@perkos/perkos-a2a 0.9.1 → 0.10.0

package/dist/bridge-agent.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+/**
+ * Standalone PerkOS A2A bridge.
+ *
+ * This is for runtimes that do not load OpenClaw plugins directly, especially
+ * Hermes Workspace. It runs the same A2A HTTP/relay server and delivers inbound
+ * tasks into a local runtime over that runtime's native wake/send API.
+ *
+ * Usage:
+ *   perkos-a2a-agent --config ./a2a.config.json
+ *   A2A_AGENT_NAME=hermes A2A_RUNTIME=hermes-api HERMES_API_URL=http://127.0.0.1:8642 perkos-a2a-agent
+ */
+export {};
+//# sourceMappingURL=bridge-agent.d.ts.map

package/dist/bridge-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-agent.d.ts","sourceRoot":"","sources":["../src/bridge-agent.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG"}

package/dist/bridge-agent.js

@@ -0,0 +1,396 @@
+#!/usr/bin/env node
+/**
+ * Standalone PerkOS A2A bridge.
+ *
+ * This is for runtimes that do not load OpenClaw plugins directly, especially
+ * Hermes Workspace. It runs the same A2A HTTP/relay server and delivers inbound
+ * tasks into a local runtime over that runtime's native wake/send API.
+ *
+ * Usage:
+ *   perkos-a2a-agent --config ./a2a.config.json
+ *   A2A_AGENT_NAME=hermes A2A_RUNTIME=hermes-api HERMES_API_URL=http://127.0.0.1:8642 perkos-a2a-agent
+ */
+import { readFileSync } from "fs";
+import { randomBytes, randomUUID } from "crypto";
+import { createServer as createHttpServer } from "node:http";
+import { A2AServer } from "./server.js";
+import { ChatClient } from "./chat-client.js";
+import { ConvRegistry } from "./conv-registry.js";
+import { startToolsTokenListener } from "./tools-token-listener.js";
+function argValue(flag) {
+    const idx = process.argv.indexOf(flag);
+    if (idx === -1)
+        return undefined;
+    return process.argv[idx + 1];
+}
+function parseJsonEnv(name, fallback) {
+    const raw = process.env[name];
+    if (!raw)
+        return fallback;
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`${name} must be valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+function loadConfig() {
+    const configPath = argValue("--config") || argValue("-c") || process.env.A2A_CONFIG;
+    if (configPath) {
+        return JSON.parse(readFileSync(configPath, "utf8"));
+    }
+    const port = Number(process.env.A2A_PORT || "5050");
+    const relayEnabled = String(process.env.A2A_RELAY_ENABLED || "").toLowerCase() === "true";
+    return {
+        agentName: process.env.A2A_AGENT_NAME || "agent",
+        port,
+        bindHost: process.env.A2A_BIND_HOST || "0.0.0.0",
+        publicUrl: process.env.A2A_PUBLIC_URL,
+        mode: process.env.A2A_MODE || "auto",
+        skills: parseJsonEnv("A2A_SKILLS", []),
+        peers: parseJsonEnv("A2A_PEERS", {}),
+        peerAuth: parseJsonEnv("A2A_PEER_AUTH", {}),
+        auth: process.env.A2A_API_KEYS
+            ? { requireApiKey: true, apiKeys: process.env.A2A_API_KEYS.split(",").map((v) => v.trim()).filter(Boolean) }
+            : undefined,
+        relay: relayEnabled || process.env.A2A_RELAY_URL
+            ? {
+                enabled: relayEnabled || Boolean(process.env.A2A_RELAY_URL),
+                url: process.env.A2A_RELAY_URL || "",
+                apiKey: process.env.A2A_RELAY_API_KEY || "",
+                hubPort: process.env.A2A_RELAY_HUB_PORT ? Number(process.env.A2A_RELAY_HUB_PORT) : undefined,
+                hubApiKeys: process.env.A2A_RELAY_HUB_API_KEYS?.split(",").map((v) => v.trim()).filter(Boolean),
+            }
+            : undefined,
+        runtime: {
+            kind: process.env.A2A_RUNTIME || "hermes",
+            sessionKey: process.env.A2A_SESSION_KEY,
+            hermesUrl: process.env.HERMES_WORKSPACE_URL,
+            hermesToken: process.env.HERMES_WORKSPACE_TOKEN || process.env.HERMES_SESSION_TOKEN,
+            hermesEndpoint: process.env.HERMES_WORKSPACE_ENDPOINT,
+        },
+        chat: process.env.A2A_CHAT_ENABLED?.toLowerCase() === "true"
+            ? {
+                enabled: true,
+                url: process.env.A2A_CHAT_URL || "wss://chat.perkos.xyz/chat",
+                apiKey: process.env.A2A_CHAT_API_KEY || process.env.A2A_RELAY_API_KEY || "",
+                storeRoot: process.env.A2A_CHAT_STORE_ROOT,
+                defaultHistoryLimit: process.env.A2A_CHAT_HISTORY_LIMIT
+                    ? Number(process.env.A2A_CHAT_HISTORY_LIMIT)
+                    : undefined,
+            }
+            : undefined,
+    };
+}
+/** Port the bridge listens on for local Hermes-side chat-reply callbacks. */
+function chatReplyPort() {
+    return Number(process.env.A2A_CHAT_REPLY_PORT || "5060");
