@absolutejs/agent 0.4.0 → 0.4.2

package/README.md

@@ -45,3 +45,12 @@ AuthZEN surfaces while Absolute supplies provider-neutral implementation seams.
 route. Absolute Auth generates it from the application's authoritative OAuth
 metadata and implements the flow natively; it is not a WorkOS adapter and does
 not require a WorkOS service.
+
+## One authenticated delegation
+
+`createAuthAgencyDelegationAuthority()` bridges the delegation already verified
+by Absolute Auth directly into Agency. Put an
+`authAgencyAuthorizationDetail()` in the Auth grant to bind its audience,
+canonical actions, effects, resource types, and optional resource IDs. Agency
+then re-reads that same grant before an action request, lease, and execution;
+there is no second grant ID or shadow state to synchronize.

package/dist/actions.d.ts

@@ -1 +1,2 @@
 export * from "@absolutejs/agency";
+export * from "./authAgency";

package/dist/actions.js

@@ -1,6 +1,66 @@
 // @bun
+// src/authAgency.ts
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+var AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE = "urn:absolutejs:authorization-detail:agency-delegation";
+var AuthAgencyAuthorizationDetailSchema = Type.Object({
+  actions: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+  audience: Type.String({ minLength: 1 }),
+  effects: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+  resourceIds: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { minItems: 1 })),
+  resourceTypes: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+  type: Type.Literal(AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE)
+}, { additionalProperties: false });
+var authAgencyAuthorizationDetail = (detail) => ({
+  ...detail,
+  type: AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE
+});
+var subset = (required, available) => required.every((value) => available.includes(value));
+var audienceOf = (action) => {
+  const audience = action.context?.audience;
+  return typeof audience === "string" ? audience : undefined;
+};
+var activeDelegation = async (store, action, now) => {
+  const { delegationId } = action.actor;
+  if (!delegationId)
+    throw new Error("Agency action requires a delegation");
+  const delegation = await store.findByDelegationId(delegationId);
+  if (!delegation)
+    throw new Error("Unknown authenticated delegation");
+  if (delegation.status !== "active")
+    throw new Error("Authenticated delegation is revoked");
+  if (delegation.expiresAt !== undefined && delegation.expiresAt <= now)
+    throw new Error("Authenticated delegation is expired");
+  return delegation;
+};
+var assertActor = (action, delegation) => {
+  if (action.actor.agentId !== delegation.agentId || action.actor.userId !== delegation.userId || action.actor.organizationId !== delegation.organizationId)
+    throw new Error("Agency actor does not match authenticated delegation");
+  if (!subset(action.actor.scopes, delegation.scopes))
+    throw new Error("Agency actor scopes exceed authenticated delegation");
+};
+var authorizationDetails = (delegation) => (delegation.authorizationDetails ?? []).filter((detail) => Value.Check(AuthAgencyAuthorizationDetailSchema, detail));
+var detailAllows = (detail, action) => detail.audience === audienceOf(action) && detail.actions.includes(action.action) && subset(action.effects, detail.effects) && detail.resourceTypes.includes(action.resource.type) && (!detail.resourceIds || detail.resourceIds.includes(action.resource.id));
+var createAuthAgencyDelegationAuthority = (options) => ({
+  assertAllows: async (action) => {
+    const delegation = await activeDelegation(options.store, action, (options.now ?? Date.now)());
+    assertActor(action, delegation);
+    if (!authorizationDetails(delegation).some((detail) => detailAllows(detail, action)))
+      throw new Error("Agency action is outside authenticated delegation");
+    return {
+      ...delegation.expiresAt === undefined ? {} : { expiresAt: delegation.expiresAt }
+    };
+  }
+});
+
 // src/actions.ts
 export * from "@absolutejs/agency";
+export {
+  createAuthAgencyDelegationAuthority,
+  authAgencyAuthorizationDetail,
+  AuthAgencyAuthorizationDetailSchema,
+  AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE
+};
 
