@agenticprimitives/a2a 0.0.0-alpha.2 → 0.0.0-alpha.20

package/dist/session-wire.js

@@ -0,0 +1,170 @@
+// SESSION WIRES — how an agent signs as an identity whose key it does not hold. Spec 350 §8 / spec 326.
+//
+// THE CALLER-SIGNATURE GAP, RESOLVED (spec 329 §3.1, generalized). A runtime holds no key for the identity
+// it acts as — an org's DO holds no org key, a relying service must never custody the service agent it
+// acts as (ADR-0019: a relying key is always a DELEGATE, never a custodian), a skills worker signs as
+// `skills-agent` without holding it. Yet A2A needs per-message sender signatures and per-poll caller
+// signatures that verify against THAT identity. A ceremony therefore mints a NARROW delegation —
+// delegator = the identity, delegate = a KMS session key, allowedMethods = a pinned set of skill
+// selectors (never the any-skill sentinel), allowedTargets pinned, timestamp-bounded — signed by the
+// identity's own custody credential. The runtime stores the wire; NO raw key ever rests there; the KMS
+// key signs each digest on demand.
+//
+// ON THE WIRE such a signature is the SESSION-WRAPPED form: `0x51` (a type byte no on-chain validator
+// accepts — it fails closed anywhere but a gate that understands it) followed by hex(utf8(JSON({ wire,
+// sig }))). A gate verifies it fail-closed PER MESSAGE: delegator === the claimed signer; timestamp window
+// live; a pinned selector set that names the requested skill and never A2A_ANY_SKILL; the raw ECDSA sig
+// recovers to the wire's delegate; the wire's own signature ERC-1271-verifies against the delegator; AND
+// the wire is unrevoked on chain — so a custodian's revocation kills the authority at every gate, now.
+//
+// WHY THIS IS HERE. Four copies of this file existed across two repos (demo-a2a's session-wire.ts and
+// org-wire.ts, skills-a2a's service-wire.ts, and a sibling worker's). "Copy the wire implementation, do not
+// invent a third" was the instruction, and the count had already reached four. It is an A2A signature
+// format that consumes this package's own `skillSelector`; it belongs here, and the apps now consume it.
+// What STAYS in the apps is policy — which caveat SHAPE counts as stewardship vs member access, which
+// contracts a stewardship wire must pin. `org-wire.ts`'s `hasStewardshipShape` is a positive identity
+// test no generic layer can express, and it does not move.
+import { hashMessage, keccak256, recoverAddress, toBytes } from 'viem';
+import { decodeAllowedMethodsTerms, decodeTimestampTerms } from '@agenticprimitives/delegation';
+import { A2A_ANY_SKILL, skillSelector } from './grant.js';
+/** Signature type byte for the session-wrapped form. Unknown to AgentAccount `_validateSig` (fails closed
+ *  on chain) and to every other verifier — only a gate that calls `verifySessionWrappedSignature` accepts
+ *  it, and only after full verification. */
+export const SESSION_WRAPPED_SIG_TYPE = '0x51';
+const utf8ToHex = (s) => `0x${Array.from(new TextEncoder().encode(s), (b) => b.toString(16).padStart(2, '0')).join('')}`;
+const hexToUtf8 = (h) => {
+    const clean = h.startsWith('0x') ? h.slice(2) : h;
+    const bytes = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < bytes.length; i++)
+        bytes[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    return new TextDecoder().decode(bytes);
+};
+/** Wrap a raw session-key ECDSA signature with the wire that authorizes it. */
+export function wrapSessionSignature(wire, sig) {
+    return (SESSION_WRAPPED_SIG_TYPE + utf8ToHex(JSON.stringify({ wire, sig })).slice(2));
+}
+/** Parse the session-wrapped form; null for any other signature shape (callers then use the standard
+ *  ERC-1271 path — one detector, no ambiguity). */
+export function parseSessionWrappedSignature(signature) {
+    if (!signature?.startsWith(SESSION_WRAPPED_SIG_TYPE) || signature.length <= SESSION_WRAPPED_SIG_TYPE.length)
+        return null;
+    try {
+        const parsed = JSON.parse(hexToUtf8(`0x${signature.slice(SESSION_WRAPPED_SIG_TYPE.length)}`));
+        if (!parsed?.wire?.delegator || !parsed.wire.delegate || !parsed.wire.signature || !parsed.sig)
+            return null;
+        return { wire: parsed.wire, sig: parsed.sig };
+    }
+    catch {
+        return null;
+    }
+}
+export function wireToDelegation(w) {
+    return {
+        delegator: w.delegator,
+        delegate: w.delegate,
+        authority: w.authority,
+        caveats: w.caveats.map((c) => ({ enforcer: c.enforcer, terms: c.terms, args: (c.args ?? '0x') })),
+        salt: BigInt(w.salt),
+        signature: w.signature,
+    };
+}
+export function delegationToWire(d) {
+    return {
+        delegator: d.delegator, delegate: d.delegate, authority: d.authority,
+        caveats: d.caveats.map((c) => ({ enforcer: c.enforcer, terms: c.terms, ...(c.args && c.args !== '0x' ? { args: c.args } : {}) })),
+        salt: d.salt.toString(), signature: d.signature,
+    };
+}
+/**
+ * Shape check for a session wire (at ceremony store time AND at every gate hit): timestamp-bounded, a
+ * pinned allowedMethods set that never carries the any-skill sentinel and — when `skill` is given — names
+ * that skill's selector.
