@agenticprimitives/a2a 0.0.0-alpha.19 → 0.0.0-alpha.20

package/dist/index.js

@@ -24,11 +24,22 @@ export { authorizeA2aMessage, hashA2aMessage, hashA2aTaskRequest, hashPushConfig
 export { createA2aAgent } from './agent.js';
 // Card-audience authentication (spec 338 §8, W4-b) — closes the `?view=authenticated` hole.
 export { PUBLIC_AUDIENCE, createCardAudienceResolver, readCardAudienceClaim } from './card-audience.js';
-export { dispatchA2aRpc, handleA2aRpcBody } from './jsonrpc.js';
 export { A2aWireAdapter } from './client.js';
 // Agent discovery (§8) — name → SA → endpoint + agent-card fetch (injected resolvers, ADR-0021)
-export { resolveA2aTarget, fetchAgentCard } from './discovery.js';
+export { resolveA2aTarget, fetchAgentCard, A2A_JSONRPC_PATH, A2A_AGENT_CARD_PATH } from './discovery.js';
 // Delivery — signed push + SSE (W4)
 export { hashPushPayload, deliverPush, verifyPushEnvelope } from './push.js';
+// Spec 366 R2 / 367 §8 — the subject-ask application profile (one agent asks another to answer a step about itself).
+export { AP_SUBJECT_ASK_EXTENSION_URI, validateSubjectAsk, subjectAsk, subjectAnswer } from './subject-ask.js';
+// Spec 376 — the hand-off profile (one step, run elsewhere under a child mandate).
+export { AP_HANDOFF_EXTENSION_URI, validateHandoff, handoff } from './handoff.js';
+// Spec 384 W2 — the intent-engagement binding (spec 336 §5): probe/response as messages under one extension URI, never a task.
+export { AP_ENGAGEMENT_EXTENSION_URI, ENGAGEMENT_CARD_EXTENSION, validateEngagementProbe, validateEngagementResponse, engagementProbeMessage, engagementResponseMessage, engagementOf } from './engagement.js';
 export { SSE_HEADERS, formatSseEvent, formatSseComment, isStreamEnd } from './sse.js';
+// ─── Spec 350 §8 — session wires: sign as an identity you do not custody (ONE implementation) ──────
+export { SESSION_WRAPPED_SIG_TYPE, wrapSessionSignature, parseSessionWrappedSignature, wireToDelegation, delegationToWire, checkSessionWireShape, verifySessionWrappedSignature, sessionBodyHash, } from './session-wire.js';
+// ─── Spec 399 §4 promotions — the delegate-key tail every A2A service verifies, and the routed hop ─────
+export { verifyDelegationWire, delegationOfWire } from './wire-verify.js';
+// Spec 366 R4 / 374 §4 / 376 — a routed ask, a delivered answer and a hand-off over the one wire; resolved through the card.
+export { a2aEndpointOf, subjectAskMessage, subjectAskOf, SUBJECT_ANSWER_ARTIFACT, routedRunRefFor, subjectEnvelopeOf, sendSubjectAskOverWire, subjectAnswerMessage, subjectAnswerOf, handoffMessage, handoffOf } from './subject-hop.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,wGAAwG;AACxG,yGAAyG;AACzG,wGAAwG;AAExG,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,4BAAqC,CAAC;AACpE,MAAM,CAAC,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAavE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAIzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAI1D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAKxF,kGAAkG;AAClG,qGAAqG;AACrG,sGAAsG;AACtG,mEAAmE;AACnE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,UAAU;AACV,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5E,6CAA6C;AAC7C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGhF,mCAAmC;AACnC,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AAGnB,4CAA4C;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,4FAA4F;AAC5F,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAWxG,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,gGAAgG;AAChG,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGlE,oCAAoC;AACpC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE7E,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,wGAAwG;AACxG,yGAAyG;AACzG,wGAAwG;AAExG,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,4BAAqC,CAAC;AACpE,MAAM,CAAC,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAavE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAIzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAI1D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAKxF,kGAAkG;AAClG,qGAAqG;AACrG,sGAAsG;AACtG,mEAAmE;AACnE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,UAAU;AACV,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5E,6CAA6C;AAC7C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGhF,mCAAmC;AACnC,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AAGnB,4CAA4C;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,4FAA4F;AAC5F,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAYxG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,gGAAgG;AAChG,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGzG,oCAAoC;AACpC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE7E,qHAAqH;AACrH,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/G,mFAAmF;AACnF,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAClF,+HAA+H;AAC/H,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAK/M,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGtF,sGAAsG;AACtG,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,6BAA6B,EAC7B,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAG3B,0GAA0G;AAC1G,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE1E,6HAA6H;AAC7H,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/session-wire.d.ts

@@ -0,0 +1,69 @@
+import { type Address, type Hex } from 'viem';
+import { type Delegation } from '@agenticprimitives/delegation';
+/** The JSON-safe form of a delegation as it travels (bigint salt as a string). */
+export interface DelegationWireV1 {
+    delegator: Address;
+    delegate: Address;
+    authority: Hex;
+    caveats: Array<{
+        enforcer: Address;
+        terms: Hex;
+        args?: Hex;
+    }>;
+    salt: string;
+    signature: Hex;
+}
+/** Signature type byte for the session-wrapped form. Unknown to AgentAccount `_validateSig` (fails closed
+ *  on chain) and to every other verifier — only a gate that calls `verifySessionWrappedSignature` accepts
+ *  it, and only after full verification. */
+export declare const SESSION_WRAPPED_SIG_TYPE = "0x51";
+/** Wrap a raw session-key ECDSA signature with the wire that authorizes it. */
+export declare function wrapSessionSignature(wire: DelegationWireV1, sig: Hex): Hex;
+/** Parse the session-wrapped form; null for any other signature shape (callers then use the standard
+ *  ERC-1271 path — one detector, no ambiguity). */
+export declare function parseSessionWrappedSignature(signature: string): {
+    wire: DelegationWireV1;
+    sig: Hex;
+} | null;
+export declare function wireToDelegation(w: DelegationWireV1): Delegation;
+export declare function delegationToWire(d: Delegation): DelegationWireV1;
+/**
+ * Shape check for a session wire (at ceremony store time AND at every gate hit): timestamp-bounded, a
+ * pinned allowedMethods set that never carries the any-skill sentinel and — when `skill` is given — names
+ * that skill's selector.
