@agenticprimitives/a2a 0.0.0-alpha.4 → 0.0.0-alpha.40

package/dist/subject-hop.js

@@ -0,0 +1,187 @@
+// A ROUTED ASK ACROSS DEPLOYMENTS — spec 366 R4 / 374 §4 / 376. Promoted from the runtime app in spec 399 W0
+// (§4): the HOP is protocol, every A2A service that routes a step to another agent makes it the same way.
+//
+// Inside one deployment a routed step (spec 366 R1) is made in-process. To an agent served ELSEWHERE the hop
+// is a network call, and it rides the one wire there is (spec 372 S4): an A2A 1.0 `SendMessage` whose
+// `message.metadata` carries the SUBJECT-ASK PROFILE (`SubjectAskV1`), and whose reply comes back as the
+// task's `subject-answer` artifact — the receiver's own ask envelope, verbatim.
+//
+// Resolved through the card, not assumed: the caller says where the card is served, and the CARD says where
+// the agent takes A2A 1.0 requests. A card that publishes no such interface is an agent that cannot be asked
+// this way, and the sender says so — it never reads the subject's records locally instead (R3), and it never
+// guesses a path (ADR-0013).
+//
+// Everything here is pure: the caller supplies `fetch`; nothing reads a store or a chain.
+import { AP_SUBJECT_ASK_EXTENSION_URI, validateSubjectAsk } from './subject-ask.js';
+import { AP_HANDOFF_EXTENSION_URI, validateHandoff } from './handoff.js';
+/** The A2A 1.0 JSON-RPC endpoint a card publishes, or null when it publishes none. */
+export function a2aEndpointOf(card) {
+    // A RELEASED card (the Studio's, signed) states the protocol version ONCE at the top; the live card
+    // states it per interface. Either says 1.x or the interface is not one this hop can use.
+    const top = /^1\./.test(String(card?.protocolVersion ?? ''));
+    const hit = (card?.supportedInterfaces ?? []).find((i) => i.protocolBinding === 'JSONRPC' && (/^1\./.test(String(i.protocolVersion ?? '')) || (i.protocolVersion === undefined && top)) && typeof i.url === 'string' && /^https:\/\//.test(i.url));
+    return hit?.url ?? null;
+}
+const hex32 = () => `0x${[...crypto.getRandomValues(new Uint8Array(32))].map((b) => b.toString(16).padStart(2, '0')).join('')}`;
+/** The message that carries a subject-ask over the wire: the goal as text, the profile as metadata. */
+export function subjectAskMessage(profile) {
+    return {
+        messageId: hex32(),
+        role: 'ROLE_USER',
+        parts: [{ text: profile.request.goal }],
+        extensions: [AP_SUBJECT_ASK_EXTENSION_URI],
+        metadata: { [AP_SUBJECT_ASK_EXTENSION_URI]: profile },
+    };
+}
+/** The subject-ask a received message carries, validated; null when it carries none. */
+export function subjectAskOf(message) {
+    const raw = message.metadata?.[AP_SUBJECT_ASK_EXTENSION_URI];
+    if (raw === undefined)
+        return null;
+    const v = validateSubjectAsk(raw);
+    return v.ok ? { ask: v.ask } : { errors: v.errors };
+}
+export const SUBJECT_ANSWER_ARTIFACT = 'subject-answer';
+/**
+ * Appendix M8 — THE RECEIVER'S RUN, NAMED BY THE SENDER. A routed step's run at the subject's agent is
+ * addressable before it answers, so the sender can read its progress while it runs and its record can
+ * cite it by reference. Derived from the correlation the sender minted; the receiver adopts it for a
+ * fresh ask (a resume names the run it continues instead).
+ */
+export function routedRunRefFor(correlation) {
+    return `routed-${correlation.runRef}-${correlation.stepRef}`.replace(/[^A-Za-z0-9._:-]/g, '_');
+}
+/** The receiver's `/harness/ask` envelope, as the task's `subject-answer` artifact carries it. */
+export function subjectEnvelopeOf(task) {
+    const art = (task?.artifacts ?? []).find((a) => a.name === SUBJECT_ANSWER_ARTIFACT);
+    const part = art?.parts.find((p) => p.data && typeof p.data === 'object' && !Array.isArray(p.data));
+    return part ? part.data : null;
+}
+/**
+ * The hop: fetch the card, take its 1.0 endpoint, send ONE message, read the artifact. A task that ended
+ * without the artifact is relayed in the receiver's status words (a rejection, a need), never retried.
+ */
+export async function sendSubjectAskOverWire(input) {
+    let card = null;
+    try {
+        const res = await input.fetch(input.cardUrl, { method: 'GET', headers: { accept: 'application/json' } });
+        if (!res.ok)
+            return { ok: false, refused: `its card at ${input.cardUrl} answered ${res.status}`, status: res.status };
+        const text = await res.text();
+        if (input.pinnedDigest) {
+            const served = `0x${[...new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text)))].map((b) => b.toString(16).padStart(2, '0')).join('')}`;
+            if (served !== input.pinnedDigest.toLowerCase())
+                return { ok: false, refused: `the card served at ${input.cardUrl} is not the one its name pins (atl:cardDigest ${input.pinnedDigest.slice(0, 12)}…, served ${served.slice(0, 12)}…)` };
+        }
+        card = JSON.parse(text);
+    }
+    catch (e) {
+        return { ok: false, refused: `its card at ${input.cardUrl} could not be read: ${e instanceof Error ? e.message : String(e)}` };
+    }
+    const endpoint = a2aEndpointOf(card);
+    if (!endpoint)
+        return { ok: false, refused: 'its card publishes no A2A 1.0 endpoint this agent can ask' };
+    const rpc = { jsonrpc: '2.0', id: 1, method: 'SendMessage', params: { message: subjectAskMessage(input.profile) } };
+    let res;
+    try {
