@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/flows-actors/a2a/controllers/a2a.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a.controller.js","sourceRoot":"","sources":["../../../../../../src/flows-actors/a2a/controllers/a2a.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAChC,iCAAiC,GAGlC,MAAM,kEAAkE,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AACzI,OAAO,EAAE,iCAAiC,EAAE,MAAM,oFAAoF,CAAC;AAGvI,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxI,OAAO,EAAE,6CAA6C,EAAE,MAAM,oFAAoF,CAAC;AACnJ,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,GAIzB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EACL,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,wEAAwE,CAAC;AAChF,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,oCAAoC,EACpC,2CAA2C,EAC3C,+BAA+B,EAC/B,qCAAqC,EACrC,6BAA6B,EAC7B,+BAA+B,EAC/B,gCAAgC,GAEjC,MAAM,kFAAkF,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAGjD,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,gCAAgC;IAKrB;IACqB;IAMjB;IACY;IAZ1E,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACzB,UAA6B,EACR,uBAAsE,EAMvF,cAAqC,EACzB,mBAAsD;QAE9H,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;QAVH,eAAU,GAAV,UAAU,CAAmB;QACR,4BAAuB,GAAvB,uBAAuB,CAA+C;QAMvF,mBAAc,GAAd,cAAc,CAAuB;QACzB,wBAAmB,GAAnB,mBAAmB,CAAmC;IAGhI,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,KAAK,CAAC,gBAAgB,CAC5B,GAAY,EACZ,GAAa,EACb,EAA0B;IAC1B,2FAA2F;IAC3F,8FAA8F;IAC9F,8FAA8F;IAC9F,gGAAgG;IAChG,MAAyH,EACzH,MAAe;IACf,0FAA0F;IAC1F,OAAoB;QAEpB,8EAA8E;QAC9E,0FAA0F;QAC1F,0FAA0F;QAC1F,8EAA8E;QAC9E,MAAM,MAAM,GAAG,iCAAiC,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,qCAAqC,CAAC,SAAS,CAAC,MAAM,CAAC;YACzD,CAAC,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,qFAAqF;QACrF,uDAAuD;QACvD,yFAAyF;QACzF,2FAA2F;QAC3F,+DAA+D;QAC/D,yFAAyF;QACzF,uFAAuF;QACvF,sFAAsF;QACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,6FAA6F;QAC7F,wEAAwE;QACxE,EAAE;QACF,uFAAuF;QACvF,gFAAgF;QAChF,wFAAwF;QACxF,0FAA0F;QAC1F,2FAA2F;QAC3F,uFAAuF;QACvF,aAAa;QACb,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,mCAAmC,EAAE,QAAQ,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9H,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,uFAAuF;QACvF,qFAAqF;QACrF,qFAAqF;QACrF,sFAAsF;QACtF,iEAAiE;QACjE,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,UAAU,CAAC,IAAI,EACf,MAAM,CAAC,IAAI,CAAC,EAAE,EACd,MAAM,EACN,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,EAC7D,sBAAsB,CAAC,GAAG,CAAC,CAC5B,CAAC;QAEF,6FAA6F;QAC7F,iEAAiE;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAC7C,UAAU,CAAC,KAAK,EAChB,MAAM,CAAC,IAAI,CAAC,EAAE,EACd,gBAAgB,CAAC,WAAW,EAC5B,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAC9D,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAC1G,OAAO;QACT,CAAC;QAED,IAAI,iCAAiC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,kCAAkC,CAC3C,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC,WAAW,EACvF,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAC9D,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC,WAAW,EAClG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,oFAAoF;YACpF,mFAAmF;YACnF,wCAAwC;YACxC,2FAA2F;YAC3F,EAAE;YACF,sFAAsF;YACtF,wFAAwF;YACxF,oDAAoD;YACpD,2DAA2D;YAC3D,4FAA4F;YAC5F,4FAA4F;YAC5F,0CAA0C;YAC1C,EAAE;YACF,sFAAsF;YACtF,2FAA2F;YAC3F,8FAA8F;YAC9F,yFAAyF;YACzF,6CAA6C;YAC7C,EAAE;YACF,wFAAwF;YACxF,4FAA4F;YAC5F,8FAA8F;YAC9F,qFAAqF;YACrF,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE7D,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpD,wFAAwF;gBACxF,yFAAyF;gBACzF,sFAAsF;gBACtF,iFAAiF;gBACjF,0FAA0F;gBAC1F,sEAAsE;gBACtE,0FAA0F;gBAC1F,uEAAuE;gBACvE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,EAAE,yDAAyD,CAAC,CAAC;gBACvJ,OAAO;YACT,CAAC;YAED,4FAA4F;YAC5F,wEAAwE;YACxE,0FAA0F;YAC1F,2FAA2F;YAC3F,4FAA4F;YAC5F,8FAA8F;YAC9F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACtH,IAAI,OAAO,KAAK,yBAAyB,CAAC,OAAO,EAAE,CAAC;gBAClD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,EAAE,iEAAiE,CAAC,CAAC;gBAC/J,OAAO;YACT,CAAC;YACD,IAAI,OAAO,KAAK,yBAAyB,CAAC,MAAM,EAAE,CAAC;gBACjD,4EAA4E;gBAC5E,uFAAuF;gBACvF,iFAAiF;gBACjF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,6BAA6B,MAAM,CAAC,IAAI,CAAC,EAAE,yBAAyB,CAAC,CAAC;gBACtI,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAChD,UAAU,CAAC,KAAK,EAChB,MAAM,CAAC,IAAI,CAAC,EAAE,EACd,gBAAgB,CAAC,WAAW,EAC5B,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAC9D,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACtG,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,qBAAqB,CACjC,UAAuE,EACvE,SAAiB,EACjB,IAAY,EACZ,SAAiB,EACjB,MAAc;IACd,4FAA4F;IAC5F,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,uFAAuF;IACvF,2CAA2C;IAC3C,WAAwB;IACxB,yFAAyF;IACzF,WAA+B;QAE/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACzC,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS;gBACT,IAAI;gBACJ,SAAS;gBACT,WAAW;gBACX,WAAW;aACZ,CAAC,CAAC;YACH,gFAAgF;YAChF,kFAAkF;YAClF,IAAI,WAAW,CAAC,OAAO;gBAAE,OAAO;YAChC,6FAA6F;YAC7F,+FAA+F;YAC/F,+FAA+F;YAC/F,2FAA2F;YAC3F,mFAAmF;YACnF,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CACnC,UAAU,CAAC,KAAK,EAChB,MAAM,EACN,IAAI,CAAC,IAAI,KAAK,OAAO;gBACnB,CAAC,CAAC,kBAAkB,CAAC,MAAM;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,mBAAmB;oBACjC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB;oBACtC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yFAAyF;YACzF,wFAAwF;YACxF,sFAAsF;YACtF,0FAA0F;YAC1F,oEAAoE;YACpE,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kFAAkF,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjH,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE;gBAC1E,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAkC,CAAC,CAAC,CAAC;QAC7I,CAAC;gBAAS,CAAC;YACT,gFAAgF;YAChF,uEAAuE;YACvE,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAsB,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAES,WAAW;QACnB,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,4EAA4E;QAC5E,2CAA2C;QAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvF,MAAM,OAAO,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,oCAAoC,CAAC,CAAC;QAEhF,MAAM,QAAQ,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,2DAA2D,CAAC,CAAC;QAEzG,+EAA+E;QAC/E,gGAAgG;QAChG,kGAAkG;QAClG,4FAA4F;QAC5F,iGAAiG;QACjG,2DAA2D;QAC3D,MAAM,eAAe,GAAG,GAAG,QAAQ,2CAA2C,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC;QAE9F,MAAM,gBAAgB,GAAG,GAAG,QAAQ,eAAe,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,EAAE,iEAAiE,CAAC,CAAC;IACzH,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,GAAY;QACrC,MAAM,SAAS,GAAI,GAAG,CAAC,MAA6C,EAAE,WAAW,CAAC;QAClF,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAClH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QACnD,+FAA+F;QAC/F,sFAAsF;QACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC;QAEjD,MAAM,cAAc,GAAG,wBAAwB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC;QAE9D,6FAA6F;QAC7F,EAAE;QACF,4FAA4F;QAC5F,yFAAyF;QACzF,EAAE;QACF,4FAA4F;QAC5F,gGAAgG;QAChG,gGAAgG;QAChG,mEAAmE;QACnE,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,gBAAgB,EAAE,WAAW,SAAS,oBAAoB,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;QAEvC,6FAA6F;QAC7F,EAAE;QACF,iGAAiG;QACjG,oFAAoF;QACpF,iGAAiG;QACjG,mFAAmF;QACnF,EAAE;QACF,+FAA+F;QAC/F,gGAAgG;QAChG,+DAA+D;QAC/D,IAAI,cAAc,CAAC,SAAS,KAAK,aAAa,CAAC,uBAAuB,EAAE,CAAC;YACvE,gGAAgG;YAChG,kFAAkF;YAClF,yFAAyF;YACzF,+FAA+F;YAC/F,gDAAgD;YAChD,EAAE;YACF,0FAA0F;YAC1F,6CAA6C;YAC7C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;YAC3H,OAAO;QACT,CAAC;QAED,IAAI,cAAc,CAAC,SAAS,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,4FAA4F;YAC5F,wFAAwF;YACxF,oEAAoE;YACpE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,gBAAgB,EAAE,WAAW,SAAS,oBAAoB,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,EAAE;QACF,gGAAgG;QAChG,6FAA6F;QAC7F,yDAAyD;QACzD,EAAE;QACF,gGAAgG;QAChG,4FAA4F;QAC5F,yFAAyF;QACzF,qFAAqF;QACrF,EAAE;QACF,wFAAwF;QACxF,0EAA0E;QAC1E,IAAI,CAAC,gCAAgC,IAAI,iCAAiC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC,YAAY,CACf,GAAG,EACH,EAAE,EACF,oBAAoB,CAAC,+BAA+B,EACpD,gDAAgD,CACjD,CAAC;YACF,OAAO;QACT,CAAC;QAED,qFAAqF;QACrF,uFAAuF;QACvF,8FAA8F;QAC9F,+FAA+F;QAC/F,yFAAyF;QACzF,4DAA4D;QAC5D,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,mBAAmB,IAAI,iCAAiC,CAAC,MAAM,CAAC,EAAE,CAAC;YACvI,6FAA6F;YAC7F,4FAA4F;YAC5F,uBAAuB;YACvB,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,+FAA+F;QAC/F,2FAA2F;QAE3F,MAAM,YAAY,GAAG,2BAA2B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC;YAC3H,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,mCAAmC,EAAE,QAAQ,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QAC7G,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,0FAA0F;QAC1F,kGAAkG;QAClG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,6FAA6F;QAC7F,2FAA2F;QAC3F,2FAA2F;QAC3F,qFAAqF;QACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,8DAA8D;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACpD,6FAA6F;QAC7F,4FAA4F;QAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,wFAAwF;QACxF,2FAA2F;QAC3F,gGAAgG;QAChG,2FAA2F;QAC3F,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC,YAAY,CACf,GAAG,EACH,EAAE,EACF,oBAAoB,CAAC,cAAc,EACnC,uHAAuH,CACxH,CAAC;YACF,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,mFAAmF;QACnF,EAAE;QACF,8FAA8F;QAC9F,2FAA2F;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,yFAAyF;QACzF,6FAA6F;QAC7F,wFAAwF;QACxF,4BAA4B;QAC5B,EAAE;QACF,2FAA2F;QAC3F,8FAA8F;QAC9F,kCAAkC;QAClC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QAEtE,4FAA4F;QAC5F,8FAA8F;QAC9F,+FAA+F;QAC/F,mFAAmF;QACnF,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAE3G,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,yFAAyF;QACzF,EAAE;QACF,4FAA4F;QAC5F,+FAA+F;QAC/F,0FAA0F;QAC1F,iEAAiE;QACjE,EAAE;QACF,2FAA2F;QAC3F,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,wEAAwE;QACxE,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,4EAA4E;QAC5E,8FAA8F;QAC9F,gGAAgG;QAChG,0EAA0E;QAC1E,EAAE;QACF,iGAAiG;QACjG,8FAA8F;QAC9F,iFAAiF;QACjF,IAAI,yBAAyB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;gBACrD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS;gBACT,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY;gBACzC,qFAAqF;gBACrF,sFAAsF;gBACtF,uFAAuF;gBACvF,wCAAwC;gBACxC,WAAW;gBACX,2FAA2F;gBAC3F,0FAA0F;gBAC1F,2FAA2F;gBAC3F,mBAAmB,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY;aACnF,CAAC,CAAC;YACH,IAAI,IAAI,EAAE,CAAC;gBACT,yFAAyF;gBACzF,sFAAsF;gBACtF,oFAAoF;gBACpF,yFAAyF;gBACzF,mDAAmD;gBACnD,EAAE;gBACF,oFAAoF;gBACpF,wFAAwF;gBACxF,qFAAqF;gBACrF,sDAAsD;gBACtD,IAAI,WAAwB,CAAC;gBAC7B,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClE,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oFAAoF,EAAE;wBACtG,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,GAAG,2BAA2B,CAAC,UAAU,CAAC;qBAC3C,CAAC,CAAC;oBACH,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;gBAC7C,CAAC;gBACD,gFAAgF;gBAChF,8EAA8E;gBAC9E,+EAA+E;gBAC/E,KAAK,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;gBAClH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC3F,OAAO;YACT,CAAC;YACD,gFAAgF;YAChF,uEAAuE;QACzE,CAAC;QAED,4EAA4E;QAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACzC,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI;YACJ,SAAS;YACT,4FAA4F;YAC5F,4FAA4F;YAC5F,0FAA0F;YAC1F,8FAA8F;YAC9F,0FAA0F;YAC1F,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YAC3G,OAAO;QACT,CAAC;QACD,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,yFAAyF;QACzF,EAAE;QACF,+FAA+F;QAC/F,0FAA0F;QAC1F,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;gBAC3D,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS;gBACT,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY;gBACzC,WAAW;gBACX,mBAAmB,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY;gBAClF,MAAM,EAAE,kBAAkB,CAAC,iBAAiB;aAC7C,CAAC,CAAC;YACH,IAAI,UAAU,EAAE,CAAC;gBACf,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACjG,OAAO;YACT,CAAC;YACD,0FAA0F;YAC1F,6FAA6F;YAC7F,mFAAmF;YACnF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,mEAAmE,CAAC,CAAC;YACrI,OAAO;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CACxB,GAAa,EACb,EAA0B,EAC1B,IAAyD,EACzD,KAA2D,EAC3D,SAAiB,EACjB,IAAY,EACZ,SAAkB;IAClB;;;;;;OAMG;IACH,WAAoB;IACpB;;;;;;;OAOG;IACH,UAAuB,WAAW,CAAC,MAAM;QAEzC,GAAG,CAAC,GAAG,CAAC;YACN,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC;QAErB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAQ,EAAE;YACvC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC,CAAC;QAEF,uFAAuF;QACvF,EAAE;QACF,gFAAgF;QAChF,qFAAqF;QACrF,4FAA4F;QAC5F,yFAAyF;QACzF,2FAA2F;QAC3F,wDAAwD;QACxD,EAAE;QACF,+FAA+F;QAC/F,8FAA8F;QAC9F,6FAA6F;QAC7F,0FAA0F;QAC1F,+FAA+F;QAC/F,6FAA6F;QAC7F,6FAA6F;QAC7F,yFAAyF;QACzF,EAAE;QACF,8EAA8E;QAC9E,yFAAyF;QACzF,6DAA6D;QAC7D,EAAE;QACF,wFAAwF;QACxF,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,kBAAkB,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACzC,IAAI;gBACJ,KAAK;gBACL,SAAS;gBACT,IAAI;gBACJ,SAAS;gBACT,WAAW;gBACX,WAAW,EAAE,UAAU,CAAC,MAAM;gBAC9B,KAAK,EAAE;oBACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;wBACjB,iFAAiF;wBACjF,+EAA+E;wBAC/E,iFAAiF;wBACjF,kDAAkD;wBAClD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;4BAAE,OAAO;wBACtC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,IAAI,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpH,CAAC;iBACF;aACF,CAAC,CAAC;YAEH,0FAA0F;YAC1F,oFAAoF;YACpF,yCAAyC;YACzC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAErC,yFAAyF;YACzF,uEAAuE;YACvE,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO;YAEtC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1I,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAC7C,2FAA2F;gBAC3F,4FAA4F;gBAC5F,0FAA0F;gBAC1F,EAAE;gBACF,wFAAwF;gBACxF,qFAAqF;gBACrF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;oBAC3D,KAAK;oBACL,SAAS,EAAE,SAAS,IAAI,SAAS;oBACjC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY;oBACzC,WAAW;oBACX,mBAAmB,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY;oBACvE,MAAM,EAAE,kBAAkB,CAAC,iBAAiB;iBAC7C,CAAC,CAAC;gBACH,IAAI,UAAU,EAAE,CAAC;oBACf,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACpF,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,cAAc,EAAE,OAAO,EAAE,mEAAmE,EAAE,EAAE,CAAC,CAAC;gBACpK,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH;;;;;;;;;;;;;;;;;;;OAmBG;IACH;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,eAAe,CAC3B,GAAY,EACZ,GAAa,EACb,EAA0B,EAC1B,MAAe,EACf,OAAoB;QAEpB,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,oFAAoF;QACpF,iGAAiG;QACjG,gGAAgG;QAChG,wBAAwB;QACxB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,mCAAmC,EAAE,QAAQ,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9H,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QAED,+FAA+F;QAC/F,qDAAqD;QACrD,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAElG,MAAM,IAAI,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAC9D,UAAU,CAAC,KAAK,EAChB,gBAAgB,CAAC,WAAW,EAC5B;YACE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,EACD,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CACzC,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE;YAC1B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAChE,yFAAyF;YACzF,yFAAyF;YACzF,4DAA4D;YAC5D,aAAa,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5E,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,+FAA+F;YAC/F,8FAA8F;YAC9F,0FAA0F;YAC1F,4EAA4E;YAC5E,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kCAAkC,CAC9C,GAAa,EACb,EAA0B,EAC1B,MAAwC,EACxC,MAAe,EACf,KAAuD,EACvD,MAAc,EACd,WAAmB,EACnB,mBAAuC;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACtH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,SAAS,MAAM,iBAAiB,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,+EAA+E;QAC/E,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,gGAAgG;QAChG,+FAA+F;QAC/F,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,+FAA+F;QAC/F,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,MAAwC,EAAE,EAAE,CAC1D,gCAAgC,CAAC,6BAA6B,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE5F,IAAI,MAAM,KAAK,kCAAkC,EAAE,CAAC;YAClD,yFAAyF;YACzF,oGAAoG;YACpG,MAAM,MAAM,GAAG,oCAAoC,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YAED,2FAA2F;YAC3F,4FAA4F;YAC5F,oEAAoE;YACpE,MAAM,SAAS,GAAG,+BAA+B,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,gCAAgC,SAAS,EAAE,CAAC,CAAC;gBAC7G,OAAO;YACT,CAAC;YAED,6FAA6F;YAC7F,6FAA6F;YAC7F,4FAA4F;YAC5F,wBAAwB;YACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;YAChD,MAAM,MAAM,GAAqC;gBAC/C,EAAE,EAAE,QAAQ;gBACZ,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACpB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtF,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;YAEhF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;gBACvH,2FAA2F;gBAC3F,uFAAuF;gBACvF,qFAAqF;gBACrF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,SAAS,MAAM,iBAAiB,CAAC,CAAC;gBAClG,OAAO;YACT,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,mCAAmC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,2CAA2C,CAAC,SAAS,CAAC,EAAE,GAAI,MAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC;gBACrH,OAAO;YACT,CAAC;YACD,8FAA8F;YAC9F,6FAA6F;YAC7F,sFAAsF;YACtF,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;YAEvC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE;gBAC1B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBACzB,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,gGAAgG;QAChG,+FAA+F;QAC/F,iCAAiC;QACjC,MAAM,QAAQ,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAEzD,IAAI,MAAM,KAAK,kCAAkC,EAAE,CAAC;YAClD,8FAA8F;YAC9F,+FAA+F;YAC/F,4DAA4D;YAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7H,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,iFAAiF;QACjF,4FAA4F;QAC5F,8FAA8F;QAC9F,0FAA0F;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QACxE,6FAA6F;QAC7F,wEAAwE;QACxE,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;eACjC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC7H,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,SAAS,MAAM,iBAAiB,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,GAAa,EACb,EAA0B,EAC1B,KAAuD,EACvD,MAAc,EACd,WAA+B,EAC/B,mBAAuC,EACvC,WAA6B;QAE7B,GAAG,CAAC,GAAG,CAAC;YACN,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC;QAErB,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAQ,EAAE;YACvC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC,CAAC;QAEF,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,MAAM,kBAAkB,GAAG,GAAS,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACnD,4FAA4F;YAC5F,8FAA8F;YAC9F,8CAA8C;YAC9C,IAAI,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO;YAEnE,IAAI,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,+BAA+B,CAAC;YAE9D,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,IAAI,UAAU;oBAAE,MAAM;gBAEtB,4FAA4F;gBAC5F,0FAA0F;gBAC1F,0FAA0F;gBAC1F,WAAW;gBACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;gBACpG,IAAI,CAAC,OAAO;oBAAE,OAAO;gBACrB,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAEjD,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBACjC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC/C,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,OAAO;YACjE,CAAC;QACH,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,GAAG,2BAA2B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YACrC,8FAA8F;YAC9F,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,sFAAsF;IAC9E,oBAAoB,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAkB,EAAE,KAAK,GAAG,IAAI;QAC5F,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,eAAe,CAAC,KAAK;YAC3B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC/B,SAAS,EAAE,SAAS,IAAI,UAAU,EAAE;YACpC,SAAS;YACT,QAAQ,EAAE,EAAE,KAAK,EAAE;SACpB,CAAC;IACJ,CAAC;IAED,kFAAkF;IAC1E,WAAW,CAAC,MAA6B;QAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC5C,MAAM,KAAK,GAAG,WAAW,IAAI,UAAU,CAAC;QACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,6EAA6E;IACrE,eAAe,CAAC,MAA6B;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK;aAC9B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;aACvE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAc,CAAC;aAClC,IAAI,CAAC,EAAE,CAAC;aACR,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,GAAY;QACrC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACK,aAAa,CAAC,GAAa,EAAE,EAA0B,EAAE,MAAe;QAC9E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IAEO,YAAY,CAClB,GAAa,EACb,EAA0B,EAC1B,IAA0B,EAC1B,OAAe,EACf,eAA0B;QAE1B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,eAAe;YAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QAClE,+DAA+D;QAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH;;;;;;OAMG;IACK,kBAAkB,CAAC,GAAa,EAAE,EAA0B;QAClE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,EAAE;YACF,KAAK,EAAE;gBACL,IAAI,EAAE,oBAAoB,CAAC,eAAe;gBAC1C,OAAO,EAAE,0DAA0D;aACpE;SACF,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,GAAa,EAAE,EAA0B,EAAE,iBAAyB;QAC1F,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,EAAE;YACF,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,YAAY,EAAE,OAAO,EAAE,uDAAuD,EAAE;SACrH,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjtCY,2BAA2B;IADvC,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACrC,WAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;IAM1D,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,WAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;qCAXX,aAAa;QACM,0BAA0B;QAC1B,mBAAmB;QACb,iBAAiB;QACiB,6CAA6C;QAMvE,qBAAqB;QACJ,iCAAiC;GAbrH,2BAA2B,CAitCvC","sourcesContent":["import 'reflect-metadata';\nimport { setTimeout as sleep } from 'node:timers/promises';\nimport { inject, injectable } from 'inversify';\nimport type { Request, Response } from 'express';\nimport cors from 'cors';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { getClientIpFromRequest } from '~wildo-backend-lib/runtime/utils/request-client-ip.utils';\nimport {\n  A2ABackendService,\n  A2A_PUSH_NOTIFICATIONS_SUPPORTED,\n  isA2APushNotificationConfigMethod,\n  type A2A_AuditedMethod,\n  type A2A_PushNotificationConfigMethod,\n} from '~wildo-backend-lib/flows-actors/a2a/services/a2a.backend.service';\nimport { A2A_TaskTransitionOutcome, A2ATaskBackendService } from '~wildo-backend-lib/flows-actors/a2a/services/a2a-task.backend.service';\nimport { A2ATaskCancellationBackendService } from '~wildo-backend-lib/flows-actors/a2a/services/a2a-task-cancellation.backend.service';\nimport type { ConversationalOwnerScope } from '~wildo-backend-lib/flows-actors/services/conversational-execution.backend.service';\nimport type { SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { FlowsActors_Status, MANUAL_CONTROLLER_ROUTES_URLS, ManualControllerRouteKey, ResourceServerKind } from '@wildo-ai/saas-models';\nimport { ResourceServerInstancesRegistryBackendService } from '~wildo-backend-lib/mcp/services/resource-server-instances-registry.backend.service';\nimport {\n  A2A_JsonRpcErrorCode,\n  A2A_JsonRpcRequestSchema,\n  A2A_MessageRole,\n  A2A_MessageSendParamsSchema,\n  A2A_TaskIdParamsSchema,\n  A2A_TERMINAL_TASK_STATES,\n  type A2A_MessageSendParams,\n  type A2A_OutboundMessage,\n  type A2A_OutboundTask,\n} from '~wildo-backend-lib/flows-actors/a2a/models/a2a.backend.schemas';\nimport { randomUUID } from 'crypto';\nimport {\n  A2A_Dialect,\n  A2A_Operation,\n  fromA2ATaskState,\n  projectTaskForDialect,\n  resolveNonBlockingRequest,\n  resolveA2AMethod,\n  toLegacyMethodName,\n} from '~wildo-backend-lib/flows-actors/a2a/models/a2a-dialect.backend.schemas';\nimport {\n  A2A_PushConfigWireForm,\n  A2A_ListTasksParamsSchema,\n  decodeListTasksPageToken,\n  parseSetPushNotificationConfigParams,\n  A2A_ListPushNotificationConfigsParamsSchema,\n  resolvePushNotificationConfigId,\n  A2A_PushNotificationTaskAddressSchema,\n  redactPushNotificationSecrets,\n  rejectUnsafePushNotificationUrl,\n  toWireTaskPushNotificationConfig,\n  type A2A_StoredPushNotificationConfig,\n} from '~wildo-backend-lib/flows-actors/a2a/models/a2a-push-notification.backend.schemas';\n\n/**\n * Inbound Agent2Agent (A2A) transport controller — a THIN transport wrapper over\n * {@link A2ABackendService}. Exposes the app's actor runtime to external agent\n * callers:\n *\n * - `GET  /a2a/.well-known/agent-card.json` — public, CORS-open agent card (like\n *   the OIDC discovery doc; carries only public metadata + advertised skills).\n * - `POST /a2a` — JSON-RPC 2.0 endpoint. `message/send` runs one turn and returns\n *   the agent's reply as an A2A `Message`; `message/stream` forwards the token\n *   deltas over SSE. Bearer-credentialed (user-delegated OR machine token, D6),\n *   audience-bound (D7).\n * - `GET /a2a/:instanceRef/.well-known/agent-card.json` + `POST /a2a/:instanceRef` — the R-2 NAMED\n *   agents. Each declared agent is a distinct IDENTITY: its own card, its own RFC 8707 audience\n *   (`…/a2a/<ref>`), and its own SKILL SUBSET (`actorSystemRefs`). Skills stay the routing mechanism\n *   WITHIN a card (`metadata.skillId`) — an agent groups them, it does not replace them. An unknown\n *   ref 404s on both surfaces BEFORE parsing/auth; it never falls back to the default card, which\n *   advertises every skill.