+ *
+ * `skill` should be passed wherever the request names one: a wire minted for one rail must not authorize
+ * another. It is omitted only on the read/control path (`tasks/get`, `tasks/cancel`,
+ * `pushNotificationConfig/set`), whose digest binds a method and a taskId, not a skill. That omission is
+ * narrow rather than lax — the wire must still be pinned, live, ERC-1271-valid and unrevoked, and the task
+ * runtime independently requires the caller to BE a party to the task.
+ */
+export declare function checkSessionWireShape(wire: DelegationWireV1, enforcers: {
+    timestamp: string;
+    allowedMethods: string;
+}, nowSec: number, opts?: {
+    skill?: string;
+}): string | null;
+/**
+ * Verify a session-wrapped signature for `signer` over `digest`, fail-closed on every leg. The on-chain
+ * checks are the SAME injected ones the standard gate uses (`OnChainChecks`) — revocation is immediate.
+ * Pass `skill` whenever the request names one.
+ */
+export declare function verifySessionWrappedSignature(args: {
+    signer: Address;
+    digest: Hex;
+    signature: string;
+    enforcers: {
+        timestamp: string;
+        allowedMethods: string;
+    };
+    verifyDelegationSig: (d: Delegation) => Promise<boolean>;
+    isRevoked: (d: Delegation) => Promise<boolean>;
+    /** The skill the inbound message requests. Omit ONLY on the read/control path. */
+    skill?: string;
+    /** Milliseconds (Date.now() shape); injected for determinism. */
+    now?: number;
+}): Promise<boolean>;
+/** keccak over stable-JSON — the a2a body-hash convention (equals the task runtime's `hashBody`). */
+export declare const sessionBodyHash: (data: unknown) => Hex;
+//# sourceMappingURL=session-wire.d.ts.map

package/dist/session-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-wire.d.ts","sourceRoot":"","sources":["../src/session-wire.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAmD,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAC/F,OAAO,EAAmD,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAGjH,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,GAAG,CAAC;IACf,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,GAAG,CAAC;QAAC,IAAI,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC,CAAC;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC;CAChB;AAED;;4CAE4C;AAC5C,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAU/C,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,CAE1E;AAED;mDACmD;AACnD,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,IAAI,CAS3G;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAShE;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAMhE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,gBAAgB,EACtB,SAAS,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EACxD,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACxB,MAAM,GAAG,IAAI,CA2Bf;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,GAAG,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,mBAAmB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBnB;AAED,qGAAqG;AACrG,eAAO,MAAM,eAAe,SAAU,OAAO,KAAG,GAAuD,CAAC"}

package/dist/session-wire.js

@@ -0,0 +1,170 @@
+// SESSION WIRES — how an agent signs as an identity whose key it does not hold. Spec 350 §8 / spec 326.
+//
+// THE CALLER-SIGNATURE GAP, RESOLVED (spec 329 §3.1, generalized). A runtime holds no key for the identity
+// it acts as — an org's DO holds no org key, a relying service must never custody the service agent it
+// acts as (ADR-0019: a relying key is always a DELEGATE, never a custodian), a skills worker signs as
+// `skills-agent` without holding it. Yet A2A needs per-message sender signatures and per-poll caller
+// signatures that verify against THAT identity. A ceremony therefore mints a NARROW delegation —
+// delegator = the identity, delegate = a KMS session key, allowedMethods = a pinned set of skill
+// selectors (never the any-skill sentinel), allowedTargets pinned, timestamp-bounded — signed by the
+// identity's own custody credential. The runtime stores the wire; NO raw key ever rests there; the KMS
+// key signs each digest on demand.
+//
+// ON THE WIRE such a signature is the SESSION-WRAPPED form: `0x51` (a type byte no on-chain validator
+// accepts — it fails closed anywhere but a gate that understands it) followed by hex(utf8(JSON({ wire,
+// sig }))). A gate verifies it fail-closed PER MESSAGE: delegator === the claimed signer; timestamp window
+// live; a pinned selector set that names the requested skill and never A2A_ANY_SKILL; the raw ECDSA sig
+// recovers to the wire's delegate; the wire's own signature ERC-1271-verifies against the delegator; AND
+// the wire is unrevoked on chain — so a custodian's revocation kills the authority at every gate, now.
