@agenticprimitives/a2a 0.0.0-alpha.19 → 0.0.0-alpha.20

package/dist/task-store.d.ts

@@ -8,6 +8,10 @@ export interface TaskStore extends MessageIdReserver {
     get(taskId: Hex): Promise<TaskRecord | null>;
     /** Task ids in a non-terminal state that are due for processing (drives the alarm loop). */
     listDue(now: number): Promise<Hex[]>;
+    /** Every record this store holds, newest first, for enumerating tasks (spec 372 S4 — A2A 1.0's
+     *  `ListTasks`). Optional: a store that cannot enumerate says so by omitting it, and a caller that
+     *  needs a list must not pretend an empty one is an answer. */
+    list?(limit?: number): Promise<TaskRecord[]>;
     /** Single-use message-id reservation (FR-4.3 inbound replay guard); two-phase per spec 290 §3.
      *  Returns `null` if already in-flight/consumed, else a reservation to commit (durable) / release. */
     reserveMessageId(messageId: Hex, ttlSec: number): Promise<MessageIdReservation | null>;

package/dist/task-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-store.d.ts","sourceRoot":"","sources":["../src/task-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEzE,MAAM,WAAW,SAAU,SAAQ,iBAAiB;IAClD,iDAAiD;IACjD,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,8CAA8C;IAC9C,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC7C,4FAA4F;IAC5F,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC;0GACsG;IACtG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACxF;AAED;8FAC8F;AAC9F,wBAAgB,uBAAuB,IAAI,SAAS,CA6BnD"}
+{"version":3,"file":"task-store.d.ts","sourceRoot":"","sources":["../src/task-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEzE,MAAM,WAAW,SAAU,SAAQ,iBAAiB;IAClD,iDAAiD;IACjD,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,8CAA8C;IAC9C,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC7C,4FAA4F;IAC5F,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC;;mEAE+D;IAC/D,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7C;0GACsG;IACtG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACxF;AAED;8FAC8F;AAC9F,wBAAgB,uBAAuB,IAAI,SAAS,CAiCnD"}

package/dist/task-store.js

@@ -19,6 +19,10 @@ export function createInMemoryTaskStore() {
         async listDue() {
             return [...due];
         },
+        async list(limit) {
+            const all = [...tasks.values()].sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0));
+            return limit ? all.slice(0, limit) : all;
+        },
         async reserveMessageId(messageId, ttlSec) {
             const key = messageId.toLowerCase();
             // A present entry means in-flight OR consumed — either way a replay (deny). Otherwise mark in-flight.

package/dist/task-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"task-store.js","sourceRoot":"","sources":["../src/task-store.ts"],"names":[],"mappings":"AAmBA;8FAC8F;AAC9F,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,4BAA4B;IACpE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;gBAClF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,OAAO;YACX,OAAO,CAAC,GAAG,GAAG,CAAU,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM;YACtC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACpC,sGAAsG;YACtG,qGAAqG;YACrG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtB,OAAO;gBACL,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,uCAAuC;gBAClF,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAM,0DAA0D;aACtG,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"task-store.js","sourceRoot":"","sources":["../src/task-store.ts"],"names":[],"mappings":"AAuBA;8FAC8F;AAC9F,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,4BAA4B;IACpE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;gBAClF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,OAAO;YACX,OAAO,CAAC,GAAG,GAAG,CAAU,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM;YACtC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACpC,sGAAsG;YACtG,qGAAqG;YACrG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtB,OAAO;gBACL,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,uCAAuC;gBAClF,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAM,0DAA0D;aACtG,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/wire-verify.d.ts