+        res = await input.fetch(endpoint, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', accept: 'application/json', 'a2a-version': '1.0', ...(input.session ? { authorization: `Bearer ${input.session}` } : {}), ...(input.traceparent ? { traceparent: input.traceparent } : {}), ...(input.tracestate ? { tracestate: input.tracestate } : {}) },
+            body: JSON.stringify(rpc),
+        });
+    }
+    catch (e) {
+        return { ok: false, endpoint, refused: `could not reach ${endpoint}: ${e instanceof Error ? e.message : String(e)}` };
+    }
+    const body = (await res.json().catch(() => null));
+    if (!body)
+        return { ok: false, endpoint, refused: `${endpoint} answered ${res.status} with no JSON-RPC body`, status: res.status };
+    if (body.error)
+        return { ok: false, endpoint, refused: `${endpoint} answered ${body.error.code}: ${body.error.message}`, status: res.status };
+    const task = body.result?.task;
+    if (!task)
+        return { ok: false, endpoint, refused: `${endpoint} answered with a message, not a task`, status: res.status };
+    const envelope = subjectEnvelopeOf(task);
+    if (envelope)
+        return { ok: true, endpoint, task, envelope };
+    const said = (task.status?.message?.parts ?? []).map((p) => (typeof p.text === 'string' ? p.text : '')).filter(Boolean).join(' ');
+    return { ok: false, endpoint, task, refused: `${task.status?.state ?? 'unknown state'}${said ? `: ${said}` : ''}`, status: res.status };
+}
+// ── The answer, delivered (spec 374 §4) ──────────────────────────────────────────────────────────────
+//
+// When a routed ACT finishes at the subject's agent — its steward signed, or refused — the outcome is
+// DELIVERED to the creditor's agent as a message under the same extension URI: a `SubjectAnswerV1` whose
+// `inResponseTo` names the creditor's own correlation. The two payloads share a URI and are told apart
+// by shape (an ask has `request`; an answer has `inResponseTo`), so one metadata key carries both halves
+// of one conversation.
+const isAddr = (v) => typeof v === 'string' && /^0x[0-9a-fA-F]{40}$/.test(v);
+/** The message that delivers a finished routed act's outcome to the creditor's agent. */
+export function subjectAnswerMessage(answer) {
+    return {
+        messageId: hex32(),
+        role: 'ROLE_AGENT',
+        parts: [{ text: answer.said ?? (answer.outcome === 'answer' ? 'Done.' : answer.outcome) }],
+        extensions: [AP_SUBJECT_ASK_EXTENSION_URI],
+        metadata: { [AP_SUBJECT_ASK_EXTENSION_URI]: answer },
+    };
+}
+/** The delivered answer a received message carries, structurally checked; null when it carries none. */
+export function subjectAnswerOf(message) {
+    const raw = message.metadata?.[AP_SUBJECT_ASK_EXTENSION_URI];
+    if (raw === undefined || raw === null || typeof raw !== 'object' || !('inResponseTo' in raw))
+        return null;
+    const errors = [];
+    if (raw.extension !== AP_SUBJECT_ASK_EXTENSION_URI)
+        errors.push(`extension: expected ${AP_SUBJECT_ASK_EXTENSION_URI}`);
+    if (raw.version !== 1)
+        errors.push('version: expected 1');
+    if (!isAddr(raw.agent))
+        errors.push('agent: an address');
+    const r = raw.inResponseTo;
+    if (!r || !['operationId', 'runRef', 'stepRef'].every((k) => typeof r[k] === 'string' && r[k]))
+        errors.push('inResponseTo: { operationId, runRef, stepRef }');
+    if (!['answer', 'refused', 'needs', 'error'].includes(String(raw.outcome)))
+        errors.push('outcome: answer | refused | needs | error');
+    if (!raw.run || typeof raw.run.runRef !== 'string')
+        errors.push('run.runRef: required');
+    return errors.length ? { errors } : { answer: raw };
+}
+// ── The hand-off (spec 376) ───────────────────────────────────────────────────────────────────────────
+//
+// One step, run elsewhere under a child mandate. Rides the one wire as a `SendMessage` whose metadata
+// carries the hand-off profile; the specialist answers with the same `subject-answer` artifact a routed
+// ask does, so the parent reads it with the same reader.
+export function handoffMessage(h) {
+    return {
+        messageId: hex32(),
+        role: 'ROLE_USER',
+        parts: [{ text: h.intent.goal }],
+        extensions: [AP_HANDOFF_EXTENSION_URI],
+        metadata: { [AP_HANDOFF_EXTENSION_URI]: h },
+    };
+}
+export function handoffOf(message) {
+    const raw = message.metadata?.[AP_HANDOFF_EXTENSION_URI];
+    if (raw === undefined)
+        return null;
+    const v = validateHandoff(raw);
+    return v.ok ? { handoff: v.handoff } : { errors: v.errors };
+}
+/**
+ * Shape a skill's result as the envelope the asker's runtime reads. The `toolId` is the capability the ask named (the
+ * asker finds its result by it), else the standard surface's own; the `runRef` is the receiver's run — the one the
+ * sender named (`routedRunRefFor`) unless the receiver had its own.
+ */
+export function subjectAnswerEnvelope(ask, outcome, opts = {}) {
+    const runRef = opts.runRef ?? routedRunRefFor(ask.correlation);
+    if (!outcome.ok)
+        return { ok: false, runRef, error: outcome.error };
+    const toolId = opts.toolId ?? ask.request.capability ?? 'harness.ask';
+    return { ok: true, runRef, reply: { kind: 'answer', runRef, text: outcome.text, results: [{ toolId, result: outcome.result }] } };
+}
+/** The artifact a receiver attaches: `subjectEnvelopeOf(task)` on the asker's side reads exactly this back. */
+/** Any `/harness/ask`-shaped envelope rides here unchanged — a harness's own reply (the runtime) or `subjectAnswerEnvelope`'s. */
+export function subjectAnswerArtifact(envelope) {
+    return { name: SUBJECT_ANSWER_ARTIFACT, parts: [{ data: envelope }] };
+}
+//# sourceMappingURL=subject-hop.js.map

