dsh-a2a-server 0.1.0

package/lib/router.js

@@ -0,0 +1,432 @@
+/**
+ * HTTP + JSON-RPC dispatch.
+ *
+ * Deliberately free of Cordis: everything it needs arrives through
+ * {@link RouterDeps}, so the RPC semantics can be unit-tested without booting a
+ * composition or opening a socket. This is the same separation Hermes reached
+ * for when it made its request handler reachable through `server.adapter`.
+ *
+ * @module dsh-a2a/router
+ */
+import { A2AContextId, ERR_INVALID_PARAMS, ERR_INVALID_REQUEST, ERR_METHOD_NOT_FOUND, ERR_PARSE, ERR_PUSH_NOT_SUPPORTED, ERR_TASK_NOT_CANCELABLE, ERR_UNSUPPORTED_OPERATION, A2ARpcError, jsonRpcError, jsonRpcResult, nowIso, parseSendParams, partsToText, renderStatusUpdate, renderTask, resolveMethod, sseFrame, taskNotFound, } from "./protocol/index.js";
+import { filterInbound, redactOutbound } from "./security.js";
+/** Largest request body accepted, before parsing. */
+const MAX_BODY_BYTES = 1_000_000;
+/**
+ * Build the router.
+ * @param deps - the injected plugin capabilities.
+ * @returns the route handlers plus stream teardown.
+ */
+export function createRouter(deps) {
+    const { config } = deps;
+    const streams = new Set();
+    const sendJson = (res, status, body) => {
+        const text = JSON.stringify(body);
+        res.writeHead(status, {
+            'content-type': 'application/json',
+            'content-length': Buffer.byteLength(text),
+        });
+        res.end(text);
+    };
+    /**
+     * Answer an authentication-class failure.
+     *
+     * The status carries the real meaning — A2A puts transport security at the
+     * HTTP layer — while the body stays a valid JSON-RPC error envelope so a
+     * client that only parses bodies is not left with nothing.
+     */
+    const sendAuthFailure = (res, status, message) => {
+        if (status === 401)
+            res.setHeader('www-authenticate', 'Bearer');
+        sendJson(res, status, jsonRpcError(null, ERR_INVALID_REQUEST, message));
+    };
+    const readBody = async (req) => {
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of req) {
+            const buffer = chunk;
+            size += buffer.length;
+            if (size > MAX_BODY_BYTES)
+                throw new A2ARpcError(ERR_PARSE, 'payload too large', 413);
+            chunks.push(buffer);
+        }
+        return Buffer.concat(chunks).toString('utf8');
+    };
+    const serveCard = (req, res) => {
+        // The card is public by design: discovery requires an anonymous read. A
+        // deployment that serves only known internal peers may still close it.
+        if (!config.card.public) {
+            sendAuthFailure(res, 401, 'unauthorized');
+            return;
+        }
+        sendJson(res, 200, deps.cardFor(req.headers.host));
+    };
+    const serveRpc = async (req, res) => {
+        if (req.method !== 'POST') {
+            sendJson(res, 405, jsonRpcError(null, ERR_INVALID_REQUEST, 'method not allowed'));
+            return;
+        }
+        let peer;
+        try {
+            deps.assertOpen();
+            const secrets = await deps.resolvePeerSecrets();
+            const header = req.headers.authorization;
+            peer = deps.identify(typeof header === 'string' ? /^Bearer\s+(.+)$/i.exec(header.trim())?.[1] : undefined, secrets);
+        }
+        catch (error) {
+            sendJson(res, 503, jsonRpcError(null, ERR_INVALID_REQUEST, String(error)));
+            return;
+        }
+        if (peer === undefined) {
+            sendAuthFailure(res, 401, 'unauthorized');
+            return;
+        }
+        if (!deps.rateLimiter.allow(peer)) {
+            sendAuthFailure(res, 429, 'rate limit exceeded');
+            return;
+        }
+        // An EMPTY allow list means "no allow list", matching the documented
+        // "omit to allow every authenticated peer". Schemastery materializes an
+        // omitted array as `[]`, so testing only for `undefined` would silently
+        // lock out every peer on a config that never mentioned trustedPeers.