+}
+/** Port the bridge listens on for Tools-API JWT mint requests. */
+function toolsTokenPort() {
+    return Number(process.env.A2A_TOOLS_TOKEN_PORT || "5070");
+}
+/**
+ * Bridge-auth secret used by the Tools-API token listener. Read from
+ * env if provided (so multi-process deployments can pre-share it with
+ * the Hermes plugin); otherwise generate a random one and surface it
+ * via an env var the same container can read. This keeps single-host
+ * deployments zero-config.
+ */
+function resolveBridgeAuthSecret() {
+    const fromEnv = process.env.A2A_BRIDGE_AUTH_SECRET?.trim();
+    if (fromEnv && fromEnv.length >= 16)
+        return fromEnv;
+    const generated = randomBytes(24).toString("hex");
+    process.env.A2A_BRIDGE_AUTH_SECRET = generated;
+    return generated;
+}
+function taskMarker(task) {
+    return `[A2A_RESULT:${task.id}]`;
+}
+function buildRuntimeMessage(task, text) {
+    const from = task.metadata?.fromAgent || "unknown";
+    const marker = taskMarker(task);
+    return [
+        marker,
+        `From: ${from}`,
+        `Task ID: ${task.id}`,
+        `Context ID: ${task.contextId}`,
+        "",
+        "Execute the following request and include the final answer in your assistant reply.",
+        `Your final answer must begin with exactly: ${marker}`,
+        "Return the useful final answer after that marker.",
+        "",
+        text,
+    ].join("\n");
+}
+async function deliverToHermes(config, message) {
+    const runtime = config.runtime || {};
+    const baseUrl = (runtime.hermesUrl || process.env.HERMES_API_URL || process.env.HERMES_WORKSPACE_URL || "http://127.0.0.1:8642").replace(/\/+$/, "");
+    const endpoint = runtime.hermesEndpoint || process.env.HERMES_API_ENDPOINT || process.env.HERMES_WORKSPACE_ENDPOINT || "/v1/responses";
+    const sessionKey = runtime.sessionKey || process.env.HERMES_SESSION_ID || process.env.HERMES_SESSION_KEY || "a2a";
+    const token = runtime.hermesToken || process.env.API_SERVER_KEY || process.env.HERMES_API_KEY || process.env.HERMES_WORKSPACE_TOKEN || process.env.HERMES_SESSION_TOKEN;
+    const url = `${baseUrl}${endpoint.startsWith("/") ? endpoint : `/${endpoint}`}`;
+    const headers = {
+        "content-type": "application/json",
+        "x-hermes-session-id": sessionKey,
+        "x-hermes-session-key": sessionKey,
+    };
+    if (token)
+        headers.authorization = `Bearer ${token}`;
+    const normalizedEndpoint = endpoint.replace(/^\/?/, "/");
+    const body = normalizedEndpoint.startsWith("/v1/chat/completions")
+        ? { model: process.env.HERMES_MODEL || "hermes-agent", messages: [{ role: "user", content: message }], stream: false }
+        : normalizedEndpoint.startsWith("/v1/runs")
+            ? { input: message, session_id: sessionKey }
+            : normalizedEndpoint.startsWith("/v1/responses")
+                ? { model: process.env.HERMES_MODEL || "hermes-agent", input: message, store: true }
+                : { sessionKey, message };
+    const response = await fetch(url, { method: "POST", headers, body: JSON.stringify(body) });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Hermes API delivery failed (${response.status}) at ${url}: ${text || response.statusText}`);
+    }
+}
+/** Extract a wallet address from a ChatIdentity ("user:0xabc..." → "0xabc..."). */
+function parseWalletFromIdentity(identity) {
+    if (typeof identity !== "string" || !identity.startsWith("user:"))
+        return null;
+    const addr = identity.slice("user:".length);
+    return addr.startsWith("0x") ? addr.toLowerCase() : null;
+}
+function buildChatMessage(frame) {
+    const walletAddress = parseWalletFromIdentity(frame.from);
+    const marker = `[PERKOS_CHAT:${frame.convId}]`;
+    const toolsApiUrl = process.env.A2A_TOOLS_API_URL?.trim();
+    const toolsTokenEndpoint = `http://127.0.0.1:${toolsTokenPort()}/v1/tools-token`;
+    return [
+        marker,
+        `From: ${frame.from}`,
+        `Conversation: ${frame.convId}`,
+        walletAddress ? `Wallet: ${walletAddress}` : "",
+        "",
+        "A user is messaging this agent in a PerkOS chat conversation.",
+        "To respond, POST to http://127.0.0.1:<A2A_CHAT_REPLY_PORT>/chat/reply with:",
+        `  { "convId": "${frame.convId}", "walletAddress": "${walletAddress ?? ""}", "text": "<your reply>" }`,
+        "",
+        toolsApiUrl
+            ? [
+                "PerkOS Tools API is available for this conversation:",
+                `  - Base URL: ${toolsApiUrl}`,
+                `  - To call a tool, first POST to ${toolsTokenEndpoint} with`,
+                `      { "convId": "${frame.convId}" }`,
