@loopingai/core 0.1.0

package/dist/a2a/parts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parts.js","sourceRoot":"","sources":["../../src/a2a/parts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAA2B,MAAM,aAAa,CAAC;AAG5D;;;;;;;;;;;;GAYG;AAEH,6DAA6D;AAC7D,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO;QACL,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;QACvC,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,eAAe;KAC3B,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,SAAS,CAAC,KAAyB;IACjD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,KAAK,MAAM;YAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,gFAAgF;AAChF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC7D,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAKhC;IACC,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,IAAI,CAAC,UAAU;QACrB,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,EAAE;QACd,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC"}

package/dist/a2a/task-store.d.ts

@@ -0,0 +1,45 @@
+import type { TaskStore } from "@a2a-js/sdk/server";
+import { type ListTasksRequest, type ListTasksResponse, type Task } from "@a2a-js/sdk";
+import type { GatewayIdentity } from "./verify.js";
+import type { AgentResolver } from "./agent-stub.js";
+/**
+ * A durable {@link TaskStore} for the a2a-js `DefaultRequestHandler`, backed by
+ * the caller's agent Durable Object (via native RPC) instead of the SDK's
+ * per-request `InMemoryTaskStore`.
+ *
+ * Task state must survive the accept → async callback gap (and answer
+ * `GetTask`/`CancelTask`/`ListTasks` across requests), so it lives in the same
+ * per-caller DO that owns the Session — keyed by the verified `identity.key`,
+ * exactly like {@link file://./executor.ts A2AExecutor}. A workflow updates the
+ * same rows through its own DO RPC calls, so this store and the workflow share
+ * one source of truth.
+ *
+ * v1.0 passes a `ServerCallContext` to every method so a shared store can scope
+ * rows by tenant/owner. This store needs none of that: the DO instance it routes
+ * to *is* the scope, resolved from the caller identity the Worker verified, so a
+ * task is unreachable from any other caller by construction.
+ */
+export declare class DurableTaskStore implements TaskStore {
+    private readonly identity;
+    private readonly resolveAgent;
+    constructor(identity: GatewayIdentity, resolveAgent: AgentResolver);
+    load(taskId: string): Promise<Task | undefined>;
+    save(task: Task): Promise<void>;
+    /**
+     * `ListTasks` (new in v1.0): this caller's tasks, newest first, with the
+     * spec's optional `contextId` / `status` / `statusTimestampAfter` filters
+     * applied in SQL.
+     *
+     * The page token is the row offset as a decimal string. Offset paging can skip
+     * or repeat a row if tasks are written mid-scan, which is acceptable here: the
+     * listing is a diagnostic view over an append-mostly table, and the alternative
+     * (a keyset cursor) buys stability this caller has no use for.
+     *
+     * An agent whose DO does not implement `listTasks` answers the RPC with the
+     * protocol's own "unsupported" error rather than a binding-level failure — the
+     * capability is genuinely optional, and one of the two predecessor agents
+     * shipped without it for its whole life.
+     */
+    list(params: ListTasksRequest): Promise<ListTasksResponse>;
+}
+//# sourceMappingURL=task-store.d.ts.map

package/dist/a2a/task-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-store.d.ts","sourceRoot":"","sources":["../../src/a2a/task-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,IAAI,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,gBAAiB,YAAW,SAAS;IAE9C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,QAAQ,EAAE,eAAe,EACzB,YAAY,EAAE,aAAa;IAGxC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAM/C,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC;;;;;;;;;;;;;;OAcG;IACG,IAAI,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAiCjE"}