+        if (config.trustedPeers !== undefined && config.trustedPeers.length > 0
+            && !config.trustedPeers.includes(peer)) {
+            sendAuthFailure(res, 403, `peer "${peer}" is not trusted`);
+            return;
+        }
+        let body;
+        try {
+            body = await readBody(req);
+        }
+        catch (error) {
+            const rpc = error;
+            sendJson(res, rpc.httpStatus ?? 400, jsonRpcError(null, rpc.code ?? ERR_PARSE, rpc.message));
+            return;
+        }
+        let request;
+        try {
+            const parsed = JSON.parse(body.length === 0 ? '{}' : body);
+            if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                sendJson(res, 400, jsonRpcError(null, ERR_INVALID_REQUEST, 'request must be a JSON object'));
+                return;
+            }
+            request = parsed;
+        }
+        catch {
+            sendJson(res, 400, jsonRpcError(null, ERR_PARSE, 'parse error'));
+            return;
+        }
+        const id = (request['id'] ?? null);
+        const method = typeof request['method'] === 'string' ? request['method'] : '';
+        const params = request['params'];
+        if (params !== undefined && (params === null || typeof params !== 'object')) {
+            sendJson(res, 200, jsonRpcError(id, ERR_INVALID_PARAMS, 'params must be an object'));
+            return;
+        }
+        const version = req.headers['a2a-version'];
+        if (typeof version === 'string' && version.length > 0
+            && !['0.3', '0.3.0', '1.0', '1.0.0'].includes(version)) {
+            sendJson(res, 200, jsonRpcError(id, ERR_INVALID_PARAMS, `unsupported A2A-Version: ${version}`));
+            return;
+        }
+        const entry = resolveMethod(method);
+        if (entry === undefined) {
+            sendJson(res, 200, jsonRpcError(id, ERR_METHOD_NOT_FOUND, `method not found: ${method}`));
+            return;
+        }
+        try {
+            await dispatch(entry.operation, entry.dialect, id, params, peer, res);
+        }
+        catch (error) {
+            if (error instanceof A2ARpcError) {
+                sendJson(res, error.httpStatus, jsonRpcError(id, error.code, error.message));
+                return;
+            }
+            deps.logger.warn(`a2a: ${method} failed: ${String(error)}`);
+            // Internal detail never reaches a peer: it can carry filesystem paths.
+            sendJson(res, 200, jsonRpcError(id, ERR_INVALID_REQUEST, 'internal error'));
+        }
+    };
+    /**
+     * Resolve the context a request addresses, creating one when none was named.
+     *
+     * A context owned by another peer is reported exactly as an absent one, so a
+     * peer cannot enumerate context ids by comparing responses.
+     */
+    const resolveContext = async (rawContextId, peer) => {
+        if (rawContextId === undefined)
+            return deps.createActivation(peer);
+        const found = deps.contexts.lookup(A2AContextId(rawContextId), peer);
+        if (found === 'unknown' || found === 'forbidden') {
+            throw new A2ARpcError(ERR_INVALID_PARAMS, `unknown contextId: ${rawContextId}`);
+        }
+        return found;
+    };
+    /**
+     * Find an IN-FLIGHT task slot this peer owns.
+     *
+     * A settled task has no slot — `settleSlot` removes it — so this is only the
+     * first half of a lookup. Operations that merely READ a task fall through to
+     * the projection ({@link readTask}); operations that act on a running task
+     * (cancel, resubscribe) need the live slot and stop here.
