@ryubyte/dsh-a2a 0.2.1 → 0.3.0

package/lib/client.js

@@ -199,6 +199,11 @@ window.__ModuleLoader__.load({
 		.a2a-auth-state[data-on='false'] { color: var(--dsw-alias-label-tertiary, #81858c); }
 		.a2a-auth-input-row { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
 		.a2a-auth-input-row .a2a-input { flex: 1; min-width: 220px; }
+		.a2a-cors-list { display: flex; flex-wrap: wrap; gap: 6px; }
+		.a2a-cors-chip { display: inline-flex; align-items: center; gap: 6px; font-size: 12px; font-family: var(--ds-font-family-code, ui-monospace, monospace); padding: 2px 6px 2px 8px; border-radius: var(--dsw-radius-sm, 6px); background: var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.05)); border: .5px solid var(--dsw-alias-border-l3, #d0d3d9); color: var(--dsw-alias-label-secondary, #4a4f57); }
+		.a2a-cors-chip-x { border: none; background: none; cursor: pointer; font-size: 14px; line-height: 1; padding: 0 2px; color: var(--dsw-alias-label-tertiary, #81858c); }
+		.a2a-cors-chip-x:hover:not(:disabled) { color: var(--dsw-alias-state-error-primary, #f04438); }
+		.a2a-cors-chip-x:disabled { cursor: default; opacity: .4; }
 
 		/* ---- inbound table ---- */
 		.a2a-table-wrap { overflow-x: auto; border: 1px solid var(--dsw-alias-border-l1, rgba(127,127,127,.12)); border-radius: 10px; }
@@ -303,21 +308,13 @@ window.__ModuleLoader__.load({
 				const dispose = injectDashboardStyles();
 				return () => dispose();
 			}, "dsh-a2a: dashboard styles");
-			ctx.effect(() => {
-				try {
-					const off = ctx.slots.register({
-						name: "settings.section",
-						id: "a2a",
-						order: 90,
-						label: () => "A2A 连接",
-						inject: () => ({})
-					}, DashboardSection);
-					return () => off();
-				} catch (err) {
-					console.error("[dsh-a2a] failed to register settings section:", err);
-					return () => {};
-				}
-			}, "dsh-a2a: settings section");
+			ctx.effect(() => ctx.slots.inject("settings.section", () => ctx.slots.register({
+				name: "settings.section",
+				id: "a2a",
+				order: 90,
+				label: () => "A2A 连接",
+				inject: () => ({})
+			}, DashboardSection)), "dsh-a2a: settings section");
 		}
 		async function fetchSnapshot() {
 			const res = await fetch("/a2a/api", { headers: { accept: "application/json" } });
@@ -390,6 +387,8 @@ window.__ModuleLoader__.load({
 			const [addToken, setAddToken] = (0, react.useState)("");
 			/** Inbound authToken input (serve tab); empty string means "clear". */
 			const [authInput, setAuthInput] = (0, react.useState)("");
+			/** New-origin input for the inbound CORS allowlist editor (serve tab). */
+			const [corsInput, setCorsInput] = (0, react.useState)("");
 			/** Serve-identity edit mode + form draft (server tab). All hooks stay at the
 			* top level in fixed order; a single shared draft avoids per-card hooks. */
 			const [editingServe, setEditingServe] = (0, react.useState)(false);
@@ -541,7 +540,7 @@ window.__ModuleLoader__.load({
 			})), (0, react.createElement)("div", { className: "a2a-hint" }, "若远程 Agent 需要鉴权,填入 token;导入与后续调用都会带上。token 会明文存入 a2a.json。"), discovering ? (0, react.createElement)("div", { className: "a2a-hint" }, "正在读取 Agent Card…") : discovered ? (0, react.createElement)("div", { className: "a2a-preview" }, (0, react.createElement)("div", { className: "a2a-preview-head" }, (0, react.createElement)("span", { className: "a2a-preview-name" }, discovered.name), discovered.version ? (0, react.createElement)("span", { className: "a2a-preview-version a2a-mono" }, `v${discovered.version}`) : null, stateDot("connected")), discovered.description ? (0, react.createElement)("div", { className: "a2a-preview-desc" }, discovered.description) : null, (discovered.skills?.length ?? 0) > 0 ? (0, react.createElement)("div", { className: "a2a-skill-list" }, (0, react.createElement)("div", { className: "a2a-skill-list-title" }, "Skills"), ...(discovered.skills ?? []).map((s) => (0, react.createElement)("div", { key: s.id }, `• ${s.name}${s.description ? ` — ${s.description}` : ""}`))) : null, discovered.endpoint ? (0, react.createElement)("div", { className: "a2a-preview-meta a2a-mono" }, `端点 ${discovered.endpoint}`) : null, (0, react.createElement)("div", { className: "a2a-btn-row" }, actionBtn("连接", true, () => void doConnect(), busy?.startsWith("add-agent:") ?? false), actionBtn("取消", false, () => {
 				setDiscovered(null);
 				setAddUrl("");
-			}, false))) : (0, react.createElement)("div", { className: "a2a-hint" }, "输入远程 Agent 的 Agent Card URL 并点击\"导入\"，将自动读取其名称、描述、技能与能力，确认后建立连接。"))) : null, tab === "server" ? (0, react.createElement)("div", { className: "a2a-stack" }, serve ? editingServe ? serveEditPanel(serveDraft, setServeDraft, (also) => void saveServeIdentity(also), () => setEditingServe(false), busy, false) : needsServeSetup(serve) ? serveEditPanel(serveDraft, setServeDraft, (also) => void saveServeIdentity(also), () => setEditingServe(false), busy, true) : serveViewPanel(serve, busy, act, authInput, setAuthInput, startEditServe) : null, (0, react.createElement)("div", { className: "a2a-crew" }, sec("入站连接（谁在连接本 DSH）", inbound.length), inbound.length === 0 ? emptyRow("暂无入站连接。其他 A2A 客户端调用本 DSH 的 JSON-RPC 端点后会显示在这里。") : (0, react.createElement)("div", { className: "a2a-table-wrap" }, (0, react.createElement)("table", { className: "a2a-table" }, (0, react.createElement)("thead", null, headRow([
