@aauth/proxy 0.1.3

package/dist/tools.js

@@ -0,0 +1,253 @@
+// The eight-tool v1 discovery surface (design.md §"Tool surface"), built against
+// an injected dependency bundle so both the stdio bin and any HTTP host share
+// one core. Each tool's description embeds the L1 snapshot taken at build time
+// so the common path needs no extra round-trip.
+//
+// Transport-agnostic: no fs, no stdio, no child_process. The stdio bin
+// (server.ts) supplies fs/local-keys deps + a browser-launch onInteraction;
+// other hosts supply their own backends and surface interaction URLs however
+// their transport allows.
+import { z } from 'zod';
+import { invokeAtResource, invokeAtResourceComplete } from './agent.js';
+import { canonicalizeHost } from './host.js';
+import { fetchRegistry } from './registry.js';
+import { fetchResource, getOperationsForResource, listOperationsForResource, toL1Entry, } from './resource.js';
+const text = (s) => ({ content: [{ type: 'text', text: s }] });
+const json = (v) => text(JSON.stringify(v, null, 2));
+const BOOTSTRAP_GUIDANCE = `The agent proxy has no AAuth identity on this machine yet.
+
+To set one up, run:
+
+  npx @aauth/bootstrap list
+
+…then follow the setup skill:
+
+  npx @aauth/bootstrap skill setup
+
+That guide walks through generating a keypair (Secure Enclave / YubiKey / software),
+binding a Person Server, and publishing the JWKS. When it's done, call this tool again.`;
+// Registers the agent proxy's eight tools on `server`. Async because the L1 snapshot
+// embedded in tool descriptions is read once at build time from the (possibly
+// async) store.
+export async function buildProxyTools(server, deps) {
+    const { l1, registryCache, identity, docCache } = deps;
+    // Identity is resolved lazily per call; the provider owns any caching (which
+    // must be per-principal — a shared process-global cache would leak identities
+    // across tenants in a multi-user host).
+    async function getConfig() {
+        const status = await identity.resolve({ local: deps.agentLocal?.() });
+        if (status.kind === 'needsBootstrap')
+            return { ok: false };
+        return { ok: true, cfg: status.cfg };
+    }
+    // Snapshot of L1 for tool descriptions, taken once at registration. Keeps the
+    // always-loaded context cheap; list_resources is the authoritative fresh view.
+    const snapshot = (await l1.list()).map((e) => e.resource);
+    const l1Snapshot = snapshot.length === 0 ? 'no resources added yet' : snapshot.join(', ');
+    const describeWithL1 = (base) => `${base}\n\nCurrently added resources: ${l1Snapshot}`;
+    async function requireL1(resource) {
+        const canonical = canonicalizeHost(resource);
+        if (!canonical)
+            return { ok: false, msg: `Invalid resource host: ${resource}` };
+        const entry = await l1.get(canonical.host);
+        if (!entry)
+            return {
+                ok: false,
+                msg: `Resource not added: ${canonical.host}. Call add_resource("${canonical.host}") first.`,
+            };
+        return { ok: true, l1: entry };
+    }
+    // Surface an interaction: hand it to the side-channel (e.g. open a browser)
+    // and return the URL as text so the LLM can relay it regardless of transport.
+    function surfaceInteraction(url, code, retryTool) {
+        const full = `${url}?code=${code}`;
+        deps.onInteraction?.(url, code);
+        return text(`Authorization required. Open this URL to continue (your client may open it automatically), then call ${retryTool} again:\n${full}`);
+    }
+    // ── Resource lifecycle ──
+    server.registerTool('find_resources', {
+        description: describeWithL1('Search the AAuth registry for discoverable resources by free-text query against name/description. Returns each result tagged `added: true` if already in your local resource set.'),
+        inputSchema: { query: z.string().optional() },
+    }, async ({ query }) => {
+        const c = await getConfig();
+        if (!c.ok)
+            return text(BOOTSTRAP_GUIDANCE);
+        try {
+            const index = await fetchRegistry(c.cfg, registryCache);
+            const q = (query ?? '').trim().toLowerCase();
+            const added = new Set((await l1.list()).map((e) => e.resource));
+            const filtered = index.resources
+                .filter((r) => {
+                if (!q)
+                    return true;
+                return (r.name.toLowerCase().includes(q) ||
+                    r.description.toLowerCase().includes(q) ||
+                    r.issuer.toLowerCase().includes(q));
+            })
+                .map((r) => {
+                const host = canonicalizeHost(r.issuer)?.host ?? r.issuer;
+                return {
+                    resource: host,
+                    name: r.name,
+                    description: r.description,