+     */
+    const requireSlot = (rawTaskId, peer) => {
+        const found = findSlot(rawTaskId, peer);
+        if (found === undefined)
+            throw taskNotFound(requireTaskId(rawTaskId));
+        return found;
+    };
+    /** Locate an in-flight slot this peer owns, without throwing when absent. */
+    const findSlot = (rawTaskId, peer) => {
+        const taskId = requireTaskId(rawTaskId);
+        for (const activation of deps.contexts.values()) {
+            if (activation.peer !== peer)
+                continue;
+            const slot = activation.slots.get(taskId);
+            if (slot !== undefined)
+                return { activation, slot };
+        }
+        return undefined;
+    };
+    /** Validate the `taskId` parameter shape. */
+    const requireTaskId = (rawTaskId) => {
+        if (typeof rawTaskId !== 'string' || rawTaskId.length === 0) {
+            throw new A2ARpcError(ERR_INVALID_PARAMS, 'taskId is required');
+        }
+        return rawTaskId;
+    };
+    /**
+     * Read a task's current state, live slot or not.
+     *
+     * Falls back to the durable projection, which is what makes `tasks/get`
+     * answerable after settlement — and, once persistence is composed, after a
+     * restart. A task belonging to another peer reports exactly like an absent
+     * one, so ownership cannot be probed by comparing responses.
+     */
+    const readTask = (rawTaskId, peer) => {
+        const taskId = requireTaskId(rawTaskId);
+        for (const activation of deps.contexts.values()) {
+            if (activation.peer !== peer)
+                continue;
+            const slot = activation.slots.get(taskId);
+            if (slot !== undefined) {
+                const state = slot.turn === undefined ? 'submitted' : 'working';
+                return deps.taskSnapshot(activation, slot, state, redactArtifacts(slot.texts.length > 0
+                    ? [{
+                            artifactId: `${taskId}-result`,
+                            parts: [{ kind: 'text', text: slot.texts.join('\n') }],
+                        }]
+                    : []));
+            }
+            const projected = deps.readProjectedTask?.(activation, taskId);
+            // Text read back from the log leaves the process just like live text
+            // does, so it goes through the same scrub.
+            if (projected !== undefined) {
+                return { ...projected, artifacts: redactArtifacts(projected.artifacts ?? []) };
+            }
+        }
+        throw taskNotFound(taskId);
+    };
+    const dispatch = async (operation, dialect, id, params, peer, res) => {
+        switch (operation) {
+            case 'send':
+            case 'stream': {
+                const parsed = parseSendParams(params);
+                if (parsed === undefined)
+                    throw new A2ARpcError(ERR_INVALID_PARAMS, 'message is required');
+                const raw = partsToText(parsed.message.parts);
+                if (raw.trim().length === 0) {
+                    throw new A2ARpcError(ERR_INVALID_PARAMS, 'message carries no readable content');
+                }
+                const activation = await resolveContext(parsed.message.contextId, peer);
+                const turn = deps.turns.track(activation.contextId);
+                if (turn > config.maxContextTurns) {
+                    const rejected = deps.taskSnapshot(activation, { taskId: 'rejected' }, 'rejected', [{
+                            artifactId: 'rejected',
+                            parts: [{
+                                    kind: 'text',
+                                    text: `context ${activation.contextId} exceeded ${config.maxContextTurns} turns; `
+                                        + 'start a new context or raise maxContextTurns',
+                                }],
+                        }]);
+                    sendJson(res, 200, jsonRpcResult(id, renderTask(rejected, dialect)));
+                    return;
+                }
+                const slot = await deps.submit(activation, filterInbound(raw), peer);
+                if (operation === 'stream') {
+                    openStream(res, id, dialect, slot, activation);
+                    return;
+                }
+                // A2A is async-first: `message/send` MAY answer with a non-terminal
+                // task. Whether it waits is negotiated, not fixed — the client asks
+                // through `configuration.blocking`, and the deployment's `sendMode` is
+                // only the default for a client that expresses no preference.
