@agenticprimitives/a2a 0.0.0-alpha.3 → 0.0.0-alpha.30

package/dist/handoff.js

@@ -0,0 +1,28 @@
+export const AP_HANDOFF_EXTENSION_URI = 'https://agenticprimitives.org/a2a/handoff/v1';
+const isAddr = (v) => typeof v === 'string' && /^0x[0-9a-fA-F]{40}$/.test(v);
+export function validateHandoff(x) {
+    const errors = [];
+    const h = x;
+    if (!h || typeof h !== 'object')
+        return { ok: false, errors: ['not an object'] };
+    if (h.extension !== AP_HANDOFF_EXTENSION_URI)
+        errors.push(`extension: expected ${AP_HANDOFF_EXTENSION_URI}`);
+    if (h.version !== 1)
+        errors.push('version: expected 1');
+    if (!h.intent || typeof h.intent.goal !== 'string' || !h.intent.goal.trim())
+        errors.push('intent.goal: required');
+    if (!h.plan || !Array.isArray(h.plan.steps) || h.plan.steps.length !== 1 || typeof h.plan.steps[0]?.toolId !== 'string')
+        errors.push('plan.steps: exactly one step');
+    if (!Array.isArray(h.presented) || h.presented.length < 1)
+        errors.push('presented: the chain, leaf first');
+    if (h.supplied !== undefined && !Array.isArray(h.supplied))
+        errors.push('supplied: a list when given');
+    const p = h.parent;
+    if (!p || !isAddr(p.agent) || !['runRef', 'stepRef', 'operationId', 'childRef'].every((k) => typeof p[k] === 'string' && p[k]))
+        errors.push('parent: { agent, runRef, stepRef, operationId, childRef }');
+    return errors.length ? { ok: false, errors } : { ok: true, handoff: h };
+}
+export function handoff(input) {
+    return { extension: AP_HANDOFF_EXTENSION_URI, version: 1, ...input };
+}
+//# sourceMappingURL=handoff.js.map

package/dist/handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.js","sourceRoot":"","sources":["../src/handoff.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,wBAAwB,GAAG,8CAA8C,CAAC;AAmBvF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEpG,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,CAA8B,CAAC;IACzC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;IACjF,IAAI,CAAC,CAAC,SAAS,KAAK,wBAAwB;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,wBAAwB,EAAE,CAAC,CAAC;IAC7G,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAClH,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACrK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC3G,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACvG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,CAA6B,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,CAA6B,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IACnQ,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAc,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAA+C;IACrE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;AACvE,CAAC"}

