,(this.#n.get(e)??0)+1);let n=!1;return()=>{if(n)return;n=!0;let r=(this.#n.get(e)??1)-1;r===0?this.#n.delete(e):this.#n.set(e,r)}}redactText(e){let n=[...new Set([...this.#n.keys(),...this.#e])],r=n.sort((s,a)=>a.length-s.length).reduce((s,a)=>s.split(a).join("[REDACTED]"),e),i=n.flatMap(s=>{let a=/^Bearer\s+(\S+)$/iu.exec(s)?.[1];return a?[a]:[]}).sort((s,a)=>a.length-s.length);return[...new Set(i)].reduce((s,a)=>Kn(s,a),r)}redactContent(e){return typeof e=="string"?this.redactText(e):Array.isArray(e)?e.map(n=>this.redactContent(n)):g(e)?Object.fromEntries(Object.entries(e).map(([n,r])=>[n,this.redactContent(r)])):e}redactPart(e){return{...e,...e.text===void 0?{}:{text:this.redactText(e.text)},...e.raw===void 0?{}:{raw:this.redactText(e.raw)},...e.url===void 0?{}:{url:this.redactText(e.url)},...e.data===void 0?{}:{data:this.redactContent(e.data)},...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)},...e.filename===void 0?{}:{filename:this.redactText(e.filename)}}}redactMessage(e){return{...e,parts:e.parts.map(n=>this.redactPart(n)),...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)}}}redactArtifact(e){return{...e,...e.name===void 0?{}:{name:this.redactText(e.name)},...e.description===void 0?{}:{description:this.redactText(e.description)},parts:e.parts.map(n=>this.redactPart(n)),...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)}}}redactTask(e){return{...e,status:{...e.status,...e.status.message===void 0?{}:{message:this.redactMessage(e.status.message)}},...e.artifacts===void 0?{}:{artifacts:e.artifacts.map(n=>this.redactArtifact(n))},...e.history===void 0?{}:{history:e.history.map(n=>this.redactMessage(n))},...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)}}}redactError(e){let n=this.redactText(e instanceof Error?e.message:String(e));return e instanceof u?new u(e.code,n,e.httpStatus,this.redactContent(e.data),e.headers):new Error(n)}};function wt(t,e){let n=new URL(e).origin;if(!t.allowedOrigins.some(i=>new URL(i).origin===n))throw new Error(`A2A endpoint origin is not allowed by network policy: ${n}`);return{...t,allowedOrigins:[n]}}o(wt,"endpointNetworkPolicy");function jn(t){if(t!==void 0){if(!g(t)||typeof t.scheme!="string")throw new Error("A2A registration authentication is invalid.");if(t.type==="http-bearer")return{type:"http-bearer",scheme:t.scheme};if(t.type!=="oauth2-client-credentials"||typeof t.issuer!="string"||typeof t.tokenUrl!="string"||typeof t.clientId!="string"||!Array.isArray(t.scopes)||!t.scopes.every(e=>typeof e=="string")||!["client-secret-basic","client-secret-post"].includes(String(t.clientAuthentication)))throw new Error("A2A registration OAuth2 authentication is invalid.");return{type:"oauth2-client-credentials",scheme:t.scheme,issuer:t.issuer,tokenUrl:t.tokenUrl,clientId:t.clientId,scopes:t.scopes,...typeof t.resource=="string"?{resource:t.resource}:{},clientAuthentication:t.clientAuthentication}}}o(jn,"executorAuthentication");function Q(t){let e=t.executorConfig;if(!g(e))throw new Error("A2A registration executorConfig is missing.");if(typeof e.agentCardUrl!="string"||typeof e.interfaceUrl!="string")throw new Error("A2A registration endpoints are invalid.");let n=jn(e.authentication);return{agentCardUrl:e.agentCardUrl,interfaceUrl:e.interfaceUrl,...typeof e.tenant=="string"?{tenant:e.tenant}:{},...n?{authentication:n}:{}}}o(Q,"executorConfig");function Bn(t,e){let n=t.supportedInterfaces.find(i=>i.protocolBinding.toUpperCase()==="JSONRPC"&&i.protocolVersion==="1.0");if(!n)throw new Error("Agent Card has no supported A2A 1.0 JSONRPC interface.");let r=new URL(n.url);if(r.username||r.password||r.hash)throw new Error("A2A interface URL must not contain credentials or a fragment.");if(r.origin!==e.origin)throw new Error("A2A interface must use the same origin as the trusted Agent Card.");return n}o(Bn,"chooseInterface");function zn(t){if(t===void 0)return;if(!g(t))throw new Error("A2A authentication must be an object.");let e=v(t.scheme,"A2A authentication.scheme");if(t.type==="http-bearer")return{type:"http-bearer",scheme:e,credentialRef:v(t.credentialRef,"A2A authentication.credentialRef")};if(t.type!=="oauth2-client-credentials")throw new Error("A2A authentication.type must be http-bearer or oauth2-client-credentials.");if(t.clientAuthentication!=="client-secret-basic"&&t.clientAuthentication!=="client-secret-post")throw new Error("A2A authentication.clientAuthentication is invalid.");return{type:"oauth2-client-credentials",scheme:e,issuer:H(t.issuer,"Configured OAuth2 issuer"),tokenUrl:$(t.tokenUrl,"Configured OAuth2 token endpoint").href,clientId:v(t.clientId,"Configured OAuth2 clientId"),clientSecretRef:v(t.clientSecretRef,"Configured OAuth2 clientSecretRef"),scopes:ie(t.scopes,"Configured OAuth2 scopes"),...t.resource===void 0?{}:{resource:ne(t.resource,"Configured OAuth2 resource")},clientAuthentication:t.clientAuthentication}}o(zn,"validatedClientAuthentication");function Jn(t){let e=t.credentialRef===void 0?void 0:v(t.credentialRef,"A2A credentialRef"),n=zn(t.authentication);if(t.credentialRef!==void 0&&t.authentication!==void 0)throw new Error("A2A registration cannot combine credentialRef with structured authentication.");return{agentId:t.agentId,agentCardUrl:t.agentCardUrl,...e!==void 0?{credentialRef:e}:{},...n!==void 0?{authentication:n}:{},effects:t.effects}}o(Jn,"validatedRegistrationInput");function Hn(t,e,n){if(t.authentication)return[[{schemeName:t.authentication.scheme,kind:t.authentication.type,...t.authentication.type==="oauth2-client-credentials"?{scopes:t.authentication.scopes}:{}}]];let r=ke(n);if(!t.credentialRef&&!r)return[[]];let i=F(e.securitySchemes,e.securityRequirements);return Object.values(i.schemes).flatMap(s=>s.kind==="http-bearer"?[[{schemeName:s.name,kind:"http-bearer"}]]:[])}o(Hn,"configuredCapabilityCandidates");function kt(t,e){for(let n of t){if(n.schemes.length!==1)continue;let r=n.schemes[0].scheme;if(e.some(i=>i.schemeName===r.name&&i.kind===r.kind))return r}}o(kt,"matchingDeclaredScheme");function Fn(t,e){let n=F(t.securitySchemes,t.securityRequirements),r=ye(n,e).filter(a=>a.schemes.length<=1);if(r.length===0)return null;let i=kt(r,e),s=[];for(let a of t.skills){let c=F(t.securitySchemes,a.securityRequirements),d=ye(c,e).filter(A=>A.schemes.length<=1);d.length!==0&&(s.push(a.id),i??=kt(d,e))}return t.skills.length>0&&s.length===0?null:{skillIds:s,...i?{declaredScheme:i}:{}}}o(Fn,"evaluateSecurityCapabilities");function Wn(t,e,n){if(t.credentialRef!==void 0&&t.authentication!==void 0)throw new Error("A2A registration cannot combine credentialRef with structured authentication.");if(n!==void 0&&!ke(n))throw new Error("A2A options.authorization must be a valid Bearer authorization.");let r=ke(n),i=t.credentialRef!==void 0||t.authentication!==void 0||r,s;for(let h of Hn(t,e,n)){let k=Fn(e,h);if(k&&(!i||k.declaredScheme)){s=k;break}}if(!s)throw new Error(i?"Configured A2A authentication cannot fully satisfy the Agent Card and any advertised Skill security requirements.":"Agent Card or at least one advertised Skill requires authentication, but no compatible A2A authentication is configured.");if(!i)return{skillIds:s.skillIds};let a=s.declaredScheme,c=t.authentication;if(!c&&!t.credentialRef&&r)return{skillIds:s.skillIds};if(!c)return{credentialRef:t.credentialRef,authentication:{type:"http-bearer",scheme:a.name},skillIds:s.skillIds};if(c.type==="http-bearer")return{credentialRef:c.credentialRef,authentication:{type:"http-bearer",scheme:c.scheme},skillIds:s.skillIds};if(a.kind!=="oauth2-client-credentials")throw new Error("Configured OAuth2 authentication does not match the selected Agent Card scheme.");let d=a,A=H(c.issuer,"Configured OAuth2 issuer"),f=$(c.tokenUrl,"Configured OAuth2 token endpoint").href,l=c.resource===void 0?void 0:ne(c.resource,"Configured OAuth2 resource");if(new URL(d.tokenUrl).href!==f)throw new Error("Configured OAuth2 tokenUrl does not match the selected Agent Card security scheme.");let p=c.scopes.find(h=>!d.scopes.includes(h));if(p)throw new Error(`Configured OAuth2 scope is not declared by the Agent Card: ${p}`);return{credentialRef:c.clientSecretRef,authentication:{type:"oauth2-client-credentials",scheme:c.scheme,issuer:A,tokenUrl:f,clientId:c.clientId,scopes:c.scopes,...l?