@@ -0,0 +1,35 @@
+import { type Delegation, type EnforcerAddressMap } from '@agenticprimitives/delegation';
+import type { Address, Hex } from '@agenticprimitives/types';
+/** A delegation as it arrives over JSON: addresses as strings, the bigint salt as a decimal string. The
+ *  typed `DelegationWireV1` is assignable to it; an untrusted body is checked here before it becomes one. */
+export interface DelegationWireLike {
+    delegator: string;
+    delegate: string;
+    authority: Hex;
+    caveats: {
+        enforcer: string;
+        terms: Hex;
+        args?: Hex;
+    }[];
+    salt: string;
+    signature: Hex;
+}
+export interface WireChecks {
+    /** EIP-712 delegation digest. */
+    digest: (d: Delegation) => Hex;
+    /** ERC-1271 / 6492 / ECDSA against the delegator. */
+    erc1271: (signer: Address, digest: Hex, sig: Hex) => Promise<boolean>;
+    /** `DelegationManager.isRevoked`. */
+    isRevoked: (digest: Hex) => Promise<boolean>;
+}
+/** Wire → `Delegation`. Throws on a salt that is not a number; callers that must not throw catch it. */
+export declare function delegationOfWire(wire: DelegationWireLike): Delegation;
+export declare function verifyDelegationWire(input: {
+    wire: DelegationWireLike | undefined;
+    expectedDelegator: string;
+    expectedDelegate: Address;
+    enforcers: EnforcerAddressMap;
+    checks: WireChecks;
+    now?: number;
+}): Promise<boolean>;
+//# sourceMappingURL=wire-verify.d.ts.map

package/dist/wire-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-verify.d.ts","sourceRoot":"","sources":["../src/wire-verify.ts"],"names":[],"mappings":"AAaA,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAC/G,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D;6GAC6G;AAC7G,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,GAAG,CAAC;IACf,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,GAAG,CAAC;QAAC,IAAI,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,GAAG,CAAC;IAC/B,qDAAqD;IACrD,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,qCAAqC;IACrC,SAAS,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9C;AAED,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,UAAU,CASrE;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,IAAI,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBnB"}

package/dist/wire-verify.js

@@ -0,0 +1,51 @@
+// A DELEGATION WIRE, VERIFIED LIVE — the tail every A2A service repeats when a grant arrives over the wire
+// (spec 350 §8; the `service-agent-signing` rule). Promoted from the runtime app in spec 399 W0 (§4), where
+// four call sites had each written it: delegator/delegate identity, caveat evaluation, revocation, signature.
+//
+// WHAT THIS DECIDES AND WHAT IT DOES NOT. `delegation.verifyLiveDelegation` decides all of it — this is the
+// wire-shaped door to that one decision. It says the wire is live and authentic FROM `expectedDelegator` TO
+// `expectedDelegate`; it says nothing about whether the caveat SHAPE is the one the caller's policy wants
+// (member access vs stewardship, which contracts a wire must pin). That is the product's authorization
+// policy — a positive identity test no generic "required enforcers" list can express. Call this AFTER the
+// shape test, never instead of it.
+//
+// Returns false on every failure path — the callers are boolean gates and must not learn why (the reason
+// would tell a prober which of several wires it is missing).
+import { verifyLiveDelegation } from '@agenticprimitives/delegation';
+/** Wire → `Delegation`. Throws on a salt that is not a number; callers that must not throw catch it. */
+export function delegationOfWire(wire) {
+    return {
+        delegator: wire.delegator,
+        delegate: wire.delegate,
+        authority: wire.authority,
+        caveats: wire.caveats.map((c) => ({ enforcer: c.enforcer, terms: c.terms, args: (c.args ?? '0x') })),
+        salt: BigInt(wire.salt),
+        signature: wire.signature,
+    };
+}
+export async function verifyDelegationWire(input) {
+    const w = input.wire;
+    if (!w?.signature || !w.delegator || !w.delegate)
+        return false;
+    let delegation;
+    try {
+        delegation = delegationOfWire(w);
+    }
+    catch {
+        return false; // BigInt(salt) on garbage
+    }
+    const r = await verifyLiveDelegation({
+        delegation,
+        expectedDelegator: input.expectedDelegator,
+        expectedDelegate: input.expectedDelegate,
+        enforcers: input.enforcers,
+        now: input.now ?? Math.floor(Date.now() / 1000),
+        checks: {
+            delegationDigest: input.checks.digest,
+            isRevoked: async (d) => input.checks.isRevoked(input.checks.digest(d)),
+            verifySignature: async ({ signer, digest, signature }) => input.checks.erc1271(signer, digest, signature),
+        },
+    });
+    return r.ok;
+}
+//# sourceMappingURL=wire-verify.js.map

