@agenticprimitives/a2a 0.0.0-alpha.3 → 0.0.0-alpha.30

package/dist/card-audience.js

@@ -0,0 +1,135 @@
+// Card-audience authentication (spec 338 §8, W4-b).
+//
+// THE HOLE THIS CLOSES: hosts were serving the extended card on a QUERY PARAMETER
+// (`?view=authenticated`). Anyone could type it. The extended card is supposed to reveal fine-grained
+// skills to *verified* callers, so a parameter that anyone can set makes the split decorative.
+//
+// A requester now proves control of its Smart Agent by signing a challenge bound to
+// {requester, nonce, cardOrigin, requestedView, issuedAt}. Verification goes through the injected
+// signature port — the same `UniversalSignatureValidator` surface used everywhere else, so EOA,
+// ERC-1271, ERC-6492 and passkey credentials all work unchanged.
+//
+// ─── DEGRADE, DON'T DENY ────────────────────────────────────────────────────────────────────────
+// Every failure resolves to `{ audience: 'public' }` rather than an error. That is deliberate and it
+// IS the fail-closed choice here: the public card is genuinely public, so the safe fallback is
+// LEAST DISCLOSURE, not a 401. It also means a plain unauthenticated `curl` keeps working, which is
+// the whole point of a well-known card.
+//
+// The rule to hold onto: a failed proof must never widen the audience. It can only ever leave it at
+// `public`.
+import { isAgentAuthenticatedPeer } from '@agenticprimitives/types';
+const DEFAULT_MAX_CLAIM_AGE_MS = 2 * 60 * 1000;
+/** The public audience — the floor, and the answer to every failed claim. */
+export const PUBLIC_AUDIENCE = { audience: 'public' };
+function normalizeView(v) {
+    return v === 'authenticated' || v === 'private' ? v : null;
+}
+/**
+ * Build the resolver a card route calls to turn a request into an audience.
+ *
+ * Never throws. Never returns an audience wider than the claim proved.
+ */
+export function createCardAudienceResolver(opts) {
+    return async (claim, peer) => {
+        const deny = (reason) => {
+            opts.observe?.({ granted: 'public', reason });
+            return PUBLIC_AUDIENCE;
+        };
+        const view = normalizeView(claim.requestedView);
+        // No wider view requested — nothing to verify, and nothing to grant.
+        if (!view)
+            return PUBLIC_AUDIENCE;
+        // Transport-authenticated peer: the connection already proved who is asking, so skip the card
+        // challenge. Anything below `agent` strength falls through to the normal challenge path — it has
+        // NOT identified a Smart Agent.
+        if (peer?.peerContext && isAgentAuthenticatedPeer(peer.peerContext)) {
+            const requester = peer.peerContext.canonicalAgentId;
+            if (view === 'private') {
+                let permitted = false;
+                try {
+                    permitted = (await opts.privateViewPolicy?.(requester)) ?? false;
+                }
+                catch {
+                    permitted = false;
+                }
+                opts.observe?.({ granted: permitted ? 'private' : 'authenticated', reason: 'peer-authenticated' });
+                return { audience: permitted ? 'private' : 'authenticated', requester };
+            }
+            opts.observe?.({ granted: 'authenticated', reason: 'peer-authenticated' });
+            return { audience: 'authenticated', requester };
+        }
+        if (!claim.requester || !claim.challengeNonce || !claim.signature || !claim.issuedAt) {
+            // THE CLOSED HOLE: a bare `?view=authenticated` with no proof lands here and gets the public card.
+            return deny('incomplete-claim');
+        }
+        const issuedAt = Date.parse(claim.issuedAt);
+        const nowMs = Date.parse(opts.now());
+        if (Number.isNaN(issuedAt) || Number.isNaN(nowMs))
+            return deny('unparseable-timestamp');
+        if (Math.abs(nowMs - issuedAt) > (opts.maxClaimAgeMs ?? DEFAULT_MAX_CLAIM_AGE_MS)) {
+            return deny('stale-claim');
+        }
+        // Nonce BEFORE signature: a replayed claim must not make the host repeat an expensive chain read.
+        let fresh = false;
+        try {
+            fresh = await opts.consumeNonce(claim.challengeNonce, opts.cardOrigin);
+        }
+        catch {
+            fresh = false;
+        }
+        if (!fresh)
+            return deny('nonce-spent-or-unknown');
+        const body = {
+            requester: claim.requester,
+            challengeNonce: claim.challengeNonce,
+            cardOrigin: opts.cardOrigin,
+            requestedView: view,
+            issuedAt: claim.issuedAt,
+        };
+        let valid = false;
+        try {
+            valid = await opts.verifySignature({ requester: claim.requester, body, signature: claim.signature });
+        }
+        catch {
+            // A verifier that threw did not verify (ADR-0013: no fallback to a weaker check).
+            valid = false;
+        }
+        if (!valid)
+            return deny('signature-invalid');
+        if (view === 'private') {
+            let permitted = false;
+            try {
+                permitted = (await opts.privateViewPolicy?.(claim.requester)) ?? false;
+            }
+            catch {
+                permitted = false;
+            }
+            if (!permitted) {
+                // Authenticated but not entitled to the private view — grant the level they DID earn.
+                opts.observe?.({ granted: 'authenticated', reason: 'private-not-permitted' });
+                return { audience: 'authenticated', requester: claim.requester };
+            }
+            opts.observe?.({ granted: 'private' });
+            return { audience: 'private', requester: claim.requester };
+        }
+        opts.observe?.({ granted: 'authenticated' });
+        return { audience: 'authenticated', requester: claim.requester };
+    };
+}
+/**
+ * Read a claim from standard request inputs.
+ *
+ * The signature and nonce come from HEADERS, never the query string: a query parameter lands in
+ * access logs, `Referer` headers, and browser history, and a proof that leaks that way is a replay
+ * waiting to happen. `view` stays in the query because it is a request, not a secret.
+ */
+export function readCardAudienceClaim(input) {
+    return {
+        requestedView: input.query('view'),
+        requester: input.header('x-ap-requester'),
+        challengeNonce: input.header('x-ap-challenge'),
+        signature: input.header('x-ap-signature'),
+        issuedAt: input.header('x-ap-issued-at'),
+    };
+}
+//# sourceMappingURL=card-audience.js.map