package/dist/a2a/task-store.js

@@ -0,0 +1,100 @@
+import { UnsupportedOperationError } from "@a2a-js/sdk/errors";
+import { TaskState } from "@a2a-js/sdk";
+/**
+ * A durable {@link TaskStore} for the a2a-js `DefaultRequestHandler`, backed by
+ * the caller's agent Durable Object (via native RPC) instead of the SDK's
+ * per-request `InMemoryTaskStore`.
+ *
+ * Task state must survive the accept → async callback gap (and answer
+ * `GetTask`/`CancelTask`/`ListTasks` across requests), so it lives in the same
+ * per-caller DO that owns the Session — keyed by the verified `identity.key`,
+ * exactly like {@link file://./executor.ts A2AExecutor}. A workflow updates the
+ * same rows through its own DO RPC calls, so this store and the workflow share
+ * one source of truth.
+ *
+ * v1.0 passes a `ServerCallContext` to every method so a shared store can scope
+ * rows by tenant/owner. This store needs none of that: the DO instance it routes
+ * to *is* the scope, resolved from the caller identity the Worker verified, so a
+ * task is unreachable from any other caller by construction.
+ */
+export class DurableTaskStore {
+    identity;
+    resolveAgent;
+    constructor(identity, resolveAgent) {
+        this.identity = identity;
+        this.resolveAgent = resolveAgent;
+    }
+    async load(taskId) {
+        return ((await this.resolveAgent(this.identity).getTask(taskId)) ?? undefined);
+    }
+    async save(task) {
+        await this.resolveAgent(this.identity).saveTask(task);
+    }
+    /**
+     * `ListTasks` (new in v1.0): this caller's tasks, newest first, with the
+     * spec's optional `contextId` / `status` / `statusTimestampAfter` filters
+     * applied in SQL.
+     *
+     * The page token is the row offset as a decimal string. Offset paging can skip
+     * or repeat a row if tasks are written mid-scan, which is acceptable here: the
+     * listing is a diagnostic view over an append-mostly table, and the alternative
+     * (a keyset cursor) buys stability this caller has no use for.
+     *
+     * An agent whose DO does not implement `listTasks` answers the RPC with the
+     * protocol's own "unsupported" error rather than a binding-level failure — the
+     * capability is genuinely optional, and one of the two predecessor agents
+     * shipped without it for its whole life.
+     */
+    async list(params) {
+        const agent = this.resolveAgent(this.identity);
+        if (!agent.listTasks) {
+            throw new UnsupportedOperationError({
+                message: "this agent does not support ListTasks"
+            });
+        }
+        const pageSize = clampPageSize(params.pageSize);
+        const offset = parseOffset(params.pageToken);
+        const { tasks, totalSize } = await agent.listTasks({
+            contextId: params.contextId,
+            // The proto default (`UNSPECIFIED`) is the spec's "no status filter".
+            state: params.status === TaskState.TASK_STATE_UNSPECIFIED
+                ? undefined
+                : params.status,
+            updatedAfter: parseTimestamp(params.statusTimestampAfter),
+            includeArtifacts: params.includeArtifacts === true,
+            historyLength: params.historyLength,
+            limit: pageSize,
+            offset
+        });
+        const nextOffset = offset + tasks.length;
+        return {
+            tasks,
+            nextPageToken: nextOffset < totalSize ? String(nextOffset) : "",
+            pageSize,
+            totalSize
+        };
+    }
+}
+/** Page size bounds from the `ListTasks` spec: default 50, min 1, max 100. */
+function clampPageSize(pageSize) {
+    if (pageSize === undefined)
+        return 50;
+    return Math.min(100, Math.max(1, Math.trunc(pageSize)));
+}
+/** Row offset from a page token; an unparseable token restarts at the first page. */
+function parseOffset(pageToken) {
+    const offset = Number.parseInt(pageToken, 10);
+    return Number.isSafeInteger(offset) && offset > 0 ? offset : 0;
+}
+/**
+ * `statusTimestampAfter` (ISO 8601) as epoch milliseconds, matching the
+ * `updated_at` column the store filters on — that column is stamped on every
+ * status write, so it tracks `status.timestamp`.
+ */
+function parseTimestamp(iso) {
+    if (!iso)
+        return undefined;
+    const ms = Date.parse(iso);
+    return Number.isNaN(ms) ? undefined : ms;
+}
+//# sourceMappingURL=task-store.js.map