+			}, false))) : (0, react.createElement)("div", { className: "a2a-hint" }, "输入远程 Agent 的 Agent Card URL 并点击\"导入\"，将自动读取其名称、描述、技能与能力，确认后建立连接。"))) : null, tab === "server" ? (0, react.createElement)("div", { className: "a2a-stack" }, serve ? editingServe ? serveEditPanel(serveDraft, setServeDraft, (also) => void saveServeIdentity(also), () => setEditingServe(false), busy, false) : needsServeSetup(serve) ? serveEditPanel(serveDraft, setServeDraft, (also) => void saveServeIdentity(also), () => setEditingServe(false), busy, true) : serveViewPanel(serve, busy, act, authInput, setAuthInput, corsInput, setCorsInput, startEditServe) : null, (0, react.createElement)("div", { className: "a2a-crew" }, sec("入站连接（谁在连接本 DSH）", inbound.length), inbound.length === 0 ? emptyRow("暂无入站连接。其他 A2A 客户端调用本 DSH 的 JSON-RPC 端点后会显示在这里。") : (0, react.createElement)("div", { className: "a2a-table-wrap" }, (0, react.createElement)("table", { className: "a2a-table" }, (0, react.createElement)("thead", null, headRow([
 				"来源",
 				"地址",
 				"首次连接",
@@ -722,7 +721,7 @@ window.__ModuleLoader__.load({
 		* "编辑" button that flips the section into {@link serveEditPanel}. Pure (no
 		* hooks): the edit-mode flag and draft live in the parent section.
 		*/
-		function serveViewPanel(serve, busy, act, authInput, setAuthInput, onEdit) {
+		function serveViewPanel(serve, busy, act, authInput, setAuthInput, corsInput, setCorsInput, onEdit) {
 			return (0, react.createElement)("div", { className: "a2a-panel" }, (0, react.createElement)("div", { className: "a2a-serve-head" }, sec("A2A 服务（本 DSH 作为 Agent 对外）", 0), stateDot(serve.enabled ? "connected" : "disconnected"), (0, react.createElement)("span", {
 				className: "a2a-serve-status",
 				"data-on": String(serve.enabled)
@@ -732,7 +731,7 @@ window.__ModuleLoader__.load({
 			})) : null, serve.agentCardUrl ? (0, react.createElement)("div", { className: "a2a-meta-row" }, (0, react.createElement)("span", { className: "a2a-meta-key" }, "Agent Card"), (0, react.createElement)("span", { className: "a2a-serve-endpoint a2a-mono" }, serve.agentCardUrl), (0, react.createElement)(CopyButton, {
 				text: serve.agentCardUrl,
 				label: "Agent Card URL"
-			})) : null, (serve.skills?.length ?? 0) > 0 ? (0, react.createElement)("div", { className: "a2a-skill-list" }, (0, react.createElement)("div", { className: "a2a-skill-list-title" }, "Skills"), ...(serve.skills ?? []).map((s) => (0, react.createElement)("div", { key: s.id }, `• ${s.name}${s.description ? ` — ${s.description}` : ""}`))) : null), serve.enabled ? executorNote(serve) : null, serve.enabled ? authControl(serve, busy, act, authInput, setAuthInput) : null);
+			})) : null, (serve.skills?.length ?? 0) > 0 ? (0, react.createElement)("div", { className: "a2a-skill-list" }, (0, react.createElement)("div", { className: "a2a-skill-list-title" }, "Skills"), ...(serve.skills ?? []).map((s) => (0, react.createElement)("div", { key: s.id }, `• ${s.name}${s.description ? ` — ${s.description}` : ""}`))) : null), serve.enabled ? executorNote(serve) : null, serve.enabled ? authControl(serve, busy, act, authInput, setAuthInput) : null, serve.enabled ? corsControl(serve, busy, act, corsInput, setCorsInput) : null);
 		}
 		/**
 		* Serve-identity edit form (also the guided-setup card for fresh installs).
@@ -814,6 +813,52 @@ window.__ModuleLoader__.load({
 				setAuthInput("");
 			}, busy === "set-server-auth:") : null), (0, react.createElement)("div", { className: "a2a-hint" }, "token 会明文存入 a2a.json,重启后仍生效。设置后,入站 JSON-RPC 请求需带 Authorization: Bearer <token>。"));
 		}
+		/**
+		* Inbound CORS allowlist control for the serve tab: shows the allowed browser
+		* origins and lets the operator add/remove them. Empty = no CORS (default),
+		* so cross-origin browser clients are blocked. Origins are exact
+		* scheme+host+port strings; the literal `*` opens it to any site (warned).
+		* Applies live (persisted to a2a.json) — no restart needed.
+		*/
+		function corsControl(serve, busy, act, corsInput, setCorsInput) {
+			const origins = serve.corsOrigins ?? [];
+			const hasWildcard = origins.includes("*");
+			const isBusy = busy === "set-server-cors:";
+			const save = (next) => {
+				act("set-server-cors", "", { corsOrigins: next });
+			};
+			const addOrigin = () => {
+				const v = corsInput.trim();
+				if (!v || origins.includes(v)) {
+					setCorsInput("");
+					return;
+				}
+				save([...origins, v]);
+				setCorsInput("");
+			};
+			return (0, react.createElement)("div", { className: "a2a-auth" }, (0, react.createElement)("div", { className: "a2a-auth-row" }, (0, react.createElement)("span", { className: "a2a-auth-label" }, "跨域访问 (CORS)"), stateDot(origins.length > 0 ? hasWildcard ? "reconnecting" : "connected" : "disabled"), (0, react.createElement)("span", {
+				className: "a2a-auth-state",
+				"data-on": String(origins.length > 0)
+			}, origins.length === 0 ? "未开启(浏览器跨源调用被拒)" : hasWildcard ? "允许任意来源(*)" : `已允许 ${origins.length} 个来源`)), origins.length > 0 ? (0, react.createElement)("div", { className: "a2a-cors-list" }, ...origins.map((o) => (0, react.createElement)("span", {
+				key: o,
+				className: "a2a-cors-chip"
+			}, o, (0, react.createElement)("button", {
+				className: "a2a-cors-chip-x",
+				title: "移除",
+				disabled: isBusy,
+				onClick: () => save(origins.filter((x) => x !== o))
+			}, "×")))) : null, (0, react.createElement)("div", { className: "a2a-auth-input-row" }, (0, react.createElement)("input", {
+				className: "a2a-input",
+				type: "text",
+				placeholder: "添加来源,如 http://localhost:8080 或 *",
+				value: corsInput,
+				disabled: isBusy,
+				onChange: (e) => setCorsInput(e.target.value),
+				onKeyDown: (e) => {
+					if (e.key === "Enter") addOrigin();
+				}
+			}), actionBtn("添加", true, addOrigin, isBusy || !corsInput.trim()), origins.length > 0 ? actionBtn("清空", false, () => save([]), isBusy) : null), (0, react.createElement)("div", { className: "a2a-hint" }, hasWildcard ? "⚠️ 已允许任意来源(*):用户浏览器打开的任何网站都能跨源调用本入站端点。仅在完全可信的本机环境使用,并建议同时配置入站鉴权 token。" : "填入完整来源(协议+主机+端口,精确匹配)。留空则默认禁止浏览器跨源调用;写 * 可放开任意来源(不推荐)。跨域配置明文存入 a2a.json,实时生效。"));
+		}
 		function inboundRow(p, busy, act) {
 			return (0, react.createElement)("tr", { key: p.id }, (0, react.createElement)("td", { "data-label": "来源" }, p.label), (0, react.createElement)("td", {
 				className: "a2a-cell-mono",