+//
+// WHY THIS IS HERE. Four copies of this file existed across two repos (demo-a2a's session-wire.ts and
+// org-wire.ts, skills-a2a's service-wire.ts, and a sibling worker's). "Copy the wire implementation, do not
+// invent a third" was the instruction, and the count had already reached four. It is an A2A signature
+// format that consumes this package's own `skillSelector`; it belongs here, and the apps now consume it.
+// What STAYS in the apps is policy — which caveat SHAPE counts as stewardship vs member access, which
+// contracts a stewardship wire must pin. `org-wire.ts`'s `hasStewardshipShape` is a positive identity
+// test no generic layer can express, and it does not move.
+import { hashMessage, keccak256, recoverAddress, toBytes } from 'viem';
+import { decodeAllowedMethodsTerms, decodeTimestampTerms } from '@agenticprimitives/delegation';
+import { A2A_ANY_SKILL, skillSelector } from './grant.js';
+/** Signature type byte for the session-wrapped form. Unknown to AgentAccount `_validateSig` (fails closed
+ *  on chain) and to every other verifier — only a gate that calls `verifySessionWrappedSignature` accepts
+ *  it, and only after full verification. */
+export const SESSION_WRAPPED_SIG_TYPE = '0x51';
+const utf8ToHex = (s) => `0x${Array.from(new TextEncoder().encode(s), (b) => b.toString(16).padStart(2, '0')).join('')}`;
+const hexToUtf8 = (h) => {
+    const clean = h.startsWith('0x') ? h.slice(2) : h;
+    const bytes = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < bytes.length; i++)
+        bytes[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    return new TextDecoder().decode(bytes);
+};
+/** Wrap a raw session-key ECDSA signature with the wire that authorizes it. */
+export function wrapSessionSignature(wire, sig) {
+    return (SESSION_WRAPPED_SIG_TYPE + utf8ToHex(JSON.stringify({ wire, sig })).slice(2));
+}
+/** Parse the session-wrapped form; null for any other signature shape (callers then use the standard
+ *  ERC-1271 path — one detector, no ambiguity). */
+export function parseSessionWrappedSignature(signature) {
+    if (!signature?.startsWith(SESSION_WRAPPED_SIG_TYPE) || signature.length <= SESSION_WRAPPED_SIG_TYPE.length)
+        return null;
+    try {
+        const parsed = JSON.parse(hexToUtf8(`0x${signature.slice(SESSION_WRAPPED_SIG_TYPE.length)}`));
+        if (!parsed?.wire?.delegator || !parsed.wire.delegate || !parsed.wire.signature || !parsed.sig)
+            return null;
+        return { wire: parsed.wire, sig: parsed.sig };
+    }
+    catch {
+        return null;
+    }
+}
+export function wireToDelegation(w) {
+    return {
+        delegator: w.delegator,
+        delegate: w.delegate,
+        authority: w.authority,
+        caveats: w.caveats.map((c) => ({ enforcer: c.enforcer, terms: c.terms, args: (c.args ?? '0x') })),
+        salt: BigInt(w.salt),
+        signature: w.signature,
+    };
+}
+export function delegationToWire(d) {
+    return {
+        delegator: d.delegator, delegate: d.delegate, authority: d.authority,
+        caveats: d.caveats.map((c) => ({ enforcer: c.enforcer, terms: c.terms, ...(c.args && c.args !== '0x' ? { args: c.args } : {}) })),
+        salt: d.salt.toString(), signature: d.signature,
+    };
+}
+/**
+ * Shape check for a session wire (at ceremony store time AND at every gate hit): timestamp-bounded, a
+ * pinned allowedMethods set that never carries the any-skill sentinel and — when `skill` is given — names
+ * that skill's selector.
+ *
+ * `skill` should be passed wherever the request names one: a wire minted for one rail must not authorize
+ * another. It is omitted only on the read/control path (`tasks/get`, `tasks/cancel`,
+ * `pushNotificationConfig/set`), whose digest binds a method and a taskId, not a skill. That omission is
+ * narrow rather than lax — the wire must still be pinned, live, ERC-1271-valid and unrevoked, and the task
+ * runtime independently requires the caller to BE a party to the task.
+ */
+export function checkSessionWireShape(wire, enforcers, nowSec, opts) {
+    const byEnforcer = (addr) => (wire.caveats ?? []).find((c) => (c.enforcer ?? '').toLowerCase() === addr.toLowerCase());
+    const tsCav = byEnforcer(enforcers.timestamp);
+    if (!tsCav?.terms)
+        return 'session wire must be timestamp-bounded';
+    try {
+        const win = decodeTimestampTerms(tsCav.terms);
+        const now = BigInt(nowSec);
+        if (now < win.validAfter || now >= win.validUntil)
+            return 'session wire outside its timestamp window';
+    }
+    catch {
+        return 'session wire timestamp terms undecodable';
+    }
+    const amCav = byEnforcer(enforcers.allowedMethods);
+    if (!amCav?.terms)
+        return 'session wire must carry an allowedMethods caveat';
+    try {
+        const selectors = decodeAllowedMethodsTerms(amCav.terms).map((s) => s.toLowerCase());
+        // A PINNED SET, never the any-skill sentinel. A leaked delegate key can send only what the custodian
+        // enumerated; `A2A_ANY_SKILL` is the line between "these operations" and "anything this agent can do".