+ *
+ * `skill` should be passed wherever the request names one: a wire minted for one rail must not authorize
+ * another. It is omitted only on the read/control path (`tasks/get`, `tasks/cancel`,
+ * `pushNotificationConfig/set`), whose digest binds a method and a taskId, not a skill. That omission is
+ * narrow rather than lax — the wire must still be pinned, live, ERC-1271-valid and unrevoked, and the task
+ * runtime independently requires the caller to BE a party to the task.
+ */
+export function checkSessionWireShape(wire, enforcers, nowSec, opts) {
+    const byEnforcer = (addr) => (wire.caveats ?? []).find((c) => (c.enforcer ?? '').toLowerCase() === addr.toLowerCase());
+    const tsCav = byEnforcer(enforcers.timestamp);
+    if (!tsCav?.terms)
+        return 'session wire must be timestamp-bounded';
+    try {
+        const win = decodeTimestampTerms(tsCav.terms);
+        const now = BigInt(nowSec);
+        if (now < win.validAfter || now >= win.validUntil)
+            return 'session wire outside its timestamp window';
+    }
+    catch {
+        return 'session wire timestamp terms undecodable';
+    }
+    const amCav = byEnforcer(enforcers.allowedMethods);
+    if (!amCav?.terms)
+        return 'session wire must carry an allowedMethods caveat';
+    try {
+        const selectors = decodeAllowedMethodsTerms(amCav.terms).map((s) => s.toLowerCase());
+        // A PINNED SET, never the any-skill sentinel. A leaked delegate key can send only what the custodian
+        // enumerated; `A2A_ANY_SKILL` is the line between "these operations" and "anything this agent can do".
+        if (selectors.some((s) => s === A2A_ANY_SKILL.toLowerCase()))
+            return 'session wire must never carry the any-skill sentinel';
+        if (selectors.length === 0)
+            return 'session wire allowedMethods must name at least one selector';
+        if (opts?.skill) {
+            const want = skillSelector(opts.skill).toLowerCase();
+            if (!selectors.includes(want))
+                return `session wire allowedMethods does not name the ${opts.skill} selector`;
+        }
+    }
+    catch {
+        return 'session wire allowedMethods terms undecodable';
+    }
+    return null;
+}
+/**
+ * Verify a session-wrapped signature for `signer` over `digest`, fail-closed on every leg. The on-chain
+ * checks are the SAME injected ones the standard gate uses (`OnChainChecks`) — revocation is immediate.
+ * Pass `skill` whenever the request names one.
+ */
+export async function verifySessionWrappedSignature(args) {
+    const parsed = parseSessionWrappedSignature(args.signature);
+    if (!parsed)
+        return false;
+    const { wire, sig } = parsed;
+    if (wire.delegator.toLowerCase() !== args.signer.toLowerCase())
+        return false;
+    const shapeOpts = args.skill ? { skill: args.skill } : undefined;
+    if (checkSessionWireShape(wire, args.enforcers, Math.floor((args.now ?? Date.now()) / 1000), shapeOpts) !== null)
+        return false;
+    // The raw sig must recover to the wire's delegate (the KMS session key). Accept both raw-digest and
+    // eth-signed-message recovery, mirroring AgentAccount._verifyEcdsa.