+                //
+                // The spec lets the server decline a blocking request ("The server may
+                // reject this if the task is long-running"), which is exactly what the
+                // timeout below does: the task keeps running and the peer polls.
+                const requested = parsed.configuration?.blocking;
+                const shouldBlock = requested ?? config.sendMode === 'block';
+                const settlement = shouldBlock
+                    ? await withTimeout(slot.settled, config.blockTimeoutMs)
+                    : undefined;
+                const task = settlement === undefined
+                    // Not an error: the peer polls tasks/get or resubscribes, and the task
+                    // keeps running. Erroring here would discard real work.
+                    ? deps.taskSnapshot(activation, slot, 'working', [])
+                    : deps.taskSnapshot(activation, slot, settlement.state, redactArtifacts(settlement.artifacts), settlement.stopReason);
+                sendJson(res, 200, jsonRpcResult(id, renderTask(task, dialect)));
+                return;
+            }
+            case 'get': {
+                const task = readTask(params?.['taskId'], peer);
+                sendJson(res, 200, jsonRpcResult(id, renderTask(task, dialect)));
+                return;
+            }
+            case 'cancel': {
+                const { activation, slot } = requireSlot(params?.['taskId'], peer);
+                if (slot.done)
+                    throw new A2ARpcError(ERR_TASK_NOT_CANCELABLE, 'task already reached a terminal state');
+                deps.cancel(activation, slot);
+                const task = deps.taskSnapshot(activation, slot, 'canceled', []);
+                sendJson(res, 200, jsonRpcResult(id, renderTask(task, dialect)));
+                return;
+            }
+            case 'resubscribe': {
+                const rawTaskId = params?.['taskId'];
+                const live = findSlot(rawTaskId, peer);
+                if (live !== undefined) {
+                    openStream(res, id, dialect, live.slot, live.activation);
+                    return;
+                }
+                // Already settled: a peer that reconnects after the fact still deserves
+                // the outcome. Emit the terminal transition from the projection and
+                // close, rather than claiming the task never existed.
+                const task = readTask(rawTaskId, peer);
+                openSettledStream(res, id, dialect, task);
+                return;
+            }
+            case 'push_set':
+            case 'push_get':
+            case 'push_list':
+            case 'push_delete': {
+                // Advertised as unsupported on the card, so a compliant peer never
+                // reaches this; answering with the spec's own code keeps one that does
+                // from guessing.
+                throw new A2ARpcError(config.push.enabled ? ERR_UNSUPPORTED_OPERATION : ERR_PUSH_NOT_SUPPORTED, 'push notifications are not enabled on this deployment');
+            }
+            default:
+                throw new A2ARpcError(ERR_METHOD_NOT_FOUND, `unsupported operation: ${operation}`);
+        }
+    };
+    /** Open an SSE stream and push this task's terminal transition when it settles. */
+    const openStream = (res, id, dialect, slot, activation) => {
+        res.writeHead(200, {
+            'content-type': 'text/event-stream',
+            'cache-control': 'no-cache',
+            connection: 'keep-alive',
+        });
+        const channel = {
+            res, id, dialect, taskId: slot.taskId, contextId: activation.contextId,
+        };
+        streams.add(channel);
+        res.write(sseFrame(id, renderStatusUpdate({
+            kind: 'status-update',
+            taskId: slot.taskId,
+            contextId: activation.contextId,
+            status: { state: slot.turn === undefined ? 'submitted' : 'working', timestamp: nowIso() },
+            final: false,
+        }, dialect)));
+        void slot.settled.then((settlement) => {
+            if (!streams.has(channel))
+                return;
+            for (const artifact of redactArtifacts(settlement.artifacts)) {
+                res.write(sseFrame(id, { kind: 'artifact-update', taskId: slot.taskId, contextId: activation.contextId, artifact, lastChunk: true }));
+            }
+            res.write(sseFrame(id, renderStatusUpdate({
+                kind: 'status-update',
+                taskId: slot.taskId,
+                contextId: activation.contextId,
+                status: { state: settlement.state, timestamp: nowIso() },
+                final: true,
+            }, dialect)));
+            streams.delete(channel);
+            res.end();
+        });
+    };
+    /**
+     * Answer a resubscribe for an already-settled task: one terminal frame, then close.