+                    access_mode: r.access_mode,
+                    added: added.has(host),
+                    ...(r.logo_uri ? { logo_uri: r.logo_uri } : {}),
+                };
+            });
+            return json(filtered);
+        }
+        catch (err) {
+            return text(`registry error: ${err.message}`);
+        }
+    });
+    server.registerTool('add_resource', {
+        description: describeWithL1('Add an AAuth resource to your local set. Pass a bare host, host:port, or full URL — the agent proxy canonicalizes. Fetches the resource\'s well-known doc, validates, picks supported vocabularies. After adding: agent-token resources are immediately invokable; aauth-access-token/auth-token resources need `connect` or a first `invoke` that surfaces the auth URL.'),
+        inputSchema: { resource: z.string() },
+    }, async ({ resource }) => {
+        try {
+            const fetched = await fetchResource(resource);
+            const entry = toL1Entry(fetched);
+            await l1.upsert(entry);
+            return json({
+                added: entry.resource,
+                access_mode: entry.access_mode,
+                vocabularies: entry.picked_vocabs.map((v) => v.vocabUri),
+                connect_required: entry.access_mode !== 'agent-token',
+            });
+        }
+        catch (err) {
+            return text(`add_resource error: ${err.message}`);
+        }
+    });
+    server.registerTool('list_resources', {
+        description: 'Return your locally added resources with name, description, access_mode, last_used, and how many vocabularies the agent proxy picked. Cheap; safe to call anytime.',
+    }, async () => {
+        const entries = (await l1.list()).map((e) => ({
+            resource: e.resource,
+            name: e.name,
+            description: e.description,
+            access_mode: e.access_mode,
+            vocabularies: e.picked_vocabs.map((v) => v.vocabUri),
+            added: e.added,
+            last_used: e.last_used,
+        }));
+        return json(entries);
+    });
+    server.registerTool('remove_resource', {
+        description: describeWithL1('Remove a resource from your local set. Agent-proxy-local only — does NOT revoke any user grants at the Person Server; re-adding picks up existing grants transparently.'),
+        inputSchema: { resource: z.string() },
+    }, async ({ resource }) => {
+        const canonical = canonicalizeHost(resource);
+        if (!canonical)
+            return text(`invalid host: ${resource}`);
+        const removed = await l1.remove(canonical.host);
+        return text(removed ? `removed ${canonical.host}` : `not found: ${canonical.host}`);
+    });
+    server.registerTool('connect', {
+        description: describeWithL1('Pre-authorize a resource — trigger a Person Server consent step if needed. No-op for agent-token resources. For aauth-access-token/auth-token resources, invokes a probe operation to surface the auth URL; returns "already connected" if the auth succeeds.'),
+        inputSchema: { resource: z.string() },
+    }, async ({ resource }) => {
+        const c = await getConfig();
+        if (!c.ok)
+            return text(BOOTSTRAP_GUIDANCE);
+        const found = await requireL1(resource);
+        if (!found.ok)
+            return text(found.msg);
+        const { l1: entry } = found;
+        if (entry.access_mode === 'agent-token') {
+            return text(`${entry.resource}: already connected (agent-token access mode)`);
+        }
+        const ops = await listOperationsForResource(entry, undefined, docCache);
+        const probe = ops.find((o) => o.kind === 'sync.request' && o.method === 'GET');
+        if (!probe)
+            return text(`${entry.resource}: no probe operation available for connect`);
+        const result = await invokeAtResource(c.cfg, entry, probe.opId, {});
+        if (result.kind === 'interaction') {
+            return surfaceInteraction(result.interaction.url, result.interaction.code, 'connect');
+        }
+        if (result.status >= 200 && result.status < 300) {
+            await l1.touch(entry.resource);
+            return text(`${entry.resource}: connected.`);
+        }
+        return text(`${entry.resource}: connect probe returned ${result.status} — ${JSON.stringify(result.body)}`);
+    });
+    // ── Operations ──
+    server.registerTool('list_operations', {
+        description: describeWithL1('List operations a resource exposes. Optional `query` is either free-text (matched against opId/summary/tags) or an OpenAPI path prefix (e.g. "/crm/v3/objects/contacts/*"). Returns summaries only — schemas are fetched via get_operations to keep token cost flat. Each op carries `kind` (sync.request/async.send/async.receive).'),
+        inputSchema: { resource: z.string(), query: z.string().optional() },
+    }, async ({ resource, query }) => {
