@ouro.bot/cli 0.1.0-alpha.92 → 0.1.0-alpha.921

package/dist/a2a/server.js

@@ -0,0 +1,771 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ESCALATION_CONFIRM_INTERVAL_MS = void 0;
+exports.a2aChatRelationship = a2aChatRelationship;
+exports.startA2AServer = startA2AServer;
+const http = __importStar(require("node:http"));
+const node_crypto_1 = require("node:crypto");
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const friends_1 = require("@ouro.bot/friends");
+const identity_1 = require("../heart/identity");
+const runtime_1 = require("../nerves/runtime");
+const shared_turn_1 = require("../senses/shared-turn");
+const card_1 = require("./card");
+const config_1 = require("./config");
+const pin_store_1 = require("./pin-store");
+const seen_ledger_1 = require("./seen-ledger");
+const did_resolution_1 = require("./did-resolution");
+const inbound_share_1 = require("./inbound-share");
+const sanctuary_runtime_1 = require("../senses/sanctuary-runtime");
+const sealed_chat_1 = require("./sealed-chat");
+const relationship_authorization_1 = require("../repertoire/relationship-authorization");
+const mission_result_wire_1 = require("./mission-result-wire");
+const delegation_stores_1 = require("./delegation-stores");
+const task_store_1 = require("./task-store");
+const delegated_command_1 = require("./delegated-command");
+const outbox_wire_1 = require("./outbox-wire");
+const failure_reports_1 = require("../heart/failure-reports");
+const MAX_A2A_REQUEST_BYTES = 128 * 1024;
+const MAX_A2A_MESSAGE_TEXT_CHARS = 16_000;
+exports.ESCALATION_CONFIRM_INTERVAL_MS = 5 * 60 * 1000;
+class A2ARequestError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+function jsonResponse(id, result) {
+    return { jsonrpc: "2.0", id: id ?? null, result };
+}
+function errorResponse(id, code, message, data) {
+    return { jsonrpc: "2.0", id: id ?? null, error: { code, message, ...(data !== undefined ? { data } : {}) } };
+}
+async function readBody(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        /* v8 ignore next -- Node HTTP request bodies arrive as Buffers in this runtime; string chunks are defensive stream compatibility @preserve */
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.byteLength;
+        if (total > MAX_A2A_REQUEST_BYTES) {
+            throw new A2ARequestError(413, -32000, `A2A request body exceeds ${MAX_A2A_REQUEST_BYTES} bytes`);
+        }
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks).toString("utf-8");
+}
+function writeJson(res, status, payload) {
+    const body = `${JSON.stringify(payload, null, 2)}\n`;
+    res.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "content-length": Buffer.byteLength(body),
+    });
+    res.end(body);
+}
+function textFromMessage(message) {
+    if (!message || typeof message !== "object")
+        return "";
+    const parts = message.parts;
+    if (!Array.isArray(parts))
+        return "";
+    return parts
+        .map((part) => {
+        if (!part || typeof part !== "object")
+            return "";
+        const text = part.text;
+        return typeof text === "string" ? text : "";
+    })
+        .filter(Boolean)
+        .join("\n")
+        .trim();
+}
+function messageFromParams(params) {
+    if (!params || typeof params !== "object")
+        return null;
+    const message = params.message;
+    if (!message || typeof message !== "object")
+        return null;
+    return message;
+}
+function metadataRecord(value) {
+    /* v8 ignore next -- protocol callers pass JSON-RPC param/message objects; this guard keeps malformed direct input inert @preserve */
+    if (!value || typeof value !== "object")
+        return undefined;
+    /* v8 ignore next -- JSON-RPC params/messages are objects in supported calls; array guard protects malformed direct input @preserve */
+    if (Array.isArray(value))
+        return undefined;
+    const metadata = value.metadata;
+    return metadata && typeof metadata === "object" && !Array.isArray(metadata) ? metadata : undefined;
+}
+function metadataStringFromRecord(metadata, key) {
+    const value = metadata?.[key];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function metadataString(message, key) {
+    return metadataStringFromRecord(metadataRecord(message), key);
+}
+function headerString(req, key) {
+    const value = req.headers[key];
+    /* v8 ignore next -- Node lower-cases singular request headers here; array values are defensive compatibility @preserve */
+    if (Array.isArray(value))
+        return value[0];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+/* v8 ignore start -- default runner crosses into the full live agent pipeline; shared-turn covers that pipeline and server tests inject a deterministic runner @preserve */
+function storageKeyFor(peerExternalId) {
+    return `a2a-${(0, node_crypto_1.createHash)("sha256").update(peerExternalId).digest("hex").slice(0, 24)}`;
+}
+async function defaultTurnRunner(input) {
+    const result = await (0, shared_turn_1.runSenseTurn)({
+        agentName: input.agentName,
+        channel: "a2a",
+        friendId: storageKeyFor(input.peerAgentId),
+        sessionKey: input.sessionKey,
+        userMessage: input.message,
+        latencyMode: "standard",
+        identity: {
+            provider: "a2a-agent",
+            externalId: input.peerAgentId,
+            displayName: input.peerName,
+        },
+        // The Butler's house tools read a typed Sanctuary runtime from the tool context; the
+        // Telegram sense attaches it, and a verified A2A friend's turn needs it too (without it
+        // every Unraid read answered "Sanctuary runtime is unavailable"). The relationship
+        // profile still decides which of those tools the peer may call.