package/dist/a2a/task-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-store.js","sourceRoot":"","sources":["../../src/a2a/task-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EACL,SAAS,EAIV,MAAM,aAAa,CAAC;AAIrB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,gBAAgB;IAER;IACA;IAFnB,YACmB,QAAyB,EACzB,YAA2B;QAD3B,aAAQ,GAAR,QAAQ,CAAiB;QACzB,iBAAY,GAAZ,YAAY,CAAe;IAC3C,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CACtE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAU;QACnB,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,IAAI,CAAC,MAAwB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,yBAAyB,CAAC;gBAClC,OAAO,EAAE,uCAAuC;aACjD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE7C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;YACjD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,sEAAsE;YACtE,KAAK,EACH,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,sBAAsB;gBAChD,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,CAAC,MAAM;YACnB,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,oBAAoB,CAAC;YACzD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,KAAK,IAAI;YAClD,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,QAAQ;YACf,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACzC,OAAO;YACL,KAAK;YACL,aAAa,EAAE,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;YAC/D,QAAQ;YACR,SAAS;SACV,CAAC;IACJ,CAAC;CACF;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,QAA4B;IACjD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,SAAiB;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAuB;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC"}

package/dist/a2a/task.d.ts

@@ -0,0 +1,86 @@
+import { type Role, type TaskState } from "@a2a-js/sdk";
+/**
+ * The A2A `Task` (and its nested types) as they cross the DO RPC boundary.
+ *
+ * Two constraints shape these, and the SDK types satisfy neither directly:
+ *
+ *  1. **Serializability.** A v1.0 `Part` carries a `content` oneof whose `raw`
+ *     arm is a `Buffer`; its methods fail Cloudflare's `Rpc.Serializable`
+ *     constraint and collapse the generated DO-stub return types to `never`.
+ *     Pinning `content` to its `text` arm removes that arm — and this agent only
+ *     ever produces, and only ever receives, text (see {@link file://./parts.ts}).
+ *  2. **Instantiation depth.** These are written out as plain interfaces rather
+ *     than derived with `Omit<Task, …> & { … }`. The v1.0 model is deep enough
+ *     that layering mapped types under Cloudflare's own RPC type mapping exceeds
+ *     TypeScript's instantiation limit at the stub call sites.
+ *
+ * Each of these widens to its SDK counterpart for free, so no cast is needed at
+ * the a2a-js edges (`AgentEvent.task`, `TaskStore.load`/`list`); the
+ * {@link _Widens} guard below fails the build if that ever stops holding.
+ * Runtime is unaffected — tasks are JSON-round-tripped in storage, so any field
+ * the SDK adds survives even though these types don't name it.
+ */
+/**
+ * The A2A extension `metadata` bag as this agent handles it: never set. Its SDK
+ * type is an open `{ [key: string]: any }` map, which is both what collapses the
+ * DO-stub types (`unknown` members fail `Rpc.Serializable`) and what pushes the
+ * stub-mapped `Task` past TypeScript's instantiation limit. Pinning it to
+ * `undefined` keeps both in check and still widens to the SDK type. Metadata a
+ * caller sent is not erased — stored tasks are JSON blobs, so it round-trips
+ * untouched; it is simply invisible to this agent, which never reads it.
+ */
+type A2AMetadata = undefined;
+/** A `Part` restricted to the text arm of its `content` oneof. */
+export interface PlainPart {
+    content: {
+        $case: "text";
+        value: string;
+    };
+    metadata: A2AMetadata;
+    filename: string;
+    mediaType: string;
+}
+/** A `Message` whose parts are all {@link PlainPart}. */
+export interface PlainMessage {
+    messageId: string;
+    contextId: string;
+    taskId: string;
+    role: Role;
+    parts: PlainPart[];
+    metadata: A2AMetadata;
+    extensions: string[];
+    referenceTaskIds: string[];
+}
+/** An `Artifact` whose parts are all {@link PlainPart}. */
+export interface PlainArtifact {
+    artifactId: string;
+    name: string;
+    description: string;
+    parts: PlainPart[];
+    metadata: A2AMetadata;
+    extensions: string[];
+}
+/** A `TaskStatus` whose message is a {@link PlainMessage}. */
+export interface PlainStatus {
+    state: TaskState;
+    message: PlainMessage | undefined;
+    timestamp: string | undefined;
+}
+/** A `Task` built entirely from the plain types above. */
+export interface PlainTask {
+    id: string;
+    contextId: string;
+    status: PlainStatus;
+    artifacts: PlainArtifact[];
+    history: PlainMessage[];
+    metadata: A2AMetadata;
+}
+/**
+ * A task state rendered for humans and for the `notify_tasks.state` column
+ * (`TASK_STATE_INPUT_REQUIRED` → `input-required`). v1.0 states are numeric enum
+ * members, so anything stored or displayed goes through the protobuf JSON name
+ * first. Matches looping-gateway's `taskStateLabel`.
+ */
+export declare function taskStateLabel(state: TaskState): string;
+export {};
+//# sourceMappingURL=task.d.ts.map