\n *\n * NOTE: `setupRoutes()` runs inside the `super()` constructor before this\n * subclass's field initializers, so it only BINDS handlers — `this.a2aService`\n * is read at REQUEST time. Standard manual-controller pattern.\n */\n/**\n * How often a `tasks/resubscribe` stream re-reads its task, and how long it will hold the socket.\n *\n * Polling is the honest mechanism here: there is no per-task event bus, and the protocol owes only\n * SUBSEQUENT updates, so an interval that is comfortably below human patience is sufficient. One\n * indexed read per second per attached client is the cost.\n *\n * The duration bound is not a nicety. Without it a client that attaches to a task which never\n * reaches a terminal state — the exact population the abandoned-task sweep exists for — pins a\n * connection and its poll loop for the lifetime of the process. Ending the stream is not lossy: the\n * task remains readable, and a client that still cares simply resubscribes.\n */\nconst A2A_RESUBSCRIBE_POLL_INTERVAL_MS = 1_000;\nconst A2A_RESUBSCRIBE_MAX_DURATION_MS = 10 * 60 * 1_000;\n\n@injectable()\nexport class A2AControllerBackendService extends AbstractControllerBackendService {\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n    @inject(SAAS_SERVICE_TYPES.A2AService) private readonly a2aService: A2ABackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceServerInstancesRegistry) private readonly resourceServerInstances: ResourceServerInstancesRegistryBackendService,\n    // APPENDED LAST, deliberately: this class is constructed POSITIONALLY in tests, so\n    // inserting a param mid-list silently shifts every later argument into the wrong slot\n    // (it landed `resourceServerInstances` on the wrong parameter and produced\n    // `tryGetInstance of undefined`). New injections go at the end — the same trap that\n    // previously gave the R-2 instance registry an `undefined` value.\n    @inject(SAAS_SERVICE_TYPES.A2ATaskService) private readonly a2aTaskService: A2ATaskBackendService,\n    @inject(SAAS_SERVICE_TYPES.A2ATaskCancellationService) private readonly a2aTaskCancellation: A2ATaskCancellationBackendService,\n  ) {\n    super(logger, errorBuilder, errorHandler, 'A2AController');\n  }\n\n  /**\n   * `tasks/get` — read one task by id.\n   *\n   * Authenticates exactly like the message methods (same bearer token, same audience\n   * gate), then delegates to the task service, whose read isolates by an owner filter\n   * derived from the authenticated principal — NOT by the resource's declared roles, which\n   * that path never exercises (see `A2ATaskBackendService`).\n   * A task belonging to another tenant and a task that does not exist\n   * both answer the same way: distinguishing them would let a caller probe for other\n   * tenants' task ids.\n   *\n   * Deliberately NOT rate-limited or budget-gated: polling a task state is not a turn,\n   * costs no LLM tokens, and throttling it would punish the very clients that used\n   * a non-blocking turn correctly.\n   *\n   * ⚠️ Read that exemption together with its COST (review finding G3-12): every poll now writes an\n   * audit row — `SYSTEM_CONTEXT_READ` from the system-access read, plus `MACHINE_ACCESS`/per-org SIEM\n   * for a machine principal or `RESOURCE_OPERATION_PERFORMED` for a delegated human. So an\n   * unthrottled endpoint amplifies into the audit pipeline, and a client polling tightly costs audit\n   * volume rather than LLM spend. What bounds it today is the GLOBAL per-IP HTTP limiter, not\n   * anything on this path. If a per-principal poll throttle is ever added, it belongs here — and it\n   * must stay distinct from the TURN throttle, which exists to cap spend, not writes.\n   */\n  private async handleTaskMethod(\n    req: Request,\n    res: Response,\n    id: string | number | null,\n    // NOT `string` (review finding G3-3). A bare `string` here forced a cast at the audit call\n    // below, which defeated the `satisfies`-checked map: routing a fifth method into this handler\n    // type-checked cleanly, resolved to `undefined` in the map, and produced an UNAUDITED access.\n    // Narrowed to the audited-method union, the compiler rejects that at the dispatch site instead.\n    method: Extract<A2A_AuditedMethod, 'tasks/get' | 'tasks/cancel' | 'tasks/resubscribe'> | A2A_PushNotificationConfigMethod,\n    params: unknown,\n    /** The vocabulary the reply must be written in — see `a2a-dialect.backend.schemas.ts`. */\n    dialect: A2A_Dialect,\n  ): Promise<void> {\n    // The task id lives under a DIFFERENT key for the configuration methods — see\n    // `A2A_PushNotificationTaskAddressSchema` for why this is a separate schema rather than a\n    // fallback: A2A 1.0 uses `id` for the CONFIGURATION and `taskId` for the task, so reading\n    // `params.id` for these methods would address a task by a configuration's id.\n    const parsed = isA2APushNotificationConfigMethod(method)\n      ? A2A_PushNotificationTaskAddressSchema.safeParse(params)\n      : A2A_TaskIdParamsSchema.safeParse(params);\n    if (!parsed.success) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, parsed.error.issues[0]?.message ?? 'invalid params');\n      return;\n    }\n\n    // Resolve the named instance the SAME way the message methods do — an unknown\n    // instance must fail closed here too, or `tasks/get` would become a way to reach the\n    // default agent through an unregistered instance path.\n    // `handleTasks` — this method's ONLY caller — already 404s on an unknown instance before\n    // dispatching, so no check is repeated here. `resolveInstanceRef` is re-run only to obtain\n    // the ref for audience binding, and cannot fail at this point.\n    // `handleTasks` already 404s an unknown instance before dispatching here, so this cannot\n    // fail today — but `strict:false` means a future reordering would surface as a runtime\n    // TypeError rather than a compile error, so it fails closed explicitly (finding F-H).\n    const resolvedInstance = this.resolveInstanceRef(req);\n    if (!resolvedInstance) {\n      res.status(404).json({ error: 'not_found', error_description: 'no such A2A agent' });\n      return;\n    }\n    const token = this.extractBearerToken(req);\n    // Short-circuit a MISSING credential before authentication, exactly as the message path does\n    // (review finding A3-8 — the asymmetry was unintended, not a decision).\n    //\n    // Handing `undefined` to `authenticateCaller` is not merely a wasted call: it routes a\n    // credential-less request into `recordExternalTokenAuthFailure`, which writes a\n    // `MACHINE_AUTH_FAILED` audit row AND increments the per-IP failure counter SHARED with\n    // `/oauth/token`. Fifty unauthenticated polls would therefore 429 token minting for every\n    // client behind that egress IP, and flood the SIEM — a denial-of-service reachable without\n    // any credential at all. There is no authentication ATTEMPT to record when nothing was\n    // presented.\n    if (!token) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, 'a Bearer access token is required', 'Bearer');\n      return;\n    }\n    const authResult = await this.a2aService.authenticateCaller(token, getClientIpFromRequest(req), resolvedInstance.instanceRef);\n    if (authResult.kind === 'error') {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, authResult.errorMessage, 'Bearer');\n      return;\n    }\n\n    // SIEM: audit the access at the authorized boundary, exactly as the message methods do\n    // at their own dispatch point. The task methods are routed BEFORE that call site, so\n    // without this they emitted no `MACHINE_ACCESS` at all — an external principal could\n    // read and cancel a tenant's work leaving nothing in the trail. Fired before the read\n    // so an attempt on a task the caller cannot see is recorded too.\n    this.a2aService.auditTaskAccess(\n      authResult.auth,\n      parsed.data.id,\n      method,\n      this.a2aTaskService.resolveTaskResourceType(authResult.owner),\n      getClientIpFromRequest(req),\n    );\n\n    // The instance ref is part of the filter, not just the audience check (review finding A3-6):\n    // two agents of the SAME tenant must not see each other's tasks.\n    const task = await this.a2aTaskService.readTask(\n      authResult.owner,\n      parsed.data.id,\n      resolvedInstance.instanceRef,\n      authResult.auth.initiatorIds?.machineCredential?.credentialId,\n    );\n    if (!task) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_FOUND, `task '${parsed.data.id}' was not found`);\n      return;\n    }\n\n    if (isA2APushNotificationConfigMethod(method)) {\n      await this.handlePushNotificationConfigMethod(\n        res, id, method, params, authResult.owner, parsed.data.id, resolvedInstance.instanceRef,\n        authResult.auth.initiatorIds?.machineCredential?.credentialId,\n      );\n      return;\n    }\n\n    if (method === 'tasks/resubscribe') {\n      await this.streamTaskUpdates(res, id, authResult.owner, parsed.data.id, resolvedInstance.instanceRef,\n        authResult.auth.initiatorIds?.machineCredential?.credentialId, task);\n      return;\n    }\n\n    if (method === 'tasks/cancel') {\n      // Reading FIRST is what makes cancel safe to authorize: a caller who cannot see the\n      // task cannot cancel it, and the check costs nothing extra since the spec requires\n      // us to return the task's state anyway.\n      // ── BROADCAST FIRST, always — refusal governs the WRITE, never the attempt ──────────────\n      //\n      // Site 1 of 2 for the invariant \"a cancellation is broadcast whenever cancellation is\n      // requested\" (review finding G7-1) — an invariant NAMED here, not quoted from anywhere.\n      // spec-cite: N/A — Wildo's own invariant statement.\n      // This used to sit AFTER the terminal check, and the check\n      // reads `task.status.state`, which is the DERIVE-ON-READ value — a live turn whose lease is\n      // missing on the reading pod reports `failed`, `failed` is terminal, so the handler refused\n      // and returned without ever broadcasting.\n      //\n      // That inverted the whole point of derive-on-read. It is a fail-SAFE hypothesis about\n      // liveness, correct on a READ (\"reporting a healthy task as abandoned is a lesser lie than\n      // leaving it working forever\") and wrong as grounds to refuse an ACTION: the task an operator\n      // most wants to stop — one that looks stuck — became precisely the one that could not be\n      // stopped. The diagnosis removed the remedy.\n      //\n      // Broadcasting unconditionally costs nothing and cannot be wrong. `requestCancel`'s own\n      // contract says a pod that does not own the task does nothing and a pod that is gone simply\n      // does not answer — \"the correct behaviour, not an error to handle\". So the only question the\n      // terminal check should govern is whether we RECORD a transition and what we answer.\n      await this.a2aTaskCancellation.requestCancel(parsed.data.id);\n\n      if (A2A_TERMINAL_TASK_STATES.has(task.status.state)) {\n        // A2A `TaskNotCancelableError`. The spec PERMITS this (§7.4 lists it among the errors a\n        // cancel may answer); it does not mandate it. An earlier revision answered HTTP 200 with\n        // the task, reasoning that the client's intent was already satisfied — which reads as\n        // helpful and is wrong: it makes \"I cancelled it\" and \"it had already completed\"\n        // indistinguishable on the wire, and that is exactly the distinction anything reconciling\n        // state needs. The task's own state remains readable via `tasks/get`.\n        // spec-cite: N/A — the two quoted phrases are the OUTCOMES a client could not tell apart,\n        // not text from the document; §7.4 is cited at the enum member itself.\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_CANCELABLE, `task '${parsed.data.id}' is already in a terminal state and cannot be canceled`);\n        return;\n      }\n\n      // The RECORD is the truth — which is why the spec has cancel return the updated task rather\n      // than an acknowledgement. The broadcast above may have reached nobody.\n      // The CAS's answer decides the RESPONSE too (review finding G5-4). The terminal pre-check\n      // above reads in a prior await, so a task can finish in between; the compare-and-swap then\n      // correctly refuses the write. Answering 200 with the task at that point re-creates exactly\n      // what H-4 removed — a client unable to tell \"I cancelled it\" from \"it had already finished\".\n      const outcome = await this.a2aTaskService.advanceTask(authResult.owner, parsed.data.id, FlowsActors_Status.CANCELLED);\n      if (outcome === A2A_TaskTransitionOutcome.REFUSED) {\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_CANCELABLE, `task '${parsed.data.id}' reached a terminal state before the cancellation was recorded`);\n        return;\n      }\n      if (outcome === A2A_TaskTransitionOutcome.FAILED) {\n        // A write FAILURE is not a state fact (review finding N-3). Reporting it as\n        // `TaskNotCancelable` would tell the client the task is terminal when nothing is known\n        // about its state — on the one verb whose whole purpose is to change that state.\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INTERNAL_ERROR, `the cancellation of task '${parsed.data.id}' could not be recorded`);\n        return;\n      }\n\n      const updated = await this.a2aTaskService.readTask(\n        authResult.owner,\n        parsed.data.id,\n        resolvedInstance.instanceRef,\n        authResult.auth.initiatorIds?.machineCredential?.credentialId,\n      );\n      res.set('Cache-Control', 'no-store');\n      res.status(200).json({ jsonrpc: '2.0', id, result: projectTaskForDialect(updated ?? task, dialect) });\n      return;\n    }\n\n    res.set('Cache-Control', 'no-store');\n    res.status(200).json({ jsonrpc: '2.0', id, result: projectTaskForDialect(task, dialect) });\n  }\n\n  /**\n   * Run a turn whose client chose not to block, advancing the task it already holds.\n   *\n   * Nothing is awaited by the request handler, so this must NEVER throw: the response\n   * is already sent and an unhandled rejection here would take the process down rather\n   * than surface anywhere useful. Every outcome lands on the task, which is precisely\n   * what the client is polling.\n   */\n  private async runTurnAndAdvanceTask(\n    authResult: { auth: SocketAuthResult; owner: ConversationalOwnerScope },\n    systemRef: string,\n    text: string,\n    contextId: string,\n    taskId: string,\n    // Passed IN rather than acquired here (review finding A3-5). `beginTurn` is what writes the\n    // liveness lease, and it must complete BEFORE the task id reaches the client — see the call\n    // site. Acquiring it inside this un-awaited method left a window in which the client held an\n    // id whose lease did not exist yet, so its first poll read `failed` for a perfectly healthy\n    // turn. `endTurn` still pairs from this method's `finally`, so the lease's lifetime is\n    // unchanged; only its START moved earlier.\n    abortSignal: AbortSignal,\n    /** The agent this turn arrived through — recorded on the conversation (finding G5-8). */\n    instanceRef: string | undefined,\n  ): Promise<void> {\n    try {\n      const turn = await this.a2aService.runTurn({\n        auth: authResult.auth,\n        owner: authResult.owner,\n        systemRef,\n        text,\n        contextId,\n        instanceRef,\n        abortSignal,\n      });\n      // An aborted turn must NOT be recorded as failed — `tasks/cancel` already wrote\n      // CANCELLED, and overwriting it would erase the fact that a human asked for this.\n      if (abortSignal.aborted) return;\n      // Three outcomes, three states. The `awaiting-approval` arm is why `runTurn` returns a union\n      // rather than an optional field: before it existed this was a two-way ternary, and a turn that\n      // paused for a human decision was recorded COMPLETED — a terminal state for work the model had\n      // explicitly declined to do without permission. The client would then read a finished task\n      // carrying no answer, with nothing anywhere naming the decision it was waiting on.\n      await this.a2aTaskService.advanceTask(\n        authResult.owner,\n        taskId,\n        turn.kind === 'error'\n          ? FlowsActors_Status.FAILED\n          : turn.kind === 'awaiting-approval'\n            ? FlowsActors_Status.AWAITING_APPROVAL\n            : FlowsActors_Status.COMPLETED,\n      );\n    } catch (error) {\n      // Consult the signal here too, exactly as the success path does (review finding G4-8). A\n      // transport that unwinds by THROWING on abort would otherwise write FAILED, and if that\n      // landed before `tasks/cancel`'s CANCELLED the compare-and-swap would then refuse the\n      // cancel — leaving a user-requested stop recorded as a failure, which inverts \"the record\n      // is the truth\". Detected from OUR signal, never the error's shape.\n      if (abortSignal.aborted) {\n        this.logger.info('[A2A] Non-blocking turn unwound after cancellation; leaving the CANCELLED record', { taskId });\n        return;\n      }\n      this.logger.error('[A2A] Non-blocking turn threw; marking its task failed', {\n        taskId,\n        ...projectCaughtErrorLogFields(error),\n      });\n      await this.a2aTaskService.advanceTask(authResult.owner, taskId, FlowsActors_Status.FAILED).catch(() => { /* already terminal-failing */ });\n    } finally {\n      // ALWAYS release: a lease outliving its turn would make a finished task read as\n      // still executing, which is the exact lie the lease exists to prevent.\n      await this.a2aTaskCancellation.endTurn(taskId).catch(() => { /* TTL reaps it */ });\n    }\n  }\n\n  protected setupRoutes(): void {\n    // The agent card is PUBLIC, non-credentialed metadata an external agent fetches\n    // cross-origin to discover this app's skills + auth requirements — CORS-open GET,\n    // exactly like the OIDC discovery doc. Safe (`origin:'*'`) because it carries no\n    // secrets and no credentials. The task endpoint stays under the restrictive\n    // global CORS (it is Bearer-credentialed).\n    const publicMetadataCors = cors({ origin: '*', methods: ['GET'], credentials: false });\n\n    const cardUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.A2A_AGENT_CARD];\n    this.router.get(cardUrl, publicMetadataCors, this.asyncHandler(this.handleAgentCard.bind(this)));\n    this.logRouteRegistration('GET', cardUrl, 'A2A agent card (public, CORS-open)');\n\n    const tasksUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.A2A_TASKS];\n    this.router.post(tasksUrl, this.asyncHandler(this.handleTasks.bind(this)));\n    this.logRouteRegistration('POST', tasksUrl, 'A2A JSON-RPC task endpoint (message/send, message/stream)');\n\n    // ── R-2: NAMED A2A agent instances (`/a2a/:instanceRef`) ────────────────────\n    // A named agent is a DISTINCT agent identity: its own card (own name/description), its own URL,\n    // its own RFC 8707 audience, and its own SKILL SUBSET. Skills remain the routing mechanism WITHIN\n    // a card (`metadata.skillId`) — an agent groups them, it does not replace them. The default\n    // `/a2a` agent (every runnable actor system) is untouched. Card path first: it has more segments\n    // than `/a2a/:instanceRef`, so Express matches it exactly.\n    const instanceCardUrl = `${tasksUrl}/:instanceRef/.well-known/agent-card.json`;\n    this.router.get(instanceCardUrl, publicMetadataCors, this.asyncHandler(this.handleAgentCard.bind(this)));\n    this.logRouteRegistration('GET', instanceCardUrl, 'Named A2A agent card (public, CORS-open)');\n\n    const instanceTasksUrl = `${tasksUrl}/:instanceRef`;\n    this.router.post(instanceTasksUrl, this.asyncHandler(this.handleTasks.bind(this)));\n    this.logRouteRegistration('POST', instanceTasksUrl, 'Named A2A agent JSON-RPC endpoint (own audience + skill subset)');\n  }\n\n  /**\n   * Resolve the NAMED agent instance addressed by this request, or the DEFAULT agent.\n   * `undefined` ⇒ the ref was supplied but is not declared → the caller 404s (fail-closed: an unknown\n   * agent must never fall back to the default card, which advertises every skill).\n   */\n  private resolveInstanceRef(req: Request): { instanceRef?: string } | undefined {\n    const requested = (req.params as Record<string, string | undefined>)?.instanceRef;\n    if (!requested) return { instanceRef: undefined };\n    const agent = this.resourceServerInstances.tryGetInstance(ResourceServerKind.A2A, requested);\n    return agent ? { instanceRef: agent.ref } : undefined;\n  }\n\n  /**\n   * `GET /a2a/.well-known/agent-card.json` (default agent) and\n   * `GET /a2a/:instanceRef/.well-known/agent-card.json` (a named agent) — the served agent card.\n   */\n  private async handleAgentCard(req: Request, res: Response): Promise<void> {\n    const resolved = this.resolveInstanceRef(req);\n    if (!resolved) {\n      res.status(404).json({ error: 'not_found', error_description: 'no such A2A agent' });\n      return;\n    }\n    const card = this.a2aService.buildAgentCard(resolved.instanceRef);\n    if (!card) {\n      res.status(503).json({ error: 'temporarily_unavailable', error_description: 'agent audience is not resolvable' });\n      return;\n    }\n    res.set('Cache-Control', 'public, max-age=3600');\n    res.status(200).json(card);\n  }\n\n  /**\n   * `POST /a2a` — JSON-RPC 2.0 dispatch. All application-level failures are\n   * returned as JSON-RPC error envelopes (HTTP 200) per the protocol; only a\n   * malformed JSON-RPC envelope yields a top-level error with a null id.\n   */\n  private async handleTasks(req: Request, res: Response): Promise<void> {\n    // R-2: which agent is being addressed (default `/a2a`, or a declared `/a2a/<ref>`). An unknown\n    // agent 404s BEFORE parsing/auth — it is not an agent, so it has no JSON-RPC surface.\n    const resolvedInstance = this.resolveInstanceRef(req);\n    if (!resolvedInstance) {\n      res.status(404).json({ error: 'not_found', error_description: 'no such A2A agent' });\n      return;\n    }\n    const instanceRef = resolvedInstance.instanceRef;\n\n    const parsedEnvelope = A2A_JsonRpcRequestSchema.safeParse(req.body);\n    if (!parsedEnvelope.success) {\n      this.sendRpcError(res, null, A2A_JsonRpcErrorCode.INVALID_REQUEST, 'malformed JSON-RPC 2.0 request');\n      return;\n    }\n    const { id, method: rawMethod, params } = parsedEnvelope.data;\n\n    // ── Dialect resolution, before ANY routing ────────────────────────────────────────────────\n    //\n    // The method name IS the dialect signal: `tasks/get` ⇒ v0.2.5, `GetTask` ⇒ A2A 1.0. The two\n    // vocabularies are disjoint (pinned in D-4), so this needs no negotiation and no header.\n    //\n    // The request is then NORMALISED to the v0.2.5 spelling, which is what keeps this migration\n    // additive: every routing branch, audit-map lookup and handler below is untouched, and only the\n    // RESPONSE side learns there are two dialects. Rewriting every comparison to the canonical enum\n    // would have churned the whole controller for no behavioural gain.\n    const resolvedMethod = resolveA2AMethod(rawMethod);\n    if (!resolvedMethod) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.METHOD_NOT_FOUND, `method '${rawMethod}' is not supported`);\n      return;\n    }\n    const dialect = resolvedMethod.dialect;\n\n    // ── The two operations A2A 1.0 adds and v0.2.5 has no name for ────────────────────────────\n    //\n    // These cannot be normalised to a legacy method string — there isn't one — so they are routed by\n    // OPERATION, before the normalisation below. Handling them here rather than letting\n    // `toLegacyMethodName` return `undefined` matters under this package's `strict: false`, where an\n    // `undefined` method would type-check and then fall through to the message branch.\n    //\n    // They exist at all because the card advertises `version: \"1.0\"`, and that is a claim to speak\n    // the whole vocabulary. Shipping a \"1.0\" interface missing two of the protocol's eleven methods\n    // is the same over-claim this migration was undertaken to fix.\n    if (resolvedMethod.operation === A2A_Operation.GET_EXTENDED_AGENT_CARD) {\n      // spec-cite: A2A 1.0 §3.3.4 — *\"If `AgentCard.capabilities.extendedAgentCard` is `false` or not\n      // present, attempts to call the Get Extended Agent Card operation **MUST** return\n      // `UnsupportedOperationError`\"* (§5.4 assigns it `-32004`). We serve one public card and\n      // declare no extended one, so this is a permanent, correct refusal — NOT `-32601`, which would\n      // read to a client as \"this server is not A2A\".