package/lib/index.js

@@ -695,6 +695,16 @@ var A2AServer = class {
 		applyAuthScheme(card, token);
 		return card;
 	}
+	/**
+	* True when the request carries the configured bearer token. Public wrapper
+	* for transports that must decide response headers/status BEFORE streaming
+	* frames — see index.ts's SSE branch, which must send `content-type:
+	* text/event-stream` + CORS headers before the first `res.write()`, and
+	* therefore needs the auth outcome up front.
+	*/
+	checkAuth(req) {
+		return this.authorized(req);
+	}
 	/** True when the request carries the configured bearer token. */
 	authorized(req) {
 		const token = this.options.authToken;
@@ -1190,10 +1200,7 @@ function createDshAgentExecutor(agents, opts) {
 				type: "text",
 				text: prompt
 			}],
-			source: {
-				kind: "plugin",
-				plugin
-			}
+			source: { kind: `plugin:${plugin}` }
 		});
 		agent.send(userMessage, "next-turn", true);
 		if (justOpened) try {
@@ -1440,6 +1447,14 @@ var DashboardRegistry = class {
 					message: "set-server-auth is not wired (server mode not mounted)"
 				};
 			}
+			case "set-server-cors": {
+				const raw = payload?.corsOrigins;
+				const origins = Array.isArray(raw) ? raw.filter((o) => typeof o === "string") : [];
+				return this.hooks.setServerCors ? this.hooks.setServerCors(origins) : {
+					ok: false,
+					message: "set-server-cors is not wired (server mode not mounted)"
+				};
+			}
 			case "server-status": return this.hooks.serverStatus ? Promise.resolve(this.hooks.serverStatus()) : {
 				ok: false,
 				message: "server-status is not wired (server mode not mounted)"
@@ -1676,6 +1691,7 @@ function mergePersisted(base, persisted) {
 		if (pServer.agentVersion) merged.agentVersion = pServer.agentVersion;
 		if (pServer.endpointPath) merged.endpointPath = pServer.endpointPath;
 		if (pServer.authToken !== void 0) merged.authToken = pServer.authToken;
+		if (pServer.corsOrigins !== void 0) merged.corsOrigins = pServer.corsOrigins;
 		if (pServer.skills) merged.skills = pServer.skills;
 	}
 	return merged;
@@ -2222,12 +2238,23 @@ function apply(ctx, config = {}) {
 				}, store);
 				let enabled = wantsServer;
 				let disposers = [];
+				let corsAllowlist = normalizeOrigins(mergedConfig.corsOrigins);
+				if (corsAllowlist.includes("*")) logger?.warn?.("[a2a] corsOrigins includes \"*\": the inbound A2A endpoint accepts cross-origin browser calls from ANY site. Set an explicit origin allowlist unless this host is fully trusted and, ideally, gate it with authToken.");
 				const registerRoutes = () => {
+					const cors = (req) => corsHeadersFor(req.headers.origin, corsAllowlist);
 					disposers.push(webServer.register({
 						kind: "exact",
 						path: "/.well-known/agent-card.json",
-						handler: async (_req, res) => {
-							res.writeHead(200, { "content-type": "application/json" });
+						handler: async (req, res) => {
+							if (req.method === "OPTIONS") {
+								res.writeHead(204, cors(req));
+								res.end();
+								return;
+							}
+							res.writeHead(200, {
+								"content-type": "application/json",
+								...cors(req)
+							});
 							res.end(JSON.stringify(server.card));
 						}
 					}));
@@ -2235,34 +2262,54 @@ function apply(ctx, config = {}) {
 						kind: "prefix",
 						path: server.endpointPath,
 						handler: async (req, res) => {
+							const ch = cors(req);
+							if (req.method === "OPTIONS") {
+								res.writeHead(204, ch);
+								res.end();
+								return;
+							}
 							const isStream = (req.headers.accept ?? "").includes("text/event-stream");
 							if (req.method === "GET" && (req.url ?? "").startsWith(server.endpointPath + "/card")) {
-								res.writeHead(200, { "content-type": "application/json" });
+								res.writeHead(200, {
+									"content-type": "application/json",
+									...ch
+								});
 								res.end(JSON.stringify(server.card));
 								return;
 							}
 							if (req.method !== "POST") {
-								res.writeHead(405, { "content-type": "text/plain" });
+								res.writeHead(405, {
+									"content-type": "text/plain",
+									...ch
+								});
 								res.end("Method Not Allowed");
 								return;
 							}
 							const body = await readBody(req);
 							if (isStream) {
-								const stream = await server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
-								if (stream.status !== 200) {
-									res.writeHead(stream.status, {
+								if (!server.checkAuth(toServerReq(req))) {
+									res.writeHead(401, {
 										"content-type": "text/plain",
-										...stream.headers ?? {}
+										...ch,
+										"WWW-Authenticate": "Bearer"
 									});
 									res.end("Unauthorized");
 									return;
 								}
+								res.writeHead(200, {
+									"content-type": "text/event-stream",
+									"cache-control": "no-cache",
+									connection: "keep-alive",
+									...ch
+								});
+								await server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
 								res.end();
 								return;
 							}
 							const out = await server.handle(toServerReq(req), body);
 							res.writeHead(out.status, {
 								"content-type": out.contentType,
+								...ch,
 								...out.headers ?? {}
 							});
 							res.end(out.body);
@@ -2385,11 +2432,34 @@ function apply(ctx, config = {}) {
 							message: token ? "已设置入站鉴权 token" : "已清除入站鉴权 token"
 						};
 					},
+					setServerCors: async (origins) => {
+						corsAllowlist = normalizeOrigins(origins);
+						if (corsAllowlist.includes("*")) logger?.warn?.("[a2a] corsOrigins set to include \"*\": the inbound A2A endpoint now accepts cross-origin browser calls from ANY site.");
+						const next = loadConfig();
+						next.server = {
+							...next.server ?? {},
+							corsOrigins: corsAllowlist.length > 0 ? corsAllowlist : void 0
+						};
+						const res = saveConfig(next);
+						if (!res.ok) {
+							logger?.error?.(`[a2a] failed to persist corsOrigins to ${res.path}: ${res.message}`);
+							return {
+								ok: false,
+								message: `applied in-memory but failed to save: ${res.message}`
+							};
+						}
+						logger?.info?.(`[a2a] inbound CORS allowlist updated (${corsAllowlist.length} origin(s), saved to ${res.path})`);
+						return {
+							ok: true,
+							message: corsAllowlist.length > 0 ? `已更新跨域白名单 (${corsAllowlist.length} 个来源)` : "已清空跨域白名单(默认禁止跨源)"
+						};
+					},
 					serverStatus: () => ({
 						ok: true,
 						message: JSON.stringify({
 							enabled,
-							...serverCard()
+							...serverCard(),
+							corsOrigins: corsAllowlist
 						})
 					})
 				});
@@ -2538,6 +2608,42 @@ async function readBody(req) {
 		req.once("error", reject);
 	});
 }
+/** Normalize a CORS origin allowlist: trim, drop empties, de-duplicate. */
+function normalizeOrigins(origins) {
+	if (!origins) return [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const o of origins) {
+		const t = typeof o === "string" ? o.trim() : "";
+		if (t) seen.add(t);
+	}
+	return [...seen];
+}
+/**
+* Resolve CORS headers for one inbound A2A request against the configured
+* origin allowlist. Returns `{}` (no CORS) when the request has no `Origin`,
+* the allowlist is empty, or the origin isn't allowed — so a disallowed
+* cross-origin browser call is blocked by the browser exactly as before this
+* feature existed. An allowed origin is echoed back verbatim (never `*` unless
+* the operator explicitly configured `['*']`), with `Vary: Origin` so shared
+* caches don't leak one origin's response to another. Credentials are never
+* allowed: inbound auth is a Bearer header, not a cookie.
+*/
+function corsHeadersFor(reqOrigin, allowed) {
+	if (allowed.length === 0) return {};
+	const wildcard = allowed.includes("*");
+	let allowOrigin;
+	if (wildcard) allowOrigin = reqOrigin ?? "*";
+	else if (reqOrigin && allowed.includes(reqOrigin)) allowOrigin = reqOrigin;
+	if (!allowOrigin) return {};
+	const headers = {
+		"Access-Control-Allow-Origin": allowOrigin,
+		"Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+		"Access-Control-Allow-Headers": "Content-Type, Authorization",
+		"Access-Control-Max-Age": "86400"
+	};
+	if (allowOrigin !== "*") headers["Vary"] = "Origin";
+	return headers;
+}
 /** Loopback/same-origin trust fence for the dashboard API (no remote write). */
 function trustedLoopback(req) {
 	const host = req.headers.host;

package/lib/types/a2a-config.d.ts

@@ -42,6 +42,8 @@ export interface PersistedServerConfig {
     endpointPath?: string;
     /** Optional shared bearer token protecting the inbound /a2a endpoint. */
     authToken?: string;
+    /** Browser origins allowed to call the inbound A2A routes (CORS allowlist); empty/absent = no CORS. `["*"]` opts into wildcard. */
+    corsOrigins?: string[];
     skills?: Array<{
         id: string;
         name: string;

package/lib/types/a2a-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-config.d.ts","sourceRoot":"","sources":["../../src/a2a-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAE9C,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,0DAA0D;IAC1D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzG;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAChC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAaxD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAoD1C;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,IAAI,kBAAkB,CAW/C;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,MAAM,EAAE,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAatG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,kBAAkB,GAAG,eAAe,CAmBpG"}
+{"version":3,"file":"a2a-config.d.ts","sourceRoot":"","sources":["../../src/a2a-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAE9C,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,0DAA0D;IAC1D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mIAAmI;IACnI,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzG;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAChC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAaxD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAW5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAoD1C;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,IAAI,kBAAkB,CAW/C;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,MAAM,EAAE,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAatG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,kBAAkB,GAAG,eAAe,CAoBpG"}

package/lib/types/client/dashboard.css.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.css.d.ts","sourceRoot":"","sources":["../../../src/client/dashboard.css.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,gBAAgB,mCAAmC,CAAC;AAmQjE;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,IAAI,CAiBlD"}
+{"version":3,"file":"dashboard.css.d.ts","sourceRoot":"","sources":["../../../src/client/dashboard.css.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,gBAAgB,mCAAmC,CAAC;AAwQjE;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,IAAI,CAiBlD"}