package/dist/index.d.ts

@@ -5,24 +5,43 @@ export type { Task, TaskState, Artifact, A2aArtifact, A2aMessage, VaultRef, Task
 export { TERMINAL_STATES, isTerminal } from './types.js';
 export type { TaskStore } from './task-store.js';
 export { createInMemoryTaskStore } from './task-store.js';
-export type { SkillHandler, SkillContext, SkillResult, VaultClient, McpClient, HandoffRequest } from './skill-handler.js';
+export type { SkillHandler, SkillExposure, SkillContext, SkillResult, VaultClient, McpClient, HandoffRequest } from './skill-handler.js';
 export { AuthRequired, HandoffRequested, buildSkillRegistry } from './skill-handler.js';
+export type { SkillPayment, PaymentGate, PaymentGateDecision, PaymentLane, X402PaymentMetadata, X402PaymentStatus } from './payment-gate.js';
+export { apAuthorityExtension, activatesApAuthority, AP_AUTHORITY_EXTENSION_URI, A2A_EXTENSIONS_HEADER, } from './authority-extension.js';
+export type { ApAuthorityExtension, ApAuthorityExtensionParams, ApAuthorityMethod } from './authority-extension.js';
+export { RUN_PROVENANCE_EXTENSION_URI, PROV_AQ_HAS_PROVENANCE, PROV_AQ_HAS_QUERY_SERVICE, runProvenanceExtension, provenanceLinkHeader } from './run-provenance-extension.js';
+export type { RunProvenanceExtension } from './run-provenance-extension.js';
+export { X402_EXTENSION_URI, x402AgentCardExtension, buildPaymentRequiredMetadata, buildPaymentSettledMetadata, gateSkillPayment, } from './payment-gate.js';
 export { newTaskRecord, applyTransition, dispatchTask } from './runtime.js';
 export type { TransitionResult } from './runtime.js';
 export { A2A_ANY_SKILL, skillSelector, buildA2aGrantCaveats } from './grant.js';
 export type { A2aEnforcers } from './grant.js';
-export { authorizeA2aMessage, hashA2aMessage, decodeTimestampTerms, decodeAllowedTargetsTerms, decodeAllowedMethodsTerms, } from './auth.js';
-export type { OnChainChecks, MessageIdReserver, AuthorizeResult } from './auth.js';
+export { authorizeA2aMessage, hashA2aMessage, hashA2aTaskRequest, hashPushConfigParams, hashArtifactParams, decodeTimestampTerms, decodeAllowedTargetsTerms, decodeAllowedMethodsTerms, } from './auth.js';
+export type { OnChainChecks, MessageIdReserver, MessageIdReservation, AuthorizeResult, ScopeCovers } from './auth.js';
 export { createA2aAgent } from './agent.js';
-export type { A2aAgent, A2aAgentConfig, AgentCard, MessageSendParams, ResubmitParams, RpcResult, RpcOk, RpcErr } from './agent.js';
-export { dispatchA2aRpc, handleA2aRpcBody } from './jsonrpc.js';
-export type { JsonRpcRequest, JsonRpcResponse } from './jsonrpc.js';
+export { PUBLIC_AUDIENCE, createCardAudienceResolver, readCardAudienceClaim } from './card-audience.js';
+export type { CardAudienceClaim, CardAudienceResolverOptions, CardChallengeBody, CardNonceConsumer, CardSignatureVerifier, PeerBackedAudienceInput, } from './card-audience.js';
+export type { AgentCardAudience, A2aAgent, A2aAgentConfig, A2aBudgetPort, A2aReceiptsConfig, AgentCard, MessageSendParams, ResubmitParams, RpcResult, RpcOk, RpcErr } from './agent.js';
+export type { JsonRpcRequest, JsonRpcResponse } from './standard/types.js';
 export { A2aWireAdapter } from './client.js';
 export type { A2aTransport } from './client.js';
-export { resolveA2aTarget, fetchAgentCard } from './discovery.js';
+export { resolveA2aTarget, fetchAgentCard, A2A_JSONRPC_PATH, A2A_AGENT_CARD_PATH } from './discovery.js';
 export type { A2aTarget, ResolveAgentName, AgentEndpointFor, A2aFetch } from './discovery.js';
 export { hashPushPayload, deliverPush, verifyPushEnvelope } from './push.js';
+export { AP_SUBJECT_ASK_EXTENSION_URI, validateSubjectAsk, subjectAsk, subjectAnswer } from './subject-ask.js';
+export { AP_HANDOFF_EXTENSION_URI, validateHandoff, handoff } from './handoff.js';
+export { AP_ENGAGEMENT_EXTENSION_URI, ENGAGEMENT_CARD_EXTENSION, validateEngagementProbe, validateEngagementResponse, engagementProbeMessage, engagementResponseMessage, engagementOf } from './engagement.js';
+export type { EngagementWireDocument } from './engagement.js';
+export type { HandoffV1 } from './handoff.js';
+export type { SubjectAskV1, SubjectAnswerV1 } from './subject-ask.js';
 export type { PushPayload, PushEnvelope, TerminalSigner, PushSender } from './push.js';
 export { SSE_HEADERS, formatSseEvent, formatSseComment, isStreamEnd } from './sse.js';
 export type { PushConfig } from './types.js';
+export { SESSION_WRAPPED_SIG_TYPE, wrapSessionSignature, parseSessionWrappedSignature, wireToDelegation, delegationToWire, checkSessionWireShape, verifySessionWrappedSignature, verifySessionLeafSignatureAt, sessionBodyHash, } from './session-wire.js';
+export type { DelegationWireV1 } from './session-wire.js';
+export { verifyDelegationWire, delegationOfWire } from './wire-verify.js';
+export type { DelegationWireLike, WireChecks } from './wire-verify.js';
+export { a2aEndpointOf, subjectAskMessage, subjectAskOf, SUBJECT_ANSWER_ARTIFACT, routedRunRefFor, subjectEnvelopeOf, sendSubjectAskOverWire, subjectAnswerMessage, subjectAnswerOf, handoffMessage, handoffOf, subjectAnswerEnvelope, subjectAnswerArtifact } from './subject-hop.js';
+export type { SubjectHopInput, SubjectHopOutcome, SubjectAnswerEnvelopeV1 } from './subject-hop.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,YAAY,2BAA2B,CAAC;AACrD,eAAO,MAAM,cAAc,EAAG,4BAAqC,CAAC;AACpE,eAAO,MAAM,QAAQ,iDAAiD,CAAC;AAGvE,YAAY,EACV,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,WAAW,EACX,UAAU,EACV,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGzD,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1H,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChF,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGnF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACnI,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG9F,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC7E,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACtF,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,YAAY,2BAA2B,CAAC;AACrD,eAAO,MAAM,cAAc,EAAG,4BAAqC,CAAC;AACpE,eAAO,MAAM,QAAQ,iDAAiD,CAAC;AAGvE,YAAY,EACV,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,WAAW,EACX,UAAU,EACV,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGzD,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzI,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxF,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAM7I,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEpH,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC9K,YAAY,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChF,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGtH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACxG,YAAY,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACxL,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACzG,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG9F,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG7E,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE/G,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAElF,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/M,YAAY,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACtF,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,6BAA6B,EAC7B,4BAA4B,EAC5B,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACvR,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -8,19 +8,40 @@ export const SPEC_REF = 'specs/269-async-delegation-authorized-a2a.md';
 export { TERMINAL_STATES, isTerminal } from './types.js';
 export { createInMemoryTaskStore } from './task-store.js';
 export { AuthRequired, HandoffRequested, buildSkillRegistry } from './skill-handler.js';
+// ADR-0059 / spec 341 §2.1 — the Card declares HOW to authenticate. Not a stock `securityScheme`:
+// those are bearer-shaped, and here the grant is an SA-bound, signature-verified, on-chain-revocable
+// delegation re-checked at the moment of acting (ADR-0041). Declaring the nearest OAuth-ish scheme to
+// look compliant would assert something false about the substrate.
+export { apAuthorityExtension, activatesApAuthority, AP_AUTHORITY_EXTENSION_URI, A2A_EXTENSIONS_HEADER, } from './authority-extension.js';
+// Spec 414 A1c — the run-provenance extension (PROV-AQ on the A2A wire) and its Link header.
+export { RUN_PROVENANCE_EXTENSION_URI, PROV_AQ_HAS_PROVENANCE, PROV_AQ_HAS_QUERY_SERVICE, runProvenanceExtension, provenanceLinkHeader } from './run-provenance-extension.js';
+export { X402_EXTENSION_URI, x402AgentCardExtension, buildPaymentRequiredMetadata, buildPaymentSettledMetadata, gateSkillPayment, } from './payment-gate.js';
 // Runtime
 export { newTaskRecord, applyTransition, dispatchTask } from './runtime.js';
 // Scoped-grant caveat builders (W2 / FR-4.2)
 export { A2A_ANY_SKILL, skillSelector, buildA2aGrantCaveats } from './grant.js';
 // Delegation-auth gate (W2 / FR-4)
-export { authorizeA2aMessage, hashA2aMessage, decodeTimestampTerms, decodeAllowedTargetsTerms, decodeAllowedMethodsTerms, } from './auth.js';
+export { authorizeA2aMessage, hashA2aMessage, hashA2aTaskRequest, hashPushConfigParams, hashArtifactParams, decodeTimestampTerms, decodeAllowedTargetsTerms, decodeAllowedMethodsTerms, } from './auth.js';
 // Embeddable agent + JSON-RPC + client (W3)
 export { createA2aAgent } from './agent.js';
-export { dispatchA2aRpc, handleA2aRpcBody } from './jsonrpc.js';
+// Card-audience authentication (spec 338 §8, W4-b) — closes the `?view=authenticated` hole.
+export { PUBLIC_AUDIENCE, createCardAudienceResolver, readCardAudienceClaim } from './card-audience.js';
 export { A2aWireAdapter } from './client.js';
 // Agent discovery (§8) — name → SA → endpoint + agent-card fetch (injected resolvers, ADR-0021)
-export { resolveA2aTarget, fetchAgentCard } from './discovery.js';
+export { resolveA2aTarget, fetchAgentCard, A2A_JSONRPC_PATH, A2A_AGENT_CARD_PATH } from './discovery.js';
 // Delivery — signed push + SSE (W4)
 export { hashPushPayload, deliverPush, verifyPushEnvelope } from './push.js';
+// Spec 366 R2 / 367 §8 — the subject-ask application profile (one agent asks another to answer a step about itself).
+export { AP_SUBJECT_ASK_EXTENSION_URI, validateSubjectAsk, subjectAsk, subjectAnswer } from './subject-ask.js';
+// Spec 376 — the hand-off profile (one step, run elsewhere under a child mandate).
+export { AP_HANDOFF_EXTENSION_URI, validateHandoff, handoff } from './handoff.js';
+// Spec 384 W2 — the intent-engagement binding (spec 336 §5): probe/response as messages under one extension URI, never a task.
+export { AP_ENGAGEMENT_EXTENSION_URI, ENGAGEMENT_CARD_EXTENSION, validateEngagementProbe, validateEngagementResponse, engagementProbeMessage, engagementResponseMessage, engagementOf } from './engagement.js';
 export { SSE_HEADERS, formatSseEvent, formatSseComment, isStreamEnd } from './sse.js';
+// ─── Spec 350 §8 — session wires: sign as an identity you do not custody (ONE implementation) ──────
+export { SESSION_WRAPPED_SIG_TYPE, wrapSessionSignature, parseSessionWrappedSignature, wireToDelegation, delegationToWire, checkSessionWireShape, verifySessionWrappedSignature, verifySessionLeafSignatureAt, sessionBodyHash, } from './session-wire.js';
+// ─── Spec 399 §4 promotions — the delegate-key tail every A2A service verifies, and the routed hop ─────
+export { verifyDelegationWire, delegationOfWire } from './wire-verify.js';
+// Spec 366 R4 / 374 §4 / 376 — a routed ask, a delivered answer and a hand-off over the one wire; resolved through the card.
+export { a2aEndpointOf, subjectAskMessage, subjectAskOf, SUBJECT_ANSWER_ARTIFACT, routedRunRefFor, subjectEnvelopeOf, sendSubjectAskOverWire, subjectAnswerMessage, subjectAnswerOf, handoffMessage, handoffOf, subjectAnswerEnvelope, subjectAnswerArtifact } from './subject-hop.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,wGAAwG;AACxG,yGAAyG;AACzG,wGAAwG;AAExG,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,4BAAqC,CAAC;AACpE,MAAM,CAAC,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAavE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAIzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAI1D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExF,UAAU;AACV,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5E,6CAA6C;AAC7C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGhF,mCAAmC;AACnC,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AAGnB,4CAA4C;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,gGAAgG;AAChG,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGlE,oCAAoC;AACpC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE7E,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,wGAAwG;AACxG,yGAAyG;AACzG,wGAAwG;AAExG,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,4BAAqC,CAAC;AACpE,MAAM,CAAC,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAavE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAIzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAI1D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAKxF,kGAAkG;AAClG,qGAAqG;AACrG,sGAAsG;AACtG,mEAAmE;AACnE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,6FAA6F;AAC7F,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE9K,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,UAAU;AACV,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5E,6CAA6C;AAC7C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGhF,mCAAmC;AACnC,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AAGnB,4CAA4C;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,4FAA4F;AAC5F,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAYxG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,gGAAgG;AAChG,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGzG,oCAAoC;AACpC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE7E,qHAAqH;AACrH,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/G,mFAAmF;AACnF,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAClF,+HAA+H;AAC/H,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAK/M,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGtF,sGAAsG;AACtG,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,6BAA6B,EAC7B,4BAA4B,EAC5B,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAG3B,0GAA0G;AAC1G,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE1E,6HAA6H;AAC7H,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/payment-gate.d.ts