+     * @param res - the HTTP response to stream over.
+     * @param id - the JSON-RPC id to correlate frames with.
+     * @param dialect - the dialect the peer spoke.
+     * @param task - the settled task, read from the projection.
+     */
+    const openSettledStream = (res, id, dialect, task) => {
+        res.writeHead(200, {
+            'content-type': 'text/event-stream',
+            'cache-control': 'no-cache',
+            connection: 'keep-alive',
+        });
+        res.write(sseFrame(id, renderStatusUpdate({
+            kind: 'status-update',
+            taskId: task.id,
+            contextId: task.contextId,
+            status: task.status,
+            final: true,
+        }, dialect)));
+        res.end();
+    };
+    const closeStreams = () => {
+        for (const channel of streams) {
+            try {
+                channel.res.write(sseFrame(channel.id, renderStatusUpdate({
+                    kind: 'status-update',
+                    taskId: channel.taskId,
+                    contextId: A2AContextId(channel.contextId),
+                    status: { state: 'canceled', timestamp: nowIso() },
+                    final: true,
+                }, channel.dialect)));
+                channel.res.end();
+            }
+            catch {
+                // A socket already gone needs no farewell.
+            }
+        }
+        streams.clear();
+    };
+    return { serveCard, serveRpc, closeStreams };
+}
+/**
+ * Scrub credential-shaped text from artifacts before they leave the process.
+ * @param artifacts - the artifacts about to be sent.
+ * @returns artifacts with text parts redacted.
+ */
+function redactArtifacts(artifacts) {
+    return artifacts.map(artifact => ({
+        ...artifact,
+        parts: artifact.parts.map(part => part.kind === 'text' ? { kind: 'text', text: redactOutbound(part.text) } : part),
+    }));
+}
+/**
+ * Await a promise, resolving to undefined if it takes too long.
+ *
+ * A timeout is NOT an error here: the task keeps running and the peer polls.
+ * @param promise - the settlement to await.
+ * @param ms - the budget.
+ * @returns the settlement, or undefined on timeout.
+ */
+async function withTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => { resolve(undefined); }, ms);
+        timer.unref?.();
+    });
+    try {
+        return await Promise.race([promise, timeout]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=router.js.map

package/lib/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,SAAS,EACT,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,MAAM,EACN,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,QAAQ,EACR,YAAY,GAOb,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAyD,MAAM,eAAe,CAAA;AAGpH,qDAAqD;AACrD,MAAM,cAAc,GAAG,SAAS,CAAA;AAiDhC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACvB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAA;IAExC,MAAM,QAAQ,GAAG,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa,EAAQ,EAAE;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACjC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;YACpB,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;SAC1C,CAAC,CAAA;QACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACf,CAAC,CAAA;IAED;;;;;;OAMG;IACH,MAAM,eAAe,GAAG,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe,EAAQ,EAAE;QACrF,IAAI,MAAM,KAAK,GAAG;YAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAA;QAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAA;IACzE,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAoB,EAAmB,EAAE;QAC/D,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,KAAe,CAAA;YAC9B,IAAI,IAAI,MAAM,CAAC,MAAM,CAAA;YACrB,IAAI,IAAI,GAAG,cAAc;gBAAE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;YACrF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC/C,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAQ,EAAE;QACpE,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAA;YACzC,OAAM;QACR,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACpD,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QAClF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,CAAA;YACjF,OAAM;QACR,CAAC;QAED,IAAI,IAA8B,CAAA;QAClC,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAA;YAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;YACxC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAClB,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EACpF,OAAO,CACR,CAAA;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1E,OAAM;QACR,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAA;YACzC,OAAM;QACR,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAA;YAChD,OAAM;QACR,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;eAClE