+        toolContext: {
+            ...((0, sanctuary_runtime_1.isSanctuaryAgent)(input.agentName) ? (0, sanctuary_runtime_1.createSanctuaryToolContext)(input.agentName) : {}),
+            ...(input.relationshipAuthorization ? { relationshipAuthorization: input.relationshipAuthorization } : {}),
+            ...(input.delegatedCommand ? { delegatedCommand: input.delegatedCommand } : {}),
+        },
+    });
+    return { response: result.response };
+}
+/* v8 ignore stop */
+/** The relationship that scopes a verified friend's A2A chat turn, from the agent's
+ * own capability registry. No registry (or an invalid one) means no relationship,
+ * which Sanctuary's tool selection turns into "no tools" for a remote turn. */
+function a2aChatRelationship(agentRoot, friend, requestId) {
+    let registry;
+    try {
+        registry = (0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(agentRoot);
+    }
+    catch {
+        return undefined;
+    }
+    return (0, relationship_authorization_1.createRelationshipAuthorizationEvaluator)({ friend, registry, requestId, requestPhase: "inbound" });
+}
+function accessTokenHash(accessToken) {
+    return (0, node_crypto_1.createHash)("sha256").update(accessToken).digest("hex");
+}
+function accessTokenScope(accessToken) {
+    return `a2a-task-token:${accessTokenHash(accessToken)}`;
+}
+function untrustedTurnPeerExternalId() {
+    return "unauthenticated-a2a-peer";
+}
+/** Whether an inbound message carries a friends sealed DataPart (`kind:"data"`). */
+function messageHasDataPart(message) {
+    /* v8 ignore next -- defensive: callers pass a parsed inbound whose `parts` is always an array; guards malformed direct input @preserve */
+    if (!Array.isArray(message.parts))
+        return false;
+    return message.parts.some((part) => part && part.kind === "data");
+}
+/** Map a friends `receiveShare` rejection reason → a JSON-RPC error code.
+ * Malformed-shape reasons map to invalid-params (-32602); auth/trust/replay
+ * rejections map to a dedicated A2A "rejected" code (-32003). */
+function rejectionErrorCode(reason) {
+    if (reason === "malformed_message" || reason === "malformed_plaintext")
+        return -32602;
+    return -32003;
+}
+function senderHintFromMessage(req, inbound) {
+    const idHint = metadataString(inbound, "senderAgentId")
+        ?? metadataString(inbound, "senderCardUrl")
+        ?? metadataString(inbound, "agentId")
+        ?? metadataString(inbound, "cardUrl")
+        ?? headerString(req, "x-a2a-agent-id");
+    const name = metadataString(inbound, "senderName")
+        ?? metadataString(inbound, "agentName")
+        ?? headerString(req, "x-a2a-agent-name")
+        ?? idHint
+        ?? "Unauthenticated A2A peer";
+    return { idHint, name };
+}
+function isTerminalTaskState(state) {
+    return state === "TASK_STATE_COMPLETED"
+        || state === "TASK_STATE_FAILED"
+        || state === "TASK_STATE_CANCELED"
+        || state === "TASK_STATE_REJECTED"
+        || state === "completed"
+        || state === "failed"
+        || state === "canceled"
+        || state === "rejected";
+}
+function accessTokenFromParams(params) {
+    /* v8 ignore next -- GetTask/CancelTask validate object params before token extraction; this keeps direct helper use defensive @preserve */
+    if (!params || typeof params !== "object" || Array.isArray(params))
+        return undefined;
+    const record = params;
+    const direct = record.accessToken ?? record.access_token;
+    if (typeof direct === "string" && direct.trim())
+        return direct.trim();
+    return metadataStringFromRecord(metadataRecord(params), "accessToken");
+}
+function taskA2AMetadata(task) {
+    const a2a = task.metadata?.a2a;
+    /* v8 ignore next -- server-created tasks always carry object auth metadata; fallback protects legacy/corrupt task files @preserve */
+    if (!a2a || typeof a2a !== "object" || Array.isArray(a2a))
+        return {};
+    return a2a;
+}
+/** A friends sealed DataPart: opaque ciphertext addressed to one DID, so it is safe
+ * to expose to the task holder (a sealed chat reply travels this way). */
+function isSealedFriendsPart(part) {
+    const data = part.data;
+    return part.kind === "data" && !!data && typeof data === "object" && typeof data.sealed === "object" && data.sealed !== null && typeof data.recipientDid === "string";
+}
+function publicMessage(message, style) {