+        if (selectors.some((s) => s === A2A_ANY_SKILL.toLowerCase()))
+            return 'session wire must never carry the any-skill sentinel';
+        if (selectors.length === 0)
+            return 'session wire allowedMethods must name at least one selector';
+        if (opts?.skill) {
+            const want = skillSelector(opts.skill).toLowerCase();
+            if (!selectors.includes(want))
+                return `session wire allowedMethods does not name the ${opts.skill} selector`;
+        }
+    }
+    catch {
+        return 'session wire allowedMethods terms undecodable';
+    }
+    return null;
+}
+/**
+ * Verify a session-wrapped signature for `signer` over `digest`, fail-closed on every leg. The on-chain
+ * checks are the SAME injected ones the standard gate uses (`OnChainChecks`) — revocation is immediate.
+ * Pass `skill` whenever the request names one.
+ */
+export async function verifySessionWrappedSignature(args) {
+    const parsed = parseSessionWrappedSignature(args.signature);
+    if (!parsed)
+        return false;
+    const { wire, sig } = parsed;
+    if (wire.delegator.toLowerCase() !== args.signer.toLowerCase())
+        return false;
+    const shapeOpts = args.skill ? { skill: args.skill } : undefined;
+    if (checkSessionWireShape(wire, args.enforcers, Math.floor((args.now ?? Date.now()) / 1000), shapeOpts) !== null)
+        return false;
+    // The raw sig must recover to the wire's delegate (the KMS session key). Accept both raw-digest and
+    // eth-signed-message recovery, mirroring AgentAccount._verifyEcdsa.
+    const delegate = wire.delegate.toLowerCase();
+    let recovered = false;
+    try {
+        recovered = (await recoverAddress({ hash: args.digest, signature: sig })).toLowerCase() === delegate;
+    }
+    catch { /* try wrapped */ }
+    if (!recovered) {
+        try {
+            recovered = (await recoverAddress({ hash: hashMessage({ raw: toBytes(args.digest) }), signature: sig })).toLowerCase() === delegate;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (!recovered)
+        return false;
+    const d = wireToDelegation(wire);
+    try {
+        if (await args.isRevoked(d))
+            return false; // custodian revoke ⇒ immediate kill at every gate
+        return await args.verifyDelegationSig(d);
+    }
+    catch {
+        return false; // fail-closed on chain-read failure (ADR-0013)
+    }
+}
+/** keccak over stable-JSON — the a2a body-hash convention (equals the task runtime's `hashBody`). */
+export const sessionBodyHash = (data) => keccak256(toBytes(JSON.stringify(data ?? null)));
+//# sourceMappingURL=session-wire.js.map

package/dist/session-wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-wire.js","sourceRoot":"","sources":["../src/session-wire.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,EAAE;AACF,2GAA2G;AAC3G,uGAAuG;AACvG,sGAAsG;AACtG,qGAAqG;AACrG,iGAAiG;AACjG,iGAAiG;AACjG,qGAAqG;AACrG,uGAAuG;AACvG,mCAAmC;AACnC,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,2GAA2G;AAC3G,wGAAwG;AACxG,yGAAyG;AACzG,uGAAuG;AACvG,EAAE;AACF,sGAAsG;AACtG,4GAA4G;AAC5G,sGAAsG;AACtG,yGAAyG;AACzG,sGAAsG;AACtG,sGAAsG;AACtG,2DAA2D;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAA0B,MAAM,MAAM,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAmB,MAAM,+BAA+B,CAAC;AACjH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAY1D;;4CAE4C;AAC5C,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,MAAM,SAAS,GAAG,CAAC,CAAS,EAAO,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAS,CAAC;AAC7I,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9F,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,IAAsB,EAAE,GAAQ;IACnE,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAQ,CAAC;AAC/F,CAAC;AAED;mDACmD;AACnD,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,wBAAwB,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC,CAA2C,CAAC;QACxI,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAC5G,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAmB;IAClD,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAQ,EAAE,CAAC,CAAC;QACxG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAa;IAC5C,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;QACpE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAY,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/I,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAgB;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAsB,EACtB,SAAwD,EACxD,MAAc,EACd,IAAyB;IAEzB,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/H,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,KAAK;QAAE,OAAO,wCAAwC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO,2CAA2C,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,EAAE,KAAK;QAAE,OAAO,kDAAkD,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACrF,qGAAqG;QACrG,uGAAuG;QACvG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,sDAAsD,CAAC;QAC5H,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,6DAA6D,CAAC;QACjG,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACrD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,iDAAiD,IAAI,CAAC,KAAK,WAAW,CAAC;QAC/G,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,+CAA+C,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAWnD;IACC,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC7B,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,IAAI,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,SAAS,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/H,oGAAoG;IACpG,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QAAC,SAAS,GAAG,CAAC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACzI,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,SAAS,GAAG,CAAC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACtK,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,kDAAkD;QAC7F,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,+CAA+C;IAC/D,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAa,EAAO,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC"}

package/dist/standard/caller.d.ts

@@ -0,0 +1,86 @@
+import { type Address, type Hex } from 'viem';
+import type { Delegation } from '@agenticprimitives/delegation';
+import { type DelegationWireV1 } from '../session-wire.js';
+import type { Principal } from './server.js';
+/** The Authorization scheme an agent presents its session wire under. */
+export declare const SESSION_AUTH_SCHEME = "A2A-Session";
+/** The skill a session wire must pin to reach the standard surface: asking this agent, and nothing else.