@@ -0,0 +1,88 @@
+import type { A2aMessage } from './types.js';
+/** PAY-A2A-1 — a skill declares its price in its descriptor. `price.amount` is atomic units (string for
+ *  wire-safety); `asset`/`payee` are addresses. `rail` is the registered rail name (e.g. 'x402'). */
+export interface SkillPayment {
+    rail: string;
+    price: {
+        amount: string;
+        asset: string;
+    };
+    payee: string;
+}
+export type X402PaymentStatus = 'payment-required' | 'payment-submitted' | 'payment-verified' | 'payment-completed' | 'payment-failed';
+/** The `x402.payment.*` task metadata (a2a-x402 v0.2). `required`/`payload`/`receipts` are OPAQUE to
+ *  a2a — the app fills them from `@agenticprimitives/payments` (PaymentRequired body / client payload /
+ *  settlement receipts). Granular status lives here, never in the A2A TaskState machine. */
+export interface X402PaymentMetadata {
+    'x402.payment.status': X402PaymentStatus;
+    'x402.payment.required'?: unknown;
+    'x402.payment.payload'?: unknown;
+    'x402.payment.receipts'?: unknown[];
+}
+/** X402-D8 — the ONE access lane a request was served by. The gate picks exactly one. */
+export type PaymentLane = 'grant' | 'entitlement' | 'settlement';
+export interface PaymentGateDecision {
+    satisfied: boolean;
+    /** Which lane satisfied it (audit + so the handler knows whether a tx happened). */
+    via?: PaymentLane;
+    /** When NOT satisfied: the PaymentRequired body to park (opaque; app-built from payments PAY-WIRE-1). */
+    required?: unknown;
+    /** When satisfied via a fresh settlement: the receipt ref to attach to the result. */
+    receiptRef?: unknown;
+    /** When satisfied via a live entitlement: the consumption ref (the app consumed one use — no tx). */
+    entitlementConsumption?: unknown;
+}
+/** The injected gate. The app wires the payments x402 rail + entitlement store. a2a only asks:
+ *  "is this priced request paid?" and acts on the verdict. X402-D8: the gate decides ONE lane —
+ *  a standing grant, a LIVE entitlement (`entitlementRef`, consume one use, no settlement), or a
+ *  fresh settlement — never two. */
+export interface PaymentGate {
+    check(args: {
+        skill: string;
+        payment: SkillPayment;
+        message: A2aMessage;
+        payload?: unknown;
+        /** Opaque ref the client presents to redeem a pre-paid entitlement / bearer voucher (no new tx).
+         *  The app resolves + consumes it via `@agenticprimitives/payments` entitlement/voucher. */
+        entitlementRef?: unknown;
+    }): Promise<PaymentGateDecision>;
+}
+/** PAY-A2A-4 — the agent-card extension a priced agent advertises in `capabilities.extensions[]`.
+ *  Clients activate via the `X-A2A-Extensions` header. */
+export declare const X402_EXTENSION_URI = "https://github.com/google-a2a/a2a-x402/v0.1";
+export declare function x402AgentCardExtension(): {
+    uri: string;
+    required: boolean;
+    description: string;
+};
+/** Build the `x402.payment.*` metadata for an `input-required` park (PAY-A2A-2). */
+export declare function buildPaymentRequiredMetadata(required: unknown): X402PaymentMetadata;
+/** Build the settled metadata to append once a payment clears (status + receipts). */
+export declare function buildPaymentSettledMetadata(receipts: unknown[]): X402PaymentMetadata;
+/**
+ * PAY-A2A-3 — the payment middleware. Run BEFORE `handler.handle`. Returns:
+ *  - `{ proceed: true, receiptRef? }` when the skill is free, or paid (the gate settled it), or no gate
+ *    is wired — the handler then runs.
+ *  - `{ proceed: false, parkMetadata }` when payment is required — the caller parks the task
+ *    `input-required` and attaches `parkMetadata` (`x402.payment.*`), WITHOUT running the handler.
+ *
+ * Fail-closed: a priced skill with a gate that returns not-satisfied NEVER reaches the handler.
+ */
+export declare function gateSkillPayment(args: {
+    payment?: SkillPayment;
+    gate?: PaymentGate;
+    skill: string;
+    message: A2aMessage;
+    payload?: unknown;
+    /** Opaque pre-paid entitlement / voucher ref the client presents (X402-D8 entitlement lane). */
+    entitlementRef?: unknown;
+}): Promise<{
+    proceed: true;
+    via?: PaymentLane;
+    receiptRef?: unknown;
+    entitlementConsumption?: unknown;
+} | {
+    proceed: false;
+    parkMetadata: X402PaymentMetadata;
+}>;
+//# sourceMappingURL=payment-gate.d.ts.map