-//# debugId=A280C5CD9E78AED364756E2164756E21
+//# debugId=C399317D4FE0652364756E2164756E21
 //# sourceMappingURL=actions.js.map

package/dist/actions.js.map

@@ -1,10 +1,11 @@
 {
   "version": 3,
-  "sources": ["../src/actions.ts"],
+  "sources": ["../src/authAgency.ts", "../src/actions.ts"],
   "sourcesContent": [
-    "export * from \"@absolutejs/agency\";\n"
+    "import type { ActionRequestInput } from \"@absolutejs/agency\";\nimport type {\n  AgentDelegation,\n  AgentDelegationStore,\n} from \"@absolutejs/auth/agents\";\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport { Value } from \"@sinclair/typebox/value\";\n\nexport const AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE =\n  \"urn:absolutejs:authorization-detail:agency-delegation\";\n\nexport const AuthAgencyAuthorizationDetailSchema = Type.Object(\n  {\n    actions: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),\n    audience: Type.String({ minLength: 1 }),\n    effects: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),\n    resourceIds: Type.Optional(\n      Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),\n    ),\n    resourceTypes: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),\n    type: Type.Literal(AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE),\n  },\n  { additionalProperties: false },\n);\n\nexport type AuthAgencyAuthorizationDetail = Static<\n  typeof AuthAgencyAuthorizationDetailSchema\n>;\n\nexport const authAgencyAuthorizationDetail = (\n  detail: Omit<AuthAgencyAuthorizationDetail, \"type\">,\n): AuthAgencyAuthorizationDetail => ({\n  ...detail,\n  type: AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE,\n});\n\nconst subset = (required: readonly string[], available: readonly string[]) =>\n  required.every((value) => available.includes(value));\n\nconst audienceOf = (action: ActionRequestInput) => {\n  const audience = action.context?.audience;\n\n  return typeof audience === \"string\" ? audience : undefined;\n};\n\nconst activeDelegation = async (\n  store: AgentDelegationStore,\n  action: ActionRequestInput,\n  now: number,\n) => {\n  const { delegationId } = action.actor;\n\n  if (!delegationId) throw new Error(\"Agency action requires a delegation\");\n  const delegation = await store.findByDelegationId(delegationId);\n\n  if (!delegation) throw new Error(\"Unknown authenticated delegation\");\n  if (delegation.status !== \"active\")\n    throw new Error(\"Authenticated delegation is revoked\");\n  if (delegation.expiresAt !== undefined && delegation.expiresAt <= now)\n    throw new Error(\"Authenticated delegation is expired\");\n\n  return delegation;\n};\n\nconst assertActor = (\n  action: ActionRequestInput,\n  delegation: AgentDelegation,\n) => {\n  if (\n    action.actor.agentId !== delegation.agentId ||\n    action.actor.userId !== delegation.userId ||\n    action.actor.organizationId !== delegation.organizationId\n  )\n    throw new Error(\"Agency actor does not match authenticated delegation\");\n  if (!subset(action.actor.scopes, delegation.scopes))\n    throw new Error(\"Agency actor scopes exceed authenticated delegation\");\n};\n\nconst authorizationDetails = (delegation: AgentDelegation) =>\n  (delegation.authorizationDetails ?? []).filter(\n    (detail): detail is AuthAgencyAuthorizationDetail =>\n      Value.Check(AuthAgencyAuthorizationDetailSchema, detail),\n  );\n\nconst detailAllows = (\n  detail: AuthAgencyAuthorizationDetail,\n  action: ActionRequestInput,\n) =>\n  detail.audience === audienceOf(action) &&\n  detail.actions.includes(action.action) &&\n  subset(action.effects, detail.effects) &&\n  detail.resourceTypes.includes(action.resource.type) &&\n  (!detail.resourceIds || detail.resourceIds.includes(action.resource.id));\n\n/** Bridges Absolute Auth's verified principal grant directly into Agency.