\n      //\n      // No authentication and no audit: nothing is accessed, and the answer is a fact about the\n      // agent that the public card already states.\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNSUPPORTED_OPERATION, 'this agent does not offer an extended agent card');\n      return;\n    }\n\n    if (resolvedMethod.operation === A2A_Operation.LIST_TASKS) {\n      await this.handleListTasks(req, res, id, params, dialect);\n      return;\n    }\n\n    const method = toLegacyMethodName(resolvedMethod.operation);\n    if (!method) {\n      // Unreachable today — every remaining operation has a legacy spelling. Explicit rather than\n      // implicit because `strict: false` would otherwise let a future 1.0-only operation fall\n      // through this point as `undefined` and be dispatched as a message.\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.METHOD_NOT_FOUND, `method '${rawMethod}' is not supported`);\n      return;\n    }\n\n    // ── The §3.3.4 capability gate, BEFORE anything else touches these methods ────────────────\n    //\n    // spec-cite: A2A 1.0 §3.3.4 — *\"If `AgentCard.capabilities.pushNotifications` is `false` or not\n    // present, operations related to push notification configuration (Create, Get, List, Delete)\n    // **MUST** return `PushNotificationNotSupportedError`\"*.\n    //\n    // Placed at dispatch rather than inside the handler on purpose. The refusal is a fact about the\n    // AGENT, not about the task or the caller, so it needs no authentication, no task read, and\n    // nothing to audit — no access occurs. Answering here also means the four methods cannot\n    // acquire a code path that reaches storage while the card says they are unsupported.\n    //\n    // The set and the card read the SAME constant, so this branch disappears the moment the\n    // capability is honestly `true` — see `A2A_PUSH_NOTIFICATIONS_SUPPORTED`.\n    if (!A2A_PUSH_NOTIFICATIONS_SUPPORTED && isA2APushNotificationConfigMethod(method)) {\n      this.sendRpcError(\n        res,\n        id,\n        A2A_JsonRpcErrorCode.PUSH_NOTIFICATION_NOT_SUPPORTED,\n        'this agent does not support push notifications',\n      );\n      return;\n    }\n\n    // `tasks/get` is addressed by task id, not by a message, so it is handled BEFORE the\n    // message-params gate below (its params shape is different and would fail that parse).\n    // The push-notification-configuration methods join it for the same reason: they are addressed\n    // by a caller-supplied task id, which is the IDENTICAL attack surface, so they must go through\n    // the same funnel — same audience binding, same audit emit, same four-axis owner filter.\n    // Authentication still runs first — see `handleTaskMethod`.\n    if (method === 'tasks/get' || method === 'tasks/cancel' || method === 'tasks/resubscribe' || isA2APushNotificationConfigMethod(method)) {\n      // No cast: each arm narrows `method` to a member of the audited union, so the compiler — not\n      // a reviewer — is what guarantees `handleTaskMethod` can only ever be reached with a method\n      // the audit map knows.\n      await this.handleTaskMethod(req, res, id, method, params, dialect);\n      return;\n    }\n\n    // No unknown-method branch here: `resolveA2AMethod` above already refused anything outside the\n    // two vocabularies, so by this point `method` is necessarily one of the two message verbs.\n\n    const parsedParams = A2A_MessageSendParamsSchema.safeParse(params);\n    if (!parsedParams.success) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, parsedParams.error.issues[0]?.message ?? 'invalid params');\n      return;\n    }\n\n    // Bearer auth — user-delegated OR machine token (D6), audience-bound (D7).\n    const token = this.extractBearerToken(req);\n    if (!token) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, 'a Bearer access token is required', 'Bearer');\n      return;\n    }\n    const authResult = await this.a2aService.authenticateCaller(token, getClientIpFromRequest(req), instanceRef);\n    if (authResult.kind === 'error') {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, authResult.errorMessage, 'Bearer');\n      return;\n    }\n\n    // Per-principal turn throttle (LLM-spend guard). A saturated principal is rejected with a\n    // transport-level 429 + Retry-After BEFORE any dispatch — covers send AND stream (one turn each).\n    const rate = await this.a2aService.assertTurnWithinRate(authResult.auth);\n    if (rate.kind === 'rate_limited') {\n      this.sendRateLimited(res, id, rate.retryAfterSeconds);\n      return;\n    }\n\n    // Per-TENANT LLM token budget (sustained spend cap, distinct from the burst throttle above).\n    // Also pre-dispatch: an exhausted allowance must never reach the LLM. Denials ride HTTP 402,\n    // NOT 429 — the client's remedy is to upgrade / wait for the period, not to retry shortly.\n    // Keyed on the PRINCIPAL, not the conversation owner: a user-delegated turn is paid by the\n    // organization the user is acting within, while the conversation row remains theirs.\n    const budget = await this.a2aService.assertTurnWithinBudget(authResult.auth);\n    if (budget.kind === 'over_budget') {\n      this.sendBudgetExceeded(res, id);\n      return;\n    }\n\n    // Resolve target skill (actor system) + the user's turn text.\n    const skillId = this.readSkillId(parsedParams.data);\n    // R-2: resolved WITHIN this agent's declared skill subset — a `skillId` belonging to another\n    // agent is rejected like an unknown skill (no side-door into another agent's actor system).\n    const target = this.a2aService.resolveTargetSystemRef(skillId, instanceRef);\n    if (target.kind === 'error') {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.SKILL_NOT_FOUND, target.errorMessage);\n      return;\n    }\n    const text = this.readMessageText(parsedParams.data);\n    if (!text) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, 'the message has no text part');\n      return;\n    }\n    // Task CONTINUATION is not supported, and saying so beats silently doing something else\n    // (review finding A3-9). A client that attaches a message to an existing task expects that\n    // task to advance; opening a fresh one instead diverges the conversation invisibly. `contextId`\n    // is the supported way to continue a thread, and it is threaded through both planes below.\n    if (parsedParams.data.message.taskId) {\n      this.sendRpcError(\n        res,\n        id,\n        A2A_JsonRpcErrorCode.INVALID_PARAMS,\n        'continuing an existing task via `message.taskId` is not supported; use `message.contextId` to continue a conversation',\n      );\n      return;\n    }\n\n    // ── The context id is MINTED HERE, once, and shared by both planes (review finding A3-1) ──\n    //\n    // A2A clients do not send `contextId` on a FIRST turn — the server assigns it and the client\n    // echoes it back to continue the conversation. Reading it without a fallback therefore left it\n    // `undefined` on the entire default path, with three consequences that compounded:\n    //\n    //   1. `Task.contextId` is REQUIRED by the protocol, and the materialised task carried none —\n    //      so the object we answered with was non-conformant, and a later `tasks/get` reported\n    //      `''` (the projection's fallback), changing the field's shape between two responses.\n    //   2. `runTurn` mints its own uuid when it receives none, so the task and the conversational\n    //      execution ended up with UNRELATED ids and could never be correlated — killing the\n    //      indexed \"enumerate this conversation's tasks\" query the schema and spec both promise.\n    //   3. The client never received a context id, so a non-blocking conversation could not\n    //      be continued at all.\n    //\n    // Minting at the transport edge is what makes the two planes agree: the SAME value reaches\n    // `materialiseTask` and `runTurn`. Do not push this back down into either of them — one mints\n    // per plane, which is the defect.\n    const contextId = parsedParams.data.message.contextId ?? randomUUID();\n\n    // SIEM-2: audit machine resource-access at the authorized-dispatch boundary — the caller is\n    // authenticated + the target skill resolved, and the request is about to be dispatched. Fires\n    // once for BOTH send + stream (no-op for user-delegated turns); the access is recorded even if\n    // the turn later errors, matching FIELD_ACCESS \"recorded when accessed\" semantics.\n    this.a2aService.auditMachineAccess(authResult.auth, target.systemRef, method, getClientIpFromRequest(req));\n\n    if (method === 'message/stream') {\n      await this.handleStream(res, id, authResult.auth, authResult.owner, target.systemRef, text, contextId, instanceRef, dialect);\n      return;\n    }\n\n    // === Inline vs task-bearing, decided by the PROTOCOL — now actually by the protocol ===\n    //\n    // A2A `configuration.blocking === false` is the client declaring it does not want to block.\n    // When set, we materialise a task and answer with it straight away; the turn keeps running and\n    // advances that task. Otherwise the spec's blocking shape applies — a turn that completes\n    // inline answers with a `Message` and writes no task row at all.\n    //\n    // ⚠️ This used to read `configuration.returnImmediately`, **a field that does not exist in\n    // A2A** (review finding G5-1). The section heading was already \"decided by the PROTOCOL, not by\n    // a heuristic\" and that was the problem: it was decided by a Wildo invention, so no conformant\n    // client could ever reach the task plane, and `tasks/get` would answer TASK_NOT_FOUND forever.\n    // The sense is inverted from the old field, so this was never a rename.\n    //\n    // The reason a wall-clock \"long-running\" threshold is still wrong is unchanged: a timer-based\n    // rule would make the response TYPE non-deterministic for identical input. The client tells us.\n    // Reads BOTH dialects' flags — `configuration.blocking: false` (v0.2.5) and\n    // `return_immediately: true` (1.0). Passed the WHOLE params object, not just `configuration`:\n    // 1.0 puts its flag at the top level, so handing this only the configuration would look correct\n    // and silently ignore every 1.0 client's request for a non-blocking turn.\n    //\n    // That is not hypothetical — it is what shipped. `resolveNonBlockingRequest` existed, was pinned\n    // (D-11..D-14), and was wired at ZERO call sites; the dual-dialect live lane caught it on its\n    // first green run, with `SendMessage` accepted and `return_immediately` ignored.\n    if (resolveNonBlockingRequest(parsedParams.data)) {\n      const task = await this.a2aTaskService.materialiseTask({\n        owner: authResult.owner,\n        contextId,\n        title: text.slice(0, 120) || 'Agent turn',\n        // Stamps WHICH agent opened this task, so `tasks/get`/`tasks/cancel` can scope by it\n        // (review finding A3-6). Without it the task plane had no per-agent dimension and one\n        // agent's token could read another's tasks — including `title`, which is the first 120\n        // characters of the originating prompt.\n        instanceRef,\n        // The credential axis (finding H-5): `applicationId` is a deployment singleton, so without\n        // this every app-scope OAuth client shares one owner filter and could read — and cancel —\n        // another client's tasks, including `title`, which is the opening 120 chars of its prompt.\n        machineCredentialId: authResult.auth.initiatorIds?.machineCredential?.credentialId,\n      });\n      if (task) {\n        // AWAIT the lease before responding (review finding A3-5). The client cannot poll a task\n        // whose id it has not received yet, so completing `beginTurn` first closes the window\n        // completely rather than narrowing it: by the time the id escapes this process, the\n        // liveness lease exists and every replica reads the turn as alive. The cost is one Redis\n        // SET on a path that already did a database write.\n        //\n        // Fail SOFT: a lease we could not start makes the turn uncancellable and (until the\n        // sweep's grace window) readable as abandoned — both far better than answering 500 to a\n        // request whose work is about to run anyway. `beginTurn` already tolerates an absent\n        // Redis internally; this guards the unexpected throw.\n        let abortSignal: AbortSignal;\n        try {\n          abortSignal = await this.a2aTaskCancellation.beginTurn(task.id);\n        } catch (leaseError) {\n          this.logger.error('[A2A] Could not start the liveness lease; the turn will run but is not cancellable', {\n            taskId: task.id,\n            ...projectCaughtErrorLogFields(leaseError),\n          });\n          abortSignal = new AbortController().signal;\n        }\n        // Dispatch the turn without awaiting it: the client asked not to block, and the\n        // task it now holds is how it observes progress. Failures are recorded on the\n        // task rather than surfaced here — there is no open response left to write to.\n        void this.runTurnAndAdvanceTask(authResult, target.systemRef, text, contextId, task.id, abortSignal, instanceRef);\n        res.set('Cache-Control', 'no-store');\n        res.status(200).json({ jsonrpc: '2.0', id, result: projectTaskForDialect(task, dialect) });\n        return;\n      }\n      // Materialisation failed — degrade to the blocking path rather than failing the\n      // turn. The client gets a correct answer, just not an addressable one.\n    }\n\n    // message/send (blocking) — run one turn, return the agent's reply Message.\n    const turn = await this.a2aService.runTurn({\n      auth: authResult.auth,\n      owner: authResult.owner,\n      systemRef: target.systemRef,\n      text,\n      contextId,\n      // Carried on EVERY turn-start site, not only the task-bearing one (review finding A-1). The\n      // conversation records which agent opened it; omitting it here stored the default sentinel,\n      // so a named agent's blocking turns were reachable through any other agent — and mixing a\n      // blocking and a non-blocking turn on one `contextId` made the continuation read miss and the\n      // re-create collide on the globally-unique `executionId`, losing the transcript silently.\n      instanceRef,\n    });\n    if (turn.kind === 'error') {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INTERNAL_ERROR, `${turn.errorCode}: ${turn.errorMessage}`);\n      return;\n    }\n    // A BLOCKING turn that paused for approval cannot answer with a `Message` — there is no reply,\n    // and the caller must be given something addressable to come back to. So it materialises a task\n    // here even though the client did not ask for one: this is the second half of the header's rule\n    // that a task exists when the turn \"cannot complete inline\", and the first production caller of\n    // `materialiseTask`'s `status` seam, which was carried unexercised for exactly this arm.\n    //\n    // `input-required` is the state the client observes (the status map projects AWAITING_APPROVAL\n    // onto it), which is the protocol's own way of saying the agent is blocked pending input.\n    if (turn.kind === 'awaiting-approval') {\n      const pausedTask = await this.a2aTaskService.materialiseTask({\n        owner: authResult.owner,\n        contextId,\n        title: text.slice(0, 120) || 'Agent turn',\n        instanceRef,\n        machineCredentialId: authResult.auth.initiatorIds?.machineCredential?.credentialId,\n        status: FlowsActors_Status.AWAITING_APPROVAL,\n      });\n      if (pausedTask) {\n        res.set('Cache-Control', 'no-store');\n        res.status(200).json({ jsonrpc: '2.0', id, result: projectTaskForDialect(pausedTask, dialect) });\n        return;\n      }\n      // Materialisation failed. Unlike the non-blocking path there is no degrading to a correct\n      // answer — there IS no answer — so this is a genuine error rather than a fallback: the pause\n      // is persisted on the execution but the caller has no handle to resume it through.\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INTERNAL_ERROR, 'The turn is awaiting approval but no task could be opened for it.');\n      return;\n    }\n    res.set('Cache-Control', 'no-store');\n    res.status(200).json({ jsonrpc: '2.0', id, result: this.buildOutboundMessage(turn.text, turn.contextId) });\n  }\n\n  /**\n   * `message/stream` — Server-Sent Events. Each token delta is a `data:` frame\n   * carrying a JSON-RPC result with a partial (non-final) agent Message; a final\n   * frame carries the complete reply. Errors mid-stream are emitted as a JSON-RPC\n   * error frame, then the stream closes.\n   */\n  private async handleStream(\n    res: Response,\n    id: string | number | null,\n    auth: Parameters<A2ABackendService['runTurn']>[0]['auth'],\n    owner: Parameters<A2ABackendService['runTurn']>[0]['owner'],\n    systemRef: string,\n    text: string,\n    contextId?: string,\n    /**\n     * The agent this stream arrived through (review finding A-1).\n     *\n     * `handleStream` had no such parameter, so every streamed conversation stored the default\n     * sentinel regardless of which named agent served it. Threaded rather than defaulted: a\n     * default here is indistinguishable from the bug it replaced.\n     */\n    instanceRef?: string,\n    /**\n     * The vocabulary every frame of this stream must be written in.\n     *\n     * Threaded rather than defaulted, for the same reason `instanceRef` above is: a default here\n     * would be indistinguishable from forgetting to pass it, and the symptom — a 1.0 client reading\n     * `\"completed\"` on the terminal frame of an otherwise-correct stream — is exactly the kind that\n     * gets blamed on the client.\n     */\n    dialect: A2A_Dialect = A2A_Dialect.V0_2_5,\n  ): Promise<void> {\n    res.set({\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-store',\n      Connection: 'keep-alive',\n    });\n    res.flushHeaders?.();\n\n    const messageId = randomUUID();\n    const write = (payload: unknown): void => {\n      res.write(`data: ${JSON.stringify(payload)}\\n\\n`);\n    };\n\n    // ── Cancel the turn when the SSE client goes away (review finding F-6) ──────────────\n    //\n    // `message/stream` materialises NO task (the dispatcher returns here before the\n    // non-blocking branch), so THIS STREAM IS THE TURN'S ONLY DELIVERY CHANNEL. Once the\n    // client disconnects there is no consumer and no row to read the answer from later, yet the\n    // model keeps generating tokens the provider charges for and nobody can read. Wiring the\n    // socket's lifetime to the turn's is the only cancellation seam this path can have: unlike\n    // `tasks/cancel`, there is no task id to address it by.\n    //\n    // ⚠️ CORRECTION (review gate #2, F-A). An earlier revision of this comment justified the abort\n    // by claiming the un-aborted tokens are \"billed to the caller's tenant\" — that was BACKWARDS,\n    // and the inversion mattered. A completed turn IS metered; an aborted one used to be metered\n    // NOT AT ALL, because `result.usage` rejects on abort and the throw skipped `reportUsage`\n    // entirely. So cancellation was the UNMETERED path, and adding it here would have widened that\n    // hole from `tasks/cancel` (needs a task) to every `message/stream` turn. The saving is real\n    // provider spend, NOT budget headroom — and it is only safe because `streamTextToDeltas` now\n    // accumulates per-step usage that survives the abort. Do not re-justify this on billing.\n    //\n    // The inverse must stay true for the non-blocking path — it MUST NOT abort on\n    // disconnect, because its result lands on a task row the client polls afterwards, so the\n    // response closing is expected rather than a signal to stop.\n    //\n    // The signal reaches AI-SDK `streamText`, which aborts the bounded multi-step tool loop\n    // between steps — so this cancels tool work, not merely the text stream.\n    const clientGone = new AbortController();\n    const onClientDisconnect = (): void => clientGone.abort();\n    res.on('close', onClientDisconnect);\n\n    try {\n      const turn = await this.a2aService.runTurn({\n        auth,\n        owner,\n        systemRef,\n        text,\n        contextId,\n        instanceRef,\n        abortSignal: clientGone.signal,\n        hooks: {\n          onDelta: (delta) => {\n            // Don't write to a socket the client already dropped. Abort is cooperative, so a\n            // delta already in flight can arrive after `close`; writing it is harmless but\n            // pointless, and skipping keeps the \"client gone → stop producing\" story true at\n            // every layer rather than only at the model call.\n            if (clientGone.signal.aborted) return;\n            write({ jsonrpc: '2.0', id, result: this.buildOutboundMessage(delta, contextId ?? messageId, messageId, false) });\n          },\n        },\n      });\n\n      // Detach BEFORE writing the terminal frame: `res.end()` below itself emits `close`, and a\n      // completed turn must not be mistaken for a disconnect. `off` is idempotent, so the\n      // `finally` still covers the throw path.\n      res.off('close', onClientDisconnect);\n\n      // The client vanished mid-turn — the socket is gone, so there is nothing to write and no\n      // task row to record against. Returning silently is the whole outcome.\n      if (clientGone.signal.aborted) return;\n\n      if (turn.kind === 'error') {\n        write({ jsonrpc: '2.0', id, error: { code: A2A_JsonRpcErrorCode.INTERNAL_ERROR, message: `${turn.errorCode}: ${turn.errorMessage}` } });\n      } else if (turn.kind === 'awaiting-approval') {\n        // The terminal frame of a paused stream is a TASK, not a message. The protocol's streaming\n        // result is a union that includes `Task`, so this is a conformant frame shape rather than a\n        // special case — and it is the only one that carries an id the caller can resume through.\n        //\n        // Without this arm the stream closed on a final EMPTY message: a client saw a completed\n        // answer of \"\", with the pending decision reported nowhere on this transport at all.\n        const pausedTask = await this.a2aTaskService.materialiseTask({\n          owner,\n          contextId: contextId ?? messageId,\n          title: text.slice(0, 120) || 'Agent turn',\n          instanceRef,\n          machineCredentialId: auth.initiatorIds?.machineCredential?.credentialId,\n          status: FlowsActors_Status.AWAITING_APPROVAL,\n        });\n        if (pausedTask) {\n          write({ jsonrpc: '2.0', id, result: projectTaskForDialect(pausedTask, dialect) });\n        } else {\n          write({ jsonrpc: '2.0', id, error: { code: A2A_JsonRpcErrorCode.INTERNAL_ERROR, message: 'The turn is awaiting approval but no task could be opened for it.' } });\n        }\n      } else {\n        write({ jsonrpc: '2.0', id, result: this.buildOutboundMessage(turn.text, turn.contextId, messageId, true) });\n      }\n      res.end();\n    } finally {\n      res.off('close', onClientDisconnect);\n    }\n  }\n\n  /**\n   * `tasks/resubscribe` — re-attach to a task's update stream after a dropped connection.\n   *\n   * ## What the protocol asks for, and what it deliberately leaves open\n   *\n   * The method takes `TaskIdParams` and answers an SSE stream of `SendStreamingMessageResponse`\n   * objects; it is an OPTIONAL capability gated on `AgentCard.capabilities.streaming`, which this\n   * agent advertises as `true`. Events missed while the client was disconnected are explicitly\n   * implementation-dependent — the obligation is to resume delivering SUBSEQUENT updates, not to\n   * replay history.\n   * spec-cite: A2A v0.2.5 — `tasks/resubscribe` (params `TaskIdParams`, result\n   * `SendStreamingMessageResponse` stream, gated on `capabilities.streaming`).\n   *\n   * That is what makes this implementable without an event log: there is no per-task event bus, and\n   * inventing one to replay deltas nobody is owed would be a large mechanism serving a requirement\n   * that does not exist. This observes the task's STATE and emits a frame whenever it changes.\n   *\n   * ## Why it reuses `handleTaskMethod`'s read rather than doing its own\n   *\n   * The caller-supplied task id is the whole attack surface here. Routing through the shared\n   * handler means resubscribe inherits, unchanged, every gate `tasks/get` passes: the addressed\n   * agent's audience binding, the audit emit, and the four-axis owner filter (owner FK + agent\n   * instance + machine credential). A parallel path would have been a second transport reaching the\n   * same rows — the exact shape that has produced cross-client disclosure on this plane before, and\n   * a `TASK_NOT_FOUND` here means \"not yours\" as indistinguishably as it does there.