+                "    and X-Bridge-Auth: <A2A_BRIDGE_AUTH_SECRET> to mint a short-lived JWT.",
+                "  - Then POST to <toolsApiUrl>/v1/tools/<toolName> with Authorization: Bearer <token>.",
+            ].join("\n")
+            : "",
+        "",
+        "Message body:",
+        frame.text,
+    ].filter(Boolean).join("\n");
+}
+/**
+ * Local-only HTTP listener for Hermes (or any sidecar) to push chat replies
+ * back through the chat client. Bound to 127.0.0.1 — never expose this port
+ * publicly. The chat client holds the relay API key; this gives Hermes a
+ * controlled callback path without leaking the key to the runtime config.
+ *
+ *   POST /chat/reply
+ *     { convId, walletAddress, text, replyTo? }
+ *
+ *   → 200 { id, delivered: boolean }
+ *   → 400 { error: "..." }
+ *   → 503 { error: "chat client not connected" }
+ */
+function startChatReplyListener(chat, port, logger) {
+    const server = createHttpServer(async (req, res) => {
+        if (req.method !== "POST" || req.url !== "/chat/reply") {
+            res.writeHead(404, { "content-type": "application/json" })
+                .end(JSON.stringify({ error: "not found" }));
+            return;
+        }
+        let raw = "";
+        req.setEncoding("utf8");
+        req.on("data", (c) => { raw += c; if (raw.length > 100_000)
+            req.destroy(); });
+        req.on("end", async () => {
+            let body;
+            try {
+                body = JSON.parse(raw);
+            }
+            catch {
+                res.writeHead(400, { "content-type": "application/json" })
+                    .end(JSON.stringify({ error: "invalid JSON" }));
+                return;
+            }
+            if (!body.convId || !body.walletAddress || !body.text) {
+                res.writeHead(400, { "content-type": "application/json" })
+                    .end(JSON.stringify({ error: "missing { convId, walletAddress, text }" }));
+                return;
+            }
+            if (!chat.isConnected()) {
+                res.writeHead(503, { "content-type": "application/json" })
+                    .end(JSON.stringify({ error: "chat client not connected; reply will be appended to local store only" }));
+                // Continue anyway — sendReply still appends to local jsonl.
+            }
+            try {
+                const result = await chat.sendReply({
+                    convId: body.convId,
+                    walletAddress: body.walletAddress,
+                    text: body.text,
+                    replyTo: body.replyTo,
+                });
+                if (!res.headersSent) {
+                    res.writeHead(200, { "content-type": "application/json" })
+                        .end(JSON.stringify(result));
+                }
+                else {
+                    res.end(JSON.stringify(result));
+                }
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                if (!res.headersSent) {
+                    res.writeHead(500, { "content-type": "application/json" })
+                        .end(JSON.stringify({ error: msg }));
+                }
+            }
+        });
+    });
+    server.listen(port, "127.0.0.1", () => {
+        logger.info(`[perkos-chat] local reply listener on http://127.0.0.1:${port}/chat/reply`);
+    });
+    return () => server.close();
+}
+async function main() {
+    const config = loadConfig();
+    const logger = console;
+    const server = new A2AServer(config, logger);
+    server.setTaskResultHandler(async (task, text) => {
+        const runtimeKind = config.runtime?.kind || "hermes";
+        task.status = {
+            state: "working",
+            timestamp: new Date().toISOString(),
+            message: { role: "agent", parts: [{ kind: "text", text: `Task dispatched to ${runtimeKind} runtime.` }] },
+        };
+        if ((runtimeKind === "hermes" || runtimeKind === "hermes-api")) {
+            await deliverToHermes(config, buildRuntimeMessage(task, text));
+            task.artifacts.push({
+                kind: "artifact",
+                artifactId: randomUUID(),
+                parts: [{ kind: "text", text: "Delivered to Hermes API Server." }],
+            });
+            return;
+        }
+        if (runtimeKind === "none") {
+            task.artifacts.push({
+                kind: "artifact",
+                artifactId: randomUUID(),
+                parts: [{ kind: "text", text: "Runtime delivery disabled." }],
+            });
+            return;
+        }
+        throw new Error(`Standalone runtime '${runtimeKind}' is not supported yet. Use OpenClaw plugin mode for OpenClaw delivery.`);