package/dist/payment-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-gate.d.ts","sourceRoot":"","sources":["../src/payment-gate.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;qGACqG;AACrG,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,mBAAmB,GACnB,gBAAgB,CAAC;AAErB;;4FAE4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,qBAAqB,EAAE,iBAAiB,CAAC;IACzC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,uBAAuB,CAAC,EAAE,OAAO,EAAE,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,YAAY,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,oFAAoF;IACpF,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sFAAsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qGAAqG;IACrG,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;oCAGoC;AACpC,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,IAAI,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,YAAY,CAAC;QACtB,OAAO,EAAE,UAAU,CAAC;QACpB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB;oGAC4F;QAC5F,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAClC;AAED;0DAC0D;AAC1D,eAAO,MAAM,kBAAkB,gDAAgD,CAAC;AAChF,wBAAgB,sBAAsB,IAAI;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAEhG;AAED,oFAAoF;AACpF,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,OAAO,GAAG,mBAAmB,CAEnF;AAED,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAEpF;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gGAAgG;IAChG,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CACP;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,WAAW,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5F;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,YAAY,EAAE,mBAAmB,CAAA;CAAE,CACxD,CAcA"}

package/dist/payment-gate.js

@@ -0,0 +1,47 @@
+// Spec 272 PAY-A2A — payment-gated A2A skills (a2a-x402 v0.2 shape). a2a stays transport-agnostic and
+// CANNOT import `payments` (package boundary) — so the concrete x402 rail is INJECTED via a `PaymentGate`
+// (the same pattern as the runtime's enforcers/checks). A priced skill invoked without a satisfied
+// payment parks in the EXISTING `input-required` task state with `x402.payment.*` metadata — NO new
+// TaskState (PAY-A2A-2). Payment is MIDDLEWARE: skill handlers never see raw x402 wire objects, only
+// "payment satisfied" + a receipt ref (PAY-A2A-6).
+/** PAY-A2A-4 — the agent-card extension a priced agent advertises in `capabilities.extensions[]`.
+ *  Clients activate via the `X-A2A-Extensions` header. */
+export const X402_EXTENSION_URI = 'https://github.com/google-a2a/a2a-x402/v0.1';
+export function x402AgentCardExtension() {
+    return { uri: X402_EXTENSION_URI, required: false, description: 'x402 pay-per-use for priced skills' };
+}
+/** Build the `x402.payment.*` metadata for an `input-required` park (PAY-A2A-2). */
+export function buildPaymentRequiredMetadata(required) {
+    return { 'x402.payment.status': 'payment-required', 'x402.payment.required': required };
+}
+/** Build the settled metadata to append once a payment clears (status + receipts). */
+export function buildPaymentSettledMetadata(receipts) {
+    return { 'x402.payment.status': 'payment-completed', 'x402.payment.receipts': receipts };
+}
+/**
+ * PAY-A2A-3 — the payment middleware. Run BEFORE `handler.handle`. Returns:
+ *  - `{ proceed: true, receiptRef? }` when the skill is free, or paid (the gate settled it), or no gate
+ *    is wired — the handler then runs.
+ *  - `{ proceed: false, parkMetadata }` when payment is required — the caller parks the task
+ *    `input-required` and attaches `parkMetadata` (`x402.payment.*`), WITHOUT running the handler.
+ *
+ * Fail-closed: a priced skill with a gate that returns not-satisfied NEVER reaches the handler.
+ */
+export async function gateSkillPayment(args) {
+    if (!args.payment)
+        return { proceed: true }; // free skill
+    if (!args.gate)
+        return { proceed: true }; // no rail wired (dev / unpriced deployment) — app opts in
+    const decision = await args.gate.check({
+        skill: args.skill,
+        payment: args.payment,
+        message: args.message,
+        payload: args.payload,
+        entitlementRef: args.entitlementRef,
+    });
+    if (decision.satisfied) {
+        return { proceed: true, via: decision.via, receiptRef: decision.receiptRef, entitlementConsumption: decision.entitlementConsumption };
+    }
+    return { proceed: false, parkMetadata: buildPaymentRequiredMetadata(decision.required) };
+}
+//# sourceMappingURL=payment-gate.js.map