package/dist/a2a/task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task.d.ts","sourceRoot":"","sources":["../../src/a2a/task.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,IAAI,EAET,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;;;GAQG;AACH,KAAK,WAAW,GAAG,SAAS,CAAC;AAE7B,kEAAkE;AAClE,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,QAAQ,EAAE,WAAW,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,QAAQ,EAAE,WAAW,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,QAAQ,EAAE,WAAW,CAAC;CACvB;AAQD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAKvD"}

package/dist/a2a/task.js

@@ -0,0 +1,16 @@
+import { taskStateToJSON } from "@a2a-js/sdk";
+const _assertWidens = true;
+void _assertWidens;
+/**
+ * A task state rendered for humans and for the `notify_tasks.state` column
+ * (`TASK_STATE_INPUT_REQUIRED` → `input-required`). v1.0 states are numeric enum
+ * members, so anything stored or displayed goes through the protobuf JSON name
+ * first. Matches looping-gateway's `taskStateLabel`.
+ */
+export function taskStateLabel(state) {
+    return taskStateToJSON(state)
+        .replace(/^TASK_STATE_/, "")
+        .toLowerCase()
+        .replace(/_/g, "-");
+}
+//# sourceMappingURL=task.js.map

package/dist/a2a/task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task.js","sourceRoot":"","sources":["../../src/a2a/task.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAIhB,MAAM,aAAa,CAAC;AAqFrB,MAAM,aAAa,GAAY,IAAI,CAAC;AACpC,KAAK,aAAa,CAAC;AAEnB;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,OAAO,eAAe,CAAC,KAAK,CAAC;SAC1B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACxB,CAAC"}

package/dist/a2a/verify.d.ts

@@ -0,0 +1,64 @@
+import { type JWTPayload } from "jose";
+/**
+ * Default namespaced claim carrying the minimal caller identity.
+ *
+ * Overridable via {@link VerifyOptions.identityClaim} for a deployment that
+ * isn't behind looping-gateway; the default is the Looping namespace so an
+ * agent built on this package needs no configuration to interoperate.
+ */
+export declare const IDENTITY_CLAIM = "https://looping.ai/identity";
+/**
+ * The gateway-agent instance identity forwarded by the gateway — i.e. which
+ * registered agent instance dispatched this call, not the human end user.
+ * Mirrors `RemoteIdentity` in looping-gateway's `src/auth/agent-jwt.ts`.
+ *
+ * Any end user travels unverified, inline in the message text; the gateway
+ * deliberately excludes it from this signed claim so a remote agent cannot read
+ * the full caller auth context. Every field is optional because the claim is
+ * whatever the issuer put there — {@link GatewayIdentity.key} is the only one
+ * anything downstream depends on, and a caller without it is rejected before a
+ * DO is ever addressed.
+ */
+export interface GatewayIdentity {
+    /** Canonical instance key, e.g. `custom:7:analytics`. */
+    key?: string;
+    /** Registry name of the logical agent instance. */
+    name?: string;
+    /** Dispatch kind of the caller (`"custom"` for remote agents). */
+    kind?: string;
+    /** Workspace the calling agent instance belongs to. */
+    workspaceId?: number | null;
+}
+/** Thrown when a gateway token is missing or fails verification. */
+export declare class GatewayAuthError extends Error {
+    constructor(message: string);
+}
+/** Extract the Bearer token from an `Authorization` header, or null. */
+export declare function bearerToken(request: Request): string | null;
+export interface VerifyOptions {
+    /** Allowed gateway origins — validates both the `jku` domain and `iss` claim. */
+    allowedOrigins: string[];
+    audience: string;
+    /** Claim carrying the caller identity. Defaults to {@link IDENTITY_CLAIM}. */
+    identityClaim?: string;
+}
+/**
+ * Normalize configured gateway origins to the HTTPS origins emitted in gateway
+ * JWT `jku` and `iss` claims. This accepts a hostname, `http://` URL, or URL
+ * with a trailing slash while keeping the verification allowlist exact.
+ */
+export declare function normalizeGatewayOrigins(origins: string[]): string[];
+/**
+ * Verify a gateway JWT and return its payload + parsed identity.
+ *
+ * The `jku` JWK Set URL is read directly from the token's protected header
+ * (RFC 7515 §4.1.2) and validated against the allowlist before fetching, so no
+ * separate JWKS URL configuration is needed on the remote side.
+ *
+ * Throws {@link GatewayAuthError} on any failure.
+ */
+export declare function verifyGatewayToken(token: string, opts: VerifyOptions): Promise<{
+    payload: JWTPayload;
+    identity: GatewayIdentity;
+}>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/a2a/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AAyBd;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,gCAAgC,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oEAAoE;AACpE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAcD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAenE;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,CAAC,CAyC7D"}