+ *  A wire that names other selectors and not this one is refused — pinning is the point. */
+export declare const STANDARD_SURFACE_SKILL = "harness.ask";
+/** What a caller signs. Every field is bound: a captured assertion cannot be replayed onto another method,
+ *  another body, another host, or a later moment. `issuedAt` is IN the digest and checked (stale / ahead refused,
+ *  the digest claimed once) — the wire path's freshness field that the deleted JSON-RPC dispatcher once dropped
+ *  (audit a2a-issuedat-dropped-in-dispatch; the folded wire of spec 372 S4 is where the check lives now). */
+export interface CallerAssertionV1 {
+    /** The Smart Agent the caller acts AS — must equal the wire's delegator. */
+    agent: string;
+    /** The A2A method this assertion is for. */
+    method: string;
+    /** keccak256 over the raw JSON-RPC request body. */
+    bodyHash: Hex;
+    /** Seconds since the epoch. */
+    issuedAt: number;
+    /** The origin the request is addressed to (`https://host`), so an assertion for one agent's host is not
+     *  usable at another's. */
+    audience: string;
+    /** The `0x51`-wrapped session signature over `callerAssertionDigest(...)`. */
+    signature: string;
+}
+/** The digest a caller signs — keccak over stable JSON, the a2a body-hash convention. */
+export declare function callerAssertionDigest(a: Omit<CallerAssertionV1, 'signature'>): Hex;
+/** keccak over the raw request body, exactly as it arrived — never over a re-serialized parse. */
+export declare const requestBodyHash: (raw: string) => Hex;
+/** Build the `Authorization` header value a runtime sends. */
+export declare function sessionAuthorizationHeader(a: CallerAssertionV1): string;
+/** Read an `A2A-Session` header. Returns null for any other scheme (a `Bearer` is a person's, not ours) and
+ *  for anything malformed — never a partial assertion. */
+export declare function parseSessionAuthorization(header: string | null | undefined): CallerAssertionV1 | null;
+export interface SessionWirePrincipalDeps {
+    /** The enforcer addresses the wire's caveats must carry (this deployment's). */
+    enforcers: {
+        timestamp: string;
+        allowedMethods: string;
+    };
+    /** ERC-1271 / ECDSA verification of the wire against its delegator. */
+    verifyDelegationSig: (d: Delegation) => Promise<boolean>;
+    /** On-chain revocation — a custodian's revoke kills the caller at the next request. */
+    isRevoked: (d: Delegation) => Promise<boolean>;
+    /**
+     * Verify an assertion the agent signed DIRECTLY — ERC-1271 against its own account, no session key in
+     * between. Some agents can do that (a relayer holding the SA's credential, a persona in this estate) and
+     * before the fold they proved themselves exactly this way, with `caller` + `signature` on the wire.
+     *
+     * NOT A FALLBACK (ADR-0013). The signature's own type byte chooses: `0x51` is session-wrapped and takes
+     * the wire path; anything else takes this one. Neither runs because the other failed, and omitting this
+     * means a direct signature is simply not admitted.
+     */
+    verifyAgentSignature?: (agent: Address, digest: Hex, signature: Hex) => Promise<boolean>;
+    /** How old an assertion may be (default 120 s). */
+    maxAgeSec?: number;
+    /** Tolerated clock skew for an assertion dated ahead (default 30 s). */
+    skewSec?: number;
+    now?: () => number;
+    /**
+     * Spend an assertion, once. Returns true when THIS call claimed it and false when it was already spent.
+     * The default is an in-isolate map, which is not replay protection where requests fan out across
+     * isolates — bind the estate's single writer (the agent's own object) in production.
+     */
+    claim?: (digest: Hex, expiresAtMs: number) => Promise<boolean>;
+    /** Told why a caller was refused — for the operator's log, never for the caller (a refusal says only
+     *  that it was refused; which leg failed is not a fact an unauthenticated caller is owed). */
+    onRefused?: (reason: string, agent?: string) => void;
+}
+/**
+ * The `principal` implementation for agents. Returns `{ agent, kind: 'agent' }` on every leg passing, and
+ * `null` otherwise — the server answers 401 and no method runs.
+ *
+ * SINGLE-USE. An accepted assertion's digest is SPENT: a captured request cannot be replayed while it is
+ * still fresh. With `claim` bound to the estate's single writer this holds everywhere; without it, only
+ * within this isolate — which on a fanned-out edge is no protection at all, and was observed live before
+ * the ledger existed. The claim happens AFTER the signature verifies, so an unauthenticated caller can
+ * spend nothing and write nothing.