package/dist/payment-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-gate.js","sourceRoot":"","sources":["../src/payment-gate.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,0GAA0G;AAC1G,mGAAmG;AACnG,oGAAoG;AACpG,qGAAqG;AACrG,mDAAmD;AA4DnD;0DAC0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAChF,MAAM,UAAU,sBAAsB;IACpC,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;AACzG,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,4BAA4B,CAAC,QAAiB;IAC5D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC;AAC1F,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,2BAA2B,CAAC,QAAmB;IAC7D,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC;AAC3F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAQtC;IAIC,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa;IAC1D,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,0DAA0D;IACpG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB,EAAE,CAAC;IACxI,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3F,CAAC"}

package/dist/run-provenance-extension.d.ts

@@ -0,0 +1,22 @@
+export declare const RUN_PROVENANCE_EXTENSION_URI: "https://agenticprimitives.dev/a2a/extensions/run-provenance/v1";
+/** The PROV-AQ link relations (W3C Note PROV-AQ §3) a response may also carry as HTTP `Link` headers. */
+export declare const PROV_AQ_HAS_PROVENANCE: "http://www.w3.org/ns/prov#has_provenance";
+export declare const PROV_AQ_HAS_QUERY_SERVICE: "http://www.w3.org/ns/prov#has_query_service";
+export interface RunProvenanceExtension {
+    uri: typeof RUN_PROVENANCE_EXTENSION_URI;
+    required: false;
+    description: string;
+    params: {
+        /** Where on a task / message the pointer rides. */
+        metadataKey: 'hasProvenance';
+        /** The standards the record is written in (ids as pinned in the publisher's standards lock). */
+        conformsTo: readonly string[];
+        /** The record's serializations the query service returns. */
+        formats: readonly ('json-ld' | 'prov-n')[];
+    };
+}
+export declare function runProvenanceExtension(): RunProvenanceExtension;
+/** A PROV-AQ `Link` header value: the run's provenance IRI (`has_provenance`) and the query service that returns
+ *  it (`has_query_service`). The provenance IRI names the bundle; the service is where a reader with standing asks. */
+export declare function provenanceLinkHeader(bundleIri: string, queryService: string): string;
+//# sourceMappingURL=run-provenance-extension.d.ts.map

package/dist/run-provenance-extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-provenance-extension.d.ts","sourceRoot":"","sources":["../src/run-provenance-extension.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,4BAA4B,EAAG,gEAAyE,CAAC;AAEtH,yGAAyG;AACzG,eAAO,MAAM,sBAAsB,EAAG,0CAAmD,CAAC;AAC1F,eAAO,MAAM,yBAAyB,EAAG,6CAAsD,CAAC;AAEhG,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,OAAO,4BAA4B,CAAC;IACzC,QAAQ,EAAE,KAAK,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,mDAAmD;QACnD,WAAW,EAAE,eAAe,CAAC;QAC7B,gGAAgG;QAChG,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;QAC9B,6DAA6D;QAC7D,OAAO,EAAE,SAAS,CAAC,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;KAC5C,CAAC;CACH;AAED,wBAAgB,sBAAsB,IAAI,sBAAsB,CAO/D;AAED;uHACuH;AACvH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEpF"}

package/dist/run-provenance-extension.js

@@ -0,0 +1,23 @@
+// THE RUN-PROVENANCE EXTENSION (spec 414 A1c) — an A2A 1.0 extension a Card declares so a peer knows that every task
+// and message this agent answers says WHERE ITS PROVENANCE IS, and in which standards. It is PROV-AQ carried on the
+// A2A wire: the metadata names the provenance record (`hasProvenance: { agent, recordType }`) and the service that
+// returns it; the record itself is a W3C PROV-O / P-Plan / EP-Plan graph in JSON-LD, validated by published SHACL
+// shapes. Declaring it grants nothing and asks nothing of the caller: a peer that ignores it loses only the pointer.
+export const RUN_PROVENANCE_EXTENSION_URI = 'https://agenticprimitives.dev/a2a/extensions/run-provenance/v1';
+/** The PROV-AQ link relations (W3C Note PROV-AQ §3) a response may also carry as HTTP `Link` headers. */
+export const PROV_AQ_HAS_PROVENANCE = 'http://www.w3.org/ns/prov#has_provenance';
+export const PROV_AQ_HAS_QUERY_SERVICE = 'http://www.w3.org/ns/prov#has_query_service';
+export function runProvenanceExtension() {
+    return {
+        uri: RUN_PROVENANCE_EXTENSION_URI,
+        required: false,
+        description: 'Every task and message this agent answers names where its run provenance is (PROV-AQ). The record is a W3C PROV-O / P-Plan / EP-Plan graph (JSON-LD) in the acting agent\'s own store, read under the asker\'s standing; evidence, never authority.',
+        params: { metadataKey: 'hasProvenance', conformsTo: ['prov-o', 'p-plan', 'ep-plan', 'json-ld', 'shacl', 'prov-aq'], formats: ['json-ld', 'prov-n'] },
+    };
+}
+/** A PROV-AQ `Link` header value: the run's provenance IRI (`has_provenance`) and the query service that returns
+ *  it (`has_query_service`). The provenance IRI names the bundle; the service is where a reader with standing asks. */
+export function provenanceLinkHeader(bundleIri, queryService) {
+    return `<${bundleIri}>; rel="${PROV_AQ_HAS_PROVENANCE}", <${queryService}>; rel="${PROV_AQ_HAS_QUERY_SERVICE}"`;
+}
+//# sourceMappingURL=run-provenance-extension.js.map