package/dist/a2a/verify.js

@@ -0,0 +1,122 @@
+import { createRemoteJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
+/**
+ * Verify the gateway identity JWT (the "B authenticates A" half of zero-trust).
+ *
+ * The gateway signs a short-lived EdDSA JWT and sends it as a Bearer token on
+ * every A2A call. Per RFC 7515 §4.1.2 it embeds a `jku` header pointing at its
+ * public JWKS, so remote agents don't need a separately configured JWKS URL —
+ * they read `jku` straight from the token and verify the key from there.
+ *
+ * Security: the `jku` origin is validated against the allowed origins before
+ * fetching, preventing key-injection attacks (an attacker cannot point `jku` at
+ * their own JWKS and have it accepted).
+ *
+ * **This file is a guardian.** The four checks below — `jku` present → origin
+ * allowlist → `iss` origin equals `jku` origin → `jwtVerify` pinned to EdDSA —
+ * are the whole zero-trust contract, and they arrived here byte-identical from
+ * two independently-evolved agents. Do not weaken any of them, do not make any
+ * of them optional, and do not add a bypass for local development: run a local
+ * gateway instead.
+ */
+/** Algorithm the gateway signs with — reject anything else. */
+const ALG = "EdDSA";
+/**
+ * Default namespaced claim carrying the minimal caller identity.
+ *
+ * Overridable via {@link VerifyOptions.identityClaim} for a deployment that
+ * isn't behind looping-gateway; the default is the Looping namespace so an
+ * agent built on this package needs no configuration to interoperate.
+ */
+export const IDENTITY_CLAIM = "https://looping.ai/identity";
+/** Thrown when a gateway token is missing or fails verification. */
+export class GatewayAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "GatewayAuthError";
+    }
+}
+// jose's remote JWKS helper caches keys + handles rotation; build one per URL
+// and reuse it across requests in the same isolate.
+const jwksByUrl = new Map();
+function jwksFor(url) {
+    let set = jwksByUrl.get(url);
+    if (!set) {
+        set = createRemoteJWKSet(new URL(url));
+        jwksByUrl.set(url, set);
+    }
+    return set;
+}
+/** Extract the Bearer token from an `Authorization` header, or null. */
+export function bearerToken(request) {
+    const header = request.headers.get("authorization") ?? "";
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match ? match[1] : null;
+}
+/**
+ * Normalize configured gateway origins to the HTTPS origins emitted in gateway
+ * JWT `jku` and `iss` claims. This accepts a hostname, `http://` URL, or URL
+ * with a trailing slash while keeping the verification allowlist exact.
+ */
+export function normalizeGatewayOrigins(origins) {
+    return origins.map((origin) => {
+        const trimmed = origin.trim();
+        if (!trimmed) {
+            throw new GatewayAuthError("allowed gateway origin cannot be empty");
+        }
+        try {
+            return new URL(`https://${trimmed.replace(/^https?:\/\//i, "")}`).origin;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new GatewayAuthError(`invalid allowed gateway origin '${origin}': ${message}`);
+        }
+    });
+}