package/dist/subject-hop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-hop.js","sourceRoot":"","sources":["../src/subject-hop.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,0GAA0G;AAC1G,EAAE;AACF,6GAA6G;AAC7G,sGAAsG;AACtG,yGAAyG;AACzG,gFAAgF;AAChF,EAAE;AACF,4GAA4G;AAC5G,6GAA6G;AAC7G,6GAA6G;AAC7G,6BAA6B;AAC7B,EAAE;AACF,0FAA0F;AAC1F,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAA2C,MAAM,kBAAkB,CAAC;AAC7H,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAkB,MAAM,cAAc,CAAC;AAEzF,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,IAAkG;IAC9H,oGAAoG;IACpG,yFAAyF;IACzF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnP,OAAO,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,KAAK,GAAG,GAAW,EAAE,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAExI,uGAAuG;AACvG,MAAM,UAAU,iBAAiB,CAAC,OAAqB;IACrD,OAAO;QACL,SAAS,EAAE,KAAK,EAAE;QAClB,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvC,UAAU,EAAE,CAAC,4BAA4B,CAAC;QAC1C,QAAQ,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE,OAAO,EAAE;KACtD,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,OAAoC;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,4BAA4B,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAExD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAAgD;IAC9E,OAAO,UAAU,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;AACjG,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,iBAAiB,CAAC,IAAkD;IAClF,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAsBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAsB;IACjE,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,KAAK,CAAC,OAAO,aAAa,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QACtH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACtK,IAAI,MAAM,KAAK,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,KAAK,CAAC,OAAO,iDAAiD,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1O,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,KAAK,CAAC,OAAO,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACjI,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,2DAA2D,EAAE,CAAC;IAC1G,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IACpH,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC1S,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA0G,CAAC;IAC3J,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,aAAa,GAAG,CAAC,MAAM,wBAAwB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACnI,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC9I,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,sCAAsC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC1H,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClI,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC1I,CAAC;AAED,wGAAwG;AACxG,EAAE;AACF,sGAAsG;AACtG,yGAAyG;AACzG,uGAAuG;AACvG,yGAAyG;AACzG,uBAAuB;AAEvB,MAAM,MAAM,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEnG,yFAAyF;AACzF,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,OAAO;QACL,SAAS,EAAE,KAAK,EAAE;QAClB,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1F,UAAU,EAAE,CAAC,4BAA4B,CAAC;QAC1C,QAAQ,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE,MAAM,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,eAAe,CAAC,OAAoC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,4BAA4B,CAAyC,CAAC;IACrG,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1G,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,CAAC,SAAS,KAAK,4BAA4B;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,4BAA4B,EAAE,CAAC,CAAC;IACvH,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAmD,CAAC;IAClE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAC9J,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACrI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,OAAQ,GAAG,CAAC,GAA4B,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAsB,EAAE,CAAC;AACzE,CAAC;AAED,yGAAyG;AACzG,EAAE;AACF,sGAAsG;AACtG,wGAAwG;AACxG,yDAAyD;AAEzD,MAAM,UAAU,cAAc,CAAC,CAAY;IACzC,OAAO;QACL,SAAS,EAAE,KAAK,EAAE;QAClB,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,UAAU,EAAE,CAAC,wBAAwB,CAAC;QACtC,QAAQ,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAoC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACzD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC9D,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAkD,EAClD,OAAmF,EACnF,OAA6C,EAAE;IAE/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC;IACtE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;AACpI,CAAC;AAED,+GAA+G;AAC/G,kIAAkI;AAClI,MAAM,UAAU,qBAAqB,CAAoC,QAAW;IAClF,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC"}