package/dist/run-provenance-extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-provenance-extension.js","sourceRoot":"","sources":["../src/run-provenance-extension.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,oHAAoH;AACpH,mHAAmH;AACnH,kHAAkH;AAClH,qHAAqH;AACrH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gEAAyE,CAAC;AAEtH,yGAAyG;AACzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,0CAAmD,CAAC;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,6CAAsD,CAAC;AAgBhG,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,GAAG,EAAE,4BAA4B;QACjC,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,qPAAqP;QAClQ,MAAM,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;KACrJ,CAAC;AACJ,CAAC;AAED;uHACuH;AACvH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,YAAoB;IAC1E,OAAO,IAAI,SAAS,WAAW,sBAAsB,OAAO,YAAY,WAAW,yBAAyB,GAAG,CAAC;AAClH,CAAC"}

package/dist/runtime.d.ts

@@ -4,6 +4,7 @@ import type { Delegation } from '@agenticprimitives/delegation';
 import type { TaskRecord, TaskState, TaskEvent, A2aMessage } from './types.js';
 import { isTerminal } from './types.js';
 import { type SkillContext, type SkillHandler } from './skill-handler.js';
+import { type PaymentGate } from './payment-gate.js';
 /** Build a fresh `submitted` task record from a verified inbound message + grant. */
 export declare function newTaskRecord(args: {
     taskId: Hex;
@@ -40,11 +41,22 @@ export declare function applyTransition(record: TaskRecord, to: TaskState, opts?
  * caller (alarm loop) persists the record and fans the events to streams/push. `makeContext` wires the
  * per-task vault / mcp / emitArtifact (W4) — the runtime stays transport-agnostic.
  */
-export declare function dispatchTask(record: TaskRecord, registry: Map<string, SkillHandler>, makeContext: (record: TaskRecord) => Omit<SkillContext, 'requestAuth' | 'requestHandoff' | 'principal' | 'sender' | 'taskId' | 'skill'> & {
+/**
+ * Skill lookup. A `Map` satisfies this, which is the point — widening the parameter from `Map` to
+ * the one accessor the runtime actually calls lets an integrator serve a FAMILY of methods whose
+ * members are not known when the registry is built (an agent hosting a set of archetypes defined in
+ * its own library, say) without this file knowing anything about that.
+ */
+export interface SkillLookup {
+    get(skill: string): SkillHandler | undefined;
+}
+export declare function dispatchTask(record: TaskRecord, registry: SkillLookup, makeContext: (record: TaskRecord) => Omit<SkillContext, 'requestAuth' | 'requestHandoff' | 'principal' | 'sender' | 'taskId' | 'skill'> & {
     input: unknown;
     delegation: Delegation;
 }, now: number, opts?: {
     handoffPolicy?: HandoffPolicy;
+    paymentGate?: PaymentGate;
+    entitlementRef?: unknown;
 }): Promise<{
     record: TaskRecord;
     events: TaskEvent[];

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuC,KAAK,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACzG,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAkC,KAAK,YAAY,EAAE,KAAK,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAE5H,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,MAAM,EAAE,GAAG,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,UAAU,CAAC;IACpB,kBAAkB,EAAE,GAAG,CAAC;IACxB,SAAS,EAAE,GAAG,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,GAAG,CAAC;CACpB,GAAG,UAAU,CAuBb;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;+FAC+F;AAC/F,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,SAAS,EACb,IAAI,GAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAe,GACjD,gBAAgB,CAalB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EACnC,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,gBAAgB,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,EACpL,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,aAAa,CAAA;CAAE,GACvC,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,SAAS,EAAE,CAAA;CAAE,CAAC,CAkFtD;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuC,KAAK,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACzG,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAkC,KAAK,YAAY,EAAE,KAAK,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEvE,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,MAAM,EAAE,GAAG,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,UAAU,CAAC;IACpB,kBAAkB,EAAE,GAAG,CAAC;IACxB,SAAS,EAAE,GAAG,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,GAAG,CAAC;CACpB,GAAG,UAAU,CAuBb;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;+FAC+F;AAC/F,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,SAAS,EACb,IAAI,GAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAe,GACjD,gBAAgB,CAalB;AAED;;;;;GAKG;AACH;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;CAC9C;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,WAAW,EACrB,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,gBAAgB,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,EACpL,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5F,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,SAAS,EAAE,CAAA;CAAE,CAAC,CAkHtD;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/runtime.js