\n * The same delegation ID is re-read at request, lease, and execution time; no\n * shadow grant or manual synchronization is required. */\nexport const createAuthAgencyDelegationAuthority = (options: {\n  now?: () => number;\n  store: AgentDelegationStore;\n}) => ({\n  assertAllows: async (action: ActionRequestInput) => {\n    const delegation = await activeDelegation(\n      options.store,\n      action,\n      (options.now ?? Date.now)(),\n    );\n    assertActor(action, delegation);\n    if (!authorizationDetails(delegation).some((detail) => detailAllows(detail, action)))\n      throw new Error(\"Agency action is outside authenticated delegation\");\n\n    return {\n      ...(delegation.expiresAt === undefined\n        ? {}\n        : { expiresAt: delegation.expiresAt }),\n    };\n  },\n});\n",
+    "export * from \"@absolutejs/agency\";\nexport * from \"./authAgency\";\n"
   ],
-  "mappings": ";;AAAA;",
-  "debugId": "A280C5CD9E78AED364756E2164756E21",
+  "mappings": ";;AAKA;AACA;AAEO,IAAM,wCACX;AAEK,IAAM,sCAAsC,KAAK,OACtD;AAAA,EACE,SAAS,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAClE,UAAU,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAA,EACtC,SAAS,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAClE,aAAa,KAAK,SAChB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAC3D;AAAA,EACA,eAAe,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EACxE,MAAM,KAAK,QAAQ,qCAAqC;AAC1D,GACA,EAAE,sBAAsB,MAAM,CAChC;AAMO,IAAM,gCAAgC,CAC3C,YACmC;AAAA,KAChC;AAAA,EACH,MAAM;AACR;AAEA,IAAM,SAAS,CAAC,UAA6B,cAC3C,SAAS,MAAM,CAAC,UAAU,UAAU,SAAS,KAAK,CAAC;AAErD,IAAM,aAAa,CAAC,WAA+B;AAAA,EACjD,MAAM,WAAW,OAAO,SAAS;AAAA,EAEjC,OAAO,OAAO,aAAa,WAAW,WAAW;AAAA;AAGnD,IAAM,mBAAmB,OACvB,OACA,QACA,QACG;AAAA,EACH,QAAQ,iBAAiB,OAAO;AAAA,EAEhC,IAAI,CAAC;AAAA,IAAc,MAAM,IAAI,MAAM,qCAAqC;AAAA,EACxE,MAAM,aAAa,MAAM,MAAM,mBAAmB,YAAY;AAAA,EAE9D,IAAI,CAAC;AAAA,IAAY,MAAM,IAAI,MAAM,kCAAkC;AAAA,EACnE,IAAI,WAAW,WAAW;AAAA,IACxB,MAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD,IAAI,WAAW,cAAc,aAAa,WAAW,aAAa;AAAA,IAChE,MAAM,IAAI,MAAM,qCAAqC;AAAA,EAEvD,OAAO;AAAA;AAGT,IAAM,cAAc,CAClB,QACA,eACG;AAAA,EACH,IACE,OAAO,MAAM,YAAY,WAAW,WACpC,OAAO,MAAM,WAAW,WAAW,UACnC,OAAO,MAAM,mBAAmB,WAAW;AAAA,IAE3C,MAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE,IAAI,CAAC,OAAO,OAAO,MAAM,QAAQ,WAAW,MAAM;AAAA,IAChD,MAAM,IAAI,MAAM,qDAAqD;AAAA;AAGzE,IAAM,uBAAuB,CAAC,gBAC3B,WAAW,wBAAwB,CAAC,GAAG,OACtC,CAAC,WACC,MAAM,MAAM,qCAAqC,MAAM,CAC3D;AAEF,IAAM,eAAe,CACnB,QACA,WAEA,OAAO,aAAa,WAAW,MAAM,KACrC,OAAO,QAAQ,SAAS,OAAO,MAAM,KACrC,OAAO,OAAO,SAAS,OAAO,OAAO,KACrC,OAAO,cAAc,SAAS,OAAO,SAAS,IAAI,MACjD,CAAC,OAAO,eAAe,OAAO,YAAY,SAAS,OAAO,SAAS,EAAE;AAKjE,IAAM,sCAAsC,CAAC,aAG7C;AAAA,EACL,cAAc,OAAO,WAA+B;AAAA,IAClD,MAAM,aAAa,MAAM,iBACvB,QAAQ,OACR,SACC,QAAQ,OAAO,KAAK,KAAK,CAC5B;AAAA,IACA,YAAY,QAAQ,UAAU;AAAA,IAC9B,IAAI,CAAC,qBAAqB,UAAU,EAAE,KAAK,CAAC,WAAW,aAAa,QAAQ,MAAM,CAAC;AAAA,MACjF,MAAM,IAAI,MAAM,mDAAmD;AAAA,IAErE,OAAO;AAAA,SACD,WAAW,cAAc,YACzB,CAAC,IACD,EAAE,WAAW,WAAW,UAAU;AAAA,IACxC;AAAA;AAEJ;;;ACrHA;",
+  "debugId": "C399317D4FE0652364756E2164756E21",
   "names": []
 }