+        const found = await requireL1(resource);
+        if (!found.ok)
+            return text(found.msg);
+        try {
+            const ops = await listOperationsForResource(found.l1, query, docCache);
+            return json(ops);
+        }
+        catch (err) {
+            return text(`list_operations error: ${err.message}`);
+        }
+    });
+    server.registerTool('get_operations', {
+        description: describeWithL1('Batch fetch full schemas (params, request body, response) for one or more operations on a resource. Separate from list_operations because schemas dominate token cost.'),
+        inputSchema: { resource: z.string(), op_ids: z.array(z.string()) },
+    }, async ({ resource, op_ids }) => {
+        const found = await requireL1(resource);
+        if (!found.ok)
+            return text(found.msg);
+        try {
+            const details = await getOperationsForResource(found.l1, op_ids, docCache);
+            return json(details);
+        }
+        catch (err) {
+            return text(`get_operations error: ${err.message}`);
+        }
+    });
+    server.registerTool('invoke', {
+        description: describeWithL1('Invoke an operation on a resource. Pass `path_params`, `query`, `body` (object) as needed. On first call to an unauthorized aauth-access-token resource, returns an auth URL — open it, then call invoke again. async.receive operations return `subscribe_requires_subagent` (v.next).'),
+        inputSchema: {
+            resource: z.string(),
+            op_id: z.string(),
+            path_params: z.record(z.string(), z.string()).optional(),
+            query: z.string().optional(),
+            body: z.record(z.string(), z.unknown()).optional(),
+        },
+    }, async ({ resource, op_id, path_params, query, body }, extra) => {
+        const c = await getConfig();
+        if (!c.ok)
+            return text(BOOTSTRAP_GUIDANCE);
+        const found = await requireL1(resource);
+        if (!found.ok)
+            return text(found.msg);
+        const invokeArgs = { pathParams: path_params, query, body };
+        try {
+            // 'await' mode: block — relay + poll the interaction to completion, return
+            // the result on this original call. (HTTP hosts holding a long call open.)
+            if (deps.interaction?.mode === 'await') {
+                const inter = deps.interaction;
+                // Per-request context so host callbacks can push to the client (e.g.
+                // emit notifications/progress carrying the interaction URL + heartbeats).
+                const ctx = {
+                    sendNotification: (n) => extra.sendNotification(n),
+                    progressToken: extra._meta?.progressToken,
+                };
+                const completed = await invokeAtResourceComplete(c.cfg, found.l1, op_id, (url, code) => inter.onInteraction?.(url, code, ctx), invokeArgs, 5, inter.pollTimeoutMs ?? 180_000, (elapsedMs) => inter.onPoll?.(elapsedMs, ctx));
+                if (completed.status >= 200 && completed.status < 300)
+                    await l1.touch(found.l1.resource);
+                return json(completed);
+            }
+            // 'surface' mode (default): non-blocking — return the URL as text.
+            const result = await invokeAtResource(c.cfg, found.l1, op_id, invokeArgs);
+            if (result.kind === 'interaction') {
+                return surfaceInteraction(result.interaction.url, result.interaction.code, 'invoke');
+            }
+            if (result.status >= 200 && result.status < 300)
+                await l1.touch(found.l1.resource);
+            return json({ status: result.status, body: result.body });
+        }
+        catch (err) {
+            return text(`invoke error: ${err.message}`);
+        }
+    });
+}
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,8EAA8E;AAC9E,+EAA+E;AAC/E,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,0BAA0B;AAG1B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,yBAAyB,EACzB,SAAS,GACV,MAAM,eAAe,CAAA;AA4CtB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AAC/E,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AAE7D,MAAM,kBAAkB,GAAG;;;;;;;;;;;wFAW6D,CAAA;AAExF,qFAAqF;AACrF,8EAA8E;AAC9E,gBAAgB;AAChB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAiB,EAAE,IAAe;IACtE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAA;IAEtD,6EAA6E;IAC7E,8EAA8E;IAC9E,wCAAwC;IACxC,KAAK,UAAU,SAAS;QACtB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;QACrE,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;QAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;IACtC,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE,CAC9C,GAAG,IAAI,kCAAkC,UAAU,EAAE,CAAA;IAEvD,KAAK,UAAU,SAAS,CACtB,QAAgB;QAEhB,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAA;QAC/E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