{resource:l}:{},clientAuthentication:c.clientAuthentication},skillIds:s.skillIds}}o(Wn,"planClientAuthentication");function Me(t,e){try{return JSON.parse(t)}catch{throw new Error(`${e} returned invalid JSON.`)}}o(Me,"parseJson");function Tt(t){let e=t.maxTaskResponseBytes??t.networkPolicy.maxResponseBytes;if(!Number.isSafeInteger(e)||e<=0)throw new Error("A2A maxTaskResponseBytes must be a positive safe integer.");return e}o(Tt,"taskResponseBytes");function Vn(t){return{...t.networkPolicy,maxResponseBytes:Tt(t)}}o(Vn,"taskNetworkPolicy");async function Et(t,e){let n=Jn(t),r=await G(new URL(n.agentCardUrl),{headers:{accept:"application/json"}},e.networkPolicy,e.fetch);if(!r.response.ok)throw new Error(`Agent Card request failed with HTTP ${r.response.status}.`);if(!de(r.response.headers.get("content-type")))throw new Error("Agent Card response is not JSON.");let i=ct(Me(X(r.body),"Agent Card")),s=i.capabilities.extensions?.filter(f=>f.required)??[];if(s.length>0)throw new Error(`Agent Card required A2A extension(s) are unsupported: ${s.map(f=>f.uri).join(", ")}`);let a=Bn(i,r.url),c=Wn(n,i,e.authorization),d=Ae({agentCardUrl:r.url.href,interfaceUrl:a.url,protocolBinding:a.protocolBinding,protocolVersion:a.protocolVersion,tenant:a.tenant??"",authentication:c.authentication??null}),A=yt(Ae({card:i,endpointIdentity:d,credentialRef:c.credentialRef??null,effects:n.effects}));return{agentCard:i,registration:{agentId:n.agentId,displayName:i.name,description:i.description,enabled:!0,executorId:Ce,protocol:"a2a",configurationRevision:A,endpointIdentityHash:yt(d),...c.credentialRef?{credentialRef:c.credentialRef}:{},executorConfig:{agentCardUrl:r.url.href,interfaceUrl:a.url,...a.tenant?{tenant:a.tenant}:{},...c.authentication?{authentication:c.authentication}:{}},skills:c.skillIds,inputModalities:i.defaultInputModes,outputModalities:i.defaultOutputModes,capabilities:{streaming:i.capabilities.streaming?"supported":"unsupported",durableTasks:"supported",inputRequired:"supported",cancellation:"supported",artifacts:"supported"},effects:{remote:n.effects.remote,workspace:"proposal"},health:{status:"healthy",checkedAt:new Date().toISOString()}}}}o(Et,"discoverA2ARegistration");function le(t){return t.metadata??{}}o(le,"metadata");function qe(t){if(t===null||typeof t=="string"||typeof t=="boolean"||typeof t=="number"&&Number.isFinite(t))return t;if(Array.isArray(t))return t.map(qe);if(g(t)){let e={};for(let[n,r]of Object.entries(t))e[n]=qe(r);return e}throw new Error("A2A response metadata must be JSON-safe.")}o(qe,"toAgentJsonValue");function St(t){let e=le(t).directMessage;return e===void 0?void 0:N(e)}o(St,"directMessage");function Gn(t){return{TASK_STATE_UNSPECIFIED:"unknown",TASK_STATE_SUBMITTED:"submitted",TASK_STATE_WORKING:"working",TASK_STATE_COMPLETED:"completed",TASK_STATE_FAILED:"failed",TASK_STATE_CANCELED:"canceled",TASK_STATE_INPUT_REQUIRED:"input-required",TASK_STATE_REJECTED:"rejected",TASK_STATE_AUTH_REQUIRED:"auth-required"}[t]??"unknown"}o(Gn,"taskState");function Le(t){return t.flatMap(e=>e.text===void 0?[]:[e.text]).join(`
+import"./chunks/chunk-GVWPHE23.js";import"./chunks/chunk-PKQOEDHJ.js";import{f as Ye,l as et}from"./chunks/chunk-WIBLZK4G.js";import"./chunks/chunk-2RI252RN.js";import"./chunks/chunk-VVE3UM4F.js";import"./chunks/chunk-IR5KIK7E.js";import"./chunks/chunk-MVARIMQV.js";import"./chunks/chunk-VDGCGOQH.js";import"./chunks/chunk-SQODXBLX.js";import"./chunks/chunk-44QXPEEE.js";import"./chunks/chunk-GIK4SGAT.js";import"./chunks/chunk-ZJIMT5I3.js";import"./chunks/chunk-JSDLBXME.js";import{b as V}from"./chunks/chunk-E27LHEIP.js";import"./chunks/chunk-EDZ5KJFT.js";import"./chunks/chunk-23X6REO4.js";import{a as o}from"./chunks/chunk-ONUPGMER.js";var te="1.0",Ce="kodax-a2a-v1-jsonrpc";var u=class extends Error{constructor(n,r,i=200,s,a){super(r);this.code=n;this.httpStatus=i;this.data=s;this.headers=a;this.name="A2AError"}code;httpStatus;data;headers;static{o(this,"A2AError")}};function ge(t){return t instanceof Error?t.message:String(t)}o(ge,"errorMessage");var nn=["apiKeySecurityScheme","httpAuthSecurityScheme","oauth2SecurityScheme","openIdConnectSecurityScheme","mtlsSecurityScheme"],rn=["authorizationCode","clientCredentials","implicit","password","deviceCode"],sn=/^[\x21\x23-\x5B\x5D-\x7E]+$/u;function re(t,e){if(!sn.test(t))throw new Error(`${e} must be an RFC 6749 scope-token.`)}o(re,"assertOAuthScopeToken");function tt(t,e){let n=t.split(" ");for(let r of n)re(r,e);return[...new Set(n)]}o(tt,"parseOAuthScopeValue");function ie(t,e){if(!Array.isArray(t))throw new Error(`${e} must be an array of strings.`);let n=t.map((r,i)=>{if(typeof r!="string")throw new Error(`${e}[${i}] must be a string.`);return re(r,`${e}[${i}]`),r});if(new Set(n).size!==n.length)throw new Error(`${e} must not contain duplicates.`);return n}o(ie,"parseOAuthScopeList");function B(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}o(B,"isRecord");function v(t,e){if(typeof t!="string"||t.trim().length===0)throw new Error(`${e} must be a non-empty string.`);return t}o(v,"requireNonEmptyString");function on(t,e){if(t!==void 0)return v(t,e)}o(on,"optionalString");function nt(t,e){return v(t,e).trim()}o(nt,"trimmedUri");function an(t){return/^[A-Za-z][A-Za-z0-9+.-]*:\/\/([^/?#]*)/u.exec(t)?.[1]?.includes("@")===!0}o(an,"hasAuthorityUserinfo");function me(t){let e=t.toLowerCase().replace(/^\[|\]$/gu,"");return e==="localhost"||e==="127.0.0.1"||e==="::1"}o(me,"isExactOAuthLoopbackHostname");function rt(t,e){let n=nt(t,e);if(!/^https?:\/\/([^/?#]*)/iu.exec(n)?.[1])throw new Error(`${e} must be an absolute HTTP(S) URL.`);let i;try{i=new URL(n)}catch{throw new Error(`${e} must be an absolute HTTP(S) URL.`)}if(an(n)||i.username||i.password||n.includes("#"))throw new Error(`${e} must not contain userinfo or a fragment.`);if(i.protocol==="http:"&&!me(i.hostname))throw new Error(`${e} must use HTTPS or exact loopback HTTP.`);return{raw:n,url:i}}o(rt,"secureOAuthHttpUrl");function H(t,e){let n=rt(t,e);if(n.raw.includes("?"))throw new Error(`${e} must not contain a query or fragment.`);return n.raw}o(H,"parseOAuthIssuerIdentifier");function $(t,e){return rt(t,e).url}o($,"parseOAuthEndpointUrl");function ne(t,e){let n=nt(t,e);if(!/^[A-Za-z][A-Za-z0-9+.-]*:/u.test(n))throw new Error(`${e} must be an absolute URI.`);try{new URL(n)}catch{throw new Error(`${e} must be an absolute URI.`)}if(n.includes("#"))throw new Error(`${e} must not contain a fragment.`);return n}o(ne,"parseOAuthResourceIdentifier");function it(t,e){return $(t,e).href}o(it,"absoluteHttpUrl");function cn(t,e){if(!B(t))throw new Error(`${e} must be a scope-description object.`);return Object.entries(t).map(([n,r])=>{if(n.trim().length===0||typeof r!="string")throw new Error(`${e} must map non-empty scope names to descriptions.`);return re(n,`${e}.${n}`),n})}o(cn,"parseScopes");function dn(t,e){if(!B(e))throw new Error(`securitySchemes.${t}.httpAuthSecurityScheme must be an object.`);let n=v(e.scheme,`securitySchemes.${t}.httpAuthSecurityScheme.scheme`),r=on(e.bearerFormat,`securitySchemes.${t}.httpAuthSecurityScheme.bearerFormat`);return n.toLowerCase()!=="bearer"?{name:t,kind:"unsupported",protocol:`http:${n.toLowerCase()}`}:{name:t,kind:"http-bearer",...r?{bearerFormat:r}:{}}}o(dn,"parseHttpScheme");function un(t,e){let n=e.flows;if(!B(n))throw new Error(`securitySchemes.${t}.oauth2SecurityScheme.flows must be an object.`);let r=rn.filter(c=>n[c]!==void 0);if(r.length!==1)throw new Error(`securitySchemes.${t}.oauth2SecurityScheme.flows must contain exactly one OAuth flow.`);let i=r[0],s=n[i];if(!B(s))throw new Error(`securitySchemes.${t}.oauth2SecurityScheme.flows.${i} must be an object.`);let a=cn(s.scopes,`securitySchemes.${t}.oauth2SecurityScheme.flows.${i}.scopes`);if(i==="clientCredentials"){let c=it(s.tokenUrl,`securitySchemes.