+    });
+    server.setTaskFailureHandler((task, errorText) => {
+        task.status = {
+            state: "failed",
+            timestamp: new Date().toISOString(),
+            message: { role: "agent", parts: [{ kind: "text", text: errorText }] },
+        };
+    });
+    await server.start();
+    logger.info(`[perkos-a2a] standalone bridge running for ${config.agentName} (${config.runtime?.kind || "hermes"})`);
+    // -------------------------------------------------------------------------
+    // Optional: PerkOS-Chat client for user-facing conversations.
+    //
+    // When enabled, inbound chat_deliver frames are forwarded to Hermes via the
+    // same /v1/responses path used for A2A tasks, but with a [PERKOS_CHAT:<id>]
+    // marker and instructions to POST the reply to the local /chat/reply
+    // listener (so the relay API key stays in this bridge).
+    // -------------------------------------------------------------------------
+    let chat = null;
+    let stopChatListener = null;
+    let stopToolsTokenListener = null;
+    const convRegistry = new ConvRegistry();
+    const chatCfg = config.chat;
+    if (chatCfg?.enabled && chatCfg.apiKey) {
+        chat = new ChatClient({
+            agentName: config.agentName,
+            config: chatCfg,
+            handlers: {
+                logger,
+                onChatDeliver: async (frame) => {
+                    try {
+                        const wallet = parseWalletFromIdentity(frame.from);
+                        if (wallet)
+                            convRegistry.touch(frame.convId, wallet, "user");
+                        await deliverToHermes(config, buildChatMessage(frame));
+                    }
+                    catch (err) {
+                        logger.error(`[perkos-chat] hermes delivery failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                },
+                onChannelJoin: async (frame) => {
+                    logger.info(`[perkos-chat] joined conv ${frame.convId} (host: ${frame.historyHost}, ${frame.participants.length} participants)`);
+                },
+            },
+        });
+        chat.start();
+        stopChatListener = startChatReplyListener(chat, chatReplyPort(), logger);
+    }
+    else if (chatCfg?.enabled && !chatCfg.apiKey) {
+        logger.error("[perkos-chat] chat.enabled=true but no apiKey (set A2A_CHAT_API_KEY or A2A_RELAY_API_KEY)");
+    }
+    // Tools-API token listener. Only starts when both env vars are set,
+    // since the runtime plugin can't call the API without them anyway.
+    const toolsJwtSecret = process.env.A2A_TOOLS_JWT_SECRET?.trim();
+    const toolsApiUrl = process.env.A2A_TOOLS_API_URL?.trim();
+    if (toolsJwtSecret && toolsApiUrl) {
+        if (toolsJwtSecret.length < 32) {
+            logger.error("[tools-token] A2A_TOOLS_JWT_SECRET must be >=32 chars; listener disabled");
+        }
+        else {
+            const bridgeAuthSecret = resolveBridgeAuthSecret();
+            const ttl = Number(process.env.A2A_TOOLS_TOKEN_TTL_SECONDS || "60");
+            convRegistry.startReaper();
+            const { stop } = startToolsTokenListener({
+                port: toolsTokenPort(),
+                bridgeAuthSecret,
+                toolsJwtSecret,
+                toolsApiUrl,
+                registry: convRegistry,
+                tokenTtlSeconds: Number.isFinite(ttl) ? ttl : 60,
+                logger: {
+                    info: (m) => logger.info(m),
+                    error: (m) => logger.error(m),
+                },
+            });
+            stopToolsTokenListener = stop;
+            logger.info(`[tools-token] enabled (tools API: ${toolsApiUrl}); plugin must present A2A_BRIDGE_AUTH_SECRET`);
+        }
+    }
+    else if (toolsJwtSecret || toolsApiUrl) {
+        logger.warn?.("[tools-token] partial config — both A2A_TOOLS_JWT_SECRET and A2A_TOOLS_API_URL are required; listener disabled");
+    }
+    const stop = async () => {
+        logger.info("[perkos-a2a] standalone bridge shutting down");
+        chat?.stop();
+        stopChatListener?.();
+        convRegistry.stopReaper();
+        if (stopToolsTokenListener) {
+            try {
+                await stopToolsTokenListener();
+            }
+            catch { /* swallow */ }
+        }
+        process.exit(0);
+    };
+    process.on("SIGINT", () => void stop());
+    process.on("SIGTERM", () => void stop());
+}
+main().catch((err) => {
+    console.error(`[perkos-a2a] standalone bridge failed: ${err instanceof Error ? err.stack || err.message : String(err)}`);
+    process.exit(1);
+});
+//# sourceMappingURL=bridge-agent.js.map