package/dist/authAgency.d.ts

@@ -0,0 +1,25 @@
+import type { ActionRequestInput } from "@absolutejs/agency";
+import type { AgentDelegationStore } from "@absolutejs/auth/agents";
+import { type Static } from "@sinclair/typebox";
+export declare const AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE = "urn:absolutejs:authorization-detail:agency-delegation";
+export declare const AuthAgencyAuthorizationDetailSchema: import("@sinclair/typebox").TObject<{
+    actions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    audience: import("@sinclair/typebox").TString;
+    effects: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    resourceIds: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    resourceTypes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    type: import("@sinclair/typebox").TLiteral<"urn:absolutejs:authorization-detail:agency-delegation">;
+}>;
+export type AuthAgencyAuthorizationDetail = Static<typeof AuthAgencyAuthorizationDetailSchema>;
+export declare const authAgencyAuthorizationDetail: (detail: Omit<AuthAgencyAuthorizationDetail, "type">) => AuthAgencyAuthorizationDetail;
+/** Bridges Absolute Auth's verified principal grant directly into Agency.
+ * The same delegation ID is re-read at request, lease, and execution time; no
+ * shadow grant or manual synchronization is required. */
+export declare const createAuthAgencyDelegationAuthority: (options: {
+    now?: () => number;
+    store: AgentDelegationStore;
+}) => {
+    assertAllows: (action: ActionRequestInput) => Promise<{
+        expiresAt?: number | undefined;
+    }>;
+};