@@ -6,6 +6,7 @@
 import { canTaskTransition, isHandoffAllowed } from '@agenticprimitives/fulfillment';
 import { isTerminal } from './types.js';
 import { AuthRequired, HandoffRequested } from './skill-handler.js';
+import { gateSkillPayment } from './payment-gate.js';
 /** Build a fresh `submitted` task record from a verified inbound message + grant. */
 export function newTaskRecord(args) {
     return {
@@ -49,18 +50,13 @@ export function applyTransition(record, to, opts = { now: 0 }) {
     };
     return { ok: true, record: next, event: { kind: 'task.status', taskId: record.task.taskId, state: to, rev } };
 }
-/**
- * Dispatch a `submitted` task: reject if the skill is unknown; otherwise move it to `working`, run the
- * handler, and map the outcome to the next state. Returns the final record + the ordered events. The
- * caller (alarm loop) persists the record and fans the events to streams/push. `makeContext` wires the
- * per-task vault / mcp / emitArtifact (W4) — the runtime stays transport-agnostic.
- */
 export async function dispatchTask(record, registry, makeContext, now, opts) {
     const events = [];
     if (record.task.state !== 'submitted') {
         return { record, events };
     }
     const handler = registry.get(record.skill);
+    console.log('[a2a dispatchTask]', record.skill, handler ? 'handler found' : 'NO HANDLER');
     if (!handler) {
         const rejected = applyTransition(record, 'rejected', { now, error: `unknown skill: ${record.skill}` });
         if (rejected.ok) {
@@ -75,6 +71,29 @@ export async function dispatchTask(record, registry, makeContext, now, opts) {
     let cur = working.record;
     events.push(working.event);
     const base = makeContext(cur);
+    // A2A-5 (seam audit): a PRICED skill is gated BEFORE its handler runs. Previously the gate was declared
+    // + exported but NEVER invoked, so priced skills executed for free. gateSkillPayment now runs here; on
+    // not-satisfied the task parks `input-required` (a legal working→input-required transition) and the
+    // handler is NOT run (fail-closed). A free skill (no `payment`) proceeds unchanged. The construction
+    // guard in createA2aAgent additionally forbids registering a priced handler with no gate wired.
+    if (handler.payment) {
+        const gated = await gateSkillPayment({
+            payment: handler.payment,
+            gate: opts?.paymentGate,
+            skill: cur.skill,
+            message: cur.inbound[cur.inbound.length - 1],
+            payload: base.input,
+            entitlementRef: opts?.entitlementRef,
+        });
+        if (!gated.proceed) {
+            const parked = applyTransition(cur, 'input-required', { now });
+            if (parked.ok) {
+                events.push(parked.event);
+                return { record: parked.record, events };
+            }
+            return { record: cur, events };
+        }
+    }
     const ctx = {
         ...base,
         taskId: cur.task.taskId,
@@ -104,10 +123,16 @@ export async function dispatchTask(record, registry, makeContext, now, opts) {
             // FR-3.6 / FLF-INV-09 — gate the reassignment on the agent's HandoffPolicy + the hop budget;
             // fail-closed: no policy, a disallowed target, or an exhausted hop budget rejects the task.
             const req = e.request;
-            const hops = (cur.hopCount ?? 0) + 1;
-            const ok = opts?.handoffPolicy
-                && isHandoffAllowed(opts.handoffPolicy, req.target, req.targetClass)
-                && hops <= opts.handoffPolicy.maxHopCount;
+            const priorHops = cur.hopCount ?? 0;
+            const hops = priorHops + 1;
+            // NEW-FLF-1: isHandoffAllowed now enforces the full HandoffPolicy (target/class, scopes, hop
+            // budget, approval, privacy tier). We pass the current (pre-handoff) hop count so it gates the
+            // maxHopCount cap itself; the external hop comparison is gone.
+            const ok = !!opts?.handoffPolicy
+                && isHandoffAllowed(opts.handoffPolicy, req.target, {
+                    targetClass: req.targetClass,
+                    hopCount: priorHops,
+                });
             if (!ok) {
                 // The handler is mid-processing (`working`), so the illegal handoff fails the task (working→failed;
                 // working→rejected is not a legal transition). Fail-closed.

package/dist/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,wGAAwG;AACxG,wGAAwG;AACxG,0GAA0G;AAC1G,4GAA4G;AAC5G,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAsB,MAAM,gCAAgC,CAAC;AAIzG,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAA0D,MAAM,oBAAoB,CAAC;AAE5H,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,IAc7B;IACC,OAAO;QACL,IAAI,EAAE;YACJ,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC;YAChC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;QACvB,SAAS,EAAE,EAAE;QACb,GAAG,EAAE,CAAC;QACN,SAAS,EAAE,IAAI,CAAC,GAAG;KACpB,CAAC;AACJ,CAAC;AAMD;+FAC+F;AAC/F,MAAM,UAAU,eAAe,CAC7B,MAAkB,EAClB,EAAa,EACb,OAAwC,EAAE,GAAG,EAAE,CAAC,EAAE;IAElD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IAC/B,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAClE,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,IAAI,OAAO,EAAE,EAAE,EAAE,CAAC;IACtG,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAe;QACvB,GAAG,MAAM;QACT,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACnC,KAAK,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;QAClD,GAAG;QACH,SAAS,EAAE,IAAI,CAAC,GAAG;KACpB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;AAChH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,QAAmC,EACnC,WAAoL,EACpL,GAAW,EACX,IAAwC;IAExC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,kBAAkB,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3C,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAE3B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAiB;QACxB,GAAG,IAAI;QACP,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;QACvB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,CAAC,MAAc,EAAS,EAAE;YACrC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,cAAc,EAAE,CAAC,GAAG,EAAS,EAAE;YAC7B,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;IAEF,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YAAC,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC;YAClC,6FAA6F;YAC7F,4FAA4F;YAC5F,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC;YACtB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,EAAE,GAAG,IAAI,EAAE,aAAa;mBACzB,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;mBACjE,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,oGAAoG;gBACpG,4DAA4D;gBAC5D,MAAM,MAAM,GAAG,0BAA0B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACvG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACpE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;gBAAC,CAAC;gBACvG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACjC,CAAC;YACD,iGAAiG;YACjG,oEAAoE;YACpE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;YAAC,CAAC;YACtH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1G,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC;QACvF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,kCAAkC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC;QACvF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IACD,GAAG,GAAG,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,WAAW;QACtD,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE;QAC9E,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACb,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,wGAAwG;AACxG,wGAAwG;AACxG,0GAA0G;AAC1G,4GAA4G;AAC5G,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAsB,MAAM,gCAAgC,CAAC;AAIzG,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAA0D,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EAAE,gBAAgB,EAAoB,MAAM,mBAAmB,CAAC;AAEvE,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,IAc7B;IACC,OAAO;QACL,IAAI,EAAE;YACJ,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC;YAChC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;QACvB,SAAS,EAAE,EAAE;QACb,GAAG,EAAE,CAAC;QACN,SAAS,EAAE,IAAI,CAAC,GAAG;KACpB,CAAC;AACJ,CAAC;AAMD;+FAC+F;AAC/F,MAAM,UAAU,eAAe,CAC7B,MAAkB,EAClB,EAAa,EACb,OAAwC,EAAE,GAAG,EAAE,CAAC,EAAE;IAElD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IAC/B,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAClE,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,IAAI,OAAO,EAAE,EAAE,EAAE,CAAC;IACtG,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAe;QACvB,GAAG,MAAM;QACT,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACnC,KAAK,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;QAClD,GAAG;QACH,SAAS,EAAE,IAAI,CAAC,GAAG;KACpB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;AAChH,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,QAAqB,EACrB,WAAoL,EACpL,GAAW,EACX,IAA6F;IAE7F,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,kBAAkB,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3C,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAE3B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE9B,wGAAwG;IACxG,uGAAuG;IACvG,oGAAoG;IACpG,qGAAqG;IACrG,gGAAgG;IAChG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC;YACnC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,IAAI,EAAE,WAAW;YACvB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE;YAC7C,OAAO,EAAE,IAAI,CAAC,KAAK;YACnB,cAAc,EAAE,IAAI,EAAE,cAAc;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YAC3C,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAiB;QACxB,GAAG,IAAI;QACP,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;QACvB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,CAAC,MAAc,EAAS,EAAE;YACrC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,cAAc,EAAE,CAAC,GAAG,EAAS,EAAE;YAC7B,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;IAEF,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YAAC,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC;YAClC,6FAA6F;YAC7F,4FAA4F;YAC5F,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC;YACtB,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,SAAS,GAAG,CAAC,CAAC;YAC3B,6FAA6F;YAC7F,+FAA+F;YAC/F,+DAA+D;YAC/D,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa;mBAC3B,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;oBAClD,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,QAAQ,EAAE,SAAS;iBACpB,CAAC,CAAC;YACL,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,oGAAoG;gBACpG,4DAA4D;gBAC5D,MAAM,MAAM,GAAG,0BAA0B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACvG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACpE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;gBAAC,CAAC;gBACvG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACjC,CAAC;YACD,iGAAiG;YACjG,oEAAoE;YACpE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;YAAC,CAAC;YACtH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1G,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC;QACvF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,kCAAkC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC;QACvF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IACD,GAAG,GAAG,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,WAAW;QACtD,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE;QAC9E,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACb,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/session-wire.d.ts