+ */
+export declare function sessionWirePrincipal(deps: SessionWirePrincipalDeps): (request: Request) => Promise<Principal | null>;
+/** Re-export so a client can build a wire-signed call without reaching past the standard surface. */
+export type { DelegationWireV1 };
+//# sourceMappingURL=caller.d.ts.map

package/dist/standard/caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.d.ts","sourceRoot":"","sources":["../../src/standard/caller.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAsB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAA+D,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD;4FAC4F;AAC5F,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;6GAG6G;AAC7G,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,QAAQ,EAAE,GAAG,CAAC;IACd,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB;+BAC2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG,GAAG,CASlF;AAED,kGAAkG;AAClG,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,GAA8B,CAAC;AAQ7E,8DAA8D;AAC9D,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAEvE;AAED;0DAC0D;AAC1D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,CAerG;AAED,MAAM,WAAW,wBAAwB;IACvC,gFAAgF;IAChF,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,uEAAuE;IACvE,mBAAmB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D;kGAC8F;IAC9F,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CA4DpH;AAED,qGAAqG;AACrG,YAAY,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/standard/caller.js

@@ -0,0 +1,159 @@
+// THE RUNTIME AS ITS OWN CALLER — spec 372 S3c.
+//
+// A person reaches the standard surface with a Home session bearer. An outside runtime — Claude Code, Goose,
+// a deploy bot — has no Home session and must never be given one: it is not a person, and a bearer minted for
+// a person is exactly the credential-sharing this estate exists to avoid. What it holds instead is what every
+// agent here holds: a SESSION WIRE (spec 350 §8) — a narrow delegation from its own Smart Agent to a key it
+// controls, timestamp-bounded, pinning the one skill it may exercise, signed by the agent's custody credential
+// and revocable on chain by that custodian at any moment.
+//
+// So the runtime signs each request with that key and presents the wire beside it. The server verifies, per
+// request and fail-closed: the wire's delegator IS the agent claimed; the wire's shape is sound (bounded,
+// pinned, never the any-skill sentinel); the raw signature recovers to the wire's delegate; the wire itself
+// verifies against the delegator on chain (ERC-1271) and is NOT revoked. Revoking the wire kills the caller
+// at the next request, everywhere, with no list to update.
+//
+// TWO SCHEMES, NOT A FALLBACK (ADR-0013). `Bearer` is a person's Home session; `A2A-Session` is an agent's
+// wire. The scheme token in the header selects ONE mechanism, and it fails closed on its own terms — neither
+// is ever tried after the other fails. Which one arrived says WHO is asking. Neither says what they may do.
+import { keccak256, toBytes } from 'viem';
+import { parseSessionWrappedSignature, verifySessionWrappedSignature } from '../session-wire.js';
+/** The Authorization scheme an agent presents its session wire under. */
+export const SESSION_AUTH_SCHEME = 'A2A-Session';
+/** The skill a session wire must pin to reach the standard surface: asking this agent, and nothing else.
+ *  A wire that names other selectors and not this one is refused — pinning is the point. */
+export const STANDARD_SURFACE_SKILL = 'harness.ask';
+/** The digest a caller signs — keccak over stable JSON, the a2a body-hash convention. */
+export function callerAssertionDigest(a) {
+    return keccak256(toBytes(JSON.stringify({
+        v: 'ap.a2a.caller-assertion.v1',
+        agent: a.agent.toLowerCase(),
+        method: a.method,
+        bodyHash: a.bodyHash.toLowerCase(),
+        issuedAt: a.issuedAt,
+        audience: a.audience.replace(/\/$/, '').toLowerCase(),
+    })));
+}
+/** keccak over the raw request body, exactly as it arrived — never over a re-serialized parse. */
+export const requestBodyHash = (raw) => keccak256(toBytes(raw));
+const b64urlDecode = (s) => {
+    const padded = s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (s.length % 4)) % 4);
+    return atob(padded);
+};
+const b64urlEncode = (s) => btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+/** Build the `Authorization` header value a runtime sends. */
+export function sessionAuthorizationHeader(a) {
+    return `${SESSION_AUTH_SCHEME} ${b64urlEncode(JSON.stringify(a))}`;
+}
+/** Read an `A2A-Session` header. Returns null for any other scheme (a `Bearer` is a person's, not ours) and
+ *  for anything malformed — never a partial assertion. */
+export function parseSessionAuthorization(header) {
+    const m = new RegExp(`^${SESSION_AUTH_SCHEME}\\s+(.+)$`, 'i').exec((header ?? '').trim());
+    if (!m)
+        return null;
+    try {
+        const a = JSON.parse(b64urlDecode(m[1].trim()));
+        if (typeof a.agent !== 'string' || !/^0x[0-9a-fA-F]{40}$/.test(a.agent))
+            return null;
+        if (typeof a.method !== 'string' || !a.method)
+            return null;
+        if (typeof a.bodyHash !== 'string' || !/^0x[0-9a-fA-F]{64}$/.test(a.bodyHash))
+            return null;
+        if (typeof a.issuedAt !== 'number' || !Number.isFinite(a.issuedAt))
+            return null;
+        if (typeof a.audience !== 'string' || !a.audience)
+            return null;
+        if (typeof a.signature !== 'string' || !a.signature.startsWith('0x'))
+            return null;
+        return a;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The `principal` implementation for agents. Returns `{ agent, kind: 'agent' }` on every leg passing, and
+ * `null` otherwise — the server answers 401 and no method runs.