+    const delegate = wire.delegate.toLowerCase();
+    let recovered = false;
+    try {
+        recovered = (await recoverAddress({ hash: args.digest, signature: sig })).toLowerCase() === delegate;
+    }
+    catch { /* try wrapped */ }
+    if (!recovered) {
+        try {
+            recovered = (await recoverAddress({ hash: hashMessage({ raw: toBytes(args.digest) }), signature: sig })).toLowerCase() === delegate;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (!recovered)
+        return false;
+    const d = wireToDelegation(wire);
+    try {
+        if (await args.isRevoked(d))
+            return false; // custodian revoke ⇒ immediate kill at every gate
+        return await args.verifyDelegationSig(d);
+    }
+    catch {
+        return false; // fail-closed on chain-read failure (ADR-0013)
+    }
+}
+/** keccak over stable-JSON — the a2a body-hash convention (equals the task runtime's `hashBody`). */
+export const sessionBodyHash = (data) => keccak256(toBytes(JSON.stringify(data ?? null)));
+//# sourceMappingURL=session-wire.js.map

package/dist/session-wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-wire.js","sourceRoot":"","sources":["../src/session-wire.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,EAAE;AACF,2GAA2G;AAC3G,uGAAuG;AACvG,sGAAsG;AACtG,qGAAqG;AACrG,iGAAiG;AACjG,iGAAiG;AACjG,qGAAqG;AACrG,uGAAuG;AACvG,mCAAmC;AACnC,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,2GAA2G;AAC3G,wGAAwG;AACxG,yGAAyG;AACzG,uGAAuG;AACvG,EAAE;AACF,sGAAsG;AACtG,4GAA4G;AAC5G,sGAAsG;AACtG,yGAAyG;AACzG,sGAAsG;AACtG,sGAAsG;AACtG,2DAA2D;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAA0B,MAAM,MAAM,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAmB,MAAM,+BAA+B,CAAC;AACjH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAY1D;;4CAE4C;AAC5C,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,MAAM,SAAS,GAAG,CAAC,CAAS,EAAO,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAS,CAAC;AAC7I,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9F,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,IAAsB,EAAE,GAAQ;IACnE,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAQ,CAAC;AAC/F,CAAC;AAED;mDACmD;AACnD,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,wBAAwB,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC,CAA2C,CAAC;QACxI,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAC5G,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAmB;IAClD,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAQ,EAAE,CAAC,CAAC;QACxG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAa;IAC5C,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;QACpE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAY,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/I,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAgB;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAsB,EACtB,SAAwD,EACxD,MAAc,EACd,IAAyB;IAEzB,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/H,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,KAAK;QAAE,OAAO,wCAAwC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO,2CAA2C,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,EAAE,KAAK;QAAE,OAAO,kDAAkD,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACrF,qGAAqG;QACrG,uGAAuG;QACvG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,sDAAsD,CAAC;QAC5H,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,6DAA6D,CAAC;QACjG,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACrD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,iDAAiD,IAAI,CAAC,KAAK,WAAW,CAAC;QAC/G,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,+CAA+C,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAWnD;IACC,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC7B,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,IAAI,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,SAAS,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/H,oGAAoG;IACpG,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QAAC,SAAS,GAAG,CAAC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACzI,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,SAAS,GAAG,CAAC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACtK,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,kDAAkD;QAC7F,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,+CAA+C;IAC/D,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAa,EAAO,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC"}

package/dist/skill-handler.d.ts

@@ -1,6 +1,7 @@
 import type { Address, Hex } from '@agenticprimitives/types';
 import type { Delegation } from '@agenticprimitives/delegation';
 import type { VaultRef } from './types.js';
+import type { SkillPayment } from './payment-gate.js';
 /** Minimal vault seam — the consumer wires demo-mcp vault read/write over a delegation. FR-3.4: a handler
  *  delivers a result into ANOTHER principal's vault by passing a `delegation` THAT principal granted
  *  (delegator == the record owner); the consumer routes it through `callMcpToolViaDelegation` so demo-mcp
@@ -16,11 +17,16 @@ export interface VaultClient {
         delegation?: Delegation;
     }): Promise<VaultRef>;
 }
-/** Minimal MCP seam — call a tool via the delegation token (reuses the a2a→mcp leg, W4). */
+/** Minimal MCP seam — call a tool via the delegation token (reuses the a2a→mcp leg, W4). Symmetric with
+ *  `VaultClient`: pass the task's `delegation` (the grant THAT principal signed) so the composed MCP call
+ *  rides the on-chain authority (ADR-0041); the consumer routes it through `callMcpToolViaDelegation`. Omit
+ *  `delegation` only for an agent-self call that needs no principal grant. This is the port the Ring-0
+ *  orchestration loop's `ToolInvoker` wraps (ADR-0044). */
 export interface McpClient {
     callTool(args: {
         tool: string;
         toolArgs?: Record<string, unknown>;
+        delegation?: Delegation;
     }): Promise<unknown>;
 }
 /** Thrown by `requestAuth` to suspend a task pending a fresh/again-scoped delegation (FR-3.5). The
@@ -67,6 +73,8 @@ export interface SkillContext {
         bodyContentType?: string;
         disclosurePolicy?: string;
         caseId?: Hex;
+        /** URI-keyed A2A extension metadata to record on the artifact (e.g. skill-provenance). */
+        metadata?: Record<string, unknown>;
     }): Promise<Hex>;
     /** Suspend pending a fresh grant — throws `AuthRequired`. */
     requestAuth(reason: string): never;
@@ -79,8 +87,25 @@ export interface SkillResult {
     artifactIds?: Hex[];
     error?: string;
 }
+/**
+ * Who may SEE a skill on an agent card (spec 338 §8, ADR-0056 §6). Mirrors `surface-catalog`'s
+ * `SurfaceExposure` structurally — not imported, so `a2a` stays dependency-light.
+ *
+ * Absent ⇒ `public`, preserving pre-spec-338 behaviour. Visibility is NOT authorization: a skill
+ * hidden from a card is still gated by delegation + policy if someone guesses its name, and a skill
+ * shown on a card grants nothing.