package/dist/task-store.d.ts

@@ -1,14 +1,20 @@
 import type { Hex } from '@agenticprimitives/types';
 import type { TaskRecord } from './types.js';
-export interface TaskStore {
+import type { MessageIdReservation, MessageIdReserver } from './auth.js';
+export interface TaskStore extends MessageIdReserver {
     /** Persist (insert or replace) a task record. */
     put(record: TaskRecord): Promise<void>;
     /** Load a task record, or null if unknown. */
     get(taskId: Hex): Promise<TaskRecord | null>;
     /** Task ids in a non-terminal state that are due for processing (drives the alarm loop). */
     listDue(now: number): Promise<Hex[]>;
-    /** Single-use message-id reservation (FR-4.3 inbound replay guard). Returns false if already seen. */
-    reserveMessageId(messageId: Hex, ttlSec: number): Promise<boolean>;
+    /** Every record this store holds, newest first, for enumerating tasks (spec 372 S4 — A2A 1.0's
+     *  `ListTasks`). Optional: a store that cannot enumerate says so by omitting it, and a caller that
+     *  needs a list must not pretend an empty one is an answer. */
+    list?(limit?: number): Promise<TaskRecord[]>;
+    /** Single-use message-id reservation (FR-4.3 inbound replay guard); two-phase per spec 290 §3.
+     *  Returns `null` if already in-flight/consumed, else a reservation to commit (durable) / release. */
+    reserveMessageId(messageId: Hex, ttlSec: number): Promise<MessageIdReservation | null>;
 }
 /** Reference in-memory TaskStore — used by the test harness + non-Worker consumers. NOT for production
  *  (no cross-isolate durability); the Cloudflare DO adapter is the durable implementation. */