package/lib/types/client/index.d.ts

@@ -13,7 +13,7 @@
  * on the product's `--dsw-alias-*` design tokens, so light/dark themes and
  * narrow-window layouts follow the DSH shell. No inline styles.
  */
-import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client';
+import type { Context as ClientContext } from '@deepseek-ai/cordis';
 import type { PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
 import { type ReactElement } from 'react';
 /** Services this plugin needs from the client runtime. */

package/lib/types/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAE5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAG9E,0DAA0D;AAC1D,eAAO,MAAM,MAAM,UAAY,CAAC;AAEhC,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAyB9C;AA8DD,KAAK,YAAY,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AA+FrD,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CA8UnE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAG9E,0DAA0D;AAC1D,eAAO,MAAM,MAAM,UAAY,CAAC;AAEhC,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CA6B9C;AA8DD,KAAK,YAAY,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AAiGrD,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAgVnE"}

package/lib/types/dashboard.d.ts

@@ -101,6 +101,8 @@ export interface DashboardControlHooks {
     setServerEnabled?: (enabled: boolean) => Promise<ControlResult>;
     /** Set or clear the inbound server's shared bearer token at runtime (persisted). */
     setServerAuthToken?: (token?: string) => Promise<ControlResult>;
+    /** Replace the inbound CORS origin allowlist at runtime (persisted); empty = no CORS. */
+    setServerCors?: (origins: string[]) => Promise<ControlResult>;
     /** Read current inbound server status (for the serve panel). */
     serverStatus?: () => ControlResult;
     /** Runtime-remove an outbound agent by its connection id. */

package/lib/types/dashboard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../src/dashboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,KAAK,EAAE,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;IACrD,yFAAyF;IACzF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClE,0FAA0F;IAC1F,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,6EAA6E;IAC7E,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD,mFAAmF;IACnF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3D,oFAAoF;IACpF,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3G,0EAA0E;IAC1E,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClG,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,aAAa,CAAC;IACnC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAC;KACpF,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,CACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KACrE,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B;AAED,yDAAyD;AACzD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,MAAM,CAAoC;IAClD,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,GAAG,CAAK;IAEhB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAM5C,wEAAwE;IACxE,YAAY,CAAC,GAAG,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,MAAM;IAmCxG,uEAAuE;IACvE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAMhD,oCAAoC;IACpC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IAKtD,gEAAgE;IAChE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAM5B,wDAAwD;IACxD,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,MAAM;IAkClE,sDAAsD;IACtD,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAU1C,gCAAgC;IAChC,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI;IASxE,uCAAuC;IACvC,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAQtC,QAAQ,IAAI,iBAAiB;IAQvB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IA+FxG,OAAO,CAAC,cAAc;CAKvB;AAaD,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAUD,0EAA0E;AAC1E,wBAAgB,iBAAiB,IAAI,iBAAiB,CAGrD;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}
+{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../src/dashboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,KAAK,EAAE,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;IACrD,yFAAyF;IACzF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClE,0FAA0F;IAC1F,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,6EAA6E;IAC7E,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD,mFAAmF;IACnF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3D,oFAAoF;IACpF,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3G,0EAA0E;IAC1E,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClG,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,yFAAyF;IACzF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,aAAa,CAAC;IACnC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAC;KACpF,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,CACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KACrE,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B;AAED,yDAAyD;AACzD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,MAAM,CAAoC;IAClD,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,GAAG,CAAK;IAEhB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAM5C,wEAAwE;IACxE,YAAY,CAAC,GAAG,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,MAAM;IAmCxG,uEAAuE;IACvE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAMhD,oCAAoC;IACpC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IAKtD,gEAAgE;IAChE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAM5B,wDAAwD;IACxD,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,MAAM;IAkClE,sDAAsD;IACtD,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAU1C,gCAAgC;IAChC,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI;IASxE,uCAAuC;IACvC,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAQtC,QAAQ,IAAI,iBAAiB;IAQvB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAuGxG,OAAO,CAAC,cAAc;CAKvB;AAaD,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAUD,0EAA0E;AAC1E,wBAAgB,iBAAiB,IAAI,iBAAiB,CAGrD;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/lib/types/index.d.ts

@@ -41,6 +41,22 @@ export interface A2APluginConfig {
     execute?: ServerOptions['execute'];
     /** Optional shared bearer token protecting the inbound /a2a endpoint. */
     authToken?: string;
+    /**
+     * Browser origins allowed to call the inbound A2A routes cross-origin (CORS).
+     * An explicit allowlist of exact origins (scheme+host+port), e.g.
+     * `['http://localhost:8080', 'https://app.example.com']`.
+     *
+     * DEFAULT IS EMPTY = NO CORS: a browser page from another origin cannot call
+     * the endpoint, which is the safe default — with server mode's optional (and
+     * off-by-default) `authToken`, a wildcard would let any site the user visits
+     * drive their local agent. Each request's `Origin` is matched against this
+     * list; a hit echoes that exact origin back (with `Vary: Origin`), a miss
+     * sends no CORS headers. The literal `['*']` opts into a wildcard (logged as
+     * a warning) for fully-trusted local setups. Credentials are never allowed
+     * (auth rides the Bearer header, not cookies). Scoped to the A2A protocol
+     * routes only — the dashboard API (`/a2a/api`) stays loopback/same-origin.
+     */
+    corsOrigins?: string[];
     /** Serve the dashboard API on the webserver (default true). */
     dashboard?: boolean;
 }

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,EAAa,KAAK,aAAa,EAA0B,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAY5G,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAEpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACjJ,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE;QACd,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E,GAAG,MAAM,IAAI,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,IAAI;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAClD;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,mDAAmD;QACnD,SAAS,EAAE,gBAAgB,CAAC;QAC5B,mEAAmE;QACnE,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;QAC7C,6DAA6D;QAC7D,YAAY,CAAC,EAAE,mBAAmB,CAAC;QACnC,0CAA0C;QAC1C,KAAK,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,IAAI,CAAA;SAAE,CAAC;QAC9C;;;;;WAKG;QACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;KAC5B;CACF;AAQD,eAAO,MAAM,IAAI,QAAQ,CAAC;AAE1B;;;;;GAKG;AACH,eAAO,MAAM,MAAM,iCAAkC,CAAC;AAEtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,QAkrB/D;AA2FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,EAAa,KAAK,aAAa,EAA0B,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAY5G,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAEpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACjJ,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE;QACd,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9E,GAAG,MAAM,IAAI,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,IAAI;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAClD;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,mDAAmD;QACnD,SAAS,EAAE,gBAAgB,CAAC;QAC5B,mEAAmE;QACnE,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;QAC7C,6DAA6D;QAC7D,YAAY,CAAC,EAAE,mBAAmB,CAAC;QACnC,0CAA0C;QAC1C,KAAK,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,IAAI,CAAA;SAAE,CAAC;QAC9C;;;;;WAKG;QACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;KAC5B;CACF;AAQD,eAAO,MAAM,IAAI,QAAQ,CAAC;AAE1B;;;;;GAKG;AACH,eAAO,MAAM,MAAM,iCAAkC,CAAC;AAEtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,QAovB/D;AA2FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/D"}