+ *
+ * SINGLE-USE. An accepted assertion's digest is SPENT: a captured request cannot be replayed while it is
+ * still fresh. With `claim` bound to the estate's single writer this holds everywhere; without it, only
+ * within this isolate — which on a fanned-out edge is no protection at all, and was observed live before
+ * the ledger existed. The claim happens AFTER the signature verifies, so an unauthenticated caller can
+ * spend nothing and write nothing.
+ */
+export function sessionWirePrincipal(deps) {
+    const maxAgeSec = deps.maxAgeSec ?? 120;
+    const skewSec = deps.skewSec ?? 30;
+    const now = deps.now ?? (() => Date.now());
+    const seen = new Map();
+    const refuse = (reason, agent) => { deps.onRefused?.(reason, agent); return null; };
+    return async (request) => {
+        const a = parseSessionAuthorization(request.headers.get('authorization'));
+        if (!a)
+            return null; // not our scheme — say nothing; another principal may own it
+        const nowSec = Math.floor(now() / 1000);
+        if (a.issuedAt > nowSec + skewSec)
+            return refuse('assertion is dated ahead', a.agent);
+        if (a.issuedAt < nowSec - maxAgeSec)
+            return refuse('assertion is stale', a.agent);
+        const audience = new URL(request.url).origin;
+        if (a.audience.replace(/\/$/, '').toLowerCase() !== audience.toLowerCase())
+            return refuse(`assertion is for ${a.audience}, not ${audience}`, a.agent);
+        let raw;
+        try {
+            raw = await request.clone().text();
+        }
+        catch {
+            return refuse('request body unreadable', a.agent);
+        }
+        if (requestBodyHash(raw).toLowerCase() !== a.bodyHash.toLowerCase())
+            return refuse('assertion does not bind this body', a.agent);
+        let method;
+        try {
+            method = JSON.parse(raw).method;
+        }
+        catch {
+            return refuse('body is not JSON', a.agent);
+        }
+        if (method !== a.method)
+            return refuse(`assertion is for ${a.method}, body calls ${String(method)}`, a.agent);
+        const digest = callerAssertionDigest(a);
+        // A cheap local reject first, so a replay landing on the isolate that served the original costs no
+        // chain read; the authoritative claim is below, after the signature verifies.
+        for (const [k, at] of seen)
+            if (at < nowSec - maxAgeSec - skewSec)
+                seen.delete(k);
+        if (seen.has(digest))
+            return refuse('assertion already used', a.agent);
+        const wrapped = parseSessionWrappedSignature(a.signature) !== null;
+        const ok = wrapped
+            ? await verifySessionWrappedSignature({
+                signer: a.agent.toLowerCase(),
+                digest,
+                signature: a.signature,
+                enforcers: deps.enforcers,
+                verifyDelegationSig: deps.verifyDelegationSig,
+                isRevoked: deps.isRevoked,
+                skill: STANDARD_SURFACE_SKILL,
+                now: now(),
+            }).catch(() => false)
+            : deps.verifyAgentSignature
+                ? await deps.verifyAgentSignature(a.agent.toLowerCase(), digest, a.signature).catch(() => false)
+                : false;
+        if (!ok) {
+            return refuse(wrapped
+                ? 'session wire did not verify (shape, signature, delegator or revocation)'
+                : deps.verifyAgentSignature ? 'the agent\'s own signature did not verify' : 'a direct agent signature is not admitted here', a.agent);
+        }
+        // SPENT, now that it is known to be genuine: the single writer decides who was first. A ledger that
+        // cannot be reached refuses the call — a replay window is not something to fail open into (ADR-0013).