${t}.oauth2SecurityScheme.flows.clientCredentials.tokenUrl`);return{name:t,kind:"oauth2-client-credentials",tokenUrl:c,scopes:a}}return{name:t,kind:"unsupported",protocol:`oauth2:${i}`,oauthScopes:a}}o(un,"parseOAuthFlow");function ln(t,e,n){if(!B(n))throw new Error(`securitySchemes.${t}.${e} must be an object.`);if(e==="apiKeySecurityScheme"){let r=v(n.location,`securitySchemes.${t}.${e}.location`);if(!["query","header","cookie"].includes(r))throw new Error(`securitySchemes.${t}.${e}.location must be query, header, or cookie.`);return v(n.name,`securitySchemes.${t}.${e}.name`),{name:t,kind:"unsupported",protocol:"api-key"}}return e==="openIdConnectSecurityScheme"?(it(n.openIdConnectUrl,`securitySchemes.${t}.${e}.openIdConnectUrl`),{name:t,kind:"unsupported",protocol:"openid-connect",acceptsOAuthScopes:!0}):{name:t,kind:"unsupported",protocol:"mutual-tls"}}o(ln,"parseUnsupportedScheme");function An(t,e){if(!B(e))throw new Error(`securitySchemes.${t} must be an object.`);let n=nn.filter(i=>e[i]!==void 0);if(n.length!==1)throw new Error(`securitySchemes.${t} must contain exactly one security scheme.`);let r=n[0];if(r==="httpAuthSecurityScheme")return dn(t,e[r]);if(r==="oauth2SecurityScheme"){let i=e[r];if(!B(i))throw new Error(`securitySchemes.${t}.${r} must be an object.`);return un(t,i)}return ln(t,r,e[r])}o(An,"parseScheme");function pn(t){if(t===void 0)return{};if(!B(t))throw new Error("securitySchemes must be an object.");return Object.fromEntries(Object.entries(t).map(([e,n])=>{if(e.trim().length===0)throw new Error("securitySchemes names must not be empty.");return[e,An(e,n)]}))}o(pn,"parseSchemes");function fn(t,e){if(!B(t))throw new Error(`${e} must be a StringList object.`);if(t.list===void 0)return[];if(!Array.isArray(t.list)||!t.list.every(n=>typeof n=="string"&&n.trim().length>0))throw new Error(`${e}.list must be an array of non-empty strings.`);if(new Set(t.list).size!==t.list.length)throw new Error(`${e}.list must not contain duplicate scopes.`);for(let n of t.list)re(n,`${e}.list`);return t.list}o(fn,"parseScopeList");function hn(t,e){if(t.kind==="oauth2-client-credentials"||t.kind==="unsupported"&&t.oauthScopes!==void 0){let n=t.kind==="oauth2-client-credentials"?t.scopes:t.oauthScopes??[];for(let r of e)if(!n.includes(r))throw new Error(`scope "${r}" is not declared by security scheme "${t.name}".`);return}if(e.length>0&&!(t.kind==="unsupported"&&t.acceptsOAuthScopes))throw new Error(`security scheme "${t.name}" does not accept OAuth scopes.`)}o(hn,"validateRequiredScopes");function gn(t,e,n){if(!B(t))throw new Error(`securityRequirements[${e}] must be an object.`);let r=t.schemes;if(r!==void 0&&!B(r))throw new Error(`securityRequirements[${e}].schemes must be an object.`);return{schemes:Object.entries(r??{}).map(([a,c])=>{if(!Object.hasOwn(n,a))throw new Error(`securityRequirements[${e}] references unknown security scheme "${a}".`);let d=n[a],A=fn(c,`securityRequirements[${e}].schemes.${a}`);return hn(d,A),{scheme:d,scopes:A}})}}o(gn,"parseRequirement");function F(t,e){let n=pn(t);if(e===void 0)return{schemes:n,requirements:[]};if(!Array.isArray(e))throw new Error("securityRequirements must be an array.");return{schemes:n,requirements:e.map((r,i)=>gn(r,i,n))}}o(F,"parseA2ASecurity");function mn(t,e){let{scheme:n,scopes:r}=e;return n.kind!=="unsupported"&&t.schemeName===n.name&&t.kind===n.kind&&r.every(i=>t.scopes?.includes(i)===!0)}o(mn,"capabilityMatches");function xi(t,e){return ye(t,e)[0]??null}o(xi,"selectA2ASecurityRequirement");function ye(t,e){return(t.requirements.length===0?[{schemes:[]}]:t.requirements).filter(r=>r.schemes.every(i=>e.some(s=>mn(s,i))))}o(ye,"satisfiableA2ASecurityRequirements");var yn=new Set(["TASK_STATE_UNSPECIFIED","TASK_STATE_SUBMITTED","TASK_STATE_WORKING","TASK_STATE_COMPLETED","TASK_STATE_FAILED","TASK_STATE_CANCELED","TASK_STATE_INPUT_REQUIRED","TASK_STATE_REJECTED","TASK_STATE_AUTH_REQUIRED"]);function g(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}o(g,"isRecord");function st(t){if(t===null)return;let e=t.split(";",1)[0]?.trim().toLowerCase();return e&&!/\s/u.test(e)?e:void 0}o(st,"mediaTypeEssence");function de(t){let e=st(t);return e==="application/json"||/^application\/[!#$%&'*+\-.^_`|~0-9a-z]+\+json$/u.test(e??"")}o(de,"isJsonMediaType");function ot(t){return st(t)==="text/event-stream"}o(ot,"isEventStreamMediaType");function U(t,e,n){let r=t[e];if(typeof r!="string"||r.trim().length===0)throw new u(-32602,`${n}.${e} must be a non-empty string.`);return r}o(U,"requiredString");function b(t,e){let n=t[e];return typeof n=="string"&&n.length>0?n:void 0}o(b,"optionalString");function se(t,e){if(!Array.isArray(t)||!t.every(n=>typeof n=="string"))throw new u(-32602,`${e} must be a string array.`);return t}o(se,"stringArray");function wn(t){if(!g(t))throw new u(-32602,"Agent Card interface is invalid.");return{url:U(t,"url","interface"),protocolBinding:U(t,"protocolBinding","interface"),protocolVersion:U(t,"protocolVersion","interface"),...b(t,"tenant")?{tenant:b(t,"tenant")}:{}}}o(wn,"parseInterface");function at(t,e,n){try{F(t,e)}catch(r){let i=r instanceof Error?r.message:String(r);throw new u(-32602,`${n} is invalid: ${i}`)}}o(at,"validateSecurity");function kn(t,e){if(!g(t))throw new u(-32602,"Agent Card skill is invalid.");return t.securityRequirements!==void 0&&at(e,t.securityRequirements,"skill.securityRequirements"),{id:U(t,"id","skill"),name:U(t,"name","skill"),description:U(t,"description","skill"),tags:se(t.tags,"skill.tags"),...Array.isArray(t.examples)?{examples:se(t.examples,"skill.examples")}:{},...Array.isArray(t.inputModes)?{inputModes:se(t.inputModes,"skill.inputModes")}:{},...Array.isArray(t.outputModes)?{outputModes:se(t.outputModes,"skill.outputModes")}:{},...Array.isArray(t.securityRequirements)?{securityRequirements:t.securityRequirements.filter(g)}:{}}}o(kn,"parseSkill");function Sn(t){if(!g(t))throw new u(-32602,"Agent Card extension is invalid.");let e=U(t,"uri","extension");try{new URL(e)}catch{throw new u(-32602,"Agent Card extension.uri must be an absolute URI.")}if(t.description!==void 0&&typeof t.description!="string")throw new u(-32602,"Agent Card extension.description must be a string.");if(t.required!==void 0&&typeof t.required!="boolean")throw new u(-32602,"Agent Card extension.required must be a boolean.");if(t.params!==void 0&&!g(t.params))throw new u(-32602,"Agent Card extension.params must be an object.");return{uri:e,...typeof t.description=="string"?{description:t.description}:{},...typeof t.required=="boolean"?{required:t.required}:{},...g(t.params)?{params:t.params}:{}}}o(Sn,"parseExtension");function ct(t){if(!g(t))throw new u(-32602,"Agent Card must be an object.");let e=t.supportedInterfaces,n=t.skills;if(!Array.isArray(e)||e.length===0)throw new u(-32602,"Agent Card must declare supportedInterfaces.");if(!Array.isArray(n))throw new u(-32602,"Agent Card must declare skills.");if(!g(t.capabilities))throw new u(-32602,"Agent Card capabilities are invalid.");if(t.capabilities.extensions!==void 0&&!Array.isArray(t.capabilities.extensions))throw new u(-32602,"Agent Card capabilities.extensions must be an array.");return at(t.securitySchemes,t.securityRequirements,"Agent Card security declaration"),{name:U(t,"name","Agent Card"),description:U(t,"description","Agent Card"),supportedInterfaces:e.map(wn),version:U(t,"version","Agent Card"),capabilities:{...typeof t.capabilities.streaming=="boolean"?{streaming:t.capabilities.streaming}:{},...typeof t.capabilities.pushNotifications=="boolean"?{pushNotifications:t.capabilities.pushNotifications}:{},...typeof t.capabilities.extendedAgentCard=="boolean"?{extendedAgentCard:t.capabilities.extendedAgentCard}:{},...Array.isArray(t.capabilities.extensions)?{extensions:t.capabilities.extensions.map(Sn)}:{}},...g(t.securitySchemes)?{securitySchemes:t.securitySchemes}:{},...Array.isArray(t.securityRequirements)?{securityRequirements:t.securityRequirements.filter(g)}:{},defaultInputModes:se(t.defaultInputModes,"Agent Card defaultInputModes"),defaultOutputModes:se(t.defaultOutputModes,"Agent Card defaultOutputModes"),skills:n.map(r=>kn(r,t.securitySchemes))}}o(ct,"parseA2AAgentCard");function dt(t){if(!g(t))throw new u(-32602,"Message Part must be an object.");let e=["text","raw","url","data"].filter(r=>t[r]!