package/dist/task-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-store.d.ts","sourceRoot":"","sources":["../src/task-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,SAAS;IACxB,iDAAiD;IACjD,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,8CAA8C;IAC9C,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC7C,4FAA4F;IAC5F,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,sGAAsG;IACtG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED;8FAC8F;AAC9F,wBAAgB,uBAAuB,IAAI,SAAS,CA2BnD"}
+{"version":3,"file":"task-store.d.ts","sourceRoot":"","sources":["../src/task-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEzE,MAAM,WAAW,SAAU,SAAQ,iBAAiB;IAClD,iDAAiD;IACjD,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,8CAA8C;IAC9C,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC7C,4FAA4F;IAC5F,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC;;mEAE+D;IAC/D,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7C;0GACsG;IACtG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACxF;AAED;8FAC8F;AAC9F,wBAAgB,uBAAuB,IAAI,SAAS,CAiCnD"}

package/dist/task-store.js

@@ -19,15 +19,21 @@ export function createInMemoryTaskStore() {
         async listDue() {
             return [...due];
         },
+        async list(limit) {
+            const all = [...tasks.values()].sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0));
+            return limit ? all.slice(0, limit) : all;
+        },
         async reserveMessageId(messageId, ttlSec) {
             const key = messageId.toLowerCase();
-            const exp = seen.get(key);
-            // `now` is injected by callers in tests; here we approximate with a monotonic-free check: a present
-            // entry means used. (The durable adapter uses KV TTL.)
-            if (exp !== undefined)
-                return false;
+            // A present entry means in-flight OR consumed — either way a replay (deny). Otherwise mark in-flight.
+            // (`now`/TTL is approximate in-memory; the durable adapter uses real storage. Two-phase per §290.3:)
+            if (seen.has(key))
+                return null;
             seen.set(key, ttlSec);
-            return true;
+            return {
+                async commit() { seen.set(key, ttlSec); }, // stays present → permanently consumed
+                async release() { seen.delete(key); }, // free the in-flight slot so a legit retry can re-reserve
+            };
         },
     };
 }

package/dist/task-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"task-store.js","sourceRoot":"","sources":["../src/task-store.ts"],"names":[],"mappings":"AAiBA;8FAC8F;AAC9F,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,4BAA4B;IACpE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;gBAClF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,OAAO;YACX,OAAO,CAAC,GAAG,GAAG,CAAU,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM;YACtC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,oGAAoG;YACpG,uDAAuD;YACvD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"task-store.js","sourceRoot":"","sources":["../src/task-store.ts"],"names":[],"mappings":"AAuBA;8FAC8F;AAC9F,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,4BAA4B;IACpE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;gBAClF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,OAAO;YACX,OAAO,CAAC,GAAG,GAAG,CAAU,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM;YACtC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACpC,sGAAsG;YACtG,qGAAqG;YACrG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtB,OAAO;gBACL,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,uCAAuC;gBAClF,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAM,0DAA0D;aACtG,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/wire-verify.d.ts

@@ -0,0 +1,35 @@
+import { type Delegation, type EnforcerAddressMap } from '@agenticprimitives/delegation';
+import type { Address, Hex } from '@agenticprimitives/types';
+/** A delegation as it arrives over JSON: addresses as strings, the bigint salt as a decimal string. The
+ *  typed `DelegationWireV1` is assignable to it; an untrusted body is checked here before it becomes one. */
+export interface DelegationWireLike {
+    delegator: string;
+    delegate: string;
+    authority: Hex;
+    caveats: {
+        enforcer: string;
+        terms: Hex;
+        args?: Hex;
+    }[];
+    salt: string;
+    signature: Hex;
+}
+export interface WireChecks {
+    /** EIP-712 delegation digest. */
+    digest: (d: Delegation) => Hex;
+    /** ERC-1271 / 6492 / ECDSA against the delegator. */
+    erc1271: (signer: Address, digest: Hex, sig: Hex) => Promise<boolean>;
+    /** `DelegationManager.isRevoked`. */
+    isRevoked: (digest: Hex) => Promise<boolean>;
+}
+/** Wire → `Delegation`. Throws on a salt that is not a number; callers that must not throw catch it. */
+export declare function delegationOfWire(wire: DelegationWireLike): Delegation;
+export declare function verifyDelegationWire(input: {
+    wire: DelegationWireLike | undefined;
+    expectedDelegator: string;
+    expectedDelegate: Address;
+    enforcers: EnforcerAddressMap;
+    checks: WireChecks;
+    now?: number;
+}): Promise<boolean>;
+//# sourceMappingURL=wire-verify.d.ts.map