@@ -0,0 +1,90 @@
+import { type Address, type Hex } from 'viem';
+import { type Delegation } from '@agenticprimitives/delegation';
+/** The JSON-safe form of a delegation as it travels (bigint salt as a string). */
+export interface DelegationWireV1 {
+    delegator: Address;
+    delegate: Address;
+    authority: Hex;
+    caveats: Array<{
+        enforcer: Address;
+        terms: Hex;
+        args?: Hex;
+    }>;
+    salt: string;
+    signature: Hex;
+}
+/** Signature type byte for the session-wrapped form. Unknown to AgentAccount `_validateSig` (fails closed
+ *  on chain) and to every other verifier — only a gate that calls `verifySessionWrappedSignature` accepts
+ *  it, and only after full verification. */
+export declare const SESSION_WRAPPED_SIG_TYPE = "0x51";
+/** Wrap a raw session-key ECDSA signature with the wire that authorizes it. */
+export declare function wrapSessionSignature(wire: DelegationWireV1, sig: Hex): Hex;
+/** Parse the session-wrapped form; null for any other signature shape (callers then use the standard
+ *  ERC-1271 path — one detector, no ambiguity). */
+export declare function parseSessionWrappedSignature(signature: string): {
+    wire: DelegationWireV1;
+    sig: Hex;
+} | null;
+export declare function wireToDelegation(w: DelegationWireV1): Delegation;
+export declare function delegationToWire(d: Delegation): DelegationWireV1;
+/**
+ * Shape check for a session wire (at ceremony store time AND at every gate hit): timestamp-bounded, a
+ * pinned allowedMethods set that never carries the any-skill sentinel and — when `skill` is given — names
+ * that skill's selector.
+ *
+ * `skill` should be passed wherever the request names one: a wire minted for one rail must not authorize
+ * another. It is omitted only on the read/control path (`tasks/get`, `tasks/cancel`,
+ * `pushNotificationConfig/set`), whose digest binds a method and a taskId, not a skill. That omission is
+ * narrow rather than lax — the wire must still be pinned, live, ERC-1271-valid and unrevoked, and the task
+ * runtime independently requires the caller to BE a party to the task.
+ */
+export declare function checkSessionWireShape(wire: DelegationWireV1, enforcers: {
+    timestamp: string;
+    allowedMethods: string;
+}, nowSec: number, opts?: {
+    skill?: string;
+}): string | null;
+/**
+ * Verify a session-wrapped signature for `signer` over `digest`, fail-closed on every leg. The on-chain
+ * checks are the SAME injected ones the standard gate uses (`OnChainChecks`) — revocation is immediate.
+ * Pass `skill` whenever the request names one.
+ */
+export declare function verifySessionWrappedSignature(args: {
+    signer: Address;
+    digest: Hex;
+    signature: string;
+    enforcers: {
+        timestamp: string;
+        allowedMethods: string;
+    };
+    verifyDelegationSig: (d: Delegation) => Promise<boolean>;
+    isRevoked: (d: Delegation) => Promise<boolean>;
+    /** The skill the inbound message requests. Omit ONLY on the read/control path. */
+    skill?: string;
+    /** Milliseconds (Date.now() shape); injected for determinism. */
+    now?: number;
+}): Promise<boolean>;
+/**
+ * Verify a session-wrapped signature over a digest THAT WAS SIGNED AT A KNOWN TIME — a release, an attestation, anything
+ * that must keep verifying for as long as it is served, long after the time-boxed leaf that signed it expired (spec 412
+ * W5 / spec 413). Every leg of `verifySessionWrappedSignature` except two:
+ *   • the timestamp window is judged AT `at` (when the thing was signed), not now — back-dating widens nothing, because
+ *     the leaf must still verify ERC-1271 against the signer and the key must still recover;
+ *   • no skill selector is required: a message gate asks "may this key send THIS skill"; a signed artifact asks only
+ *     "did the signer's agent sign it while its leaf was live".
+ * Revocation is read NOW: a leaf the custodian revoked stops vouching for anything it ever signed.
+ * Returns null when every leg holds, else the leg that failed, in words. Fail-closed on a chain-read failure.
+ */
+export declare function verifySessionLeafSignatureAt(args: {
+    signer: Address;
+    digest: Hex;
+    signature: string;
+    timestampEnforcer: string;
+    /** When the digest was signed, in milliseconds (Date.now() shape). */
+    at: number;
+    verifyDelegationSig: (d: Delegation) => Promise<boolean>;
+    isRevoked: (d: Delegation) => Promise<boolean>;
+}): Promise<string | null>;
+/** keccak over stable-JSON — the a2a body-hash convention (equals the task runtime's `hashBody`). */
+export declare const sessionBodyHash: (data: unknown) => Hex;
+//# sourceMappingURL=session-wire.d.ts.map