+ */
+export type SkillExposure = 'public' | 'authenticated' | 'private' | 'service-only';
 export interface SkillHandler {
     skill: string;
+    /** Card visibility. Omit ⇒ `public`. See `SkillExposure`. */
+    exposure?: SkillExposure;
+    /** For `exposure: 'private'` — canonical ids permitted to see it. Empty/absent ⇒ nobody. */
+    audience?: readonly string[];
+    /** PAY-A2A-1 — optional price. A priced skill is gated by the injected `PaymentGate` BEFORE `handle`
+     *  runs; an unpaid request parks `input-required` with `x402.payment.*` metadata (the handler is never
+     *  reached). Free skills omit this. */
+    payment?: SkillPayment;
     handle(ctx: SkillContext): Promise<SkillResult>;
 }
 /** Index handlers by skill name; reject duplicate registrations. */

package/dist/skill-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-handler.d.ts","sourceRoot":"","sources":["../src/skill-handler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;2GAG2G;AAC3G,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChH;AAED,4FAA4F;AAC5F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxF;AAED;yEACyE;AACzE,qBAAa,YAAa,SAAQ,KAAK;aACT,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAI/C;AAED;4EAC4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;mFAEmF;AACnF,qBAAa,gBAAiB,SAAQ,KAAK;aACb,OAAO,EAAE,cAAc;gBAAvB,OAAO,EAAE,cAAc;CAIpD;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,GAAG,CAAC;IACZ,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,qDAAqD;IACrD,MAAM,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,KAAK,EAAE,OAAO,CAAC;IACf,oCAAoC;IACpC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;IACf;6GACyG;IACzG,YAAY,CAAC,CAAC,EAAE;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,OAAO,CAAC;QACd,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,MAAM,CAAC,EAAE,GAAG,CAAC;KACd,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,6DAA6D;IAC7D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC;6EACyE;IACzE,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,KAAK,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,gBAAgB,CAAC;IACjD,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjD;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAOtF"}
+{"version":3,"file":"skill-handler.d.ts","sourceRoot":"","sources":["../src/skill-handler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;2GAG2G;AAC3G,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChH;AAED;;;;2DAI2D;AAC3D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjH;AAED;yEACyE;AACzE,qBAAa,YAAa,SAAQ,KAAK;aACT,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAI/C;AAED;4EAC4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;mFAEmF;AACnF,qBAAa,gBAAiB,SAAQ,KAAK;aACb,OAAO,EAAE,cAAc;gBAAvB,OAAO,EAAE,cAAc;CAIpD;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,GAAG,CAAC;IACZ,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,qDAAqD;IACrD,MAAM,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,KAAK,EAAE,OAAO,CAAC;IACf,oCAAoC;IACpC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;IACf;6GACyG;IACzG,YAAY,CAAC,CAAC,EAAE;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,OAAO,CAAC;QACd,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,MAAM,CAAC,EAAE,GAAG,CAAC;QACb,0FAA0F;QAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,6DAA6D;IAC7D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IACnC;6EACyE;IACzE,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,KAAK,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,gBAAgB,CAAC;IACjD,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,eAAe,GAAG,SAAS,GAAG,cAAc,CAAC;AAEpF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;2CAEuC;IACvC,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjD;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAOtF"}

package/dist/skill-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-handler.js","sourceRoot":"","sources":["../src/skill-handler.ts"],"names":[],"mappings":"AAsBA;yEACyE;AACzE,MAAM,OAAO,YAAa,SAAQ,KAAK;IACT;IAA5B,YAA4B,UAAkB;QAC5C,KAAK,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;QADZ,eAAU,GAAV,UAAU,CAAQ;QAE5C,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAcD;;mFAEmF;AACnF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACb;IAA5B,YAA4B,OAAuB;QACjD,KAAK,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QADpB,YAAO,GAAP,OAAO,CAAgB;QAEjD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAyCD,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,QAAwB;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"skill-handler.js","sourceRoot":"","sources":["../src/skill-handler.ts"],"names":[],"mappings":"AA2BA;yEACyE;AACzE,MAAM,OAAO,YAAa,SAAQ,KAAK;IACT;IAA5B,YAA4B,UAAkB;QAC5C,KAAK,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;QADZ,eAAU,GAAV,UAAU,CAAQ;QAE5C,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAcD;;mFAEmF;AACnF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACb;IAA5B,YAA4B,OAAuB;QACjD,KAAK,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QADpB,YAAO,GAAP,OAAO,CAAgB;QAEjD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AA6DD,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,QAAwB;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/standard/caller.d.ts

@@ -0,0 +1,86 @@
+import { type Address, type Hex } from 'viem';
+import type { Delegation } from '@agenticprimitives/delegation';
+import { type DelegationWireV1 } from '../session-wire.js';
+import type { Principal } from './server.js';
+/** The Authorization scheme an agent presents its session wire under. */
+export declare const SESSION_AUTH_SCHEME = "A2A-Session";
+/** The skill a session wire must pin to reach the standard surface: asking this agent, and nothing else.