+    const parts = message.parts
+        .filter((part) => part && typeof part === "object" && (typeof part.text === "string" || isSealedFriendsPart(part)))
+        .map((part) => style === "legacy" ? { ...part, kind: part.kind ?? "text" } : part);
+    if (style === "latest")
+        return { ...message, kind: "message", parts };
+    return {
+        ...message,
+        kind: "message",
+        role: message.role === "ROLE_AGENT" ? "agent" : message.role === "ROLE_USER" ? "user" : message.role,
+        parts,
+    };
+}
+function legacyTaskState(state) {
+    if (state === "TASK_STATE_SUBMITTED")
+        return "submitted";
+    if (state === "TASK_STATE_WORKING")
+        return "working";
+    if (state === "TASK_STATE_COMPLETED")
+        return "completed";
+    if (state === "TASK_STATE_FAILED")
+        return "failed";
+    if (state === "TASK_STATE_CANCELED")
+        return "canceled";
+    if (state === "TASK_STATE_REJECTED")
+        return "rejected";
+    if (state === "TASK_STATE_AUTH_REQUIRED")
+        return "auth-required";
+    if (state === "TASK_STATE_INPUT_REQUIRED")
+        return "input-required";
+    return state;
+}
+function publicTask(task, accessToken, style, includeAccessToken) {
+    const a2a = taskA2AMetadata(task);
+    const { accessTokenHash: _accessTokenHash, taskScopeHash: _taskScopeHash, ...safeA2A } = a2a;
+    const statusMessage = task.status.message ? publicMessage(task.status.message, style) : undefined;
+    return {
+        ...task,
+        kind: task.kind ?? "task",
+        status: {
+            ...task.status,
+            state: style === "legacy" ? legacyTaskState(task.status.state) : task.status.state,
+            ...(statusMessage ? { message: statusMessage } : {}),
+        },
+        history: task.history.map((message) => publicMessage(message, style)),
+        ...(task.artifacts ? {
+            artifacts: task.artifacts.map((artifact) => ({
+                ...artifact,
+                parts: style === "legacy"
+                    ? artifact.parts.map((part) => ({ ...part, kind: part.kind ?? "text" }))
+                    : artifact.parts,
+            })),
+        } : {}),
+        metadata: {
+            ...task.metadata,
+            a2a: {
+                ...safeA2A,
+                ...(includeAccessToken ? { accessToken } : {}),
+            },
+        },
+    };
+}
+function taskAuthorized(task, accessToken) {
+    const a2a = taskA2AMetadata(task);
+    return a2a.accessTokenHash === accessTokenHash(accessToken);
+}
+function taskFor(input) {
+    const now = new Date().toISOString();
+    const history = [...(input.previousTask?.history ?? []), input.inbound];
+    const previousA2A = input.previousTask ? taskA2AMetadata(input.previousTask) : {};
+    const responseParts = input.responseParts ?? (input.response ? [{ text: input.response }] : undefined);
+    const responseMessage = responseParts
+        ? {
+            kind: "message",
+            role: "ROLE_AGENT",
+            taskId: input.taskId,
+            contextId: input.contextId,
+            messageId: (0, node_crypto_1.randomUUID)(),
+            parts: responseParts,
+        }
+        : undefined;
+    if (responseMessage)
+        history.push(responseMessage);
+    return {
+        kind: "task",
+        id: input.taskId,
+        contextId: input.contextId,
+        status: {
+            state: input.state,
+            timestamp: now,
+            ...(responseMessage ? { message: responseMessage } : {}),
+        },
+        history,
+        metadata: {
+            ...input.previousTask?.metadata,
+            a2a: {
+                ...previousA2A,
+                accessTokenHash: accessTokenHash(input.accessToken),
+                ...(input.clientTaskId ? { clientTaskId: input.clientTaskId } : {}),
+            },
+        },
+        ...(responseMessage ? {
+            artifacts: [{
+                    artifactId: `artifact-${input.taskId}`,
+                    name: "response",
+                    parts: responseMessage.parts,
+                }],
+        } : {}),
+    };
+}
+async function startA2AServer(options) {
+    const host = options.host ?? config_1.A2A_DEFAULT_HOST;
+    /* v8 ignore next -- daemon-managed A2A owns the default-port path; protocol tests bind port 0 to avoid collisions @preserve */
+    const port = options.port ?? (0, config_1.defaultA2APort)(options.agentName);