==void 0);if(e.length!==1)throw new u(-32602,"Message Part must contain exactly one content field.");let n=e[0];if(n!=="data"&&typeof t[n]!="string")throw new u(-32602,`Message Part ${n} content must be a string.`);return{...typeof t.text=="string"?{text:t.text}:{},...typeof t.raw=="string"?{raw:t.raw}:{},...typeof t.url=="string"?{url:t.url}:{},...t.data!==void 0?{data:t.data}:{},...g(t.metadata)?{metadata:t.metadata}:{},...b(t,"filename")?{filename:b(t,"filename")}:{},...b(t,"mediaType")?{mediaType:b(t,"mediaType")}:{}}}o(dt,"parseA2APart");function N(t){if(!g(t))throw new u(-32602,"Message must be an object.");if(t.role!=="ROLE_USER"&&t.role!=="ROLE_AGENT")throw new u(-32602,"Message role is invalid.");if(!Array.isArray(t.parts)||t.parts.length===0)throw new u(-32602,"Message parts must not be empty.");return{messageId:U(t,"messageId","Message"),role:t.role,parts:t.parts.map(dt),...b(t,"contextId")?{contextId:b(t,"contextId")}:{},...b(t,"taskId")?{taskId:b(t,"taskId")}:{},...g(t.metadata)?{metadata:t.metadata}:{}}}o(N,"parseA2AMessage");function Rn(t){if(!g(t)||!Array.isArray(t.parts)||t.parts.length===0)throw new u(-32603,"A2A artifact is invalid.");return{artifactId:U(t,"artifactId","Artifact"),parts:t.parts.map(dt),...b(t,"name")?{name:b(t,"name")}:{},...b(t,"description")?{description:b(t,"description")}:{},...g(t.metadata)?{metadata:t.metadata}:{}}}o(Rn,"parseArtifact");function z(t){if(!g(t)||!g(t.status))throw new u(-32603,"A2A task is invalid.");let e=t.status.state;if(typeof e!="string")throw new u(-32603,"A2A task state is invalid.");let n=yn.has(e)?e:"TASK_STATE_UNSPECIFIED";return{id:U(t,"id","Task"),contextId:b(t,"contextId")??"",status:{state:n,...t.status.message!==void 0?{message:N(t.status.message)}:{},...b(t.status,"timestamp")?{timestamp:b(t.status,"timestamp")}:{}},...Array.isArray(t.artifacts)?{artifacts:t.artifacts.map(Rn)}:{},...Array.isArray(t.history)?{history:t.history.map(N)}:{},...g(t.metadata)?{metadata:t.metadata}:{}}}o(z,"parseA2ATask");function ut(t){if(!g(t)||t.jsonrpc!=="2.0")throw new u(-32600,"Invalid JSON-RPC request.");if(typeof t.id!="string"&&typeof t.id!="number")throw new u(-32600,"JSON-RPC request id is required.");return{jsonrpc:"2.0",id:t.id,method:U(t,"method","JSON-RPC request"),...g(t.params)?{params:t.params}:{}}}o(ut,"parseJsonRpcRequest");import{lookup as Tn}from"node:dns/promises";import{request as En}from"node:http";import{request as bn}from"node:https";import{BlockList as xn,isIP as At}from"node:net";import{Readable as In}from"node:stream";var we=new xn;we.addSubnet("127.0.0.0",8,"ipv4");we.addAddress("::1","ipv6");function pt(t){let e=At(t);return e===4?we.check(t,"ipv4"):e===6&&we.check(t,"ipv6")}o(pt,"isLoopbackAddress");function ve(t){let e=t.split(".").map(Number),[n,r,i,s]=e;return e.length!==4||n===void 0||r===void 0||i===void 0||s===void 0?!0:n===0||n===10||n===127||n===100&&r>=64&&r<=127||n===169&&r===254||n===172&&r>=16&&r<=31||n===192&&r===168||n===192&&r===0&&i===0&&s!==9&&s!==10||n===192&&r===0&&i===2||n===198&&(r===18||r===19)||n===198&&r===51&&i===100||n===203&&r===0&&i===113||n>=224}o(ve,"isPrivateIpv4");function Cn(t){if(pt(t))return!0;let e=t.toLowerCase(),n=/^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(e)?.[1];if(n)return ve(n);let r=/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(e);if(r?.[1]&&r[2]){let i=Number.parseInt(r[1],16),s=Number.parseInt(r[2],16);return ve(`${i>>8}.${i&255}.${s>>8}.${s&255}`)}return e==="::"||e==="::1"||e.startsWith("fc")||e.startsWith("fd")||e.startsWith("fe8")||e.startsWith("fe9")||e.startsWith("fea")||e.startsWith("feb")||e.startsWith("ff")}o(Cn,"isPrivateIpv6");function lt(t){let e=At(t);return e===4?ve(t):e===6?Cn(t):!0}o(lt,"isPrivateAddress");async function ft(t,e){if(t.protocol!=="https:"&&t.protocol!=="http:")throw new u(-32602,"A2A URL must use HTTP or HTTPS.");if(!e.allowedOrigins.includes(t.origin))throw new u(-32602,`A2A origin is not allowed: ${t.origin}`);if(t.username||t.password)throw new u(-32602,"A2A URL must not include credentials.");let n=t.hostname.startsWith("[")&&t.hostname.endsWith("]")?t.hostname.slice(1,-1):t.hostname,r=await Tn(n,{all:!0,verbatim:!0});if(r.length===0)throw new u(-32602,"A2A hostname did not resolve.");if(n.toLowerCase()==="localhost"&&!r.every(s=>pt(s.address)))throw new u(-32602,"A2A localhost target must resolve only to loopback addresses.");if(t.protocol==="http:"&&!r.every(s=>lt(s.address)))throw new u(-32602,"Public A2A targets must use HTTPS.");if(!e.allowPrivateAddresses&&r.some(s=>lt(s.address)))throw new u(-32602,"A2A private network targets are not allowed.");let i=r[0];if(i===void 0||i.family!==4&&i.family!==6)throw new u(-32602,"A2A hostname returned an unsupported address.");return{address:i.address,family:i.family}}o(ft,"validateA2AUrl");async function vn(t,e){await ft(t,e)}o(vn,"assertSafeA2AUrl");function Pn(t){if(t==null||typeof t=="string")return t??void 0;if(t instanceof URLSearchParams)return t.toString();if(t instanceof Uint8Array)return t;if(t instanceof ArrayBuffer)return new Uint8Array(t);if(ArrayBuffer.isView(t))return new Uint8Array(t.buffer,t.byteOffset,t.byteLength);throw new u(-32602,"A2A request body type is not supported by the safe transport.")}o(Pn,"encodeRequestBody");function On(t){return((e,n,r)=>{if(typeof n=="object"&&n.all){r(null,[t]);return}r(null,t.address,t.family)})}o(On,"pinnedLookup");function Un(t,e,n){return new Promise((r,i)=>{let s=new Headers(e.headers);s.set("accept-encoding","identity");let a=(t.protocol==="https:"?bn:En)(t,{method:e.method,headers:Object.fromEntries(s),lookup:On(n),signal:e.signal??void 0},c=>{let d=new Headers;for(let p=0;p<c.rawHeaders.length;p+=2){let h=c.rawHeaders[p],k=c.rawHeaders[p+1];h!==void 0&&k!==void 0&&d.append(h,k)}let A=c.statusCode??500,l=e.method!=="HEAD"&&A!==204&&A!==205&&A!==304?In.toWeb(c):null;r(new Response(l,{status:A,statusText:c.statusMessage,headers:d}))});a.once("error",i),a.end(Pn(e.body))})}o(Un,"requestValidatedAddress");async function Pe(t,e,n,r){let i=await ft(t,n);return r!==void 0?r(t,e):Un(t,e,i)}o(Pe,"openSafeA2AResponse");async function _n(t,e){let n=t.headers.get("content-length");if(n&&Number(n)>e)throw new u(-32603,"A2A response is too large.");if(!t.body)return new Uint8Array;let r=t.body.getReader(),i=[],s=0;for(;;){let d=await r.read();if(d.done)break;if(s+=d.value.byteLength,s>e)throw await r.cancel(),new u(-32603,"A2A response is too large.");i.push(d.value)}let a=new Uint8Array(s),c=0;for(let d of i)a.set(d,c),c+=d.byteLength;return a}o(_n,"boundedBody");async function G(t,e,n,r){let i=t,s=new Headers(e.headers).get("authorization");for(let a=0;a<=n.maxRedirects;a+=1){let c=new AbortController,d=setTimeout(()=>c.abort(new Error("A2A request timed out.")),n.requestTimeoutMs),A=new Headers(e.headers);s===null?A.delete("authorization"):A.set("authorization",s);try{let f=await Pe(i,{...e,headers:A,redirect:"manual",signal:c.signal},n,r);if(f.status<300||f.status>=400)return{response:f,body:await _n(f,n.maxResponseBytes),url:i};let l=f.headers.get("location");if(!l||a===n.maxRedirects)throw new u(-32603,"A2A redirect limit exceeded.");let p=new URL(l,i);await f.body?.cancel(),p.origin!==i.origin&&(s=null),i=p}finally{clearTimeout(d)}}throw new u(-32603,"A2A redirect limit exceeded.")}o(G,"safeA2AFetch");function X(t){return new TextDecoder("utf-8",{fatal:!0}).decode(t)}o(X,"decodeUtf8");import{createHash as Dn,randomUUID as Oe}from"node:crypto";import*as D from"oauth4webapi";var Mn=6e4,qn=1e3,Ln=.1;function $n(t,e){return new Response(e.byteLength===0?null:X(e),{status:t.status,statusText:t.statusText,headers:t.headers})}o($n,"oauthResponse");function Nn(t,e){if(e===void 0||e<=0)return t;let n=e*1e3,r=Math.min(Mn,Math.max(qn,n*Ln));return t+Math.max(0,n-r)}o(Nn,"cacheExpiry");function ht(t){let e=v(t.clientId,"OAuth 2.0 clientId");if(t.clientAuthenticationMethod!