package/dist/wire-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-verify.js","sourceRoot":"","sources":["../src/wire-verify.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,4GAA4G;AAC5G,8GAA8G;AAC9G,EAAE;AACF,4GAA4G;AAC5G,4GAA4G;AAC5G,0GAA0G;AAC1G,uGAAuG;AACvG,0GAA0G;AAC1G,mCAAmC;AACnC,EAAE;AACF,yGAAyG;AACzG,6DAA6D;AAC7D,OAAO,EAAE,oBAAoB,EAA4C,MAAM,+BAA+B,CAAC;AAuB/G,wGAAwG;AACxG,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAoB;QACpC,QAAQ,EAAE,IAAI,CAAC,QAAmB;QAClC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAmB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAQ,EAAE,CAAC,CAAC;QACtH,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAO1C;IACC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;IACrB,IAAI,CAAC,CAAC,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE/D,IAAI,UAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,0BAA0B;IAC1C,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,oBAAoB,CAAC;QACnC,UAAU;QACV,iBAAiB,EAAE,KAAK,CAAC,iBAA4B;QACrD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC/C,MAAM,EAAE;YACN,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;YACrC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACtE,eAAe,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;SAC1G;KACF,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/a2a",
-  "version": "0.0.0-alpha.19",
+  "version": "0.0.0-alpha.20",
   "description": "Async, delegation-authorized Agent-to-Agent (A2A) task transport: Task/Message/Artifact runtime over a TaskStore port, JSON-RPC method handlers, SkillHandler dispatch, the A2aWireAdapter client, and scoped-grant caveat builders. Transport-agnostic core (spec 269 / ADR-0034); the Cloudflare TaskStoreDO ships as the ./cloudflare adapter subpath.",
   "license": "MIT",
   "repository": {
@@ -23,6 +23,14 @@
     "./cloudflare": {
       "types": "./dist/cloudflare/index.d.ts",
       "import": "./dist/cloudflare/index.js"
+    },
+    "./standard": {
+      "types": "./dist/standard/index.d.ts",
+      "import": "./dist/standard/index.js"
+    },
+    "./conform": {
+      "types": "./dist/conform/index.d.ts",
+      "import": "./dist/conform/index.js"
     }
   },
   "files": [
@@ -30,7 +38,8 @@
     "dist",
     "spec.md",
     "README.md",
-    "CLAUDE.md"
+    "CLAUDE.md",
+    "bin"
   ],
   "publishConfig": {
     "access": "public"
@@ -52,10 +61,13 @@
     "agentic"
   ],
   "dependencies": {
-    "@agenticprimitives/delegation": "1.0.0-alpha.22",
-    "@agenticprimitives/fulfillment": "0.0.0-alpha.19",
-    "@agenticprimitives/types": "1.0.0-alpha.22",
-    "@agenticprimitives/verification-receipts": "0.0.0-alpha.3"
+    "@agenticprimitives/delegation": "1.0.0-alpha.23",
+    "@agenticprimitives/fulfillment": "0.0.0-alpha.20",
+    "@agenticprimitives/types": "1.0.0-alpha.23",
+    "@agenticprimitives/verification-receipts": "0.0.0-alpha.4"
+  },
+  "bin": {
+    "a2a-conform": "./bin/a2a-conform.mjs"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
@@ -63,6 +75,7 @@
     "test": "vitest run",
     "test:unit": "vitest run --passWithNoTests",
     "test:watch": "vitest",
-    "clean": "rm -rf dist"
+    "clean": "rm -rf dist",
+    "tck:sut": "tsx tck/sut.mts"
   }
 }