package/dist/authAgency.js

@@ -0,0 +1,63 @@
+// @bun
+// src/authAgency.ts
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+var AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE = "urn:absolutejs:authorization-detail:agency-delegation";
+var AuthAgencyAuthorizationDetailSchema = Type.Object({
+  actions: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+  audience: Type.String({ minLength: 1 }),
+  effects: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+  resourceIds: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { minItems: 1 })),
+  resourceTypes: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),
+  type: Type.Literal(AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE)
+}, { additionalProperties: false });
+var authAgencyAuthorizationDetail = (detail) => ({
+  ...detail,
+  type: AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE
+});
+var subset = (required, available) => required.every((value) => available.includes(value));
+var audienceOf = (action) => {
+  const audience = action.context?.audience;
+  return typeof audience === "string" ? audience : undefined;
+};
+var activeDelegation = async (store, action, now) => {
+  const { delegationId } = action.actor;
+  if (!delegationId)
+    throw new Error("Agency action requires a delegation");
+  const delegation = await store.findByDelegationId(delegationId);
+  if (!delegation)
+    throw new Error("Unknown authenticated delegation");
+  if (delegation.status !== "active")
+    throw new Error("Authenticated delegation is revoked");
+  if (delegation.expiresAt !== undefined && delegation.expiresAt <= now)
+    throw new Error("Authenticated delegation is expired");
+  return delegation;
+};
+var assertActor = (action, delegation) => {
+  if (action.actor.agentId !== delegation.agentId || action.actor.userId !== delegation.userId || action.actor.organizationId !== delegation.organizationId)
+    throw new Error("Agency actor does not match authenticated delegation");
+  if (!subset(action.actor.scopes, delegation.scopes))
+    throw new Error("Agency actor scopes exceed authenticated delegation");
+};
+var authorizationDetails = (delegation) => (delegation.authorizationDetails ?? []).filter((detail) => Value.Check(AuthAgencyAuthorizationDetailSchema, detail));
+var detailAllows = (detail, action) => detail.audience === audienceOf(action) && detail.actions.includes(action.action) && subset(action.effects, detail.effects) && detail.resourceTypes.includes(action.resource.type) && (!detail.resourceIds || detail.resourceIds.includes(action.resource.id));
+var createAuthAgencyDelegationAuthority = (options) => ({
+  assertAllows: async (action) => {
+    const delegation = await activeDelegation(options.store, action, (options.now ?? Date.now)());
+    assertActor(action, delegation);
+    if (!authorizationDetails(delegation).some((detail) => detailAllows(detail, action)))
+      throw new Error("Agency action is outside authenticated delegation");
+    return {
+      ...delegation.expiresAt === undefined ? {} : { expiresAt: delegation.expiresAt }
+    };
+  }
+});
+export {
+  createAuthAgencyDelegationAuthority,
+  authAgencyAuthorizationDetail,
+  AuthAgencyAuthorizationDetailSchema,
+  AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE
+};
+
+//# debugId=E0B3B1639AE88DFF64756E2164756E21
+//# sourceMappingURL=authAgency.js.map