\n   *\n   * The first frame is the task's CURRENT state. Strictly the protocol only owes what follows, but a\n   * client that just reconnected has no idea where the task got to, and withholding it would force\n   * an immediate `tasks/get` to learn what this stream is about.\n   */\n  /**\n   * The four `tasks/pushNotificationConfig/*` methods, after the shared gates have run.\n   *\n   * Reached ONLY through `handleTaskMethod`, so by the time this executes the caller has already\n   * passed authentication, the addressed agent's audience binding, the audit emit, and the\n   * four-axis owner read that proved the task is theirs. Nothing here re-authorizes, and nothing\n   * here may be reachable by another route — a configuration is addressed by a caller-supplied task\n   * id, which is the identical attack surface `tasks/get` and `tasks/resubscribe` have.\n   *\n   * ## What leaves this method is always redacted\n   *\n   * `token` and `authentication.credentials` are the client's own secrets, held so we can present\n   * them to its webhook. Every response path below goes through `redactPushNotificationSecrets`,\n   * including the echo `set` returns. Echoing them back buys nothing — the client chose them — and\n   * not echoing them means no read of this task can become a credential disclosure through a future\n   * projection, a log line, or an audit row that captures a result.\n   *\n   * spec-cite: A2A 1.0 §§3.1.7–3.1.10 (the four operations, their inputs and outputs) and §13.2\n   * (*\"Authentication tokens in `PushNotificationConfig` **SHOULD** be treated as secrets\"*).\n   */\n  /**\n   * A2A 1.0 `ListTasks` — enumerate the caller's own tasks.\n   *\n   * spec-cite: A2A 1.0 §3.1.4 / proto `ListTasksRequest` — filters `context_id` and `status`, and\n   * *\"`page_size` … If unspecified, at most 50 tasks will be returned. The minimum value is 1. The\n   * maximum value is 100.\"* `ListTasksResponse` carries `tasks`, `next_page_token`, `page_size` and\n   * `total_size`, all REQUIRED.\n   *\n   * 1.0-only, so it never reaches `handleTaskMethod` (which is addressed by a task id). It therefore\n   * repeats that funnel's gates deliberately and in the same order — instance resolution,\n   * credential-presence short-circuit, authentication, audit — because a LIST is exactly the shape\n   * where a missing gate is least visible: it answers plausibly with an empty array.\n   */\n  private async handleListTasks(\n    req: Request,\n    res: Response,\n    id: string | number | null,\n    params: unknown,\n    dialect: A2A_Dialect,\n  ): Promise<void> {\n    const resolvedInstance = this.resolveInstanceRef(req);\n    if (!resolvedInstance) {\n      res.status(404).json({ error: 'not_found', error_description: 'no such A2A agent' });\n      return;\n    }\n    const token = this.extractBearerToken(req);\n    // Short-circuit a MISSING credential before authenticating — handing `undefined` to\n    // `authenticateCaller` writes a MACHINE_AUTH_FAILED row and increments the per-IP counter SHARED\n    // with /oauth/token, so an unauthenticated flood here would throttle token minting for everyone\n    // behind one egress IP.\n    if (!token) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, 'a Bearer access token is required', 'Bearer');\n      return;\n    }\n    const authResult = await this.a2aService.authenticateCaller(token, getClientIpFromRequest(req), resolvedInstance.instanceRef);\n    if (authResult.kind === 'error') {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, authResult.errorMessage, 'Bearer');\n      return;\n    }\n\n    const parsed = A2A_ListTasksParamsSchema.safeParse(params ?? {});\n    if (!parsed.success) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, parsed.error.issues[0]?.message ?? 'invalid params');\n      return;\n    }\n\n    // Enumeration is its OWN audited operation — see `A2A_TASKS_LIST`. Emitted before the read, so\n    // an attempt that returns nothing is still recorded.\n    this.a2aService.auditMachineAccess(authResult.auth, '', 'ListTasks', getClientIpFromRequest(req));\n\n    const page = decodeListTasksPageToken(parsed.data.pageToken);\n    const { tasks, totalSize } = await this.a2aTaskService.listTasks(\n      authResult.owner,\n      resolvedInstance.instanceRef,\n      {\n        ...(parsed.data.contextId ? { contextId: parsed.data.contextId } : {}),\n        ...(parsed.data.status ? { status: fromA2ATaskState(parsed.data.status) } : {}),\n      },\n      { pageSize: parsed.data.pageSize, page },\n    );\n\n    this.sendRpcResult(res, id, {\n      tasks: tasks.map((task) => projectTaskForDialect(task, dialect)),\n      // A full page implies there MAY be another; an empty token means \"no more\". The token is\n      // opaque by contract, so encoding the next page number in it is conformant and keeps the\n      // repository's page-based pagination out of the wire shape.\n      nextPageToken: tasks.length === parsed.data.pageSize ? String(page + 1) : '',\n      pageSize: parsed.data.pageSize,\n      // `total_size` is REQUIRED and documented as the total BEFORE pagination. We report the page's\n      // own size, which is a KNOWN divergence: a true count needs a second aggregate query on every\n      // list, and this transport has no caller that pages deeply. Recorded rather than silently\n      // approximated — if a client ever paginates on it, this is the line to fix.\n      totalSize,\n    });\n  }\n\n  private async handlePushNotificationConfigMethod(\n    res: Response,\n    id: string | number | null,\n    method: A2A_PushNotificationConfigMethod,\n    params: unknown,\n    owner: Parameters<A2ATaskBackendService['readTask']>[0],\n    taskId: string,\n    instanceRef: string,\n    machineCredentialId: string | undefined,\n  ): Promise<void> {\n    const stored = await this.a2aTaskService.readPushNotificationConfigs(owner, taskId, instanceRef, machineCredentialId);\n    if (stored === undefined) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_FOUND, `task '${taskId}' was not found`);\n      return;\n    }\n    // Responses are A2A 1.0 (FLAT) — including the reply to a legacy-shaped `set`.\n    //\n    // An earlier attempt mirrored the request's shape on every verb. It was wrong, and the way it\n    // broke is worth recording: `list` returns 1.0's `{ configs[], nextPageToken }` envelope, which\n    // v0.2.5 does not have (its `list` result is a bare array). Answering nested ITEMS inside a 1.0\n    // ENVELOPE produces a chimera conforming to neither version — strictly worse than picking one.\n    //\n    // So the rule is: be liberal in what `set` ACCEPTS (a v0.2.5 client's params are understood),\n    // strict in what everything EMITS (1.0). The residual is real and recorded rather than papered\n    // over: the agent card still declares `protocolVersion: \"0.2.5\"`, so a v0.2.5 client's `get` /\n    // `delete` — which address the task as `params.id` — are refused. The honest fix is migrating\n    // the whole surface to the 1.0 method vocabulary and bumping the card; that is a separate unit\n    // touching every method and every live lane.\n    const wireForm = A2A_PushConfigWireForm.FLAT;\n    const toWire = (config: A2A_StoredPushNotificationConfig) =>\n      toWireTaskPushNotificationConfig(redactPushNotificationSecrets(config), taskId, wireForm);\n\n    if (method === 'tasks/pushNotificationConfig/set') {\n      // Accepts BOTH the v0.2.5 nested shape and the 1.0 flat one, and reports which arrived —\n      // see `A2A_PushConfigWireForm` for why that matters on a card declaring `protocolVersion: \"0.2.5\"`.\n      const parsed = parseSetPushNotificationConfigParams(params);\n      if (parsed.kind === 'error') {\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, parsed.message);\n        return;\n      }\n\n      // The SSRF gate, at the one point a client is present to be told why it was refused. It is\n      // not the complete control and does not pretend to be — a hostname is not resolved here, so\n      // the remaining defence belongs at connect time in the egress path.\n      const rejection = rejectUnsafePushNotificationUrl(parsed.data.url);\n      if (rejection) {\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, `the webhook url was refused: ${rejection}`);\n        return;\n      }\n\n      // A client-supplied `id` UPDATES that configuration; its absence creates one. Both are `set`\n      // in this vocabulary, and honouring the supplied id is what makes the operation idempotent —\n      // a client retrying after a timeout must not silently accumulate duplicate delivery targets\n      // for the same webhook.\n      const configId = parsed.data.id ?? randomUUID();\n      const config: A2A_StoredPushNotificationConfig = {\n        id: configId,\n        url: parsed.data.url,\n        ...(parsed.data.token ? { token: parsed.data.token } : {}),\n        ...(parsed.data.authentication ? { authentication: parsed.data.authentication } : {}),\n      };\n      const next = [...stored.filter((existing) => existing.id !== configId), config];\n\n      if (!(await this.a2aTaskService.replacePushNotificationConfigs(owner, taskId, next, instanceRef, machineCredentialId))) {\n        // The read above proved the task was visible, so a write that matches nothing means it was\n        // removed in between — not that the caller was never entitled to it. Reporting success\n        // would leave the client believing it is subscribed to a task that no longer exists.\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_FOUND, `task '${taskId}' was not found`);\n        return;\n      }\n      this.sendRpcResult(res, id, toWire(config));\n      return;\n    }\n\n    if (method === 'tasks/pushNotificationConfig/list') {\n      const parsed = A2A_ListPushNotificationConfigsParamsSchema.safeParse({ ...(params as object), id: taskId });\n      if (!parsed.success) {\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, parsed.error.issues[0]?.message ?? 'invalid params');\n        return;\n      }\n      // Pagination is a MAY in the norm, and it is honoured rather than ignored so a conformant 1.0\n      // client's `pageSize` is not silently overrun. The page token is the OFFSET as a string: the\n      // list is a small, wholly-read array on one row, so a cursor keyed on an id would buy\n      // stability this collection cannot lose in the first place.\n      const offset = Number.parseInt(parsed.data.pageToken ?? '0', 10);\n      const start = Number.isSafeInteger(offset) && offset > 0 ? offset : 0;\n      const pageSize = parsed.data.pageSize ?? stored.length;\n      const page = stored.slice(start, start + pageSize);\n      const nextOffset = start + page.length;\n\n      this.sendRpcResult(res, id, {\n        configs: page.map(toWire),\n        ...(nextOffset < stored.length ? { nextPageToken: String(nextOffset) } : {}),\n      });\n      return;\n    }\n\n    // Resolved by DIALECT, not by key order: 1.0 puts the configuration in `id`, v0.2.5 puts the\n    // TASK there. An earlier version overwrote `id` with the task id before parsing, which silently\n    // discarded a conformant 1.0 client's configuration id and made every `get`/`delete` behave as\n    // though none had been supplied.\n    const configId = resolvePushNotificationConfigId(params);\n\n    if (method === 'tasks/pushNotificationConfig/get') {\n      // With no id, a single-configuration task is readable without the client having kept the id —\n      // and an ambiguous read is refused rather than guessed, because returning \"some configuration\"\n      // would make a client believe it had read the one it meant.\n      const match = configId ? stored.find((existing) => existing.id === configId) : (stored.length === 1 ? stored[0] : undefined);\n      if (!match) {\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_FOUND, 'no such push notification configuration');\n        return;\n      }\n      this.sendRpcResult(res, id, toWire(match));\n      return;\n    }\n\n    // delete — IDEMPOTENT by contract, so removing an absent configuration SUCCEEDS.\n    // spec-cite: A2A 1.0 §3.1.10 — *\"MUST be idempotent - multiple deletions of the same config\n    // have the same effect\"*. Answering not-found on the second call would make a retrying client\n    // report failure for work that is done, which is the opposite of what idempotence is for.\n    if (!configId) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, 'pushNotificationConfigId is required');\n      return;\n    }\n    const remaining = stored.filter((existing) => existing.id !== configId);\n    // Skip the write when nothing changed: a repeated delete must not keep touching the row, and\n    // must not fail merely because the task finished between the two calls.\n    if (remaining.length !== stored.length\n      && !(await this.a2aTaskService.replacePushNotificationConfigs(owner, taskId, remaining, instanceRef, machineCredentialId))) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_FOUND, `task '${taskId}' was not found`);\n      return;\n    }\n    this.sendRpcResult(res, id, null);\n  }\n\n  private async streamTaskUpdates(\n    res: Response,\n    id: string | number | null,\n    owner: Parameters<A2ATaskBackendService['readTask']>[0],\n    taskId: string,\n    instanceRef: string | undefined,\n    machineCredentialId: string | undefined,\n    initialTask: A2A_OutboundTask,\n  ): Promise<void> {\n    res.set({\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-store',\n      Connection: 'keep-alive',\n    });\n    res.flushHeaders?.();\n\n    const write = (payload: unknown): void => {\n      res.write(`data: ${JSON.stringify(payload)}\\n\\n`);\n    };\n\n    let clientGone = false;\n    const onClientDisconnect = (): void => { clientGone = true; };\n    res.on('close', onClientDisconnect);\n\n    try {\n      write({ jsonrpc: '2.0', id, result: initialTask });\n      // A task that is ALREADY finished has no subsequent updates to wait for. Holding the socket\n      // open would be a connection leak dressed as a feature, and the client would learn nothing it\n      // does not already have from the frame above.\n      if (A2A_TERMINAL_TASK_STATES.has(initialTask.status.state)) return;\n\n      let lastState = initialTask.status.state;\n      const deadline = Date.now() + A2A_RESUBSCRIBE_MAX_DURATION_MS;\n\n      while (!clientGone && Date.now() < deadline) {\n        await sleep(A2A_RESUBSCRIBE_POLL_INTERVAL_MS);\n        if (clientGone) break;\n\n        // The SAME filtered read the subscribe passed. Re-applied on every poll rather than cached:\n        // a task can be cancelled or reassigned mid-stream, and a stream that kept serving from a\n        // snapshot taken at connect time would keep answering after the caller's access to it had\n        // changed.\n        const current = await this.a2aTaskService.readTask(owner, taskId, instanceRef, machineCredentialId);\n        if (!current) return;\n        if (current.status.state === lastState) continue;\n\n        lastState = current.status.state;\n        write({ jsonrpc: '2.0', id, result: current });\n        if (A2A_TERMINAL_TASK_STATES.has(current.status.state)) return;\n      }\n    } catch (streamError) {\n      this.logger.error('[A2A] Task update stream failed', { taskId, ...projectCaughtErrorLogFields(streamError) });\n    } finally {\n      res.off('close', onClientDisconnect);\n      // `end()` on an already-closed socket is a no-op, so this is safe on the disconnect path too.\n      res.end();\n    }\n  }\n\n  /** Build an A2A agent `Message` result. `final` marks the terminal streamed frame. */\n  private buildOutboundMessage(text: string, contextId: string, messageId?: string, final = true): A2A_OutboundMessage {\n    return {\n      kind: 'message',\n      role: A2A_MessageRole.AGENT,\n      parts: [{ kind: 'text', text }],\n      messageId: messageId ?? randomUUID(),\n      contextId,\n      metadata: { final },\n    };\n  }\n\n  /** Read the caller-selected skill id from message metadata or params metadata. */\n  private readSkillId(params: A2A_MessageSendParams): string | undefined {\n    const fromMessage = params.message.metadata?.skillId;\n    const fromParams = params.metadata?.skillId;\n    const value = fromMessage ?? fromParams;\n    return typeof value === 'string' ? value : undefined;\n  }\n\n  /** Concatenate the text parts of the inbound message (text-only mapping). */\n  private readMessageText(params: A2A_MessageSendParams): string | undefined {\n    const text = params.message.parts\n      .filter((part) => part.kind === 'text' && typeof part.text === 'string')\n      .map((part) => part.text as string)\n      .join('')\n      .trim();\n    return text.length > 0 ? text : undefined;\n  }\n\n  private extractBearerToken(req: Request): string | undefined {\n    const authHeader = req.headers['authorization'];\n    if (typeof authHeader !== 'string' || !authHeader.startsWith('Bearer ')) return undefined;\n    const token = authHeader.slice('Bearer '.length).trim();\n    return token.length > 0 ? token : undefined;\n  }\n\n  /**\n   * The success counterpart of {@link sendRpcError}.\n   *\n   * Added for the push-configuration methods rather than hand-writing the envelope at each of their\n   * five exits. `result` is deliberately typed to include `null`: `delete` answers with a null\n   * result, which is a VALID JSON-RPC success and must not be confused with an omitted `result`.\n   *\n   * The `Cache-Control: no-store` mirrors the error path on purpose — a configuration read carries a\n   * client's webhook URL, and an intermediary caching it would disclose one client's delivery target\n   * to whoever shares that cache.\n   */\n  private sendRpcResult(res: Response, id: string | number | null, result: unknown): void {\n    res.set('Cache-Control', 'no-store');\n    res.status(200).json({ jsonrpc: '2.0', id, result });\n  }\n\n  private sendRpcError(\n    res: Response,\n    id: string | number | null,\n    code: A2A_JsonRpcErrorCode,\n    message: string,\n    wwwAuthenticate?: 'Bearer',\n  ): void {\n    res.set('Cache-Control', 'no-store');\n    if (wwwAuthenticate) res.set('WWW-Authenticate', wwwAuthenticate);\n    // JSON-RPC errors ride HTTP 200; the error is in the envelope.\n    res.status(200).json({ jsonrpc: '2.0', id, error: { code, message } });\n  }\n\n  /**\n   * Transport-level throttle response: HTTP 429 + `Retry-After`, carrying a valid JSON-RPC\n   * error envelope with `RATE_LIMITED`. Distinct from {@link sendRpcError} (HTTP 200) because\n   * rate-limiting is a transport concern a client should honor at the HTTP layer.\n   */\n  /**\n   * Transport-level budget denial: HTTP **402** (payment required) carrying a valid JSON-RPC error\n   * envelope with `BUDGET_EXCEEDED`. No `Retry-After` — unlike a rate limit, waiting a few seconds\n   * does not help; the tenant must upgrade its plan or wait for the billing period to roll. The\n   * message is deliberately generic: the caller is an external agent, and the tenant's exact\n   * allowance / consumption is billing detail that belongs on the owner's own billing surface.\n   */\n  private sendBudgetExceeded(res: Response, id: string | number | null): void {\n    res.set('Cache-Control', 'no-store');\n    res.status(402).json({\n      jsonrpc: '2.0',\n      id,\n      error: {\n        code: A2A_JsonRpcErrorCode.BUDGET_EXCEEDED,\n        message: 'The LLM token budget for this period has been exhausted.',\n      },\n    });\n  }\n\n  private sendRateLimited(res: Response, id: string | number | null, retryAfterSeconds: number): void {\n    res.set('Cache-Control', 'no-store');\n    res.set('Retry-After', String(retryAfterSeconds));\n    res.status(429).json({\n      jsonrpc: '2.0',\n      id,\n      error: { code: A2A_JsonRpcErrorCode.RATE_LIMITED, message: 'Rate limit exceeded; retry after the indicated delay.' },\n    });\n  }\n}\n"]}
+{"version":3,"file":"a2a.controller.js","sourceRoot":"","sources":["../../../../../src/flows-actors/a2a/controllers/a2a.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAChC,iCAAiC,GAGlC,MAAM,kEAAkE,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AACzI,OAAO,EAAE,iCAAiC,EAAE,MAAM,oFAAoF,CAAC;AAGvI,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxI,OAAO,EAAE,6CAA6C,EAAE,MAAM,oFAAoF,CAAC;AACnJ,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,GAIzB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EACL,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,wEAAwE,CAAC;AAChF,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,oCAAoC,EACpC,2CAA2C,EAC3C,+BAA+B,EAC/B,qCAAqC,EACrC,6BAA6B,EAC7B,+BAA+B,EAC/B,gCAAgC,GAEjC,MAAM,kFAAkF,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAGjD,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,gCAAgC;IAKrB;IACqB;IAMjB;IACY;IAZ1E,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACzB,UAA6B,EACR,uBAAsE,EAMvF,cAAqC,EACzB,mBAAsD;QAE9H,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;QAVH,eAAU,GAAV,UAAU,CAAmB;QACR,4BAAuB,GAAvB,uBAAuB,CAA+C;QAMvF,mBAAc,GAAd,cAAc,CAAuB;QACzB,wBAAmB,GAAnB,mBAAmB,CAAmC;IAGhI,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,KAAK,CAAC,gBAAgB,CAC5B,GAAY,EACZ,GAAa,EACb,EAA0B;IAC1B,2FAA2F;IAC3F,8FAA8F;IAC9F,8FAA8F;IAC9F,gGAAgG;IAChG,MAAyH,EACzH,MAAe;IACf,0FAA0F;IAC1F,OAAoB;QAEpB,8EAA8E;QAC9E,0FAA0F;QAC1F,0FAA0F;QAC1F,8EAA8E;QAC9E,MAAM,MAAM,GAAG,iCAAiC,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,qCAAqC,CAAC,SAAS,CAAC,MAAM,CAAC;YACzD,CAAC,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,qFAAqF;QACrF,uDAAuD;QACvD,yFAAyF;QACzF,2FAA2F;QAC3F,+DAA+D;QAC/D,yFAAyF;QACzF,uFAAuF;QACvF,sFAAsF;QACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,6FAA6F;QAC7F,wEAAwE;QACxE,EAAE;QACF,uFAAuF;QACvF,gFAAgF;QAChF,wFAAwF;QACxF,0FAA0F;QAC1F,2FAA2F;QAC3F,uFAAuF;QACvF,aAAa;QACb,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,mCAAmC,EAAE,QAAQ,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9H,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,uFAAuF;QACvF,qFAAqF;QACrF,qFAAqF;QACrF,sFAAsF;QACtF,iEAAiE;QACjE,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7B,UAAU,CAAC,IAAI,EACf,MAAM,CAAC,IAAI,CAAC,EAAE,EACd,MAAM,EACN,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,EAC7D,sBAAsB,CAAC,GAAG,CAAC,CAC5B,CAAC;QAEF,6FAA6F;QAC7F,iEAAiE;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAC7C,UAAU,CAAC,KAAK,EAChB,MAAM,CAAC,IAAI,CAAC,EAAE,EACd,gBAAgB,CAAC,WAAW,EAC5B,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAC9D,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAC1G,OAAO;QACT,CAAC;QAED,IAAI,iCAAiC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,kCAAkC,CAC3C,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC,WAAW,EACvF,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAC9D,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC,WAAW,EAClG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,oFAAoF;YACpF,mFAAmF;YACnF,wCAAwC;YACxC,2FAA2F;YAC3F,EAAE;YACF,sFAAsF;YACtF,wFAAwF;YACxF,oDAAoD;YACpD,2DAA2D;YAC3D,4FAA4F;YAC5F,4FAA4F;YAC5F,0CAA0C;YAC1C,EAAE;YACF,sFAAsF;YACtF,2FAA2F;YAC3F,8FAA8F;YAC9F,yFAAyF;YACzF,6CAA6C;YAC7C,EAAE;YACF,wFAAwF;YACxF,4FAA4F;YAC5F,8FAA8F;YAC9F,qFAAqF;YACrF,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE7D,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpD,wFAAwF;gBACxF,yFAAyF;gBACzF,sFAAsF;gBACtF,iFAAiF;gBACjF,0FAA0F;gBAC1F,sEAAsE;gBACtE,0FAA0F;gBAC1F,uEAAuE;gBACvE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,EAAE,yDAAyD,CAAC,CAAC;gBACvJ,OAAO;YACT,CAAC;YAED,4FAA4F;YAC5F,wEAAwE;YACxE,0FAA0F;YAC1F,2FAA2F;YAC3F,4FAA4F;YAC5F,8FAA8F;YAC9F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACtH,IAAI,OAAO,KAAK,yBAAyB,CAAC,OAAO,EAAE,CAAC;gBAClD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,EAAE,iEAAiE,CAAC,CAAC;gBAC/J,OAAO;YACT,CAAC;YACD,IAAI,OAAO,KAAK,yBAAyB,CAAC,MAAM,EAAE,CAAC;gBACjD,4EAA4E;gBAC5E,uFAAuF;gBACvF,iFAAiF;gBACjF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,6BAA6B,MAAM,CAAC,IAAI,CAAC,EAAE,yBAAyB,CAAC,CAAC;gBACtI,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAChD,UAAU,CAAC,KAAK,EAChB,MAAM,CAAC,IAAI,CAAC,EAAE,EACd,gBAAgB,CAAC,WAAW,EAC5B,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAC9D,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACtG,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,qBAAqB,CACjC,UAAuE,EACvE,SAAiB,EACjB,IAAY,EACZ,SAAiB,EACjB,MAAc;IACd,4FAA4F;IAC5F,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,uFAAuF;IACvF,2CAA2C;IAC3C,WAAwB;IACxB,yFAAyF;IACzF,WAA+B;QAE/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACzC,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS;gBACT,IAAI;gBACJ,SAAS;gBACT,WAAW;gBACX,WAAW;aACZ,CAAC,CAAC;YACH,gFAAgF;YAChF,kFAAkF;YAClF,IAAI,WAAW,CAAC,OAAO;gBAAE,OAAO;YAChC,6FAA6F;YAC7F,+FAA+F;YAC/F,+FAA+F;YAC/F,2FAA2F;YAC3F,mFAAmF;YACnF,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CACnC,UAAU,CAAC,KAAK,EAChB,MAAM,EACN,IAAI,CAAC,IAAI,KAAK,OAAO;gBACnB,CAAC,CAAC,kBAAkB,CAAC,MAAM;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,mBAAmB;oBACjC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB;oBACtC,CAAC,CAAC,kBAAkB,CAAC,SAAS;YAClC,0FAA0F;YAC1F,0FAA0F;YAC1F,wFAAwF;YACxF,qFAAqF;YACrF,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yFAAyF;YACzF,wFAAwF;YACxF,sFAAsF;YACtF,0FAA0F;YAC1F,oEAAoE;YACpE,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kFAAkF,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjH,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE;gBAC1E,MAAM;gBACN,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAkC,CAAC,CAAC,CAAC;QAC7I,CAAC;gBAAS,CAAC;YACT,gFAAgF;YAChF,uEAAuE;YACvE,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAsB,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAES,WAAW;QACnB,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,4EAA4E;QAC5E,2CAA2C;QAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvF,MAAM,OAAO,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,oCAAoC,CAAC,CAAC;QAEhF,MAAM,QAAQ,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,2DAA2D,CAAC,CAAC;QAEzG,+EAA+E;QAC/E,gGAAgG;QAChG,kGAAkG;QAClG,4FAA4F;QAC5F,iGAAiG;QACjG,2DAA2D;QAC3D,MAAM,eAAe,GAAG,GAAG,QAAQ,2CAA2C,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC;QAE9F,MAAM,gBAAgB,GAAG,GAAG,QAAQ,eAAe,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,EAAE,iEAAiE,CAAC,CAAC;IACzH,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,GAAY;QACrC,MAAM,SAAS,GAAI,GAAG,CAAC,MAA6C,EAAE,WAAW,CAAC;QAClF,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAClH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QACnD,+FAA+F;QAC/F,sFAAsF;QACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC;QAEjD,MAAM,cAAc,GAAG,wBAAwB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC;QAE9D,6FAA6F;QAC7F,EAAE;QACF,4FAA4F;QAC5F,yFAAyF;QACzF,EAAE;QACF,4FAA4F;QAC5F,gGAAgG;QAChG,gGAAgG;QAChG,mEAAmE;QACnE,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,gBAAgB,EAAE,WAAW,SAAS,oBAAoB,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;QAEvC,6FAA6F;QAC7F,EAAE;QACF,iGAAiG;QACjG,oFAAoF;QACpF,iGAAiG;QACjG,mFAAmF;QACnF,EAAE;QACF,+FAA+F;QAC/F,gGAAgG;QAChG,+DAA+D;QAC/D,IAAI,cAAc,CAAC,SAAS,KAAK,aAAa,CAAC,uBAAuB,EAAE,CAAC;YACvE,gGAAgG;YAChG,kFAAkF;YAClF,yFAAyF;YACzF,+FAA+F;YAC/F,gDAAgD;YAChD,EAAE;YACF,0FAA0F;YAC1F,6CAA6C;YAC7C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;YAC3H,OAAO;QACT,CAAC;QAED,IAAI,cAAc,CAAC,SAAS,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,4FAA4F;YAC5F,wFAAwF;YACxF,oEAAoE;YACpE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,gBAAgB,EAAE,WAAW,SAAS,oBAAoB,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,EAAE;QACF,gGAAgG;QAChG,6FAA6F;QAC7F,yDAAyD;QACzD,EAAE;QACF,gGAAgG;QAChG,4FAA4F;QAC5F,yFAAyF;QACzF,qFAAqF;QACrF,EAAE;QACF,wFAAwF;QACxF,0EAA0E;QAC1E,IAAI,CAAC,gCAAgC,IAAI,iCAAiC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC,YAAY,CACf,GAAG,EACH,EAAE,EACF,oBAAoB,CAAC,+BAA+B,EACpD,gDAAgD,CACjD,CAAC;YACF,OAAO;QACT,CAAC;QAED,qFAAqF;QACrF,uFAAuF;QACvF,8FAA8F;QAC9F,+FAA+F;QAC/F,yFAAyF;QACzF,4DAA4D;QAC5D,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,mBAAmB,IAAI,iCAAiC,CAAC,MAAM,CAAC,EAAE,CAAC;YACvI,6FAA6F;YAC7F,4FAA4F;YAC5F,uBAAuB;YACvB,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,+FAA+F;QAC/F,2FAA2F;QAE3F,MAAM,YAAY,GAAG,2BAA2B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC;YAC3H,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,mCAAmC,EAAE,QAAQ,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QAC7G,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,0FAA0F;QAC1F,kGAAkG;QAClG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,6FAA6F;QAC7F,2FAA2F;QAC3F,2FAA2F;QAC3F,qFAAqF;QACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,8DAA8D;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACpD,6FAA6F;QAC7F,4FAA4F;QAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,wFAAwF;QACxF,2FAA2F;QAC3F,gGAAgG;QAChG,2FAA2F;QAC3F,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC,YAAY,CACf,GAAG,EACH,EAAE,EACF,oBAAoB,CAAC,cAAc,EACnC,uHAAuH,CACxH,CAAC;YACF,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,mFAAmF;QACnF,EAAE;QACF,8FAA8F;QAC9F,2FAA2F;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,yFAAyF;QACzF,6FAA6F;QAC7F,wFAAwF;QACxF,4BAA4B;QAC5B,EAAE;QACF,2FAA2F;QAC3F,8FAA8F;QAC9F,kCAAkC;QAClC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QAEtE,4FAA4F;QAC5F,8FAA8F;QAC9F,+FAA+F;QAC/F,mFAAmF;QACnF,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAE3G,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,yFAAyF;QACzF,EAAE;QACF,4FAA4F;QAC5F,+FAA+F;QAC/F,0FAA0F;QAC1F,iEAAiE;QACjE,EAAE;QACF,2FAA2F;QAC3F,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,wEAAwE;QACxE,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,4EAA4E;QAC5E,8FAA8F;QAC9F,gGAAgG;QAChG,0EAA0E;QAC1E,EAAE;QACF,iGAAiG;QACjG,8FAA8F;QAC9F,iFAAiF;QACjF,IAAI,yBAAyB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;gBACrD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS;gBACT,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY;gBACzC,qFAAqF;gBACrF,sFAAsF;gBACtF,uFAAuF;gBACvF,wCAAwC;gBACxC,WAAW;gBACX,2FAA2F;gBAC3F,0FAA0F;gBAC1F,2FAA2F;gBAC3F,mBAAmB,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY;aACnF,CAAC,CAAC;YACH,IAAI,IAAI,EAAE,CAAC;gBACT,yFAAyF;gBACzF,sFAAsF;gBACtF,oFAAoF;gBACpF,yFAAyF;gBACzF,mDAAmD;gBACnD,EAAE;gBACF,oFAAoF;gBACpF,wFAAwF;gBACxF,qFAAqF;gBACrF,sDAAsD;gBACtD,IAAI,WAAwB,CAAC;gBAC7B,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClE,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oFAAoF,EAAE;wBACtG,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,GAAG,2BAA2B,CAAC,UAAU,CAAC;qBAC3C,CAAC,CAAC;oBACH,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;gBAC7C,CAAC;gBACD,gFAAgF;gBAChF,8EAA8E;gBAC9E,+EAA+E;gBAC/E,KAAK,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;gBAClH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC3F,OAAO;YACT,CAAC;YACD,gFAAgF;YAChF,uEAAuE;QACzE,CAAC;QAED,4EAA4E;QAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACzC,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI;YACJ,SAAS;YACT,4FAA4F;YAC5F,4FAA4F;YAC5F,0FAA0F;YAC1F,8FAA8F;YAC9F,0FAA0F;YAC1F,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YAC3G,OAAO;QACT,CAAC;QACD,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,yFAAyF;QACzF,EAAE;QACF,+FAA+F;QAC/F,0FAA0F;QAC1F,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;gBAC3D,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS;gBACT,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY;gBACzC,WAAW;gBACX,mBAAmB,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY;gBAClF,MAAM,EAAE,kBAAkB,CAAC,iBAAiB;aAC7C,CAAC,CAAC;YACH,IAAI,UAAU,EAAE,CAAC;gBACf,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACjG,OAAO;YACT,CAAC;YACD,0FAA0F;YAC1F,6FAA6F;YAC7F,mFAAmF;YACnF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,mEAAmE,CAAC,CAAC;YACrI,OAAO;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CACxB,GAAa,EACb,EAA0B,EAC1B,IAAyD,EACzD,KAA2D,EAC3D,SAAiB,EACjB,IAAY,EACZ,SAAkB;IAClB;;;;;;OAMG;IACH,WAAoB;IACpB;;;;;;;OAOG;IACH,UAAuB,WAAW,CAAC,MAAM;QAEzC,GAAG,CAAC,GAAG,CAAC;YACN,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC;QAErB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAQ,EAAE;YACvC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC,CAAC;QAEF,uFAAuF;QACvF,EAAE;QACF,gFAAgF;QAChF,qFAAqF;QACrF,4FAA4F;QAC5F,yFAAyF;QACzF,2FAA2F;QAC3F,wDAAwD;QACxD,EAAE;QACF,+FAA+F;QAC/F,8FAA8F;QAC9F,6FAA6F;QAC7F,0FAA0F;QAC1F,+FAA+F;QAC/F,6FAA6F;QAC7F,6FAA6F;QAC7F,yFAAyF;QACzF,EAAE;QACF,8EAA8E;QAC9E,yFAAyF;QACzF,6DAA6D;QAC7D,EAAE;QACF,wFAAwF;QACxF,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,kBAAkB,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACzC,IAAI;gBACJ,KAAK;gBACL,SAAS;gBACT,IAAI;gBACJ,SAAS;gBACT,WAAW;gBACX,WAAW,EAAE,UAAU,CAAC,MAAM;gBAC9B,KAAK,EAAE;oBACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;wBACjB,iFAAiF;wBACjF,+EAA+E;wBAC/E,iFAAiF;wBACjF,kDAAkD;wBAClD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;4BAAE,OAAO;wBACtC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,IAAI,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpH,CAAC;iBACF;aACF,CAAC,CAAC;YAEH,0FAA0F;YAC1F,oFAAoF;YACpF,yCAAyC;YACzC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAErC,yFAAyF;YACzF,uEAAuE;YACvE,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO;YAEtC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1I,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAC7C,2FAA2F;gBAC3F,4FAA4F;gBAC5F,0FAA0F;gBAC1F,EAAE;gBACF,wFAAwF;gBACxF,qFAAqF;gBACrF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;oBAC3D,KAAK;oBACL,SAAS,EAAE,SAAS,IAAI,SAAS;oBACjC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY;oBACzC,WAAW;oBACX,mBAAmB,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY;oBACvE,MAAM,EAAE,kBAAkB,CAAC,iBAAiB;iBAC7C,CAAC,CAAC;gBACH,IAAI,UAAU,EAAE,CAAC;oBACf,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACpF,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,cAAc,EAAE,OAAO,EAAE,mEAAmE,EAAE,EAAE,CAAC,CAAC;gBACpK,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH;;;;;;;;;;;;;;;;;;;OAmBG;IACH;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,eAAe,CAC3B,GAAY,EACZ,GAAa,EACb,EAA0B,EAC1B,MAAe,EACf,OAAoB;QAEpB,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,oFAAoF;QACpF,iGAAiG;QACjG,gGAAgG;QAChG,wBAAwB;QACxB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,mCAAmC,EAAE,QAAQ,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9H,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,eAAe,EAAE,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QAED,+FAA+F;QAC/F,qDAAqD;QACrD,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAElG,MAAM,IAAI,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAC9D,UAAU,CAAC,KAAK,EAChB,gBAAgB,CAAC,WAAW,EAC5B;YACE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,EACD,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CACzC,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE;YAC1B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAChE,yFAAyF;YACzF,yFAAyF;YACzF,4DAA4D;YAC5D,aAAa,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5E,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,+FAA+F;YAC/F,8FAA8F;YAC9F,0FAA0F;YAC1F,4EAA4E;YAC5E,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kCAAkC,CAC9C,GAAa,EACb,EAA0B,EAC1B,MAAwC,EACxC,MAAe,EACf,KAAuD,EACvD,MAAc,EACd,WAAmB,EACnB,mBAAuC;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACtH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,SAAS,MAAM,iBAAiB,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,+EAA+E;QAC/E,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,gGAAgG;QAChG,+FAA+F;QAC/F,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,+FAA+F;QAC/F,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,MAAwC,EAAE,EAAE,CAC1D,gCAAgC,CAAC,6BAA6B,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE5F,IAAI,MAAM,KAAK,kCAAkC,EAAE,CAAC;YAClD,yFAAyF;YACzF,oGAAoG;YACpG,MAAM,MAAM,GAAG,oCAAoC,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YAED,2FAA2F;YAC3F,4FAA4F;YAC5F,oEAAoE;YACpE,MAAM,SAAS,GAAG,+BAA+B,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,gCAAgC,SAAS,EAAE,CAAC,CAAC;gBAC7G,OAAO;YACT,CAAC;YAED,6FAA6F;YAC7F,6FAA6F;YAC7F,4FAA4F;YAC5F,wBAAwB;YACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC;YAChD,MAAM,MAAM,GAAqC;gBAC/C,EAAE,EAAE,QAAQ;gBACZ,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gBACpB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtF,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;YAEhF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;gBACvH,2FAA2F;gBAC3F,uFAAuF;gBACvF,qFAAqF;gBACrF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,SAAS,MAAM,iBAAiB,CAAC,CAAC;gBAClG,OAAO;YACT,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,mCAAmC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,2CAA2C,CAAC,SAAS,CAAC,EAAE,GAAI,MAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC;gBACrH,OAAO;YACT,CAAC;YACD,8FAA8F;YAC9F,6FAA6F;YAC7F,sFAAsF;YACtF,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;YAEvC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE;gBAC1B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBACzB,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,gGAAgG;QAChG,+FAA+F;QAC/F,iCAAiC;QACjC,MAAM,QAAQ,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAEzD,IAAI,MAAM,KAAK,kCAAkC,EAAE,CAAC;YAClD,8FAA8F;YAC9F,+FAA+F;YAC/F,4DAA4D;YAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7H,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,iFAAiF;QACjF,4FAA4F;QAC5F,8FAA8F;QAC9F,0FAA0F;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QACxE,6FAA6F;QAC7F,wEAAwE;QACxE,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;eACjC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC7H,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,oBAAoB,CAAC,cAAc,EAAE,SAAS,MAAM,iBAAiB,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,GAAa,EACb,EAA0B,EAC1B,KAAuD,EACvD,MAAc,EACd,WAA+B,EAC/B,mBAAuC,EACvC,WAA6B;QAE7B,GAAG,CAAC,GAAG,CAAC;YACN,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC;QAErB,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAQ,EAAE;YACvC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC,CAAC;QAEF,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,MAAM,kBAAkB,GAAG,GAAS,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACnD,4FAA4F;YAC5F,8FAA8F;YAC9F,8CAA8C;YAC9C,IAAI,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO;YAEnE,IAAI,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,+BAA+B,CAAC;YAE9D,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,IAAI,UAAU;oBAAE,MAAM;gBAEtB,4FAA4F;gBAC5F,0FAA0F;gBAC1F,0FAA0F;gBAC1F,WAAW;gBACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;gBACpG,IAAI,CAAC,OAAO;oBAAE,OAAO;gBACrB,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAEjD,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBACjC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC/C,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,OAAO;YACjE,CAAC;QACH,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,GAAG,2BAA2B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YACrC,8FAA8F;YAC9F,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,sFAAsF;IAC9E,oBAAoB,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAkB,EAAE,KAAK,GAAG,IAAI;QAC5F,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,eAAe,CAAC,KAAK;YAC3B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC/B,SAAS,EAAE,SAAS,IAAI,UAAU,EAAE;YACpC,SAAS;YACT,QAAQ,EAAE,EAAE,KAAK,EAAE;SACpB,CAAC;IACJ,CAAC;IAED,kFAAkF;IAC1E,WAAW,CAAC,MAA6B;QAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC5C,MAAM,KAAK,GAAG,WAAW,IAAI,UAAU,CAAC;QACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,6EAA6E;IACrE,eAAe,CAAC,MAA6B;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK;aAC9B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;aACvE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAc,CAAC;aAClC,IAAI,CAAC,EAAE,CAAC;aACR,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,GAAY;QACrC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACK,aAAa,CAAC,GAAa,EAAE,EAA0B,EAAE,MAAe;QAC9E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IAEO,YAAY,CAClB,GAAa,EACb,EAA0B,EAC1B,IAA0B,EAC1B,OAAe,EACf,eAA0B;QAE1B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,IAAI,eAAe;YAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QAClE,+DAA+D;QAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH;;;;;;OAMG;IACK,kBAAkB,CAAC,GAAa,EAAE,EAA0B;QAClE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,EAAE;YACF,KAAK,EAAE;gBACL,IAAI,EAAE,oBAAoB,CAAC,eAAe;gBAC1C,OAAO,EAAE,0DAA0D;aACpE;SACF,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,GAAa,EAAE,EAA0B,EAAE,iBAAyB;QAC1F,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,EAAE;YACF,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,YAAY,EAAE,OAAO,EAAE,uDAAuD,EAAE;SACrH,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAttCY,2BAA2B;IADvC,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACrC,WAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;IAM1D,WAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,WAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;qCAXX,aAAa;QACM,0BAA0B;QAC1B,mBAAmB;QACb,iBAAiB;QACiB,6CAA6C;QAMvE,qBAAqB;QACJ,iCAAiC;GAbrH,2BAA2B,CAstCvC","sourcesContent":["import 'reflect-metadata';\nimport { setTimeout as sleep } from 'node:timers/promises';\nimport { inject, injectable } from 'inversify';\nimport type { Request, Response } from 'express';\nimport cors from 'cors';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { getClientIpFromRequest } from '~wildo-backend-lib/runtime/utils/request-client-ip.utils';\nimport {\n  A2ABackendService,\n  A2A_PUSH_NOTIFICATIONS_SUPPORTED,\n  isA2APushNotificationConfigMethod,\n  type A2A_AuditedMethod,\n  type A2A_PushNotificationConfigMethod,\n} from '~wildo-backend-lib/flows-actors/a2a/services/a2a.backend.service';\nimport { A2A_TaskTransitionOutcome, A2ATaskBackendService } from '~wildo-backend-lib/flows-actors/a2a/services/a2a-task.backend.service';\nimport { A2ATaskCancellationBackendService } from '~wildo-backend-lib/flows-actors/a2a/services/a2a-task-cancellation.backend.service';\nimport type { ConversationalOwnerScope } from '~wildo-backend-lib/flows-actors/services/conversational-execution.backend.service';\nimport type { SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { FlowsActors_Status, MANUAL_CONTROLLER_ROUTES_URLS, ManualControllerRouteKey, ResourceServerKind } from '@wildo-ai/saas-models';\nimport { ResourceServerInstancesRegistryBackendService } from '~wildo-backend-lib/mcp/services/resource-server-instances-registry.backend.service';\nimport {\n  A2A_JsonRpcErrorCode,\n  A2A_JsonRpcRequestSchema,\n  A2A_MessageRole,\n  A2A_MessageSendParamsSchema,\n  A2A_TaskIdParamsSchema,\n  A2A_TERMINAL_TASK_STATES,\n  type A2A_MessageSendParams,\n  type A2A_OutboundMessage,\n  type A2A_OutboundTask,\n} from '~wildo-backend-lib/flows-actors/a2a/models/a2a.backend.schemas';\nimport { randomUUID } from 'crypto';\nimport {\n  A2A_Dialect,\n  A2A_Operation,\n  fromA2ATaskState,\n  projectTaskForDialect,\n  resolveNonBlockingRequest,\n  resolveA2AMethod,\n  toLegacyMethodName,\n} from '~wildo-backend-lib/flows-actors/a2a/models/a2a-dialect.backend.schemas';\nimport {\n  A2A_PushConfigWireForm,\n  A2A_ListTasksParamsSchema,\n  decodeListTasksPageToken,\n  parseSetPushNotificationConfigParams,\n  A2A_ListPushNotificationConfigsParamsSchema,\n  resolvePushNotificationConfigId,\n  A2A_PushNotificationTaskAddressSchema,\n  redactPushNotificationSecrets,\n  rejectUnsafePushNotificationUrl,\n  toWireTaskPushNotificationConfig,\n  type A2A_StoredPushNotificationConfig,\n} from '~wildo-backend-lib/flows-actors/a2a/models/a2a-push-notification.backend.schemas';\n\n/**\n * Inbound Agent2Agent (A2A) transport controller — a THIN transport wrapper over\n * {@link A2ABackendService}. Exposes the app's actor runtime to external agent\n * callers:\n *\n * - `GET  /a2a/.well-known/agent-card.json` — public, CORS-open agent card (like\n *   the OIDC discovery doc; carries only public metadata + advertised skills).\n * - `POST /a2a` — JSON-RPC 2.0 endpoint. `message/send` runs one turn and returns\n *   the agent's reply as an A2A `Message`; `message/stream` forwards the token\n *   deltas over SSE. Bearer-credentialed (user-delegated OR machine token, D6),\n *   audience-bound (D7).\n * - `GET /a2a/:instanceRef/.well-known/agent-card.json` + `POST /a2a/:instanceRef` — the R-2 NAMED\n *   agents. Each declared agent is a distinct IDENTITY: its own card, its own RFC 8707 audience\n *   (`…/a2a/<ref>`), and its own SKILL SUBSET (`actorSystemRefs`). Skills stay the routing mechanism\n *   WITHIN a card (`metadata.skillId`) — an agent groups them, it does not replace them. An unknown\n *   ref 404s on both surfaces BEFORE parsing/auth; it never falls back to the default card, which\n *   advertises every skill.\n *\n * NOTE: `setupRoutes()` runs inside the `super()` constructor before this\n * subclass's field initializers, so it only BINDS handlers — `this.a2aService`\n * is read at REQUEST time. Standard manual-controller pattern.\n */\n/**\n * How often a `tasks/resubscribe` stream re-reads its task, and how long it will hold the socket.\n *\n * Polling is the honest mechanism here: there is no per-task event bus, and the protocol owes only\n * SUBSEQUENT updates, so an interval that is comfortably below human patience is sufficient. One\n * indexed read per second per attached client is the cost.\n *\n * The duration bound is not a nicety. Without it a client that attaches to a task which never\n * reaches a terminal state — the exact population the abandoned-task sweep exists for — pins a\n * connection and its poll loop for the lifetime of the process. Ending the stream is not lossy: the\n * task remains readable, and a client that still cares simply resubscribes.\n */\nconst A2A_RESUBSCRIBE_POLL_INTERVAL_MS = 1_000;\nconst A2A_RESUBSCRIBE_MAX_DURATION_MS = 10 * 60 * 1_000;\n\n@injectable()\nexport class A2AControllerBackendService extends AbstractControllerBackendService {\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n    @inject(SAAS_SERVICE_TYPES.A2AService) private readonly a2aService: A2ABackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceServerInstancesRegistry) private readonly resourceServerInstances: ResourceServerInstancesRegistryBackendService,\n    // APPENDED LAST, deliberately: this class is constructed POSITIONALLY in tests, so\n    // inserting a param mid-list silently shifts every later argument into the wrong slot\n    // (it landed `resourceServerInstances` on the wrong parameter and produced\n    // `tryGetInstance of undefined`). New injections go at the end — the same trap that\n    // previously gave the R-2 instance registry an `undefined` value.\n    @inject(SAAS_SERVICE_TYPES.A2ATaskService) private readonly a2aTaskService: A2ATaskBackendService,\n    @inject(SAAS_SERVICE_TYPES.A2ATaskCancellationService) private readonly a2aTaskCancellation: A2ATaskCancellationBackendService,\n  ) {\n    super(logger, errorBuilder, errorHandler, 'A2AController');\n  }\n\n  /**\n   * `tasks/get` — read one task by id.\n   *\n   * Authenticates exactly like the message methods (same bearer token, same audience\n   * gate), then delegates to the task service, whose read isolates by an owner filter\n   * derived from the authenticated principal — NOT by the resource's declared roles, which\n   * that path never exercises (see `A2ATaskBackendService`).\n   * A task belonging to another tenant and a task that does not exist\n   * both answer the same way: distinguishing them would let a caller probe for other\n   * tenants' task ids.\n   *\n   * Deliberately NOT rate-limited or budget-gated: polling a task state is not a turn,\n   * costs no LLM tokens, and throttling it would punish the very clients that used\n   * a non-blocking turn correctly.\n   *\n   * ⚠️ Read that exemption together with its COST (review finding G3-12): every poll now writes an\n   * audit row — `SYSTEM_CONTEXT_READ` from the system-access read, plus `MACHINE_ACCESS`/per-org SIEM\n   * for a machine principal or `RESOURCE_OPERATION_PERFORMED` for a delegated human. So an\n   * unthrottled endpoint amplifies into the audit pipeline, and a client polling tightly costs audit\n   * volume rather than LLM spend. What bounds it today is the GLOBAL per-IP HTTP limiter, not\n   * anything on this path. If a per-principal poll throttle is ever added, it belongs here — and it\n   * must stay distinct from the TURN throttle, which exists to cap spend, not writes.\n   */\n  private async handleTaskMethod(\n    req: Request,\n    res: Response,\n    id: string | number | null,\n    // NOT `string` (review finding G3-3). A bare `string` here forced a cast at the audit call\n    // below, which defeated the `satisfies`-checked map: routing a fifth method into this handler\n    // type-checked cleanly, resolved to `undefined` in the map, and produced an UNAUDITED access.\n    // Narrowed to the audited-method union, the compiler rejects that at the dispatch site instead.