package/dist/wire-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-verify.d.ts","sourceRoot":"","sources":["../src/wire-verify.ts"],"names":[],"mappings":"AAaA,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAC/G,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D;6GAC6G;AAC7G,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,GAAG,CAAC;IACf,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,GAAG,CAAC;QAAC,IAAI,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,iCAAiC;IACjC,MAAM,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,GAAG,CAAC;IAC/B,qDAAqD;IACrD,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,qCAAqC;IACrC,SAAS,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9C;AAED,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,UAAU,CASrE;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,IAAI,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBnB"}

package/dist/wire-verify.js

@@ -0,0 +1,51 @@
+// A DELEGATION WIRE, VERIFIED LIVE — the tail every A2A service repeats when a grant arrives over the wire
+// (spec 350 §8; the `service-agent-signing` rule). Promoted from the runtime app in spec 399 W0 (§4), where
+// four call sites had each written it: delegator/delegate identity, caveat evaluation, revocation, signature.
+//
+// WHAT THIS DECIDES AND WHAT IT DOES NOT. `delegation.verifyLiveDelegation` decides all of it — this is the
+// wire-shaped door to that one decision. It says the wire is live and authentic FROM `expectedDelegator` TO
+// `expectedDelegate`; it says nothing about whether the caveat SHAPE is the one the caller's policy wants
+// (member access vs stewardship, which contracts a wire must pin). That is the product's authorization
+// policy — a positive identity test no generic "required enforcers" list can express. Call this AFTER the
+// shape test, never instead of it.
+//
+// Returns false on every failure path — the callers are boolean gates and must not learn why (the reason
+// would tell a prober which of several wires it is missing).
+import { verifyLiveDelegation } from '@agenticprimitives/delegation';
+/** Wire → `Delegation`. Throws on a salt that is not a number; callers that must not throw catch it. */
+export function delegationOfWire(wire) {
+    return {
+        delegator: wire.delegator,
+        delegate: wire.delegate,
+        authority: wire.authority,
+        caveats: wire.caveats.map((c) => ({ enforcer: c.enforcer, terms: c.terms, args: (c.args ?? '0x') })),
+        salt: BigInt(wire.salt),
+        signature: wire.signature,
+    };
+}
+export async function verifyDelegationWire(input) {
+    const w = input.wire;
+    if (!w?.signature || !w.delegator || !w.delegate)
+        return false;
+    let delegation;
+    try {
+        delegation = delegationOfWire(w);
+    }
+    catch {
+        return false; // BigInt(salt) on garbage
+    }
+    const r = await verifyLiveDelegation({
+        delegation,
+        expectedDelegator: input.expectedDelegator,
+        expectedDelegate: input.expectedDelegate,
+        enforcers: input.enforcers,
+        now: input.now ?? Math.floor(Date.now() / 1000),
+        checks: {
+            delegationDigest: input.checks.digest,
+            isRevoked: async (d) => input.checks.isRevoked(input.checks.digest(d)),
+            verifySignature: async ({ signer, digest, signature }) => input.checks.erc1271(signer, digest, signature),
+        },
+    });
+    return r.ok;
+}
+//# sourceMappingURL=wire-verify.js.map

package/dist/wire-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-verify.js","sourceRoot":"","sources":["../src/wire-verify.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,4GAA4G;AAC5G,8GAA8G;AAC9G,EAAE;AACF,4GAA4G;AAC5G,4GAA4G;AAC5G,0GAA0G;AAC1G,uGAAuG;AACvG,0GAA0G;AAC1G,mCAAmC;AACnC,EAAE;AACF,yGAAyG;AACzG,6DAA6D;AAC7D,OAAO,EAAE,oBAAoB,EAA4C,MAAM,+BAA+B,CAAC;AAuB/G,wGAAwG;AACxG,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAoB;QACpC,QAAQ,EAAE,IAAI,CAAC,QAAmB;QAClC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAmB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAQ,EAAE,CAAC,CAAC;QACtH,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAO1C;IACC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;IACrB,IAAI,CAAC,CAAC,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE/D,IAAI,UAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,0BAA0B;IAC1C,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,oBAAoB,CAAC;QACnC,UAAU;QACV,iBAAiB,EAAE,KAAK,CAAC,iBAA4B;QACrD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC/C,MAAM,EAAE;YACN,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;YACrC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACtE,eAAe,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;SAC1G;KACF,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC"}