+    const a2aPath = (0, config_1.normalizeA2APath)(options.path);
+    /* v8 ignore next -- foreground CLI/default daemon paths own the ambient agent-root fallback; protocol tests inject an isolated root @preserve */
+    const agentRoot = options.agentRoot ?? (0, identity_1.getAgentRoot)(options.agentName);
+    const taskStore = new task_store_1.FileA2ATaskStore(agentRoot);
+    /* v8 ignore next -- default runner crosses into the full live agent pipeline; shared-turn covers that pipeline and server tests inject a deterministic runner @preserve */
+    const turnRunner = options.turnRunner ?? defaultTurnRunner;
+    // The inbound friends-DataPart bridge is available only when the agent has a
+    // cryptographic identity (its did:key + X25519 unseal keys). Build its durable
+    // stores once at start; without an identity, inbound stays on the text path.
+    let inboundShareDeps;
+    if (options.identity) {
+        const friendsDir = `${agentRoot}/friends`;
+        inboundShareDeps = {
+            sodium: await (0, a2a_client_1.ready)(),
+            store: new friends_1.FileFriendStore(friendsDir),
+            // The SAME canonical mission store the Slice-4 delegation tools use, so an
+            // inbound `importCoordination` write lands where the read/prepare surface reads.
+            missionStore: (0, delegation_stores_1.delegationStoresFor)(agentRoot).missionStore,
+            pinStore: new pin_store_1.FileA2APinStore(agentRoot),
+            seen: new seen_ledger_1.FileA2ASeenLedger(agentRoot),
+            didResolution: (0, did_resolution_1.makeDidResolution)({ sodium: await (0, a2a_client_1.ready)() }),
+            identity: options.identity,
+        };
+    }
+    // Resolved failure reports are confirmed to the owner once the running version reaches the fix: now, after each
+    // resolution, and on a timer, so a fix that lands with a restart is announced without anyone calling again.
+    const confirmReports = async () => {
+        if (!options.escalation)
+            return;
+        try {
+            await (0, failure_reports_1.confirmResolvedReports)(agentRoot, { ...options.escalation, ...(inboundShareDeps ? { friends: inboundShareDeps.store } : {}) });
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "channels", event: "channel.a2a_escalation_confirm_error", message: "confirming resolved failure reports failed", meta: { agentName: options.agentName, error: error instanceof Error ? error.message : String(error) } });
+        }
+    };
+    let confirmTimer;
+    let publicBaseUrl = options.baseUrl;
+    const server = http.createServer(async (req, res) => {
+        /* v8 ignore next -- Node always supplies url/host for accepted HTTP requests; fallback keeps malformed local calls safe @preserve */
+        const requestUrl = new URL(req.url ?? "/", `http://${req.headers.host ?? `${host}:${port}`}`);
+        /* v8 ignore next -- host fallback is defensive for malformed local requests; publicBaseUrl/default host branches are covered @preserve */
+        const currentBaseUrl = publicBaseUrl ?? `http://${req.headers.host ?? `${host}:${port}`}`;
+        if (req.method === "GET" && (requestUrl.pathname === "/.well-known/agent-card.json" || requestUrl.pathname === "/agent-card.json")) {
+            writeJson(res, 200, (0, card_1.buildA2AAgentCard)({
+                agentName: options.agentName,
+                baseUrl: currentBaseUrl,
+                path: a2aPath,
+                ...(options.identity ? { did: options.identity.did } : {}),
+            }));
+            return;
+        }
+        if (req.method !== "POST" || requestUrl.pathname !== a2aPath) {
+            writeJson(res, 404, { error: "not found" });
+            return;
+        }
+        let rpc;
+        try {
+            const rawBody = await readBody(req);
+            rpc = JSON.parse(rawBody);
+        }
+        catch (error) {
+            if (error instanceof A2ARequestError) {
+                writeJson(res, error.status, errorResponse(null, error.code, error.message));
+                return;
+            }
+            writeJson(res, 400, errorResponse(null, -32700, "invalid JSON"));
+            return;
+        }
+        try {
+            if ((0, outbox_wire_1.isOutboxMethod)(rpc.method)) {
+                // Peer outbox methods: signed and sealed like a chat, access decided here from the verified friend record.