\n    method: Extract<A2A_AuditedMethod, 'tasks/get' | 'tasks/cancel' | 'tasks/resubscribe'> | A2A_PushNotificationConfigMethod,\n    params: unknown,\n    /** The vocabulary the reply must be written in — see `a2a-dialect.backend.schemas.ts`. */\n    dialect: A2A_Dialect,\n  ): Promise<void> {\n    // The task id lives under a DIFFERENT key for the configuration methods — see\n    // `A2A_PushNotificationTaskAddressSchema` for why this is a separate schema rather than a\n    // fallback: A2A 1.0 uses `id` for the CONFIGURATION and `taskId` for the task, so reading\n    // `params.id` for these methods would address a task by a configuration's id.\n    const parsed = isA2APushNotificationConfigMethod(method)\n      ? A2A_PushNotificationTaskAddressSchema.safeParse(params)\n      : A2A_TaskIdParamsSchema.safeParse(params);\n    if (!parsed.success) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, parsed.error.issues[0]?.message ?? 'invalid params');\n      return;\n    }\n\n    // Resolve the named instance the SAME way the message methods do — an unknown\n    // instance must fail closed here too, or `tasks/get` would become a way to reach the\n    // default agent through an unregistered instance path.\n    // `handleTasks` — this method's ONLY caller — already 404s on an unknown instance before\n    // dispatching, so no check is repeated here. `resolveInstanceRef` is re-run only to obtain\n    // the ref for audience binding, and cannot fail at this point.\n    // `handleTasks` already 404s an unknown instance before dispatching here, so this cannot\n    // fail today — but `strict:false` means a future reordering would surface as a runtime\n    // TypeError rather than a compile error, so it fails closed explicitly (finding F-H).\n    const resolvedInstance = this.resolveInstanceRef(req);\n    if (!resolvedInstance) {\n      res.status(404).json({ error: 'not_found', error_description: 'no such A2A agent' });\n      return;\n    }\n    const token = this.extractBearerToken(req);\n    // Short-circuit a MISSING credential before authentication, exactly as the message path does\n    // (review finding A3-8 — the asymmetry was unintended, not a decision).\n    //\n    // Handing `undefined` to `authenticateCaller` is not merely a wasted call: it routes a\n    // credential-less request into `recordExternalTokenAuthFailure`, which writes a\n    // `MACHINE_AUTH_FAILED` audit row AND increments the per-IP failure counter SHARED with\n    // `/oauth/token`. Fifty unauthenticated polls would therefore 429 token minting for every\n    // client behind that egress IP, and flood the SIEM — a denial-of-service reachable without\n    // any credential at all. There is no authentication ATTEMPT to record when nothing was\n    // presented.\n    if (!token) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, 'a Bearer access token is required', 'Bearer');\n      return;\n    }\n    const authResult = await this.a2aService.authenticateCaller(token, getClientIpFromRequest(req), resolvedInstance.instanceRef);\n    if (authResult.kind === 'error') {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, authResult.errorMessage, 'Bearer');\n      return;\n    }\n\n    // SIEM: audit the access at the authorized boundary, exactly as the message methods do\n    // at their own dispatch point. The task methods are routed BEFORE that call site, so\n    // without this they emitted no `MACHINE_ACCESS` at all — an external principal could\n    // read and cancel a tenant's work leaving nothing in the trail. Fired before the read\n    // so an attempt on a task the caller cannot see is recorded too.\n    this.a2aService.auditTaskAccess(\n      authResult.auth,\n      parsed.data.id,\n      method,\n      this.a2aTaskService.resolveTaskResourceType(authResult.owner),\n      getClientIpFromRequest(req),\n    );\n\n    // The instance ref is part of the filter, not just the audience check (review finding A3-6):\n    // two agents of the SAME tenant must not see each other's tasks.\n    const task = await this.a2aTaskService.readTask(\n      authResult.owner,\n      parsed.data.id,\n      resolvedInstance.instanceRef,\n      authResult.auth.initiatorIds?.machineCredential?.credentialId,\n    );\n    if (!task) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_FOUND, `task '${parsed.data.id}' was not found`);\n      return;\n    }\n\n    if (isA2APushNotificationConfigMethod(method)) {\n      await this.handlePushNotificationConfigMethod(\n        res, id, method, params, authResult.owner, parsed.data.id, resolvedInstance.instanceRef,\n        authResult.auth.initiatorIds?.machineCredential?.credentialId,\n      );\n      return;\n    }\n\n    if (method === 'tasks/resubscribe') {\n      await this.streamTaskUpdates(res, id, authResult.owner, parsed.data.id, resolvedInstance.instanceRef,\n        authResult.auth.initiatorIds?.machineCredential?.credentialId, task);\n      return;\n    }\n\n    if (method === 'tasks/cancel') {\n      // Reading FIRST is what makes cancel safe to authorize: a caller who cannot see the\n      // task cannot cancel it, and the check costs nothing extra since the spec requires\n      // us to return the task's state anyway.\n      // ── BROADCAST FIRST, always — refusal governs the WRITE, never the attempt ──────────────\n      //\n      // Site 1 of 2 for the invariant \"a cancellation is broadcast whenever cancellation is\n      // requested\" (review finding G7-1) — an invariant NAMED here, not quoted from anywhere.\n      // spec-cite: N/A — Wildo's own invariant statement.\n      // This used to sit AFTER the terminal check, and the check\n      // reads `task.status.state`, which is the DERIVE-ON-READ value — a live turn whose lease is\n      // missing on the reading pod reports `failed`, `failed` is terminal, so the handler refused\n      // and returned without ever broadcasting.\n      //\n      // That inverted the whole point of derive-on-read. It is a fail-SAFE hypothesis about\n      // liveness, correct on a READ (\"reporting a healthy task as abandoned is a lesser lie than\n      // leaving it working forever\") and wrong as grounds to refuse an ACTION: the task an operator\n      // most wants to stop — one that looks stuck — became precisely the one that could not be\n      // stopped. The diagnosis removed the remedy.\n      //\n      // Broadcasting unconditionally costs nothing and cannot be wrong. `requestCancel`'s own\n      // contract says a pod that does not own the task does nothing and a pod that is gone simply\n      // does not answer — \"the correct behaviour, not an error to handle\". So the only question the\n      // terminal check should govern is whether we RECORD a transition and what we answer.\n      await this.a2aTaskCancellation.requestCancel(parsed.data.id);\n\n      if (A2A_TERMINAL_TASK_STATES.has(task.status.state)) {\n        // A2A `TaskNotCancelableError`. The spec PERMITS this (§7.4 lists it among the errors a\n        // cancel may answer); it does not mandate it. An earlier revision answered HTTP 200 with\n        // the task, reasoning that the client's intent was already satisfied — which reads as\n        // helpful and is wrong: it makes \"I cancelled it\" and \"it had already completed\"\n        // indistinguishable on the wire, and that is exactly the distinction anything reconciling\n        // state needs. The task's own state remains readable via `tasks/get`.\n        // spec-cite: N/A — the two quoted phrases are the OUTCOMES a client could not tell apart,\n        // not text from the document; §7.4 is cited at the enum member itself.\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_CANCELABLE, `task '${parsed.data.id}' is already in a terminal state and cannot be canceled`);\n        return;\n      }\n\n      // The RECORD is the truth — which is why the spec has cancel return the updated task rather\n      // than an acknowledgement. The broadcast above may have reached nobody.\n      // The CAS's answer decides the RESPONSE too (review finding G5-4). The terminal pre-check\n      // above reads in a prior await, so a task can finish in between; the compare-and-swap then\n      // correctly refuses the write. Answering 200 with the task at that point re-creates exactly\n      // what H-4 removed — a client unable to tell \"I cancelled it\" from \"it had already finished\".\n      const outcome = await this.a2aTaskService.advanceTask(authResult.owner, parsed.data.id, FlowsActors_Status.CANCELLED);\n      if (outcome === A2A_TaskTransitionOutcome.REFUSED) {\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_CANCELABLE, `task '${parsed.data.id}' reached a terminal state before the cancellation was recorded`);\n        return;\n      }\n      if (outcome === A2A_TaskTransitionOutcome.FAILED) {\n        // A write FAILURE is not a state fact (review finding N-3). Reporting it as\n        // `TaskNotCancelable` would tell the client the task is terminal when nothing is known\n        // about its state — on the one verb whose whole purpose is to change that state.\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INTERNAL_ERROR, `the cancellation of task '${parsed.data.id}' could not be recorded`);\n        return;\n      }\n\n      const updated = await this.a2aTaskService.readTask(\n        authResult.owner,\n        parsed.data.id,\n        resolvedInstance.instanceRef,\n        authResult.auth.initiatorIds?.machineCredential?.credentialId,\n      );\n      res.set('Cache-Control', 'no-store');\n      res.status(200).json({ jsonrpc: '2.0', id, result: projectTaskForDialect(updated ?? task, dialect) });\n      return;\n    }\n\n    res.set('Cache-Control', 'no-store');\n    res.status(200).json({ jsonrpc: '2.0', id, result: projectTaskForDialect(task, dialect) });\n  }\n\n  /**\n   * Run a turn whose client chose not to block, advancing the task it already holds.\n   *\n   * Nothing is awaited by the request handler, so this must NEVER throw: the response\n   * is already sent and an unhandled rejection here would take the process down rather\n   * than surface anywhere useful. Every outcome lands on the task, which is precisely\n   * what the client is polling.\n   */\n  private async runTurnAndAdvanceTask(\n    authResult: { auth: SocketAuthResult; owner: ConversationalOwnerScope },\n    systemRef: string,\n    text: string,\n    contextId: string,\n    taskId: string,\n    // Passed IN rather than acquired here (review finding A3-5). `beginTurn` is what writes the\n    // liveness lease, and it must complete BEFORE the task id reaches the client — see the call\n    // site. Acquiring it inside this un-awaited method left a window in which the client held an\n    // id whose lease did not exist yet, so its first poll read `failed` for a perfectly healthy\n    // turn. `endTurn` still pairs from this method's `finally`, so the lease's lifetime is\n    // unchanged; only its START moved earlier.\n    abortSignal: AbortSignal,\n    /** The agent this turn arrived through — recorded on the conversation (finding G5-8). */\n    instanceRef: string | undefined,\n  ): Promise<void> {\n    try {\n      const turn = await this.a2aService.runTurn({\n        auth: authResult.auth,\n        owner: authResult.owner,\n        systemRef,\n        text,\n        contextId,\n        instanceRef,\n        abortSignal,\n      });\n      // An aborted turn must NOT be recorded as failed — `tasks/cancel` already wrote\n      // CANCELLED, and overwriting it would erase the fact that a human asked for this.\n      if (abortSignal.aborted) return;\n      // Three outcomes, three states. The `awaiting-approval` arm is why `runTurn` returns a union\n      // rather than an optional field: before it existed this was a two-way ternary, and a turn that\n      // paused for a human decision was recorded COMPLETED — a terminal state for work the model had\n      // explicitly declined to do without permission. The client would then read a finished task\n      // carrying no answer, with nothing anywhere naming the decision it was waiting on.\n      await this.a2aTaskService.advanceTask(\n        authResult.owner,\n        taskId,\n        turn.kind === 'error'\n          ? FlowsActors_Status.FAILED\n          : turn.kind === 'awaiting-approval'\n            ? FlowsActors_Status.AWAITING_APPROVAL\n            : FlowsActors_Status.COMPLETED,\n        // THIS is the turn's own report about work it actually performed, which is why it — alone\n        // among the three `advanceTask` call sites — may take a task back off the FAILED that the\n        // abandoned-task sweep derived from a missing liveness lease. `tasks/cancel` above must\n        // never carry this flag: a cancellation is a claim about intent, not about the work.\n        { reclaimAbandonedVerdict: true },\n      );\n    } catch (error) {\n      // Consult the signal here too, exactly as the success path does (review finding G4-8). A\n      // transport that unwinds by THROWING on abort would otherwise write FAILED, and if that\n      // landed before `tasks/cancel`'s CANCELLED the compare-and-swap would then refuse the\n      // cancel — leaving a user-requested stop recorded as a failure, which inverts \"the record\n      // is the truth\". Detected from OUR signal, never the error's shape.\n      if (abortSignal.aborted) {\n        this.logger.info('[A2A] Non-blocking turn unwound after cancellation; leaving the CANCELLED record', { taskId });\n        return;\n      }\n      this.logger.error('[A2A] Non-blocking turn threw; marking its task failed', {\n        taskId,\n        ...projectCaughtErrorLogFields(error),\n      });\n      await this.a2aTaskService.advanceTask(authResult.owner, taskId, FlowsActors_Status.FAILED).catch(() => { /* already terminal-failing */ });\n    } finally {\n      // ALWAYS release: a lease outliving its turn would make a finished task read as\n      // still executing, which is the exact lie the lease exists to prevent.\n      await this.a2aTaskCancellation.endTurn(taskId).catch(() => { /* TTL reaps it */ });\n    }\n  }\n\n  protected setupRoutes(): void {\n    // The agent card is PUBLIC, non-credentialed metadata an external agent fetches\n    // cross-origin to discover this app's skills + auth requirements — CORS-open GET,\n    // exactly like the OIDC discovery doc. Safe (`origin:'*'`) because it carries no\n    // secrets and no credentials. The task endpoint stays under the restrictive\n    // global CORS (it is Bearer-credentialed).\n    const publicMetadataCors = cors({ origin: '*', methods: ['GET'], credentials: false });\n\n    const cardUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.A2A_AGENT_CARD];\n    this.router.get(cardUrl, publicMetadataCors, this.asyncHandler(this.handleAgentCard.bind(this)));\n    this.logRouteRegistration('GET', cardUrl, 'A2A agent card (public, CORS-open)');\n\n    const tasksUrl = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.A2A_TASKS];\n    this.router.post(tasksUrl, this.asyncHandler(this.handleTasks.bind(this)));\n    this.logRouteRegistration('POST', tasksUrl, 'A2A JSON-RPC task endpoint (message/send, message/stream)');\n\n    // ── R-2: NAMED A2A agent instances (`/a2a/:instanceRef`) ────────────────────\n    // A named agent is a DISTINCT agent identity: its own card (own name/description), its own URL,\n    // its own RFC 8707 audience, and its own SKILL SUBSET. Skills remain the routing mechanism WITHIN\n    // a card (`metadata.skillId`) — an agent groups them, it does not replace them. The default\n    // `/a2a` agent (every runnable actor system) is untouched. Card path first: it has more segments\n    // than `/a2a/:instanceRef`, so Express matches it exactly.\n    const instanceCardUrl = `${tasksUrl}/:instanceRef/.well-known/agent-card.json`;\n    this.router.get(instanceCardUrl, publicMetadataCors, this.asyncHandler(this.handleAgentCard.bind(this)));\n    this.logRouteRegistration('GET', instanceCardUrl, 'Named A2A agent card (public, CORS-open)');\n\n    const instanceTasksUrl = `${tasksUrl}/:instanceRef`;\n    this.router.post(instanceTasksUrl, this.asyncHandler(this.handleTasks.bind(this)));\n    this.logRouteRegistration('POST', instanceTasksUrl, 'Named A2A agent JSON-RPC endpoint (own audience + skill subset)');\n  }\n\n  /**\n   * Resolve the NAMED agent instance addressed by this request, or the DEFAULT agent.\n   * `undefined` ⇒ the ref was supplied but is not declared → the caller 404s (fail-closed: an unknown\n   * agent must never fall back to the default card, which advertises every skill).\n   */\n  private resolveInstanceRef(req: Request): { instanceRef?: string } | undefined {\n    const requested = (req.params as Record<string, string | undefined>)?.instanceRef;\n    if (!requested) return { instanceRef: undefined };\n    const agent = this.resourceServerInstances.tryGetInstance(ResourceServerKind.A2A, requested);\n    return agent ? { instanceRef: agent.ref } : undefined;\n  }\n\n  /**\n   * `GET /a2a/.well-known/agent-card.json` (default agent) and\n   * `GET /a2a/:instanceRef/.well-known/agent-card.json` (a named agent) — the served agent card.\n   */\n  private async handleAgentCard(req: Request, res: Response): Promise<void> {\n    const resolved = this.resolveInstanceRef(req);\n    if (!resolved) {\n      res.status(404).json({ error: 'not_found', error_description: 'no such A2A agent' });\n      return;\n    }\n    const card = this.a2aService.buildAgentCard(resolved.instanceRef);\n    if (!card) {\n      res.status(503).json({ error: 'temporarily_unavailable', error_description: 'agent audience is not resolvable' });\n      return;\n    }\n    res.set('Cache-Control', 'public, max-age=3600');\n    res.status(200).json(card);\n  }\n\n  /**\n   * `POST /a2a` — JSON-RPC 2.0 dispatch. All application-level failures are\n   * returned as JSON-RPC error envelopes (HTTP 200) per the protocol; only a\n   * malformed JSON-RPC envelope yields a top-level error with a null id.\n   */\n  private async handleTasks(req: Request, res: Response): Promise<void> {\n    // R-2: which agent is being addressed (default `/a2a`, or a declared `/a2a/<ref>`). An unknown\n    // agent 404s BEFORE parsing/auth — it is not an agent, so it has no JSON-RPC surface.\n    const resolvedInstance = this.resolveInstanceRef(req);\n    if (!resolvedInstance) {\n      res.status(404).json({ error: 'not_found', error_description: 'no such A2A agent' });\n      return;\n    }\n    const instanceRef = resolvedInstance.instanceRef;\n\n    const parsedEnvelope = A2A_JsonRpcRequestSchema.safeParse(req.body);\n    if (!parsedEnvelope.success) {\n      this.sendRpcError(res, null, A2A_JsonRpcErrorCode.INVALID_REQUEST, 'malformed JSON-RPC 2.0 request');\n      return;\n    }\n    const { id, method: rawMethod, params } = parsedEnvelope.data;\n\n    // ── Dialect resolution, before ANY routing ────────────────────────────────────────────────\n    //\n    // The method name IS the dialect signal: `tasks/get` ⇒ v0.2.5, `GetTask` ⇒ A2A 1.0. The two\n    // vocabularies are disjoint (pinned in D-4), so this needs no negotiation and no header.\n    //\n    // The request is then NORMALISED to the v0.2.5 spelling, which is what keeps this migration\n    // additive: every routing branch, audit-map lookup and handler below is untouched, and only the\n    // RESPONSE side learns there are two dialects. Rewriting every comparison to the canonical enum\n    // would have churned the whole controller for no behavioural gain.\n    const resolvedMethod = resolveA2AMethod(rawMethod);\n    if (!resolvedMethod) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.METHOD_NOT_FOUND, `method '${rawMethod}' is not supported`);\n      return;\n    }\n    const dialect = resolvedMethod.dialect;\n\n    // ── The two operations A2A 1.0 adds and v0.2.5 has no name for ────────────────────────────\n    //\n    // These cannot be normalised to a legacy method string — there isn't one — so they are routed by\n    // OPERATION, before the normalisation below. Handling them here rather than letting\n    // `toLegacyMethodName` return `undefined` matters under this package's `strict: false`, where an\n    // `undefined` method would type-check and then fall through to the message branch.\n    //\n    // They exist at all because the card advertises `version: \"1.0\"`, and that is a claim to speak\n    // the whole vocabulary. Shipping a \"1.0\" interface missing two of the protocol's eleven methods\n    // is the same over-claim this migration was undertaken to fix.\n    if (resolvedMethod.operation === A2A_Operation.GET_EXTENDED_AGENT_CARD) {\n      // spec-cite: A2A 1.0 §3.3.4 — *\"If `AgentCard.capabilities.extendedAgentCard` is `false` or not\n      // present, attempts to call the Get Extended Agent Card operation **MUST** return\n      // `UnsupportedOperationError`\"* (§5.4 assigns it `-32004`). We serve one public card and\n      // declare no extended one, so this is a permanent, correct refusal — NOT `-32601`, which would\n      // read to a client as \"this server is not A2A\".\n      //\n      // No authentication and no audit: nothing is accessed, and the answer is a fact about the\n      // agent that the public card already states.\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNSUPPORTED_OPERATION, 'this agent does not offer an extended agent card');\n      return;\n    }\n\n    if (resolvedMethod.operation === A2A_Operation.LIST_TASKS) {\n      await this.handleListTasks(req, res, id, params, dialect);\n      return;\n    }\n\n    const method = toLegacyMethodName(resolvedMethod.operation);\n    if (!method) {\n      // Unreachable today — every remaining operation has a legacy spelling. Explicit rather than\n      // implicit because `strict: false` would otherwise let a future 1.0-only operation fall\n      // through this point as `undefined` and be dispatched as a message.\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.METHOD_NOT_FOUND, `method '${rawMethod}' is not supported`);\n      return;\n    }\n\n    // ── The §3.3.4 capability gate, BEFORE anything else touches these methods ────────────────\n    //\n    // spec-cite: A2A 1.0 §3.3.4 — *\"If `AgentCard.capabilities.pushNotifications` is `false` or not\n    // present, operations related to push notification configuration (Create, Get, List, Delete)\n    // **MUST** return `PushNotificationNotSupportedError`\"*.\n    //\n    // Placed at dispatch rather than inside the handler on purpose. The refusal is a fact about the\n    // AGENT, not about the task or the caller, so it needs no authentication, no task read, and\n    // nothing to audit — no access occurs. Answering here also means the four methods cannot\n    // acquire a code path that reaches storage while the card says they are unsupported.\n    //\n    // The set and the card read the SAME constant, so this branch disappears the moment the\n    // capability is honestly `true` — see `A2A_PUSH_NOTIFICATIONS_SUPPORTED`.\n    if (!A2A_PUSH_NOTIFICATIONS_SUPPORTED && isA2APushNotificationConfigMethod(method)) {\n      this.sendRpcError(\n        res,\n        id,\n        A2A_JsonRpcErrorCode.PUSH_NOTIFICATION_NOT_SUPPORTED,\n        'this agent does not support push notifications',\n      );\n      return;\n    }\n\n    // `tasks/get` is addressed by task id, not by a message, so it is handled BEFORE the\n    // message-params gate below (its params shape is different and would fail that parse).\n    // The push-notification-configuration methods join it for the same reason: they are addressed\n    // by a caller-supplied task id, which is the IDENTICAL attack surface, so they must go through\n    // the same funnel — same audience binding, same audit emit, same four-axis owner filter.\n    // Authentication still runs first — see `handleTaskMethod`.\n    if (method === 'tasks/get' || method === 'tasks/cancel' || method === 'tasks/resubscribe' || isA2APushNotificationConfigMethod(method)) {\n      // No cast: each arm narrows `method` to a member of the audited union, so the compiler — not\n      // a reviewer — is what guarantees `handleTaskMethod` can only ever be reached with a method\n      // the audit map knows.\n      await this.handleTaskMethod(req, res, id, method, params, dialect);\n      return;\n    }\n\n    // No unknown-method branch here: `resolveA2AMethod` above already refused anything outside the\n    // two vocabularies, so by this point `method` is necessarily one of the two message verbs.\n\n    const parsedParams = A2A_MessageSendParamsSchema.safeParse(params);\n    if (!parsedParams.success) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, parsedParams.error.issues[0]?.message ?? 'invalid params');\n      return;\n    }\n\n    // Bearer auth — user-delegated OR machine token (D6), audience-bound (D7).