+        if (deps.claim) {
+            const claimed = await deps.claim(digest, (a.issuedAt + maxAgeSec + skewSec) * 1000).catch(() => false);
+            if (!claimed)
+                return refuse('assertion already used', a.agent);
+        }
+        seen.set(digest, nowSec);
+        return { agent: a.agent.toLowerCase(), kind: 'agent' };
+    };
+}
+//# sourceMappingURL=caller.js.map

package/dist/standard/caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../src/standard/caller.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,6GAA6G;AAC7G,8GAA8G;AAC9G,8GAA8G;AAC9G,4GAA4G;AAC5G,+GAA+G;AAC/G,0DAA0D;AAC1D,EAAE;AACF,4GAA4G;AAC5G,0GAA0G;AAC1G,4GAA4G;AAC5G,4GAA4G;AAC5G,2DAA2D;AAC3D,EAAE;AACF,2GAA2G;AAC3G,6GAA6G;AAC7G,4GAA4G;AAC5G,OAAO,EAAE,SAAS,EAAE,OAAO,EAA0B,MAAM,MAAM,CAAC;AAElE,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAyB,MAAM,oBAAoB,CAAC;AAGxH,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD;4FAC4F;AAC5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAsBpD,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CAAC,CAAuC;IAC3E,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QACtC,CAAC,EAAE,4BAA4B;QAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;QAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;KACtD,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAO,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAE7E,MAAM,YAAY,GAAG,CAAC,CAAS,EAAU,EAAE;IACzC,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAE/G,8DAA8D;AAC9D,MAAM,UAAU,0BAA0B,CAAC,CAAoB;IAC7D,OAAO,GAAG,mBAAmB,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;0DAC0D;AAC1D,MAAM,UAAU,yBAAyB,CAAC,MAAiC;IACzE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,mBAAmB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAA+B,CAAC;QAC/E,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3F,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClF,OAAO,CAAsB,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAmCD;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA8B;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAc,EAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3G,OAAO,KAAK,EAAE,OAAgB,EAA6B,EAAE;QAC3D,MAAM,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,6DAA6D;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO;YAAE,OAAO,MAAM,CAAC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,QAAQ,GAAG,MAAM,GAAG,SAAS;YAAE,OAAO,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAElF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC,QAAQ,SAAS,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAEtJ,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACxG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,CAAC,mCAAmC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACjI,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YAAC,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC,MAAM,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACxH,IAAI,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,gBAAgB,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAE9G,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACxC,mGAAmG;QACnG,8EAA8E;QAC9E,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI;YAAE,IAAI,EAAE,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAEvE,MAAM,OAAO,GAAG,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;QACnE,MAAM,EAAE,GAAG,OAAO;YAChB,CAAC,CAAC,MAAM,6BAA6B,CAAC;gBAClC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAa;gBACxC,MAAM;gBACN,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,sBAAsB;gBAC7B,GAAG,EAAE,GAAG,EAAE;aACX,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACvB,CAAC,CAAC,IAAI,CAAC,oBAAoB;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAa,EAAE,MAAM,EAAE,CAAC,CAAC,SAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;gBAClH,CAAC,CAAC,KAAK,CAAC;QACZ,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,MAAM,CAAC,OAAO;gBACnB,CAAC,CAAC,yEAAyE;gBAC3E,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,+CAA+C,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1I,CAAC;QAED,oGAAoG;QACpG,sGAAsG;QACtG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACvG,IAAI,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC"}

package/dist/standard/client.d.ts

@@ -0,0 +1,50 @@
+import type { AgentCardV1, MessageV1, PartV1, TaskV1 } from './types.js';
+export interface ResolvedAgentCard {
+    card: AgentCardV1;
+    /** SHA-256 over the card's bytes as served, hex — what a record pins and a later fetch is compared to. */
+    cardDigest: string;
+    /** The JSON-RPC 1.x interface the card publishes. */
+    endpoint: string;
+    cardUrl: string;
+}
+/** The A2A 1.0 JSON-RPC endpoint a card publishes (top-level `protocolVersion` covers a released card's interfaces). */
+export declare function jsonRpcEndpointOf(card: AgentCardV1 & {
+    protocolVersion?: string;
+}): string | null;
+/** Fetch a card, digest its bytes, read its endpoint. A card without a 1.x JSON-RPC interface is refused. */
+export declare function resolveAgentCard(cardUrl: string, fetchImpl?: typeof fetch, expectDigest?: string): Promise<ResolvedAgentCard>;
+export interface StandardA2aClientOptions {
+    endpoint: string;
+    fetch?: typeof fetch;
+    /** Extra headers on every call — a bearer, a session wire. Never a mandate. */
+    headers?: Record<string, string>;
+}
+export interface SendResult {
+    task?: TaskV1;
+    message?: MessageV1;
+}
+export interface StandardA2aClient {
+    sendMessage(parts: PartV1[], opts?: {
+        metadata?: Record<string, unknown>;
+        extensions?: string[];
+        contextId?: string;
+        taskId?: string;
+    }): Promise<SendResult>;
+    getTask(id: string): Promise<TaskV1>;
+    /** Poll until the task is terminal or the deadline passes; the last task seen is returned either way. */
+    awaitTask(id: string, opts?: {
+        timeoutMs?: number;
+        everyMs?: number;
+    }): Promise<TaskV1>;
+    /** Send one text message and wait: the reply's text (status message + text artifacts) and the task. */
+    ask(text: string, opts?: {
+        metadata?: Record<string, unknown>;
+        timeoutMs?: number;
+    }): Promise<{
+        text: string;
+        task?: TaskV1;
+        message?: MessageV1;
+    }>;
+}
+export declare function createStandardA2aClient(o: StandardA2aClientOptions): StandardA2aClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/standard/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/standard/client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAmB,MAAM,YAAY,CAAC;AAG1F,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,WAAW,CAAC;IAClB,0GAA0G;IAC1G,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,wHAAwH;AACxH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAIjG;AAED,6GAA6G;AAC7G,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY1I;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE;AAIlE,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7J,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,yGAAyG;IACzG,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxF,uGAAuG;IACvG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;CACrJ;AAED,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,wBAAwB,GAAG,iBAAiB,CA0CtF"}