+ *  A wire that names other selectors and not this one is refused — pinning is the point. */
+export declare const STANDARD_SURFACE_SKILL = "harness.ask";
+/** What a caller signs. Every field is bound: a captured assertion cannot be replayed onto another method,
+ *  another body, another host, or a later moment. `issuedAt` is IN the digest and checked (stale / ahead refused,
+ *  the digest claimed once) — the wire path's freshness field that the deleted JSON-RPC dispatcher once dropped
+ *  (audit a2a-issuedat-dropped-in-dispatch; the folded wire of spec 372 S4 is where the check lives now). */
+export interface CallerAssertionV1 {
+    /** The Smart Agent the caller acts AS — must equal the wire's delegator. */
+    agent: string;
+    /** The A2A method this assertion is for. */
+    method: string;
+    /** keccak256 over the raw JSON-RPC request body. */
+    bodyHash: Hex;
+    /** Seconds since the epoch. */
+    issuedAt: number;
+    /** The origin the request is addressed to (`https://host`), so an assertion for one agent's host is not
+     *  usable at another's. */
+    audience: string;
+    /** The `0x51`-wrapped session signature over `callerAssertionDigest(...)`. */
+    signature: string;
+}
+/** The digest a caller signs — keccak over stable JSON, the a2a body-hash convention. */
+export declare function callerAssertionDigest(a: Omit<CallerAssertionV1, 'signature'>): Hex;
+/** keccak over the raw request body, exactly as it arrived — never over a re-serialized parse. */
+export declare const requestBodyHash: (raw: string) => Hex;
+/** Build the `Authorization` header value a runtime sends. */
+export declare function sessionAuthorizationHeader(a: CallerAssertionV1): string;
+/** Read an `A2A-Session` header. Returns null for any other scheme (a `Bearer` is a person's, not ours) and
+ *  for anything malformed — never a partial assertion. */
+export declare function parseSessionAuthorization(header: string | null | undefined): CallerAssertionV1 | null;
+export interface SessionWirePrincipalDeps {
+    /** The enforcer addresses the wire's caveats must carry (this deployment's). */
+    enforcers: {
+        timestamp: string;
+        allowedMethods: string;
+    };
+    /** ERC-1271 / ECDSA verification of the wire against its delegator. */
+    verifyDelegationSig: (d: Delegation) => Promise<boolean>;
+    /** On-chain revocation — a custodian's revoke kills the caller at the next request. */
+    isRevoked: (d: Delegation) => Promise<boolean>;
+    /**
+     * Verify an assertion the agent signed DIRECTLY — ERC-1271 against its own account, no session key in
+     * between. Some agents can do that (a relayer holding the SA's credential, a persona in this estate) and
+     * before the fold they proved themselves exactly this way, with `caller` + `signature` on the wire.
+     *
+     * NOT A FALLBACK (ADR-0013). The signature's own type byte chooses: `0x51` is session-wrapped and takes
+     * the wire path; anything else takes this one. Neither runs because the other failed, and omitting this
+     * means a direct signature is simply not admitted.
+     */
+    verifyAgentSignature?: (agent: Address, digest: Hex, signature: Hex) => Promise<boolean>;
+    /** How old an assertion may be (default 120 s). */
+    maxAgeSec?: number;
+    /** Tolerated clock skew for an assertion dated ahead (default 30 s). */
+    skewSec?: number;
+    now?: () => number;
+    /**
+     * Spend an assertion, once. Returns true when THIS call claimed it and false when it was already spent.
+     * The default is an in-isolate map, which is not replay protection where requests fan out across
+     * isolates — bind the estate's single writer (the agent's own object) in production.
+     */
+    claim?: (digest: Hex, expiresAtMs: number) => Promise<boolean>;
+    /** Told why a caller was refused — for the operator's log, never for the caller (a refusal says only
+     *  that it was refused; which leg failed is not a fact an unauthenticated caller is owed). */
+    onRefused?: (reason: string, agent?: string) => void;
+}
+/**
+ * The `principal` implementation for agents. Returns `{ agent, kind: 'agent' }` on every leg passing, and
+ * `null` otherwise — the server answers 401 and no method runs.
+ *
+ * SINGLE-USE. An accepted assertion's digest is SPENT: a captured request cannot be replayed while it is
+ * still fresh. With `claim` bound to the estate's single writer this holds everywhere; without it, only
+ * within this isolate — which on a fanned-out edge is no protection at all, and was observed live before
+ * the ledger existed. The claim happens AFTER the signature verifies, so an unauthenticated caller can
+ * spend nothing and write nothing.