package/lib/types/server.d.ts

@@ -149,6 +149,16 @@ export declare class A2AServer {
         endpointChanged: boolean;
     };
     private buildCard;
+    /**
+     * True when the request carries the configured bearer token. Public wrapper
+     * for transports that must decide response headers/status BEFORE streaming
+     * frames — see index.ts's SSE branch, which must send `content-type:
+     * text/event-stream` + CORS headers before the first `res.write()`, and
+     * therefore needs the auth outcome up front.
+     */
+    checkAuth(req: {
+        headers?: Record<string, string>;
+    }): boolean;
     /** True when the request carries the configured bearer token. */
     private authorized;
     private emit;
@@ -238,8 +248,7 @@ interface AgentUserMessage {
     readonly role: 'user';
     readonly content: AgentTextBlock[];
     readonly source: {
-        kind: 'plugin';
-        plugin: string;
+        kind: string;
     };
 }
 /** The slice of a live `Agent` we drive (mirrors `@deepseek-ai/dsh-agent` `Agent`). */
@@ -324,7 +333,7 @@ export interface DshAgentExecutorOptions {
      * absolute — pass `process.cwd()` (the profile's workspace) at wire time.
      */
     cwd: string;
-    /** `source.plugin` tag stamped on inbound messages (defaults to `'a2a'`). */
+    /** Producer tag stamped on inbound messages (defaults to `'a2a'`); serialized as `plugin:<name>` under session format v4. */
     plugin?: string;
     /** Optional static per-agent model routing forwarded to `create()`. */
     agentOptions?: {

package/lib/types/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,SAAS,EAET,UAAU,EAGV,OAAO,EACP,IAAI,EAEJ,IAAI,EACL,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,SAAS,EAKV,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,WAAY,SAAQ,UAAU;CAAG;AAElD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,wDAAwD;IACxD,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1C,+EAA+E;IAC/E,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzG;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,6DAA6D;AAC7D,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,QAAQ,CAA8B;IAE9C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAgB9B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS;IAIjC,IAAI,IAAI,IAAI,EAAE;IAId,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI;IAWpE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAYxI,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;CAG5C;AASD,yEAAyE;AACzE,qBAAa,SAAS;IACpB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,SAAS,CAA2C;IAC5D,OAAO,CAAC,OAAO,CAAS;IACxB,mFAAmF;IACnF,OAAO,CAAC,OAAO,CAAsC;gBAEzC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAkB;IAa3D;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKjC,0DAA0D;IAC1D,UAAU,IAAI,MAAM;IAIpB,+EAA+E;IAC/E,OAAO,CAAC,oBAAoB;IAO5B;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAYlC,6DAA6D;IAC7D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;;;;;;;OAUG;IACH,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE;IA8BlE,OAAO,CAAC,SAAS;IA0BjB,iEAAiE;IACjE,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,IAAI;IAIZ,gEAAgE;IAC1D,MAAM,CAAC,GAAG,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IA4D/P,YAAY,CAAC,GAAG,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;YA6DvP,UAAU;YASV,YAAY;IAQ1B,2EAA2E;YAC7D,OAAO;YAkCP,QAAQ;IAoDtB,OAAO,CAAC,YAAY;CAIrB;AAwBD,eAAO,MAAM,aAAa,EAAE,WAAW,EAStC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,YAYnC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,EAAE,YAmC3B,CAAC;AACF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,YAA4B,CAAC;AAmB3D,sEAAsE;AACtE,KAAK,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;AAE7C,8EAA8E;AAC9E,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kFAAkF;AAClF,UAAU,YAAY;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,4EAA4E;AAC5E,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED,uFAAuF;AACvF,UAAU,SAAS;IACjB,QAAQ,CAAC,OAAO,EAAE;QAAE,cAAc,IAAI,YAAY,EAAE,CAAA;KAAE,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,iEAAiE;AACjE,UAAU,WAAW;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,OAAO,EAAE;QACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACzE,QAAQ,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzB,MAAM,CAAC,OAAO,EAAE;QACd,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED,uFAAuF;AACvF,UAAU,gBAAiB,SAAQ,YAAY;IAC7C,oEAAoE;IACpE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,MAAM;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAClG;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/I;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;CACjC;AA+BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,uBAAuB,GAC5B,gBAAgB,CAsIlB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,SAAS,EAET,UAAU,EAGV,OAAO,EACP,IAAI,EAEJ,IAAI,EACL,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,SAAS,EAKV,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,WAAY,SAAQ,UAAU;CAAG;AAElD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,wDAAwD;IACxD,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1C,+EAA+E;IAC/E,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzG;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,6DAA6D;AAC7D,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,QAAQ,CAA8B;IAE9C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAgB9B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS;IAIjC,IAAI,IAAI,IAAI,EAAE;IAId,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI;IAWpE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAYxI,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;CAG5C;AASD,yEAAyE;AACzE,qBAAa,SAAS;IACpB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,SAAS,CAA2C;IAC5D,OAAO,CAAC,OAAO,CAAS;IACxB,mFAAmF;IACnF,OAAO,CAAC,OAAO,CAAsC;gBAEzC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAkB;IAa3D;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKjC,0DAA0D;IAC1D,UAAU,IAAI,MAAM;IAIpB,+EAA+E;IAC/E,OAAO,CAAC,oBAAoB;IAO5B;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAYlC,6DAA6D;IAC7D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;;;;;;;;OAUG;IACH,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE;IA8BlE,OAAO,CAAC,SAAS;IA0BjB;;;;;;OAMG;IACH,SAAS,CAAC,GAAG,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO;IAI7D,iEAAiE;IACjE,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,IAAI;IAIZ,gEAAgE;IAC1D,MAAM,CAAC,GAAG,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IA4D/P,YAAY,CAAC,GAAG,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;YA6DvP,UAAU;YASV,YAAY;IAQ1B,2EAA2E;YAC7D,OAAO;YAkCP,QAAQ;IAoDtB,OAAO,CAAC,YAAY;CAIrB;AAwBD,eAAO,MAAM,aAAa,EAAE,WAAW,EAStC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,YAYnC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,EAAE,YAmC3B,CAAC;AACF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,YAA4B,CAAC;AAmB3D,sEAAsE;AACtE,KAAK,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;AAE7C,8EAA8E;AAC9E,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kFAAkF;AAClF,UAAU,YAAY;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,4EAA4E;AAC5E,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAED,uFAAuF;AACvF,UAAU,SAAS;IACjB,QAAQ,CAAC,OAAO,EAAE;QAAE,cAAc,IAAI,YAAY,EAAE,CAAA;KAAE,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,iEAAiE;AACjE,UAAU,WAAW;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,OAAO,EAAE;QACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACzE,QAAQ,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzB,MAAM,CAAC,OAAO,EAAE;QACd,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED,uFAAuF;AACvF,UAAU,gBAAiB,SAAQ,YAAY;IAC7C,oEAAoE;IACpE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,6HAA6H;IAC7H,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,MAAM;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAClG;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/I;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;CACjC;AA+BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,uBAAuB,GAC5B,gBAAgB,CAsIlB"}

package/package.json

@@ -1,7 +1,23 @@
 {
   "name": "@ryubyte/dsh-a2a",
   "description": "Agent2Agent (A2A) protocol v1.0 plugin for DeepSeek Harness (DSH): outbound client (remote AgentCard skills as ctx.tools), inbound server (A2A JSON-RPC + AgentCard endpoint), and a settings dashboard of live A2A connections",
-  "version": "0.2.1",
+  "version": "0.3.0",
+  "keywords": [
+    "a2a",
+    "agent2agent",
+    "agent-to-agent",
+    "a2a-protocol",
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "dsh-bundle",
+    "agent",
+    "ai-agent",
+    "agent-card",
+    "json-rpc",
+    "sse",
+    "interoperability"
+  ],
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -33,12 +49,12 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.7-rc.2",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
@@ -56,7 +72,7 @@
   "dsh": {
     "client": {
       "inject": [
-        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-renderer",
         "@deepseek-ai/dsh-client-ui-slots",
         "@deepseek-ai/dsh-client-ui-settings"
       ],

package/src/a2a-config.ts

@@ -49,6 +49,8 @@ export interface PersistedServerConfig {
   endpointPath?: string;
   /** Optional shared bearer token protecting the inbound /a2a endpoint. */
   authToken?: string;
+  /** Browser origins allowed to call the inbound A2A routes (CORS allowlist); empty/absent = no CORS. `["*"]` opts into wildcard. */
+  corsOrigins?: string[];
   skills?: Array<{ id: string; name: string; description: string; tags?: string[]; examples?: string[] }>;
 }
 