\n    const token = this.extractBearerToken(req);\n    if (!token) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, 'a Bearer access token is required', 'Bearer');\n      return;\n    }\n    const authResult = await this.a2aService.authenticateCaller(token, getClientIpFromRequest(req), instanceRef);\n    if (authResult.kind === 'error') {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, authResult.errorMessage, 'Bearer');\n      return;\n    }\n\n    // Per-principal turn throttle (LLM-spend guard). A saturated principal is rejected with a\n    // transport-level 429 + Retry-After BEFORE any dispatch — covers send AND stream (one turn each).\n    const rate = await this.a2aService.assertTurnWithinRate(authResult.auth);\n    if (rate.kind === 'rate_limited') {\n      this.sendRateLimited(res, id, rate.retryAfterSeconds);\n      return;\n    }\n\n    // Per-TENANT LLM token budget (sustained spend cap, distinct from the burst throttle above).\n    // Also pre-dispatch: an exhausted allowance must never reach the LLM. Denials ride HTTP 402,\n    // NOT 429 — the client's remedy is to upgrade / wait for the period, not to retry shortly.\n    // Keyed on the PRINCIPAL, not the conversation owner: a user-delegated turn is paid by the\n    // organization the user is acting within, while the conversation row remains theirs.\n    const budget = await this.a2aService.assertTurnWithinBudget(authResult.auth);\n    if (budget.kind === 'over_budget') {\n      this.sendBudgetExceeded(res, id);\n      return;\n    }\n\n    // Resolve target skill (actor system) + the user's turn text.\n    const skillId = this.readSkillId(parsedParams.data);\n    // R-2: resolved WITHIN this agent's declared skill subset — a `skillId` belonging to another\n    // agent is rejected like an unknown skill (no side-door into another agent's actor system).\n    const target = this.a2aService.resolveTargetSystemRef(skillId, instanceRef);\n    if (target.kind === 'error') {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.SKILL_NOT_FOUND, target.errorMessage);\n      return;\n    }\n    const text = this.readMessageText(parsedParams.data);\n    if (!text) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, 'the message has no text part');\n      return;\n    }\n    // Task CONTINUATION is not supported, and saying so beats silently doing something else\n    // (review finding A3-9). A client that attaches a message to an existing task expects that\n    // task to advance; opening a fresh one instead diverges the conversation invisibly. `contextId`\n    // is the supported way to continue a thread, and it is threaded through both planes below.\n    if (parsedParams.data.message.taskId) {\n      this.sendRpcError(\n        res,\n        id,\n        A2A_JsonRpcErrorCode.INVALID_PARAMS,\n        'continuing an existing task via `message.taskId` is not supported; use `message.contextId` to continue a conversation',\n      );\n      return;\n    }\n\n    // ── The context id is MINTED HERE, once, and shared by both planes (review finding A3-1) ──\n    //\n    // A2A clients do not send `contextId` on a FIRST turn — the server assigns it and the client\n    // echoes it back to continue the conversation. Reading it without a fallback therefore left it\n    // `undefined` on the entire default path, with three consequences that compounded:\n    //\n    //   1. `Task.contextId` is REQUIRED by the protocol, and the materialised task carried none —\n    //      so the object we answered with was non-conformant, and a later `tasks/get` reported\n    //      `''` (the projection's fallback), changing the field's shape between two responses.\n    //   2. `runTurn` mints its own uuid when it receives none, so the task and the conversational\n    //      execution ended up with UNRELATED ids and could never be correlated — killing the\n    //      indexed \"enumerate this conversation's tasks\" query the schema and spec both promise.\n    //   3. The client never received a context id, so a non-blocking conversation could not\n    //      be continued at all.\n    //\n    // Minting at the transport edge is what makes the two planes agree: the SAME value reaches\n    // `materialiseTask` and `runTurn`. Do not push this back down into either of them — one mints\n    // per plane, which is the defect.\n    const contextId = parsedParams.data.message.contextId ?? randomUUID();\n\n    // SIEM-2: audit machine resource-access at the authorized-dispatch boundary — the caller is\n    // authenticated + the target skill resolved, and the request is about to be dispatched. Fires\n    // once for BOTH send + stream (no-op for user-delegated turns); the access is recorded even if\n    // the turn later errors, matching FIELD_ACCESS \"recorded when accessed\" semantics.\n    this.a2aService.auditMachineAccess(authResult.auth, target.systemRef, method, getClientIpFromRequest(req));\n\n    if (method === 'message/stream') {\n      await this.handleStream(res, id, authResult.auth, authResult.owner, target.systemRef, text, contextId, instanceRef, dialect);\n      return;\n    }\n\n    // === Inline vs task-bearing, decided by the PROTOCOL — now actually by the protocol ===\n    //\n    // A2A `configuration.blocking === false` is the client declaring it does not want to block.\n    // When set, we materialise a task and answer with it straight away; the turn keeps running and\n    // advances that task. Otherwise the spec's blocking shape applies — a turn that completes\n    // inline answers with a `Message` and writes no task row at all.\n    //\n    // ⚠️ This used to read `configuration.returnImmediately`, **a field that does not exist in\n    // A2A** (review finding G5-1). The section heading was already \"decided by the PROTOCOL, not by\n    // a heuristic\" and that was the problem: it was decided by a Wildo invention, so no conformant\n    // client could ever reach the task plane, and `tasks/get` would answer TASK_NOT_FOUND forever.\n    // The sense is inverted from the old field, so this was never a rename.\n    //\n    // The reason a wall-clock \"long-running\" threshold is still wrong is unchanged: a timer-based\n    // rule would make the response TYPE non-deterministic for identical input. The client tells us.\n    // Reads BOTH dialects' flags — `configuration.blocking: false` (v0.2.5) and\n    // `return_immediately: true` (1.0). Passed the WHOLE params object, not just `configuration`:\n    // 1.0 puts its flag at the top level, so handing this only the configuration would look correct\n    // and silently ignore every 1.0 client's request for a non-blocking turn.\n    //\n    // That is not hypothetical — it is what shipped. `resolveNonBlockingRequest` existed, was pinned\n    // (D-11..D-14), and was wired at ZERO call sites; the dual-dialect live lane caught it on its\n    // first green run, with `SendMessage` accepted and `return_immediately` ignored.\n    if (resolveNonBlockingRequest(parsedParams.data)) {\n      const task = await this.a2aTaskService.materialiseTask({\n        owner: authResult.owner,\n        contextId,\n        title: text.slice(0, 120) || 'Agent turn',\n        // Stamps WHICH agent opened this task, so `tasks/get`/`tasks/cancel` can scope by it\n        // (review finding A3-6). Without it the task plane had no per-agent dimension and one\n        // agent's token could read another's tasks — including `title`, which is the first 120\n        // characters of the originating prompt.\n        instanceRef,\n        // The credential axis (finding H-5): `applicationId` is a deployment singleton, so without\n        // this every app-scope OAuth client shares one owner filter and could read — and cancel —\n        // another client's tasks, including `title`, which is the opening 120 chars of its prompt.\n        machineCredentialId: authResult.auth.initiatorIds?.machineCredential?.credentialId,\n      });\n      if (task) {\n        // AWAIT the lease before responding (review finding A3-5). The client cannot poll a task\n        // whose id it has not received yet, so completing `beginTurn` first closes the window\n        // completely rather than narrowing it: by the time the id escapes this process, the\n        // liveness lease exists and every replica reads the turn as alive. The cost is one Redis\n        // SET on a path that already did a database write.\n        //\n        // Fail SOFT: a lease we could not start makes the turn uncancellable and (until the\n        // sweep's grace window) readable as abandoned — both far better than answering 500 to a\n        // request whose work is about to run anyway. `beginTurn` already tolerates an absent\n        // Redis internally; this guards the unexpected throw.\n        let abortSignal: AbortSignal;\n        try {\n          abortSignal = await this.a2aTaskCancellation.beginTurn(task.id);\n        } catch (leaseError) {\n          this.logger.error('[A2A] Could not start the liveness lease; the turn will run but is not cancellable', {\n            taskId: task.id,\n            ...projectCaughtErrorLogFields(leaseError),\n          });\n          abortSignal = new AbortController().signal;\n        }\n        // Dispatch the turn without awaiting it: the client asked not to block, and the\n        // task it now holds is how it observes progress. Failures are recorded on the\n        // task rather than surfaced here — there is no open response left to write to.\n        void this.runTurnAndAdvanceTask(authResult, target.systemRef, text, contextId, task.id, abortSignal, instanceRef);\n        res.set('Cache-Control', 'no-store');\n        res.status(200).json({ jsonrpc: '2.0', id, result: projectTaskForDialect(task, dialect) });\n        return;\n      }\n      // Materialisation failed — degrade to the blocking path rather than failing the\n      // turn. The client gets a correct answer, just not an addressable one.\n    }\n\n    // message/send (blocking) — run one turn, return the agent's reply Message.\n    const turn = await this.a2aService.runTurn({\n      auth: authResult.auth,\n      owner: authResult.owner,\n      systemRef: target.systemRef,\n      text,\n      contextId,\n      // Carried on EVERY turn-start site, not only the task-bearing one (review finding A-1). The\n      // conversation records which agent opened it; omitting it here stored the default sentinel,\n      // so a named agent's blocking turns were reachable through any other agent — and mixing a\n      // blocking and a non-blocking turn on one `contextId` made the continuation read miss and the\n      // re-create collide on the globally-unique `executionId`, losing the transcript silently.\n      instanceRef,\n    });\n    if (turn.kind === 'error') {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INTERNAL_ERROR, `${turn.errorCode}: ${turn.errorMessage}`);\n      return;\n    }\n    // A BLOCKING turn that paused for approval cannot answer with a `Message` — there is no reply,\n    // and the caller must be given something addressable to come back to. So it materialises a task\n    // here even though the client did not ask for one: this is the second half of the header's rule\n    // that a task exists when the turn \"cannot complete inline\", and the first production caller of\n    // `materialiseTask`'s `status` seam, which was carried unexercised for exactly this arm.\n    //\n    // `input-required` is the state the client observes (the status map projects AWAITING_APPROVAL\n    // onto it), which is the protocol's own way of saying the agent is blocked pending input.\n    if (turn.kind === 'awaiting-approval') {\n      const pausedTask = await this.a2aTaskService.materialiseTask({\n        owner: authResult.owner,\n        contextId,\n        title: text.slice(0, 120) || 'Agent turn',\n        instanceRef,\n        machineCredentialId: authResult.auth.initiatorIds?.machineCredential?.credentialId,\n        status: FlowsActors_Status.AWAITING_APPROVAL,\n      });\n      if (pausedTask) {\n        res.set('Cache-Control', 'no-store');\n        res.status(200).json({ jsonrpc: '2.0', id, result: projectTaskForDialect(pausedTask, dialect) });\n        return;\n      }\n      // Materialisation failed. Unlike the non-blocking path there is no degrading to a correct\n      // answer — there IS no answer — so this is a genuine error rather than a fallback: the pause\n      // is persisted on the execution but the caller has no handle to resume it through.\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INTERNAL_ERROR, 'The turn is awaiting approval but no task could be opened for it.');\n      return;\n    }\n    res.set('Cache-Control', 'no-store');\n    res.status(200).json({ jsonrpc: '2.0', id, result: this.buildOutboundMessage(turn.text, turn.contextId) });\n  }\n\n  /**\n   * `message/stream` — Server-Sent Events. Each token delta is a `data:` frame\n   * carrying a JSON-RPC result with a partial (non-final) agent Message; a final\n   * frame carries the complete reply. Errors mid-stream are emitted as a JSON-RPC\n   * error frame, then the stream closes.\n   */\n  private async handleStream(\n    res: Response,\n    id: string | number | null,\n    auth: Parameters<A2ABackendService['runTurn']>[0]['auth'],\n    owner: Parameters<A2ABackendService['runTurn']>[0]['owner'],\n    systemRef: string,\n    text: string,\n    contextId?: string,\n    /**\n     * The agent this stream arrived through (review finding A-1).\n     *\n     * `handleStream` had no such parameter, so every streamed conversation stored the default\n     * sentinel regardless of which named agent served it. Threaded rather than defaulted: a\n     * default here is indistinguishable from the bug it replaced.\n     */\n    instanceRef?: string,\n    /**\n     * The vocabulary every frame of this stream must be written in.\n     *\n     * Threaded rather than defaulted, for the same reason `instanceRef` above is: a default here\n     * would be indistinguishable from forgetting to pass it, and the symptom — a 1.0 client reading\n     * `\"completed\"` on the terminal frame of an otherwise-correct stream — is exactly the kind that\n     * gets blamed on the client.\n     */\n    dialect: A2A_Dialect = A2A_Dialect.V0_2_5,\n  ): Promise<void> {\n    res.set({\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-store',\n      Connection: 'keep-alive',\n    });\n    res.flushHeaders?.();\n\n    const messageId = randomUUID();\n    const write = (payload: unknown): void => {\n      res.write(`data: ${JSON.stringify(payload)}\\n\\n`);\n    };\n\n    // ── Cancel the turn when the SSE client goes away (review finding F-6) ──────────────\n    //\n    // `message/stream` materialises NO task (the dispatcher returns here before the\n    // non-blocking branch), so THIS STREAM IS THE TURN'S ONLY DELIVERY CHANNEL. Once the\n    // client disconnects there is no consumer and no row to read the answer from later, yet the\n    // model keeps generating tokens the provider charges for and nobody can read. Wiring the\n    // socket's lifetime to the turn's is the only cancellation seam this path can have: unlike\n    // `tasks/cancel`, there is no task id to address it by.\n    //\n    // ⚠️ CORRECTION (review gate #2, F-A). An earlier revision of this comment justified the abort\n    // by claiming the un-aborted tokens are \"billed to the caller's tenant\" — that was BACKWARDS,\n    // and the inversion mattered. A completed turn IS metered; an aborted one used to be metered\n    // NOT AT ALL, because `result.usage` rejects on abort and the throw skipped `reportUsage`\n    // entirely. So cancellation was the UNMETERED path, and adding it here would have widened that\n    // hole from `tasks/cancel` (needs a task) to every `message/stream` turn. The saving is real\n    // provider spend, NOT budget headroom — and it is only safe because `streamTextToDeltas` now\n    // accumulates per-step usage that survives the abort. Do not re-justify this on billing.\n    //\n    // The inverse must stay true for the non-blocking path — it MUST NOT abort on\n    // disconnect, because its result lands on a task row the client polls afterwards, so the\n    // response closing is expected rather than a signal to stop.\n    //\n    // The signal reaches AI-SDK `streamText`, which aborts the bounded multi-step tool loop\n    // between steps — so this cancels tool work, not merely the text stream.\n    const clientGone = new AbortController();\n    const onClientDisconnect = (): void => clientGone.abort();\n    res.on('close', onClientDisconnect);\n\n    try {\n      const turn = await this.a2aService.runTurn({\n        auth,\n        owner,\n        systemRef,\n        text,\n        contextId,\n        instanceRef,\n        abortSignal: clientGone.signal,\n        hooks: {\n          onDelta: (delta) => {\n            // Don't write to a socket the client already dropped. Abort is cooperative, so a\n            // delta already in flight can arrive after `close`; writing it is harmless but\n            // pointless, and skipping keeps the \"client gone → stop producing\" story true at\n            // every layer rather than only at the model call.\n            if (clientGone.signal.aborted) return;\n            write({ jsonrpc: '2.0', id, result: this.buildOutboundMessage(delta, contextId ?? messageId, messageId, false) });\n          },\n        },\n      });\n\n      // Detach BEFORE writing the terminal frame: `res.end()` below itself emits `close`, and a\n      // completed turn must not be mistaken for a disconnect. `off` is idempotent, so the\n      // `finally` still covers the throw path.\n      res.off('close', onClientDisconnect);\n\n      // The client vanished mid-turn — the socket is gone, so there is nothing to write and no\n      // task row to record against. Returning silently is the whole outcome.\n      if (clientGone.signal.aborted) return;\n\n      if (turn.kind === 'error') {\n        write({ jsonrpc: '2.0', id, error: { code: A2A_JsonRpcErrorCode.INTERNAL_ERROR, message: `${turn.errorCode}: ${turn.errorMessage}` } });\n      } else if (turn.kind === 'awaiting-approval') {\n        // The terminal frame of a paused stream is a TASK, not a message. The protocol's streaming\n        // result is a union that includes `Task`, so this is a conformant frame shape rather than a\n        // special case — and it is the only one that carries an id the caller can resume through.\n        //\n        // Without this arm the stream closed on a final EMPTY message: a client saw a completed\n        // answer of \"\", with the pending decision reported nowhere on this transport at all.\n        const pausedTask = await this.a2aTaskService.materialiseTask({\n          owner,\n          contextId: contextId ?? messageId,\n          title: text.slice(0, 120) || 'Agent turn',\n          instanceRef,\n          machineCredentialId: auth.initiatorIds?.machineCredential?.credentialId,\n          status: FlowsActors_Status.AWAITING_APPROVAL,\n        });\n        if (pausedTask) {\n          write({ jsonrpc: '2.0', id, result: projectTaskForDialect(pausedTask, dialect) });\n        } else {\n          write({ jsonrpc: '2.0', id, error: { code: A2A_JsonRpcErrorCode.INTERNAL_ERROR, message: 'The turn is awaiting approval but no task could be opened for it.' } });\n        }\n      } else {\n        write({ jsonrpc: '2.0', id, result: this.buildOutboundMessage(turn.text, turn.contextId, messageId, true) });\n      }\n      res.end();\n    } finally {\n      res.off('close', onClientDisconnect);\n    }\n  }\n\n  /**\n   * `tasks/resubscribe` — re-attach to a task's update stream after a dropped connection.\n   *\n   * ## What the protocol asks for, and what it deliberately leaves open\n   *\n   * The method takes `TaskIdParams` and answers an SSE stream of `SendStreamingMessageResponse`\n   * objects; it is an OPTIONAL capability gated on `AgentCard.capabilities.streaming`, which this\n   * agent advertises as `true`. Events missed while the client was disconnected are explicitly\n   * implementation-dependent — the obligation is to resume delivering SUBSEQUENT updates, not to\n   * replay history.\n   * spec-cite: A2A v0.2.5 — `tasks/resubscribe` (params `TaskIdParams`, result\n   * `SendStreamingMessageResponse` stream, gated on `capabilities.streaming`).\n   *\n   * That is what makes this implementable without an event log: there is no per-task event bus, and\n   * inventing one to replay deltas nobody is owed would be a large mechanism serving a requirement\n   * that does not exist. This observes the task's STATE and emits a frame whenever it changes.\n   *\n   * ## Why it reuses `handleTaskMethod`'s read rather than doing its own\n   *\n   * The caller-supplied task id is the whole attack surface here. Routing through the shared\n   * handler means resubscribe inherits, unchanged, every gate `tasks/get` passes: the addressed\n   * agent's audience binding, the audit emit, and the four-axis owner filter (owner FK + agent\n   * instance + machine credential). A parallel path would have been a second transport reaching the\n   * same rows — the exact shape that has produced cross-client disclosure on this plane before, and\n   * a `TASK_NOT_FOUND` here means \"not yours\" as indistinguishably as it does there.\n   *\n   * The first frame is the task's CURRENT state. Strictly the protocol only owes what follows, but a\n   * client that just reconnected has no idea where the task got to, and withholding it would force\n   * an immediate `tasks/get` to learn what this stream is about.\n   */\n  /**\n   * The four `tasks/pushNotificationConfig/*` methods, after the shared gates have run.\n   *\n   * Reached ONLY through `handleTaskMethod`, so by the time this executes the caller has already\n   * passed authentication, the addressed agent's audience binding, the audit emit, and the\n   * four-axis owner read that proved the task is theirs. Nothing here re-authorizes, and nothing\n   * here may be reachable by another route — a configuration is addressed by a caller-supplied task\n   * id, which is the identical attack surface `tasks/get` and `tasks/resubscribe` have.\n   *\n   * ## What leaves this method is always redacted\n   *\n   * `token` and `authentication.credentials` are the client's own secrets, held so we can present\n   * them to its webhook. Every response path below goes through `redactPushNotificationSecrets`,\n   * including the echo `set` returns. Echoing them back buys nothing — the client chose them — and\n   * not echoing them means no read of this task can become a credential disclosure through a future\n   * projection, a log line, or an audit row that captures a result.\n   *\n   * spec-cite: A2A 1.0 §§3.1.7–3.1.10 (the four operations, their inputs and outputs) and §13.2\n   * (*\"Authentication tokens in `PushNotificationConfig` **SHOULD** be treated as secrets\"*).\n   */\n  /**\n   * A2A 1.0 `ListTasks` — enumerate the caller's own tasks.\n   *\n   * spec-cite: A2A 1.0 §3.1.4 / proto `ListTasksRequest` — filters `context_id` and `status`, and\n   * *\"`page_size` … If unspecified, at most 50 tasks will be returned. The minimum value is 1. The\n   * maximum value is 100.\"* `ListTasksResponse` carries `tasks`, `next_page_token`, `page_size` and\n   * `total_size`, all REQUIRED.\n   *\n   * 1.0-only, so it never reaches `handleTaskMethod` (which is addressed by a task id). It therefore\n   * repeats that funnel's gates deliberately and in the same order — instance resolution,\n   * credential-presence short-circuit, authentication, audit — because a LIST is exactly the shape\n   * where a missing gate is least visible: it answers plausibly with an empty array.\n   */\n  private async handleListTasks(\n    req: Request,\n    res: Response,\n    id: string | number | null,\n    params: unknown,\n    dialect: A2A_Dialect,\n  ): Promise<void> {\n    const resolvedInstance = this.resolveInstanceRef(req);\n    if (!resolvedInstance) {\n      res.status(404).json({ error: 'not_found', error_description: 'no such A2A agent' });\n      return;\n    }\n    const token = this.extractBearerToken(req);\n    // Short-circuit a MISSING credential before authenticating — handing `undefined` to\n    // `authenticateCaller` writes a MACHINE_AUTH_FAILED row and increments the per-IP counter SHARED\n    // with /oauth/token, so an unauthenticated flood here would throttle token minting for everyone\n    // behind one egress IP.\n    if (!token) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, 'a Bearer access token is required', 'Bearer');\n      return;\n    }\n    const authResult = await this.a2aService.authenticateCaller(token, getClientIpFromRequest(req), resolvedInstance.instanceRef);\n    if (authResult.kind === 'error') {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.UNAUTHENTICATED, authResult.errorMessage, 'Bearer');\n      return;\n    }\n\n    const parsed = A2A_ListTasksParamsSchema.safeParse(params ?? {});\n    if (!parsed.success) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, parsed.error.issues[0]?.message ?? 