package/dist/card-audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-audience.js","sourceRoot":"","sources":["../src/card-audience.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,kFAAkF;AAClF,sGAAsG;AACtG,+FAA+F;AAC/F,EAAE;AACF,oFAAoF;AACpF,kGAAkG;AAClG,gGAAgG;AAChG,iEAAiE;AACjE,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,+FAA+F;AAC/F,oGAAoG;AACpG,wCAAwC;AACxC,EAAE;AACF,oGAAoG;AACpG,YAAY;AAEZ,OAAO,EAAE,wBAAwB,EAA8B,MAAM,0BAA0B,CAAC;AAuEhG,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAEzE,SAAS,aAAa,CAAC,CAAqB;IAC1C,OAAO,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAiC;IAC1E,OAAO,KAAK,EACV,KAAwB,EACxB,IAA8B,EACF,EAAE;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAc,EAAqB,EAAE;YACjD,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChD,qEAAqE;QACrE,IAAI,CAAC,IAAI;YAAE,OAAO,eAAe,CAAC;QAElC,8FAA8F;QAC9F,iGAAiG;QACjG,gCAAgC;QAChC,IAAI,IAAI,EAAE,WAAW,IAAI,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACpE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,IAAI,CAAC;oBACH,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC;gBACnE,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,GAAG,KAAK,CAAC;gBACpB,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACnG,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,CAAC;YAC1E,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3E,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrF,mGAAmG;YACnG,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACxF,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,wBAAwB,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QAED,kGAAkG;QAClG,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAElD,MAAM,IAAI,GAAsB;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QAEF,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACvG,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;YAClF,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAE7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC;YACzE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,sFAAsF;gBACtF,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBAC9E,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACvC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IACnE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IACC,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACzC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC9C,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAA8B;QACtE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/dist/client.d.ts