@@ -247,6 +249,7 @@ export function mergePersisted(base: A2APluginConfig, persisted: PersistedA2ACon
     if (pServer.agentVersion) merged.agentVersion = pServer.agentVersion;
     if (pServer.endpointPath) merged.endpointPath = pServer.endpointPath;
     if (pServer.authToken !== undefined) merged.authToken = pServer.authToken;
+    if (pServer.corsOrigins !== undefined) merged.corsOrigins = pServer.corsOrigins;
     if (pServer.skills) merged.skills = pServer.skills;
   }
   return merged;

package/src/client/dashboard.css.ts

@@ -193,6 +193,11 @@ const css = String.raw`
 .a2a-auth-state[data-on='false'] { color: var(--dsw-alias-label-tertiary, #81858c); }
 .a2a-auth-input-row { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
 .a2a-auth-input-row .a2a-input { flex: 1; min-width: 220px; }
+.a2a-cors-list { display: flex; flex-wrap: wrap; gap: 6px; }
+.a2a-cors-chip { display: inline-flex; align-items: center; gap: 6px; font-size: 12px; font-family: var(--ds-font-family-code, ui-monospace, monospace); padding: 2px 6px 2px 8px; border-radius: var(--dsw-radius-sm, 6px); background: var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.05)); border: .5px solid var(--dsw-alias-border-l3, #d0d3d9); color: var(--dsw-alias-label-secondary, #4a4f57); }
+.a2a-cors-chip-x { border: none; background: none; cursor: pointer; font-size: 14px; line-height: 1; padding: 0 2px; color: var(--dsw-alias-label-tertiary, #81858c); }
+.a2a-cors-chip-x:hover:not(:disabled) { color: var(--dsw-alias-state-error-primary, #f04438); }
+.a2a-cors-chip-x:disabled { cursor: default; opacity: .4; }
 
 /* ---- inbound table ---- */
 .a2a-table-wrap { overflow-x: auto; border: 1px solid var(--dsw-alias-border-l1, rgba(127,127,127,.12)); border-radius: 10px; }

package/src/client/index.ts

@@ -14,7 +14,10 @@
  * narrow-window layouts follow the DSH shell. No inline styles.
  */
 
-import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client';
+import type { Context as ClientContext } from '@deepseek-ai/cordis';
+// Side-effect type import: augments cordis `Context` with `slots` (the renderer
+// owns that service; the retired `dsh-client-runtime` used to re-export it).
+import type {} from '@deepseek-ai/dsh-client-ui-renderer/client';
 import type {} from '@deepseek-ai/dsh-client-ui-settings/client';
 import type { PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
 import { createElement, useEffect, useState, type ReactElement } from 'react';
@@ -30,24 +33,28 @@ export function apply(ctx: ClientContext): void {
     return () => dispose();
   }, 'dsh-a2a: dashboard styles');
 
-  ctx.effect(() => {
-    try {
-      const off = ctx.slots.register(
-        {
-          name: 'settings.section',
-          id: 'a2a',
-          order: 90,
-          label: () => 'A2A 连接',
-          inject: () => ({}),
-        },
-        DashboardSection,
-      );
-      return () => off();
-    } catch (err) {
-      console.error('[dsh-a2a] failed to register settings section:', err);
-      return () => {};
-    }
-  }, 'dsh-a2a: settings section');
+  // Contribute the "A2A 连接" settings section. The `settings.section` slot is
+  // declared by `dsh-client-ui-settings`, which may activate AFTER this plugin.
+  // A bare `slots.register` throws "slot not declared" when it wins that race
+  // (silently swallowed here, so the section never appears). `slots.inject`
+  // defers the register until the declaration is committed and re-runs it across
+  // declaration lifetimes — the pattern every first-party settings section uses.
+  ctx.effect(
+    () =>
+      ctx.slots.inject('settings.section', () =>
+        ctx.slots.register(
+          {
+            name: 'settings.section',
+            id: 'a2a',
+            order: 90,
+            label: () => 'A2A 连接',
+            inject: () => ({}),
+          },
+          DashboardSection,
+        ),
+      ),
+    'dsh-a2a: settings section',
+  );
 }
 
 // ── wire types (mirror the host dashboard.ts) ──────────────────────────────
@@ -129,6 +136,8 @@ interface ServeStatus {
   executor?: 'custom' | 'dsh-agent' | 'none';
   /** Whether the inbound endpoint is token-gated (never the token value). */
   authConfigured?: boolean;
+  /** Browser origins allowed to call inbound cross-origin (CORS allowlist); empty = no CORS. */
+  corsOrigins?: string[];
 }
 
 interface DiscoveredCard {
@@ -227,6 +236,8 @@ export function DashboardSection(_props: SectionProps): ReactElement {
   const [addToken, setAddToken] = useState('');
   /** Inbound authToken input (serve tab); empty string means "clear". */
   const [authInput, setAuthInput] = useState('');
+  /** New-origin input for the inbound CORS allowlist editor (serve tab). */
+  const [corsInput, setCorsInput] = useState('');
   /** Serve-identity edit mode + form draft (server tab). All hooks stay at the
    * top level in fixed order; a single shared draft avoids per-card hooks. */
   const [editingServe, setEditingServe] = useState(false);
@@ -511,7 +522,7 @@ export function DashboardSection(_props: SectionProps): ReactElement {
               ? serveEditPanel(serveDraft, setServeDraft, (also) => void saveServeIdentity(also), () => setEditingServe(false), busy, false)
               : needsServeSetup(serve)
                 ? serveEditPanel(serveDraft, setServeDraft, (also) => void saveServeIdentity(also), () => setEditingServe(false), busy, true)
-                : serveViewPanel(serve, busy, act, authInput, setAuthInput, startEditServe)
+                : serveViewPanel(serve, busy, act, authInput, setAuthInput, corsInput, setCorsInput, startEditServe)
             : null,
           // (2) inbound connections — who is calling this DSH's A2A endpoint
           createElement(
@@ -857,6 +868,8 @@ function serveViewPanel(
   act: (a: string, t: string, p?: Record<string, unknown>) => Promise<void>,
   authInput: string,
   setAuthInput: (v: string) => void,
+  corsInput: string,
+  setCorsInput: (v: string) => void,
   onEdit: () => void,
 ): ReactElement {
   return createElement(
@@ -926,6 +939,7 @@ function serveViewPanel(
     ),
     serve.enabled ? executorNote(serve) : null,
     serve.enabled ? authControl(serve, busy, act, authInput, setAuthInput) : null,
+    serve.enabled ? corsControl(serve, busy, act, corsInput, setCorsInput) : null,
   );
 }
 