+                const outboxInbound = messageFromParams(rpc.params);
+                if (!outboxInbound || !inboundShareDeps) {
+                    writeJson(res, 200, errorResponse(rpc.id, outbox_wire_1.OUTBOX_ERROR_REFUSED, "outbox calls need a signed message and an A2A identity"));
+                    return;
+                }
+                const bridged = await (0, inbound_share_1.receiveInboundShare)({ ...outboxInbound, kind: outboxInbound.kind ?? "message" }, inboundShareDeps);
+                if (bridged.outcome === "rejected") {
+                    writeJson(res, 200, errorResponse(rpc.id, rejectionErrorCode(bridged.reason), `A2A outbox call rejected: ${bridged.reason}`));
+                    return;
+                }
+                if (bridged.outcome !== "completed" || !bridged.message) {
+                    writeJson(res, 200, errorResponse(rpc.id, outbox_wire_1.OUTBOX_ERROR_REFUSED, "outbox calls must be a signed chat message"));
+                    return;
+                }
+                const command = (0, outbox_wire_1.parseOutboxCommand)(bridged.message.text);
+                if (!command || command.method !== rpc.method) {
+                    writeJson(res, 200, errorResponse(rpc.id, outbox_wire_1.OUTBOX_ERROR_INVALID, "the signed method does not match the requested method"));
+                    return;
+                }
+                const outcome = await (0, outbox_wire_1.handleOutboxCommand)({ agentRoot, friend: bridged.friend, method: command.method, params: command.params, verifiedDid: bridged.verifiedDid });
+                if (!outcome.ok) {
+                    writeJson(res, 200, errorResponse(rpc.id, outcome.code, outcome.message));
+                    return;
+                }
+                if (command.method === "report/resolve")
+                    await confirmReports();
+                /* v8 ignore next -- receiveShare pins the verified sender before it reports a completed message @preserve */
+                const outboxPinned = inboundShareDeps.pinStore.get(bridged.verifiedDid);
+                const contextId = outboxInbound.contextId ?? "default";
+                const reply = (0, sealed_chat_1.sealChatMessage)({
+                    sodium: inboundShareDeps.sodium,
+                    from: options.identity,
+                    recipientDid: bridged.verifiedDid,
+                    recipientEd25519Pub: outboxPinned.ed25519Pub,
+                    text: JSON.stringify(outcome.result),
+                    conversationId: contextId,
+                });
+                writeJson(res, 200, jsonResponse(rpc.id, { kind: "message", role: "ROLE_AGENT", messageId: (0, node_crypto_1.randomUUID)(), contextId, parts: reply.parts }));
+                return;
+            }
+            if (rpc.method === "SendMessage" || rpc.method === "message/send") {
+                const responseStyle = rpc.method === "message/send" ? "legacy" : "latest";
+                const parsedInbound = messageFromParams(rpc.params);
+                const inbound = parsedInbound ? { ...parsedInbound, kind: parsedInbound.kind ?? "message" } : null;
+                // HARNESS-OWNED RESULT WIRE (runs BEFORE the friends-share branch). A
+                // `mission_result`-tagged DataPart is NOT a FriendsKind — it routes to
+                // `importMissionResult` (assignee/correlation-gated, store-only, NO turn), never
+                // to `receiveShare`. Recognized by the `ouroKind` discriminator.
+                if (inbound && inboundShareDeps && (0, mission_result_wire_1.isMissionResultDataPart)(inbound)) {
+                    const imported = await (0, mission_result_wire_1.receiveInboundMissionResult)(inbound, {
+                        sodium: inboundShareDeps.sodium,
+                        store: inboundShareDeps.store,
+                        missionStore: inboundShareDeps.missionStore,
+                        // The SAME authentication seam the share bridge uses — so a forged-sender
+                        // result is rejected by the DidVerifier exactly like a forged share.
+                        pinStore: inboundShareDeps.pinStore,
+                        seen: inboundShareDeps.seen,
+                        didResolution: inboundShareDeps.didResolution,
+                        identity: inboundShareDeps.identity,
+                    });
+                    if (imported.outcome === "rejected") {
+                        writeJson(res, 200, errorResponse(rpc.id, rejectionErrorCode(imported.reason), `A2A result rejected: ${imported.reason}`));
+                        return;
+                    }
+                    // imported (store-only, no turn): acknowledge with a minimal completed task.