,uBAAuB,SAAS,CAAC,IAAI,wBAAwB,SAAS,CAAC,IAAI,WAAW;aAC5F,CAAA;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IAChC,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,SAAS,kBAAkB,CAAC,GAAW,EAAE,IAAY,EAAE,SAAiB;QACtE,MAAM,IAAI,GAAG,GAAG,GAAG,SAAS,IAAI,EAAE,CAAA;QAClC,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC/B,OAAO,IAAI,CACT,wGAAwG,SAAS,YAAY,IAAI,EAAE,CACpI,CAAA;IACH,CAAC;IAED,2BAA2B;IAE3B,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,cAAc,CACzB,mLAAmL,CACpL;QACD,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KAC9C,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YACvD,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS;iBAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACZ,IAAI,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAA;gBACnB,OAAO,CACL,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAChC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACvC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CACnC,CAAA;YACH,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,CAAA;gBACzD,OAAO;oBACL,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChD,CAAA;YACH,CAAC,CAAC,CAAA;YACJ,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EAAE,cAAc,CACzB,2WAA2W,CAC5W;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;YAChC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtB,OAAO,IAAI,CAAC;gBACV,KAAK,EAAE,KAAK,CAAC,QAAQ;gBACrB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACxD,gBAAgB,EAAE,KAAK,CAAC,WAAW,KAAK,aAAa;aACtD,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EACT,oKAAoK;KACvK,EACD,KAAK,IAAI,EAAE;QACT,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YACpD,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC,CAAA;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;IACtB,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EAAE,cAAc,CACzB,yKAAyK,CAC1K;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IACrF,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,SAAS,EACT;QACE,WAAW,EAAE,cAAc,CACzB,+PAA+P,CAChQ;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;QAC3B,IAAI,KAAK,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,+CAA+C,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAA;QAC9E,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,4CAA4C,CAAC,CAAA;QACtF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnE,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClC,OAAO,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAChD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YAC9B,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,cAAc,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,IAAI,CACT,GAAG,KAAK,CAAC,QAAQ,4BAA4B,MAAM,CAAC,MAAM,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC9F,CAAA;IACH,CAAC,CACF,CAAA;IAED,mBAAmB;IAEnB,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EAAE,cAAc,CACzB,sUAAsU,CACvU;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KACpE,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;YACtE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAA;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACjE,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,WAAW,EAAE,cAAc,CACzB,wKAAwK,CACzK;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;KACnE,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;YAC1E,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAChE,CAAC;IACH,CAAC,CACF,CAAA;IAED,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;QACE,WAAW,EAAE,cAAc,CACzB,yRAAyR,CAC1R;QACD,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;SACnD;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE;QAC7D,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAA;QAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,UAAU,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAC3D,IAAI,CAAC;YACH,2EAA2E;YAC3E,2EAA2E;YAC3E,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAA;gBAC9B,qEAAqE;gBACrE,0EAA0E;gBAC1E,MAAM,GAAG,GAAuB;oBAC9B,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAU,CAAC;oBAC3D,aAAa,EAAE,KAAK,CAAC,KAAK,EAAE,aAAa;iBAC1C,CAAA;gBACD,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAC9C,CAAC,CAAC,GAAG,EACL,KAAK,CAAC,EAAE,EACR,KAAK,EACL,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,EACpD,UAAU,EACV,CAAC,EACD,KAAK,CAAC,aAAa,IAAI,OAAO,EAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAC9C,CAAA;gBACD,IAAI,SAAS,CAAC,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG;oBAAE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;gBACxF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAA;YACxB,CAAC;YAED,mEAAmE;YACnE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;YACzE,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACtF,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;YAClF,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACxD,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/vocab/index.d.ts