package/package.json

@@ -1,17 +1,21 @@
 {
   "name": "@agenticprimitives/a2a",
-  "version": "0.0.0-alpha.4",
+  "version": "0.0.0-alpha.40",
   "description": "Async, delegation-authorized Agent-to-Agent (A2A) task transport: Task/Message/Artifact runtime over a TaskStore port, JSON-RPC method handlers, SkillHandler dispatch, the A2aWireAdapter client, and scoped-grant caveat builders. Transport-agnostic core (spec 269 / ADR-0034); the Cloudflare TaskStoreDO ships as the ./cloudflare adapter subpath.",
+  "homepage": "https://agenticprimitives.dev",
+  "bugs": {
+    "url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
+  },
+  "author": {
+    "name": "Agentic Trust Labs",
+    "url": "https://agenticprimitives.dev"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/agentictrustlabs/agenticprimitives.git",
     "directory": "packages/a2a"
   },
-  "homepage": "https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/a2a",
-  "bugs": {
-    "url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
-  },
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -23,6 +27,14 @@
     "./cloudflare": {
       "types": "./dist/cloudflare/index.d.ts",
       "import": "./dist/cloudflare/index.js"
+    },
+    "./standard": {
+      "types": "./dist/standard/index.d.ts",
+      "import": "./dist/standard/index.js"
+    },
+    "./conform": {
+      "types": "./dist/conform/index.d.ts",
+      "import": "./dist/conform/index.js"
     }
   },
   "files": [
@@ -30,7 +42,8 @@
     "dist",
     "spec.md",
     "README.md",
-    "CLAUDE.md"
+    "CLAUDE.md",
+    "bin"
   ],
   "publishConfig": {
     "access": "public"
@@ -41,7 +54,7 @@
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20240117.0",
     "@types/node": "^22.7.0",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "a2a",
@@ -49,12 +62,21 @@
     "task",
     "delegation",
     "jsonrpc",
-    "agentic"
+    "agentic",
+    "agentic-primitives",
+    "agenticprimitives",
+    "ai-agents",
+    "agent-authority",
+    "agentic-trust"
   ],
   "dependencies": {
-    "@agenticprimitives/fulfillment": "0.0.0-alpha.5",
-    "@agenticprimitives/delegation": "1.0.0-alpha.8",
-    "@agenticprimitives/types": "1.0.0-alpha.8"
+    "@agenticprimitives/delegation": "1.0.0-alpha.39",
+    "@agenticprimitives/fulfillment": "0.0.0-alpha.36",
+    "@agenticprimitives/types": "1.0.0-alpha.39",
+    "@agenticprimitives/verification-receipts": "0.0.0-alpha.16"
+  },
+  "bin": {
+    "a2a-conform": "./bin/a2a-conform.mjs"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
@@ -62,6 +84,7 @@
     "test": "vitest run",
     "test:unit": "vitest run --passWithNoTests",
     "test:watch": "vitest",
-    "clean": "rm -rf dist"
+    "clean": "rm -rf dist",
+    "tck:sut": "tsx tck/sut.mts"
   }
 }

package/dist/jsonrpc.d.ts

@@ -1,25 +0,0 @@
-import type { A2aAgent } from './agent.js';
-export interface JsonRpcRequest {
-    jsonrpc?: string;
-    id?: string | number | null;
-    method?: string;
-    params?: unknown;
-}
-export type JsonRpcResponse = {
-    jsonrpc: '2.0';
-    id: string | number | null;
-    result: unknown;
-} | {
-    jsonrpc: '2.0';
-    id: string | number | null;
-    error: {
-        code: number;
-        message: string;
-    };
-};
-/** Dispatch a single JSON-RPC request to the agent. `message/stream` is rejected here (handled by the
- *  SSE transport). The `caller` for tasks/get|cancel is taken from `params.caller`. */
-export declare function dispatchA2aRpc(agent: A2aAgent, req: JsonRpcRequest): Promise<JsonRpcResponse>;
-/** Parse a raw JSON body + dispatch. Used by the HTTP/Cloudflare transport. */
-export declare function handleA2aRpcBody(agent: A2aAgent, rawBody: string): Promise<JsonRpcResponse>;
-//# sourceMappingURL=jsonrpc.d.ts.map