@@ -1,11 +1,11 @@
 import type { Address, Hex } from '@agenticprimitives/types';
 import type { Delegation } from '@agenticprimitives/delegation';
 import type { Task, TaskEvent, A2aMessage } from './types.js';
-import type { JsonRpcRequest, JsonRpcResponse } from './jsonrpc.js';
+import type { ArtifactV1, JsonRpcRequest, JsonRpcResponse, TaskV1 } from './standard/types.js';
 export interface A2aTransport {
-    /** POST a JSON-RPC request to `targetAgent`'s /api/a2a and return the parsed response. */
+    /** POST a JSON-RPC request to `targetAgent`'s A2A endpoint and return the parsed response. */
     rpc(targetAgent: Address, request: JsonRpcRequest): Promise<JsonRpcResponse>;
-    /** Open the message/stream SSE for a task; yields events until terminal. Optional until W4. */
+    /** Open the streaming SSE for a task; yields events until terminal. Optional. */
     stream?(targetAgent: Address, taskId: Hex): AsyncIterable<TaskEvent>;
 }
 export declare class A2aWireAdapter {
@@ -13,7 +13,10 @@ export declare class A2aWireAdapter {
     private seq;
     constructor(transport: A2aTransport);
     private id;
-    /** Submit an async task. The `message` must already be signed by `requester` (see `hashA2aMessage`). */
+    /**
+     * Submit an async task. The `message` must already be signed by its sender (see `hashA2aMessage`); its
+     * envelope travels in the extension so the receiver re-derives the same digest.
+     */
     submitTask(targetAgent: Address, args: {
         message: A2aMessage;
         delegation: Delegation;
@@ -27,11 +30,23 @@ export declare class A2aWireAdapter {
         taskId: Hex;
         state: Task['state'];
     }>;
-    /** Poll a task's current state + artifact refs. */
-    getTask(targetAgent: Address, taskId: Hex, caller: Address): Promise<Task & {
-        error?: string;
+    /** Resubmit a parked (auth-required) task with a fresh grant + a newly signed message. */
+    resubmitTask(targetAgent: Address, taskId: Hex, args: {
+        message: A2aMessage;
+        delegation: Delegation;
+        requester: Address;
+        input: unknown;
+    }): Promise<{
+        taskId: Hex;
+        state: Task['state'];
     }>;
-    cancelTask(targetAgent: Address, taskId: Hex, caller: Address): Promise<{
+    /** Poll a task. The caller is authenticated by the transport's `Authorization` header, not by params. */
+    getTask(targetAgent: Address, taskId: Hex): Promise<TaskV1>;
+    /** Read an artifact BODY (the delegated-task extension's `GetTaskArtifact`): the projection `getTask` returns
+     *  carries only a ref and a hash. Authenticated the same way `getTask` is; a non-party reads not-found. */
+    getTaskArtifact(targetAgent: Address, taskId: Hex, artifactId: Hex): Promise<ArtifactV1>;
+    /** Cancel a task. Authenticated the same way `getTask` is. */
+    cancelTask(targetAgent: Address, taskId: Hex): Promise<{
         taskId: Hex;
         state: Task['state'];
     }>;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,0FAA0F;IAC1F,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,+FAA+F;IAC/F,MAAM,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;CACtE;AAOD,qBAAa,cAAc;IAEb,OAAO,CAAC,QAAQ,CAAC,SAAS;IADtC,OAAO,CAAC,GAAG,CAAK;gBACa,SAAS,EAAE,YAAY;IAEpD,OAAO,CAAC,EAAE;IAIV,wGAAwG;IAClG,UAAU,CACd,WAAW,EAAE,OAAO,EACpB,IAAI,EAAE;QAAE,OAAO,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GACtI,OAAO,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAQjD,mDAAmD;IAC7C,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/F,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAOpH,wGAAwG;IACxG,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC;CAIlF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAa,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG1G,MAAM,WAAW,YAAY;IAC3B,8FAA8F;IAC9F,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,iFAAiF;IACjF,MAAM,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;CACtE;AA4BD,qBAAa,cAAc;IAEb,OAAO,CAAC,QAAQ,CAAC,SAAS;IADtC,OAAO,CAAC,GAAG,CAAK;gBACa,SAAS,EAAE,YAAY;IAEpD,OAAO,CAAC,EAAE;IAIV;;;OAGG;IACG,UAAU,CACd,WAAW,EAAE,OAAO,EACpB,IAAI,EAAE;QAAE,OAAO,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GACtI,OAAO,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IA+BjD,0FAA0F;IACpF,YAAY,CAChB,WAAW,EAAE,OAAO,EACpB,MAAM,EAAE,GAAG,EACX,IAAI,EAAE;QAAE,OAAO,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,GACxF,OAAO,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAejD,yGAAyG;IACnG,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAKjE;+GAC2G;IACrG,eAAe,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC;IAK9F,8DAA8D;IACxD,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAMnG,wGAAwG;IACxG,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC;CAIlF"}