=="basic"&&t.clientAuthenticationMethod!=="post")throw new Error("OAuth 2.0 clientAuthenticationMethod must be basic or post.");let n=t.clientAuthenticationMethod,r=t.scopes===void 0?void 0:ie(t.scopes,"OAuth 2.0 scopes"),i=H(t.issuer,"OAuth 2.0 issuer"),s=$(t.tokenUrl,"OAuth 2.0 token endpoint"),a=t.resource===void 0?void 0:ne(t.resource,"OAuth 2.0 resource"),c={issuer:i,token_endpoint:s.href},d={client_id:e},A={...t.networkPolicy,maxRedirects:0},f=t.now??Date.now,l,p,h=0;async function k(w){let y=n==="post"?D.ClientSecretPost(w):D.ClientSecretBasic(w),T=new URLSearchParams;r&&r.length>0&&T.set("scope",r.join(" ")),a!==void 0&&T.set("resource",a);let m={[D.customFetch]:async(R,O)=>{if(new URL(R).href!==s.href)throw new Error("OAuth 2.0 token request targeted an unexpected endpoint.");let j=await G(s,{method:O.method,headers:O.headers,body:O.body,redirect:"manual",...O.signal!==void 0?{signal:O.signal}:{}},A,t.fetch);return $n(j.response,j.body)}};s.protocol==="http:"&&(m[D.allowInsecureRequests]=!0);let S;try{let R=await D.clientCredentialsGrantRequest(c,d,y,T,m);S=await D.processClientCredentialsResponse(c,d,R)}catch{throw new Error("OAuth 2.0 client credentials token request failed.")}if(S.token_type!=="bearer")throw new Error("OAuth 2.0 token endpoint did not return a Bearer access token.");let q=f();return{value:`Bearer ${S.access_token}`,expiresAt:Nn(q,S.expires_in)}}return o(k,"requestAuthorization"),{async getAuthorization(w){if(w.length===0)throw new Error("OAuth 2.0 client secret is required.");let y=f();if(l!==void 0&&l.expiresAt>y)return l.value;if(p!==void 0)return p;let T=h,m;return m=k(w).then(S=>(h===T&&S.expiresAt>f()&&(l=S),S.value)).finally(()=>{p===m&&(p=void 0)}),p=m,m},invalidate(w){if(w!==void 0){l?.value===w&&(l=void 0);return}h+=1,l=void 0,p=void 0}}}o(ht,"createOAuth2ClientCredentialsTokenManager");var gt=4,mt=/^[A-Za-z0-9\-._~+/=]$/u;function ke(t){return t!==void 0&&/^Bearer\s+\S+$/iu.test(t)}o(ke,"isBearerAuthorization");function Kn(t,e){let n="",r=0;for(;r<t.length;){let i=t.indexOf(e,r);if(i<0)return n+t.slice(r);let s=i===0?void 0:t[i-1],a=i+e.length,c=a===t.length?void 0:t[a],d=s===void 0||!mt.test(s),A=c===void 0||!mt.test(c);n+=t.slice(r,i),d&&A?(n+="[REDACTED]",r=a):(n+=e,r=a)}return n}o(Kn,"replaceBoundedToken");function Ae(t){return Array.isArray(t)?`[${t.map(Ae).join(",")}]`:g(t)?`{${Object.keys(t).sort().map(e=>`${JSON.stringify(e)}:${Ae(t[e])}`).join(",")}}`:JSON.stringify(t)??"null"}o(Ae,"stableJson");function yt(t){return`sha256:${Dn("sha256").update(t).digest("hex")}`}o(yt,"sha256");var _e=class{static{o(this,"AuthorizationRedactor")}#e=[];#n=new Map;remember(e){if(!e)return;let n=this.#e.indexOf(e);n>=0&&this.#e.splice(n,1),this.#e.unshift(e),this.#e.length>gt&&(this.#e.length=gt)}retain(e){if(!e)return()=>{};this.remember(e),this.#n.set(e,(this.#n.get(e)??0)+1);let n=!1;return()=>{if(n)return;n=!0;let r=(this.#n.get(e)??1)-1;r===0?this.#n.delete(e):this.#n.set(e,r)}}redactText(e){let n=[...new Set([...this.#n.keys(),...this.#e])],r=n.sort((s,a)=>a.length-s.length).reduce((s,a)=>s.split(a).join("[REDACTED]"),e),i=n.flatMap(s=>{let a=/^Bearer\s+(\S+)$/iu.exec(s)?.[1];return a?[a]:[]}).sort((s,a)=>a.length-s.length);return[...new Set(i)].reduce((s,a)=>Kn(s,a),r)}redactContent(e){return typeof e=="string"?this.redactText(e):Array.isArray(e)?e.map(n=>this.redactContent(n)):g(e)?Object.fromEntries(Object.entries(e).map(([n,r])=>[n,this.redactContent(r)])):e}redactPart(e){return{...e,...e.text===void 0?{}:{text:this.redactText(e.text)},...e.raw===void 0?{}:{raw:this.redactText(e.raw)},...e.url===void 0?{}:{url:this.redactText(e.url)},...e.data===void 0?{}:{data:this.redactContent(e.data)},...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)},...e.filename===void 0?{}:{filename:this.redactText(e.filename)}}}redactMessage(e){return{...e,parts:e.parts.map(n=>this.redactPart(n)),...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)}}}redactArtifact(e){return{...e,...e.name===void 0?{}:{name:this.redactText(e.name)},...e.description===void 0?{}:{description:this.redactText(e.description)},parts:e.parts.map(n=>this.redactPart(n)),...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)}}}redactTask(e){return{...e,status:{...e.status,...e.status.message===void 0?{}:{message:this.redactMessage(e.status.message)}},...e.artifacts===void 0?{}:{artifacts:e.artifacts.map(n=>this.redactArtifact(n))},...e.history===void 0?{}:{history:e.history.map(n=>this.redactMessage(n))},...e.metadata===void 0?{}:{metadata:this.redactContent(e.metadata)}}}redactError(e){let n=this.redactText(e instanceof Error?e.message:String(e));return e instanceof u?new u(e.code,n,e.httpStatus,this.redactContent(e.data),e.headers):new Error(n)}};function wt(t,e){let n=new URL(e).origin;if(!t.allowedOrigins.some(i=>new URL(i).origin===n))throw new Error(`A2A endpoint origin is not allowed by network policy: ${n}`);return{...t,allowedOrigins:[n]}}o(wt,"endpointNetworkPolicy");function jn(t){if(t!==void 0){if(!g(t)||typeof t.scheme!="string")throw new Error("A2A registration authentication is invalid.");if(t.type==="http-bearer")return{type:"http-bearer",scheme:t.scheme};if(t.type!=="oauth2-client-credentials"||typeof t.issuer!="string"||typeof t.tokenUrl!="string"||typeof t.clientId!="string"||!Array.isArray(t.scopes)||!t.scopes.every(e=>typeof e=="string")||!["client-secret-basic","client-secret-post"].includes(String(t.clientAuthentication)))throw new Error("A2A registration OAuth2 authentication is invalid.");return{type:"oauth2-client-credentials",scheme:t.scheme,issuer:t.issuer,tokenUrl:t.tokenUrl,clientId:t.clientId,scopes:t.scopes,...typeof t.resource=="string"?{resource:t.resource}:{},clientAuthentication:t.clientAuthentication}}}o(jn,"executorAuthentication");function Q(t){let e=t.executorConfig;if(!g(e))throw new Error("A2A registration executorConfig is missing.");if(typeof e.agentCardUrl!="string"||typeof e.interfaceUrl!="string")throw new Error("A2A registration endpoints are invalid.");let n=jn(e.authentication);return{agentCardUrl:e.agentCardUrl,interfaceUrl:e.interfaceUrl,...typeof e.tenant=="string"?{tenant:e.tenant}:{},...n?{authentication:n}:{}}}o(Q,"executorConfig");function Bn(t,e){let n=t.supportedInterfaces.find(i=>i.protocolBinding.toUpperCase()==="JSONRPC"&&i.protocolVersion==="1.0");if(!n)throw new Error("Agent Card has no supported A2A 1.0 JSONRPC interface.");let r=new URL(n.url);if(r.username||r.password||r.hash)throw new Error("A2A interface URL must not contain credentials or a fragment.");if(r.origin!==e.origin)throw new Error("A2A interface must use the same origin as the trusted Agent Card.");return n}o(Bn,"chooseInterface");function zn(t){if(t===void 0)return;if(!g(t))throw new Error("A2A authentication must be an object.");let e=v(t.scheme,"A2A authentication.scheme");if(t.type==="http-bearer")return{type:"http-bearer",scheme:e,credentialRef:v(t.credentialRef,"A2A authentication.credentialRef")};if(t.type!=="oauth2-client-credentials")throw new Error("A2A authentication.type must be http-bearer or oauth2-client-credentials.");if(t.clientAuthentication!=="client-secret-basic"&&t.clientAuthentication!=="client-secret-post")throw new Error("A2A authentication.clientAuthentication is invalid.");return{type:"oauth2-client-credentials",scheme:e,issuer:H(t.issuer,"Configured OAuth2 issuer"),tokenUrl:$(t.tokenUrl,"Configured OAuth2 token endpoint").href,clientId:v(t.clientId,"Configured OAuth2 clientId"),clientSecretRef:v(t.clientSecretRef,"Configured OAuth2 clientSecretRef"),scopes:ie(t.scopes,"Configured OAuth2 scopes"),...t.resource===void 0?{}:{resource:ne(t.resource,"Configured OAuth2 resource")},clientAuthentication:t.clientAuthentication}}o(zn,"validatedClientAuthentication");function Jn(t){let e=t.credentialRef===void 0?void 0:v(t.credentialRef,"A2A credentialRef"),n=zn(t.authentication);if(t.credentialRef!==void 0&&t.authentication!==void 0)throw new Error("A2A registration cannot combine credentialRef with structured authentication.");return{agentId:t.agentId,agentCardUrl:t.agentCardUrl,...e!