@@ -0,0 +1,6 @@
+import type { VocabAdapter } from './types.js';
+export * from './types.js';
+export { OpenAPIAdapter } from './openapi.js';
+export declare function getAdapter(vocabUri: string): VocabAdapter | undefined;
+export declare function supportedVocabUris(): string[];
+//# sourceMappingURL=index.d.ts.map

package/dist/vocab/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vocab/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAS7C,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAErE;AAED,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C"}

package/dist/vocab/index.js

@@ -0,0 +1,19 @@
+// Vocabulary adapter registry. The agent proxy picks adapters at resource-load time by
+// walking `r3_vocabularies` from the well-known doc and selecting every URN
+// it has an adapter for.
+import { OpenAPIAdapter } from './openapi.js';
+export * from './types.js';
+export { OpenAPIAdapter } from './openapi.js';
+const ADAPTERS = {
+    'urn:aauth:vocabulary:openapi': new OpenAPIAdapter(),
+    // 'urn:aauth:vocabulary:asyncapi': new AsyncAPIAdapter(),   // Phase 3
+    // 'urn:aauth:vocabulary:mcp-tools': new MCPToolsAdapter(),  // future
+    // 'urn:aauth:vocabulary:graphql':   new GraphQLAdapter(),   // future
+};
+export function getAdapter(vocabUri) {
+    return ADAPTERS[vocabUri];
+}
+export function supportedVocabUris() {
+    return Object.keys(ADAPTERS);
+}
+//# sourceMappingURL=index.js.map

package/dist/vocab/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vocab/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,4EAA4E;AAC5E,yBAAyB;AAEzB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG7C,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,QAAQ,GAAiC;IAC7C,8BAA8B,EAAE,IAAI,cAAc,EAAE;IACpD,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;CACvE,CAAA;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAC9B,CAAC"}