package/dist/bridge-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-agent.js","sourceRoot":"","sources":["../src/bridge-agent.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAIpE,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAI,IAAY,EAAE,QAAW;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACpF,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAoB,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IAC1F,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO;QAChD,IAAI;QACJ,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS;QAChD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QACrC,IAAI,EAAG,OAAO,CAAC,GAAG,CAAC,QAAoC,IAAI,MAAM;QACjE,MAAM,EAAE,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;QACtC,KAAK,EAAE,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACpC,QAAQ,EAAE,YAAY,CAAC,eAAe,EAAE,EAAE,CAAC;QAC3C,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;YAC5B,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAC5G,CAAC,CAAC,SAAS;QACb,KAAK,EAAE,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;YAC9C,CAAC,CAAC;gBACE,OAAO,EAAE,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC3D,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;gBACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;gBAC3C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC5F,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;aAChG;YACH,CAAC,CAAC,SAAS;QACb,OAAO,EAAE;YACP,IAAI,EAAG,OAAO,CAAC,GAAG,CAAC,WAA6G,IAAI,QAAQ;YAC5I,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;YACvC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC3C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;YACnF,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;SACtD;QACD,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,KAAK,MAAM;YAC1D,CAAC,CAAC;gBACE,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,4BAA4B;gBAC7D,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;gBAC3E,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;gBAC1C,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;oBACrD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;oBAC5C,CAAC,CAAC,SAAS;aACd;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa;IACpB,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,kEAAkE;AAClE,SAAS,cAAc;IACrB,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,OAAO,eAAe,IAAI,CAAC,EAAE,GAAG,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAU,EAAE,IAAY;IACnD,MAAM,IAAI,GAAI,IAAI,CAAC,QAAQ,EAAE,SAAoB,IAAI,SAAS,CAAC;IAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,MAAM;QACN,SAAS,IAAI,EAAE;QACf,YAAY,IAAI,CAAC,EAAE,EAAE;QACrB,eAAe,IAAI,CAAC,SAAS,EAAE;QAC/B,EAAE;QACF,qFAAqF;QACrF,8CAA8C,MAAM,EAAE;QACtD,mDAAmD;QACnD,EAAE;QACF,IAAI;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAuB,EAAE,OAAe;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrJ,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,eAAe,CAAC;IACvI,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAClH,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACxK,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,EAAE,CAAC;IAChF,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,qBAAqB,EAAE,UAAU;QACjC,sBAAsB,EAAE,UAAU;KACnC,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;IAErD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAChE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACtH,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC;YACzC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE;YAC5C,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,eAAe,CAAC;gBAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;gBACpF,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiD;IACzE,MAAM,aAAa,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,gBAAgB,KAAK,CAAC,MAAM,GAAG,CAAC;IAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,kBAAkB,GAAG,oBAAoB,cAAc,EAAE,iBAAiB,CAAC;IACjF,OAAO;QACL,MAAM;QACN,SAAS,KAAK,CAAC,IAAI,EAAE;QACrB,iBAAiB,KAAK,CAAC,MAAM,EAAE;QAC/B,aAAa,CAAC,CAAC,CAAC,WAAW,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE;QAC/C,EAAE;QACF,+DAA+D;QAC/D,6EAA6E;QAC7E,kBAAkB,KAAK,CAAC,MAAM,wBAAwB,aAAa,IAAI,EAAE,6BAA6B;QACtG,EAAE;QACF,WAAW;YACT,CAAC,CAAC;gBACE,sDAAsD;gBACtD,iBAAiB,WAAW,EAAE;gBAC9B,qCAAqC,kBAAkB,OAAO;gBAC9D,sBAAsB,KAAK,CAAC,MAAM,KAAK;gBACvC,4EAA4E;gBAC5E,wFAAwF;aACzF,CAAC,IAAI,CAAC,IAAI,CAAC;YACd,CAAC,CAAC,EAAE;QACN,EAAE;QACF,eAAe;QACf,KAAK,CAAC,IAAI;KACX,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAAC,IAAgB,EAAE,IAAY,EAAE,MAAe;IAC7E,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,aAAa,EAAE,CAAC;YACvD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;iBACvD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,OAAO;YAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACvB,IAAI,IAAkF,CAAC;YACvF,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;qBACvD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;qBACvD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;qBACvD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uEAAuE,EAAE,CAAC,CAAC,CAAC;gBAC3G,4DAA4D;YAC9D,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;oBAClC,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;yBACvD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;yBACvD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,IAAI,CAAC,0DAA0D,IAAI,aAAa,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7C,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,QAAQ,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,WAAW,WAAW,EAAE,CAAC,EAAE;SAC1G,CAAC;QAEF,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,YAAY,CAAC,EAAE,CAAC;YAC/D,MAAM,eAAe,CAAC,MAAM,EAAE,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,UAAU,EAAE;gBACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC;aACnE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,UAAU,EAAE;gBACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,uBAAuB,WAAW,yEAAyE,CAAC,CAAC;IAC/H,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;QAC/C,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;SACvE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,MAAM,CAAC,IAAI,CAAC,8CAA8C,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEpH,4EAA4E;IAC5E,8DAA8D;IAC9D,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,qEAAqE;IACrE,wDAAwD;IACxD,4EAA4E;IAE5E,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,IAAI,gBAAgB,GAAwB,IAAI,CAAC;IACjD,IAAI,sBAAsB,GAAiC,IAAI,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;IAExC,MAAM,OAAO,GAA2B,MAAM,CAAC,IAAI,CAAC;IACpD,IAAI,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,UAAU,CAAC;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE;gBACR,MAAM;gBACN,aAAa,EAAE,KAAK,EAAE,KAAiD,EAAE,EAAE;oBACzE,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACnD,IAAI,MAAM;4BAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;wBAC7D,MAAM,eAAe,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,KAAK,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC5G,CAAC;gBACH,CAAC;gBACD,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;oBAC7B,MAAM,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,YAAY,CAAC,MAAM,gBAAgB,CAAC,CAAC;gBACnI,CAAC;aACF;SACF,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,gBAAgB,GAAG,sBAAsB,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;SAAM,IAAI,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC5G,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,CACV,0EAA0E,CAC3E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,GAAG,uBAAuB,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC,CAAC;YACpE,YAAY,CAAC,WAAW,EAAE,CAAC;YAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;gBACvC,IAAI,EAAE,cAAc,EAAE;gBACtB,gBAAgB;gBAChB,cAAc;gBACd,WAAW;gBACX,QAAQ,EAAE,YAAY;gBACtB,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBAChD,MAAM,EAAE;oBACN,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC3B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;iBAC9B;aACF,CAAC,CAAC;YACH,sBAAsB,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,qCAAqC,WAAW,+CAA+C,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,EAAE,CACX,gHAAgH,CACjH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC5D,IAAI,EAAE,IAAI,EAAE,CAAC;QACb,gBAAgB,EAAE,EAAE,CAAC;QACrB,YAAY,CAAC,UAAU,EAAE,CAAC;QAC1B,IAAI,sBAAsB,EAAE,CAAC;YAC3B,IAAI,CAAC;gBAAC,MAAM,sBAAsB,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,0CAA0C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/conv-registry.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Tracks active chat conversations the bridge is currently relaying.
+ *
+ * Used by `tools-token-listener` to authorize Tools-API token mints:
+ * the listener will only mint a token for a convId that the bridge has
+ * seen a chat_deliver for in the last `staleAfterMs` window. This binds
+ * the wallet to the conv server-side — the runtime cannot ask for a
+ * token for a wallet that isn't its current caller.
+ */
+export type Role = "user" | "admin";
+export type ConvEntry = {
+    wallet: string;
+    role: Role;
+    lastSeen: number;
+};
+export declare class ConvRegistry {
+    private readonly map;
+    private readonly staleAfterMs;
+    private reaper;
+    constructor(opts?: {
+        staleAfterMs?: number;
+    });
+    /** Record that the bridge is currently handling a chat for this wallet/conv. */
+    touch(convId: string, wallet: string, role?: Role): void;
+    /** Lookup — returns undefined if the conv is unknown or stale. */
+    get(convId: string): ConvEntry | undefined;
+    size(): number;
+    startReaper(intervalMs?: number): void;
+    stopReaper(): void;
+    private sweep;
+}
+//# sourceMappingURL=conv-registry.d.ts.map