package/dist/authAgency.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/authAgency.ts"],
+  "sourcesContent": [
+    "import type { ActionRequestInput } from \"@absolutejs/agency\";\nimport type {\n  AgentDelegation,\n  AgentDelegationStore,\n} from \"@absolutejs/auth/agents\";\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport { Value } from \"@sinclair/typebox/value\";\n\nexport const AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE =\n  \"urn:absolutejs:authorization-detail:agency-delegation\";\n\nexport const AuthAgencyAuthorizationDetailSchema = Type.Object(\n  {\n    actions: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),\n    audience: Type.String({ minLength: 1 }),\n    effects: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),\n    resourceIds: Type.Optional(\n      Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),\n    ),\n    resourceTypes: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }),\n    type: Type.Literal(AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE),\n  },\n  { additionalProperties: false },\n);\n\nexport type AuthAgencyAuthorizationDetail = Static<\n  typeof AuthAgencyAuthorizationDetailSchema\n>;\n\nexport const authAgencyAuthorizationDetail = (\n  detail: Omit<AuthAgencyAuthorizationDetail, \"type\">,\n): AuthAgencyAuthorizationDetail => ({\n  ...detail,\n  type: AUTH_AGENCY_AUTHORIZATION_DETAIL_TYPE,\n});\n\nconst subset = (required: readonly string[], available: readonly string[]) =>\n  required.every((value) => available.includes(value));\n\nconst audienceOf = (action: ActionRequestInput) => {\n  const audience = action.context?.audience;\n\n  return typeof audience === \"string\" ? audience : undefined;\n};\n\nconst activeDelegation = async (\n  store: AgentDelegationStore,\n  action: ActionRequestInput,\n  now: number,\n) => {\n  const { delegationId } = action.actor;\n\n  if (!delegationId) throw new Error(\"Agency action requires a delegation\");\n  const delegation = await store.findByDelegationId(delegationId);\n\n  if (!delegation) throw new Error(\"Unknown authenticated delegation\");\n  if (delegation.status !== \"active\")\n    throw new Error(\"Authenticated delegation is revoked\");\n  if (delegation.expiresAt !== undefined && delegation.expiresAt <= now)\n    throw new Error(\"Authenticated delegation is expired\");\n\n  return delegation;\n};\n\nconst assertActor = (\n  action: ActionRequestInput,\n  delegation: AgentDelegation,\n) => {\n  if (\n    action.actor.agentId !== delegation.agentId ||\n    action.actor.userId !== delegation.userId ||\n    action.actor.organizationId !== delegation.organizationId\n  )\n    throw new Error(\"Agency actor does not match authenticated delegation\");\n  if (!subset(action.actor.scopes, delegation.scopes))\n    throw new Error(\"Agency actor scopes exceed authenticated delegation\");\n};\n\nconst authorizationDetails = (delegation: AgentDelegation) =>\n  (delegation.authorizationDetails ?? []).filter(\n    (detail): detail is AuthAgencyAuthorizationDetail =>\n      Value.Check(AuthAgencyAuthorizationDetailSchema, detail),\n  );\n\nconst detailAllows = (\n  detail: AuthAgencyAuthorizationDetail,\n  action: ActionRequestInput,\n) =>\n  detail.audience === audienceOf(action) &&\n  detail.actions.includes(action.action) &&\n  subset(action.effects, detail.effects) &&\n  detail.resourceTypes.includes(action.resource.type) &&\n  (!detail.resourceIds || detail.resourceIds.includes(action.resource.id));\n\n/** Bridges Absolute Auth's verified principal grant directly into Agency.