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,IAAI,kBAAkB,CAAC,CAAA;YAC1D,OAAM;QACR,CAAC;QAED,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAoB,CAAA;YAChC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;YAC5F,OAAM;QACR,CAAC;QAED,IAAI,OAAgC,CAAA;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACnE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,mBAAmB,EAAE,+BAA+B,CAAC,CAAC,CAAA;gBAC5F,OAAM;YACR,CAAC;YACD,OAAO,GAAG,MAAiC,CAAA;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAA;YAChE,OAAM;QACR,CAAC;QAED,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAA2B,CAAA;QAC5D,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAChC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC5E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,kBAAkB,EAAE,0BAA0B,CAAC,CAAC,CAAA;YACpF,OAAM;QACR,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;eAChD,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,kBAAkB,EAAE,4BAA4B,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/F,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,oBAAoB,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC,CAAA;YACzF,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;gBAC5E,OAAM;YACR,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,MAAM,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC3D,uEAAuE;YACvE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC,CAAA;IAED;;;;;OAKG;IACH,MAAM,cAAc,GAAG,KAAK,EAC1B,YAAgC,EAChC,IAAkB,EACG,EAAE;QACvB,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAA;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAA;QACpE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YACjD,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,sBAAsB,YAAY,EAAE,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED;;;;;;;OAOG;IACH,MAAM,WAAW,GAAG,CAAC,SAAkB,EAAE,IAAkB,EAA8C,EAAE;QACzG,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QACvC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAA;QACrE,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,CACf,SAAkB,EAClB,IAAkB,EACsC,EAAE;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChD,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAQ;YACtC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACzC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QACrD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,6CAA6C;IAC7C,MAAM,aAAa,GAAG,CAAC,SAAkB,EAAa,EAAE;QACtD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAA;QACjE,CAAC;QACD,OAAO,SAAsB,CAAA;IAC/B,CAAC,CAAA;IAED;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,CAAC,SAAkB,EAAE,IAAkB,EAAW,EAAE;QACnE,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;QAEvC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChD,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAQ;YACtC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAiB,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC7E,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAC/D,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;oBACnB,CAAC,CAAC,CAAC;4BACD,UAAU,EAAE,GAAG,MAAM,SAAS;4BAC9B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;yBACvD,CAAC;oBACF,CAAC,CAAC,EAAE,CACP,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;YAC9D,qEAAqE;YACrE,2CAA2C;YAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAA;YAChF,CAAC;QACH,CAAC;QACD,MAAM,YAAY,CAAC,MAAM,CAAC,CAAA;IAC5B,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,EACpB,SAAiB,EACjB,OAAmB,EACnB,EAA0B,EAC1B,MAAe,EACf,IAAkB,EAClB,GAAmB,EACJ,EAAE;QACjB,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC;YACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;gBACtC,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAA;gBAE1F,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAC7C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAA;gBAClF,CAAC;gBAED,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;gBAEvE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;gBACnD,IAAI,IAAI,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;oBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAChC,UAAU,EACV,EAAE,MAAM,EAAE,UAAuB,EAAc,EAC/C,UAAU,EACV,CAAC;4BACC,UAAU,EAAE,UAAU;4BACtB,KAAK,EAAE,CAAC;oCACN,IAAI,EAAE,MAAM;oCACZ,IAAI,EAAE,WAAW,UAAU,CAAC,SAAS,aAAa,MAAM,CAAC,eAAe,UAAU;0CAC9E,8CAA8C;iCACnD,CAAC;yBACH,CAAC,CACH,CAAA;oBACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;oBACpE,OAAM;gBACR,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;gBAEpE,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC3B,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;oBAC9C,OAAM;gBACR,CAAC;gBAED,oEAAoE;gBACpE,oEAAoE;gBACpE,uEAAuE;gBACvE,8DAA8D;gBAC9D,EAAE;gBACF,uEAAuE;gBACvE,uEAAuE;gBACvE,iEAAiE;gBACjE,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAA;gBAChD,MAAM,WAAW,GAAG,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAA;gBAE5D,MAAM,UAAU,GAAG,WAAW;oBAC5B,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC;oBACxD,CAAC,CAAC,SAAS,CAAA;gBAEb,MAAM,IAAI,GAAG,UAAU,KAAK,SAAS;oBACnC,uEAAuE;oBACvE,wDAAwD;oBACxD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;oBACpD,CAAC,CAAC,IAAI,CAAC,YAAY,CACjB,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,EAClC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,UAAU,CAC7D,CAAA;gBACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,IAAI,GAAG,QAAQ,CAAE,MAAkC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC5E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,WAAW,CAAE,MAAkC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC/F,IAAI,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,WAAW,CAAC,uBAAuB,EAAE,uCAAuC,CAAC,CAAA;gBACtG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;gBAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;gBAChE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,SAAS,GAAI,MAAkC,EAAE,CAAC,QAAQ,CAAC,CAAA;gBACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;gBACtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;oBACxD,OAAM;gBACR,CAAC;gBACD,wEAAwE;gBACxE,oEAAoE;gBACpE,sDAAsD;gBACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;gBACtC,iBAAiB,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;gBACzC,OAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC;YAChB,KAAK,UAAU,CAAC;YAChB,KAAK,WAAW,CAAC;YACjB,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,mEAAmE;gBACnE,uEAAuE;gBACvE,iBAAiB;gBACjB,MAAM,IAAI,WAAW,CACnB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,sBAAsB,EACxE,uDAAuD,CACxD,CAAA;YACH,CAAC;YAED;gBACE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,0BAA0B,SAAS,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC,CAAA;IAED,mFAAmF;IACnF,MAAM,UAAU,GAAG,CACjB,GAAmB,EACnB,EAA0B,EAC1B,OAAmB,EACnB,IAAc,EACd,UAAsB,EAChB,EAAE;QACR,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;SACzB,CAAC,CAAA;QACF,MAAM,OAAO,GAAkB;YAC7B,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS;SACvE,CAAA;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAEpB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,CAAC;YACxC,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;YACzF,KAAK,EAAE,KAAK;SACb,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QAEb,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAA0B,EAAE,EAAE;YACpD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAM;YACjC,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YACvI,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,CAAC;gBACxC,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;gBACxD,KAAK,EAAE,IAAI;aACZ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;YACb,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACvB,GAAG,CAAC,GAAG,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED;;;;;;OAMG;IACH,MAAM,iBAAiB,GAAG,CACxB,GAAmB,EACnB,EAA0B,EAC1B,OAAmB,EACnB,IAAa,EACP,EAAE;QACR,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;SACzB,CAAC,CAAA;QACF,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,CAAC;YACxC,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI;SACZ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QACb,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,kBAAkB,CAAC;oBACxD,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;oBAC1C,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;oBAClD,KAAK,EAAE,IAAI;iBACZ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;gBACrB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAA;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC,CAAA;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;AAC9C,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAAiC;IACxD,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAChC,GAAG,QAAQ;QACX,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAC/B,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KAC5F,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CAAI,OAAmB,EAAE,EAAU;IAC3D,IAAI,KAAiC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;QACjD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACpD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACjB,CAAC,CAAC,CAAA;IACF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC"}

package/lib/security.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Authentication, rate limiting, inbound defanging, and outbound redaction.
+ *
+ * The real security boundary is not in this file: it is the sandbox scope and
+ * the deterministically-rejected approval an A2A agent runs under. Injection
+ * defanging here is noise reduction, and must never be cited as a reason to
+ * widen what a peer-driven agent is allowed to do.