package/dist/client.js

@@ -1,8 +1,30 @@
+import { delegatedInputPart, taskStateFromV1, withDelegatedTask } from './standard/delegated.js';
+/**
+ * The grant, JSON-safe. `Delegation.salt` is a bigint in the type and a decimal STRING on the wire, and
+ * `JSON.stringify` throws on a bigint — so a caller that holds the typed shape and one that received the
+ * wire shape both end up sending the same bytes. (Every sender in the estate already did this by hand.)
+ *
+ * A bigint is the ONLY thing changed. A grant the caller received as a wire is passed through untouched,
+ * field for field — inventing a default `salt` for one that carries none would make "the wire goes out as
+ * it came in" false, and that promise is the whole reason a re-minted grant is not required here.
+ */
+function grantToWire(d) {
+    const salt = d.salt;
+    if (typeof salt !== 'bigint')
+        return { ...d };
+    return { ...d, salt: salt.toString() };
+}
 function unwrap(res) {
     if ('error' in res)
         throw new Error(`a2a rpc error ${res.error.code}: ${res.error.message}`);
     return res.result;
 }
+/** The 1.0 result of `SendMessage` is a task or a bare message; a delegated task is always a task. */
+function taskOf(result) {
+    if (!result?.task)
+        throw new Error('a2a: SendMessage returned no task — a delegated task always creates one');
+    return result.task;
+}
 export class A2aWireAdapter {
     transport;
     seq = 0;
@@ -12,31 +34,70 @@ export class A2aWireAdapter {
     id() {
         return ++this.seq;
     }
-    /** Submit an async task. The `message` must already be signed by `requester` (see `hashA2aMessage`). */
+    /**
+     * Submit an async task. The `message` must already be signed by its sender (see `hashA2aMessage`); its
+     * envelope travels in the extension so the receiver re-derives the same digest.
+     */
     async submitTask(targetAgent, args) {
+        const m = args.message;
+        const carried = withDelegatedTask({
+            messageId: m.messageId,
+            role: 'ROLE_USER',
+            parts: [delegatedInputPart(args.input)],
+            ...(m.threadId ? { contextId: m.threadId } : {}),
+        }, {
+            delegation: grantToWire(args.delegation),
+            requester: args.requester,
+            skill: m.skill,
+            sender: m.sender,
+            bodyHash: m.bodyHash,
+            bodyRef: m.bodyRef,
+            signature: m.signature,
+            createdAt: m.createdAt,
+        });
         const res = await this.transport.rpc(targetAgent, {
-            jsonrpc: '2.0', id: this.id(), method: 'message/send',
-            params: { delegation: args.delegation, requester: args.requester, message: args.message, input: args.input, pushConfig: args.pushConfig },
+            jsonrpc: '2.0', id: this.id(), method: 'SendMessage',
+            params: {
+                message: carried,
+                ...(args.pushConfig ? { configuration: { taskPushNotificationConfig: args.pushConfig } } : {}),
+            },
         });
-        return unwrap(res);
+        const task = taskOf(unwrap(res));
+        return { taskId: task.id, state: taskStateFromV1(task.status.state) };
     }
-    /** Poll a task's current state + artifact refs. */
-    async getTask(targetAgent, taskId, caller) {
-        const res = await this.transport.rpc(targetAgent, {
-            jsonrpc: '2.0', id: this.id(), method: 'tasks/get', params: { taskId, caller },
+    /** Resubmit a parked (auth-required) task with a fresh grant + a newly signed message. */
+    async resubmitTask(targetAgent, taskId, args) {
+        const m = args.message;
+        const carried = withDelegatedTask({ messageId: m.messageId, role: 'ROLE_USER', parts: [delegatedInputPart(args.input)], taskId, ...(m.threadId ? { contextId: m.threadId } : {}) }, {
+            delegation: grantToWire(args.delegation), requester: args.requester, skill: m.skill, sender: m.sender,
+            bodyHash: m.bodyHash, bodyRef: m.bodyRef,
+            signature: m.signature, createdAt: m.createdAt, taskId,
         });
+        const res = await this.transport.rpc(targetAgent, { jsonrpc: '2.0', id: this.id(), method: 'SendMessage', params: { message: carried } });
+        const task = taskOf(unwrap(res));
+        return { taskId: task.id, state: taskStateFromV1(task.status.state) };
+    }
+    /** Poll a task. The caller is authenticated by the transport's `Authorization` header, not by params. */
+    async getTask(targetAgent, taskId) {
+        const res = await this.transport.rpc(targetAgent, { jsonrpc: '2.0', id: this.id(), method: 'GetTask', params: { id: taskId } });
         return unwrap(res);
     }
-    async cancelTask(targetAgent, taskId, caller) {
-        const res = await this.transport.rpc(targetAgent, {
-            jsonrpc: '2.0', id: this.id(), method: 'tasks/cancel', params: { taskId, caller },
-        });
+    /** Read an artifact BODY (the delegated-task extension's `GetTaskArtifact`): the projection `getTask` returns
+     *  carries only a ref and a hash. Authenticated the same way `getTask` is; a non-party reads not-found. */
+    async getTaskArtifact(targetAgent, taskId, artifactId) {
+        const res = await this.transport.rpc(targetAgent, { jsonrpc: '2.0', id: this.id(), method: 'GetTaskArtifact', params: { id: taskId, artifactId } });
         return unwrap(res);
     }
+    /** Cancel a task. Authenticated the same way `getTask` is. */
+    async cancelTask(targetAgent, taskId) {
+        const res = await this.transport.rpc(targetAgent, { jsonrpc: '2.0', id: this.id(), method: 'CancelTask', params: { id: taskId } });
+        const task = unwrap(res);
+        return { taskId: task.id, state: taskStateFromV1(task.status.state) };
+    }
     /** Subscribe to a task's status/artifact events (SSE). Requires a transport that supports streaming. */
     subscribeTaskUpdates(targetAgent, taskId) {
         if (!this.transport.stream)
-            throw new Error('transport does not support streaming (message/stream)');
+            throw new Error('transport does not support streaming (SubscribeToTask)');
         return this.transport.stream(targetAgent, taskId);
     }
 }