+/**
+ * Verify a gateway JWT and return its payload + parsed identity.
+ *
+ * The `jku` JWK Set URL is read directly from the token's protected header
+ * (RFC 7515 §4.1.2) and validated against the allowlist before fetching, so no
+ * separate JWKS URL configuration is needed on the remote side.
+ *
+ * Throws {@link GatewayAuthError} on any failure.
+ */
+export async function verifyGatewayToken(token, opts) {
+    try {
+        const allowedOrigins = normalizeGatewayOrigins(opts.allowedOrigins);
+        // Extract jku from the protected header — this is the standard way the
+        // gateway advertises where to fetch its public key (RFC 7515 §4.1.2).
+        const header = decodeProtectedHeader(token);
+        const jku = header.jku;
+        if (!jku) {
+            throw new GatewayAuthError("gateway JWT missing jku header (RFC 7515 §4.1.2)");
+        }
+        // Security: validate the jku origin before fetching. Without this an
+        // attacker could forge a token with jku pointing at their own JWKS.
+        const jkuOrigin = new URL(jku).origin;
+        if (!allowedOrigins.includes(jkuOrigin)) {
+            throw new GatewayAuthError(`jku origin '${jkuOrigin}' is not in the allowed gateway origins`);
+        }
+        // Prevent one listed gateway from impersonating another: the origin where
+        // keys are fetched must match the origin that issued the token.
+        const rawIss = decodeJwt(token).iss ?? "";
+        const issOrigin = new URL(rawIss).origin;
+        if (issOrigin !== jkuOrigin) {
+            throw new GatewayAuthError(`jku origin '${jkuOrigin}' does not match iss origin '${issOrigin}'`);
+        }
+        const { payload } = await jwtVerify(token, jwksFor(jku), {
+            issuer: allowedOrigins,
+            audience: opts.audience,
+            algorithms: [ALG]
+        });
+        const claim = opts.identityClaim ?? IDENTITY_CLAIM;
+        const identity = payload[claim] ?? {};
+        return { payload, identity };
+    }
+    catch (err) {
+        if (err instanceof GatewayAuthError)
+            throw err;
+        throw new GatewayAuthError(err.message);
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/a2a/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,qBAAqB,EACrB,SAAS,EAEV,MAAM,MAAM,CAAC;AAEd;;;;;;;;;;;;;;;;;;GAkBG;AAEH,+DAA+D;AAC/D,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAyB5D,oEAAoE;AACpE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAC3E,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,MAAM,MAAM,OAAO,EAAE,CACzD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,IAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAqB,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,yCAAyC,CAClE,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,gCAAgC,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACvD,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,GAAG,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC;QACnD,MAAM,QAAQ,GAAI,OAAO,CAAC,KAAK,CAAiC,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,MAAM,IAAI,gBAAgB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/agent/budget.d.ts