package/dist/vocab/openapi.d.ts

@@ -0,0 +1,43 @@
+import type { InvocationPlan, InvokeArgs, OpDetail, OpSummary, VocabAdapter } from './types.js';
+declare const HTTP_METHODS: readonly ["get", "post", "put", "delete", "patch", "head", "options"];
+type HttpMethod = (typeof HTTP_METHODS)[number];
+interface OpenAPIOperation {
+    operationId?: string;
+    summary?: string;
+    description?: string;
+    tags?: string[];
+    parameters?: unknown[];
+    requestBody?: unknown;
+    responses?: Record<string, unknown>;
+}
+type OpenAPIPathItem = Partial<Record<HttpMethod, OpenAPIOperation>> & {
+    parameters?: unknown[];
+};
+interface OpenAPIDoc {
+    openapi?: string;
+    paths: Record<string, OpenAPIPathItem>;
+    components?: Record<string, unknown>;
+}
+interface ResolvedOp {
+    opId: string;
+    method: string;
+    path: string;
+    summary?: string;
+    tags?: string[];
+    parameters?: unknown[];
+    requestBody?: unknown;
+    responses?: Record<string, unknown>;
+}
+export interface OpenAPIVocabDoc {
+    raw: OpenAPIDoc;
+    ops: Map<string, ResolvedOp>;
+}
+export declare class OpenAPIAdapter implements VocabAdapter<OpenAPIVocabDoc> {
+    readonly vocabUri = "urn:aauth:vocabulary:openapi";
+    load(url: string): Promise<OpenAPIVocabDoc>;
+    listOperations(doc: OpenAPIVocabDoc, query?: string): OpSummary[];
+    getOperations(doc: OpenAPIVocabDoc, opIds: string[]): OpDetail[];
+    buildInvocation(doc: OpenAPIVocabDoc, opId: string, args: InvokeArgs): InvocationPlan;
+}
+export {};
+//# sourceMappingURL=openapi.d.ts.map

package/dist/vocab/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/vocab/openapi.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,QAAA,MAAM,YAAY,uEAAwE,CAAA;AAC1F,KAAK,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAA;AAE/C,UAAU,gBAAgB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,UAAU,CAAC,EAAE,OAAO,EAAE,CAAA;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED,KAAK,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,GAAG;IACrE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAA;CACvB,CAAA;AAED,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,UAAU,CAAC,EAAE,OAAO,EAAE,CAAA;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAA;IACf,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CAC7B;AA6CD,qBAAa,cAAe,YAAW,YAAY,CAAC,eAAe,CAAC;IAClE,QAAQ,CAAC,QAAQ,kCAAiC;IAE5C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAOjD,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE;IAiBjE,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE;IAoBhE,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc;CAkBtF"}