'invalid params');\n      return;\n    }\n\n    // Enumeration is its OWN audited operation — see `A2A_TASKS_LIST`. Emitted before the read, so\n    // an attempt that returns nothing is still recorded.\n    this.a2aService.auditMachineAccess(authResult.auth, '', 'ListTasks', getClientIpFromRequest(req));\n\n    const page = decodeListTasksPageToken(parsed.data.pageToken);\n    const { tasks, totalSize } = await this.a2aTaskService.listTasks(\n      authResult.owner,\n      resolvedInstance.instanceRef,\n      {\n        ...(parsed.data.contextId ? { contextId: parsed.data.contextId } : {}),\n        ...(parsed.data.status ? { status: fromA2ATaskState(parsed.data.status) } : {}),\n      },\n      { pageSize: parsed.data.pageSize, page },\n    );\n\n    this.sendRpcResult(res, id, {\n      tasks: tasks.map((task) => projectTaskForDialect(task, dialect)),\n      // A full page implies there MAY be another; an empty token means \"no more\". The token is\n      // opaque by contract, so encoding the next page number in it is conformant and keeps the\n      // repository's page-based pagination out of the wire shape.\n      nextPageToken: tasks.length === parsed.data.pageSize ? String(page + 1) : '',\n      pageSize: parsed.data.pageSize,\n      // `total_size` is REQUIRED and documented as the total BEFORE pagination. We report the page's\n      // own size, which is a KNOWN divergence: a true count needs a second aggregate query on every\n      // list, and this transport has no caller that pages deeply. Recorded rather than silently\n      // approximated — if a client ever paginates on it, this is the line to fix.\n      totalSize,\n    });\n  }\n\n  private async handlePushNotificationConfigMethod(\n    res: Response,\n    id: string | number | null,\n    method: A2A_PushNotificationConfigMethod,\n    params: unknown,\n    owner: Parameters<A2ATaskBackendService['readTask']>[0],\n    taskId: string,\n    instanceRef: string,\n    machineCredentialId: string | undefined,\n  ): Promise<void> {\n    const stored = await this.a2aTaskService.readPushNotificationConfigs(owner, taskId, instanceRef, machineCredentialId);\n    if (stored === undefined) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_FOUND, `task '${taskId}' was not found`);\n      return;\n    }\n    // Responses are A2A 1.0 (FLAT) — including the reply to a legacy-shaped `set`.\n    //\n    // An earlier attempt mirrored the request's shape on every verb. It was wrong, and the way it\n    // broke is worth recording: `list` returns 1.0's `{ configs[], nextPageToken }` envelope, which\n    // v0.2.5 does not have (its `list` result is a bare array). Answering nested ITEMS inside a 1.0\n    // ENVELOPE produces a chimera conforming to neither version — strictly worse than picking one.\n    //\n    // So the rule is: be liberal in what `set` ACCEPTS (a v0.2.5 client's params are understood),\n    // strict in what everything EMITS (1.0). The residual is real and recorded rather than papered\n    // over: the agent card still declares `protocolVersion: \"0.2.5\"`, so a v0.2.5 client's `get` /\n    // `delete` — which address the task as `params.id` — are refused. The honest fix is migrating\n    // the whole surface to the 1.0 method vocabulary and bumping the card; that is a separate unit\n    // touching every method and every live lane.\n    const wireForm = A2A_PushConfigWireForm.FLAT;\n    const toWire = (config: A2A_StoredPushNotificationConfig) =>\n      toWireTaskPushNotificationConfig(redactPushNotificationSecrets(config), taskId, wireForm);\n\n    if (method === 'tasks/pushNotificationConfig/set') {\n      // Accepts BOTH the v0.2.5 nested shape and the 1.0 flat one, and reports which arrived —\n      // see `A2A_PushConfigWireForm` for why that matters on a card declaring `protocolVersion: \"0.2.5\"`.\n      const parsed = parseSetPushNotificationConfigParams(params);\n      if (parsed.kind === 'error') {\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, parsed.message);\n        return;\n      }\n\n      // The SSRF gate, at the one point a client is present to be told why it was refused. It is\n      // not the complete control and does not pretend to be — a hostname is not resolved here, so\n      // the remaining defence belongs at connect time in the egress path.\n      const rejection = rejectUnsafePushNotificationUrl(parsed.data.url);\n      if (rejection) {\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, `the webhook url was refused: ${rejection}`);\n        return;\n      }\n\n      // A client-supplied `id` UPDATES that configuration; its absence creates one. Both are `set`\n      // in this vocabulary, and honouring the supplied id is what makes the operation idempotent —\n      // a client retrying after a timeout must not silently accumulate duplicate delivery targets\n      // for the same webhook.\n      const configId = parsed.data.id ?? randomUUID();\n      const config: A2A_StoredPushNotificationConfig = {\n        id: configId,\n        url: parsed.data.url,\n        ...(parsed.data.token ? { token: parsed.data.token } : {}),\n        ...(parsed.data.authentication ? { authentication: parsed.data.authentication } : {}),\n      };\n      const next = [...stored.filter((existing) => existing.id !== configId), config];\n\n      if (!(await this.a2aTaskService.replacePushNotificationConfigs(owner, taskId, next, instanceRef, machineCredentialId))) {\n        // The read above proved the task was visible, so a write that matches nothing means it was\n        // removed in between — not that the caller was never entitled to it. Reporting success\n        // would leave the client believing it is subscribed to a task that no longer exists.\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_FOUND, `task '${taskId}' was not found`);\n        return;\n      }\n      this.sendRpcResult(res, id, toWire(config));\n      return;\n    }\n\n    if (method === 'tasks/pushNotificationConfig/list') {\n      const parsed = A2A_ListPushNotificationConfigsParamsSchema.safeParse({ ...(params as object), id: taskId });\n      if (!parsed.success) {\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, parsed.error.issues[0]?.message ?? 'invalid params');\n        return;\n      }\n      // Pagination is a MAY in the norm, and it is honoured rather than ignored so a conformant 1.0\n      // client's `pageSize` is not silently overrun. The page token is the OFFSET as a string: the\n      // list is a small, wholly-read array on one row, so a cursor keyed on an id would buy\n      // stability this collection cannot lose in the first place.\n      const offset = Number.parseInt(parsed.data.pageToken ?? '0', 10);\n      const start = Number.isSafeInteger(offset) && offset > 0 ? offset : 0;\n      const pageSize = parsed.data.pageSize ?? stored.length;\n      const page = stored.slice(start, start + pageSize);\n      const nextOffset = start + page.length;\n\n      this.sendRpcResult(res, id, {\n        configs: page.map(toWire),\n        ...(nextOffset < stored.length ? { nextPageToken: String(nextOffset) } : {}),\n      });\n      return;\n    }\n\n    // Resolved by DIALECT, not by key order: 1.0 puts the configuration in `id`, v0.2.5 puts the\n    // TASK there. An earlier version overwrote `id` with the task id before parsing, which silently\n    // discarded a conformant 1.0 client's configuration id and made every `get`/`delete` behave as\n    // though none had been supplied.\n    const configId = resolvePushNotificationConfigId(params);\n\n    if (method === 'tasks/pushNotificationConfig/get') {\n      // With no id, a single-configuration task is readable without the client having kept the id —\n      // and an ambiguous read is refused rather than guessed, because returning \"some configuration\"\n      // would make a client believe it had read the one it meant.\n      const match = configId ? stored.find((existing) => existing.id === configId) : (stored.length === 1 ? stored[0] : undefined);\n      if (!match) {\n        this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_FOUND, 'no such push notification configuration');\n        return;\n      }\n      this.sendRpcResult(res, id, toWire(match));\n      return;\n    }\n\n    // delete — IDEMPOTENT by contract, so removing an absent configuration SUCCEEDS.\n    // spec-cite: A2A 1.0 §3.1.10 — *\"MUST be idempotent - multiple deletions of the same config\n    // have the same effect\"*. Answering not-found on the second call would make a retrying client\n    // report failure for work that is done, which is the opposite of what idempotence is for.\n    if (!configId) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.INVALID_PARAMS, 'pushNotificationConfigId is required');\n      return;\n    }\n    const remaining = stored.filter((existing) => existing.id !== configId);\n    // Skip the write when nothing changed: a repeated delete must not keep touching the row, and\n    // must not fail merely because the task finished between the two calls.\n    if (remaining.length !== stored.length\n      && !(await this.a2aTaskService.replacePushNotificationConfigs(owner, taskId, remaining, instanceRef, machineCredentialId))) {\n      this.sendRpcError(res, id, A2A_JsonRpcErrorCode.TASK_NOT_FOUND, `task '${taskId}' was not found`);\n      return;\n    }\n    this.sendRpcResult(res, id, null);\n  }\n\n  private async streamTaskUpdates(\n    res: Response,\n    id: string | number | null,\n    owner: Parameters<A2ATaskBackendService['readTask']>[0],\n    taskId: string,\n    instanceRef: string | undefined,\n    machineCredentialId: string | undefined,\n    initialTask: A2A_OutboundTask,\n  ): Promise<void> {\n    res.set({\n      'Content-Type': 'text/event-stream',\n      'Cache-Control': 'no-store',\n      Connection: 'keep-alive',\n    });\n    res.flushHeaders?.();\n\n    const write = (payload: unknown): void => {\n      res.write(`data: ${JSON.stringify(payload)}\\n\\n`);\n    };\n\n    let clientGone = false;\n    const onClientDisconnect = (): void => { clientGone = true; };\n    res.on('close', onClientDisconnect);\n\n    try {\n      write({ jsonrpc: '2.0', id, result: initialTask });\n      // A task that is ALREADY finished has no subsequent updates to wait for. Holding the socket\n      // open would be a connection leak dressed as a feature, and the client would learn nothing it\n      // does not already have from the frame above.\n      if (A2A_TERMINAL_TASK_STATES.has(initialTask.status.state)) return;\n\n      let lastState = initialTask.status.state;\n      const deadline = Date.now() + A2A_RESUBSCRIBE_MAX_DURATION_MS;\n\n      while (!clientGone && Date.now() < deadline) {\n        await sleep(A2A_RESUBSCRIBE_POLL_INTERVAL_MS);\n        if (clientGone) break;\n\n        // The SAME filtered read the subscribe passed. Re-applied on every poll rather than cached:\n        // a task can be cancelled or reassigned mid-stream, and a stream that kept serving from a\n        // snapshot taken at connect time would keep answering after the caller's access to it had\n        // changed.\n        const current = await this.a2aTaskService.readTask(owner, taskId, instanceRef, machineCredentialId);\n        if (!current) return;\n        if (current.status.state === lastState) continue;\n\n        lastState = current.status.state;\n        write({ jsonrpc: '2.0', id, result: current });\n        if (A2A_TERMINAL_TASK_STATES.has(current.status.state)) return;\n      }\n    } catch (streamError) {\n      this.logger.error('[A2A] Task update stream failed', { taskId, ...projectCaughtErrorLogFields(streamError) });\n    } finally {\n      res.off('close', onClientDisconnect);\n      // `end()` on an already-closed socket is a no-op, so this is safe on the disconnect path too.\n      res.end();\n    }\n  }\n\n  /** Build an A2A agent `Message` result. `final` marks the terminal streamed frame. */\n  private buildOutboundMessage(text: string, contextId: string, messageId?: string, final = true): A2A_OutboundMessage {\n    return {\n      kind: 'message',\n      role: A2A_MessageRole.AGENT,\n      parts: [{ kind: 'text', text }],\n      messageId: messageId ?? randomUUID(),\n      contextId,\n      metadata: { final },\n    };\n  }\n\n  /** Read the caller-selected skill id from message metadata or params metadata. */\n  private readSkillId(params: A2A_MessageSendParams): string | undefined {\n    const fromMessage = params.message.metadata?.skillId;\n    const fromParams = params.metadata?.skillId;\n    const value = fromMessage ?? fromParams;\n    return typeof value === 'string' ? value : undefined;\n  }\n\n  /** Concatenate the text parts of the inbound message (text-only mapping). */\n  private readMessageText(params: A2A_MessageSendParams): string | undefined {\n    const text = params.message.parts\n      .filter((part) => part.kind === 'text' && typeof part.text === 'string')\n      .map((part) => part.text as string)\n      .join('')\n      .trim();\n    return text.length > 0 ? text : undefined;\n  }\n\n  private extractBearerToken(req: Request): string | undefined {\n    const authHeader = req.headers['authorization'];\n    if (typeof authHeader !== 'string' || !authHeader.startsWith('Bearer ')) return undefined;\n    const token = authHeader.slice('Bearer '.length).trim();\n    return token.length > 0 ? token : undefined;\n  }\n\n  /**\n   * The success counterpart of {@link sendRpcError}.\n   *\n   * Added for the push-configuration methods rather than hand-writing the envelope at each of their\n   * five exits. `result` is deliberately typed to include `null`: `delete` answers with a null\n   * result, which is a VALID JSON-RPC success and must not be confused with an omitted `result`.\n   *\n   * The `Cache-Control: no-store` mirrors the error path on purpose — a configuration read carries a\n   * client's webhook URL, and an intermediary caching it would disclose one client's delivery target\n   * to whoever shares that cache.\n   */\n  private sendRpcResult(res: Response, id: string | number | null, result: unknown): void {\n    res.set('Cache-Control', 'no-store');\n    res.status(200).json({ jsonrpc: '2.0', id, result });\n  }\n\n  private sendRpcError(\n    res: Response,\n    id: string | number | null,\n    code: A2A_JsonRpcErrorCode,\n    message: string,\n    wwwAuthenticate?: 'Bearer',\n  ): void {\n    res.set('Cache-Control', 'no-store');\n    if (wwwAuthenticate) res.set('WWW-Authenticate', wwwAuthenticate);\n    // JSON-RPC errors ride HTTP 200; the error is in the envelope.\n    res.status(200).json({ jsonrpc: '2.0', id, error: { code, message } });\n  }\n\n  /**\n   * Transport-level throttle response: HTTP 429 + `Retry-After`, carrying a valid JSON-RPC\n   * error envelope with `RATE_LIMITED`. Distinct from {@link sendRpcError} (HTTP 200) because\n   * rate-limiting is a transport concern a client should honor at the HTTP layer.\n   */\n  /**\n   * Transport-level budget denial: HTTP **402** (payment required) carrying a valid JSON-RPC error\n   * envelope with `BUDGET_EXCEEDED`. No `Retry-After` — unlike a rate limit, waiting a few seconds\n   * does not help; the tenant must upgrade its plan or wait for the billing period to roll. The\n   * message is deliberately generic: the caller is an external agent, and the tenant's exact\n   * allowance / consumption is billing detail that belongs on the owner's own billing surface.\n   */\n  private sendBudgetExceeded(res: Response, id: string | number | null): void {\n    res.set('Cache-Control', 'no-store');\n    res.status(402).json({\n      jsonrpc: '2.0',\n      id,\n      error: {\n        code: A2A_JsonRpcErrorCode.BUDGET_EXCEEDED,\n        message: 'The LLM token budget for this period has been exhausted.',\n      },\n    });\n  }\n\n  private sendRateLimited(res: Response, id: string | number | null, retryAfterSeconds: number): void {\n    res.set('Cache-Control', 'no-store');\n    res.set('Retry-After', String(retryAfterSeconds));\n    res.status(429).json({\n      jsonrpc: '2.0',\n      id,\n      error: { code: A2A_JsonRpcErrorCode.RATE_LIMITED, message: 'Rate limit exceeded; retry after the indicated delay.' },\n    });\n  }\n}\n"]}

package/dist/esm/flows-actors/a2a/models/a2a-dialect.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-dialect.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/flows-actors/a2a/models/a2a-dialect.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,aAAa,EAAkB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,+FAA+F;AAC/F,oBAAY,WAAW;IACrB,4EAA4E;IAC5E,MAAM,UAAU;IAChB,wBAAwB;IACxB,IAAI,QAAQ;CACb;AAED;;;;;;;GAOG;AACH,oBAAY,aAAa;IACvB,YAAY,iBAAiB;IAC7B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;IACrB,WAAW,gBAAgB;IAC3B,iBAAiB,sBAAsB;IACvC,+BAA+B,oCAAoC;IACnE,4BAA4B,iCAAiC;IAC7D,8BAA8B,mCAAmC;IACjE,+BAA+B,oCAAoC;IACnE;;;;;;OAMG;IACH,UAAU,eAAe;IACzB;;;;;;OAMG;IACH,uBAAuB,4BAA4B;CACpD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;CAUO,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;CAYS,CAAC;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,aAAa,CAG9D,CAAC;AAeH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,aAAa,GAAG,oBAAoB,GAAG,SAAS,CAE7F;AAED,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,8BAA8B,CAAC;AAE/E,0FAA0F;AAC1F,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAQ/E;AA6BD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAErF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAG7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,GAAG,CAAC,CAM/G;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAMlE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAO9E"}
+{"version":3,"file":"a2a-dialect.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/a2a/models/a2a-dialect.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,aAAa,EAAkB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,+FAA+F;AAC/F,oBAAY,WAAW;IACrB,4EAA4E;IAC5E,MAAM,UAAU;IAChB,wBAAwB;IACxB,IAAI,QAAQ;CACb;AAED;;;;;;;GAOG;AACH,oBAAY,aAAa;IACvB,YAAY,iBAAiB;IAC7B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;IACrB,WAAW,gBAAgB;IAC3B,iBAAiB,sBAAsB;IACvC,+BAA+B,oCAAoC;IACnE,4BAA4B,iCAAiC;IAC7D,8BAA8B,mCAAmC;IACjE,+BAA+B,oCAAoC;IACnE;;;;;;OAMG;IACH,UAAU,eAAe;IACzB;;;;;;OAMG;IACH,uBAAuB,4BAA4B;CACpD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;CAUO,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;CAYS,CAAC;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,aAAa,CAG9D,CAAC;AAeH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,aAAa,GAAG,oBAAoB,GAAG,SAAS,CAE7F;AAED,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,8BAA8B,CAAC;AAE/E,0FAA0F;AAC1F,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAQ/E;AA6BD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAErF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAG7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,GAAG,CAAC,CAM/G;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAMlE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAO9E"}

package/dist/esm/flows-actors/a2a/models/a2a-push-notification-delivery.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-notification-delivery.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/flows-actors/a2a/models/a2a-push-notification-delivery.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,cAAc,yBAAyB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,kGAAkG;IAClG,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,oFAAoF;AACpF,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,yBAAyB,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,2BAA2B,CAS9G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,gCAAgC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASrG;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpE"}
+{"version":3,"file":"a2a-push-notification-delivery.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/a2a/models/a2a-push-notification-delivery.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,cAAc,yBAAyB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,kGAAkG;IAClG,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,oFAAoF;AACpF,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,yBAAyB,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,2BAA2B,CAS9G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,gCAAgC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASrG;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpE"}

package/dist/esm/flows-actors/a2a/models/a2a-push-notification.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-push-notification.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/flows-actors/a2a/models/a2a-push-notification.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAqBlF,kFAAkF;AAClF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;KAM1C,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;iBAOjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,+FAA+F;AAC/F,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAQ/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;GAuB9C,CAAC;AAEL,yGAAyG;AACzG,eAAO,MAAM,2CAA2C;;;;iBAKtD,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;;iBAKpD,CAAC;AAkBH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,sBAAsB;IAChC,2DAA2D;IAC3D,MAAM,WAAW;IACjB,+DAA+D;IAC/D,IAAI,SAAS;CACd;AAED,oFAAoF;AACpF,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,EAAE,sBAAsB,CAAC;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,OAAO,GACd;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,6CAA6C,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAa1G;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUnF;AAED,0FAA0F;AAC1F,eAAO,MAAM,wCAAwC;;;iBAKnD,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,gCAAgC,EACxC,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,sBAAoD,GAC7D,8BAA8B,GAAG,oCAAoC,CAevE;AAED,8FAA8F;AAC9F,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC9D,CAAC;CACH;AAED,+DAA+D;AAC/D,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,gCAAgC,EAAE,GAAG,MAAM,CAEpG;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,gCAAgC,EAAE,CAQ/G;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,6BAA6B,CAAC,CAAC,SAAS;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,sBAAsB,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAMjI;AAED,8FAA8F;AAC9F,oBAAY,gCAAgC;IAC1C,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,2BAA2B,gCAAgC;IAC3D,6BAA6B,kCAAkC;CAChE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,gCAAgC,GAAG,SAAS,CAyB5G;AAKD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB;;IAEpC,yFAAyF;;;;iBAIzF,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAG1E"}
+{"version":3,"file":"a2a-push-notification.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/a2a/models/a2a-push-notification.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAqBlF,kFAAkF;AAClF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;KAM1C,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;iBAOjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,+FAA+F;AAC/F,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAQ/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;GAuB9C,CAAC;AAEL,yGAAyG;AACzG,eAAO,MAAM,2CAA2C;;;;iBAKtD,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;;iBAKpD,CAAC;AAkBH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,sBAAsB;IAChC,2DAA2D;IAC3D,MAAM,WAAW;IACjB,+DAA+D;IAC/D,IAAI,SAAS;CACd;AAED,oFAAoF;AACpF,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,EAAE,sBAAsB,CAAC;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,OAAO,GACd;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,6CAA6C,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAa1G;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUnF;AAED,0FAA0F;AAC1F,eAAO,MAAM,wCAAwC;;;iBAKnD,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,gCAAgC,EACxC,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,sBAAoD,GAC7D,8BAA8B,GAAG,oCAAoC,CAevE;AAED,8FAA8F;AAC9F,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC9D,CAAC;CACH;AAED,+DAA+D;AAC/D,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,gCAAgC,EAAE,GAAG,MAAM,CAEpG;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,gCAAgC,EAAE,CAQ/G;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,6BAA6B,CAAC,CAAC,SAAS;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,sBAAsB,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAMjI;AAED,8FAA8F;AAC9F,oBAAY,gCAAgC;IAC1C,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,2BAA2B,gCAAgC;IAC3D,6BAA6B,kCAAkC;CAChE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,gCAAgC,GAAG,SAAS,CAyB5G;AAKD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB;;IAEpC,yFAAyF;;;;iBAIzF,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAG1E"}