@@ -1097,6 +1111,99 @@ function authControl(
   );
 }
 
+/**
+ * Inbound CORS allowlist control for the serve tab: shows the allowed browser
+ * origins and lets the operator add/remove them. Empty = no CORS (default),
+ * so cross-origin browser clients are blocked. Origins are exact
+ * scheme+host+port strings; the literal `*` opens it to any site (warned).
+ * Applies live (persisted to a2a.json) — no restart needed.
+ */
+function corsControl(
+  serve: { corsOrigins?: string[] },
+  busy: string | null,
+  act: (a: string, t: string, p?: Record<string, unknown>) => Promise<void>,
+  corsInput: string,
+  setCorsInput: (v: string) => void,
+): ReactElement {
+  const origins = serve.corsOrigins ?? [];
+  const hasWildcard = origins.includes('*');
+  const isBusy = busy === 'set-server-cors:';
+  const save = (next: string[]): void => {
+    void act('set-server-cors', '', { corsOrigins: next });
+  };
+  const addOrigin = (): void => {
+    const v = corsInput.trim();
+    if (!v || origins.includes(v)) { setCorsInput(''); return; }
+    save([...origins, v]);
+    setCorsInput('');
+  };
+  return createElement(
+    'div',
+    { className: 'a2a-auth' },
+    createElement(
+      'div',
+      { className: 'a2a-auth-row' },
+      createElement('span', { className: 'a2a-auth-label' }, '跨域访问 (CORS)'),
+      stateDot(origins.length > 0 ? (hasWildcard ? 'reconnecting' : 'connected') : 'disabled'),
+      createElement(
+        'span',
+        { className: 'a2a-auth-state', 'data-on': String(origins.length > 0) },
+        origins.length === 0
+          ? '未开启(浏览器跨源调用被拒)'
+          : hasWildcard
+            ? '允许任意来源(*)'
+            : `已允许 ${origins.length} 个来源`,
+      ),
+    ),
+    // Current allowlist as removable chips.
+    origins.length > 0
+      ? createElement(
+          'div',
+          { className: 'a2a-cors-list' },
+          ...origins.map((o) =>
+            createElement(
+              'span',
+              { key: o, className: 'a2a-cors-chip' },
+              o,
+              createElement(
+                'button',
+                {
+                  className: 'a2a-cors-chip-x',
+                  title: '移除',
+                  disabled: isBusy,
+                  onClick: () => save(origins.filter((x) => x !== o)),
+                },
+                '×',
+              ),
+            ),
+          ),
+        )
+      : null,
+    createElement(
+      'div',
+      { className: 'a2a-auth-input-row' },
+      createElement('input', {
+        className: 'a2a-input',
+        type: 'text',
+        placeholder: '添加来源,如 http://localhost:8080 或 *',
+        value: corsInput,
+        disabled: isBusy,
+        onChange: (e: { target: { value: string } }) => setCorsInput(e.target.value),
+        onKeyDown: (e: { key: string }) => { if (e.key === 'Enter') addOrigin(); },
+      }),
+      actionBtn('添加', true, addOrigin, isBusy || !corsInput.trim()),
+      origins.length > 0 ? actionBtn('清空', false, () => save([]), isBusy) : null,
+    ),
+    createElement(
+      'div',
+      { className: 'a2a-hint' },
+      hasWildcard
+        ? '⚠️ 已允许任意来源(*):用户浏览器打开的任何网站都能跨源调用本入站端点。仅在完全可信的本机环境使用,并建议同时配置入站鉴权 token。'
+        : '填入完整来源(协议+主机+端口,精确匹配)。留空则默认禁止浏览器跨源调用;写 * 可放开任意来源(不推荐)。跨域配置明文存入 a2a.json,实时生效。',
+    ),
+  );
+}
+
 function inboundRow(p: InboundPeerApi, busy: string | null, act: (a: string, t: string) => void): ReactElement {
   return createElement(
     'tr',

package/src/dashboard.ts

@@ -98,6 +98,8 @@ export interface DashboardControlHooks {
   setServerEnabled?: (enabled: boolean) => Promise<ControlResult>;
   /** Set or clear the inbound server's shared bearer token at runtime (persisted). */
   setServerAuthToken?: (token?: string) => Promise<ControlResult>;
+  /** Replace the inbound CORS origin allowlist at runtime (persisted); empty = no CORS. */
+  setServerCors?: (origins: string[]) => Promise<ControlResult>;
   /** Read current inbound server status (for the serve panel). */
   serverStatus?: () => ControlResult;
   /** Runtime-remove an outbound agent by its connection id. */
@@ -321,6 +323,14 @@ export class DashboardRegistry {
           ? this.hooks.setServerAuthToken(token)
           : { ok: false, message: 'set-server-auth is not wired (server mode not mounted)' };
       }
+      case 'set-server-cors': {
+        // Replace the CORS origin allowlist wholesale; empty array = no CORS.
+        const raw = payload?.corsOrigins;
+        const origins = Array.isArray(raw) ? raw.filter((o): o is string => typeof o === 'string') : [];
+        return this.hooks.setServerCors
+          ? this.hooks.setServerCors(origins)
+          : { ok: false, message: 'set-server-cors is not wired (server mode not mounted)' };
+      }
       case 'server-status':
         return this.hooks.serverStatus
           ? Promise.resolve(this.hooks.serverStatus())

package/src/index.ts

@@ -60,6 +60,22 @@ export interface A2APluginConfig {
   execute?: ServerOptions['execute'];
   /** Optional shared bearer token protecting the inbound /a2a endpoint. */
   authToken?: string;
+  /**
+   * Browser origins allowed to call the inbound A2A routes cross-origin (CORS).
+   * An explicit allowlist of exact origins (scheme+host+port), e.g.
+   * `['http://localhost:8080', 'https://app.example.com']`.
+   *
+   * DEFAULT IS EMPTY = NO CORS: a browser page from another origin cannot call
+   * the endpoint, which is the safe default — with server mode's optional (and
+   * off-by-default) `authToken`, a wildcard would let any site the user visits
+   * drive their local agent. Each request's `Origin` is matched against this
+   * list; a hit echoes that exact origin back (with `Vary: Origin`), a miss
+   * sends no CORS headers. The literal `['*']` opts into a wildcard (logged as
+   * a warning) for fully-trusted local setups. Credentials are never allowed
+   * (auth rides the Bearer header, not cookies). Scoped to the A2A protocol
+   * routes only — the dashboard API (`/a2a/api`) stays loopback/same-origin.
+   */
+  corsOrigins?: string[];
   // dashboard
   /** Serve the dashboard API on the webserver (default true). */
   dashboard?: boolean;
@@ -671,15 +687,37 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
         // keeps routes off until the UI enables the server.
         let enabled = wantsServer;
         let disposers: Array<() => void> = [];
+        // Mutable CORS allowlist, read per-request so a UI change takes effect
+        // live (like authToken) without rebuilding routes. Normalized to unique,
+        // trimmed, non-empty entries. Empty = no CORS (safe default).
+        let corsAllowlist: string[] = normalizeOrigins(mergedConfig.corsOrigins);
+        if (corsAllowlist.includes('*')) {
+          logger?.warn?.(
+            '[a2a] corsOrigins includes "*": the inbound A2A endpoint accepts cross-origin browser calls from ANY site. ' +
+              'Set an explicit origin allowlist unless this host is fully trusted and, ideally, gate it with authToken.',
+          );
+        }
 