+ */
+export declare function sessionWirePrincipal(deps: SessionWirePrincipalDeps): (request: Request) => Promise<Principal | null>;
+/** Re-export so a client can build a wire-signed call without reaching past the standard surface. */
+export type { DelegationWireV1 };
+//# sourceMappingURL=caller.d.ts.map

package/dist/standard/caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.d.ts","sourceRoot":"","sources":["../../src/standard/caller.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAsB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAA+D,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD;4FAC4F;AAC5F,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;6GAG6G;AAC7G,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,QAAQ,EAAE,GAAG,CAAC;IACd,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB;+BAC2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG,GAAG,CASlF;AAED,kGAAkG;AAClG,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,GAA8B,CAAC;AAQ7E,8DAA8D;AAC9D,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAEvE;AAED;0DAC0D;AAC1D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,CAerG;AAED,MAAM,WAAW,wBAAwB;IACvC,gFAAgF;IAChF,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,uEAAuE;IACvE,mBAAmB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D;kGAC8F;IAC9F,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CA4DpH;AAED,qGAAqG;AACrG,YAAY,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/standard/caller.js

@@ -0,0 +1,159 @@
+// THE RUNTIME AS ITS OWN CALLER — spec 372 S3c.
+//
+// A person reaches the standard surface with a Home session bearer. An outside runtime — Claude Code, Goose,
+// a deploy bot — has no Home session and must never be given one: it is not a person, and a bearer minted for
+// a person is exactly the credential-sharing this estate exists to avoid. What it holds instead is what every
+// agent here holds: a SESSION WIRE (spec 350 §8) — a narrow delegation from its own Smart Agent to a key it
+// controls, timestamp-bounded, pinning the one skill it may exercise, signed by the agent's custody credential
+// and revocable on chain by that custodian at any moment.
+//
+// So the runtime signs each request with that key and presents the wire beside it. The server verifies, per
+// request and fail-closed: the wire's delegator IS the agent claimed; the wire's shape is sound (bounded,
+// pinned, never the any-skill sentinel); the raw signature recovers to the wire's delegate; the wire itself
+// verifies against the delegator on chain (ERC-1271) and is NOT revoked. Revoking the wire kills the caller
+// at the next request, everywhere, with no list to update.
+//
+// TWO SCHEMES, NOT A FALLBACK (ADR-0013). `Bearer` is a person's Home session; `A2A-Session` is an agent's
+// wire. The scheme token in the header selects ONE mechanism, and it fails closed on its own terms — neither
+// is ever tried after the other fails. Which one arrived says WHO is asking. Neither says what they may do.
+import { keccak256, toBytes } from 'viem';
+import { parseSessionWrappedSignature, verifySessionWrappedSignature } from '../session-wire.js';
+/** The Authorization scheme an agent presents its session wire under. */
+export const SESSION_AUTH_SCHEME = 'A2A-Session';
+/** The skill a session wire must pin to reach the standard surface: asking this agent, and nothing else.
+ *  A wire that names other selectors and not this one is refused — pinning is the point. */
+export const STANDARD_SURFACE_SKILL = 'harness.ask';
+/** The digest a caller signs — keccak over stable JSON, the a2a body-hash convention. */
+export function callerAssertionDigest(a) {
+    return keccak256(toBytes(JSON.stringify({
+        v: 'ap.a2a.caller-assertion.v1',
+        agent: a.agent.toLowerCase(),
+        method: a.method,
+        bodyHash: a.bodyHash.toLowerCase(),
+        issuedAt: a.issuedAt,
+        audience: a.audience.replace(/\/$/, '').toLowerCase(),
+    })));
+}
+/** keccak over the raw request body, exactly as it arrived — never over a re-serialized parse. */
+export const requestBodyHash = (raw) => keccak256(toBytes(raw));
+const b64urlDecode = (s) => {
+    const padded = s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (s.length % 4)) % 4);
+    return atob(padded);
+};
+const b64urlEncode = (s) => btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+/** Build the `Authorization` header value a runtime sends. */
+export function sessionAuthorizationHeader(a) {
+    return `${SESSION_AUTH_SCHEME} ${b64urlEncode(JSON.stringify(a))}`;
+}
+/** Read an `A2A-Session` header. Returns null for any other scheme (a `Bearer` is a person's, not ours) and
+ *  for anything malformed — never a partial assertion. */
+export function parseSessionAuthorization(header) {
+    const m = new RegExp(`^${SESSION_AUTH_SCHEME}\\s+(.+)$`, 'i').exec((header ?? '').trim());
+    if (!m)
+        return null;
+    try {
+        const a = JSON.parse(b64urlDecode(m[1].trim()));
+        if (typeof a.agent !== 'string' || !/^0x[0-9a-fA-F]{40}$/.test(a.agent))
+            return null;
+        if (typeof a.method !== 'string' || !a.method)
+            return null;
+        if (typeof a.bodyHash !== 'string' || !/^0x[0-9a-fA-F]{64}$/.test(a.bodyHash))
+            return null;
+        if (typeof a.issuedAt !== 'number' || !Number.isFinite(a.issuedAt))
+            return null;
+        if (typeof a.audience !== 'string' || !a.audience)
+            return null;
+        if (typeof a.signature !== 'string' || !a.signature.startsWith('0x'))
+            return null;
+        return a;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The `principal` implementation for agents. Returns `{ agent, kind: 'agent' }` on every leg passing, and
+ * `null` otherwise — the server answers 401 and no method runs.