\n * The same delegation ID is re-read at request, lease, and execution time; no\n * shadow grant or manual synchronization is required. */\nexport const createAuthAgencyDelegationAuthority = (options: {\n  now?: () => number;\n  store: AgentDelegationStore;\n}) => ({\n  assertAllows: async (action: ActionRequestInput) => {\n    const delegation = await activeDelegation(\n      options.store,\n      action,\n      (options.now ?? Date.now)(),\n    );\n    assertActor(action, delegation);\n    if (!authorizationDetails(delegation).some((detail) => detailAllows(detail, action)))\n      throw new Error(\"Agency action is outside authenticated delegation\");\n\n    return {\n      ...(delegation.expiresAt === undefined\n        ? {}\n        : { expiresAt: delegation.expiresAt }),\n    };\n  },\n});\n"
+  ],
+  "mappings": ";;AAKA;AACA;AAEO,IAAM,wCACX;AAEK,IAAM,sCAAsC,KAAK,OACtD;AAAA,EACE,SAAS,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAClE,UAAU,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAA,EACtC,SAAS,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EAClE,aAAa,KAAK,SAChB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAC3D;AAAA,EACA,eAAe,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;AAAA,EACxE,MAAM,KAAK,QAAQ,qCAAqC;AAC1D,GACA,EAAE,sBAAsB,MAAM,CAChC;AAMO,IAAM,gCAAgC,CAC3C,YACmC;AAAA,KAChC;AAAA,EACH,MAAM;AACR;AAEA,IAAM,SAAS,CAAC,UAA6B,cAC3C,SAAS,MAAM,CAAC,UAAU,UAAU,SAAS,KAAK,CAAC;AAErD,IAAM,aAAa,CAAC,WAA+B;AAAA,EACjD,MAAM,WAAW,OAAO,SAAS;AAAA,EAEjC,OAAO,OAAO,aAAa,WAAW,WAAW;AAAA;AAGnD,IAAM,mBAAmB,OACvB,OACA,QACA,QACG;AAAA,EACH,QAAQ,iBAAiB,OAAO;AAAA,EAEhC,IAAI,CAAC;AAAA,IAAc,MAAM,IAAI,MAAM,qCAAqC;AAAA,EACxE,MAAM,aAAa,MAAM,MAAM,mBAAmB,YAAY;AAAA,EAE9D,IAAI,CAAC;AAAA,IAAY,MAAM,IAAI,MAAM,kCAAkC;AAAA,EACnE,IAAI,WAAW,WAAW;AAAA,IACxB,MAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD,IAAI,WAAW,cAAc,aAAa,WAAW,aAAa;AAAA,IAChE,MAAM,IAAI,MAAM,qCAAqC;AAAA,EAEvD,OAAO;AAAA;AAGT,IAAM,cAAc,CAClB,QACA,eACG;AAAA,EACH,IACE,OAAO,MAAM,YAAY,WAAW,WACpC,OAAO,MAAM,WAAW,WAAW,UACnC,OAAO,MAAM,mBAAmB,WAAW;AAAA,IAE3C,MAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE,IAAI,CAAC,OAAO,OAAO,MAAM,QAAQ,WAAW,MAAM;AAAA,IAChD,MAAM,IAAI,MAAM,qDAAqD;AAAA;AAGzE,IAAM,uBAAuB,CAAC,gBAC3B,WAAW,wBAAwB,CAAC,GAAG,OACtC,CAAC,WACC,MAAM,MAAM,qCAAqC,MAAM,CAC3D;AAEF,IAAM,eAAe,CACnB,QACA,WAEA,OAAO,aAAa,WAAW,MAAM,KACrC,OAAO,QAAQ,SAAS,OAAO,MAAM,KACrC,OAAO,OAAO,SAAS,OAAO,OAAO,KACrC,OAAO,cAAc,SAAS,OAAO,SAAS,IAAI,MACjD,CAAC,OAAO,eAAe,OAAO,YAAY,SAAS,OAAO,SAAS,EAAE;AAKjE,IAAM,sCAAsC,CAAC,aAG7C;AAAA,EACL,cAAc,OAAO,WAA+B;AAAA,IAClD,MAAM,aAAa,MAAM,iBACvB,QAAQ,OACR,SACC,QAAQ,OAAO,KAAK,KAAK,CAC5B;AAAA,IACA,YAAY,QAAQ,UAAU;AAAA,IAC9B,IAAI,CAAC,qBAAqB,UAAU,EAAE,KAAK,CAAC,WAAW,aAAa,QAAQ,MAAM,CAAC;AAAA,MACjF,MAAM,IAAI,MAAM,mDAAmD;AAAA,IAErE,OAAO;AAAA,SACD,WAAW,cAAc,YACzB,CAAC,IACD,EAAE,WAAW,WAAW,UAAU;AAAA,IACxC;AAAA;AAEJ;",
+  "debugId": "E0B3B1639AE88DFF64756E2164756E21",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@absolutejs/agent",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "The production-grade, provider-neutral agent stack for AbsoluteJS: auth, actions, runtime, sandboxing, trust, memory, inbox, discovery, MCP, A2A, policy, wallet limits, controls, and conformance.",
   "type": "module",
   "license": "MIT",
@@ -121,7 +121,7 @@
     "release": "bun run format && bun run check:package && npm publish --access public"
   },
   "dependencies": {
-    "@absolutejs/a2a": "^0.2.0",
+    "@absolutejs/a2a": "^0.2.1",
     "@absolutejs/agency": "^0.5.0",
     "@absolutejs/agent-conformance": "^0.4.0",
     "@absolutejs/agent-control": "^0.4.0",
@@ -134,9 +134,9 @@
     "@absolutejs/auth": "^0.56.0",
     "@absolutejs/execution": "^0.2.0",
     "@absolutejs/manifest": "^0.3.0",
-    "@absolutejs/mcp": "^0.10.1",
+    "@absolutejs/mcp": "^0.10.2",
     "@absolutejs/policy": "^0.2.0",
-    "@absolutejs/wallet": "^0.3.0",
+    "@absolutejs/wallet": "^0.3.2",
     "@sinclair/typebox": "^0.34.0"
   },
   "devDependencies": {