package/dist/jsonrpc.d.ts

@@ -1,27 +0,0 @@
-import type { A2aAgent } from './agent.js';
-export interface JsonRpcRequest {
-    jsonrpc?: string;
-    id?: string | number | null;
-    method?: string;
-    params?: unknown;
-}
-export type JsonRpcResponse = {
-    jsonrpc: '2.0';
-    id: string | number | null;
-    result: unknown;
-} | {
-    jsonrpc: '2.0';
-    id: string | number | null;
-    error: {
-        code: number;
-        message: string;
-    };
-};
-/** Dispatch a single JSON-RPC request to the agent. `message/stream` is rejected here (handled by the
- *  SSE transport). AUDIT NEW-A2A-2: tasks/get|cancel|pushNotificationConfig/set carry `caller` + `signature`;
- *  the agent verifies the signature (ERC-1271) against the request digest, so `caller` can't be spoofed —
- *  an attacker passing a victim's address but no/own signature is rejected. */
-export declare function dispatchA2aRpc(agent: A2aAgent, req: JsonRpcRequest): Promise<JsonRpcResponse>;
-/** Parse a raw JSON body + dispatch. Used by the HTTP/Cloudflare transport. */
-export declare function handleA2aRpcBody(agent: A2aAgent, rawBody: string): Promise<JsonRpcResponse>;
-//# sourceMappingURL=jsonrpc.d.ts.map

package/dist/jsonrpc.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jsonrpc.d.ts","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAqC,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AACD,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAU7F;;;+EAG+E;AAC/E,wBAAsB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAgBnG;AA6CD,+EAA+E;AAC/E,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAIjG"}

package/dist/jsonrpc.js

@@ -1,81 +0,0 @@
-const PARSE_ERROR = -32700;
-const INVALID_REQUEST = -32600;
-const METHOD_NOT_FOUND = -32601;
-const INTERNAL_ERROR = -32603;
-const err = (id, code, message) => ({ jsonrpc: '2.0', id, error: { code, message } });
-const ok = (id, result) => ({ jsonrpc: '2.0', id, result });
-/** Dispatch a single JSON-RPC request to the agent. `message/stream` is rejected here (handled by the
- *  SSE transport). AUDIT NEW-A2A-2: tasks/get|cancel|pushNotificationConfig/set carry `caller` + `signature`;
- *  the agent verifies the signature (ERC-1271) against the request digest, so `caller` can't be spoofed —
- *  an attacker passing a victim's address but no/own signature is rejected. */
-export async function dispatchA2aRpc(agent, req) {
-    const id = req.id ?? null;
-    try {
-        return await dispatch(agent, req, id);
-    }
-    catch {
-        // A THROW IS NOT A PROTOCOL RESPONSE. Handlers read `params` positionally off untrusted JSON, so a
-        // caller omitting a field reaches `undefined.toLowerCase()` and the exception escapes the wire
-        // entry — surfacing as a 500 with a stack rather than a JSON-RPC error. That is the same class of
-        // bug `demo-a2a`'s `validate.ts` exists to prevent, on a PUBLIC surface (`message/send` takes
-        // caller-supplied params), and it was reachable until spec 340's task-DO coverage hit it.
-        //
-        // The message is deliberately generic: the caller learns the request failed, never why internally.
-        // A rejected-but-valid request still gets its own typed code from the handler below; this only
-        // catches what nothing else answered.
-        return err(id, INTERNAL_ERROR, 'internal error');
-    }
-}
-async function dispatch(agent, req, id) {
-    if (req.jsonrpc !== '2.0' || typeof req.method !== 'string') {
-        return err(id, INVALID_REQUEST, 'not a JSON-RPC 2.0 request');
-    }
-    const p = (req.params ?? {});
-    switch (req.method) {
-        case 'message/send': {
-            const r = await agent.messageSend(p);
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        case 'tasks/resubmit': {
-            const r = await agent.resubmit(p);
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        // a2a-issuedat-dropped-in-dispatch (2026-07-04 self-audit): the caller-signature FRESHNESS field
-        // (N-2 issuedAt) MUST be forwarded here — this dispatcher is the only wire entry, so dropping it left the
-        // digest computed with issuedAt=0 (a signed tasks/get replays for the task's life) AND made
-        // callerSigMaxAgeSec unusable (verifyCaller rejects every wire call with "issuedAt required"). The client
-        // mints it into the signed digest; thread it through unchanged.
-        case 'tasks/get': {
-            const r = await agent.tasksGet({ taskId: p.taskId, caller: p.caller, signature: (p.signature ?? '0x'), issuedAt: p.issuedAt });
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        case 'tasks/artifact': {
-            const r = await agent.tasksArtifact({ taskId: p.taskId, artifactId: p.artifactId, caller: p.caller, signature: (p.signature ?? '0x'), issuedAt: p.issuedAt });
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        case 'tasks/cancel': {
-            const r = await agent.tasksCancel({ taskId: p.taskId, caller: p.caller, signature: (p.signature ?? '0x'), issuedAt: p.issuedAt });
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        case 'tasks/pushNotificationConfig/set': {
-            const r = await agent.pushConfigSet({ taskId: p.taskId, caller: p.caller, signature: (p.signature ?? '0x'), url: p.url, token: p.token, issuedAt: p.issuedAt });
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        case 'message/stream':
-            return err(id, INVALID_REQUEST, 'message/stream must use the SSE transport, not the JSON-RPC body');
-        default:
-            return err(id, METHOD_NOT_FOUND, `unknown method: ${req.method}`);
-    }
-}
-/** Parse a raw JSON body + dispatch. Used by the HTTP/Cloudflare transport. */
-export async function handleA2aRpcBody(agent, rawBody) {
-    let req;
-    try {
-        req = JSON.parse(rawBody);
-    }
-    catch {
-        return err(null, PARSE_ERROR, 'invalid JSON');
-    }
-    return dispatchA2aRpc(agent, req);
-}
-//# sourceMappingURL=jsonrpc.js.map