+ *
+ * SINGLE-USE. An accepted assertion's digest is SPENT: a captured request cannot be replayed while it is
+ * still fresh. With `claim` bound to the estate's single writer this holds everywhere; without it, only
+ * within this isolate — which on a fanned-out edge is no protection at all, and was observed live before
+ * the ledger existed. The claim happens AFTER the signature verifies, so an unauthenticated caller can
+ * spend nothing and write nothing.
+ */
+export function sessionWirePrincipal(deps) {
+    const maxAgeSec = deps.maxAgeSec ?? 120;
+    const skewSec = deps.skewSec ?? 30;
+    const now = deps.now ?? (() => Date.now());
+    const seen = new Map();
+    const refuse = (reason, agent) => { deps.onRefused?.(reason, agent); return null; };
+    return async (request) => {
+        const a = parseSessionAuthorization(request.headers.get('authorization'));
+        if (!a)
+            return null; // not our scheme — say nothing; another principal may own it
+        const nowSec = Math.floor(now() / 1000);
+        if (a.issuedAt > nowSec + skewSec)
+            return refuse('assertion is dated ahead', a.agent);
+        if (a.issuedAt < nowSec - maxAgeSec)
+            return refuse('assertion is stale', a.agent);
+        const audience = new URL(request.url).origin;
+        if (a.audience.replace(/\/$/, '').toLowerCase() !== audience.toLowerCase())
+            return refuse(`assertion is for ${a.audience}, not ${audience}`, a.agent);
+        let raw;
+        try {
+            raw = await request.clone().text();
+        }
+        catch {
+            return refuse('request body unreadable', a.agent);
+        }
+        if (requestBodyHash(raw).toLowerCase() !== a.bodyHash.toLowerCase())
+            return refuse('assertion does not bind this body', a.agent);
+        let method;
+        try {
+            method = JSON.parse(raw).method;
+        }
+        catch {
+            return refuse('body is not JSON', a.agent);
+        }
+        if (method !== a.method)
+            return refuse(`assertion is for ${a.method}, body calls ${String(method)}`, a.agent);
+        const digest = callerAssertionDigest(a);
+        // A cheap local reject first, so a replay landing on the isolate that served the original costs no
+        // chain read; the authoritative claim is below, after the signature verifies.
+        for (const [k, at] of seen)
+            if (at < nowSec - maxAgeSec - skewSec)
+                seen.delete(k);
+        if (seen.has(digest))
+            return refuse('assertion already used', a.agent);
+        const wrapped = parseSessionWrappedSignature(a.signature) !== null;
+        const ok = wrapped
+            ? await verifySessionWrappedSignature({
+                signer: a.agent.toLowerCase(),
+                digest,
+                signature: a.signature,
+                enforcers: deps.enforcers,
+                verifyDelegationSig: deps.verifyDelegationSig,
+                isRevoked: deps.isRevoked,
+                skill: STANDARD_SURFACE_SKILL,
+                now: now(),
+            }).catch(() => false)
+            : deps.verifyAgentSignature
+                ? await deps.verifyAgentSignature(a.agent.toLowerCase(), digest, a.signature).catch(() => false)
+                : false;
+        if (!ok) {
+            return refuse(wrapped
+                ? 'session wire did not verify (shape, signature, delegator or revocation)'
+                : deps.verifyAgentSignature ? 'the agent\'s own signature did not verify' : 'a direct agent signature is not admitted here', a.agent);
+        }
+        // SPENT, now that it is known to be genuine: the single writer decides who was first. A ledger that
+        // cannot be reached refuses the call — a replay window is not something to fail open into (ADR-0013).