package/dist/jsonrpc.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jsonrpc.d.ts","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAqC,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AACD,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAS7F;uFACuF;AACvF,wBAAsB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAiCnG;AAED,+EAA+E;AAC/E,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAIjG"}

package/dist/jsonrpc.js

@@ -1,52 +0,0 @@
-const PARSE_ERROR = -32700;
-const INVALID_REQUEST = -32600;
-const METHOD_NOT_FOUND = -32601;
-const err = (id, code, message) => ({ jsonrpc: '2.0', id, error: { code, message } });
-const ok = (id, result) => ({ jsonrpc: '2.0', id, result });
-/** Dispatch a single JSON-RPC request to the agent. `message/stream` is rejected here (handled by the
- *  SSE transport). The `caller` for tasks/get|cancel is taken from `params.caller`. */
-export async function dispatchA2aRpc(agent, req) {
-    const id = req.id ?? null;
-    if (req.jsonrpc !== '2.0' || typeof req.method !== 'string') {
-        return err(id, INVALID_REQUEST, 'not a JSON-RPC 2.0 request');
-    }
-    const p = (req.params ?? {});
-    switch (req.method) {
-        case 'message/send': {
-            const r = await agent.messageSend(p);
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        case 'tasks/resubmit': {
-            const r = await agent.resubmit(p);
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        case 'tasks/get': {
-            const r = await agent.tasksGet({ taskId: p.taskId, caller: p.caller });
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        case 'tasks/cancel': {
-            const r = await agent.tasksCancel({ taskId: p.taskId, caller: p.caller });
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        case 'tasks/pushNotificationConfig/set': {
-            const r = await agent.pushConfigSet({ taskId: p.taskId, caller: p.caller, url: p.url, token: p.token });
-            return r.ok ? ok(id, r.result) : err(id, r.code, r.message);
-        }
-        case 'message/stream':
-            return err(id, INVALID_REQUEST, 'message/stream must use the SSE transport, not the JSON-RPC body');
-        default:
-            return err(id, METHOD_NOT_FOUND, `unknown method: ${req.method}`);
-    }
-}
-/** Parse a raw JSON body + dispatch. Used by the HTTP/Cloudflare transport. */
-export async function handleA2aRpcBody(agent, rawBody) {
-    let req;
-    try {
-        req = JSON.parse(rawBody);
-    }
-    catch {
-        return err(null, PARSE_ERROR, 'invalid JSON');
-    }
-    return dispatchA2aRpc(agent, req);
-}
-//# sourceMappingURL=jsonrpc.js.map

package/dist/jsonrpc.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jsonrpc.js","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC;AAC3B,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC;AAC/B,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAEhC,MAAM,GAAG,GAAG,CAAC,EAA0B,EAAE,IAAY,EAAE,OAAe,EAAmB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAC/I,MAAM,EAAE,GAAG,CAAC,EAA0B,EAAE,MAAe,EAAmB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9G;uFACuF;AACvF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAe,EAAE,GAAmB;IACvE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,GAAG,CAAC,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAExD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAiC,CAAC,CAAC;YACrE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAA8B,CAAC,CAAC;YAC/D,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAiB,EAAE,CAAC,CAAC;YACzF,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAiB,EAAE,CAAC,CAAC;YAC5F,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,kCAAkC,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAa,EAAE,KAAK,EAAE,CAAC,CAAC,KAA2B,EAAE,CAAC,CAAC;YAC1J,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,GAAG,CAAC,EAAE,EAAE,eAAe,EAAE,kEAAkE,CAAC,CAAC;QACtG;YACE,OAAO,GAAG,CAAC,EAAE,EAAE,gBAAgB,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAe,EAAE,OAAe;IACrE,IAAI,GAAmB,CAAC;IACxB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IAAC,CAAC;IAC3F,OAAO,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC"}