+ *
+ * @module dsh-a2a/security
+ */
+/** Who a request is from. The value comes only from the presented credential. */
+export type PeerIdentity = string;
+/**
+ * Compare two secrets without leaking their relationship through timing.
+ * @param a - the presented value.
+ * @param b - the stored value.
+ * @returns whether they are byte-identical.
+ */
+export declare function constantTimeEqual(a: string, b: string): boolean;
+/**
+ * Extract the bearer token from an Authorization header.
+ * @param header - the raw header value, if any.
+ * @returns the token, or undefined when absent or not a bearer scheme.
+ */
+export declare function parseBearer(header: string | undefined): string | undefined;
+/**
+ * Resolve the presented token to a declared peer identity.
+ *
+ * Every candidate is compared even after a match, so response time does not
+ * reveal which peer matched or how many peers are declared.
+ * @param token - the presented bearer token, if any.
+ * @param credentials - declared peer name to its resolved secret.
+ * @returns the matched identity, or undefined.
+ */
+export declare function identifyPeer(token: string | undefined, credentials: ReadonlyMap<PeerIdentity, string>): PeerIdentity | undefined;
+/** Sliding-window request counter, keyed by authenticated identity. */
+export declare class RateLimiter {
+    private readonly perMinute;
+    private readonly now;
+    private readonly hits;
+    /**
+     * @param perMinute - allowed requests per identity per rolling minute.
+     * @param now - clock injection point for tests.
+     */
+    constructor(perMinute: number, now?: () => number);
+    /**
+     * Record a request and report whether it is within budget.
+     * @param identity - the authenticated peer.
+     * @returns true when the request may proceed.
+     */
+    allow(identity: PeerIdentity): boolean;
+    /** Drop all counters; used on teardown. */
+    clear(): void;
+}
+/** Per-context turn counter that stops one peer from looping a context forever. */
+export declare class TurnTracker {
+    private readonly turns;
+    /**
+     * Count one inbound message on a context.
+     * @param contextId - the context being extended.
+     * @returns the turn number this message occupies, starting at 1.
+     */
+    track(contextId: string): number;
+    /**
+     * Reset a context's counter, as an explicit cancellation should.
+     * @param contextId - the context to reset.
+     */
+    reset(contextId: string): void;
+    /** Drop all counters; used on teardown. */
+    clear(): void;
+}
+/** What a defanged marker is replaced with. */
+export declare const FILTERED = "[filtered]";
+/**
+ * Defang prompt-injection markers in inbound task text.
+ * @param text - the peer's raw text.
+ * @returns the text with markers replaced.
+ */
+export declare function filterInbound(text: string): string;
+/**
+ * Scrub credential-shaped substrings before text leaves this process.
+ *
+ * This applies to REPLIES, not just to a hypothetical outbound client: an
+ * inbound-only server still ships model-authored text to a peer.
+ * @param text - the text about to be sent.
+ * @returns the scrubbed text.
+ */
+export declare function redactOutbound(text: string): string;
+//# sourceMappingURL=security.d.ts.map

package/lib/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAA;AAEjC;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAW/D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,WAAW,EAAE,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,GAC7C,YAAY,GAAG,SAAS,CAO1B;AAED,uEAAuE;AACvE,qBAAa,WAAW;IAQpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IARtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoC;IAEzD;;;OAGG;gBAEgB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;OAIG;IACH,KAAK,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO;IAYtC,2CAA2C;IAC3C,KAAK,IAAI,IAAI;CAGd;AAED,mFAAmF;AACnF,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAElD;;;;OAIG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAMhC;;;OAGG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI9B,2CAA2C;IAC3C,KAAK,IAAI,IAAI;CAGd;AAkBD,+CAA+C;AAC/C,eAAO,MAAM,QAAQ,eAAe,CAAA;AAEpC;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AAaD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAInD"}