package/dist/conv-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conv-registry.d.ts","sourceRoot":"","sources":["../src/conv-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpC,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgC;IACpD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,MAAM,CAA+B;gBAEjC,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO;IAIhD,gFAAgF;IAChF,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,IAAa,GAAG,IAAI;IAIhE,kEAAkE;IAClE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAU1C,IAAI,IAAI,MAAM;IAId,WAAW,CAAC,UAAU,SAAS,GAAG,IAAI;IAOtC,UAAU,IAAI,IAAI;IAOlB,OAAO,CAAC,KAAK;CAMd"}

package/dist/conv-registry.js

@@ -0,0 +1,56 @@
+/**
+ * Tracks active chat conversations the bridge is currently relaying.
+ *
+ * Used by `tools-token-listener` to authorize Tools-API token mints:
+ * the listener will only mint a token for a convId that the bridge has
+ * seen a chat_deliver for in the last `staleAfterMs` window. This binds
+ * the wallet to the conv server-side — the runtime cannot ask for a
+ * token for a wallet that isn't its current caller.
+ */
+export class ConvRegistry {
+    map = new Map();
+    staleAfterMs;
+    reaper = null;
+    constructor(opts = {}) {
+        this.staleAfterMs = opts.staleAfterMs ?? 10 * 60 * 1000;
+    }
+    /** Record that the bridge is currently handling a chat for this wallet/conv. */
+    touch(convId, wallet, role = "user") {
+        this.map.set(convId, { wallet: wallet.toLowerCase(), role, lastSeen: Date.now() });
+    }
+    /** Lookup — returns undefined if the conv is unknown or stale. */
+    get(convId) {
+        const entry = this.map.get(convId);
+        if (!entry)
+            return undefined;
+        if (Date.now() - entry.lastSeen > this.staleAfterMs) {
+            this.map.delete(convId);
+            return undefined;
+        }
+        return entry;
+    }
+    size() {
+        return this.map.size;
+    }
+    startReaper(intervalMs = 60_000) {
+        if (this.reaper)
+            return;
+        this.reaper = setInterval(() => this.sweep(), intervalMs);
+        // Reaper is a maintenance task; don't keep the event loop alive for it.
+        this.reaper.unref?.();
+    }
+    stopReaper() {
+        if (this.reaper) {
+            clearInterval(this.reaper);
+            this.reaper = null;
+        }
+    }
+    sweep() {
+        const cutoff = Date.now() - this.staleAfterMs;
+        for (const [convId, entry] of this.map) {
+            if (entry.lastSeen < cutoff)
+                this.map.delete(convId);
+        }
+    }
+}
+//# sourceMappingURL=conv-registry.js.map

package/dist/conv-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conv-registry.js","sourceRoot":"","sources":["../src/conv-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,MAAM,OAAO,YAAY;IACN,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACnC,YAAY,CAAS;IAC9B,MAAM,GAA0B,IAAI,CAAC;IAE7C,YAAY,OAAkC,EAAE;QAC9C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC1D,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,MAAc,EAAE,MAAc,EAAE,OAAa,MAAM;QACvD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,kEAAkE;IAClE,GAAG,CAAC,MAAc;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,WAAW,CAAC,UAAU,GAAG,MAAM;QAC7B,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;QAC1D,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACxB,CAAC;IAED,UAAU;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAEO,KAAK;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;QAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,QAAQ,GAAG,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF"}

package/dist/tools-jwt.d.ts

@@ -0,0 +1,12 @@
+export type ToolsClaims = {
+    wallet: string;
+    convId: string;
+    role: "user" | "admin";
+    requestId: string;
+};
+export declare function signToolsToken(claims: ToolsClaims, secret: string, ttlSeconds?: number): {
+    token: string;
+    iat: number;
+    exp: number;
+};
+//# sourceMappingURL=tools-jwt.d.ts.map

package/dist/tools-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-jwt.d.ts","sourceRoot":"","sources":["../src/tools-jwt.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AASF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,UAAU,SAAK,GACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAY7C"}