+                    /* v8 ignore next -- "not-a-result" is unreachable here (gated by isMissionResultDataPart) @preserve */
+                    const ackText = imported.outcome === "imported"
+                        ? `[a2a] imported mission result from ${imported.verifiedDid}`
+                        /* v8 ignore next -- defensive: the gate above guarantees imported|rejected @preserve */
+                        : "[a2a] mission result";
+                    const contextId = inbound.contextId ?? "default";
+                    const taskId = (0, node_crypto_1.randomUUID)();
+                    const accessToken = (0, node_crypto_1.randomUUID)();
+                    const ackTask = taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_COMPLETED", response: ackText });
+                    taskStore.put(ackTask, accessTokenScope(accessToken));
+                    writeJson(res, 200, jsonResponse(rpc.id, publicTask(ackTask, accessToken, responseStyle, true)));
+                    return;
+                }
+                // Inbound friends-DataPart branch (runs BEFORE the legacy text path). A
+                // sealed DataPart is unwrapped + verified through the bridge; the turn is
+                // then keyed on the VERIFIED sender DID (replacing the unauthenticated
+                // sentinel). A non-friends (text) message falls through unchanged.
+                let verifiedPeerAgentId;
+                let verifiedPeerName;
+                let verifiedShareText;
+                let verifiedChat;
+                if (inbound && inboundShareDeps && messageHasDataPart(inbound)) {
+                    const bridged = await (0, inbound_share_1.receiveInboundShare)(inbound, inboundShareDeps);
+                    if (bridged.outcome === "rejected") {
+                        writeJson(res, 200, errorResponse(rpc.id, rejectionErrorCode(bridged.reason), `A2A share rejected: ${bridged.reason}`));
+                        return;
+                    }
+                    // A message with a data part always resolves to completed|rejected — the
+                    // bridge only returns "not-a-share" when there is NO data part, which the
+                    // `messageHasDataPart` gate above excludes. So this is the completed path.
+                    /* v8 ignore next -- "not-a-share" is unreachable here (gated by messageHasDataPart) @preserve */
+                    if (bridged.outcome === "completed") {
+                        verifiedPeerAgentId = bridged.verifiedDid;
+                        verifiedPeerName = bridged.verifiedDid;
+                        if (bridged.message) {
+                            // Authenticated chat: the signed, sealed text IS the turn.
+                            verifiedShareText = bridged.message.text;
+                            /* v8 ignore next -- a completed chat always has a friend record: an unknown DID reads as stranger and the message is refused @preserve */
+                            verifiedPeerName = bridged.friend?.name ?? bridged.verifiedDid;
+                            verifiedChat = { did: bridged.verifiedDid, friend: bridged.friend, ...(bridged.message.onBehalfOf ? { onBehalfOf: bridged.message.onBehalfOf } : {}) };
+                        }
+                        else {
+                            verifiedShareText = `[a2a] received ${bridged.friendsKind} (${bridged.status}) from ${bridged.verifiedDid}`;
+                        }
+                    }
+                }
+                const text = verifiedShareText ?? textFromMessage(inbound);
+                if (!inbound || !text) {
+                    writeJson(res, 200, errorResponse(rpc.id, -32602, "SendMessage requires a text message"));
+                    return;
+                }
+                if (text.length > MAX_A2A_MESSAGE_TEXT_CHARS) {
+                    writeJson(res, 200, errorResponse(rpc.id, -32602, `SendMessage text exceeds ${MAX_A2A_MESSAGE_TEXT_CHARS} characters`));
+                    return;
+                }
+                const senderHint = senderHintFromMessage(req, inbound);
+                // The verified DID wins as the turn's peer identity; otherwise the legacy
+                // unauthenticated sentinel (text path, behavior-preserved).