         const registerRoutes = (): void => {
+          // CORS for the A2A protocol routes so allowlisted browser clients
+          // (Flutter Web, plain fetch()) can call cross-origin. Resolved
+          // per-request against `corsAllowlist` (read live so a UI change lands
+          // without a route rebuild); empty allowlist = no CORS. Scoped to these
+          // routes only — /a2a/api stays loopback-fenced.
+          const cors = (req: IncomingMessage): Record<string, string> =>
+            corsHeadersFor(req.headers.origin, corsAllowlist);
           // AgentCard discovery route.
           disposers.push(
             webServer.register({
               kind: 'exact',
               path: '/.well-known/agent-card.json',
-              handler: async (_req: IncomingMessage, res: ServerResponse) => {
-                res.writeHead(200, { 'content-type': 'application/json' });
+              handler: async (req: IncomingMessage, res: ServerResponse) => {
+                if (req.method === 'OPTIONS') {
+                  res.writeHead(204, cors(req));
+                  res.end();
+                  return;
+                }
+                res.writeHead(200, { 'content-type': 'application/json', ...cors(req) });
                 res.end(JSON.stringify(server.card));
               },
             }),
@@ -690,30 +728,49 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
               kind: 'prefix',
               path: server.endpointPath,
               handler: async (req: IncomingMessage, res: ServerResponse) => {
+                const ch = cors(req);
+                // Answer the CORS preflight before any routing — a browser sends
+                // OPTIONS first and refuses the real request without these headers.
+                if (req.method === 'OPTIONS') {
+                  res.writeHead(204, ch);
+                  res.end();
+                  return;
+                }
                 const isStream = (req.headers.accept ?? '').includes('text/event-stream');
                 if (req.method === 'GET' && (req.url ?? '').startsWith(server.endpointPath + '/card')) {
-                  res.writeHead(200, { 'content-type': 'application/json' });
+                  res.writeHead(200, { 'content-type': 'application/json', ...ch });
                   res.end(JSON.stringify(server.card));
                   return;
                 }
                 if (req.method !== 'POST') {
-                  res.writeHead(405, { 'content-type': 'text/plain' });
+                  res.writeHead(405, { 'content-type': 'text/plain', ...ch });
                   res.end('Method Not Allowed');
                   return;
                 }
                 const body = await readBody(req);
                 if (isStream) {
-                  const stream = await server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
-                  if (stream.status !== 200) {
-                    res.writeHead(stream.status, { 'content-type': 'text/plain', ...(stream.headers ?? {}) });
+                  // Auth must be decided BEFORE the first frame: the SSE success
+                  // path writes frames via the onEvent callback, and the first
+                  // res.write() implicitly flushes headers — so we cannot set
+                  // text/event-stream + CORS afterward. Gate here, write the
+                  // stream headers up front, then stream.
+                  if (!server.checkAuth(toServerReq(req))) {
+                    res.writeHead(401, { 'content-type': 'text/plain', ...ch, 'WWW-Authenticate': 'Bearer' });
                     res.end('Unauthorized');
                     return;
                   }
+                  res.writeHead(200, {
+                    'content-type': 'text/event-stream',
+                    'cache-control': 'no-cache',
+                    connection: 'keep-alive',
+                    ...ch,
+                  });
+                  await server.handleStream(toServerReq(req), body, (frame) => res.write(frame));
                   res.end();
                   return;
                 }
                 const out = await server.handle(toServerReq(req), body);
-                res.writeHead(out.status, { 'content-type': out.contentType, ...(out.headers ?? {}) });
+                res.writeHead(out.status, { 'content-type': out.contentType, ...ch, ...(out.headers ?? {}) });
                 res.end(out.body);
               },
             }),
@@ -830,9 +887,34 @@ export function apply(ctx: Context, config: A2APluginConfig = {}) {
             logger?.info?.(`[a2a] inbound authToken ${token ? 'set' : 'cleared'} (saved to ${res.path})`);
             return { ok: true, message: token ? '已设置入站鉴权 token' : '已清除入站鉴权 token' };
           },
+          setServerCors: async (origins) => {
+            // Replace the allowlist wholesale; read live by the route handlers,
+            // so this takes effect on the next request without a route rebuild.
+            corsAllowlist = normalizeOrigins(origins);
+            if (corsAllowlist.includes('*')) {
+              logger?.warn?.(
+                '[a2a] corsOrigins set to include "*": the inbound A2A endpoint now accepts cross-origin browser calls from ANY site.',
+              );
+            }
+            const next: PersistedA2AConfig = loadPersistedA2A();
+            next.server = {
+              ...(next.server ?? {}),
+              corsOrigins: corsAllowlist.length > 0 ? corsAllowlist : undefined,
+            };
+            const res = savePersistedA2A(next);
+            if (!res.ok) {
+              logger?.error?.(`[a2a] failed to persist corsOrigins to ${res.path}: ${res.message}`);
+              return { ok: false, message: `applied in-memory but failed to save: ${res.message}` };
+            }
+            logger?.info?.(`[a2a] inbound CORS allowlist updated (${corsAllowlist.length} origin(s), saved to ${res.path})`);
+            return {
+              ok: true,
+              message: corsAllowlist.length > 0 ? `已更新跨域白名单 (${corsAllowlist.length} 个来源)` : '已清空跨域白名单(默认禁止跨源)',
+            };
+          },
           serverStatus: () => ({
             ok: true,
-            message: JSON.stringify({ enabled, ...serverCard() }),
+            message: JSON.stringify({ enabled, ...serverCard(), corsOrigins: corsAllowlist }),
           }),
         });
 
@@ -1008,6 +1090,47 @@ async function readBody(req: IncomingMessage): Promise<string> {
   });
 }
 
+/** Normalize a CORS origin allowlist: trim, drop empties, de-duplicate. */
+function normalizeOrigins(origins: readonly string[] | undefined): string[] {
+  if (!origins) return [];
+  const seen = new Set<string>();
+  for (const o of origins) {
+    const t = typeof o === 'string' ? o.trim() : '';
+    if (t) seen.add(t);
+  }
+  return [...seen];
+}
+
+/**
+ * Resolve CORS headers for one inbound A2A request against the configured
+ * origin allowlist. Returns `{}` (no CORS) when the request has no `Origin`,
+ * the allowlist is empty, or the origin isn't allowed — so a disallowed
+ * cross-origin browser call is blocked by the browser exactly as before this
+ * feature existed. An allowed origin is echoed back verbatim (never `*` unless
+ * the operator explicitly configured `['*']`), with `Vary: Origin` so shared
+ * caches don't leak one origin's response to another. Credentials are never
+ * allowed: inbound auth is a Bearer header, not a cookie.
+ */
+function corsHeadersFor(reqOrigin: string | undefined, allowed: readonly string[]): Record<string, string> {
+  if (allowed.length === 0) return {};
+  const wildcard = allowed.includes('*');
+  // `*` echoes the caller's origin when present (so the value is still concrete
+  // and future credentialed use stays possible), else the literal `*`.
+  let allowOrigin: string | undefined;
+  if (wildcard) allowOrigin = reqOrigin ?? '*';
+  else if (reqOrigin && allowed.includes(reqOrigin)) allowOrigin = reqOrigin;
+  if (!allowOrigin) return {};
+  const headers: Record<string, string> = {
+    'Access-Control-Allow-Origin': allowOrigin,
+    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+    'Access-Control-Max-Age': '86400',
+  };
+  // Vary on Origin whenever the value is request-dependent (i.e. not a static `*`).
+  if (allowOrigin !== '*') headers['Vary'] = 'Origin';
+  return headers;
+}
+
 /** Loopback/same-origin trust fence for the dashboard API (no remote write). */
 function trustedLoopback(req: IncomingMessage): boolean {
   const host = req.headers.host;

package/src/server.ts

@@ -303,6 +303,17 @@ export class A2AServer {
     return card;
   }
 
+  /**
+   * True when the request carries the configured bearer token. Public wrapper
+   * for transports that must decide response headers/status BEFORE streaming
+   * frames — see index.ts's SSE branch, which must send `content-type:
+   * text/event-stream` + CORS headers before the first `res.write()`, and
+   * therefore needs the auth outcome up front.
+   */
+  checkAuth(req: { headers?: Record<string, string> }): boolean {
+    return this.authorized(req);
+  }
+
   /** True when the request carries the configured bearer token. */
   private authorized(req: { headers?: Record<string, string> }): boolean {
     const token = this.options.authToken;
@@ -697,7 +708,7 @@ interface AgentUserMessage {
   readonly id: string;
   readonly role: 'user';
   readonly content: AgentTextBlock[];
-  readonly source: { kind: 'plugin'; plugin: string };
+  readonly source: { kind: string };
 }
 
 /** The slice of a live `Agent` we drive (mirrors `@deepseek-ai/dsh-agent` `Agent`). */
@@ -772,7 +783,7 @@ export interface DshAgentExecutorOptions {
    * absolute — pass `process.cwd()` (the profile's workspace) at wire time.
    */
   cwd: string;
-  /** `source.plugin` tag stamped on inbound messages (defaults to `'a2a'`). */
+  /** Producer tag stamped on inbound messages (defaults to `'a2a'`); serialized as `plugin:<name>` under session format v4. */
   plugin?: string;
   /** Optional static per-agent model routing forwarded to `create()`. */
   agentOptions?: { provider?: string; model?: string; maxTokens?: number };
@@ -935,7 +946,7 @@ export function createDshAgentExecutor(
       id: crypto.randomUUID(),
       role: 'user',
       content: [{ type: 'text', text: prompt }],
-      source: { kind: 'plugin', plugin },
+      source: { kind: `plugin:${plugin}` },
     });
     agent.send(userMessage, 'next-turn', true);
     // Fire the one-time naming/grouping hook after the first prompt is queued