package/dist/tools-jwt.js

@@ -0,0 +1,33 @@
+/**
+ * Mint HS256 JWTs the PerkOS-Platform-Tools-API will accept.
+ *
+ * The token shape MUST match what the Tools API verifier expects in
+ * `src/auth/jwt.ts` over there:
+ *
+ *   { wallet: "0x...", convId: "assistant-0x...", role: "user"|"admin",
+ *     requestId: "uuid", iat: <epoch>, exp: <iat + ttl> }
+ *
+ * The shared secret is set via env (A2A_TOOLS_JWT_SECRET) and never
+ * leaves this process — the bridge is the only entity that holds it.
+ * Hermes runtimes ask this bridge for a fresh token via the local
+ * listener (see tools-token-listener.ts).
+ */
+import { createHmac } from "node:crypto";
+function b64url(buf) {
+    return buf.toString("base64")
+        .replace(/=+$/, "")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_");
+}
+export function signToolsToken(claims, secret, ttlSeconds = 60) {
+    if (!secret || secret.length < 32) {
+        throw new Error("signToolsToken: secret too short (need >=32 chars)");
+    }
+    const iat = Math.floor(Date.now() / 1000);
+    const exp = iat + Math.max(1, Math.min(ttlSeconds, 600));
+    const header = b64url(Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })));
+    const payload = b64url(Buffer.from(JSON.stringify({ ...claims, iat, exp })));
+    const signature = b64url(createHmac("sha256", secret).update(`${header}.${payload}`).digest());
+    return { token: `${header}.${payload}.${signature}`, iat, exp };
+}
+//# sourceMappingURL=tools-jwt.js.map

package/dist/tools-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-jwt.js","sourceRoot":"","sources":["../src/tools-jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC1B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAmB,EACnB,MAAc,EACd,UAAU,GAAG,EAAE;IAEf,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,CACtB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CACrE,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,OAAO,IAAI,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAClE,CAAC"}

package/dist/tools-token-listener.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Local HTTP listener that mints Tools-API JWTs for the active runtime.
+ *
+ *   POST /v1/tools-token
+ *     headers: X-Bridge-Auth: <shared secret with runtime plugin>
+ *     body:    { convId: string, requestId?: string }
+ *     → 200   { token, exp, toolsApiUrl }
+ *     → 400   { error: "..." }                  (bad body)
+ *     → 401   { error: "..." }                  (bad/missing bridge auth)
+ *     → 404   { error: "unknown or stale conv" } (conv not in registry)
+ *
+ *   GET /healthz → 200 { ok: true, conv_count }
+ *
+ * Binds 127.0.0.1 only. The bridge is the only entity that knows
+ * A2A_TOOLS_JWT_SECRET — Hermes never sees it; it just receives short
+ * derived tokens.
+ *
+ * Authorization model — three layers of defense:
+ *   1. Network: listener is bound to 127.0.0.1, so only same-host
+ *      processes can reach it.
+ *   2. Bridge-auth: caller must present X-Bridge-Auth matching the
+ *      bridge's startup secret. This stops other processes on the
+ *      same host (e.g. neighboring containers if 127.0.0.1 is shared)
+ *      from minting tokens.
+ *   3. Conv binding: the listener only mints for convIds the bridge
+ *      is currently handling (touched via chat_deliver in last 10m).
+ *      Even with valid auth, the runtime can't mint a token for a
+ *      wallet that isn't the active caller.
+ */
+import { type Server } from "node:http";
+import { ConvRegistry } from "./conv-registry.js";
+export type ToolsTokenListenerOptions = {
+    port: number;
+    bridgeAuthSecret: string;
+    toolsJwtSecret: string;
+    toolsApiUrl: string;
+    registry: ConvRegistry;
+    /** TTL of minted tokens, in seconds. Default 60. */
+    tokenTtlSeconds?: number;
+    logger?: {
+        info: (msg: string) => void;
+        error: (msg: string) => void;
+        warn?: (msg: string) => void;
+    };
+};
+export declare function startToolsTokenListener(opts: ToolsTokenListenerOptions): {
+    server: Server;
+    stop: () => Promise<void>;
+};
+//# sourceMappingURL=tools-token-listener.d.ts.map

package/dist/tools-token-listener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-token-listener.d.ts","sourceRoot":"","sources":["../src/tools-token-listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAGjG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACtG,CAAC;AAwCF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,yBAAyB,GAAG;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B,CAwEA"}