+                const peerAgentId = verifiedPeerAgentId ?? untrustedTurnPeerExternalId();
+                const peerName = verifiedPeerName ?? senderHint.name;
+                const continuationToken = accessTokenFromParams(rpc.params);
+                const continuationTask = inbound.taskId && continuationToken
+                    ? taskStore.get(inbound.taskId, accessTokenScope(continuationToken))
+                    : null;
+                if (inbound.taskId && continuationToken && (!continuationTask || !taskAuthorized(continuationTask, continuationToken))) {
+                    writeJson(res, 200, errorResponse(rpc.id, -32001, "task not found"));
+                    return;
+                }
+                if (continuationTask && isTerminalTaskState(continuationTask.status.state)) {
+                    writeJson(res, 200, errorResponse(rpc.id, -32002, "task is terminal; start a new task"));
+                    return;
+                }
+                const contextId = inbound.contextId ?? continuationTask?.contextId ?? "default";
+                const taskId = continuationTask?.id ?? (0, node_crypto_1.randomUUID)();
+                const accessToken = continuationToken && continuationTask ? continuationToken : (0, node_crypto_1.randomUUID)();
+                const tokenScope = accessTokenScope(accessToken);
+                const clientTaskId = continuationTask ? taskA2AMetadata(continuationTask).clientTaskId : inbound.taskId;
+                let relationshipAuthorization = verifiedChat?.friend
+                    ? a2aChatRelationship(agentRoot, verifiedChat.friend, taskId)
+                    : undefined;
+                let turnText = text;
+                let delegatedCommand;
+                // Only the server writes the delegated banner. Any turn that is not about to be admitted as a delegated command
+                // (verified or not, including a plain unauthenticated text turn) gets a typed banner marked as the sender's own words.
+                if (verifiedChat?.onBehalfOf !== "principal")
+                    turnText = (0, delegated_command_1.shieldDelegatedBanner)(text);
+                if (verifiedChat?.onBehalfOf === "principal") {
+                    // A delegated command runs with the principal's authority only after the
+                    // server, never the model, has checked the grant and told the principal.
+                    let registry;
+                    try {
+                        registry = (0, relationship_authorization_1.loadRelationshipCapabilityRegistry)(agentRoot);
+                    }
+                    catch {
+                        registry = undefined;
+                    }
+                    /* v8 ignore next -- a completed chat always carries the sender's friend record (see the receipt above) @preserve */
+                    if (!verifiedChat.friend)
+                        throw new Error("verified chat has no friend record");
+                    const admission = await (0, delegated_command_1.admitDelegatedCommand)({ friend: verifiedChat.friend, did: verifiedChat.did, text, commandId: (0, node_crypto_1.randomUUID)(), store: inboundShareDeps.store, registry, options: options.delegation });
+                    if (!admission.ok) {
+                        // The code and the "delegated command refused: <reason>" prefix stay: the replay gate and older CLIs match them.
+                        // Only an active family peer is told why: anyone else gets no_grant whatever the real reason was (a broken trust file, a key mismatch), which stays in the local log and nerves.
+                        const activeFamily = verifiedChat.friend.trustLevel === "family" && verifiedChat.friend.admissionState === "active";
+                        const shown = activeFamily ? admission.reason : "no_grant";
+                        const guidance = (0, delegated_command_1.delegationRefusalGuidance)(shown, { legacyRecordGrant: activeFamily && verifiedChat.friend.delegationGrant !== undefined });
+                        writeJson(res, 200, errorResponse(rpc.id, -32004, `delegated command refused: ${shown} (${guidance.message}). Nothing ran. Next: ${guidance.next}`, { reason: shown, nothingRan: true, retry: guidance.retry, next: guidance.next }));
+                        return;
+                    }
+                    relationshipAuthorization = admission.relationship;
+                    turnText = admission.turnText;
+                    delegatedCommand = admission.context;
+                }
+                taskStore.put(taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_WORKING", clientTaskId, previousTask: continuationTask ?? undefined }), tokenScope);
+                const turn = await turnRunner({
+                    agentName: options.agentName,
+                    peerAgentId,
+                    peerName,
+                    sessionKey: contextId,
+                    message: turnText,
+                    ...(relationshipAuthorization ? { relationshipAuthorization } : {}),
+                    ...(delegatedCommand ? { delegatedCommand } : {}),
+                });
+                let responseParts;
+                if (verifiedChat) {
+                    // A verified chat's reply is sealed to the sender and stored sealed, so neither
+                    // the wire nor a later GetTask ever carries the plaintext.