package/dist/vocab/openapi.js

@@ -0,0 +1,113 @@
+// OpenAPI 3.x vocabulary adapter. All ops are `sync.request`.
+//
+// listOperations supports two query modes:
+//   - free-text: matched against opId, summary, tags (case-insensitive substring)
+//   - path prefix: query starts with '/'; optional trailing /* — matches path prefix
+// Both are bounded; the caller decides on a result cap.
+const HTTP_METHODS = ['get', 'post', 'put', 'delete', 'patch', 'head', 'options'];
+function indexOperations(doc) {
+    const ops = new Map();
+    for (const [path, item] of Object.entries(doc.paths ?? {})) {
+        if (!item)
+            continue;
+        for (const method of HTTP_METHODS) {
+            const op = item[method];
+            if (!op?.operationId)
+                continue;
+            ops.set(op.operationId, {
+                opId: op.operationId,
+                method: method.toUpperCase(),
+                path,
+                summary: op.summary ?? op.description,
+                tags: op.tags,
+                parameters: [...(item.parameters ?? []), ...(op.parameters ?? [])],
+                requestBody: op.requestBody,
+                responses: op.responses,
+            });
+        }
+    }
+    return ops;
+}
+function matches(op, query) {
+    if (!query)
+        return true;
+    // Path prefix mode: '/foo' or '/foo/*' — match against the op's path.
+    if (query.startsWith('/')) {
+        const prefix = query.endsWith('/*') ? query.slice(0, -2) : query;
+        return op.path.toLowerCase().startsWith(prefix.toLowerCase());
+    }
+    const q = query.toLowerCase();
+    return (op.opId.toLowerCase().includes(q) ||
+        (op.summary?.toLowerCase().includes(q) ?? false) ||
+        (op.tags?.some((t) => t.toLowerCase().includes(q)) ?? false));
+}
+function applyPathParams(path, pathParams = {}) {
+    return path.replace(/\{(\w+)\}/g, (_m, name) => encodeURIComponent(pathParams[name] ?? ''));
+}
+export class OpenAPIAdapter {
+    vocabUri = 'urn:aauth:vocabulary:openapi';
+    async load(url) {
+        const res = await fetch(url);
+        if (!res.ok)
+            throw new Error(`openapi load ${url}: ${res.status}`);
+        const raw = (await res.json());
+        return { raw, ops: indexOperations(raw) };
+    }
+    listOperations(doc, query) {
+        const q = query ?? '';
+        const out = [];
+        for (const op of doc.ops.values()) {
+            if (!matches(op, q))
+                continue;
+            out.push({
+                opId: op.opId,
+                kind: 'sync.request',
+                summary: op.summary,
+                method: op.method,
+                path: op.path,
+                tags: op.tags,
+            });
+        }
+        return out;
+    }
+    getOperations(doc, opIds) {
+        const out = [];
+        for (const opId of opIds) {
+            const op = doc.ops.get(opId);
+            if (!op)
+                continue;
+            out.push({
+                opId: op.opId,
+                kind: 'sync.request',
+                summary: op.summary,
+                method: op.method,
+                path: op.path,
+                tags: op.tags,
+                paramsSchema: op.parameters,
+                bodySchema: op.requestBody,
+                responseSchema: op.responses,
+            });
+        }
+        return out;
+    }
+    buildInvocation(doc, opId, args) {
+        const op = doc.ops.get(opId);
+        if (!op)
+            throw new Error(`openapi: unknown operation ${opId}`);
+        const path = applyPathParams(op.path, args.pathParams);
+        const body = args.body;
+        return {
+            kind: 'sync.request',
+            method: op.method,
+            path,
+            ...(args.query !== undefined ? { query: args.query } : {}),
+            ...(body !== undefined
+                ? {
+                    headers: { 'content-type': args.contentType ?? 'application/json' },
+                    body: typeof body === 'string' ? body : JSON.stringify(body),
+                }
+                : {}),
+        };
+    }
+}
+//# sourceMappingURL=openapi.js.map

package/dist/vocab/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../src/vocab/openapi.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,2CAA2C;AAC3C,kFAAkF;AAClF,qFAAqF;AACrF,wDAAwD;AAUxD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAU,CAAA;AAuC1F,SAAS,eAAe,CAAC,GAAe;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAA;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;YACvB,IAAI,CAAC,EAAE,EAAE,WAAW;gBAAE,SAAQ;YAC9B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE;gBACtB,IAAI,EAAE,EAAE,CAAC,WAAW;gBACpB,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC5B,IAAI;gBACJ,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,WAAW;gBACrC,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBAClE,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,SAAS,EAAE,EAAE,CAAC,SAAS;aACxB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,EAAc,EAAE,KAAa;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,sEAAsE;IACtE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAChE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/D,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IAC7B,OAAO,CACL,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjC,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAChD,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAC7D,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,aAAqC,EAAE;IAC5E,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CACrD,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAC3C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,QAAQ,GAAG,8BAA8B,CAAA;IAElD,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAA;QAC5C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAA;IAC3C,CAAC;IAED,cAAc,CAAC,GAAoB,EAAE,KAAc;QACjD,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAA;QACrB,MAAM,GAAG,GAAgB,EAAE,CAAA;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBAAE,SAAQ;YAC7B,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,EAAE,CAAC,IAAI;aACd,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,aAAa,CAAC,GAAoB,EAAE,KAAe;QACjD,MAAM,GAAG,GAAe,EAAE,CAAA;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC5B,IAAI,CAAC,EAAE;gBAAE,SAAQ;YACjB,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,YAAY,EAAE,EAAE,CAAC,UAAU;gBAC3B,UAAU,EAAE,EAAE,CAAC,WAAW;gBAC1B,cAAc,EAAE,EAAE,CAAC,SAAS;aAC7B,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,eAAe,CAAC,GAAoB,EAAE,IAAY,EAAE,IAAgB;QAClE,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI;YACJ,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,KAAK,SAAS;gBACpB,CAAC,CAAC;oBACE,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE;oBACnE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC7D;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAA;IACH,CAAC;CACF"}