package/dist/tools-token-listener.js

@@ -0,0 +1,128 @@
+/**
+ * Local HTTP listener that mints Tools-API JWTs for the active runtime.
+ *
+ *   POST /v1/tools-token
+ *     headers: X-Bridge-Auth: <shared secret with runtime plugin>
+ *     body:    { convId: string, requestId?: string }
+ *     → 200   { token, exp, toolsApiUrl }
+ *     → 400   { error: "..." }                  (bad body)
+ *     → 401   { error: "..." }                  (bad/missing bridge auth)
+ *     → 404   { error: "unknown or stale conv" } (conv not in registry)
+ *
+ *   GET /healthz → 200 { ok: true, conv_count }
+ *
+ * Binds 127.0.0.1 only. The bridge is the only entity that knows
+ * A2A_TOOLS_JWT_SECRET — Hermes never sees it; it just receives short
+ * derived tokens.
+ *
+ * Authorization model — three layers of defense:
+ *   1. Network: listener is bound to 127.0.0.1, so only same-host
+ *      processes can reach it.
+ *   2. Bridge-auth: caller must present X-Bridge-Auth matching the
+ *      bridge's startup secret. This stops other processes on the
+ *      same host (e.g. neighboring containers if 127.0.0.1 is shared)
+ *      from minting tokens.
+ *   3. Conv binding: the listener only mints for convIds the bridge
+ *      is currently handling (touched via chat_deliver in last 10m).
+ *      Even with valid auth, the runtime can't mint a token for a
+ *      wallet that isn't the active caller.
+ */
+import { createServer } from "node:http";
+import { timingSafeEqual, randomUUID } from "node:crypto";
+import { signToolsToken } from "./tools-jwt.js";
+function constantTimeEqual(a, b) {
+    // Both inputs may differ in length; pad to the same length to keep
+    // the comparison length-stable, then bail on length mismatch.
+    if (a.length !== b.length) {
+        // Still do a dummy compare to avoid early-exit timing signal.
+        const pad = Buffer.alloc(Math.max(a.length, b.length, 1), 0);
+        timingSafeEqual(pad, pad);
+        return false;
+    }
+    return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
+async function readBody(req, maxBytes = 8192) {
+    return new Promise((resolve, reject) => {
+        let raw = "";
+        req.setEncoding("utf8");
+        req.on("data", (chunk) => {
+            raw += chunk;
+            if (raw.length > maxBytes) {
+                req.destroy(new Error("body too large"));
+                reject(new Error("body too large"));
+            }
+        });
+        req.on("end", () => resolve(raw));
+        req.on("error", reject);
+    });
+}
+function sendJson(res, code, body) {
+    if (res.headersSent) {
+        res.end(JSON.stringify(body));
+        return;
+    }
+    res
+        .writeHead(code, { "content-type": "application/json" })
+        .end(JSON.stringify(body));
+}
+export function startToolsTokenListener(opts) {
+    const logger = opts.logger ?? console;
+    const ttl = opts.tokenTtlSeconds ?? 60;
+    const server = createServer(async (req, res) => {
+        try {
+            if (req.method === "GET" && req.url === "/healthz") {
+                sendJson(res, 200, { ok: true, conv_count: opts.registry.size() });
+                return;
+            }
+            if (req.method !== "POST" || req.url !== "/v1/tools-token") {
+                sendJson(res, 404, { error: "not found" });
+                return;
+            }
+            const presented = req.headers["x-bridge-auth"];
+            const authHeader = Array.isArray(presented) ? presented[0] : presented;
+            if (!authHeader || !constantTimeEqual(authHeader, opts.bridgeAuthSecret)) {
+                sendJson(res, 401, { error: "bridge auth missing or invalid" });
+                return;
+            }
+            let body;
+            try {
+                body = JSON.parse((await readBody(req)) || "{}");
+            }
+            catch {
+                sendJson(res, 400, { error: "invalid JSON" });
+                return;
+            }
+            if (!body.convId || typeof body.convId !== "string") {
+                sendJson(res, 400, { error: "missing convId" });
+                return;
+            }
+            const entry = opts.registry.get(body.convId);
+            if (!entry) {
+                sendJson(res, 404, { error: "unknown or stale conv" });
+                return;
+            }
+            const { token, exp } = signToolsToken({
+                wallet: entry.wallet,
+                convId: body.convId,
+                role: entry.role,
+                requestId: body.requestId ?? randomUUID(),
+            }, opts.toolsJwtSecret, ttl);
+            sendJson(res, 200, { token, exp, toolsApiUrl: opts.toolsApiUrl });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            logger.error(`[tools-token] ${msg}`);
+            sendJson(res, 500, { error: "internal" });
+        }
+    });
+    server.listen(opts.port, "127.0.0.1", () => {
+        logger.info(`[tools-token] listener on http://127.0.0.1:${opts.port}/v1/tools-token (TTL ${ttl}s)`);
+    });
+    const stop = async () => {
+        await new Promise((resolve, reject) => {
+            server.close((err) => (err ? reject(err) : resolve()));
+        });
+    };
+    return { server, stop };
+}
+//# sourceMappingURL=tools-token-listener.js.map

package/dist/tools-token-listener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools-token-listener.js","sourceRoot":"","sources":["../src/tools-token-listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAahD,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,mEAAmE;IACnE,8DAA8D;IAC9D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,QAAQ,GAAG,IAAI;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACvB,GAAG,IAAI,KAAK,CAAC;YACb,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;gBAC1B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACzC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAY;IAC/D,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,GAAG;SACA,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;SACvD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAA+B;IAIrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IAEvC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;gBAC3D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YAED,IAAI,IAA6C,CAAC;YAClD,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,cAAc,CACnC;gBACE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE;aAC1C,EACD,IAAI,CAAC,cAAc,EACnB,GAAG,CACJ,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;YACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,IAAI,CACT,8CAA8C,IAAI,CAAC,IAAI,wBAAwB,GAAG,IAAI,CACvF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@perkos/perkos-a2a",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "A2A Protocol communication plugin for OpenClaw — Agent-to-Agent protocol implementation",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
     "perkos-a2a-agent": "./dist/agent.js",
-    "perkos-a2a-hermes": "./dist/hermes-cli.js"
+    "perkos-a2a-hermes": "./dist/hermes-cli.js",
+    "perkos-a2a-bridge": "./dist/bridge-agent.js"
   },
   "exports": {
     ".": {
@@ -39,7 +40,9 @@
   "scripts": {
     "build": "tsc && node scripts/bundle.mjs",
     "dev": "tsc --watch",
-    "lint": "tsc --noEmit"
+    "lint": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "openclaw": {
     "extensions": [
@@ -76,7 +79,8 @@
     "@types/node": "^22.19.19",
     "@types/ws": "^8.5.0",
     "esbuild": "^0.28.0",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "vitest": "^3.2.4"
   },
   "peerDependencies": {
     "openclaw": ">=2026.3.0"