+                    const pinned = inboundShareDeps.pinStore.get(verifiedChat.did);
+                    /* v8 ignore next 4 -- receiveShare pins the verified sender before it reports a completed chat; refuse rather than reply in plaintext @preserve */
+                    if (!pinned) {
+                        writeJson(res, 200, errorResponse(rpc.id, -32003, "A2A chat reply cannot be sealed to the sender"));
+                        return;
+                    }
+                    responseParts = (0, sealed_chat_1.sealChatMessage)({
+                        sodium: inboundShareDeps.sodium,
+                        from: options.identity,
+                        recipientDid: verifiedChat.did,
+                        recipientEd25519Pub: pinned.ed25519Pub,
+                        text: turn.response,
+                        conversationId: contextId,
+                    }).parts;
+                }
+                const task = taskFor({ taskId, accessToken, contextId, inbound, state: "TASK_STATE_COMPLETED", response: turn.response, responseParts, clientTaskId, previousTask: continuationTask ?? undefined });
+                taskStore.put(task, tokenScope);
+                writeJson(res, 200, jsonResponse(rpc.id, publicTask(task, accessToken, responseStyle, true)));
+                return;
+            }
+            if (rpc.method === "GetTask" || rpc.method === "tasks/get") {
+                const responseStyle = rpc.method === "tasks/get" ? "legacy" : "latest";
+                const taskId = rpc.params && typeof rpc.params === "object"
+                    ? rpc.params.id
+                    : undefined;
+                if (typeof taskId !== "string" || !taskId.trim()) {
+                    writeJson(res, 200, errorResponse(rpc.id, -32602, "GetTask requires id"));
+                    return;
+                }
+                const accessToken = accessTokenFromParams(rpc.params);
+                if (!accessToken) {
+                    writeJson(res, 200, errorResponse(rpc.id, -32602, "GetTask requires accessToken"));
+                    return;
+                }
+                const task = taskStore.get(taskId, accessTokenScope(accessToken));
+                writeJson(res, 200, task && taskAuthorized(task, accessToken)
+                    ? jsonResponse(rpc.id, publicTask(task, accessToken, responseStyle, false))
+                    : errorResponse(rpc.id, -32001, "task not found"));
+                return;
+            }
+            if (rpc.method === "CancelTask" || rpc.method === "tasks/cancel") {
+                const responseStyle = rpc.method === "tasks/cancel" ? "legacy" : "latest";
+                const taskId = rpc.params && typeof rpc.params === "object"
+                    ? rpc.params.id
+                    : undefined;
+                if (typeof taskId !== "string" || !taskId.trim()) {
+                    writeJson(res, 200, errorResponse(rpc.id, -32602, "CancelTask requires id"));
+                    return;
+                }
+                const accessToken = accessTokenFromParams(rpc.params);
+                if (!accessToken) {
+                    writeJson(res, 200, errorResponse(rpc.id, -32602, "CancelTask requires accessToken"));
+                    return;
+                }
+                const tokenScope = accessTokenScope(accessToken);
+                const task = taskStore.get(taskId, tokenScope);
+                if (!task || !taskAuthorized(task, accessToken)) {
+                    writeJson(res, 200, errorResponse(rpc.id, -32001, "task not found"));
+                    return;
+                }
+                const canceled = {
+                    ...task,
+                    status: { state: "TASK_STATE_CANCELED", timestamp: new Date().toISOString() },
+                };
+                taskStore.put(canceled, tokenScope);
+                writeJson(res, 200, jsonResponse(rpc.id, publicTask(canceled, accessToken, responseStyle, false)));
+                return;
+            }
+            writeJson(res, 200, errorResponse(rpc.id, -32601, `unknown method: ${rpc.method}`));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : /* v8 ignore next -- defensive non-Error throw branch @preserve */ String(error);
+            writeJson(res, 200, errorResponse(rpc.id, -32000, message));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off("listening", onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, host);
+    });
+    const address = server.address();
+    /* v8 ignore next -- server.address() is an address object after successful listen on TCP @preserve */
+    const actualPort = typeof address === "object" && address ? address.port : port;
+    const localBaseUrl = `http://${host}:${actualPort}`;
+    publicBaseUrl = publicBaseUrl ?? localBaseUrl;
+    const endpointUrl = new URL(publicBaseUrl);
+    endpointUrl.pathname = a2aPath;
+    endpointUrl.search = "";
+    endpointUrl.hash = "";
+    if (options.escalation) {
+        await confirmReports();
+        confirmTimer = setInterval(() => { void confirmReports(); }, options.escalation.confirmIntervalMs ?? exports.ESCALATION_CONFIRM_INTERVAL_MS);
+        confirmTimer.unref();
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_server_started",
+        message: "A2A sense server started",
+        meta: { agentName: options.agentName, url: publicBaseUrl, endpoint: endpointUrl.toString() },
+    });
+    return {
+        server,
+        url: publicBaseUrl,
+        endpointUrl: endpointUrl.toString(),
+        close: () => new Promise((resolve, reject) => {
+            if (confirmTimer)
+                clearInterval(confirmTimer);
+            server.close((error) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_server_stopped",
+                    message: "A2A sense server stopped",
+                    meta: { agentName: options.agentName },
+                });
+                resolve();
+            });
+        }),
+    };
+}