==void 0?{credentialRef:e}:{},...n!==void 0?{authentication:n}:{},effects:t.effects}}o(Jn,"validatedRegistrationInput");function Hn(t,e,n){if(t.authentication)return[[{schemeName:t.authentication.scheme,kind:t.authentication.type,...t.authentication.type==="oauth2-client-credentials"?{scopes:t.authentication.scopes}:{}}]];let r=ke(n);if(!t.credentialRef&&!r)return[[]];let i=F(e.securitySchemes,e.securityRequirements);return Object.values(i.schemes).flatMap(s=>s.kind==="http-bearer"?[[{schemeName:s.name,kind:"http-bearer"}]]:[])}o(Hn,"configuredCapabilityCandidates");function kt(t,e){for(let n of t){if(n.schemes.length!==1)continue;let r=n.schemes[0].scheme;if(e.some(i=>i.schemeName===r.name&&i.kind===r.kind))return r}}o(kt,"matchingDeclaredScheme");function Fn(t,e){let n=F(t.securitySchemes,t.securityRequirements),r=ye(n,e).filter(a=>a.schemes.length<=1);if(r.length===0)return null;let i=kt(r,e),s=[];for(let a of t.skills){let c=F(t.securitySchemes,a.securityRequirements),d=ye(c,e).filter(A=>A.schemes.length<=1);d.length!==0&&(s.push(a.id),i??=kt(d,e))}return t.skills.length>0&&s.length===0?null:{skillIds:s,...i?{declaredScheme:i}:{}}}o(Fn,"evaluateSecurityCapabilities");function Wn(t,e,n){if(t.credentialRef!==void 0&&t.authentication!==void 0)throw new Error("A2A registration cannot combine credentialRef with structured authentication.");if(n!==void 0&&!ke(n))throw new Error("A2A options.authorization must be a valid Bearer authorization.");let r=ke(n),i=t.credentialRef!==void 0||t.authentication!==void 0||r,s;for(let h of Hn(t,e,n)){let k=Fn(e,h);if(k&&(!i||k.declaredScheme)){s=k;break}}if(!s)throw new Error(i?"Configured A2A authentication cannot fully satisfy the Agent Card and any advertised Skill security requirements.":"Agent Card or at least one advertised Skill requires authentication, but no compatible A2A authentication is configured.");if(!i)return{skillIds:s.skillIds};let a=s.declaredScheme,c=t.authentication;if(!c&&!t.credentialRef&&r)return{skillIds:s.skillIds};if(!c)return{credentialRef:t.credentialRef,authentication:{type:"http-bearer",scheme:a.name},skillIds:s.skillIds};if(c.type==="http-bearer")return{credentialRef:c.credentialRef,authentication:{type:"http-bearer",scheme:c.scheme},skillIds:s.skillIds};if(a.kind!=="oauth2-client-credentials")throw new Error("Configured OAuth2 authentication does not match the selected Agent Card scheme.");let d=a,A=H(c.issuer,"Configured OAuth2 issuer"),f=$(c.tokenUrl,"Configured OAuth2 token endpoint").href,l=c.resource===void 0?void 0:ne(c.resource,"Configured OAuth2 resource");if(new URL(d.tokenUrl).href!==f)throw new Error("Configured OAuth2 tokenUrl does not match the selected Agent Card security scheme.");let p=c.scopes.find(h=>!d.scopes.includes(h));if(p)throw new Error(`Configured OAuth2 scope is not declared by the Agent Card: ${p}`);return{credentialRef:c.clientSecretRef,authentication:{type:"oauth2-client-credentials",scheme:c.scheme,issuer:A,tokenUrl:f,clientId:c.clientId,scopes:c.scopes,...l?{resource:l}:{},clientAuthentication:c.clientAuthentication},skillIds:s.skillIds}}o(Wn,"planClientAuthentication");function Me(t,e){try{return JSON.parse(t)}catch{throw new Error(`${e} returned invalid JSON.`)}}o(Me,"parseJson");function Tt(t){let e=t.maxTaskResponseBytes??t.networkPolicy.maxResponseBytes;if(!Number.isSafeInteger(e)||e<=0)throw new Error("A2A maxTaskResponseBytes must be a positive safe integer.");return e}o(Tt,"taskResponseBytes");function Vn(t){return{...t.networkPolicy,maxResponseBytes:Tt(t)}}o(Vn,"taskNetworkPolicy");async function Et(t,e){let n=Jn(t),r=await G(new URL(n.agentCardUrl),{headers:{accept:"application/json"}},e.networkPolicy,e.fetch);if(!r.response.ok)throw new Error(`Agent Card request failed with HTTP ${r.response.status}.`);if(!de(r.response.headers.get("content-type")))throw new Error("Agent Card response is not JSON.");let i=ct(Me(X(r.body),"Agent Card")),s=i.capabilities.extensions?.filter(f=>f.required)??[];if(s.length>0)throw new Error(`Agent Card required A2A extension(s) are unsupported: ${s.map(f=>f.uri).join(", ")}`);let a=Bn(i,r.url),c=Wn(n,i,e.authorization),d=Ae({agentCardUrl:r.url.href,interfaceUrl:a.url,protocolBinding:a.protocolBinding,protocolVersion:a.protocolVersion,tenant:a.tenant??"",authentication:c.authentication??null}),A=yt(Ae({card:i,endpointIdentity:d,credentialRef:c.credentialRef??null,effects:n.effects}));return{agentCard:i,registration:{agentId:n.agentId,displayName:i.name,description:i.description,enabled:!0,executorId:Ce,protocol:"a2a",configurationRevision:A,endpointIdentityHash:yt(d),...c.credentialRef?{credentialRef:c.credentialRef}:{},executorConfig:{agentCardUrl:r.url.href,interfaceUrl:a.url,...a.tenant?{tenant:a.tenant}:{},...c.authentication?{authentication:c.authentication}:{}},skills:c.skillIds,inputModalities:i.defaultInputModes,outputModalities:i.defaultOutputModes,capabilities:{streaming:i.capabilities.streaming?"supported":"unsupported",durableTasks:"supported",inputRequired:"supported",cancellation:"supported",artifacts:"supported"},effects:{remote:n.effects.remote,workspace:"proposal"},health:{status:"healthy",checkedAt:new Date().toISOString()}}}}o(Et,"discoverA2ARegistration");function le(t){return t.metadata??{}}o(le,"metadata");function qe(t){if(t===null||typeof t=="string"||typeof t=="boolean"||typeof t=="number"&&Number.isFinite(t))return t;if(Array.isArray(t))return t.map(qe);if(g(t)){let e={};for(let[n,r]of Object.entries(t))e[n]=qe(r);return e}throw new Error("A2A response metadata must be JSON-safe.")}o(qe,"toAgentJsonValue");function St(t){let e=le(t).directMessage;return e===void 0?void 0:N(e)}o(St,"directMessage");function Gn(t){return{TASK_STATE_UNSPECIFIED:"unknown",TASK_STATE_SUBMITTED:"submitted",TASK_STATE_WORKING:"working",TASK_STATE_COMPLETED:"completed",TASK_STATE_FAILED:"failed",TASK_STATE_CANCELED:"canceled",TASK_STATE_INPUT_REQUIRED:"input-required",TASK_STATE_REJECTED:"rejected",TASK_STATE_AUTH_REQUIRED:"auth-required"}[t]??"unknown"}o(Gn,"taskState");function Le(t){return t.flatMap(e=>e.text===void 0?[]:[e.text]).join(`
 `)}o(Le,"textFromParts");function bt(t,e){let n=t.mediaType??(t.data!==void 0?"application/json":"application/octet-stream"),r=t.raw!==void 0?`data:${n};base64,${t.raw}`:t.data!==void 0?`data:${n};base64,${Buffer.from(JSON.stringify(t.data),"utf8").toString("base64")}`:void 0,i=t.url??r;if(i)return{name:e,...t.mediaType?{mimeType:t.mediaType}:{},...t.raw!==void 0?{size:Buffer.from(t.raw,"base64").byteLength}:{},uri:i,provenance:"a2a"}}o(bt,"partArtifactReference");function Xn(t){let e=t.parts.find(n=>n.url!==void 0||n.raw!==void 0||n.data!==void 0);return e?bt(e,t.name??t.artifactId):void 0}o(Xn,"artifactReference");function ue(t){let e=(t.artifacts??[]).flatMap(i=>Le(i.parts)),n=t.status.message?Le(t.status.message.parts):"",r=[...e,n].filter(Boolean).join(`