package/dist/vocab/types.d.ts

@@ -0,0 +1,47 @@
+export type OpKind = 'sync.request' | 'async.send' | 'async.receive';
+export interface OpSummary {
+    opId: string;
+    kind: OpKind;
+    summary?: string;
+    method?: string;
+    path?: string;
+    channel?: string;
+    tags?: string[];
+}
+export interface OpDetail extends OpSummary {
+    paramsSchema?: unknown;
+    bodySchema?: unknown;
+    responseSchema?: unknown;
+}
+export type InvocationPlan = {
+    kind: 'sync.request';
+    method: string;
+    path: string;
+    query?: string;
+    headers?: Record<string, string>;
+    body?: string;
+} | {
+    kind: 'async.send';
+    channel: string;
+    message: unknown;
+    headers?: Record<string, string>;
+} | {
+    kind: 'async.receive';
+    channel: string;
+    filter?: unknown;
+};
+export interface InvokeArgs {
+    pathParams?: Record<string, string>;
+    query?: string;
+    body?: unknown;
+    contentType?: string;
+    message?: unknown;
+}
+export interface VocabAdapter<Doc = unknown> {
+    readonly vocabUri: string;
+    load(url: string): Promise<Doc>;
+    listOperations(doc: Doc, query?: string): OpSummary[];
+    getOperations(doc: Doc, opIds: string[]): OpDetail[];
+    buildInvocation(doc: Doc, opId: string, args: InvokeArgs): InvocationPlan;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/vocab/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vocab/types.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,MAAM,GAAG,cAAc,GAAG,YAAY,GAAG,eAAe,CAAA;AAEpE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,QAAS,SAAQ,SAAS;IAKzC,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAKL,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,GAAG,GAAG,OAAO;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAA;IACrD,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;IACpD,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc,CAAA;CAC1E"}

package/dist/vocab/types.js

@@ -0,0 +1,11 @@
+// Vocabulary adapter contract. A resource advertises one or more vocabularies
+// in `r3_vocabularies` ({ urn → vocab_doc_url }). Each adapter knows how to:
+//   - fetch + parse the doc
+//   - enumerate operations as bounded summaries (for list_operations)
+//   - return full schemas for chosen op_ids (for get_operations)
+//   - turn (opId, args) into an InvocationPlan the agent proxy's `invoke` can execute
+//
+// See design.md §"Vocabularies". The LLM never sees `vocab` — it sees
+// `kind` (sync.request | async.send | async.receive) on each OpSummary.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/vocab/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/vocab/types.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,4BAA4B;AAC5B,sEAAsE;AACtE,iEAAiE;AACjE,sFAAsF;AACtF,EAAE;AACF,sEAAsE;AACtE,wEAAwE"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@aauth/proxy",
+  "version": "0.1.3",
+  "description": "The user's AAuth agent in MCP form — discovery, identity, interaction relay",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./local": {
+      "types": "./dist/identity-local.d.ts",
+      "default": "./dist/identity-local.js"
+    }
+  },
+  "bin": {
+    "aauth-proxy": "./dist/server.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "dev": "tsx src/server.ts",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "aauth",
+    "mcp",
+    "agent",
+    "identity"
+  ],
+  "author": "Dick Hardt <dick.hardt@hello.coop>",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aauth-dev/proxy"
+  },
+  "dependencies": {
+    "@aauth/local-keys": "^1.1.0",
+    "@hellocoop/httpsig": "^1.6.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  }
+}