+        if (deps.claim) {
+            const claimed = await deps.claim(digest, (a.issuedAt + maxAgeSec + skewSec) * 1000).catch(() => false);
+            if (!claimed)
+                return refuse('assertion already used', a.agent);
+        }
+        seen.set(digest, nowSec);
+        return { agent: a.agent.toLowerCase(), kind: 'agent' };
+    };
+}
+//# sourceMappingURL=caller.js.map

package/dist/standard/caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../src/standard/caller.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,6GAA6G;AAC7G,8GAA8G;AAC9G,8GAA8G;AAC9G,4GAA4G;AAC5G,+GAA+G;AAC/G,0DAA0D;AAC1D,EAAE;AACF,4GAA4G;AAC5G,0GAA0G;AAC1G,4GAA4G;AAC5G,4GAA4G;AAC5G,2DAA2D;AAC3D,EAAE;AACF,2GAA2G;AAC3G,6GAA6G;AAC7G,4GAA4G;AAC5G,OAAO,EAAE,SAAS,EAAE,OAAO,EAA0B,MAAM,MAAM,CAAC;AAElE,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAyB,MAAM,oBAAoB,CAAC;AAGxH,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD;4FAC4F;AAC5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAsBpD,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CAAC,CAAuC;IAC3E,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QACtC,CAAC,EAAE,4BAA4B;QAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;QAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;KACtD,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAO,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAE7E,MAAM,YAAY,GAAG,CAAC,CAAS,EAAU,EAAE;IACzC,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAE/G,8DAA8D;AAC9D,MAAM,UAAU,0BAA0B,CAAC,CAAoB;IAC7D,OAAO,GAAG,mBAAmB,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;0DAC0D;AAC1D,MAAM,UAAU,yBAAyB,CAAC,MAAiC;IACzE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,mBAAmB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAA+B,CAAC;QAC/E,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3F,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClF,OAAO,CAAsB,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAmCD;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA8B;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAc,EAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3G,OAAO,KAAK,EAAE,OAAgB,EAA6B,EAAE;QAC3D,MAAM,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,6DAA6D;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO;YAAE,OAAO,MAAM,CAAC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,QAAQ,GAAG,MAAM,GAAG,SAAS;YAAE,OAAO,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAElF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC,QAAQ,SAAS,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAEtJ,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACxG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,CAAC,mCAAmC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACjI,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YAAC,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC,MAAM,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACxH,IAAI,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,gBAAgB,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAE9G,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACxC,mGAAmG;QACnG,8EAA8E;QAC9E,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI;YAAE,IAAI,EAAE,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAEvE,MAAM,OAAO,GAAG,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;QACnE,MAAM,EAAE,GAAG,OAAO;YAChB,CAAC,CAAC,MAAM,6BAA6B,CAAC;gBAClC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAa;gBACxC,MAAM;gBACN,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,sBAAsB;gBAC7B,GAAG,EAAE,GAAG,EAAE;aACX,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACvB,CAAC,CAAC,IAAI,CAAC,oBAAoB;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAa,EAAE,MAAM,EAAE,CAAC,CAAC,SAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;gBAClH,CAAC,CAAC,KAAK,CAAC;QACZ,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,MAAM,CAAC,OAAO;gBACnB,CAAC,CAAC,yEAAyE;gBAC3E,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,+CAA+C,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1I,CAAC;QAED,oGAAoG;QACpG,sGAAsG;QACtG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACvG,IAAI,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC"}

package/dist/standard/client.d.ts

@@ -0,0 +1,50 @@
+import type { AgentCardV1, MessageV1, PartV1, TaskV1 } from './types.js';
+export interface ResolvedAgentCard {
+    card: AgentCardV1;
+    /** SHA-256 over the card's bytes as served, hex — what a record pins and a later fetch is compared to. */
+    cardDigest: string;
+    /** The JSON-RPC 1.x interface the card publishes. */
+    endpoint: string;
+    cardUrl: string;
+}
+/** The A2A 1.0 JSON-RPC endpoint a card publishes (top-level `protocolVersion` covers a released card's interfaces). */
+export declare function jsonRpcEndpointOf(card: AgentCardV1 & {
+    protocolVersion?: string;
+}): string | null;
+/** Fetch a card, digest its bytes, read its endpoint. A card without a 1.x JSON-RPC interface is refused. */
+export declare function resolveAgentCard(cardUrl: string, fetchImpl?: typeof fetch, expectDigest?: string): Promise<ResolvedAgentCard>;
+export interface StandardA2aClientOptions {
+    endpoint: string;
+    fetch?: typeof fetch;
+    /** Extra headers on every call — a bearer, a session wire. Never a mandate. */
+    headers?: Record<string, string>;
+}
+export interface SendResult {
+    task?: TaskV1;
+    message?: MessageV1;
+}
+export interface StandardA2aClient {
+    sendMessage(parts: PartV1[], opts?: {
+        metadata?: Record<string, unknown>;
+        extensions?: string[];
+        contextId?: string;
+        taskId?: string;
+    }): Promise<SendResult>;
+    getTask(id: string): Promise<TaskV1>;
+    /** Poll until the task is terminal or the deadline passes; the last task seen is returned either way. */
+    awaitTask(id: string, opts?: {
+        timeoutMs?: number;
+        everyMs?: number;
+    }): Promise<TaskV1>;
+    /** Send one text message and wait: the reply's text (status message + text artifacts) and the task. */
+    ask(text: string, opts?: {
+        metadata?: Record<string, unknown>;
+        timeoutMs?: number;
+    }): Promise<{
+        text: string;
+        task?: TaskV1;
+        message?: MessageV1;
+    }>;
+}
+export declare function createStandardA2aClient(o: StandardA2aClientOptions): StandardA2aClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/standard/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/standard/client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAmB,MAAM,YAAY,CAAC;AAG1F,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,WAAW,CAAC;IAClB,0GAA0G;IAC1G,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,wHAAwH;AACxH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAIjG;AAED,6GAA6G;AAC7G,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY1I;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE;AAIlE,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7J,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,yGAAyG;IACzG,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxF,uGAAuG;IACvG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;CACrJ;AAED,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,wBAAwB,GAAG,iBAAiB,CA0CtF"}