 `);return{state:Gn(t.status.state),...r?{output:r}:{},...t.status.state==="TASK_STATE_FAILED"?{error:n||"Remote A2A task failed."}:{},...t.artifacts?.length?{artifacts:t.artifacts.flatMap(i=>Xn(i)??[])}:{}}}o(ue,"snapshotFromTask");function Ue(t){let e=Le(t.parts),n=t.parts.flatMap((r,i)=>{if(r.text!==void 0)return[];let s=bt(r,r.filename??`message-part-${i+1}`);return s?[s]:[]});return{state:"completed",...e?{output:e}:{},...n.length>0?{artifacts:n}:{}}}o(Ue,"snapshotFromMessage");function Rt(t){return t==="completed"||t==="failed"||t==="canceled"||t==="rejected"}o(Rt,"isTerminal");function Qn(t,e,n){let r=t.get(e.artifactId);t.set(e.artifactId,n&&r?{...r,...e,parts:[...r.parts,...e.parts]}:e)}o(Qn,"mergeStreamArtifact");var Se=class{constructor(e,n,r,i,s){this.registration=e;this.context=n;this.options=r;this.oauthTokenManager=i;this.releaseOAuthTokenManager=s}registration;context;options;oauthTokenManager;releaseOAuthTokenManager;static{o(this,"A2AClientExecutor")}#e=!1;#n=new Set;#t=new _e;async preflight(){try{return Q(this.registration),{ok:!0}}catch(e){return{ok:!1,reasons:[e instanceof Error?e.message:String(e)]}}}async start(e){let n=e.idempotencyKey;if(!n)throw new Error("A2A executor requires an idempotency key.");let r=await this.sendMessage({message:{messageId:n,role:"ROLE_USER",parts:[{text:e.input??e.objective,mediaType:"text/plain"}]},configuration:{returnImmediately:!0}});if(g(r.task)){let i=z(r.task);return{idempotencyKey:n,remoteTaskId:i.id,...i.contextId?{metadata:{contextId:i.contextId}}:{}}}if(r.message!==void 0){let i=this.#t.redactMessage(N(r.message));return{idempotencyKey:n,metadata:{directMessage:qe(i)}}}throw new Error("A2A SendMessage returned neither task nor message.")}async*events(e){let n=St(e);if(n){yield await this.authorizeArtifacts(Ue(this.#t.redactMessage(n)));return}if(this.registration.capabilities.streaming==="supported")try{yield*this.streamEvents(e);return}catch(r){if(this.#e)return;V({source:"a2a.client",level:"warn",message:"A2A event stream failed; polling fallback started.",detail:r}),yield{progress:{message:"A2A stream unavailable; polling."}}}for(;!this.#e;){let r=await this.get(e);if(yield r,Rt(r.state)||r.state==="input-required"||r.state==="auth-required")return;await new Promise(i=>setTimeout(i,this.options.pollIntervalMs))}}async get(e){let n=St(e);if(n)return this.authorizeArtifacts(Ue(this.#t.redactMessage(n)));if(!e.remoteTaskId)throw new Error("A2A task reference has no remote task ID.");let r=z(await this.rpc("GetTask",this.taskParams(e)));return this.assertTaskReference(r,e),this.authorizeArtifacts(ue(this.#t.redactTask(r)))}async sendInput(e,n){if(!e.remoteTaskId)throw new Error("Direct A2A responses cannot accept input.");await this.sendMessage({message:{messageId:Oe(),taskId:e.remoteTaskId,...typeof le(e).contextId=="string"?{contextId:le(e).contextId}:{},role:"ROLE_USER",parts:[{text:n.content,mediaType:"text/plain"}]},configuration:{returnImmediately:!0}})}async cancel(e){if(!e.remoteTaskId)return this.get(e);let n=z(await this.rpc("CancelTask",this.taskParams(e)));return this.assertTaskReference(n,e),this.authorizeArtifacts(ue(this.#t.redactTask(n)))}async reconcile(e){return this.get(e)}async dispose(){if(!this.#e){this.#e=!0;try{for(let e of this.#n)e.abort(new Error("A2A executor disposed."))}finally{this.releaseOAuthTokenManager?.()}}}async*streamEvents(e){if(!e.remoteTaskId)throw new Error("A2A stream requires a remote task ID.");let n=Q(this.registration),r=new URL(n.interfaceUrl),i=new Headers({accept:"text/event-stream","a2a-version":"1.0","content-type":"application/json"}),s=new AbortController,a=Oe();this.#n.add(s);let c,d,A=o(()=>{d!==void 0&&clearTimeout(d),d=void 0},"disarmTimeout"),f=o(l=>{A(),d=setTimeout(()=>s.abort(new Error(l)),this.options.networkPolicy.requestTimeoutMs),d.unref?.()},"armTimeout");try{f("A2A stream connection timed out.");let l=await this.openStreamResponse(r,i,s.signal,{jsonrpc:"2.0",id:a,method:"SubscribeToTask",params:this.taskParams(e)}),p=l.response;if(c=l.releaseAuthorization,A(),!p.ok||!p.body)throw new Error(`A2A stream failed with HTTP ${p.status}.`);if(!ot(p.headers.get("content-type")))throw new Error("A2A stream returned an invalid content type.");let h=p.body.getReader(),k=new TextDecoder,w=new Map,y="",T=0;for(;!this.#e;){f("A2A stream was idle for too long.");let m=await h.read();if(A(),m.done)break;if(T+=m.value.byteLength,T>Tt(this.options))throw new Error("A2A stream exceeded the response size limit.");y+=k.decode(m.value,{stream:!0});let S=y.split(/\r?\n\r?\n/);y=S.pop()??"";for(let q of S){let R=q.split(/\r?\n/).filter(j=>j.startsWith("data:")).map(j=>j.slice(5).trimStart()).join(`
 `);if(!R)continue;let O=await this.snapshotFromStreamPayload(Me(R,"A2A stream"),a,e,w);if(O&&(yield O,O.state&&(Rt(O.state)||O.state==="input-required"||O.state==="auth-required")))return}}if(!this.#e)throw new Error("A2A event stream ended before the task reached a stable state.")}catch(l){throw this.#t.redactError(l)}finally{A(),c?.(),this.#n.delete(s)}}async snapshotFromStreamPayload(e,n,r,i){if(!g(e))throw new Error("A2A stream frame is invalid.");if(e.jsonrpc!=="2.0"||e.id!==n)throw new Error("A2A stream frame has an invalid JSON-RPC version or response id.");if(e.error!==void 0){let s=g(e.error)?e.error:{},a=typeof s.message=="string"?s.message:"A2A stream error.";throw new u(typeof s.code=="number"?s.code:-32603,this.#t.redactText(a))}if(g(e.result)){if(e.result.task!==void 0){let s=z(e.result.task);this.assertTaskReference(s,r),i.clear();for(let a of s.artifacts??[])i.set(a.artifactId,a);return this.authorizeArtifacts(ue(this.#t.redactTask(s)))}if(e.result.message!==void 0){let s=N(e.result.message);if(s.taskId!==void 0&&s.taskId!==r.remoteTaskId)throw new Error("A2A stream message belongs to a different task.");return this.authorizeArtifacts(Ue(this.#t.redactMessage(s)))}if(g(e.result.statusUpdate)&&g(e.result.statusUpdate.status)){this.assertStreamTaskScope(e.result.statusUpdate,r);let s=z({id:r.remoteTaskId,contextId:e.result.statusUpdate.contextId,status:e.result.statusUpdate.status,...i.size>0?{artifacts:[...i.values()]}:{}});return this.authorizeArtifacts(ue(this.#t.redactTask(s)))}if(g(e.result.artifactUpdate)&&e.result.artifactUpdate.artifact!==void 0){this.assertStreamTaskScope(e.result.artifactUpdate,r);let s=z({id:r.remoteTaskId,contextId:e.result.artifactUpdate.contextId,status:{state:"TASK_STATE_WORKING"},artifacts:[e.result.artifactUpdate.artifact]}),a=s.artifacts?.[0];if(!a)throw new Error("A2A artifact update has no artifact.");Qn(i,a,e.result.artifactUpdate.append===!0);let c={...s,artifacts:[...i.values()]};return this.authorizeArtifacts(ue(this.#t.redactTask(c)))}}}async authorizeArtifacts(e){for(let n of e.artifacts??[])await this.context.authorizeArtifact(n);return e}assertTaskReference(e,n){if(e.id!==n.remoteTaskId)throw new Error("A2A response belongs to a different task id.");let r=le(n).contextId;if(typeof r=="string"&&e.contextId&&e.contextId!==r)throw new Error("A2A response belongs to a different task context.")}assertStreamTaskScope(e,n){if(typeof e.taskId!="string"||e.taskId!==n.remoteTaskId)throw new Error("A2A stream event belongs to a different task.");let r=le(n).contextId;if(typeof e.contextId!="string"||typeof r=="string"&&e.contextId!==r)throw new Error("A2A stream event belongs to a different task context.")}async openStreamResponse(e,n,r,i){let s=o(a=>{let c=new Headers(n);return a&&c.set("authorization",a),Pe(e,{method:"POST",headers:c,redirect:"manual",signal:r,body:JSON.stringify(i)},this.options.networkPolicy,this.options.fetch)},"open");return this.withAuthorization(async a=>{let c=this.#t.retain(a);try{let d=await s(a);if(d.status===401)throw await d.body?.cancel(),new u(-32600,"A2A authentication was rejected.",401);return{response:d,releaseAuthorization:c}}catch(d){throw c(),d}})}taskParams(e){let n=Q(this.registration);return{id:e.remoteTaskId,...n.tenant?{tenant:n.tenant}:{}}}async sendMessage(e){let n=await this.rpc("SendMessage",{...e,...Q(this.registration).tenant?{tenant:Q(this.registration).tenant}:{}});if(!g(n))throw new Error("A2A SendMessage result is invalid.");return n}async rpc(e,n){if(this.#e)throw new Error("A2A executor is disposed.");return this.withAuthorization(r=>this.rpcWithAuthorization(e,n,r))}redactRpcResult(e,n){return e==="GetTask"||e==="CancelTask"?this.#t.redactTask(z(n)):e!=="SendMessage"||!g(n)?n:{...n,...n.task===void 0?{}:{task:this.#t.redactTask(z(n.task))},...n.message===void 0?{}:{message:this.#t.redactMessage(N(n.message))}}}async withAuthorization(e){let n=Q(this.registration).authentication;if(!n){if(this.options.authorization!==void 0&&!ke(this.options.authorization))throw new Error("A2A options.authorization must be a valid Bearer authorization.");let c=this.#t.retain(this.options.authorization);try{return await e(this.options.authorization)}catch(d){throw this.#t.redactError(d)}finally{c()}}let r=this.registration.credentialRef;if(!r)throw new Error("Authenticated A2A registration has no credential reference.");let i=o(c=>this.context.withCredential(r,async d=>{let A,f;try{return A=n.type==="http-bearer"?`Bearer ${d}`:await this.requireOAuthTokenManager().getAuthorization(d),f=this.