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAgBA,SAAS,MAAM,CAAI,GAAoB;IACrC,IAAI,OAAO,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC,MAAW,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,cAAc;IAEI;IADrB,GAAG,GAAG,CAAC,CAAC;IAChB,YAA6B,SAAuB;QAAvB,cAAS,GAAT,SAAS,CAAc;IAAG,CAAC;IAEhD,EAAE;QACR,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,UAAU,CACd,WAAoB,EACpB,IAAuI;QAEvI,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE;YAChD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc;YACrD,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;SAC1I,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,OAAO,CAAC,WAAoB,EAAE,MAAW,EAAE,MAAe;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE;YAChD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAC/E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAAoB,EAAE,MAAW,EAAE,MAAe;QACjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE;YAChD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAClF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,wGAAwG;IACxG,oBAAoB,CAAC,WAAoB,EAAE,MAAW;QACpD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACrG,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AASjG;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,CAAkC;IACrD,MAAM,IAAI,GAAI,CAAwB,CAAC,IAAI,CAAC;IAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAI,CAA6B,EAAE,CAAC;IAC3E,OAAO,EAAE,GAAI,CAA6B,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,MAAM,CAAI,GAAoB;IACrC,IAAI,OAAO,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC,MAAW,CAAC;AACzB,CAAC;AAED,sGAAsG;AACtG,SAAS,MAAM,CAAC,MAA4C;IAC1D,IAAI,CAAC,MAAM,EAAE,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC9G,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,OAAO,cAAc;IAEI;IADrB,GAAG,GAAG,CAAC,CAAC;IAChB,YAA6B,SAAuB;QAAvB,cAAS,GAAT,SAAS,CAAc;IAAG,CAAC;IAEhD,EAAE;QACR,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,WAAoB,EACpB,IAAuI;QAEvI,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,MAAM,OAAO,GAAc,iBAAiB,CAC1C;YACE,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,EACD;YACE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAU;YACjD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,OAAO,EAAE,CAAC,CAAC,OAAgD;YAC3D,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE;YAChD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa;YACpD,MAAM,EAAE;gBACN,OAAO,EAAE,OAAO;gBAChB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,0BAA0B,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/F;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAS,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAChB,WAAoB,EACpB,MAAW,EACX,IAAyF;QAEzF,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,MAAM,OAAO,GAAc,iBAAiB,CAC1C,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAChJ;YACE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;YAC9G,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAgD;YACjF,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM;SACvD,CACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1I,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAS,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,yGAAyG;IACzG,KAAK,CAAC,OAAO,CAAC,WAAoB,EAAE,MAAW;QAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAChI,OAAO,MAAM,CAAS,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;+GAC2G;IAC3G,KAAK,CAAC,eAAe,CAAC,WAAoB,EAAE,MAAW,EAAE,UAAe;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACpJ,OAAO,MAAM,CAAa,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,UAAU,CAAC,WAAoB,EAAE,MAAW;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACnI,MAAM,IAAI,GAAG,MAAM,CAAS,GAAG,CAAC,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAS,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,wGAAwG;IACxG,oBAAoB,CAAC,WAAoB,EAAE,MAAW;QACpD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/cloudflare/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAMlD;;qFAEqF;AACrF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,CA2BrF;AAED,eAAO,MAAM,6BAA6B,EAAG,IAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAMlD;;qFAEqF;AACrF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAmCrF;AAED,eAAO,MAAM,6BAA6B,EAAG,IAAa,CAAC"}