@@ -0,0 +1,47 @@
+/**
+ * One round's turn allowance, carried as a single mutable object rather than as a
+ * number threaded down and a count threaded back up.
+ *
+ * The distinction matters because a round is not one model call. Each slot may
+ * repair a rejected decomposition several times before the round moves on to the
+ * fallback, and every one of those attempts *restarts* the round from the same
+ * messages — so a failed attempt is work redone, with whatever tool side effects
+ * it already had. They all spend the same allowance. When that allowance was a
+ * plain number, keeping later attempts honest meant remembering to decrement it
+ * between each pair, and forgetting let one round cost a multiple of its budget.
+ * Sharing one object removes the thing there was to forget.
+ *
+ * `spent` is mutated where the turn is actually spent (the model loop's
+ * `onStepEnd`) and read where it actually matters (the RPC return that the
+ * Workflow meters against the Task). Nothing in between carries it.
+ */
+/** One round's allowance and what it has spent, across every attempt in the round. */
+export interface TurnBudget {
+    /** What this round was allowed when it started: the Task's unspent turns. */
+    readonly allowance: number;
+    /** Turns spent so far. Mutated by the model loop, one per completed step. */
+    spent: number;
+}
+/** A fresh budget for a round that may spend `allowance` turns. */
+export declare const newTurnBudget: (allowance: number) => TurnBudget;
+/**
+ * Steps one `generateText` attempt may spend, given what the run has already used.
+ *
+ * Must be evaluated **per attempt**: `isStepCount` counts steps within a single
+ * call, so an allowance computed once and shared with later attempts would hand
+ * each of them the turns its predecessors already burned.
+ *
+ * The `Math.max(1, …)` floor is load-bearing, not defensive. A primary that
+ * consumed the entire remainder still leaves the fallback one step, because an
+ * attempt with nothing to spend cannot reach an ending — which fails the round and
+ * costs the caller its answer, a far worse trade than one turn. So a round may
+ * exceed its allowance by exactly one, and never by more.
+ *
+ * The bound survives repair attempts because only an attempt that *starts* already
+ * at the allowance can overrun, and only by the one step of this floor: an attempt
+ * that starts under it is capped at the exact remainder, and `runTurn` refuses to
+ * open a repair once the allowance is gone. That leaves the fallback's first
+ * attempt as the only one that can ever begin overdrawn.
+ */
+export declare const stepAllowance: (maxTurns: number, spent: number) => number;
+//# sourceMappingURL=budget.d.ts.map

package/dist/agent/budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../../src/agent/budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,eAAO,MAAM,aAAa,GAAI,WAAW,MAAM,KAAG,UAGhD,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,EAAE,OAAO,MAAM,KAAG,MACjC,CAAC"}

package/dist/agent/budget.js

@@ -0,0 +1,43 @@
+/**
+ * One round's turn allowance, carried as a single mutable object rather than as a
+ * number threaded down and a count threaded back up.
+ *
+ * The distinction matters because a round is not one model call. Each slot may
+ * repair a rejected decomposition several times before the round moves on to the
+ * fallback, and every one of those attempts *restarts* the round from the same
+ * messages — so a failed attempt is work redone, with whatever tool side effects
+ * it already had. They all spend the same allowance. When that allowance was a
+ * plain number, keeping later attempts honest meant remembering to decrement it
+ * between each pair, and forgetting let one round cost a multiple of its budget.
+ * Sharing one object removes the thing there was to forget.
+ *
+ * `spent` is mutated where the turn is actually spent (the model loop's
+ * `onStepEnd`) and read where it actually matters (the RPC return that the
+ * Workflow meters against the Task). Nothing in between carries it.
+ */
+/** A fresh budget for a round that may spend `allowance` turns. */
+export const newTurnBudget = (allowance) => ({
+    allowance,
+    spent: 0
+});
+/**
+ * Steps one `generateText` attempt may spend, given what the run has already used.
+ *
+ * Must be evaluated **per attempt**: `isStepCount` counts steps within a single
+ * call, so an allowance computed once and shared with later attempts would hand
+ * each of them the turns its predecessors already burned.
+ *
+ * The `Math.max(1, …)` floor is load-bearing, not defensive. A primary that
+ * consumed the entire remainder still leaves the fallback one step, because an
+ * attempt with nothing to spend cannot reach an ending — which fails the round and
+ * costs the caller its answer, a far worse trade than one turn. So a round may
+ * exceed its allowance by exactly one, and never by more.
+ *
+ * The bound survives repair attempts because only an attempt that *starts* already
+ * at the allowance can overrun, and only by the one step of this floor: an attempt
+ * that starts under it is capped at the exact remainder, and `runTurn` refuses to
+ * open a repair once the allowance is gone. That leaves the fallback's first
+ * attempt as the only one that can ever begin overdrawn.
+ */
+export const stepAllowance = (maxTurns, spent) => Math.max(1, maxTurns - spent);
+//# sourceMappingURL=budget.js.map

package/dist/agent/budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.js","sourceRoot":"","sources":["../../src/agent/budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAc,EAAE,CAAC,CAAC;IAC/D,SAAS;IACT,KAAK,EAAE,CAAC;CACT,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAU,EAAE,CACvE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC"}