package/dist/jsonrpc.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jsonrpc.js","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC;AAC3B,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC;AAC/B,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAChC,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC;AAE9B,MAAM,GAAG,GAAG,CAAC,EAA0B,EAAE,IAAY,EAAE,OAAe,EAAmB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC/I,MAAM,EAAE,GAAG,CAAC,EAA0B,EAAE,MAAe,EAAmB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9G;;;+EAG+E;AAC/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAe,EAAE,GAAmB;IACvE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,mGAAmG;QACnG,+FAA+F;QAC/F,kGAAkG;QAClG,8FAA8F;QAC9F,0FAA0F;QAC1F,EAAE;QACF,mGAAmG;QACnG,+FAA+F;QAC/F,sCAAsC;QACtC,OAAO,GAAG,CAAC,EAAE,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAe,EAAE,GAAmB,EAAE,EAA0B;IACtF,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,GAAG,CAAC,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAExD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAiC,CAAC,CAAC;YACrE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAA8B,CAAC,CAAC;YAC/D,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,iGAAiG;QACjG,0GAA0G;QAC1G,4FAA4F;QAC5F,0GAA0G;QAC1G,gEAAgE;QAChE,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAA8B,EAAE,CAAC,CAAC;YAC9K,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,UAAU,EAAE,CAAC,CAAC,UAAiB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAA8B,EAAE,CAAC,CAAC;YACpN,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAA8B,EAAE,CAAC,CAAC;YACjL,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,kCAAkC,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAa,EAAE,KAAK,EAAE,CAAC,CAAC,KAA2B,EAAE,QAAQ,EAAE,CAAC,CAAC,QAA8B,EAAE,CAAC,CAAC;YAC/O,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,GAAG,CAAC,EAAE,EAAE,eAAe,EAAE,kEAAkE,CAAC,CAAC;QACtG;YACE,OAAO,GAAG,CAAC,EAAE,EAAE,gBAAgB,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAe,EAAE,OAAe;IACrE,IAAI,GAAmB,CAAC;IACxB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IAAC,CAAC;IAC3F,OAAO,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC"}