package/dist/cloudflare/index.js

@@ -27,11 +27,19 @@ export function createDurableObjectTaskStore(storage) {
             return out;
         },
         async reserveMessageId(messageId) {
+            // Two-phase (spec 290 §3). The key's PRESENCE is the durable replay guard: a present key means the id
+            // is in-flight OR consumed → replay (deny). Reserve writes the key (in-flight); commit leaves it
+            // (permanently consumed); release deletes it so a legitimate retry of the same message may re-reserve.
+            // A crash between reserve and commit/release leaves the key present → that exact id can't retry
+            // (fail-closed; the sender mints a fresh messageId), which is the safe posture.
             const k = MSG(messageId);
             if ((await storage.get(k)) !== undefined)
-                return false;
+                return null;
             await storage.put(k, 1);
-            return true;
+            return {
+                async commit() { },
+                async release() { await storage.delete(k); },
+            };
         },
     };
 }

package/dist/cloudflare/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAUA,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AACxD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AACtD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAEtD;;qFAEqF;AACrF,MAAM,UAAU,4BAA4B,CAAC,OAA6B;IACxE,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAkB;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAW;YACnB,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAa,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,OAAO;YACX,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAU,EAAE,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAQ,CAAC,CAAC;YACxE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,SAAc;YACnC,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAUA,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AACxD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AACtD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAEtD;;qFAEqF;AACrF,MAAM,UAAU,4BAA4B,CAAC,OAA6B;IACxE,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAkB;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAW;YACnB,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAa,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,OAAO;YACX,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAU,EAAE,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAQ,CAAC,CAAC;YACxE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,SAAc;YACnC,sGAAsG;YACtG,iGAAiG;YACjG,uGAAuG;YACvG,gGAAgG;YAChG,gFAAgF;YAChF,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,OAAO;gBACL,KAAK,CAAC,MAAM,KAAkE,CAAC;gBAC/E,KAAK,CAAC,OAAO,KAAK,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAC7C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAa,CAAC"}

package/dist/conform/index.d.ts

@@ -0,0 +1,36 @@
+export type ConformanceLevel = 'MUST' | 'SHOULD' | 'MAY';
+export interface ConformanceCheck {
+    id: string;
+    level: ConformanceLevel;
+    ok: boolean;
+    detail?: string;
+}
+/** One probe's verdict. `ok` is the conjunction of the MUSTs; SHOULD/MAY inform, never flip it. */
+export interface ConformanceReport {
+    target: string;
+    ok: boolean;
+    checks: ConformanceCheck[];
+}
+export interface ConformA2aOptions {
+    /** The bearer the surface admits (a Home session, an agent's session wire). */
+    bearer?: string;
+    /** Per-request timeout and the task-settle wait (default 15 s). */
+    timeoutMs?: number;
+    /** The text of the one message sent (default a probe sentence). */
+    message?: string;
+    /** Injected for tests; default global fetch. */
+    fetch?: typeof fetch;
+}
+/** Finalise the report: a MUST that failed flips `ok`. */
+export declare function summarize(target: string, checks: ConformanceCheck[]): ConformanceReport;
+/** A fixed-width table a person reads; the JSON is what a CI step keeps. */
+export declare function formatConformanceReport(r: ConformanceReport): string;
+/** The card URL for a target: an origin gets `/.well-known/agent-card.json`; a URL ending in `.json` is the card itself. */
+export declare function cardUrlOf(target: string): string;
+/**
+ * Probe an A2A 1.0 agent. `target` is the agent's origin (the card is read from `/.well-known/agent-card.json`)
+ * or the card URL itself; the JSON-RPC endpoint is the one the card publishes. Never throws for a server's
+ * behaviour — an unreachable card is a failed MUST with the reason.
+ */
+export declare function conformA2a(target: string, opts?: ConformA2aOptions): Promise<ConformanceReport>;
+//# sourceMappingURL=index.d.ts.map

package/dist/conform/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/conform/index.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,gBAAgB,CAAC;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAMD,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,iBAAiB,CAEvF;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAIpE;AAED,4HAA4H;AAC5H,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIhD;AAcD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA8IzG"}