#t.retain(A),{ok:!0,value:await e(A)}}catch(l){if(c&&n.type==="oauth2-client-credentials"&&l instanceof u&&l.httpStatus===401&&A!==void 0)return{ok:!1,rejectedAuthorization:A};throw this.#t.redactError(l)}finally{f?.()}}),"execute"),s=await i(n.type==="oauth2-client-credentials");if(s.ok)return s.value;this.requireOAuthTokenManager().invalidate(s.rejectedAuthorization);let a=await i(!1);if(!a.ok)throw new Error("A2A OAuth2 retry did not produce a result.");return a.value}requireOAuthTokenManager(){if(!this.oauthTokenManager)throw new Error("A2A OAuth2 token manager is unavailable.");return this.oauthTokenManager}async rpcWithAuthorization(e,n,r){let i=Q(this.registration),s=new Headers({accept:"application/json","a2a-version":"1.0","content-type":"application/json"});r&&s.set("authorization",r);let a=Oe(),c=await G(new URL(i.interfaceUrl),{method:"POST",headers:s,body:JSON.stringify({jsonrpc:"2.0",id:a,method:e,params:n})},Vn(this.options),this.options.fetch);if(c.response.status===401)throw new u(-32600,"A2A authentication was rejected.",401);if(!de(c.response.headers.get("content-type")))throw new Error("A2A JSON-RPC response has an invalid content type.");let d=Me(X(c.body),"A2A endpoint");if(!g(d))throw new Error("A2A JSON-RPC response is invalid.");if(d.jsonrpc!=="2.0"||d.id!==a)throw new Error("A2A JSON-RPC response has an invalid version or response id.");let A=Object.hasOwn(d,"result"),f=Object.hasOwn(d,"error");if(A===f)throw new Error("A2A JSON-RPC response must contain exactly one result or error.");if(f)throw!g(d.error)||typeof d.error.code!="number"||typeof d.error.message!="string"?new Error("A2A JSON-RPC error response is invalid."):new u(d.error.code,this.#t.redactText(d.error.message),c.response.status,this.#t.redactContent(d.error.data));if(!c.response.ok)throw new Error(`A2A request failed with HTTP ${c.response.status}.`);return this.redactRpcResult(e,d.result)}};function xt(t){let e=new Map;return{executorId:Ce,protocol:"a2a",async create(n,r){let i=typeof t=="function"?t(n):t,s=Q(n),a=s.authentication,c={...i,networkPolicy:wt(i.networkPolicy,s.interfaceUrl)},d;if(a?.type==="oauth2-client-credentials"){let p=wt(i.networkPolicy,a.tokenUrl),h=Ae({authentication:a,credentialRef:n.credentialRef??"",networkPolicy:p}),k=e.get(n.agentId);if(d=k?.key===h&&k.fetch===i.fetch?k:void 0,!d){let w=ht({issuer:a.issuer,tokenUrl:a.tokenUrl,clientId:a.clientId,scopes:a.scopes,...a.resource?{resource:a.resource}:{},clientAuthenticationMethod:a.clientAuthentication==="client-secret-post"?"post":"basic",networkPolicy:p,...i.fetch?{fetch:i.fetch}:{}});d={key:h,fetch:i.fetch,manager:w,references:0},e.set(n.agentId,d)}}if(!d)return new Se(n,r,c);let A=d;A.references+=1;let f=!1,l=o(()=>{f||(f=!0,A.references-=1,A.references===0&&(A.manager.invalidate(),e.get(n.agentId)===A&&e.delete(n.agentId)))},"releaseOAuthTokenManager");return new Se(n,r,c,A.manager,l)}}}o(xt,"createA2AAgentExecutorFactory");import{createHash as er,randomUUID as fe}from"node:crypto";import W from"node:fs";import{createServer as tr}from"node:http";import E from"node:path";import{Readable as vt}from"node:stream";import{createHash as Zn}from"node:crypto";var Z="realm-subject-tenant-v1";function It(t){return Zn("sha256").update(t).digest("hex")}o(It,"sha256");function Ct(t){return It(`${t.subject}\0${t.tenant??""}`)}o(Ct,"legacyA2APrincipalKey");function Re(t){return It(JSON.stringify([t.securityRealm,t.subject,t.tenant??null]))}o(Re,"realmA2APrincipalKey");import _ from"node:fs";import $e from"node:path";function Y(t){return structuredClone(t)}o(Y,"clone");function Yn(t){if(!g(t))throw new Error("A2A task store record must be an object.");for(let n of["taskId","contextId","principalKey","runtimeIdentity","sessionId","createdAt","updatedAt"])if(typeof t[n]!="string")throw new Error(`A2A task store record has invalid ${n}.`);if(!g(t.messageDigests)||!Object.values(t.messageDigests).every(n=>typeof n=="string"))throw new Error("A2A task store message digests are invalid.");if(!Array.isArray(t.runIds)||!t.runIds.every(n=>typeof n=="string"))throw new Error("A2A task store run IDs are invalid.");if(!Array.isArray(t.history))throw new Error("A2A task store history is invalid.");if(t.principalKeyScheme!==void 0&&t.principalKeyScheme!==Z)throw new Error("A2A task store principal key scheme is unsupported.");if(!Number.isSafeInteger(t.eventSeq)||!Number.isSafeInteger(t.lastRuntimeEventSeq))throw new Error("A2A task store event cursors are invalid.");let e=t.pendingUserInput;if(e!==void 0&&(!g(e)||typeof e.requestId!="string"||!Number.isSafeInteger(e.revision)||typeof e.runId!="string"||typeof e.kind!="string"))throw new Error("A2A task store pending user input is invalid.");if(t.acceptedOutputModes!==void 0&&(!Array.isArray(t.acceptedOutputModes)||!t.acceptedOutputModes.every(n=>typeof n=="string")))throw new Error("A2A task store accepted output modes are invalid.");return{taskId:t.taskId,contextId:t.contextId,principalKey:t.principalKey,...t.principalKeyScheme===Z?{principalKeyScheme:Z}:{},runtimeIdentity:t.runtimeIdentity,sessionId:t.sessionId,...typeof t.workspaceRoot=="string"?{workspaceRoot:t.workspaceRoot}:{},...typeof t.executionPolicyRevision=="string"?{executionPolicyRevision:t.executionPolicyRevision}:{},messageDigests:t.messageDigests,runIds:t.runIds,task:z(t.task),history:t.history.map(N),createdAt:t.createdAt,updatedAt:t.updatedAt,eventSeq:t.eventSeq,lastRuntimeEventSeq:t.lastRuntimeEventSeq,runtimeEventCount:Number.isSafeInteger(t.runtimeEventCount)?t.runtimeEventCount:0,runtimeEventBytes:Number.isSafeInteger(t.runtimeEventBytes)?t.runtimeEventBytes:0,...t.acceptedOutputModes!==void 0?{acceptedOutputModes:t.acceptedOutputModes}:{},...e!==void 0?{pendingUserInput:{requestId:e.requestId,revision:e.revision,runId:e.runId,kind:e.kind}}:{}}}o(Yn,"parseRecord");var oe=class{static{o(this,"A2AFileTaskStore")}#e=new Map;#n=new Map;#t;#r;#i;constructor(e){let n=$e.resolve(e);_.mkdirSync(n,{recursive:!0,mode:448}),this.#t=$e.join(n,"tasks.json"),this.#r=$e.join(n,".server.lock"),this.#i=this.acquireLock();try{this.load()}catch(r){throw _.closeSync(this.#i),_.rmSync(this.#r,{force:!0}),r}}get(e){let n=this.#e.get(e);return n?Y(n):void 0}findByMessage(e,n){for(let r of this.#e.values())if(r.principalKey===e&&r.messageDigests[n]!==void 0)return Y(r)}list(e){return[...this.#e.values()].filter(n=>n.principalKey===e).sort((n,r)=>r.updatedAt.localeCompare(n.updatedAt)||r.taskId.localeCompare(n.taskId)).map(Y)}all(){return[...this.#e.values()].map(Y)}save(e){let n=Y(e),r=this.#e.get(e.taskId);this.#e.set(e.taskId,n);try{this.persist()}catch(i){throw r?this.#e.set(e.taskId,r):this.#e.delete(e.taskId),i}for(let i of this.#n.get(e.taskId)??[])i(Y(n));return Y(n)}pruneTerminal(e,n){let r=[...this.#e.values()].filter(s=>s.principalKey===e).sort((s,a)=>s.updatedAt.localeCompare(a.updatedAt)),i=[];for(;r.length>n;){let s=r.findIndex(c=>c.task.status.state==="TASK_STATE_COMPLETED"||c.task.status.state==="TASK_STATE_FAILED"||c.task.status.state==="TASK_STATE_CANCELED"||c.task.status.state==="TASK_STATE_REJECTED");if(s<0)break;let[a]=r.splice(s,1);if(!a)break;this.#e.delete(a.taskId),this.#n.delete(a.taskId),i.push(Y(a))}return i.length>0&&this.persist(),i}migrateUnversionedPrincipalKeys(e){let n=0,r=0,i=0,s=[];for(let[a,c]of this.#e){if(c.principalKeyScheme!==void 0)continue;let d=e.legacyToCurrent.get(c.principalKey);d!==void 0?(n+=1,s.push([a,{...c,principalKey:d,principalKeyScheme:Z}])):e.currentKeys.has(c.principalKey)?(r+=1,s.push([a,{...c,principalKeyScheme:Z}])):i+=1}if(e.apply&&s.length>0){for(let[a,c]of s)this.#e.set(a,c);this.persist()}return{matchedLegacyTaskCount:n,matchedCurrentTaskCount:r,unmatchedUnversionedTaskCount:i}}subscribe(e,n){let r=this.#n.get(e)??new Set;return r.add(n),this.#n.set(e,r),()=>{r.delete(n),r.size===0&&this.#n.delete(e)}}close(){this.#n.clear(),_.closeSync(this.#i),_.rmSync(this.#r,{force:!0})}acquireLock(){let e=o(()=>{let n=_.openSync(this.#r,"wx",384);return _.writeFileSync(n,`${process.pid}